[svn-upgrade] new version madwifi (0.9.4+r4139.20110504)
[debian/madwifi.git] / net80211 / ieee80211_input.c
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  * $Id: ieee80211_input.c 4139 2011-05-03 22:07:34Z proski $
33  */
34 #ifndef EXPORT_SYMTAB
35 #define EXPORT_SYMTAB
36 #endif
37
38 /*
39  * IEEE 802.11 input handling.
40  */
41 #if !defined(AUTOCONF_INCLUDED) && !defined(CONFIG_LOCALVERSION)
42 #include <linux/config.h>
43 #endif
44 #include <linux/version.h>
45 #include <linux/module.h>
46 #include <linux/skbuff.h>
47 #include <linux/netdevice.h>
48 #include <linux/etherdevice.h>
49 #include <linux/random.h>
50 #include <linux/if_vlan.h>
51 #include <net/iw_handler.h> /* wireless_send_event(..) */
52 #include <linux/wireless.h> /* SIOCGIWTHRSPY */
53 #include <linux/if_arp.h> /* ARPHRD_ETHER */
54
55 #include <net80211/if_llc.h>
56 #include <net80211/if_ethersubr.h>
57 #include <net80211/if_media.h>
58 #include <net80211/if_athproto.h>
59
60 #include <net80211/ieee80211_var.h>
61
62 #ifdef IEEE80211_DEBUG
63 /*
64  * Decide if a received management frame should be
65  * printed when debugging is enabled.  This filters some
66  * of the less interesting frames that come frequently
67  * (e.g. beacons).
68  */
69 static __inline int
70 doprint(struct ieee80211vap *vap, int subtype)
71 {
72         switch (subtype) {
73         case IEEE80211_FC0_SUBTYPE_BEACON:
74                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
75         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
76                 return (vap->iv_opmode == IEEE80211_M_IBSS);
77         }
78         return 1;
79 }
80
81 /*
82  * Emit a debug message about discarding a frame or information
83  * element.  One format is for extracting the mac address from
84  * the frame header; the other is for when a header is not
85  * available or otherwise appropriate.
86  */
87 #define IEEE80211_DISCARD(_vap, _m, _wh, _type, _fmt, ...) do {         \
88         if ((_vap)->iv_debug & (_m))                                    \
89                 ieee80211_discard_frame(_vap, _wh, _type, _fmt, __VA_ARGS__);\
90 } while (0)
91 #define IEEE80211_DISCARD_IE(_vap, _m, _wh, _type, _fmt, ...) do {      \
92         if ((_vap)->iv_debug & (_m))                                    \
93                 ieee80211_discard_ie(_vap, _wh, _type, _fmt, __VA_ARGS__);\
94 } while (0)
95 #define IEEE80211_DISCARD_MAC(_vap, _m, _mac, _type, _fmt, ...) do {    \
96         if ((_vap)->iv_debug & (_m))                                    \
97                 ieee80211_discard_mac(_vap, _mac, _type, _fmt, __VA_ARGS__);\
98 } while (0)
99
100 static const u_int8_t *ieee80211_getbssid(struct ieee80211vap *,
101         const struct ieee80211_frame *);
102 static void ieee80211_discard_frame(struct ieee80211vap *,
103         const struct ieee80211_frame *, const char *, const char *, ...);
104 static void ieee80211_discard_ie(struct ieee80211vap *,
105         const struct ieee80211_frame *, const char *, const char *, ...);
106 static void ieee80211_discard_mac(struct ieee80211vap *,
107         const u_int8_t mac[IEEE80211_ADDR_LEN], const char *,
108         const char *, ...);
109 #else
110 #define IEEE80211_DISCARD(_vap, _m, _wh, _type, _fmt, ...)
111 #define IEEE80211_DISCARD_IE(_vap, _m, _wh, _type, _fmt, ...)
112 #define IEEE80211_DISCARD_MAC(_vap, _m, _mac, _type, _fmt, ...)
113 #endif /* IEEE80211_DEBUG */
114
115 static struct sk_buff *ieee80211_defrag(struct ieee80211_node *,
116         struct sk_buff *, int);
117 static void ieee80211_deliver_data(struct ieee80211_node *, struct sk_buff *);
118 static struct sk_buff *ieee80211_decap(struct ieee80211vap *,
119         struct sk_buff *, int);
120 static void ieee80211_send_error(struct ieee80211_node *, const u_int8_t *,
121         int, int);
122 static void ieee80211_recv_pspoll(struct ieee80211_node *, struct sk_buff *);
123 static int accept_data_frame(struct ieee80211vap *, struct ieee80211_node *,
124         struct ieee80211_key *, struct sk_buff *, struct ether_header *);
125
126
127 #ifdef ATH_SUPERG_FF
128 static void athff_decap(struct sk_buff *);
129 #endif
130 #ifdef USE_HEADERLEN_RESV
131 static __be16 ath_eth_type_trans(struct sk_buff *, struct net_device *);
132 #endif
133
134 #if WIRELESS_EXT >= 16
135 /**
136  * Given a node and the RSSI value of a just received frame from the node, this
137  * function checks if to raise an iwspy event because we iwspy the node and RSSI
138  * exceeds threshold (if active).
