* New upstream SVN snapshot.
[debian/madwifi.git] / net80211 / ieee80211_input.c
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  * $Id: ieee80211_input.c 4165 2011-08-15 19:10:12Z proski $
33  */
34 #ifndef EXPORT_SYMTAB
35 #define EXPORT_SYMTAB
36 #endif
37
38 /*
39  * IEEE 802.11 input handling.
40  */
41 #if !defined(AUTOCONF_INCLUDED) && !defined(CONFIG_LOCALVERSION)
42 #include <linux/config.h>
43 #endif
44 #include <linux/version.h>
45 #include <linux/module.h>
46 #include <linux/skbuff.h>
47 #include <linux/netdevice.h>
48 #include <linux/etherdevice.h>
49 #include <linux/random.h>
50 #include <linux/if_vlan.h>
51 #include <net/iw_handler.h> /* wireless_send_event(..) */
52 #include <linux/wireless.h> /* SIOCGIWTHRSPY */
53 #include <linux/if_arp.h> /* ARPHRD_ETHER */
54
55 #include <net80211/if_llc.h>
56 #include <net80211/if_ethersubr.h>
57 #include <net80211/if_media.h>
58 #include <net80211/if_athproto.h>
59
60 #include <net80211/ieee80211_var.h>
61
62 #ifdef IEEE80211_DEBUG
63 /*
64  * Decide if a received management frame should be
65  * printed when debugging is enabled.  This filters some
66  * of the less interesting frames that come frequently
67  * (e.g. beacons).
68  */
69 static __inline int
70 doprint(struct ieee80211vap *vap, int subtype)
71 {
72         switch (subtype) {
73         case IEEE80211_FC0_SUBTYPE_BEACON:
74                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
75         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
76                 return (vap->iv_opmode == IEEE80211_M_IBSS);
77         }
78         return 1;
79 }
80
81 /*
82  * Emit a debug message about discarding a frame or information
83  * element.  One format is for extracting the mac address from
84  * the frame header; the other is for when a header is not
85  * available or otherwise appropriate.
86  */
87 #define IEEE80211_DISCARD(_vap, _m, _wh, _type, _fmt, ...) do {         \
88         if ((_vap)->iv_debug & (_m))                                    \
89                 ieee80211_discard_frame(_vap, _wh, _type, _fmt, __VA_ARGS__);\
90 } while (0)
91 #define IEEE80211_DISCARD_IE(_vap, _m, _wh, _type, _fmt, ...) do {      \
92         if ((_vap)->iv_debug & (_m))                                    \
93                 ieee80211_discard_ie(_vap, _wh, _type, _fmt, __VA_ARGS__);\
94 } while (0)
95 #define IEEE80211_DISCARD_MAC(_vap, _m, _mac, _type, _fmt, ...) do {    \
96         if ((_vap)->iv_debug & (_m))                                    \
97                 ieee80211_discard_mac(_vap, _mac, _type, _fmt, __VA_ARGS__);\
98 } while (0)
99
100 static const u_int8_t *ieee80211_getbssid(struct ieee80211vap *,
101         const struct ieee80211_frame *);
102 static void ieee80211_discard_frame(struct ieee80211vap *,
103         const struct ieee80211_frame *, const char *, const char *, ...);
104 static void ieee80211_discard_ie(struct ieee80211vap *,
105         const struct ieee80211_frame *, const char *, const char *, ...);
106 static void ieee80211_discard_mac(struct ieee80211vap *,
107         const u_int8_t mac[IEEE80211_ADDR_LEN], const char *,
108         const char *, ...);
109 #else
110 #define IEEE80211_DISCARD(_vap, _m, _wh, _type, _fmt, ...)
111 #define IEEE80211_DISCARD_IE(_vap, _m, _wh, _type, _fmt, ...)
112 #define IEEE80211_DISCARD_MAC(_vap, _m, _mac, _type, _fmt, ...)
113 #endif /* IEEE80211_DEBUG */
114
115 static struct sk_buff *ieee80211_defrag(struct ieee80211_node *,
116         struct sk_buff *, int);
117 static void ieee80211_deliver_data(struct ieee80211_node *, struct sk_buff *);
118 static struct sk_buff *ieee80211_decap(struct ieee80211vap *,
119         struct sk_buff *, int);
120 static void ieee80211_send_error(struct ieee80211_node *, const u_int8_t *,
121         int, int);
122 static void ieee80211_recv_pspoll(struct ieee80211_node *, struct sk_buff *);
123 static int accept_data_frame(struct ieee80211vap *, struct ieee80211_node *,
124         struct ieee80211_key *, struct sk_buff *, struct ether_header *);
125
126
127 #ifdef ATH_SUPERG_FF
128 static void athff_decap(struct sk_buff *);
129 #endif
130 #ifdef USE_HEADERLEN_RESV
131 static __be16 ath_eth_type_trans(struct sk_buff *, struct net_device *);
132 #endif
133
134 #if WIRELESS_EXT >= 16
135 /**
136  * Given a node and the RSSI value of a just received frame from the node, this
137  * function checks if to raise an iwspy event because we iwspy the node and RSSI
138  * exceeds threshold (if active).
139  * 
140  * @param vap: VAP
141  * @param ni: sender node
142  * @param rssi: RSSI value of received frame
143  */
144 static void
145 iwspy_event(struct ieee80211vap *vap, struct ieee80211_node *ni, u_int rssi)
146 {
147         if (vap->iv_spy.thr_low && vap->iv_spy.num && ni && (rssi <
148                 vap->iv_spy.thr_low || rssi > vap->iv_spy.thr_high)) {
149                 int i;
150                 for (i = 0; i < vap->iv_spy.num; i++) {
151                         if (IEEE80211_ADDR_EQ(ni->ni_macaddr,
152                                 &(vap->iv_spy.mac[i * IEEE80211_ADDR_LEN]))) {
153                                         
154                                 union iwreq_data wrq;
155                                 struct iw_thrspy thr;
156                                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_DEBUG,
157                                         "%s: we spy %s, threshold is active "
158                                         "and rssi exceeds it -> raise an iwspy"
159                                         " event\n", __func__, ether_sprintf(
160                                          ni->ni_macaddr));
161                                 memset(&wrq, 0, sizeof(wrq));
162                                 wrq.data.length = 1;
163                                 memset(&thr, 0, sizeof(struct iw_thrspy));
164                                 memcpy(thr.addr.sa_data, ni->ni_macaddr,
165                                         IEEE80211_ADDR_LEN);
166                                 thr.addr.sa_family = ARPHRD_ETHER;
167                                 set_quality(&thr.qual, rssi, vap->iv_ic->ic_channoise);
168                                 set_quality(&thr.low, vap->iv_spy.thr_low, vap->iv_ic->ic_channoise);
169                                 set_quality(&thr.high, vap->iv_spy.thr_high, vap->iv_ic->ic_channoise);
170                                 wireless_send_event(vap->iv_dev,
171                                         SIOCGIWTHRSPY, &wrq, (char*) &thr);
172                                 break;
173                         }
174                 }
175         }
176 }
177
178 #else
179 #define iwspy_event(_vap, _ni, _rssi)
180 #endif /* WIRELESS_EXT >= 16 */
181
182 /*
183  * Process a received frame.  The node associated with the sender
184  * should be supplied.  If nothing was found in the node table then
185  * the caller is assumed to supply a reference to ic_bss instead.
186  * The RSSI and a timestamp are also supplied.  The RSSI data is used
187  * during AP scanning to select a AP to associate with; it can have
188  * any units so long as values have consistent units and higher values
189  * mean ``better signal''.  The receive timestamp is currently not used
190  * by the 802.11 layer.
191  *
192  * Context: softIRQ (tasklet)
193  */
194 int
195 ieee80211_input(struct ieee80211_node *ni,
196         struct sk_buff *skb, int rssi, u_int32_t rstamp)
197 {
198 #define HAS_SEQ(type)   ((type & 0x4) == 0)
199         struct ieee80211vap *vap = ni->ni_vap;
200         struct ieee80211com *ic = vap->iv_ic;
201         struct net_device *dev = vap->iv_dev;
202         struct ieee80211_frame *wh;
203         struct ieee80211_key *key;
204         struct ether_header *eh;
205 #ifdef ATH_SUPERG_FF
206         struct llc *llc;
207 #endif
208         int hdrspace;
209         u_int8_t dir, type, subtype;
210         u_int8_t *bssid;
211         u_int16_t rxseq;
212
213         KASSERT(ni != NULL, ("null node"));
214         ni->ni_inact = ni->ni_inact_reload;
215
216         KASSERT(skb->len >= sizeof(struct ieee80211_frame_min),
217                 ("frame length too short: %u", skb->len));
218
219         /* XXX adjust device in sk_buff? */
220
221         type = -1;                      /* undefined */
222         /*
223          * In monitor mode, send everything directly to bpf.
224          * Also do not process frames w/o i_addr2 any further.
225          * XXX may want to include the CRC
226          */
227         if (vap->iv_opmode == IEEE80211_M_MONITOR)
228                 goto out;
229
230         if (skb->len < sizeof(struct ieee80211_frame_min)) {
231                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
232                         ni->ni_macaddr, NULL,
233                         "too short (1): len %u", skb->len);
234                 vap->iv_stats.is_rx_tooshort++;
235                 goto out;
236         }
237         /*
238          * Bit of a cheat here, we use a pointer for a 3-address
239          * frame format but don't reference fields past outside
240          * ieee80211_frame_min w/o first validating the data is
241          * present.
242          */
243         wh = (struct ieee80211_frame *)skb->data;
244
245         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
246             IEEE80211_FC0_VERSION_0) {
247                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
248                         ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
249                 vap->iv_stats.is_rx_badversion++;
250                 goto err;
251         }
252
253         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
254         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
255         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
256         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
257                 switch (vap->iv_opmode) {
258                 case IEEE80211_M_STA:
259                         bssid = wh->i_addr2;
260                         if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
261                                 /* not interested in */
262                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
263                                         bssid, NULL, "%s", "not to bss");
264                                 vap->iv_stats.is_rx_wrongbss++;
265                                 goto out;
266                         }
267                         iwspy_event(vap, ni, rssi);
268                         break;
269                 case IEEE80211_M_IBSS:
270                 case IEEE80211_M_AHDEMO:
271                         if (dir != IEEE80211_FC1_DIR_NODS)
272                                 bssid = wh->i_addr1;
273                         else if (type == IEEE80211_FC0_TYPE_CTL)
274                                 bssid = wh->i_addr1;
275                         else {
276                                 if (skb->len < sizeof(struct ieee80211_frame)) {
277                                         IEEE80211_DISCARD_MAC(vap,
278                                                 IEEE80211_MSG_ANY, ni->ni_macaddr,
279                                                 NULL, "too short (2): len %u",
280                                                 skb->len);
281                                         vap->iv_stats.is_rx_tooshort++;
282                                         goto out;
283                                 }
284                                 bssid = wh->i_addr3;
285                         }
286                         /* Do not try to find a node reference if the packet really did come from the BSS */
287                         if (type == IEEE80211_FC0_TYPE_DATA && ni == vap->iv_bss &&
288                                         !IEEE80211_ADDR_EQ(vap->iv_bss->ni_macaddr, wh->i_addr2)) {
289                                 /* Try to find sender in local node table. */
290                                 ni = ieee80211_find_node(vap->iv_bss->ni_table, wh->i_addr2);
291                                 if (ni == NULL) {
292                                         /*
293                                          * Fake up a node for this newly discovered
294                                          * member of the IBSS.  This should probably
295                                          * done after an ACL check.
296                                          */
297                                         ni = ieee80211_fakeup_adhoc_node(vap,
298                                                         wh->i_addr2);
299                                         if (ni == NULL) {
300                                                 /* NB: stat kept for alloc failure */
301                                                 goto err;
302                                         }
303                                 }
304                         }
305                         iwspy_event(vap, ni, rssi);
306                         break;
307                 case IEEE80211_M_HOSTAP:
308                         if (dir != IEEE80211_FC1_DIR_NODS)
309                                 bssid = wh->i_addr1;
310                         else if (type == IEEE80211_FC0_TYPE_CTL)
311                                 bssid = wh->i_addr1;
312                         else {
313                                 if (skb->len < sizeof(struct ieee80211_frame)) {
314                                         IEEE80211_DISCARD_MAC(vap,
315                                                 IEEE80211_MSG_ANY, ni->ni_macaddr,
316                                                 NULL, "too short (2): len %u",
317                                                 skb->len);
318                                         vap->iv_stats.is_rx_tooshort++;
319                                         goto out;
320                                 }
321                                 bssid = wh->i_addr3;
322                         }
323                         /*
324                          * Validate the bssid.
325                          */
326 #ifdef ATH_SUPERG_XR
327                         if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
328                             !IEEE80211_ADDR_EQ(bssid, dev->broadcast)) {
329                                 /*
330                                  * allow MGT frames to vap->iv_xrvap.
331                                  * this will allow roaming between  XR and normal vaps
332                                  * without station dis associating from previous vap.
333                                  */
334                                 if (!(vap->iv_xrvap && 
335                                     IEEE80211_ADDR_EQ(bssid, vap->iv_xrvap->iv_bss->ni_bssid) &&
336                                     type == IEEE80211_FC0_TYPE_MGT && 
337                                     ni != vap->iv_bss)) {
338                                         /* not interested in */
339                                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
340                                                 bssid, NULL, "%s", "not to bss or xrbss");
341                                         vap->iv_stats.is_rx_wrongbss++;
342                                         goto out;
343                                 }
344                         }
345 #else
346                         if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
347                             !IEEE80211_ADDR_EQ(bssid, dev->broadcast)) {
348                                 /* not interested in */
349                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
350                                         bssid, NULL, "%s", "not to bss");
351                                 vap->iv_stats.is_rx_wrongbss++;
352                                 goto out;
353                         }
354
355 #endif
356                         break;
357                 case IEEE80211_M_WDS:
358                         if (skb->len < sizeof(struct ieee80211_frame_addr4)) {
359                                 IEEE80211_DISCARD_MAC(vap,
360                                         IEEE80211_MSG_ANY, ni->ni_macaddr,
361                                         NULL, "too short (3): len %u",
362                                         skb->len);
363                                 vap->iv_stats.is_rx_tooshort++;
364                                 goto out;
365                         }
366                         bssid = wh->i_addr1;
367                         if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
368                             !IEEE80211_ADDR_EQ(bssid, dev->broadcast)) {
369                                 /* not interested in */
370                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
371                                         bssid, NULL, "%s", "not to bss");
372                                 vap->iv_stats.is_rx_wrongbss++;
373                                 goto out;
374                         }
375                         if (!IEEE80211_ADDR_EQ(wh->i_addr2, vap->wds_mac)) {
376                                 /* not interested in */
377                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
378                                         wh->i_addr2, NULL, "%s", "not from DS");
379                                 vap->iv_stats.is_rx_wrongbss++;
380                                 goto out;       
381                         }
382                         break;
383                 default:
384                         /* XXX catch bad values */
385                         goto out;
386                 }
387                 ni->ni_rssi = rssi;
388                 ni->ni_rstamp = rstamp;
389                 ni->ni_last_rx = jiffies;
390                 if (HAS_SEQ(type)) {
391                         u_int8_t tid;
392                         if (IEEE80211_QOS_HAS_SEQ(wh)) {
393                                 tid = ((struct ieee80211_qosframe *)wh)->
394                                         i_qos[0] & IEEE80211_QOS_TID;
395                                 if (TID_TO_WME_AC(tid) >= WME_AC_VI)
396                                         ic->ic_wme.wme_hipri_traffic++;
397                                 tid++;
398                         } else
399                                 tid = 0;
400                         rxseq = le16toh(*(__le16 *)wh->i_seq);
401                         if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
402                             IEEE80211_SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
403                                 /* duplicate, discard */
404                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
405                                         bssid, "duplicate",
406                                         "seqno <%u,%u> fragno <%u,%u> tid %u",
407                                         rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
408                                         ni->ni_rxseqs[tid] >>
409                                                 IEEE80211_SEQ_SEQ_SHIFT,
410                                         rxseq & IEEE80211_SEQ_FRAG_MASK,
411                                         ni->ni_rxseqs[tid] &
412                                                 IEEE80211_SEQ_FRAG_MASK,
413                                         tid);
414                                 vap->iv_stats.is_rx_dup++;
415                                 IEEE80211_NODE_STAT(ni, rx_dup);
416                                 goto out;
417                         }
418                         ni->ni_rxseqs[tid] = rxseq;
419                 }
420         }
421
422         switch (type) {
423         case IEEE80211_FC0_TYPE_DATA:
424                 hdrspace = ieee80211_hdrspace(ic, wh);
425                 if (skb->len < hdrspace) {
426                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
427                                 wh, "data", "too short: len %u, expecting %u",
428                                 skb->len, hdrspace);
429                         vap->iv_stats.is_rx_tooshort++;
430                         goto out;               /* XXX */
431                 }
432                 switch (vap->iv_opmode) {
433                 case IEEE80211_M_STA:
434                         if ((dir != IEEE80211_FC1_DIR_FROMDS) &&
435                             (!((vap->iv_flags_ext & IEEE80211_FEXT_WDS) &&
436                             (dir == IEEE80211_FC1_DIR_DSTODS)))) {
437                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
438                                         wh, "data", "invalid dir 0x%x", dir);
439                                 vap->iv_stats.is_rx_wrongdir++;
440                                 goto out;
441                         }
442                         if ((dev->flags & IFF_MULTICAST) &&
443                             IEEE80211_IS_MULTICAST(wh->i_addr1)) {
444                                 if (IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr)) {
445                                         /*
446                                          * In IEEE802.11 network, multicast packet
447                                          * sent from me is broadcasted from AP.