139  * 
140  * @param vap: VAP
141  * @param ni: sender node
142  * @param rssi: RSSI value of received frame
143  */
144 static void
145 iwspy_event(struct ieee80211vap *vap, struct ieee80211_node *ni, u_int rssi)
146 {
147         if (vap->iv_spy.thr_low && vap->iv_spy.num && ni && (rssi <
148                 vap->iv_spy.thr_low || rssi > vap->iv_spy.thr_high)) {
149                 int i;
150                 for (i = 0; i < vap->iv_spy.num; i++) {
151                         if (IEEE80211_ADDR_EQ(ni->ni_macaddr,
152                                 &(vap->iv_spy.mac[i * IEEE80211_ADDR_LEN]))) {
153                                         
154                                 union iwreq_data wrq;
155                                 struct iw_thrspy thr;
156                                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_DEBUG,
157                                         "%s: we spy %s, threshold is active "
158                                         "and rssi exceeds it -> raise an iwspy"
159                                         " event\n", __func__, ether_sprintf(
160                                          ni->ni_macaddr));
161                                 memset(&wrq, 0, sizeof(wrq));
162                                 wrq.data.length = 1;
163                                 memset(&thr, 0, sizeof(struct iw_thrspy));
164                                 memcpy(thr.addr.sa_data, ni->ni_macaddr,
165                                         IEEE80211_ADDR_LEN);
166                                 thr.addr.sa_family = ARPHRD_ETHER;
167                                 set_quality(&thr.qual, rssi, vap->iv_ic->ic_channoise);
168                                 set_quality(&thr.low, vap->iv_spy.thr_low, vap->iv_ic->ic_channoise);
169                                 set_quality(&thr.high, vap->iv_spy.thr_high, vap->iv_ic->ic_channoise);
170                                 wireless_send_event(vap->iv_dev,
171                                         SIOCGIWTHRSPY, &wrq, (char*) &thr);
172                                 break;
173                         }
174                 }
175         }
176 }
177
178 #else
179 #define iwspy_event(_vap, _ni, _rssi)
180 #endif /* WIRELESS_EXT >= 16 */
181
182 /*
183  * Process a received frame.  The node associated with the sender
184  * should be supplied.  If nothing was found in the node table then
185  * the caller is assumed to supply a reference to ic_bss instead.
186  * The RSSI and a timestamp are also supplied.  The RSSI data is used
187  * during AP scanning to select a AP to associate with; it can have
188  * any units so long as values have consistent units and higher values
189  * mean ``better signal''.  The receive timestamp is currently not used
190  * by the 802.11 layer.
191  *
192  * Context: softIRQ (tasklet)
193  */
194 int
195 ieee80211_input(struct ieee80211_node *ni,
196         struct sk_buff *skb, int rssi, u_int32_t rstamp)
197 {
198 #define HAS_SEQ(type)   ((type & 0x4) == 0)
199         struct ieee80211vap *vap = ni->ni_vap;
200         struct ieee80211com *ic = vap->iv_ic;
201         struct net_device *dev = vap->iv_dev;
202         struct ieee80211_frame *wh;
203         struct ieee80211_key *key;
204         struct ether_header *eh;
205 #ifdef ATH_SUPERG_FF
206         struct llc *llc;
207 #endif
208         int hdrspace;
209         u_int8_t dir, type, subtype;
210         u_int8_t *bssid;
211         u_int16_t rxseq;
212
213         KASSERT(ni != NULL, ("null node"));
214         ni->ni_inact = ni->ni_inact_reload;
215
216         KASSERT(skb->len >= sizeof(struct ieee80211_frame_min),
217                 ("frame length too short: %u", skb->len));
218
219         /* XXX adjust device in sk_buff? */
220
221         type = -1;                      /* undefined */
222         /*
223          * In monitor mode, send everything directly to bpf.
224          * Also do not process frames w/o i_addr2 any further.
225          * XXX may want to include the CRC
226          */
227         if (vap->iv_opmode == IEEE80211_M_MONITOR)
228                 goto out;
229
230         if (skb->len < sizeof(struct ieee80211_frame_min)) {
231                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
232                         ni->ni_macaddr, NULL,
233                         "too short (1): len %u", skb->len);
234                 vap->iv_stats.is_rx_tooshort++;
235                 goto out;
236         }
237         /*
238          * Bit of a cheat here, we use a pointer for a 3-address
239          * frame format but don't reference fields past outside
240          * ieee80211_frame_min w/o first validating the data is
241          * present.
242          */
243         wh = (struct ieee80211_frame *)skb->data;
244
245         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
246             IEEE80211_FC0_VERSION_0) {
247                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
248                         ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
249                 vap->iv_stats.is_rx_badversion++;
250                 goto err;
251         }
252
253         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
254         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
255         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
256         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
257                 switch (vap->iv_opmode) {
258                 case IEEE80211_M_STA:
259                         bssid = wh->i_addr2;
260                         if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
261                                 /* not interested in */
262                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
263                                         bssid, NULL, "%s", "not to bss");
264                                 vap->iv_stats.is_rx_wrongbss++;
265                                 goto out;
266                         }
267                         iwspy_event(vap, ni, rssi);
268                         break;
269                 case IEEE80211_M_IBSS:
270                 case IEEE80211_M_AHDEMO:
271                         if (dir != IEEE80211_FC1_DIR_NODS)
272                                 bssid = wh->i_addr1;
273                         else if (type == IEEE80211_FC0_TYPE_CTL)
274                                 bssid = wh->i_addr1;
275                         else {
276                                 if (skb->len < sizeof(struct ieee80211_frame)) {
277                                         IEEE80211_DISCARD_MAC(vap,
278                                                 IEEE80211_MSG_ANY, ni->ni_macaddr,
279                                                 NULL, "too short (2): len %u",
280                                                 skb->len);
281                                         vap->iv_stats.is_rx_tooshort++;
282                                         goto out;
283                                 }
284                                 bssid = wh->i_addr3;
285                         }
286                         /* Do not try to find a node reference if the packet really did come from the BSS */
287                         if (type == IEEE80211_FC0_TYPE_DATA && ni == vap->iv_bss &&
288                                         !IEEE80211_ADDR_EQ(vap->iv_bss->ni_macaddr, wh->i_addr2)) {
289                                 /* Try to find sender in local node table. */
290                                 ni = ieee80211_find_node(vap->iv_bss->ni_table, wh->i_addr2);
291                                 if (ni == NULL) {
292                                         /*
293                                          * Fake up a node for this newly discovered
294                                          * member of the IBSS.  This should probably
295                                          * done after an ACL check.