448                                          * It should be silently discarded for
449                                          * SIMPLEX interface.
450                                          *
451                                          * NB: Linux has no IFF_ flag to indicate
452                                          *     if an interface is SIMPLEX or not;
453                                          *     so we always assume it to be true.
454                                          */
455                                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
456                                                 wh, NULL, "%s", "multicast echo");
457                                         vap->iv_stats.is_rx_mcastecho++;
458                                         goto out;
459                                 }
460                                 /* 
461                                  * if it is brodcasted by me on behalf of
462                                  * a station behind me, drop it.
463                                  */
464                                 if (vap->iv_flags_ext & IEEE80211_FEXT_WDS) {
465                                         struct ieee80211_node_table *nt;
466                                         struct ieee80211_node *ni_wds;
467                                         nt = &ic->ic_sta;
468                                         ni_wds = ieee80211_find_wds_node(nt, wh->i_addr3);
469                                         if (ni_wds) {
470                                                 ieee80211_free_node(ni_wds); /* Decr ref count */
471                                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
472                                                         wh, NULL, "%s",
473                                                         "multicast echo originated from node behind me");
474                                                 vap->iv_stats.is_rx_mcastecho++;
475                                                 goto out;
476                                         } 
477                                 }
478                         }
479                         break;
480                 case IEEE80211_M_IBSS:
481                 case IEEE80211_M_AHDEMO:
482                         if (dir != IEEE80211_FC1_DIR_NODS) {
483                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
484                                         wh, "data", "invalid dir 0x%x", dir);
485                                 vap->iv_stats.is_rx_wrongdir++;
486                                 goto out;
487                         }
488                         /* XXX no power-save support */
489                         break;
490                 case IEEE80211_M_HOSTAP:
491                         if ((dir != IEEE80211_FC1_DIR_TODS) &&
492                             (dir != IEEE80211_FC1_DIR_DSTODS)) {
493                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
494                                         wh, "data", "invalid dir 0x%x", dir);
495                                 vap->iv_stats.is_rx_wrongdir++;
496                                 goto out;
497                         }
498                         /* check if source STA is associated */
499                         if (ni == vap->iv_bss) {
500                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
501                                         wh, "data", "%s", "unknown src");
502                                 /* NB: caller deals with reference */
503                                 if (vap->iv_state == IEEE80211_S_RUN)
504                                         ieee80211_send_error(ni, wh->i_addr2,
505                                                 IEEE80211_FC0_SUBTYPE_DEAUTH,
506                                                 IEEE80211_REASON_NOT_AUTHED);
507                                 vap->iv_stats.is_rx_notassoc++;
508                                 goto err;
509                         }
510                         if (ni->ni_associd == 0) {
511                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
512                                         wh, "data", "%s", "unassoc src");
513                                 IEEE80211_SEND_MGMT(ni,
514                                         IEEE80211_FC0_SUBTYPE_DISASSOC,
515                                         IEEE80211_REASON_NOT_ASSOCED);
516                                 vap->iv_stats.is_rx_notassoc++;
517                                 goto err;
518                         }
519                         /*
520                          * If we're a 4 address packet, make sure we have an entry in
521                          * the node table for the packet source address (addr4).
522                          * If not, add one.
523                          */
524                         if (dir == IEEE80211_FC1_DIR_DSTODS) {
525                                 struct ieee80211_node_table *nt;
526                                 struct ieee80211_frame_addr4 *wh4;
527                                 struct ieee80211_node *ni_wds;
528                                 if (!(vap->iv_flags_ext & IEEE80211_FEXT_WDS)) {
529                                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
530                                                 wh, "data", "%s", "4 addr not allowed");
531                                         goto err;
532                                 }
533                                 wh4 = (struct ieee80211_frame_addr4 *)skb->data;
534                                 nt = &ic->ic_sta;
535                                 ni_wds = ieee80211_find_wds_node(nt, wh4->i_addr4);
536                                 /* Last call increments ref count if !NULL */
537                                 if ((ni_wds != NULL) && (ni_wds != ni)) {
538                                         /*
539                                          * node with source address (addr4) moved
540                                          * to another WDS capable station. remove the
541                                          * reference to the previous station and add 
542                                          * reference to the new one
543                                          */
544                                          (void) ieee80211_remove_wds_addr(nt, wh4->i_addr4);
545                                          ieee80211_add_wds_addr(nt, ni, wh4->i_addr4, 0);
546                                 }
547                                 if (ni_wds == NULL)
548                                         ieee80211_add_wds_addr(nt, ni, wh4->i_addr4, 0);
549                                 else
550                                         ieee80211_free_node(ni_wds); /* Decr ref count */
551                         }
552                         
553                         /*
554                          * Check for power save state change.
555                          */
556                         if (!(ni->ni_flags & IEEE80211_NODE_UAPSD)) {
557                                 if ((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
558                                     (ni->ni_flags & IEEE80211_NODE_PWR_MGT))
559                                         ieee80211_node_pwrsave(ni, wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
560                         } else if (ni->ni_flags & IEEE80211_NODE_PS_CHANGED) {
561                                 int pwr_save_changed = 0;
562                                 IEEE80211_LOCK_IRQ(ic);
563                                 if ((*(__le16 *)(&wh->i_seq[0])) == ni->ni_pschangeseq) {
564                                         ni->ni_flags &= ~IEEE80211_NODE_PS_CHANGED;
565                                         pwr_save_changed = 1;
566                                 }
567                                 IEEE80211_UNLOCK_IRQ(ic);
568                                 if (pwr_save_changed)
569                                         ieee80211_node_pwrsave(ni, wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
570                         }
571                         break;
572                 case IEEE80211_M_WDS:
573                         if (dir != IEEE80211_FC1_DIR_DSTODS) {
574                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
575                                         wh, "data", "invalid dir 0x%x", dir);
576                                 vap->iv_stats.is_rx_wrongdir++;
577                                 goto out;
578                         }
579                         break;
580                 default:
581                         /* XXX here to keep compiler happy */
582                         goto out;
583                 }
584
585                 /*
586                  * Handle privacy requirements.  Note that we
587                  * must not be preempted from here until after
588                  * we (potentially) call ieee80211_crypto_demic;
589                  * otherwise we may violate assumptions in the
590                  * crypto cipher modules used to do delayed update
591                  * of replay sequence numbers.
592                  */
593                 if (wh->i_fc[1] & IEEE80211_FC1_PROT) {
594                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
595                                 /*
596                                  * Discard encrypted frames when privacy is off.
597                                  */
598                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
599                                         wh, "WEP", "%s", "PRIVACY off");
600                                 vap->iv_stats.is_rx_noprivacy++;
601                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
602                                 goto out;
603                         }
604                         key = ieee80211_crypto_decap(ni, skb, hdrspace);
605                         if (key == NULL) {
606                                 /* NB: stats+msgs handled in crypto_decap */
607                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
608                                 goto out;
609                         }
610                         wh = (struct ieee80211_frame *)skb->data;
611                         wh->i_fc[1] &= ~IEEE80211_FC1_PROT;
612                 } else
613                         key = NULL;
614
615                 /*
616                  * Next up, any fragmentation.
617                  */
618                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
619                         skb = ieee80211_defrag(ni, skb, hdrspace);
620                         if (skb == NULL) {
621                                 /* Fragment dropped or frame not complete yet */
622                                 goto out;
623                         }
624                 }
625                 wh = NULL;              /* no longer valid, catch any uses */
626
627                 /*
628                  * Next strip any MSDU crypto bits.
629                  */
630                 if (key != NULL &&
631                     !ieee80211_crypto_demic(vap, key, skb, hdrspace)) {
632                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
633                                 ni->ni_macaddr, "data", "%s", "demic error");
634                         IEEE80211_NODE_STAT(ni, rx_demicfail);
635                         goto out;
636                 }
637
638                 /*
639                  * Finally, strip the 802.11 header.
640                  */
641                 skb = ieee80211_decap(vap, skb, hdrspace);
642                 if (skb == NULL) {
643                         /* don't count Null data frames as errors */
644                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA)
645                                 goto out;
646                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
647                                 ni->ni_macaddr, "data", "%s", "decap error");
648                         vap->iv_stats.is_rx_decap++;
649                         IEEE80211_NODE_STAT(ni, rx_decap);
650                         goto err;
651                 }
652                 eh = (struct ether_header *) skb->data;
653
654                 if (! accept_data_frame(vap, ni, key, skb, eh))
655                         goto out;
656
657                 vap->iv_devstats.rx_packets++;
658                 vap->iv_devstats.rx_bytes += skb->len;
659                 IEEE80211_NODE_STAT(ni, rx_data);
660                 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, skb->len);
661                 ic->ic_lastdata = jiffies;
662
663 #ifdef ATH_SUPERG_FF
664                 /* check for FF */
665                 llc = (struct llc *) (skb->data + sizeof(struct ether_header));
666                 if (ntohs(llc->llc_snap.ether_type) == (u_int16_t)ATH_ETH_TYPE) {
667                         struct sk_buff *skb1 = NULL;
668                         struct ether_header *eh_tmp;
669                         struct athl2p_tunnel_hdr *ath_hdr;
670                         int frame_len;
671
672                         /* NB: assumes linear (i.e., non-fragmented) skb */
673
674                         /* check length > header */
675                         if (skb->len < sizeof(struct ether_header) + LLC_SNAPFRAMELEN
676                             + roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2) {
677                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
678                                         ni->ni_macaddr, "data", "%s", "decap error");
679                                         vap->iv_stats.is_rx_decap++;
680                                 IEEE80211_NODE_STAT(ni, rx_decap);
681                                 goto err;
682                         }
683
684                         /* get to the tunneled headers */
685                         ath_hdr = (struct athl2p_tunnel_hdr *)
686                                 skb_pull(skb, sizeof(struct ether_header) + LLC_SNAPFRAMELEN);
687                         eh_tmp = (struct ether_header *)
688                                 skb_pull(skb, roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2);
689                         /* sanity check for malformed 802.3 length */
690                         frame_len = ntohs(eh_tmp->ether_type);
691                         if (skb->len < roundup(sizeof(struct ether_header) + frame_len, 4)) {
692                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
693                                         ni->ni_macaddr, "data", "%s", "decap error");
694                                         vap->iv_stats.is_rx_decap++;
695                                 IEEE80211_NODE_STAT(ni, rx_decap);
696                                 goto err;
697                         }
698
699                         /* only implementing FF now. drop all others. */
700                         if (ath_hdr->proto != ATH_L2TUNNEL_PROTO_FF) {
701                                 IEEE80211_DISCARD_MAC(vap,
702                                         IEEE80211_MSG_SUPG | IEEE80211_MSG_INPUT,
703                                         eh->ether_shost, "fast-frame",
704                                         "bad atheros tunnel prot %u",
705                                         ath_hdr->proto);
706                                 vap->iv_stats.is_rx_badathtnl++;
707                                 goto err;
708                         }
709                         vap->iv_stats.is_rx_ffcnt++;
710                         
711                         skb1 = skb_clone(skb, GFP_ATOMIC); /* XXX: GFP_ATOMIC is overkill? */
712
713                         /* we now have 802.3 MAC hdr followed by 802.2 LLC/SNAP. convert to DIX */
714                         athff_decap(skb);
715
716                         /* remove second frame from end of first */
717                         skb_trim(skb, sizeof(struct ether_header) + frame_len - LLC_SNAPFRAMELEN);
718
719                         /* prepare second tunneled frame */
720                         skb_pull(skb1, roundup(sizeof(struct ether_header) + frame_len, 4));
721                         athff_decap(skb1);
722
723                         /* deliver the frames */
724                         ieee80211_deliver_data(ni, skb);
725                         ieee80211_deliver_data(ni, skb1);
726                 } else {
727                         /* assume non-atheros llc type */
728                         ieee80211_deliver_data(ni, skb);
729                 }
730 #else /* !ATH_SUPERG_FF */
731                 ieee80211_deliver_data(ni, skb);
732 #endif
733                 return IEEE80211_FC0_TYPE_DATA;
734
735         case IEEE80211_FC0_TYPE_MGT:
736                 /*
737                  * WDS opmode do not support management frames
738                  */
739                 if (vap->iv_opmode == IEEE80211_M_WDS) {
740                         vap->iv_stats.is_rx_mgtdiscard++;
741                         goto out;
742                 }
743                 IEEE80211_NODE_STAT(ni, rx_mgmt);
744                 if (dir != IEEE80211_FC1_DIR_NODS) {
745                         vap->iv_stats.is_rx_wrongdir++;
746                         goto err;
747                 }
748                 if (skb->len < sizeof(struct ieee80211_frame)) {
749                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
750                                 ni->ni_macaddr, "mgt", "too short: len %u",
751                                 skb->len);
752                         vap->iv_stats.is_rx_tooshort++;
753                         goto out;
754                 }
755 #ifdef IEEE80211_DEBUG
756                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
757                     ieee80211_msg_dumppkts(vap)) {
758                         ieee80211_note(vap, "received %s from %s rssi %d\n",
759                                 ieee80211_mgt_subtype_name[subtype >>
760                                 IEEE80211_FC0_SUBTYPE_SHIFT],
761                                 ether_sprintf(wh->i_addr2), rssi);
762                 }
763 #endif
764                 if (wh->i_fc[1] & IEEE80211_FC1_PROT) {
765                         if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
766                                 /*
767                                  * Only shared key auth frames with a challenge
768                                  * should be encrypted, discard all others.
769                                  */
770                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
771                                         wh, ieee80211_mgt_subtype_name[subtype >>
772                                         IEEE80211_FC0_SUBTYPE_SHIFT],
773                                         "%s", "WEP set but not permitted");
774                                 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
775                                 goto out;
776                         }
777                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
778                                 /*
779                                  * Discard encrypted frames when privacy is off.
780                                  */
781                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
782                                         wh, "mgt", "%s", "WEP set but PRIVACY off");
783                                 vap->iv_stats.is_rx_noprivacy++;
784                                 goto out;
785                         }
786                         hdrspace = ieee80211_hdrspace(ic, wh);
787                         key = ieee80211_crypto_decap(ni, skb, hdrspace);
788                         if (key == NULL) {
789                                 /* NB: stats+msgs handled in crypto_decap */
790                                 goto out;
791                         }
792                         wh = (struct ieee80211_frame *)skb->data;
793                         wh->i_fc[1] &= ~IEEE80211_FC1_PROT;
794                 }
795                 ic->ic_recv_mgmt(ni, skb, subtype, rssi, rstamp);
796                 goto out;
797
798         case IEEE80211_FC0_TYPE_CTL:
799                 IEEE80211_NODE_STAT(ni, rx_ctrl);
800                 vap->iv_stats.is_rx_ctl++;
801                 if (vap->iv_opmode == IEEE80211_M_HOSTAP)
802                         if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
803                                 ieee80211_recv_pspoll(ni, skb);
804                 goto out;
805
806         default:
807                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
808                         wh, NULL, "bad frame type 0x%x", type);
809                 /* should not come here */
810                 break;
811         }
812 err:
813         vap->iv_devstats.rx_errors++;
814 out:
815         if (skb != NULL)
816                 dev_kfree_skb(skb);
817         return type;
818 #undef HAS_SEQ
819 }
820 EXPORT_SYMBOL(ieee80211_input);
821
822
823 /*
824  * Determines whether a frame should be accepted, based on information
825  * about the frame's origin and encryption, and policy for this vap.
826  */
827 static int accept_data_frame(struct ieee80211vap *vap,
828        struct ieee80211_node *ni, struct ieee80211_key *key,
829        struct sk_buff *skb, struct ether_header *eh)
830 {
831 #define IS_EAPOL(eh) ((eh)->ether_type == __constant_htons(ETHERTYPE_PAE))
832 #define PAIRWISE_SET(vap) ((vap)->iv_nw_keys[0].wk_cipher != &ieee80211_cipher_none)
833        if (IS_EAPOL(eh)) {
834                /* encrypted eapol is always OK */
835                if (key)
836                        return 1;
837                /* cleartext eapol is OK if we don't have pairwise keys yet */
838                if (! PAIRWISE_SET(vap))
839                        return 1;
840                /* cleartext eapol is OK if configured to allow it */
841                if (! IEEE80211_VAP_DROPUNENC_EAPOL(vap))
842                        return 1;
843                /* cleartext eapol is OK if other unencrypted is OK */
844                if (! (vap->iv_flags & IEEE80211_F_DROPUNENC))
845                        return 1;
846                /* not OK */
847                IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
848                        eh->ether_shost, "data",
849                        "unauthorized port: ether type 0x%x len %u",
850                        ntohs(eh->ether_type), skb->len);
851                vap->iv_stats.is_rx_unauth++;
852                vap->iv_devstats.rx_errors++;
853                IEEE80211_NODE_STAT(ni, rx_unauth);
854                return 0;
855        }
856
857        if (!ieee80211_node_is_authorized(ni)) {
858                /*
859                 * Deny any non-PAE frames received prior to
860                 * authorization.  For open/shared-key
861                 * authentication the port is mark authorized
862                 * after authentication completes.  For 802.1x
863                 * the port is not marked authorized by the
864                 * authenticator until the handshake has completed.
865                 */
866                IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
867                        eh->ether_shost, "data",
868                        "unauthorized port: ether type 0x%x len %u",
869                        ntohs(eh->ether_type), skb->len);
870                vap->iv_stats.is_rx_unauth++;
871                vap->iv_devstats.rx_errors++;
872                IEEE80211_NODE_STAT(ni, rx_unauth);
873                return 0;
874        } else {
875                /*
876                 * When denying unencrypted frames, discard
877                 * any non-PAE frames received without encryption.
878                 */
879                if ((vap->iv_flags & IEEE80211_F_DROPUNENC) && key == NULL) {
880                        IEEE80211_NODE_STAT(ni, rx_unencrypted);
881                        return 0;
882                }
883        }
884        return 1;
885
886 #undef IS_EAPOL
887 #undef PAIRWISE_SET
888 }
889
890
891 /*
892  * Context: softIRQ (tasklet)
893  */
894 int
895 ieee80211_input_all(struct ieee80211com *ic,
896         struct sk_buff *skb, int rssi, u_int32_t rstamp)
897 {
898         struct ieee80211vap *vap;
899         int type = -1;
900
901         /* XXX locking */
902         TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
903                 struct ieee80211_node *ni;
904                 struct sk_buff *skb1;
905
906                 if (TAILQ_NEXT(vap, iv_next) != NULL) {
907                         skb1 = skb_copy(skb, GFP_ATOMIC);
908                         if (skb1 == NULL) {
909                                 /* XXX stat+msg */
910                                 continue;
911                         }
912                 } else {
913                         skb1 = skb;
914                         skb = NULL;
915                 }
916                 ni = ieee80211_ref_node(vap->iv_bss);
917                 type = ieee80211_input(ni, skb1, rssi, rstamp);
918                 ieee80211_free_node(ni);
919         }
920         if (skb != NULL)                /* no vaps, reclaim skb */
921                 dev_kfree_skb(skb);
922         return type;
923 }
924 EXPORT_SYMBOL(ieee80211_input_all);
925
926 /*
927  * This function reassemble fragments using the skb of the 1st fragment,
928  * if large enough. If not, a new skb is allocated to hold incoming
929  * fragments.
930  *
931  * Fragments are copied at the end of the previous fragment.  A different
932  * strategy could have been used, where a non-linear skb is allocated and
933  * fragments attached to that skb.
934  */
935 static struct sk_buff *
936 ieee80211_defrag(struct ieee80211_node *ni, struct sk_buff *skb, int hdrlen)
937 {
938         struct ieee80211_frame *wh = (struct ieee80211_frame *) skb->data;
939         u_int16_t rxseq, last_rxseq;
940         u_int8_t fragno, last_fragno;
941         u_int8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
942
943         rxseq = le16_to_cpu(*(__le16 *)wh->i_seq) >> IEEE80211_SEQ_SEQ_SHIFT;
944         fragno = le16_to_cpu(*(__le16 *)wh->i_seq) & IEEE80211_SEQ_FRAG_MASK;
945
946         /* Quick way out, if there's nothing to defragment */
947         if (!more_frag && fragno == 0 && ni->ni_rxfrag == NULL)
948                 return skb;
949
950         /*
951          * Remove frag to ensure it doesn't get reaped by timer.
952          */
953         if (ni->ni_table == NULL) {
954                 /*
955                  * Should never happen.  If the node is orphaned (not in
956                  * the table) then input packets should not reach here.
957                  * Otherwise, a concurrent request that yanks the table
958                  * should be blocked by other interlocking and/or by first
959                  * shutting the driver down.  Regardless, be defensive
960                  * here and just bail
961                  */
962                 /* XXX need msg+stat */
963                 dev_kfree_skb(skb);
964                 return NULL;
965         }
966
967         /*
968          * Use this lock to make sure ni->ni_rxfrag is
969          * not freed by the timer process while we use it.
970          * XXX bogus
971          */
972         IEEE80211_NODE_LOCK_IRQ(ni->ni_table);
973
974         /*
975          * Update the time stamp.  As a side effect, it
976          * also makes sure that the timer will not change
977          * ni->ni_rxfrag for at least 1 second, or in
978          * other words, for the remaining of this function.
979          */
980         ni->ni_rxfragstamp = jiffies;
981
982         IEEE80211_NODE_UNLOCK_IRQ(ni->ni_table);
983
984         /*
985          * Validate that fragment is in order and
986          * related to the previous ones.
987          */
988         if (ni->ni_rxfrag) {
989                 struct ieee80211_frame *lwh;
990
991                 lwh = (struct ieee80211_frame *) ni->ni_rxfrag->data;
992                 last_rxseq = le16_to_cpu(*(__le16 *)lwh->i_seq) >>
993                         IEEE80211_SEQ_SEQ_SHIFT;
994                 last_fragno = le16_to_cpu(*(__le16 *)lwh->i_seq) &
995                         IEEE80211_SEQ_FRAG_MASK;
996                 if (rxseq != last_rxseq
997                     || fragno != last_fragno + 1
998                     || (!IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1))
999                     || (!IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2))
1000                     || (ni->ni_rxfrag->end - ni->ni_rxfrag->tail <
1001                         skb->len)) {
1002                         /*
1003                          * Unrelated fragment or no space for it,
1004                          * clear current fragments
1005                          */
1006                         dev_kfree_skb(ni->ni_rxfrag);
1007                         ni->ni_rxfrag = NULL;
1008                 }
1009         }
1010
1011         /* If this is the first fragment */
1012         if (ni->ni_rxfrag == NULL && fragno == 0) {
1013                 ni->ni_rxfrag = skb;
1014                 /* If more frags are coming */
1015                 if (more_frag) {
1016                         if (skb_is_nonlinear(skb)) {
1017                                 /*
1018                                  * We need a continous buffer to
1019                                  * assemble fragments
1020                                  */
1021                                 ni->ni_rxfrag = skb_copy(skb, GFP_ATOMIC);
1022                                 dev_kfree_skb(skb);
1023                         }
1024                         /*
1025                          * Check that we have enough space to hold
1026                          * incoming fragments
1027                          * XXX 4-address/QoS frames?
1028                          */
1029                         else if ((skb_end_pointer(skb) - skb->head) <
1030                                  (ni->ni_vap->iv_dev->mtu + hdrlen)) {
1031                                 ni->ni_rxfrag = skb_copy_expand(skb, 0,
1032                                         (ni->ni_vap->iv_dev->mtu + hdrlen) -
1033                                         (skb_end_pointer(skb) - skb->head),
1034                                         GFP_ATOMIC);
1035                                 dev_kfree_skb(skb);
1036                         }
1037                 }
1038         } else {
1039                 if (ni->ni_rxfrag) {
1040                         struct ieee80211_frame *lwh = (struct ieee80211_frame *)
1041                                 ni->ni_rxfrag->data;
1042
1043                         /*
1044                          * We know we have enough space to copy,
1045                          * we've verified that before
1046                          */
1047                         /* Copy current fragment at end of previous one */
1048                         memcpy(skb_tail_pointer(ni->ni_rxfrag),
1049                                skb->data + hdrlen, skb->len - hdrlen);
1050                         /* Update tail and length */
1051                         skb_put(ni->ni_rxfrag, skb->len - hdrlen);
1052                         /* Keep a copy of last sequence and fragno */
1053                         *(__le16 *) lwh->i_seq = *(__le16 *) wh->i_seq;
1054                 }
1055                 /* we're done with the fragment */
1056                 dev_kfree_skb(skb);
1057         }
1058                 
1059         if (more_frag) {
1060                 /* More to come */
1061                 skb = NULL;
1062         } else {
1063                 /* Last fragment received, we're done! */
1064                 skb = ni->ni_rxfrag;
1065                 ni->ni_rxfrag = NULL;
1066         }
1067         return skb;
1068 }
1069
1070 static void 
1071 ieee80211_deliver_data(struct ieee80211_node *ni, struct sk_buff *skb)
1072 {
1073         struct ieee80211vap *vap = ni->ni_vap;
1074         struct net_device *dev = vap->iv_dev;
1075         struct ether_header *eh = (struct ether_header *) skb->data;
1076
1077 #ifdef ATH_SUPERG_XR 
1078         /*
1079          * if it is a XR vap, send the data to associated normal net
1080          * device. XR vap has a net device which is not registered with
1081          * OS. 
1082          */
1083         if (vap->iv_xrvap && vap->iv_flags & IEEE80211_F_XR)
1084                 dev = vap->iv_xrvap->iv_dev;
1085 #endif
1086
1087         /* perform as a bridge within the vap */
1088         /* XXX intra-vap bridging only */
1089         if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
1090             (vap->iv_flags & IEEE80211_F_NOBRIDGE) == 0) {
1091                 struct sk_buff *skb1 = NULL;
1092                 
1093                 if (ETHER_IS_MULTICAST(eh->ether_dhost))
1094                         skb1 = skb_copy(skb, GFP_ATOMIC);
1095                 else {
1096                         /*
1097                          * Check if destination is associated with the
1098                          * same vap and authorized to receive traffic.
1099                          * Beware of traffic destined for the vap itself;
1100                          * sending it will not work; just let it be
1101                          * delivered normally.
1102                          */
1103                         struct ieee80211_node *ni1 = ieee80211_find_node(
1104                                 &vap->iv_ic->ic_sta, eh->ether_dhost);
1105                         if (ni1 != NULL) {
1106                                 if (ni1->ni_vap == vap &&
1107                                     ieee80211_node_is_authorized(ni1) &&
1108                                     ni1 != vap->iv_bss) {
1109                                         skb1 = skb;
1110                                         skb = NULL;
1111                                 }
1112                                 /* XXX statistic? */
1113                                 ieee80211_free_node(ni1);
1114                         }
1115                 }
1116                 if (skb1 != NULL) {
1117                         skb1->dev = dev;
1118
1119                         skb_reset_mac_header(skb1);
1120                         skb_set_network_header(skb1, sizeof(struct ether_header));
1121
1122                         skb1->protocol = __constant_htons(ETH_P_802_2);
1123                         /* XXX insert vlan tag before queue it? */
1124                         dev_queue_xmit(skb1);
1125                 }
1126         }
1127
1128         if (skb != NULL) {
1129                 skb->dev = dev;
1130                 
1131 #ifdef USE_HEADERLEN_RESV
1132                 skb->protocol = ath_eth_type_trans(skb, dev);
1133 #else
1134                 skb->protocol = eth_type_trans(skb, dev);
1135 #endif
1136 #if IEEE80211_VLAN_TAG_USED
1137                 if (ni->ni_vlan != 0 && vap->iv_vlgrp != NULL) {
1138                         /* attach vlan tag */
1139                         vlan_hwaccel_receive_skb(skb, vap->iv_vlgrp, ni->ni_vlan);
1140                 } else
1141 #endif
1142                         netif_rx(skb);
1143                 dev->last_rx = jiffies;
1144         }
1145 }
1146
1147 static struct sk_buff *
1148 ieee80211_decap(struct ieee80211vap *vap, struct sk_buff *skb, int hdrlen)
1149 {
1150         struct ieee80211_qosframe_addr4 wh;     /* Max size address frames */
1151         struct ether_header *eh;
1152         struct llc *llc;
1153         __be16 ether_type = 0;
1154
1155         memcpy(&wh, skb->data, hdrlen); /* Only copy hdrlen over */
1156         llc = (struct llc *) skb_pull(skb, hdrlen);
1157         if (skb->len >= LLC_SNAPFRAMELEN &&
1158             llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
1159             llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
1160             llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) {
1161                 ether_type = llc->llc_un.type_snap.ether_type;
1162                 skb_pull(skb, LLC_SNAPFRAMELEN);
1163                 llc = NULL;
1164         }
1165         eh = (struct ether_header *) skb_push(skb, sizeof(struct ether_header));
1166         switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
1167         case IEEE80211_FC1_DIR_NODS:
1168                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
1169                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
1170                 break;
1171         case IEEE80211_FC1_DIR_TODS:
1172                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
1173                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
1174                 break;
1175         case IEEE80211_FC1_DIR_FROMDS:
1176                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
1177                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
1178                 break;
1179         case IEEE80211_FC1_DIR_DSTODS:
1180                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
1181                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
1182                 break;
1183         }
1184         if (!ALIGNED_POINTER(skb->data + sizeof(*eh), u_int32_t)) {
1185                 struct sk_buff *n;
1186
1187                 /* XXX does this always work? */
1188                 n = skb_copy(skb, GFP_ATOMIC);
1189                 dev_kfree_skb(skb);
1190                 if (n == NULL)
1191                         return NULL;
1192                 skb = n;
1193                 eh = (struct ether_header *) skb->data;
1194         }
1195         if (llc != NULL)
1196                 eh->ether_type = htons(skb->len - sizeof(*eh));
1197         else
1198                 eh->ether_type = ether_type;
1199         return skb;
1200 }
1201
1202 /*
1203  * Install received rate set information in the node's state block.
1204  */
1205 int
1206 ieee80211_setup_rates(struct ieee80211_node *ni,
1207         const u_int8_t *rates, const u_int8_t *xrates, int flags)
1208 {
1209         struct ieee80211_rateset *rs = &ni->ni_rates;
1210
1211         memset(rs, 0, sizeof(*rs));
1212         rs->rs_nrates = rates[1];
1213         memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
1214         if (xrates != NULL) {
1215                 u_int8_t nxrates;
1216                 /*
1217                  * Tack on 11g extended supported rate element.
1218                  */
1219                 nxrates = xrates[1];
1220                 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
1221                         struct ieee80211vap *vap = ni->ni_vap;
1222
1223                         nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
1224                         IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE, ni,
1225                                 "extended rate set too large;"
1226                                 " only using %u of %u rates",
1227                                 nxrates, xrates[1]);
1228                         vap->iv_stats.is_rx_rstoobig++;
1229                 }
1230                 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
1231                 rs->rs_nrates += nxrates;
1232         }
1233         return ieee80211_fix_rate(ni, flags);
1234 }
1235
1236 static void
1237 ieee80211_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
1238         int rssi, u_int32_t rstamp, u_int16_t seq, u_int16_t status)
1239 {
1240         struct ieee80211vap *vap = ni->ni_vap;
1241
1242         if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
1243                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1244                         ni->ni_macaddr, "open auth",
1245                         "bad sta auth mode %u", ni->ni_authmode);
1246                 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1247                 if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1248                         /* XXX hack to workaround calling convention */
1249
1250                         /* XXX To send the frame to the requesting STA, we have to
1251                          * create a node for the station that we're going to reject.