296                                          */
297                                         ni = ieee80211_fakeup_adhoc_node(vap,
298                                                         wh->i_addr2);
299                                         if (ni == NULL) {
300                                                 /* NB: stat kept for alloc failure */
301                                                 goto err;
302                                         }
303                                 }
304                         }
305                         iwspy_event(vap, ni, rssi);
306                         break;
307                 case IEEE80211_M_HOSTAP:
308                         if (dir != IEEE80211_FC1_DIR_NODS)
309                                 bssid = wh->i_addr1;
310                         else if (type == IEEE80211_FC0_TYPE_CTL)
311                                 bssid = wh->i_addr1;
312                         else {
313                                 if (skb->len < sizeof(struct ieee80211_frame)) {
314                                         IEEE80211_DISCARD_MAC(vap,
315                                                 IEEE80211_MSG_ANY, ni->ni_macaddr,
316                                                 NULL, "too short (2): len %u",
317                                                 skb->len);
318                                         vap->iv_stats.is_rx_tooshort++;
319                                         goto out;
320                                 }
321                                 bssid = wh->i_addr3;
322                         }
323                         /*
324                          * Validate the bssid.
325                          */
326 #ifdef ATH_SUPERG_XR
327                         if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
328                             !IEEE80211_ADDR_EQ(bssid, dev->broadcast)) {
329                                 /*
330                                  * allow MGT frames to vap->iv_xrvap.
331                                  * this will allow roaming between  XR and normal vaps
332                                  * without station dis associating from previous vap.
333                                  */
334                                 if (!(vap->iv_xrvap && 
335                                     IEEE80211_ADDR_EQ(bssid, vap->iv_xrvap->iv_bss->ni_bssid) &&
336                                     type == IEEE80211_FC0_TYPE_MGT && 
337                                     ni != vap->iv_bss)) {
338                                         /* not interested in */
339                                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
340                                                 bssid, NULL, "%s", "not to bss or xrbss");
341                                         vap->iv_stats.is_rx_wrongbss++;
342                                         goto out;
343                                 }
344                         }
345 #else
346                         if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
347                             !IEEE80211_ADDR_EQ(bssid, dev->broadcast)) {
348                                 /* not interested in */
349                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
350                                         bssid, NULL, "%s", "not to bss");
351                                 vap->iv_stats.is_rx_wrongbss++;
352                                 goto out;
353                         }
354
355 #endif
356                         break;
357                 case IEEE80211_M_WDS:
358                         if (skb->len < sizeof(struct ieee80211_frame_addr4)) {
359                                 IEEE80211_DISCARD_MAC(vap,
360                                         IEEE80211_MSG_ANY, ni->ni_macaddr,
361                                         NULL, "too short (3): len %u",
362                                         skb->len);
363                                 vap->iv_stats.is_rx_tooshort++;
364                                 goto out;
365                         }
366                         bssid = wh->i_addr1;
367                         if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
368                             !IEEE80211_ADDR_EQ(bssid, dev->broadcast)) {
369                                 /* not interested in */
370                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
371                                         bssid, NULL, "%s", "not to bss");
372                                 vap->iv_stats.is_rx_wrongbss++;
373                                 goto out;
374                         }
375                         if (!IEEE80211_ADDR_EQ(wh->i_addr2, vap->wds_mac)) {
376                                 /* not interested in */
377                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
378                                         wh->i_addr2, NULL, "%s", "not from DS");
379                                 vap->iv_stats.is_rx_wrongbss++;
380                                 goto out;       
381                         }
382                         break;
383                 default:
384                         /* XXX catch bad values */
385                         goto out;
386                 }
387                 ni->ni_rssi = rssi;
388                 ni->ni_rstamp = rstamp;
389                 ni->ni_last_rx = jiffies;
390                 if (HAS_SEQ(type)) {
391                         u_int8_t tid;
392                         if (IEEE80211_QOS_HAS_SEQ(wh)) {
393                                 tid = ((struct ieee80211_qosframe *)wh)->
394                                         i_qos[0] & IEEE80211_QOS_TID;
395                                 if (TID_TO_WME_AC(tid) >= WME_AC_VI)
396                                         ic->ic_wme.wme_hipri_traffic++;
397                                 tid++;
398                         } else
399                                 tid = 0;
400                         rxseq = le16toh(*(__le16 *)wh->i_seq);
401                         if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
402                             IEEE80211_SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
403                                 /* duplicate, discard */
404                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
405                                         bssid, "duplicate",
406                                         "seqno <%u,%u> fragno <%u,%u> tid %u",
407                                         rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
408                                         ni->ni_rxseqs[tid] >>
409                                                 IEEE80211_SEQ_SEQ_SHIFT,
410                                         rxseq & IEEE80211_SEQ_FRAG_MASK,
411                                         ni->ni_rxseqs[tid] &
412                                                 IEEE80211_SEQ_FRAG_MASK,
413                                         tid);
414                                 vap->iv_stats.is_rx_dup++;
415                                 IEEE80211_NODE_STAT(ni, rx_dup);
416                                 goto out;
417                         }
418                         ni->ni_rxseqs[tid] = rxseq;
419                 }
420         }
421
422         switch (type) {
423         case IEEE80211_FC0_TYPE_DATA:
424                 hdrspace = ieee80211_hdrspace(ic, wh);
425                 if (skb->len < hdrspace) {
426                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
427                                 wh, "data", "too short: len %u, expecting %u",
428                                 skb->len, hdrspace);
429                         vap->iv_stats.is_rx_tooshort++;
430                         goto out;               /* XXX */
431                 }
432                 switch (vap->iv_opmode) {
433                 case IEEE80211_M_STA:
434                         if ((dir != IEEE80211_FC1_DIR_FROMDS) &&
435                             (!((vap->iv_flags_ext & IEEE80211_FEXT_WDS) &&
436                             (dir == IEEE80211_FC1_DIR_DSTODS)))) {
437                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
438                                         wh, "data", "invalid dir 0x%x", dir);
439                                 vap->iv_stats.is_rx_wrongdir++;
440                                 goto out;
441                         }
442                         if ((dev->flags & IFF_MULTICAST) &&
443                             IEEE80211_IS_MULTICAST(wh->i_addr1)) {
444                                 if (IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr)) {
445                                         /*
446                                          * In IEEE802.11 network, multicast packet
447                                          * sent from me is broadcasted from AP.