1252                          * The node will be freed automatically */
1253                         if (ni == vap->iv_bss) {
1254                                 ni = ieee80211_dup_bss(vap, wh->i_addr2);
1255                                 if (ni == NULL)
1256                                         return;
1257
1258                                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, 
1259                                 "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr), 
1260                                 ieee80211_node_refcnt(ni));
1261                         }
1262                         IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH,
1263                                 (seq + 1) | (IEEE80211_STATUS_ALG << 16));
1264                         return;
1265                 }
1266         }
1267         switch (vap->iv_opmode) {
1268         case IEEE80211_M_IBSS:
1269                 if (vap->iv_state != IEEE80211_S_RUN ||
1270                     seq != IEEE80211_AUTH_OPEN_REQUEST) {
1271                         vap->iv_stats.is_rx_bad_auth++;
1272                         return;
1273                 }
1274                 ieee80211_new_state(vap, IEEE80211_S_AUTH,
1275                         wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1276                 break;
1277
1278         case IEEE80211_M_AHDEMO:
1279         case IEEE80211_M_WDS:
1280                 /* should not come here */
1281                 break;
1282
1283         case IEEE80211_M_HOSTAP:
1284                 if (vap->iv_state != IEEE80211_S_RUN ||
1285                     seq != IEEE80211_AUTH_OPEN_REQUEST) {
1286                         vap->iv_stats.is_rx_bad_auth++;
1287                         return;
1288                 }
1289                 /* always accept open authentication requests */
1290                 if (ni == vap->iv_bss) {
1291                         ni = ieee80211_dup_bss(vap, wh->i_addr2); 
1292                         if (ni == NULL)
1293                                 return;
1294
1295                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, 
1296                         "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr), 
1297                         ieee80211_node_refcnt(ni));
1298
1299                 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1300                         (void) ieee80211_ref_node(ni);
1301                 /*
1302                  * Mark the node as referenced to reflect that it's
1303                  * reference count has been bumped to ensure it remains
1304                  * after the transaction completes.
1305                  */
1306                 ni->ni_flags |= IEEE80211_NODE_AREF;
1307
1308                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1309                 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1310                         ni, "station authenticated (%s)", "open");
1311                 /*
1312                  * When 802.1x is not in use mark the port
1313                  * authorized at this point so traffic can flow.
1314                  */
1315                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
1316                         ieee80211_node_authorize(ni);
1317                 break;
1318
1319         case IEEE80211_M_STA:
1320                 if (vap->iv_state != IEEE80211_S_AUTH ||
1321                     seq != IEEE80211_AUTH_OPEN_RESPONSE) {
1322                         vap->iv_stats.is_rx_bad_auth++;
1323                         return;
1324                 }
1325                 if (status != 0) {
1326                         IEEE80211_NOTE(vap,
1327                                 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
1328                                 "open auth failed (reason %d)", status);
1329                         vap->iv_stats.is_rx_auth_fail++;
1330                         ieee80211_new_state(vap, IEEE80211_S_SCAN,
1331                                 IEEE80211_SCAN_FAIL_STATUS);
1332                 } else
1333                         ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1334                 break;
1335         case IEEE80211_M_MONITOR:
1336                 break;
1337         }
1338 }
1339
1340 /*
1341  * Send a management frame error response to the specified
1342  * station.  If ni is associated with the station then use
1343  * it; otherwise allocate a temporary node suitable for
1344  * transmitting the frame and then free the reference so
1345  * it will go away as soon as the frame has been transmitted.
1346  */
1347 static void
1348 ieee80211_send_error(struct ieee80211_node *ni,
1349         const u_int8_t *mac, int subtype, int arg)
1350 {
1351         struct ieee80211vap *vap = ni->ni_vap;
1352         int istmp;
1353
1354         if (ni == vap->iv_bss) {
1355                 ni = ieee80211_tmp_node(vap, mac);
1356                 if (ni == NULL) {
1357                         /* XXX msg */
1358                         return;
1359                 }
1360                 istmp = 1;
1361         } else
1362                 istmp = 0;
1363         IEEE80211_SEND_MGMT(ni, subtype, arg);
1364         if (istmp)
1365                 ieee80211_free_node(ni);
1366 }
1367
1368 static int
1369 alloc_challenge(struct ieee80211_node *ni)
1370 {
1371         if (ni->ni_challenge == NULL)
1372                 MALLOC(ni->ni_challenge, u_int32_t*, IEEE80211_CHALLENGE_LEN,
1373                         M_DEVBUF, M_NOWAIT);
1374         if (ni->ni_challenge == NULL) {
1375                 IEEE80211_NOTE(ni->ni_vap,
1376                         IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
1377                         "%s", "shared key challenge alloc failed");
1378                 /* XXX statistic */
1379         }
1380         return (ni->ni_challenge != NULL);
1381 }
1382
1383 /* XXX TODO: add statistics */
1384 static void
1385 ieee80211_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
1386         u_int8_t *frm, u_int8_t *efrm, int rssi, u_int32_t rstamp,
1387         u_int16_t seq, u_int16_t status)
1388 {
1389         struct ieee80211vap *vap = ni->ni_vap;
1390         u_int8_t *challenge;
1391         int allocbs, estatus;
1392
1393         /*
1394          * NB: this can happen as we allow pre-shared key
1395          * authentication to be enabled w/o wep being turned
1396          * on so that configuration of these can be done
1397          * in any order.  It may be better to enforce the
1398          * ordering in which case this check would just be
1399          * for sanity/consistency.
1400          */
1401         estatus = 0;                    /* NB: silence compiler */
1402         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
1403                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1404                         ni->ni_macaddr, "shared key auth",
1405                         "%s", " PRIVACY is disabled");
1406                 estatus = IEEE80211_STATUS_ALG;
1407                 goto bad;
1408         }
1409         /*
1410          * Pre-shared key authentication is evil; accept
1411          * it only if explicitly configured (it is supported
1412          * mainly for compatibility with clients like OS X).
1413          */
1414         if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1415             ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1416                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1417                         ni->ni_macaddr, "shared key auth",
1418                         "bad sta auth mode %u", ni->ni_authmode);
1419                 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1420                 estatus = IEEE80211_STATUS_ALG;
1421                 goto bad;
1422         }
1423
1424         challenge = NULL;
1425         if (frm + 1 < efrm) {
1426                 if ((frm[1] + 2) > (efrm - frm)) {
1427                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1428                                 ni->ni_macaddr, "shared key auth",
1429                                 "ie %d/%d too long",
1430                                 frm[0], (frm[1] + 2) - (efrm - frm));
1431                         vap->iv_stats.is_rx_bad_auth++;
1432                         estatus = IEEE80211_STATUS_CHALLENGE;
1433                         goto bad;
1434                 }
1435                 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1436                         challenge = frm;
1437                 frm += frm[1] + 2;
1438         }
1439         switch (seq) {
1440         case IEEE80211_AUTH_SHARED_CHALLENGE:
1441         case IEEE80211_AUTH_SHARED_RESPONSE:
1442                 if (challenge == NULL) {
1443                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1444                                 ni->ni_macaddr, "shared key auth",
1445                                 "%s", "no challenge");
1446                         vap->iv_stats.is_rx_bad_auth++;
1447                         estatus = IEEE80211_STATUS_CHALLENGE;
1448                         goto bad;
1449                 }
1450                 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1451                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1452                                 ni->ni_macaddr, "shared key auth",
1453                                 "bad challenge len %d", challenge[1]);
1454                         vap->iv_stats.is_rx_bad_auth++;
1455                         estatus = IEEE80211_STATUS_CHALLENGE;
1456                         goto bad;
1457                 }
1458         default:
1459                 break;
1460         }
1461         switch (vap->iv_opmode) {
1462         case IEEE80211_M_MONITOR:
1463         case IEEE80211_M_AHDEMO:
1464         case IEEE80211_M_IBSS:
1465         case IEEE80211_M_WDS:
1466                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1467                         ni->ni_macaddr, "shared key auth",
1468                         "bad operating mode %u", vap->iv_opmode);
1469                 return;
1470         case IEEE80211_M_HOSTAP:
1471                 if (vap->iv_state != IEEE80211_S_RUN) {
1472                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1473                                 ni->ni_macaddr, "shared key auth",
1474                                 "bad state %u", vap->iv_state);
1475                         estatus = IEEE80211_STATUS_ALG; /* XXX */
1476                         goto bad;
1477                 }
1478                 switch (seq) {
1479                 case IEEE80211_AUTH_SHARED_REQUEST:
1480                         if (ni == vap->iv_bss) {
1481                                 ni = ieee80211_dup_bss(vap, wh->i_addr2);
1482                                 if (ni == NULL) {
1483                                         /* NB: no way to return an error */
1484                                         return;
1485                                 }
1486
1487                                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, 
1488                                 "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr), 
1489                                 ieee80211_node_refcnt(ni));
1490
1491                                 allocbs = 1;
1492                         } else {
1493                                 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1494                                         (void) ieee80211_ref_node(ni);
1495                                 allocbs = 0;
1496                         }
1497                         /*
1498                          * Mark the node as referenced to reflect that it's
1499                          * reference count has been bumped to ensure it remains
1500                          * after the transaction completes.
1501                          */
1502                         ni->ni_flags |= IEEE80211_NODE_AREF;
1503                         ni->ni_rssi = rssi;
1504                         ni->ni_rstamp = rstamp;
1505                         ni->ni_last_rx = jiffies;
1506                         if (!alloc_challenge(ni)) {
1507                                 /* NB: don't return error so they rexmit */
1508                                 return;
1509                         }
1510                         get_random_bytes(ni->ni_challenge,
1511                                 IEEE80211_CHALLENGE_LEN);
1512                         IEEE80211_NOTE(vap,
1513                                 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
1514                                 "shared key %sauth request", allocbs ? "" : "re");
1515                         break;
1516                 case IEEE80211_AUTH_SHARED_RESPONSE:
1517                         if (ni == vap->iv_bss) {
1518                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1519                                         ni->ni_macaddr, "shared key response",
1520                                         "%s", "unknown station");
1521                                 /* NB: don't send a response */
1522                                 return;
1523                         }
1524                         if (ni->ni_challenge == NULL) {
1525                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1526                                         ni->ni_macaddr, "shared key response",
1527                                         "%s", "no challenge recorded");
1528                                 vap->iv_stats.is_rx_bad_auth++;
1529                                 estatus = IEEE80211_STATUS_CHALLENGE;
1530                                 goto bad;
1531                         }
1532                         if (memcmp(ni->ni_challenge, &challenge[2],
1533                             challenge[1]) != 0) {
1534                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1535                                         ni->ni_macaddr, "shared key response",
1536                                         "%s", "challenge mismatch");
1537                                 vap->iv_stats.is_rx_auth_fail++;
1538                                 estatus = IEEE80211_STATUS_CHALLENGE;
1539                                 goto bad;
1540                         }
1541                         IEEE80211_NOTE(vap,
1542                                 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
1543                                 "station authenticated (%s)", "shared key");
1544                         ieee80211_node_authorize(ni);
1545                         break;
1546                 default:
1547                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1548                                 ni->ni_macaddr, "shared key auth",
1549                                 "bad seq %d", seq);
1550                         vap->iv_stats.is_rx_bad_auth++;
1551                         estatus = IEEE80211_STATUS_SEQUENCE;
1552                         goto bad;
1553                 }
1554                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1555                 break;
1556
1557         case IEEE80211_M_STA:
1558                 if (vap->iv_state != IEEE80211_S_AUTH)
1559                         return;
1560                 switch (seq) {
1561                 case IEEE80211_AUTH_SHARED_PASS:
1562                         if (ni->ni_challenge != NULL) {
1563                                 FREE(ni->ni_challenge, M_DEVBUF);
1564                                 ni->ni_challenge = NULL;
1565                         }
1566                         if (status != 0) {
1567                                 IEEE80211_NOTE_MAC(vap,
1568                                         IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1569                                         ieee80211_getbssid(vap, wh),
1570                                         "shared key auth failed (reason %d)",
1571                                         status);
1572                                 vap->iv_stats.is_rx_auth_fail++;
1573                                 /* XXX IEEE80211_SCAN_FAIL_STATUS */
1574                                 goto bad;
1575                         }
1576                         ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1577                         break;
1578                 case IEEE80211_AUTH_SHARED_CHALLENGE:
1579                         if (!alloc_challenge(ni))
1580                                 goto bad;
1581                         /* XXX could optimize by passing recvd challenge */
1582                         memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1583                         IEEE80211_SEND_MGMT(ni,
1584                                 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1585                         break;
1586                 default:
1587                         IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
1588                                 wh, "shared key auth", "bad seq %d", seq);
1589                         vap->iv_stats.is_rx_bad_auth++;
1590                         goto bad;
1591                 }
1592                 break;
1593         }
1594         return;
1595 bad:
1596         /*
1597          * Send an error response; but only when operating as an AP.
1598          */
1599         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1600                 /* XXX hack to workaround calling convention */
1601                 ieee80211_send_error(ni, wh->i_addr2, 
1602                         IEEE80211_FC0_SUBTYPE_AUTH,
1603                         (seq + 1) | (estatus<<16));
1604         } else if (vap->iv_opmode == IEEE80211_M_STA) {
1605                 /*
1606                  * Kick the state machine.  This short-circuits
1607                  * using the mgt frame timeout to trigger the
1608                  * state transition.
1609                  */
1610                 if (vap->iv_state == IEEE80211_S_AUTH)
1611                         ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
1612         }
1613 }
1614
1615 /* Verify the existence and length of __elem or get out. */
1616 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do {                 \
1617         if ((__elem) == NULL) {                                         \
1618                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID,            \
1619                         wh, ieee80211_mgt_subtype_name[subtype >>       \
1620                                 IEEE80211_FC0_SUBTYPE_SHIFT],           \
1621                         "%s", "no " #__elem );                          \
1622                 vap->iv_stats.is_rx_elem_missing++;                     \
1623                 return;                                                 \
1624         }                                                               \
1625         if ((__elem)[1] > (__maxlen)) {                                 \
1626                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID,            \
1627                         wh, ieee80211_mgt_subtype_name[subtype >>       \
1628                                 IEEE80211_FC0_SUBTYPE_SHIFT],           \
1629                         "bad " #__elem " len %d", (__elem)[1]);         \
1630                 vap->iv_stats.is_rx_elem_toobig++;                      \
1631                 return;                                                 \
1632         }                                                               \
1633 } while (0)
1634
1635 #define IEEE80211_VERIFY_LENGTH(_len, _minlen) do {                     \
1636         if ((_len) < (_minlen)) {                                       \
1637                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID,            \
1638                         wh, ieee80211_mgt_subtype_name[subtype >>       \
1639                                 IEEE80211_FC0_SUBTYPE_SHIFT],           \
1640                         "%s", "ie too short");                          \
1641                 vap->iv_stats.is_rx_elem_toosmall++;                    \
1642                 return;                                                 \
1643         }                                                               \
1644 } while (0)
1645
1646 #ifdef IEEE80211_DEBUG
1647 static void
1648 ieee80211_ssid_mismatch(struct ieee80211vap *vap, const char *tag,
1649         u_int8_t mac[IEEE80211_ADDR_LEN], u_int8_t *ssid)
1650 {
1651         printf("[%s] discard %s frame, ssid mismatch: ",
1652                 ether_sprintf(mac), tag);
1653         ieee80211_print_essid(ssid + 2, ssid[1]);
1654         printf("\n");
1655 }
1656
1657 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do {                          \
1658         if ((_ssid)[1] != 0 &&                                          \
1659             ((_ssid)[1] != (_ni)->ni_esslen ||                          \
1660             memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {   \
1661                 if (ieee80211_msg_input(vap))                           \
1662                         ieee80211_ssid_mismatch(vap,                    \
1663                                 ieee80211_mgt_subtype_name[subtype >>   \
1664                                         IEEE80211_FC0_SUBTYPE_SHIFT],   \
1665                                 wh->i_addr2, _ssid);                    \
1666                 vap->iv_stats.is_rx_ssidmismatch++;                     \
1667                 return;                                                 \
1668         }                                                               \
1669 } while (0)
1670 #else /* !IEEE80211_DEBUG */
1671 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do {                          \
1672         if ((_ssid)[1] != 0 &&                                          \
1673             ((_ssid)[1] != (_ni)->ni_esslen ||                          \
1674             memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {   \
1675                 vap->iv_stats.is_rx_ssidmismatch++;                     \
1676                 return;                                                 \
1677         }                                                               \
1678 } while (0)
1679 #endif /* !IEEE80211_DEBUG */
1680
1681 /* unaligned little endian access */     
1682 #define LE_READ_2(p)                                    \
1683         ((u_int16_t)                                    \
1684          ((((const u_int8_t *)(p))[0]      ) |          \
1685           (((const u_int8_t *)(p))[1] <<  8)))
1686 #define LE_READ_4(p)                                    \
1687         ((u_int32_t)                                    \
1688          ((((const u_int8_t *)(p))[0]      ) |          \
1689           (((const u_int8_t *)(p))[1] <<  8) |          \
1690           (((const u_int8_t *)(p))[2] << 16) |          \
1691           (((const u_int8_t *)(p))[3] << 24)))
1692
1693 static __inline int
1694 iswpaoui(const u_int8_t *frm)
1695 {
1696         return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
1697 }
1698
1699 static __inline int
1700 iswmeoui(const u_int8_t *frm)
1701 {
1702         return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI);
1703 }
1704
1705 static __inline int
1706 iswmeparam(const u_int8_t *frm)
1707 {
1708         return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1709                 frm[6] == WME_PARAM_OUI_SUBTYPE;
1710 }
1711
1712 static __inline int
1713 iswmeinfo(const u_int8_t *frm)
1714 {
1715         return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1716                 frm[6] == WME_INFO_OUI_SUBTYPE;
1717 }
1718
1719 static __inline int
1720 isatherosoui(const u_int8_t *frm)
1721 {
1722         return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
1723 }
1724
1725 /*
1726  * Convert a WPA cipher selector OUI to an internal
1727  * cipher algorithm.  Where appropriate we also
1728  * record any key length.