448                                          * It should be silently discarded for
449                                          * SIMPLEX interface.
450                                          *
451                                          * NB: Linux has no IFF_ flag to indicate
452                                          *     if an interface is SIMPLEX or not;
453                                          *     so we always assume it to be true.
454                                          */
455                                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
456                                                 wh, NULL, "%s", "multicast echo");
457                                         vap->iv_stats.is_rx_mcastecho++;
458                                         goto out;
459                                 }
460                                 /* 
461                                  * if it is brodcasted by me on behalf of
462                                  * a station behind me, drop it.
463                                  */
464                                 if (vap->iv_flags_ext & IEEE80211_FEXT_WDS) {
465                                         struct ieee80211_node_table *nt;
466                                         struct ieee80211_node *ni_wds;
467                                         nt = &ic->ic_sta;
468                                         ni_wds = ieee80211_find_wds_node(nt, wh->i_addr3);
469                                         if (ni_wds) {
470                                                 ieee80211_free_node(ni_wds); /* Decr ref count */
471                                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
472                                                         wh, NULL, "%s",
473                                                         "multicast echo originated from node behind me");
474                                                 vap->iv_stats.is_rx_mcastecho++;
475                                                 goto out;
476                                         } 
477                                 }
478                         }
479                         break;
480                 case IEEE80211_M_IBSS:
481                 case IEEE80211_M_AHDEMO:
482                         if (dir != IEEE80211_FC1_DIR_NODS) {
483                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
484                                         wh, "data", "invalid dir 0x%x", dir);
485                                 vap->iv_stats.is_rx_wrongdir++;
486                                 goto out;
487                         }
488                         /* XXX no power-save support */
489                         break;
490                 case IEEE80211_M_HOSTAP:
491                         if ((dir != IEEE80211_FC1_DIR_TODS) &&
492                             (dir != IEEE80211_FC1_DIR_DSTODS)) {
493                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
494                                         wh, "data", "invalid dir 0x%x", dir);
495                                 vap->iv_stats.is_rx_wrongdir++;
496                                 goto out;
497                         }
498                         /* check if source STA is associated */
499                         if (ni == vap->iv_bss) {
500                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
501                                         wh, "data", "%s", "unknown src");
502                                 /* NB: caller deals with reference */
503                                 if (vap->iv_state == IEEE80211_S_RUN)
504                                         ieee80211_send_error(ni, wh->i_addr2,
505                                                 IEEE80211_FC0_SUBTYPE_DEAUTH,
506                                                 IEEE80211_REASON_NOT_AUTHED);
507                                 vap->iv_stats.is_rx_notassoc++;
508                                 goto err;
509                         }
510                         if (ni->ni_associd == 0) {
511                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
512                                         wh, "data", "%s", "unassoc src");
513                                 IEEE80211_SEND_MGMT(ni,
514                                         IEEE80211_FC0_SUBTYPE_DISASSOC,
515                                         IEEE80211_REASON_NOT_ASSOCED);
516                                 vap->iv_stats.is_rx_notassoc++;
517                                 goto err;
518                         }
519                         /*
520                          * If we're a 4 address packet, make sure we have an entry in
521                          * the node table for the packet source address (addr4).
522                          * If not, add one.
523                          */
524                         if (dir == IEEE80211_FC1_DIR_DSTODS) {
525                                 struct ieee80211_node_table *nt;
526                                 struct ieee80211_frame_addr4 *wh4;
527                                 struct ieee80211_node *ni_wds;
528                                 if (!(vap->iv_flags_ext & IEEE80211_FEXT_WDS)) {
529                                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
530                                                 wh, "data", "%s", "4 addr not allowed");
531                                         goto err;
532                                 }
533                                 wh4 = (struct ieee80211_frame_addr4 *)skb->data;
534                                 nt = &ic->ic_sta;
535                                 ni_wds = ieee80211_find_wds_node(nt, wh4->i_addr4);
536                                 /* Last call increments ref count if !NULL */
537                                 if ((ni_wds != NULL) && (ni_wds != ni)) {
538                                         /*
539                                          * node with source address (addr4) moved
540                                          * to another WDS capable station. remove the
541                                          * reference to the previous station and add 
542                                          * reference to the new one
543                                          */
544                                          (void) ieee80211_remove_wds_addr(nt, wh4->i_addr4);
545                                          ieee80211_add_wds_addr(nt, ni, wh4->i_addr4, 0);
546                                 }
547                                 if (ni_wds == NULL)
548                                         ieee80211_add_wds_addr(nt, ni, wh4->i_addr4, 0);
549                                 else
550                                         ieee80211_free_node(ni_wds); /* Decr ref count */
551                         }
552                         
553                         /*
554                          * Check for power save state change.