1729  */
1730 static int
1731 wpa_cipher(u_int8_t *sel, u_int8_t *keylen)
1732 {
1733 #define WPA_SEL(x)      (((x) << 24) | WPA_OUI)
1734         u_int32_t w = LE_READ_4(sel);
1735
1736         switch (w) {
1737         case WPA_SEL(WPA_CSE_NULL):
1738                 return IEEE80211_CIPHER_NONE;
1739         case WPA_SEL(WPA_CSE_WEP40):
1740                 if (keylen)
1741                         *keylen = 40 / NBBY;
1742                 return IEEE80211_CIPHER_WEP;
1743         case WPA_SEL(WPA_CSE_WEP104):
1744                 if (keylen)
1745                         *keylen = 104 / NBBY;
1746                 return IEEE80211_CIPHER_WEP;
1747         case WPA_SEL(WPA_CSE_TKIP):
1748                 return IEEE80211_CIPHER_TKIP;
1749         case WPA_SEL(WPA_CSE_CCMP):
1750                 return IEEE80211_CIPHER_AES_CCM;
1751         }
1752         return 32;              /* NB: so 1<< is discarded */
1753 #undef WPA_SEL
1754 }
1755
1756 /*
1757  * Convert a WPA key management/authentication algorithm
1758  * to an internal code.
1759  */
1760 static int
1761 wpa_keymgmt(u_int8_t *sel)
1762 {
1763 #define WPA_SEL(x)      (((x)<<24)|WPA_OUI)
1764         u_int32_t w = LE_READ_4(sel);
1765
1766         switch (w) {
1767         case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1768                 return WPA_ASE_8021X_UNSPEC;
1769         case WPA_SEL(WPA_ASE_8021X_PSK):
1770                 return WPA_ASE_8021X_PSK;
1771         case WPA_SEL(WPA_ASE_NONE):
1772                 return WPA_ASE_NONE;
1773         }
1774         return 0;               /* NB: so is discarded */
1775 #undef WPA_SEL
1776 }
1777
1778 /*
1779  * Parse a WPA information element to collect parameters
1780  * and validate the parameters against what has been
1781  * configured for the system.
1782  */
1783 static int
1784 ieee80211_parse_wpa(struct ieee80211vap *vap, u_int8_t *frm,
1785         struct ieee80211_rsnparms *rsn_parm, const struct ieee80211_frame *wh)
1786 {
1787         u_int8_t len = frm[1];
1788         u_int32_t w;
1789         int n;
1790
1791         /*
1792          * Check the length once for fixed parts: OUI, type,
1793          * version, mcast cipher, and 2 selector counts.
1794          * Other, variable-length data, must be checked separately.
1795          */
1796         if (!(vap->iv_flags & IEEE80211_F_WPA1)) {
1797                 IEEE80211_DISCARD_IE(vap,
1798                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1799                         wh, "WPA", "vap not WPA, flags 0x%x", vap->iv_flags);
1800                 return IEEE80211_REASON_IE_INVALID;
1801         }
1802         
1803         if (len < 14) {
1804                 IEEE80211_DISCARD_IE(vap,
1805                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1806                         wh, "WPA", "too short, len %u", len);
1807                 return IEEE80211_REASON_IE_INVALID;
1808         }
1809         frm += 6, len -= 4;             /* NB: len is payload only */
1810         /* NB: iswapoui already validated the OUI and type */
1811         w = LE_READ_2(frm);
1812         if (w != WPA_VERSION) {
1813                 IEEE80211_DISCARD_IE(vap,
1814                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1815                         wh, "WPA", "bad version %u", w);
1816                 return IEEE80211_REASON_IE_INVALID;
1817         }
1818         frm += 2;
1819         len -= 2;
1820
1821         /* multicast/group cipher */
1822         w = wpa_cipher(frm, &rsn_parm->rsn_mcastkeylen);
1823         if (w != rsn_parm->rsn_mcastcipher) {
1824                 IEEE80211_DISCARD_IE(vap,
1825                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1826                         wh, "WPA", "mcast cipher mismatch; got %u, expected %u",
1827                         w, rsn_parm->rsn_mcastcipher);
1828                 return IEEE80211_REASON_IE_INVALID;
1829         }
1830         frm += 4;
1831         len -= 4;
1832
1833         /* unicast ciphers */
1834         n = LE_READ_2(frm);
1835         frm += 2;
1836         len -= 2;
1837         if (len < n*4+2) {
1838                 IEEE80211_DISCARD_IE(vap,
1839                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1840                         wh, "WPA", "ucast cipher data too short; len %u, n %u",
1841                         len, n);
1842                 return IEEE80211_REASON_IE_INVALID;
1843         }
1844         w = 0;
1845         for (; n > 0; n--) {
1846                 w |= 1 << wpa_cipher(frm, &rsn_parm->rsn_ucastkeylen);
1847                 frm += 4;
1848                 len -= 4;
1849         }
1850         w &= rsn_parm->rsn_ucastcipherset;
1851         if (w == 0) {
1852                 IEEE80211_DISCARD_IE(vap,
1853                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1854                         wh, "WPA", "%s", "ucast cipher set empty");
1855                 return IEEE80211_REASON_IE_INVALID;
1856         }
1857         if (w & (1 << IEEE80211_CIPHER_TKIP))
1858                 rsn_parm->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1859         else
1860                 rsn_parm->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1861
1862         /* key management algorithms */
1863         n = LE_READ_2(frm);
1864         frm += 2;
1865         len -= 2;
1866         if (len < n * 4) {
1867                 IEEE80211_DISCARD_IE(vap,
1868                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1869                         wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1870                         len, n);
1871                 return IEEE80211_REASON_IE_INVALID;
1872         }
1873         w = 0;
1874         for (; n > 0; n--) {
1875                 w |= wpa_keymgmt(frm);
1876                 frm += 4;
1877                 len -= 4;
1878         }
1879         w &= rsn_parm->rsn_keymgmtset;
1880         if (w == 0) {
1881                 IEEE80211_DISCARD_IE(vap,
1882                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1883                         wh, "WPA", "%s", "no acceptable key mgmt alg");
1884                 return IEEE80211_REASON_IE_INVALID;
1885         }
1886         if (w & WPA_ASE_8021X_UNSPEC)
1887                 rsn_parm->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1888         else
1889                 rsn_parm->rsn_keymgmt = WPA_ASE_8021X_PSK;
1890
1891         if (len > 2)            /* optional capabilities */
1892                 rsn_parm->rsn_caps = LE_READ_2(frm);
1893
1894         return 0;
1895 }
1896
1897 /*
1898  * Convert an RSN cipher selector OUI to an internal
1899  * cipher algorithm.  Where appropriate we also
1900  * record any key length.
1901  */
1902 static int
1903 rsn_cipher(u_int8_t *sel, u_int8_t *keylen)
1904 {
1905 #define RSN_SEL(x)      (((x) << 24) | RSN_OUI)
1906         u_int32_t w = LE_READ_4(sel);
1907
1908         switch (w) {
1909         case RSN_SEL(RSN_CSE_NULL):
1910                 return IEEE80211_CIPHER_NONE;
1911         case RSN_SEL(RSN_CSE_WEP40):
1912                 if (keylen)
1913                         *keylen = 40 / NBBY;
1914                 return IEEE80211_CIPHER_WEP;
1915         case RSN_SEL(RSN_CSE_WEP104):
1916                 if (keylen)
1917                         *keylen = 104 / NBBY;
1918                 return IEEE80211_CIPHER_WEP;
1919         case RSN_SEL(RSN_CSE_TKIP):
1920                 return IEEE80211_CIPHER_TKIP;
1921         case RSN_SEL(RSN_CSE_CCMP):
1922                 return IEEE80211_CIPHER_AES_CCM;
1923         case RSN_SEL(RSN_CSE_WRAP):
1924                 return IEEE80211_CIPHER_AES_OCB;
1925         }
1926         return 32;              /* NB: so 1<< is discarded */
1927 #undef RSN_SEL
1928 }
1929
1930 /*
1931  * Convert an RSN key management/authentication algorithm
1932  * to an internal code.
1933  */
1934 static int
1935 rsn_keymgmt(u_int8_t *sel)
1936 {
1937 #define RSN_SEL(x)      (((x) << 24) | RSN_OUI)
1938         u_int32_t w = LE_READ_4(sel);
1939
1940         switch (w) {
1941         case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1942                 return RSN_ASE_8021X_UNSPEC;
1943         case RSN_SEL(RSN_ASE_8021X_PSK):
1944                 return RSN_ASE_8021X_PSK;
1945         case RSN_SEL(RSN_ASE_NONE):
1946                 return RSN_ASE_NONE;
1947         }
1948         return 0;               /* NB: so is discarded */
1949 #undef RSN_SEL
1950 }
1951
1952 /*
1953  * Parse a WPA/RSN information element to collect parameters
1954  * and validate the parameters against what has been
1955  * configured for the system.
1956  */
1957 static int
1958 ieee80211_parse_rsn(struct ieee80211vap *vap, u_int8_t *frm,
1959         struct ieee80211_rsnparms *rsn_parm, const struct ieee80211_frame *wh)
1960 {
1961         u_int8_t len = frm[1];
1962         u_int32_t w;
1963         int n;
1964
1965         /*
1966          * Check the length once for fixed parts: 
1967          * version, mcast cipher, and 2 selector counts.
1968          * Other, variable-length data, must be checked separately.
1969          */
1970         if (!(vap->iv_flags & IEEE80211_F_WPA2)) {
1971                 IEEE80211_DISCARD_IE(vap,
1972                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1973                         wh, "RSN", "vap not RSN, flags 0x%x", vap->iv_flags);
1974                 return IEEE80211_REASON_IE_INVALID;
1975         }
1976         
1977         if (len < 10) {
1978                 IEEE80211_DISCARD_IE(vap,
1979                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1980                         wh, "RSN", "too short, len %u", len);
1981                 return IEEE80211_REASON_IE_INVALID;
1982         }
1983         frm += 2;
1984         w = LE_READ_2(frm);
1985         if (w != RSN_VERSION) {
1986                 IEEE80211_DISCARD_IE(vap,
1987                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1988                         wh, "RSN", "bad version %u", w);
1989                 return IEEE80211_REASON_IE_INVALID;
1990         }
1991         frm += 2;
1992         len -= 2;
1993
1994         /* multicast/group cipher */
1995         w = rsn_cipher(frm, &rsn_parm->rsn_mcastkeylen);
1996         if (w != rsn_parm->rsn_mcastcipher) {
1997                 IEEE80211_DISCARD_IE(vap,
1998                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1999                         wh, "RSN", "mcast cipher mismatch; got %u, expected %u",
2000                         w, rsn_parm->rsn_mcastcipher);
2001                 return IEEE80211_REASON_IE_INVALID;
2002         }
2003         frm += 4;
2004         len -= 4;
2005
2006         /* unicast ciphers */
2007         n = LE_READ_2(frm);
2008         frm += 2;
2009         len -= 2;
2010         if (len < n * 4 + 2) {
2011                 IEEE80211_DISCARD_IE(vap,
2012                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
2013                         wh, "RSN", "ucast cipher data too short; len %u, n %u",
2014                         len, n);
2015                 return IEEE80211_REASON_IE_INVALID;
2016         }
2017         w = 0;
2018         for (; n > 0; n--) {
2019                 w |= 1 << rsn_cipher(frm, &rsn_parm->rsn_ucastkeylen);
2020                 frm += 4;
2021                 len -= 4;
2022         }
2023         w &= rsn_parm->rsn_ucastcipherset;
2024         if (w == 0) {
2025                 IEEE80211_DISCARD_IE(vap,
2026                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
2027                         wh, "RSN", "%s", "ucast cipher set empty");
2028                 return IEEE80211_REASON_IE_INVALID;
2029         }
2030         if (w & (1<<IEEE80211_CIPHER_TKIP))
2031                 rsn_parm->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
2032         else
2033                 rsn_parm->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
2034
2035         /* key management algorithms */
2036         n = LE_READ_2(frm);
2037         frm += 2;
2038         len -= 2;
2039         if (len < n * 4) {
2040                 IEEE80211_DISCARD_IE(vap, 
2041                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
2042                         wh, "RSN", "key mgmt alg data too short; len %u, n %u",
2043                         len, n);
2044                 return IEEE80211_REASON_IE_INVALID;
2045         }
2046         w = 0;
2047         for (; n > 0; n--) {
2048                 w |= rsn_keymgmt(frm);
2049                 frm += 4;
2050                 len -= 4;
2051         }
2052         w &= rsn_parm->rsn_keymgmtset;
2053         if (w == 0) {
2054                 IEEE80211_DISCARD_IE(vap,
2055                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
2056                         wh, "RSN", "%s", "no acceptable key mgmt alg");
2057                 return IEEE80211_REASON_IE_INVALID;
2058         }
2059         if (w & RSN_ASE_8021X_UNSPEC)
2060                 rsn_parm->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
2061         else
2062                 rsn_parm->rsn_keymgmt = RSN_ASE_8021X_PSK;
2063
2064         /* optional RSN capabilities */
2065         if (len > 2)
2066                 rsn_parm->rsn_caps = LE_READ_2(frm);
2067         /* XXXPMKID */
2068
2069         return 0;
2070 }
2071
2072 void
2073 ieee80211_saveie(u_int8_t **iep, const u_int8_t *ie)
2074 {
2075         u_int ielen = ie[1] + 2;
2076         /*
2077          * Record information element for later use.
2078          */
2079         if (*iep == NULL || (*iep)[1] != ie[1]) {
2080                 if (*iep != NULL)
2081                         FREE(*iep, M_DEVBUF);
2082                 MALLOC(*iep, void*, ielen, M_DEVBUF, M_NOWAIT);
2083         }
2084         if (*iep != NULL)
2085                 memcpy(*iep, ie, ielen);
2086 }
2087 EXPORT_SYMBOL(ieee80211_saveie);
2088
2089 static int
2090 ieee80211_parse_wmeie(u_int8_t *frm, const struct ieee80211_frame *wh, 
2091                                           struct ieee80211_node *ni)
2092 {
2093         u_int len = frm[1];
2094
2095         if (len != 7) {
2096                 IEEE80211_DISCARD_IE(ni->ni_vap,
2097                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
2098                         wh, "WME IE", "too short, len %u", len);
2099                 return -1;
2100         }
2101         ni->ni_uapsd = frm[WME_CAPINFO_IE_OFFSET];
2102         if (ni->ni_uapsd) {
2103                 ni->ni_flags |= IEEE80211_NODE_UAPSD;
2104                 switch (WME_UAPSD_MAXSP(ni->ni_uapsd)) {
2105                 case 1: 
2106                         ni->ni_uapsd_maxsp = 2; break;
2107                 case 2: 
2108                         ni->ni_uapsd_maxsp = 4; break;
2109                 case 3: 
2110                         ni->ni_uapsd_maxsp = 6; break;
2111                 default:  
2112                         ni->ni_uapsd_maxsp = WME_UAPSD_NODE_MAXQDEPTH;
2113                 }
2114         }
2115         IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_POWER, ni,
2116                 "UAPSD bit settings from STA: %02x", ni->ni_uapsd);
2117
2118         return 1;
2119 }
2120
2121 static int
2122 ieee80211_parse_wmeparams(struct ieee80211vap *vap, u_int8_t *frm,
2123         const struct ieee80211_frame *wh, u_int8_t *qosinfo)
2124 {
2125 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
2126         struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
2127         u_int len = frm[1], qosinfo_count;
2128         int i;
2129
2130         *qosinfo = 0;
2131
2132         if (len < sizeof(struct ieee80211_wme_param)-2) {
2133                 IEEE80211_DISCARD_IE(vap,
2134                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
2135                         wh, "WME", "too short, len %u", len);
2136                 return -1;
2137         }
2138         *qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
2139         qosinfo_count = *qosinfo & WME_QOSINFO_COUNT;
2140         /* XXX do proper check for wraparound */
2141         if (qosinfo_count == wme->wme_wmeChanParams.cap_info_count)
2142                 return 0;
2143         frm += __offsetof(struct ieee80211_wme_param, params_acParams);
2144         for (i = 0; i < WME_NUM_AC; i++) {
2145                 struct wmeParams *wmep =
2146                         &wme->wme_wmeChanParams.cap_wmeParams[i];
2147                 /* NB: ACI not used */
2148                 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
2149                 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
2150                 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
2151                 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
2152                 wmep->wmep_txopLimit = LE_READ_2(frm + 2);
2153                 frm += 4;
2154         }
2155         wme->wme_wmeChanParams.cap_info_count = qosinfo_count;
2156         return 1;
2157 #undef MS
2158 }
2159
2160 static void
2161 ieee80211_parse_athParams(struct ieee80211_node *ni, u_int8_t *ie)
2162 {
2163 #ifdef ATH_SUPERG_DYNTURBO
2164         struct ieee80211vap *vap = ni->ni_vap;
2165         struct ieee80211com *ic = ni->ni_ic;
2166 #endif /* ATH_SUPERG_DYNTURBO */
2167         struct ieee80211_ie_athAdvCap *athIe =
2168                 (struct ieee80211_ie_athAdvCap *) ie;
2169
2170         ni->ni_ath_flags = athIe->athAdvCap_capability;
2171         if (ni->ni_ath_flags & IEEE80211_ATHC_COMP)
2172                 ni->ni_ath_defkeyindex = LE_READ_2(&athIe->athAdvCap_defKeyIndex);
2173 #if 0
2174         /* NB: too noisy */
2175         IEEE80211_NOTE(vap, IEEE80211_MSG_SUPG, ni,
2176                 "recv ath params: caps 0x%x flags 0x%x defkeyix %u",
2177                 athIe->athAdvCap_capability, ni->ni_ath_flags,
2178                 ni->ni_ath_defkeyindex);
2179 #endif
2180 #ifdef ATH_SUPERG_DYNTURBO
2181         if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_ATHC_TURBOP)) {
2182                 u_int16_t curflags, newflags;
2183
2184                 /*
2185                  * Check for turbo mode switch.  Calculate flags
2186                  * for the new mode and effect the switch.
2187                  */
2188                 newflags = curflags = ic->ic_bsschan->ic_flags;
2189                 /* NB: ATHC_BOOST is not in ic_ath_cap, so get it from the ie */
2190                 if (athIe->athAdvCap_capability & IEEE80211_ATHC_BOOST) 
2191                         newflags |= IEEE80211_CHAN_TURBO;
2192                 else
2193                         newflags &= ~IEEE80211_CHAN_TURBO;
2194                 if (newflags != curflags)
2195                         ieee80211_dturbo_switch(ic, newflags);
2196         }
2197 #endif /* ATH_SUPERG_DYNTURBO */
2198 }
2199
2200 static void
2201 forward_mgmt_to_app(struct ieee80211vap *vap, int subtype, struct sk_buff *skb,
2202         struct ieee80211_frame *wh)
2203 {
2204         struct net_device *dev = vap->iv_dev;
2205         int filter_type = 0;
2206
2207         switch (subtype) {
2208         case IEEE80211_FC0_SUBTYPE_BEACON:
2209                 filter_type = IEEE80211_FILTER_TYPE_BEACON;
2210                 break;
2211         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2212                 filter_type = IEEE80211_FILTER_TYPE_PROBE_REQ;
2213                 break;
2214         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2215                 filter_type = IEEE80211_FILTER_TYPE_PROBE_RESP;
2216                 break;
2217         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2218         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
2219                 filter_type = IEEE80211_FILTER_TYPE_ASSOC_REQ;
2220                 break;
2221         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2222         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2223                 filter_type = IEEE80211_FILTER_TYPE_ASSOC_RESP;
2224                 break;
2225         case IEEE80211_FC0_SUBTYPE_AUTH:
2226                 filter_type = IEEE80211_FILTER_TYPE_AUTH;
2227                 break;
2228         case IEEE80211_FC0_SUBTYPE_DEAUTH:
2229                 filter_type = IEEE80211_FILTER_TYPE_DEAUTH;
2230                 break;
2231         case IEEE80211_FC0_SUBTYPE_DISASSOC:
2232                 filter_type = IEEE80211_FILTER_TYPE_DISASSOC;
2233                 break;
2234         default:
2235                 break;
2236         }
2237
2238         if (filter_type && ((vap->app_filter & filter_type) == filter_type)) {
2239                 struct sk_buff *skb1;
2240
2241                 skb1 = skb_copy(skb, GFP_ATOMIC);
2242                 if (skb1 == NULL)
2243                         return;
2244                 skb1->dev = dev;
2245                 skb_reset_mac_header(skb1);
2246                 
2247                 skb1->ip_summed = CHECKSUM_NONE;
2248                 skb1->pkt_type = PACKET_OTHERHOST;
2249                 skb1->protocol = __constant_htons(0x0019);  /* ETH_P_80211_RAW */
2250
2251                 netif_rx(skb1);
2252         }
2253 }
2254
2255 void
2256 ieee80211_saveath(struct ieee80211_node *ni, u_int8_t *ie)
2257 {
2258         const struct ieee80211_ie_athAdvCap *athIe =
2259                 (const struct ieee80211_ie_athAdvCap *) ie;
2260
2261         ni->ni_ath_flags = athIe->athAdvCap_capability;
2262         if (ni->ni_ath_flags & IEEE80211_ATHC_COMP)
2263                 ni->ni_ath_defkeyindex = LE_READ_2(&athIe->athAdvCap_defKeyIndex);
2264         ieee80211_saveie(&ni->ni_ath_ie, ie);
2265 }
2266
2267 struct ieee80211_channel *
2268 ieee80211_doth_findchan(struct ieee80211vap *vap, u_int8_t chan)
2269 {
2270         struct ieee80211com *ic = vap->iv_ic;
2271         struct ieee80211_channel *c;
2272         int flags, freq;
2273
2274         /* NB: try first to preserve turbo */
2275         flags = ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL;
2276         freq = ieee80211_ieee2mhz(chan, 0);
2277         c = ieee80211_find_channel(ic, freq, flags);
2278         if (c == NULL)
2279                 c = ieee80211_find_channel(ic, freq, 0);
2280         return c;
2281 }
2282
2283 static void
2284 ieee80211_doth_cancel_cs(struct ieee80211vap *vap)
2285 {
2286         del_timer(&vap->iv_csa_timer);
2287         if (vap->iv_csa_jiffies) 
2288                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2289                                 "channel switch canceled (was: to %u in %u "
2290                                 "tbtt, mode %u)\n", vap->iv_csa_chan->ic_ieee,
2291                                 vap->iv_csa_count, vap->iv_csa_mode);
2292         vap->iv_csa_jiffies = 0;
2293 }
2294
2295 static void
2296 ieee80211_doth_switch_channel(struct ieee80211vap *vap)
2297 {
2298         struct ieee80211com *ic = vap->iv_ic;
2299
2300         IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2301                         "%s: Channel switch to %d NOW!\n",
2302                         __func__, vap->iv_csa_chan->ic_ieee);
2303 #if 0
2304         /* XXX does not belong here? */
2305         /* XXX doesn't stop management frames */
2306         /* XXX who restarts the queue? */
2307         /* NB: for now, error here is non-catastrophic.
2308          *     in the future we may need to ensure we
2309          *     stop xmit on this channel.
2310          */
2311         netif_stop_queue(ic->ic_dev);
2312 #endif
2313
2314         vap->iv_csa_jiffies = 0; /* supress "cancel" msg */
2315         ieee80211_doth_cancel_cs(vap);
2316
2317         ic->ic_prevchan = ic->ic_curchan;
2318         ic->ic_curchan = ic->ic_bsschan = vap->iv_csa_chan;
2319         ic->ic_set_channel(ic);
2320 }
2321
2322 static void
2323 ieee80211_doth_switch_channel_tmr(unsigned long arg)
2324 {
2325         struct ieee80211vap *vap = (struct ieee80211vap *)arg;
2326         ieee80211_doth_switch_channel(vap);
2327 }
2328
2329 static int
2330 ieee80211_parse_csaie(struct ieee80211_node *ni, u_int8_t *frm,
2331         const struct ieee80211_frame *wh)
2332 {
2333         struct ieee80211vap *vap = ni->ni_vap;
2334         struct ieee80211com *ic = vap->iv_ic;
2335         struct ieee80211_channel *c;
2336         struct ieee80211_ie_csa *csa_ie = (struct ieee80211_ie_csa *)frm;
2337
2338         if (!frm) {
2339                 /* we had CS underway but now we got Beacon without CSA IE */
2340                 /* XXX abuse? */
2341
2342                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2343                                 "%s: channel switch is scheduled, but we got "
2344                                 "Beacon without CSA IE!\n", __func__);
2345
2346                 ieee80211_doth_cancel_cs(vap);
2347                 return 0;
2348         }
2349
2350         if (csa_ie->csa_len != 3) {
2351                 IEEE80211_DISCARD_IE(vap,
2352                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
2353                         wh, "channel switch", "invalid length %u",
2354                         csa_ie->csa_len);
2355                 return -1;
2356         }
2357
2358         if (isclr(ic->ic_chan_avail, csa_ie->csa_chan)) {
2359                 IEEE80211_DISCARD_IE(vap,
2360                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
2361                         wh, "channel switch", "invalid channel %u", 
2362                         csa_ie->csa_chan);
2363                 return -1;
2364         }
2365
2366         if ((c = ieee80211_doth_findchan(vap, csa_ie->csa_chan)) == NULL) {
2367                 /* XXX something wrong */
2368                 IEEE80211_DISCARD_IE(vap,
2369                                 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
2370                                 wh, "channel switch",
2371                                 "channel %u lookup failed", csa_ie->csa_chan);
2372                 return -1;
2373         }
2374
2375         IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2376                 "%s: channel switch to %u in %u tbtt (mode %u) announced\n",
2377                 __func__, csa_ie->csa_chan, csa_ie->csa_count,
2378                 csa_ie->csa_mode);
2379
2380         if (vap->iv_csa_jiffies) {
2381                 /* CSA was received recently */
2382                 if (c != vap->iv_csa_chan) {
2383                         /* XXX abuse? */
2384                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2385                                         "%s: channel switch channel "
2386                                         "changed from %u to %u!\n", __func__,
2387                                         vap->iv_csa_chan->ic_ieee,
2388                                         csa_ie->csa_chan);
2389
2390                         if (vap->iv_csa_count > IEEE80211_CSA_PROTECTION_PERIOD)
2391                                 ieee80211_doth_cancel_cs(vap);
2392                         return 0;
2393                 }
2394
2395                 if (csa_ie->csa_mode != vap->iv_csa_mode) {
2396                         /* Can be abused, but with no (to little) impact. */
2397
2398                         /* CS mode change has no influence on our actions since
2399                          * we don't respect cs modes at all (yet). Complain and
2400                          * forget. */
2401                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2402                                         "%s: channel switch mode changed from "
2403                                         "%u to %u!\n", __func__, 
2404                                         vap->iv_csa_mode, csa_ie->csa_mode);
2405                 }
2406
2407                 if (csa_ie->csa_count >= vap->iv_csa_count) {
2408                         /* XXX abuse? what for? */
2409                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2410                                         "%s: channel switch count didn't "
2411                                         "decrease (%u -> %u)!\n", __func__,
2412                                         vap->iv_csa_count, csa_ie->csa_count);
2413                         return 0;
2414                 }
2415
2416                 {
2417                         u_int32_t elapsed = IEEE80211_JIFFIES_TO_TU(
2418                             jiffies - vap->iv_csa_jiffies);
2419                         u_int32_t cnt_diff = vap->iv_csa_count -
2420                           csa_ie->csa_count;
2421                         u_int32_t expected = ni->ni_intval * cnt_diff;
2422                         int32_t delta = elapsed - expected;
2423                         if (delta < 0)
2424                                 delta = -delta;
2425                         if (delta > IEEE80211_CSA_SANITY_THRESHOLD) {
2426                                 /* XXX abuse? for now, it's safer to cancel CS
2427                                  * than to follow it blindly */
2428                                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2429                                                 "%s: %u.%02u bintvals elapsed, "
2430                                                 "but count dropped by %u (delta"
2431                                                 " = %u TUs)\n", __func__,
2432                                                 elapsed / ni->ni_intval,
2433                                                 elapsed * 100 / ni->ni_intval 
2434                                                 % 100, cnt_diff, delta);
2435
2436                                 ieee80211_doth_cancel_cs(vap);
2437                                 return 0;
2438                         }
2439                 }
2440
2441                 vap->iv_csa_count = csa_ie->csa_count;
2442                 mod_timer(&vap->iv_csa_timer, jiffies + 
2443                                 IEEE80211_TU_TO_JIFFIES(vap->iv_csa_count
2444                                   * ni->ni_intval + 10));
2445         } else {
2446                 /* CSA wasn't received recently, so this is the first one in
2447                  * the sequence. */
2448
2449                 if (csa_ie->csa_count < IEEE80211_CSA_PROTECTION_PERIOD) {
2450                         /* XXX abuse? */
2451                         IEEE80211_DISCARD_IE(vap,
2452                                         IEEE80211_MSG_ELEMID | 
2453                                         IEEE80211_MSG_DOTH,
2454                                         wh, "channel switch",
2455                                         "initial announcement: channel switch"
2456                                         " would occur too soon (in %u tbtt)",
2457                                         csa_ie->csa_count);
2458                         return 0;
2459                 }
2460
2461                 vap->iv_csa_mode = csa_ie->csa_mode;
2462                 vap->iv_csa_count = csa_ie->csa_count;
2463                 vap->iv_csa_chan = c;
2464
2465                 vap->iv_csa_timer.function = ieee80211_doth_switch_channel_tmr;
2466                 vap->iv_csa_timer.data = (unsigned long)vap;
2467                 vap->iv_csa_timer.expires = jiffies + IEEE80211_TU_TO_JIFFIES(
2468                     vap->iv_csa_count * ni->ni_intval + 10);
2469                 add_timer(&vap->iv_csa_timer);
2470         }
2471
2472         vap->iv_csa_jiffies = jiffies;
2473
2474         if (vap->iv_csa_count <= 1)
2475                 ieee80211_doth_switch_channel(vap);
2476
2477         return 0;
2478 }
2479
2480 /* XXX. Not the right place for such a definition */
2481 struct l2_update_frame {
2482         struct ether_header eh;
2483         u8 dsap;
2484         u8 ssap;
2485         u8 control;
2486         u8 xid[3];
2487 }  __packed;
2488
2489 static void
2490 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
2491 {
2492         struct ieee80211vap *vap = ni->ni_vap;
2493         struct net_device *dev = vap->iv_dev;
2494         struct sk_buff *skb;
2495         struct l2_update_frame *l2uf;
2496         struct ether_header *eh;
2497         
2498         skb = dev_alloc_skb(sizeof(*l2uf));
2499         if (!skb) {
2500                 printk("ieee80211_deliver_l2uf: no buf available\n");
2501                 return;
2502         }
2503         skb_put(skb, sizeof(*l2uf));    
2504         l2uf = (struct l2_update_frame *)(skb->data);
2505         eh = &l2uf->eh;
2506         /* dst: Broadcast address */
2507         IEEE80211_ADDR_COPY(eh->ether_dhost, dev->broadcast);
2508         /* src: associated STA */
2509         IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
2510         eh->ether_type = htons(skb->len - sizeof(*eh));
2511         
2512         l2uf->dsap = 0;
2513         l2uf->ssap = 0;
2514         l2uf->control = 0xf5;
2515         l2uf->xid[0] = 0x81;
2516         l2uf->xid[1] = 0x80;
2517         l2uf->xid[2] = 0x00;
2518         
2519         skb->dev = dev;
2520         skb->protocol = eth_type_trans(skb, dev);
2521         skb_reset_mac_header(skb);
2522
2523         ieee80211_deliver_data(ni, skb);
2524         return;
2525 }
2526
2527 static __inline int
2528 contbgscan(struct ieee80211vap *vap)
2529 {
2530         struct ieee80211com *ic = vap->iv_ic;
2531
2532         return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
2533                 time_after(jiffies, ic->ic_lastdata + vap->iv_bgscanidle));
2534 }
2535
2536 static __inline int
2537 startbgscan(struct ieee80211vap *vap)
2538 {
2539         struct ieee80211com *ic = vap->iv_ic;
2540
2541         return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
2542                 !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
2543                 time_after(jiffies, ic->ic_lastscan + vap->iv_bgscanintvl) &&
2544                 time_after(jiffies, ic->ic_lastdata + vap->iv_bgscanidle));
2545 }
2546
2547
2548 /*
2549  * Context: SoftIRQ
2550  */
2551 void
2552 ieee80211_recv_mgmt(struct ieee80211_node *ni, struct sk_buff *skb,
2553         int subtype, int rssi, u_int32_t rstamp)
2554 {
2555 #define ISPROBE(_st)    ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
2556 #define ISREASSOC(_st)  ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
2557         struct ieee80211vap *vap = ni->ni_vap;
2558         struct ieee80211com *ic = vap->iv_ic;
2559         struct ieee80211_frame *wh;
2560         u_int8_t *frm, *efrm;
2561         u_int8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath;
2562         u_int8_t rate;
2563         int reassoc, resp, allocbs;
2564         u_int8_t qosinfo;
2565
2566         wh = (struct ieee80211_frame *) skb->data;
2567         frm = (u_int8_t *)&wh[1];
2568         efrm = skb->data + skb->len;
2569
2570         /* forward management frame to application */
2571         if (vap->iv_opmode != IEEE80211_M_MONITOR)
2572                 forward_mgmt_to_app(vap, subtype, skb, wh);
2573
2574         switch (subtype) {
2575         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2576         case IEEE80211_FC0_SUBTYPE_BEACON: {
2577                 struct ieee80211_scanparams scan;
2578
2579                 /*
2580                  * We process beacon/probe response frames:
2581                  *    o when scanning, or
2582                  *    o station mode when associated (to collect state
2583                  *      updates such as 802.11g slot time), or
2584                  *    o adhoc mode (to discover neighbors)
2585                  * Frames otherwise received are discarded.