555                          */
556                         if (!(ni->ni_flags & IEEE80211_NODE_UAPSD)) {
557                                 if ((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
558                                     (ni->ni_flags & IEEE80211_NODE_PWR_MGT))
559                                         ieee80211_node_pwrsave(ni, wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
560                         } else if (ni->ni_flags & IEEE80211_NODE_PS_CHANGED) {
561                                 int pwr_save_changed = 0;
562                                 IEEE80211_LOCK_IRQ(ic);
563                                 if ((*(__le16 *)(&wh->i_seq[0])) == ni->ni_pschangeseq) {
564                                         ni->ni_flags &= ~IEEE80211_NODE_PS_CHANGED;
565                                         pwr_save_changed = 1;
566                                 }
567                                 IEEE80211_UNLOCK_IRQ(ic);
568                                 if (pwr_save_changed)
569                                         ieee80211_node_pwrsave(ni, wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
570                         }
571                         break;
572                 case IEEE80211_M_WDS:
573                         if (dir != IEEE80211_FC1_DIR_DSTODS) {
574                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
575                                         wh, "data", "invalid dir 0x%x", dir);
576                                 vap->iv_stats.is_rx_wrongdir++;
577                                 goto out;
578                         }
579                         break;
580                 default:
581                         /* XXX here to keep compiler happy */
582                         goto out;
583                 }
584
585                 /*
586                  * Handle privacy requirements.  Note that we
587                  * must not be preempted from here until after
588                  * we (potentially) call ieee80211_crypto_demic;
589                  * otherwise we may violate assumptions in the
590                  * crypto cipher modules used to do delayed update
591                  * of replay sequence numbers.
592                  */
593                 if (wh->i_fc[1] & IEEE80211_FC1_PROT) {
594                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
595                                 /*
596                                  * Discard encrypted frames when privacy is off.
597                                  */
598                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
599                                         wh, "WEP", "%s", "PRIVACY off");
600                                 vap->iv_stats.is_rx_noprivacy++;
601                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
602                                 goto out;
603                         }
604                         key = ieee80211_crypto_decap(ni, skb, hdrspace);
605                         if (key == NULL) {
606                                 /* NB: stats+msgs handled in crypto_decap */
607                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
608                                 goto out;
609                         }
610                         wh = (struct ieee80211_frame *)skb->data;
611                         wh->i_fc[1] &= ~IEEE80211_FC1_PROT;
612                 } else
613                         key = NULL;
614
615                 /*
616                  * Next up, any fragmentation.
617                  */
618                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
619                         skb = ieee80211_defrag(ni, skb, hdrspace);
620                         if (skb == NULL) {
621                                 /* Fragment dropped or frame not complete yet */
622                                 goto out;
623                         }
624                 }
625                 wh = NULL;              /* no longer valid, catch any uses */
626
627                 /*
628                  * Next strip any MSDU crypto bits.
629                  */
630                 if (key != NULL &&
631                     !ieee80211_crypto_demic(vap, key, skb, hdrspace)) {
632                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
633                                 ni->ni_macaddr, "data", "%s", "demic error");
634                         IEEE80211_NODE_STAT(ni, rx_demicfail);
635                         goto out;
636                 }
637
638                 /*
639                  * Finally, strip the 802.11 header.
640                  */
641                 skb = ieee80211_decap(vap, skb, hdrspace);
642                 if (skb == NULL) {
643                         /* don't count Null data frames as errors */
644                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA)
645                                 goto out;
646                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
647                                 ni->ni_macaddr, "data", "%s", "decap error");
648                         vap->iv_stats.is_rx_decap++;
649                         IEEE80211_NODE_STAT(ni, rx_decap);
650                         goto err;
651                 }
652                 eh = (struct ether_header *) skb->data;
653
654                 if (! accept_data_frame(vap, ni, key, skb, eh))
655                         goto out;
656
657                 vap->iv_devstats.rx_packets++;
658                 vap->iv_devstats.rx_bytes += skb->len;
659                 IEEE80211_NODE_STAT(ni, rx_data);
660                 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, skb->len);
661                 ic->ic_lastdata = jiffies;
662
663 #ifdef ATH_SUPERG_FF
664                 /* check for FF */
665                 llc = (struct llc *) (skb->data + sizeof(struct ether_header));
666                 if (ntohs(llc->llc_snap.ether_type) == (u_int16_t)ATH_ETH_TYPE) {
667                         struct sk_buff *skb1 = NULL;
668                         struct ether_header *eh_tmp;
669                         struct athl2p_tunnel_hdr *ath_hdr;
670                         int frame_len;
671
672                         /* NB: assumes linear (i.e., non-fragmented) skb */
673
674                         /* check length > header */
675                         if (skb->len < sizeof(struct ether_header) + LLC_SNAPFRAMELEN
676                             + roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2) {
677                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
678                                         ni->ni_macaddr, "data", "%s", "decap error");
679                                         vap->iv_stats.is_rx_decap++;
680                                 IEEE80211_NODE_STAT(ni, rx_decap);
681                                 goto err;
682                         }
683
684                         /* get to the tunneled headers */
685                         ath_hdr = (struct athl2p_tunnel_hdr *)
686                                 skb_pull(skb, sizeof(struct ether_header) + LLC_SNAPFRAMELEN);
687                         eh_tmp = (struct ether_header *)
688                                 skb_pull(skb, roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2);
689                         /* sanity check for malformed 802.3 length */
690                         frame_len = ntohs(eh_tmp->ether_type);
691                         if (skb->len < roundup(sizeof(struct ether_header) + frame_len, 4)) {
692                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
693                                         ni->ni_macaddr, "data", "%s", "decap error");
694                                         vap->iv_stats.is_rx_decap++;
695                                 IEEE80211_NODE_STAT(ni, rx_decap);
696                                 goto err;
697                         }
698
699                         /* only implementing FF now. drop all others. */
700                         if (ath_hdr->proto != ATH_L2TUNNEL_PROTO_FF) {
701                                 IEEE80211_DISCARD_MAC(vap,