2586                  */ 
2587                 if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
2588                     (vap->iv_opmode == IEEE80211_M_STA && ni->ni_associd) ||
2589                     vap->iv_opmode == IEEE80211_M_IBSS)) {
2590                         vap->iv_stats.is_rx_mgtdiscard++;
2591                         return;
2592                 }
2593                 /*
2594                  * beacon/probe response frame format
2595                  *      [8] time stamp
2596                  *      [2] beacon interval
2597                  *      [2] capability information
2598                  *      [tlv] ssid
2599                  *      [tlv] supported rates
2600                  *      [tlv] country information
2601                  *      [tlv] parameter set (FH/DS)
2602                  *      [tlv] erp information
2603                  *      [tlv] extended supported rates
2604                  *      [tlv] WME
2605                  *      [tlv] WPA or RSN
2606                  *      [tlv] Atheros Advanced Capabilities
2607                  */
2608                 IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
2609                 memset(&scan, 0, sizeof(scan));
2610                 scan.tstamp  = frm;
2611                 frm += 8;
2612                 scan.bintval = le16toh(*(__le16 *)frm);
2613                 frm += 2;
2614                 scan.capinfo = le16toh(*(__le16 *)frm);
2615                 frm += 2;
2616                 scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2617                 scan.chan = scan.bchan;
2618
2619                 while (frm < efrm) {
2620                         /* Agere element in beacon */
2621                         if ((*frm == IEEE80211_ELEMID_AGERE1) ||
2622                             (*frm == IEEE80211_ELEMID_AGERE2)) {
2623                                 frm = efrm;
2624                                 continue;
2625                         }
2626
2627                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
2628                         switch (*frm) {
2629                         case IEEE80211_ELEMID_SSID:
2630                                 scan.ssid = frm;
2631                                 break;
2632                         case IEEE80211_ELEMID_RATES:
2633                                 scan.rates = frm;
2634                                 break;
2635                         case IEEE80211_ELEMID_COUNTRY:
2636                                 scan.country = frm;
2637                                 break;
2638                         case IEEE80211_ELEMID_FHPARMS:
2639                                 if (ic->ic_phytype == IEEE80211_T_FH) {
2640                                         scan.fhdwell = LE_READ_2(&frm[2]);
2641                                         scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
2642                                         scan.fhindex = frm[6];
2643                                 }
2644                                 break;
2645                         case IEEE80211_ELEMID_DSPARMS:
2646                                 /*
2647                                  * XXX hack this since depending on phytype
2648                                  * is problematic for multi-mode devices.
2649                                  */
2650                                 if (ic->ic_phytype != IEEE80211_T_FH)
2651                                         scan.chan = frm[2];
2652                                 break;
2653                         case IEEE80211_ELEMID_TIM:
2654                                 /* XXX ATIM? */
2655                                 scan.tim = frm;
2656                                 scan.timoff = frm - skb->data;
2657                                 break;
2658                         case IEEE80211_ELEMID_IBSSPARMS:
2659                                 break;
2660                         case IEEE80211_ELEMID_XRATES:
2661                                 scan.xrates = frm;
2662                                 break;
2663                         case IEEE80211_ELEMID_ERP:
2664                                 if (frm[1] != 1) {
2665                                         IEEE80211_DISCARD_IE(vap,
2666                                                 IEEE80211_MSG_ELEMID, wh, "ERP",
2667                                                 "bad len %u", frm[1]);
2668                                         vap->iv_stats.is_rx_elem_toobig++;
2669                                         break;
2670                                 }
2671                                 scan.erp = frm[2];
2672                                 break;
2673                         case IEEE80211_ELEMID_RSN:
2674                                 scan.rsn = frm;
2675                                 break;
2676                         case IEEE80211_ELEMID_VENDOR:
2677                                 if (iswpaoui(frm))
2678                                         scan.wpa = frm;
2679                                 else if (iswmeparam(frm) || iswmeinfo(frm))
2680                                         scan.wme = frm;
2681                                 else if (isatherosoui(frm))
2682                                         scan.ath = frm;
2683                                 break;
2684                         case IEEE80211_ELEMID_CHANSWITCHANN:
2685                                 if (ic->ic_flags & IEEE80211_F_DOTH)
2686                                         scan.csa = frm;
2687                                 break;
2688                         default:
2689                                 IEEE80211_DISCARD_IE(vap, IEEE80211_MSG_ELEMID,
2690                                         wh, "unhandled",
2691                                         "id %u, len %u", *frm, frm[1]);
2692                                 vap->iv_stats.is_rx_elem_unknown++;
2693                                 break;
2694                         }
2695                         frm += frm[1] + 2;
2696                 }
2697                 if (frm > efrm)
2698                         return;
2699                 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
2700                 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
2701 #if IEEE80211_CHAN_MAX < 255
2702                 if (scan.chan > IEEE80211_CHAN_MAX) {
2703                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID,
2704                                 wh, ieee80211_mgt_subtype_name[subtype >>
2705                                         IEEE80211_FC0_SUBTYPE_SHIFT],
2706                                 "invalid channel %u", scan.chan);
2707                         vap->iv_stats.is_rx_badchan++;
2708                         return;
2709                 }
2710 #endif
2711                 if (scan.chan != scan.bchan &&
2712                     ic->ic_phytype != IEEE80211_T_FH) {
2713                         /*
2714                          * Frame was received on a channel different from the
2715                          * one indicated in the DS params element id;
2716                          * silently discard it.
2717                          *
2718                          * NB: this can happen due to signal leakage.
2719                          *     But we should take it for FH phy because
2720                          *     the rssi value should be correct even for
2721                          *     different hop pattern in FH.
2722                          */
2723                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID,
2724                                 wh, ieee80211_mgt_subtype_name[subtype >>
2725                                         IEEE80211_FC0_SUBTYPE_SHIFT],
2726                                 "for off-channel %u", scan.chan);
2727                         vap->iv_stats.is_rx_chanmismatch++;
2728                         return;
2729                 }
2730
2731                 /* IEEE802.11 does not specify the allowed range for 
2732                  * beacon interval. We discard any beacons with a 
2733                  * beacon interval outside of an arbitrary range in
2734                  * order to protect against attack.
2735                  */
2736                 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval && 
2737                      scan.bintval <= IEEE80211_BINTVAL_MAX)) {
2738                         IEEE80211_DISCARD(vap, IEEE80211_MSG_SCAN,
2739                                 wh, "beacon", "invalid beacon interval (%u)", 
2740                                 scan.bintval);
2741                         return;
2742                 }
2743                 
2744                 /*
2745                  * Count frame now that we know it's to be processed.
2746                  */
2747                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
2748                         IEEE80211_NODE_STAT(ni, rx_beacons);
2749                 else
2750                         IEEE80211_NODE_STAT(ni, rx_proberesp);
2751
2752                 /*
2753                  * When operating in station mode, check for state updates.
2754                  * Be careful to ignore beacons received while doing a
2755                  * background scan.  We consider only 11g/WMM stuff right now.
2756                  */
2757                 if (vap->iv_opmode == IEEE80211_M_STA &&
2758                     ni->ni_associd != 0 &&
2759                     IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid)) {
2760                         /* record tsf of last beacon */
2761                         memcpy(ni->ni_tstamp.data, scan.tstamp,
2762                                 sizeof(ni->ni_tstamp));
2763                         if (ni->ni_intval != scan.bintval) {
2764                                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2765                                               "beacon interval divergence: was %u, now %u",
2766                                         ni->ni_intval, scan.bintval);
2767                                if (!ni->ni_intval_end) {
2768                                        int msecs = 0; /* silence compiler */
2769                                        ni->ni_intval_cnt = 0;
2770                                        ni->ni_intval_old = ni->ni_intval;
2771                                        msecs = (ni->ni_intval_old * 1024 * 10) / 1000;
2772                                        ni->ni_intval_end = jiffies +
2773                                                msecs_to_jiffies(msecs);
2774                                        IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2775                                                       "scheduling beacon interval measurement for %u msecs",
2776                                                       msecs);
2777                                }
2778                                if (scan.bintval > ni->ni_intval) {
2779                                        ni->ni_intval = scan.bintval;
2780                                        vap->iv_flags_ext |= IEEE80211_FEXT_APPIE_UPDATE;
2781                                }
2782                                /* XXX statistic */
2783                        }
2784                        if (ni->ni_intval_end) {
2785                                if (scan.bintval == ni->ni_intval_old)
2786                                        ni->ni_intval_cnt++;
2787                                if (!time_before(jiffies, ni->ni_intval_end)) {
2788                                        IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2789                                                       "beacon interval measurement finished, old value repeated: %u times",
2790                                                       ni->ni_intval_cnt);
2791                                        ni->ni_intval_end = 0;
2792                                        if (ni->ni_intval_cnt == 0) {
2793                                                IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2794                                                               "reprogramming bmiss timer from %u to %u",
2795                                                               ni->ni_intval_old, scan.bintval);
2796                                 ni->ni_intval = scan.bintval;
2797                                                vap->iv_flags_ext |= IEEE80211_FEXT_APPIE_UPDATE;
2798                                        } else {
2799                                                IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2800                                                               "ignoring the divergence (maybe someone tried to spoof the AP?)", 0);
2801                                        }
2802                                 }
2803                                 /* XXX statistic */
2804                         }
2805                         if (ni->ni_erp != scan.erp) {
2806                                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2807                                         "erp change: was 0x%x, now 0x%x",
2808                                         ni->ni_erp, scan.erp);
2809                                 if (scan.erp & IEEE80211_ERP_USE_PROTECTION)
2810                                         ic->ic_flags |= IEEE80211_F_USEPROT;
2811                                 else
2812                                         ic->ic_flags &= ~IEEE80211_F_USEPROT;
2813                                 ni->ni_erp = scan.erp;
2814                                 /* XXX statistic */
2815                         }
2816                         if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
2817                                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2818                                         "capabilities change: was 0x%x, now 0x%x",
2819                                         ni->ni_capinfo, scan.capinfo);
2820                                 /*
2821                                  * NB: we assume short preamble doesn't
2822                                  *     change dynamically
2823                                  */
2824                                 ieee80211_set_shortslottime(ic,
2825                                         IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
2826                                         (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2827                                 ni->ni_capinfo = scan.capinfo;
2828                                 /* XXX statistic */
2829                         }
2830                         if (scan.wme != NULL &&
2831                             (ni->ni_flags & IEEE80211_NODE_QOS)) {
2832                                 int _retval;
2833                                 if ((_retval = ieee80211_parse_wmeparams(vap, scan.wme, wh, &qosinfo)) >= 0) {
2834                                         if (qosinfo & WME_CAPINFO_UAPSD_EN)
2835                                                 ni->ni_flags |= IEEE80211_NODE_UAPSD;
2836                                         if (_retval > 0)
2837                                                 ieee80211_wme_updateparams(vap);
2838                                 }
2839                         } else
2840                                 ni->ni_flags &= ~IEEE80211_NODE_UAPSD;
2841                         if (scan.ath != NULL)
2842                                 ieee80211_parse_athParams(ni, scan.ath);
2843                         if (scan.csa != NULL || vap->iv_csa_jiffies)
2844                                 ieee80211_parse_csaie(ni, scan.csa, wh);
2845                         if (scan.tim != NULL) {
2846                                 /*
2847                                  * Check the TIM. For now we drop out of
2848                                  * power save mode for any reason.
2849                                  */
2850                                 struct ieee80211_tim_ie *tim =
2851                                     (struct ieee80211_tim_ie *) scan.tim;
2852                                 int aid = IEEE80211_AID(ni->ni_associd);
2853                                 int ix = aid / NBBY;
2854                                 int min = tim->tim_bitctl &~ 1;
2855                                 int max = tim->tim_len + min - 4;
2856                                 if ((tim->tim_bitctl&1) ||
2857                                     (min <= ix && ix <= max &&
2858                                     isset(tim->tim_bitmap - min, aid)))
2859                                         ieee80211_sta_pwrsave(vap, 0);
2860                                 vap->iv_dtim_count = tim->tim_count;
2861                         }
2862
2863                         /* WDS/Repeater: re-schedule software beacon timer for STA */
2864                         if (vap->iv_state == IEEE80211_S_RUN &&
2865                             vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS) {
2866                                 mod_timer(&vap->iv_swbmiss, jiffies + vap->iv_swbmiss_period);
2867                         }
2868                         
2869                         /*
2870                          * If scanning, pass the info to the scan module.
2871                          * Otherwise, check if it's the right time to do
2872                          * a background scan.  Background scanning must
2873                          * be enabled and we must not be operating in the
2874                          * turbo phase of dynamic turbo mode.  Then,
2875                          * it's been a while since the last background
2876                          * scan and if no data frames have come through
2877                          * recently, kick off a scan.  Note that this
2878                          * is the mechanism by which a background scan
2879                          * is started _and_ continued each time we
2880                          * return on-channel to receive a beacon from
2881                          * our ap.
2882                          */
2883                         if (ic->ic_flags & IEEE80211_F_SCAN)
2884                                 ieee80211_add_scan(vap, &scan, wh,
2885                                         subtype, rssi, rstamp);
2886                         else if (contbgscan(vap) || startbgscan(vap))
2887                                 ieee80211_bg_scan(vap);
2888                         return;
2889                 }
2890                 /*
2891                  * If scanning, just pass information to the scan module.