702                                         IEEE80211_MSG_SUPG | IEEE80211_MSG_INPUT,
703                                         eh->ether_shost, "fast-frame",
704                                         "bad atheros tunnel prot %u",
705                                         ath_hdr->proto);
706                                 vap->iv_stats.is_rx_badathtnl++;
707                                 goto err;
708                         }
709                         vap->iv_stats.is_rx_ffcnt++;
710                         
711                         skb1 = skb_clone(skb, GFP_ATOMIC); /* XXX: GFP_ATOMIC is overkill? */
712
713                         /* we now have 802.3 MAC hdr followed by 802.2 LLC/SNAP. convert to DIX */
714                         athff_decap(skb);
715
716                         /* remove second frame from end of first */
717                         skb_trim(skb, sizeof(struct ether_header) + frame_len - LLC_SNAPFRAMELEN);
718
719                         /* prepare second tunneled frame */
720                         skb_pull(skb1, roundup(sizeof(struct ether_header) + frame_len, 4));
721                         athff_decap(skb1);
722
723                         /* deliver the frames */
724                         ieee80211_deliver_data(ni, skb);
725                         ieee80211_deliver_data(ni, skb1);
726                 } else {
727                         /* assume non-atheros llc type */
728                         ieee80211_deliver_data(ni, skb);
729                 }
730 #else /* !ATH_SUPERG_FF */
731                 ieee80211_deliver_data(ni, skb);
732 #endif
733                 return IEEE80211_FC0_TYPE_DATA;
734
735         case IEEE80211_FC0_TYPE_MGT:
736                 /*
737                  * WDS opmode do not support management frames
738                  */
739                 if (vap->iv_opmode == IEEE80211_M_WDS) {
740                         vap->iv_stats.is_rx_mgtdiscard++;
741                         goto out;
742                 }
743                 IEEE80211_NODE_STAT(ni, rx_mgmt);
744                 if (dir != IEEE80211_FC1_DIR_NODS) {
745                         vap->iv_stats.is_rx_wrongdir++;
746                         goto err;
747                 }
748                 if (skb->len < sizeof(struct ieee80211_frame)) {
749                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
750                                 ni->ni_macaddr, "mgt", "too short: len %u",
751                                 skb->len);
752                         vap->iv_stats.is_rx_tooshort++;
753                         goto out;
754                 }
755 #ifdef IEEE80211_DEBUG
756                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
757                     ieee80211_msg_dumppkts(vap)) {
758                         ieee80211_note(vap, "received %s from %s rssi %d\n",
759                                 ieee80211_mgt_subtype_name[subtype >>
760                                 IEEE80211_FC0_SUBTYPE_SHIFT],
761                                 ether_sprintf(wh->i_addr2), rssi);
762                 }
763 #endif
764                 if (wh->i_fc[1] & IEEE80211_FC1_PROT) {
765                         if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
766                                 /*
767                                  * Only shared key auth frames with a challenge
768                                  * should be encrypted, discard all others.
769                                  */
770                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
771                                         wh, ieee80211_mgt_subtype_name[subtype >>
772                                         IEEE80211_FC0_SUBTYPE_SHIFT],
773                                         "%s", "WEP set but not permitted");
774                                 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
775                                 goto out;
776                         }
777                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
778                                 /*
779                                  * Discard encrypted frames when privacy is off.
780                                  */
781                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
782                                         wh, "mgt", "%s", "WEP set but PRIVACY off");
783                                 vap->iv_stats.is_rx_noprivacy++;
784                                 goto out;
785                         }
786                         hdrspace = ieee80211_hdrspace(ic, wh);
787                         key = ieee80211_crypto_decap(ni, skb, hdrspace);
788                         if (key == NULL) {
789                                 /* NB: stats+msgs handled in crypto_decap */
790                                 goto out;
791                         }
792                         wh = (struct ieee80211_frame *)skb->data;
793                         wh->i_fc[1] &= ~IEEE80211_FC1_PROT;
794                 }
795                 ic->ic_recv_mgmt(ni, skb, subtype, rssi, rstamp);
796                 goto out;
797
798         case IEEE80211_FC0_TYPE_CTL:
799                 IEEE80211_NODE_STAT(ni, rx_ctrl);
800                 vap->iv_stats.is_rx_ctl++;
801                 if (vap->iv_opmode == IEEE80211_M_HOSTAP)
802                         if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
803                                 ieee80211_recv_pspoll(ni, skb);
804                 goto out;
805
806         default:
807                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
808                         wh, NULL, "bad frame type 0x%x", type);
809                 /* should not come here */
810                 break;
811         }
812 err:
813         vap->iv_devstats.rx_errors++;
814 out:
815         if (skb != NULL)
816                 dev_kfree_skb(skb);
817         return type;
818 #undef HAS_SEQ
819 }
820 EXPORT_SYMBOL(ieee80211_input);
821
822
823 /*
824  * Determines whether a frame should be accepted, based on information
825  * about the frame's origin and encryption, and policy for this vap.
826  */
827 static int accept_data_frame(struct ieee80211vap *vap,
828        struct ieee80211_node *ni, struct ieee80211_key *key,
829        struct sk_buff *skb, struct ether_header *eh)
830 {
831 #define IS_EAPOL(eh) ((eh)->ether_type == __constant_htons(ETHERTYPE_PAE))
832 #define PAIRWISE_SET(vap) ((vap)->iv_nw_keys[0].wk_cipher != &ieee80211_cipher_none)
833        if (IS_EAPOL(eh)) {
834                /* encrypted eapol is always OK */
835                if (key)
836                        return 1;
837                /* cleartext eapol is OK if we don't have pairwise keys yet */
838                if (! PAIRWISE_SET(vap))
839                        return 1;
840                /* cleartext eapol is OK if configured to allow it */
841                if (! IEEE80211_VAP_DROPUNENC_EAPOL(vap))
842                        return 1;
843                /* cleartext eapol is OK if other unencrypted is OK */
844                if (! (vap->iv_flags & IEEE80211_F_DROPUNENC))
845                        return 1;
846                /* not OK */
847                IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
848                        eh->ether_shost, "data",
849                        "unauthorized port: ether type 0x%x len %u",
850                        ntohs(eh->ether_type), skb->len);
851                vap->iv_stats.is_rx_unauth++;
852                vap->iv_devstats.rx_errors++;
853                IEEE80211_NODE_STAT(ni, rx_unauth);
854                return 0;
855        }
856
857        if (!ieee80211_node_is_authorized(ni)) {
858                /*
859                 * Deny any non-PAE frames received prior to
860                 * authorization.  For open/shared-key
861                 * authentication the port is mark authorized
862                 * after authentication completes.  For 802.1x
863                 * the port is not marked authorized by the
864                 * authenticator until the handshake has completed.
865                 */
866                IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
867                        eh->ether_shost, "data",
868                        "unauthorized port: ether type 0x%x len %u",
869                        ntohs(eh->ether_type), skb->len);
870                vap->iv_stats.is_rx_unauth++;
871                vap->iv_devstats.rx_errors++;
872                IEEE80211_NODE_STAT(ni, rx_unauth);
873                return 0;
874        } else {
875                /*
876                 * When denying unencrypted frames, discard
877                 * any non-PAE frames received without encryption.
878                 */
879                if ((vap->iv_flags & IEEE80211_F_DROPUNENC) && key == NULL) {
880                        IEEE80211_NODE_STAT(ni, rx_unencrypted);
881                        return 0;
882                }
883        }
884        return 1;
885
886 #undef IS_EAPOL
887 #undef PAIRWISE_SET
888 }
889
890
891 /*
892  * Context: softIRQ (tasklet)
893  */
894 int
895 ieee80211_input_all(struct ieee80211com *ic,
896         struct sk_buff *skb, int rssi, u_int32_t rstamp)
897 {
898         struct ieee80211vap *vap;
899         int type = -1;
900
901         /* XXX locking */
902         TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
903                 struct ieee80211_node *ni;
904                 struct sk_buff *skb1;
905
906                 if (TAILQ_NEXT(vap, iv_next) != NULL) {
907                         skb1 = skb_copy(skb, GFP_ATOMIC);
908                         if (skb1 == NULL) {
909                                 /* XXX stat+msg */
910                                 continue;
911                         }
912                 } else {
913                         skb1 = skb;
914                         skb = NULL;
915                 }
916                 ni = ieee80211_ref_node(vap->iv_bss);
917                 type = ieee80211_input(ni, skb1, rssi, rstamp);
918                 ieee80211_free_node(ni);
919         }
920         if (skb != NULL)                /* no vaps, reclaim skb */
921                 dev_kfree_skb(skb);
922         return type;
923 }
924 EXPORT_SYMBOL(ieee80211_input_all);
925
926 /*
927  * This function reassemble fragments using the skb of the 1st fragment,
928  * if large enough. If not, a new skb is allocated to hold incoming
929  * fragments.
930  *
931  * Fragments are copied at the end of the previous fragment.  A different
932  * strategy could have been used, where a non-linear skb is allocated and
933  * fragments attached to that skb.
934  */
935 static struct sk_buff *
936 ieee80211_defrag(struct ieee80211_node *ni, struct sk_buff *skb, int hdrlen)
937 {
938         struct ieee80211_frame *wh = (struct ieee80211_frame *) skb->data;
939         u_int16_t rxseq, last_rxseq;
940         u_int8_t fragno, last_fragno;
941         u_int8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
942
943         rxseq = le16_to_cpu(*(__le16 *)wh->i_seq) >> IEEE80211_SEQ_SEQ_SHIFT;
944         fragno = le16_to_cpu(*(__le16 *)wh->i_seq) & IEEE80211_SEQ_FRAG_MASK;
945
946         /* Quick way out, if there's nothing to defragment */
947         if (!more_frag && fragno == 0 && ni->ni_rxfrag == NULL)
948                 return skb;
949
950         /*
951          * Remove frag to ensure it doesn't get reaped by timer.
952          */
953         if (ni->ni_table == NULL) {
954                 /*
955                  * Should never happen.  If the node is orphaned (not in
956                  * the table) then input packets should not reach here.
957                  * Otherwise, a concurrent request that yanks the table
958                  * should be blocked by other interlocking and/or by first
959                  * shutting the driver down.  Regardless, be defensive
960                  * here and just bail
961                  */
962                 /* XXX need msg+stat */
963                 dev_kfree_skb(skb);
964                 return NULL;
965         }
966
967         /*
968          * Use this lock to make sure ni->ni_rxfrag is
969          * not freed by the timer process while we use it.
970          * XXX bogus
971          */
972         IEEE80211_NODE_LOCK_IRQ(ni->ni_table);
973
974         /*
975          * Update the time stamp.  As a side effect, it
976          * also makes sure that the timer will not change
977          * ni->ni_rxfrag for at least 1 second, or in
978          * other words, for the remaining of this function.
979          */
980         ni->ni_rxfragstamp = jiffies;
981
982         IEEE80211_NODE_UNLOCK_IRQ(ni->ni_table);
983
984         /*
985          * Validate that fragment is in order and
986          * related to the previous ones.
987          */
988         if (ni->ni_rxfrag) {
989                 struct ieee80211_frame *lwh;
990
991                 lwh = (struct ieee80211_frame *) ni->ni_rxfrag->data;
992                 last_rxseq = le16_to_cpu(*(__le16 *)lwh->i_seq) >>
993                         IEEE80211_SEQ_SEQ_SHIFT;
994                 last_fragno = le16_to_cpu(*(__le16 *)lwh->i_seq) &
995                         IEEE80211_SEQ_FRAG_MASK;
996                 if (rxseq != last_rxseq
997                     || fragno != last_fragno + 1
998                     || (!IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1))
999                     || (!IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2))
1000                     || (ni->ni_rxfrag->end - ni->ni_rxfrag->tail <
1001                         skb->len)) {
1002                         /*
1003                          * Unrelated fragment or no space for it,
1004                          * clear current fragments
1005                          */
1006                         dev_kfree_skb(ni->ni_rxfrag);
1007                         ni->ni_rxfrag = NULL;
1008                 }
1009         }
1010
1011         /* If this is the first fragment */
1012         if (ni->ni_rxfrag == NULL && fragno == 0) {
1013                 ni->ni_rxfrag = skb;
1014                 /* If more frags are coming */
1015                 if (more_frag) {
1016                         if (skb_is_nonlinear(skb)) {
1017                                 /*
1018                                  * We need a continous buffer to
1019                                  * assemble fragments
1020                                  */
1021                                 ni->ni_rxfrag = skb_copy(skb, GFP_ATOMIC);
1022                                 dev_kfree_skb(skb);
1023                         }
1024                         /*
1025                          * Check that we have enough space to hold
1026                          * incoming fragments
1027                          * XXX 4-address/QoS frames?