2892                  */
2893                 if (ic->ic_flags & IEEE80211_F_SCAN) {
2894                         ieee80211_add_scan(vap, &scan, wh, subtype, rssi, rstamp);
2895                         return;
2896                 }
2897                 if ((vap->iv_opmode == IEEE80211_M_IBSS) && 
2898                                 (scan.capinfo & IEEE80211_CAPINFO_IBSS)) {
2899                         if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2900                                 /* Create a new entry in the neighbor table. */
2901                                 ni = ieee80211_add_neighbor(vap, wh, &scan);
2902                         } else {
2903                                 /*
2904                                  * Copy data from beacon to neighbor table.
2905                                  * Some of this information might change after
2906                                  * ieee80211_add_neighbor(), so we just copy
2907                                  * everything over to be safe.
2908                                  */
2909                                 ni->ni_esslen = scan.ssid[1];
2910                                 memcpy(ni->ni_essid, scan.ssid + 2, scan.ssid[1]);
2911                                 IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
2912                                 memcpy(ni->ni_tstamp.data, scan.tstamp,
2913                                         sizeof(ni->ni_tstamp));
2914                                 ni->ni_intval = IEEE80211_BINTVAL_SANITISE(scan.bintval);
2915                                 ni->ni_capinfo = scan.capinfo;
2916                                 ni->ni_chan = ic->ic_curchan;
2917                                 ni->ni_fhdwell = scan.fhdwell;
2918                                 ni->ni_fhindex = scan.fhindex;
2919                                 ni->ni_erp = scan.erp;
2920                                 ni->ni_timoff = scan.timoff;
2921                                 if (scan.wme != NULL)
2922                                         ieee80211_saveie(&ni->ni_wme_ie, scan.wme);
2923                                 if (scan.wpa != NULL)
2924                                         ieee80211_saveie(&ni->ni_wpa_ie, scan.wpa);
2925                                 if (scan.rsn != NULL)
2926                                         ieee80211_saveie(&ni->ni_rsn_ie, scan.rsn);
2927                                 if (scan.ath != NULL)
2928                                         ieee80211_saveath(ni, scan.ath);
2929
2930                                 /* NB: must be after ni_chan is setup */
2931                                 ieee80211_setup_rates(ni, scan.rates,
2932                                         scan.xrates, IEEE80211_F_DOSORT);
2933                         }
2934                         if (ni != NULL) {
2935                                 ni->ni_rssi = rssi;
2936                                 ni->ni_rstamp = rstamp;
2937                                 ni->ni_last_rx = jiffies;
2938                         }
2939                 }
2940                 break;
2941         }
2942
2943         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2944                 if (vap->iv_opmode == IEEE80211_M_STA ||
2945                     vap->iv_opmode == IEEE80211_M_AHDEMO ||
2946                     vap->iv_state != IEEE80211_S_RUN) {
2947                         vap->iv_stats.is_rx_mgtdiscard++;
2948                         return;
2949                 }
2950                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
2951                         /* frame must be directed */
2952                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
2953                         return;
2954                 }
2955
2956 /*
2957  * XR vap does not process  probe requests.
2958  */
2959 #ifdef ATH_SUPERG_XR
2960         if(vap->iv_flags & IEEE80211_F_XR ) 
2961                 return;
2962 #endif
2963                 /*
2964                  * prreq frame format
2965                  *      [tlv] ssid
2966                  *      [tlv] supported rates
2967                  *      [tlv] extended supported rates
2968                  *      [tlv] Atheros Advanced Capabilities
2969                  */
2970                 ssid = rates = xrates = ath = NULL;
2971                 while (frm < efrm) {
2972                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
2973                         switch (*frm) {
2974                         case IEEE80211_ELEMID_SSID:
2975                                 ssid = frm;
2976                                 break;
2977                         case IEEE80211_ELEMID_RATES:
2978                                 rates = frm;
2979                                 break;
2980                         case IEEE80211_ELEMID_XRATES:
2981                                 xrates = frm;
2982                                 break;
2983                         case IEEE80211_ELEMID_VENDOR:
2984                                 if (isatherosoui(frm))
2985                                         ath = frm;
2986                                 /* XXX Atheros OUI support */
2987                                 break;
2988                         }
2989                         frm += frm[1] + 2;
2990                 }
2991                 if (frm > efrm)
2992                         return;
2993                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2994                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2995                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid);
2996                 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
2997                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2998                                 wh, ieee80211_mgt_subtype_name[subtype >>
2999                                         IEEE80211_FC0_SUBTYPE_SHIFT],
3000                                 "%s", "no ssid with ssid suppression enabled");
3001                         vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
3002                         return;
3003                 }
3004                 if (ni == vap->iv_bss) {
3005                         if (vap->iv_opmode == IEEE80211_M_IBSS) {
3006                                 /*
3007                                  * XXX Cannot tell if the sender is operating
3008                                  * in ibss mode.  But we need a new node to
3009                                  * send the response so blindly add them to the
3010                                  * neighbor table.
3011                                  */
3012                                 ni = ieee80211_fakeup_adhoc_node(vap,
3013                                         wh->i_addr2);
3014                         } else {
3015                                 ni = ieee80211_tmp_node(vap, wh->i_addr2);
3016                         }
3017                         if (ni == NULL)
3018                                 return;
3019                         allocbs = 1;
3020                 } else
3021                         allocbs = 0;
3022                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
3023                         "%s", "recv probe req");
3024                 ni->ni_rssi = rssi;
3025                 ni->ni_rstamp = rstamp;
3026                 ni->ni_last_rx = jiffies;
3027                 rate = ieee80211_setup_rates(ni, rates, xrates,
3028                         IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
3029                         IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
3030                 if (rate & IEEE80211_RATE_BASIC) {
3031                         IEEE80211_DISCARD(vap, IEEE80211_MSG_XRATE,
3032                                 wh, ieee80211_mgt_subtype_name[subtype >>
3033                                         IEEE80211_FC0_SUBTYPE_SHIFT],
3034                                 "%s", "recv'd rate set invalid");
3035                 } else {
3036                         IEEE80211_SEND_MGMT(ni,
3037                                 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
3038                 }
3039                 if (allocbs && vap->iv_opmode != IEEE80211_M_IBSS) {
3040                         /*
3041                          * Temporary node created just to send a
3042                          * response, reclaim immediately
3043                          */
3044                         ieee80211_free_node(ni);
3045                 } else if (ath != NULL)
3046                         ieee80211_saveath(ni, ath);
3047                 break;
3048
3049         case IEEE80211_FC0_SUBTYPE_AUTH: {
3050                 u_int16_t algo, seq, status;
3051                 /*
3052                  * auth frame format
3053                  *      [2] algorithm
3054                  *      [2] sequence
3055                  *      [2] status
3056                  *      [tlv*] challenge
3057                  */
3058                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
3059                 algo   = le16toh(*(__le16 *)frm);
3060                 seq    = le16toh(*(__le16 *)(frm + 2));
3061                 status = le16toh(*(__le16 *)(frm + 4));
3062 #ifdef ATH_SUPERG_XR
3063                 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
3064                         /*
3065                          * node roaming between XR and normal vaps. 
3066                          * this can only happen in AP mode. disaccociate from
3067                          * previous vap first.
3068                          */
3069                         if (vap->iv_xrvap) {
3070                                 if (ni == vap->iv_bss)
3071                                         ni = vap->iv_xrvap->iv_bss;
3072                                 else {
3073                                         ieee80211_node_leave(ni);
3074                                         ieee80211_node_reset(ni, vap->iv_xrvap);
3075                                 }
3076                                 vap = vap->iv_xrvap;
3077                         } else {
3078                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
3079                                         wh, "auth", "%s", "not to pier xr bssid");
3080                                 return;
3081                         }
3082                 }
3083 #endif
3084                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
3085                         "recv auth frame with algorithm %d seq %d", algo, seq);
3086                 /*
3087                  * Consult the ACL policy module if setup.
3088                  */
3089                 if (vap->iv_acl != NULL &&
3090                     !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
3091                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
3092                                 wh, "auth", "%s", "disallowed by ACL");
3093                         vap->iv_stats.is_rx_acl++;
3094                         return;
3095                 }
3096                 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
3097                         IEEE80211_DISCARD(vap,
3098                                 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
3099                                 wh, "auth", "%s", "TKIP countermeasures enabled");
3100                         vap->iv_stats.is_rx_auth_countermeasures++;
3101                         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
3102                                 ieee80211_send_error(ni, wh->i_addr2,
3103                                         IEEE80211_FC0_SUBTYPE_AUTH,
3104                                         IEEE80211_REASON_MIC_FAILURE);
3105                         }
3106                         return;
3107                 }
3108                 if (algo == IEEE80211_AUTH_ALG_SHARED)
3109                         ieee80211_auth_shared(ni, wh, frm + 6, efrm, rssi,
3110                                 rstamp, seq, status);
3111                 else if (algo == IEEE80211_AUTH_ALG_OPEN)
3112                         ieee80211_auth_open(ni, wh, rssi, rstamp, seq, status);
3113                 else {
3114                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
3115                                 wh, "auth", "unsupported alg %d", algo);
3116                         vap->iv_stats.is_rx_auth_unsupported++;
3117                         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
3118                                 /* XXX not right */
3119                                 ieee80211_send_error(ni, wh->i_addr2,
3120                                         IEEE80211_FC0_SUBTYPE_AUTH,
3121                                         (seq+1) | (IEEE80211_STATUS_ALG << 16));
3122                         }
3123                         return;
3124                 } 
3125                 break;
3126         }
3127
3128         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
3129         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
3130                 u_int16_t capinfo, bintval;
3131                 struct ieee80211_rsnparms rsn_parm;
3132                 u_int8_t reason;
3133
3134                 if (vap->iv_opmode != IEEE80211_M_HOSTAP ||
3135                     vap->iv_state != IEEE80211_S_RUN) {
3136                         vap->iv_stats.is_rx_mgtdiscard++;
3137                         return;
3138                 }
3139
3140                 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
3141                         reassoc = 1;
3142                         resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
3143                 } else {
3144                         reassoc = 0;
3145                         resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
3146                 }
3147
3148                 /*
3149                  * asreq frame format
3150                  *      [2] capability information
3151                  *      [2] listen interval
3152                  *      [6*] current AP address (reassoc only)
3153                  *      [tlv] ssid
3154                  *      [tlv] supported rates
3155                  *      [tlv] extended supported rates
3156                  *      [tlv] wpa or RSN
3157                  *      [tlv] WME
3158                  *      [tlv] Atheros Advanced Capabilities
3159                  */
3160                 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4));
3161                 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
3162                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
3163                                 wh, ieee80211_mgt_subtype_name[subtype >>
3164                                         IEEE80211_FC0_SUBTYPE_SHIFT],
3165                                 "%s", "wrong bssid");
3166                         vap->iv_stats.is_rx_assoc_bss++;
3167                         return;
3168                 }
3169                 capinfo = le16toh(*(__le16 *)frm);
3170                 frm += 2;
3171                 bintval = le16toh(*(__le16 *)frm);
3172                 frm += 2;
3173                 if (reassoc)
3174                         frm += 6;       /* ignore current AP info */
3175                 ssid = rates = xrates = wpa = rsn = wme = ath = NULL;
3176                 while (frm < efrm) {
3177                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
3178                         switch (*frm) {
3179                         case IEEE80211_ELEMID_SSID:
3180                                 ssid = frm;
3181                                 break;
3182                         case IEEE80211_ELEMID_RATES:
3183                                 rates = frm;
3184                                 break;
3185                         case IEEE80211_ELEMID_XRATES:
3186                                 xrates = frm;
3187                                 break;
3188                         /* XXX verify only one of RSN and WPA ie's? */
3189                         case IEEE80211_ELEMID_RSN:
3190                                 if (vap->iv_flags & IEEE80211_F_WPA2)
3191                                         rsn = frm;
3192                                 else
3193                                         IEEE80211_DPRINTF(vap,
3194                                                 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
3195                                                 "[%s] ignoring RSN IE in association request\n",
3196                                                 ether_sprintf(wh->i_addr2));
3197                                 break;
3198                         case IEEE80211_ELEMID_VENDOR:
3199                                 /* don't override RSN element
3200                                  * XXX: actually the driver should report both WPA versions,
3201                                  * so wpa_supplicant can choose and also detect downgrade attacks
3202                                  */
3203                                 if (iswpaoui(frm) && !wpa) {
3204                                         if (vap->iv_flags & IEEE80211_F_WPA1)
3205                                                 wpa = frm;
3206                                         else
3207                                                 IEEE80211_DPRINTF(vap,
3208                                                         IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
3209                                                         "[%s] ignoring WPA IE in association request\n",
3210                                                         ether_sprintf(wh->i_addr2));
3211                                 } else if (iswmeinfo(frm))
3212                                         wme = frm;
3213                                 else if (isatherosoui(frm))
3214                                         ath = frm;
3215                                 break;
3216                         }
3217                         frm += frm[1] + 2;
3218                 }
3219                 if (frm > efrm)
3220                         return;
3221                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
3222                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
3223                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid);
3224
3225                 if (ni == vap->iv_bss) {
3226                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
3227                                 "deny %s request, sta not authenticated",
3228                                 reassoc ? "reassoc" : "assoc");
3229                         ieee80211_send_error(ni, wh->i_addr2,
3230                                 IEEE80211_FC0_SUBTYPE_DEAUTH,
3231                                 IEEE80211_REASON_ASSOC_NOT_AUTHED);
3232                         vap->iv_stats.is_rx_assoc_notauth++;
3233                         return;
3234                 }
3235                 
3236                 /* Assert right associstion security credentials */
3237                 /* XXX Divy. Incomplete */
3238                 if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) {
3239                         IEEE80211_DPRINTF(vap,
3240                                 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
3241                                 "[%s] no WPA/RSN IE in association request\n",
3242                                 ether_sprintf(wh->i_addr2));
3243                         IEEE80211_SEND_MGMT(ni,
3244                                 IEEE80211_FC0_SUBTYPE_DEAUTH,
3245                                 IEEE80211_REASON_RSN_REQUIRED);
3246                         ieee80211_node_leave(ni);
3247                         /* XXX distinguish WPA/RSN? */
3248                         vap->iv_stats.is_rx_assoc_badwpaie++;
3249                         return; 
3250                 }
3251                                 
3252                 if (rsn != NULL) {
3253                         /*
3254                          * Parse WPA information element.  Note that
3255                          * we initialize the param block from the node
3256                          * state so that information in the IE overrides
3257                          * our defaults.  The resulting parameters are
3258                          * installed below after the association is assured.
3259                          */
3260                         rsn_parm = ni->ni_rsn;
3261                         if (rsn[0] != IEEE80211_ELEMID_RSN)
3262                                 reason = ieee80211_parse_wpa(vap, rsn, &rsn_parm, wh);
3263                         else
3264                                 reason = ieee80211_parse_rsn(vap, rsn, &rsn_parm, wh);
3265                         if (reason != 0) {
3266                                 IEEE80211_SEND_MGMT(ni,
3267                                         IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
3268                                 ieee80211_node_leave(ni);
3269                                 /* XXX distinguish WPA/RSN? */
3270                                 vap->iv_stats.is_rx_assoc_badwpaie++;
3271                                 return;
3272                         }
3273                         IEEE80211_NOTE_MAC(vap,
3274                                 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
3275                                 wh->i_addr2,
3276                                 "%s ie: mc %u/%u uc %u/%u key %u caps 0x%x",
3277                                 rsn[0] != IEEE80211_ELEMID_RSN ?  "WPA" : "RSN",
3278                                 rsn_parm.rsn_mcastcipher, rsn_parm.rsn_mcastkeylen,
3279                                 rsn_parm.rsn_ucastcipher, rsn_parm.rsn_ucastkeylen,
3280                                 rsn_parm.rsn_keymgmt, rsn_parm.rsn_caps);
3281                 }
3282                 /* discard challenge after association */
3283                 if (ni->ni_challenge != NULL) {
3284                         FREE(ni->ni_challenge, M_DEVBUF);
3285                         ni->ni_challenge = NULL;
3286                 }
3287                 /* 802.11 spec says to ignore station's privacy bit */
3288                 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
3289                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
3290             &n