1028                          */
1029                         else if ((skb_end_pointer(skb) - skb->head) <
1030                                  (ni->ni_vap->iv_dev->mtu + hdrlen)) {
1031                                 ni->ni_rxfrag = skb_copy_expand(skb, 0,
1032                                         (ni->ni_vap->iv_dev->mtu + hdrlen) -
1033                                         (skb_end_pointer(skb) - skb->head),
1034                                         GFP_ATOMIC);
1035                                 dev_kfree_skb(skb);
1036                         }
1037                 }
1038         } else {
1039                 if (ni->ni_rxfrag) {
1040                         struct ieee80211_frame *lwh = (struct ieee80211_frame *)
1041                                 ni->ni_rxfrag->data;
1042
1043                         /*
1044                          * We know we have enough space to copy,
1045                          * we've verified that before
1046                          */
1047                         /* Copy current fragment at end of previous one */
1048                         memcpy(skb_tail_pointer(ni->ni_rxfrag),
1049                                skb->data + hdrlen, skb->len - hdrlen);
1050                         /* Update tail and length */
1051                         skb_put(ni->ni_rxfrag, skb->len - hdrlen);
1052                         /* Keep a copy of last sequence and fragno */
1053                         *(__le16 *) lwh->i_seq = *(__le16 *) wh->i_seq;
1054                 }
1055                 /* we're done with the fragment */
1056                 dev_kfree_skb(skb);
1057         }
1058                 
1059         if (more_frag) {
1060                 /* More to come */
1061                 skb = NULL;
1062         } else {
1063                 /* Last fragment received, we're done! */
1064                 skb = ni->ni_rxfrag;
1065                 ni->ni_rxfrag = NULL;
1066         }
1067         return skb;
1068 }
1069
1070 static void 
1071 ieee80211_deliver_data(struct ieee80211_node *ni, struct sk_buff *skb)
1072 {
1073         struct ieee80211vap *vap = ni->ni_vap;
1074         struct net_device *dev = vap->iv_dev;
1075         struct ether_header *eh = (struct ether_header *) skb->data;
1076
1077 #ifdef ATH_SUPERG_XR 
1078         /*
1079          * if it is a XR vap, send the data to associated normal net
1080          * device. XR vap has a net device which is not registered with
1081          * OS. 
1082          */
1083         if (vap->iv_xrvap && vap->iv_flags & IEEE80211_F_XR)
1084                 dev = vap->iv_xrvap->iv_dev;
1085 #endif
1086
1087         /* perform as a bridge within the vap */
1088         /* XXX intra-vap bridging only */
1089         if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
1090             (vap->iv_flags & IEEE80211_F_NOBRIDGE) == 0) {
1091                 struct sk_buff *skb1 = NULL;
1092                 
1093                 if (ETHER_IS_MULTICAST(eh->ether_dhost))
1094                         skb1 = skb_copy(skb, GFP_ATOMIC);
1095                 else {
1096                         /*
1097                          * Check if destination is associated with the
1098                          * same vap and authorized to receive traffic.
1099                          * Beware of traffic destined for the vap itself;
1100                          * sending it will not work; just let it be
1101                          * delivered normally.
1102                          */
1103                         struct ieee80211_node *ni1 = ieee80211_find_node(
1104                                 &vap->iv_ic->ic_sta, eh->ether_dhost);
1105                         if (ni1 != NULL) {
1106                                 if (ni1->ni_vap == vap &&
1107                                     ieee80211_node_is_authorized(ni1) &&
1108                                     ni1 != vap->iv_bss) {
1109                                         skb1 = skb;
1110                                         skb = NULL;
1111                                 }
1112                                 /* XXX statistic? */
1113                                 ieee80211_free_node(ni1);
1114                         }
1115                 }
1116                 if (skb1 != NULL) {
1117                         skb1->dev = dev;
1118
1119                         skb_reset_mac_header(skb1);
1120                         skb_set_network_header(skb1, sizeof(struct ether_header));
1121
1122                         skb1->protocol = __constant_htons(ETH_P_802_2);
1123                         /* XXX insert vlan tag before queue it? */
1124                         dev_queue_xmit(skb1);
1125                 }
1126         }
1127
1128         if (skb != NULL) {
1129                 skb->dev = dev;
1130                 
1131 #ifdef USE_HEADERLEN_RESV
1132                 skb->protocol = ath_eth_type_trans(skb, dev);
1133 #else
1134                 skb->protocol = eth_type_trans(skb, dev);
1135 #endif
1136                 if (ni->ni_vlan != 0 && vap->iv_vlgrp != NULL) {
1137                         /* attach vlan tag */
1138                         vlan_hwaccel_receive_skb(skb, vap->iv_vlgrp, ni->ni_vlan);
1139                 } else
1140                         netif_rx(skb);
1141                 dev->last_rx = jiffies;
1142         }
1143 }
1144
1145 static struct sk_buff *
1146 ieee80211_decap(struct ieee80211vap *vap, struct sk_buff *skb, int hdrlen)
1147 {
1148         struct ieee80211_qosframe_addr4 wh;     /* Max size address frames */
1149         struct ether_header *eh;
1150         struct llc *llc;
1151         __be16 ether_type = 0;
1152
1153         memcpy(&wh, skb->data, hdrlen); /* Only copy hdrlen over */
1154         llc = (struct llc *) skb_pull(skb, hdrlen);
1155         if (skb->len >= LLC_SNAPFRAMELEN &&
1156             llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
1157             llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
1158             llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) {
1159                 ether_type = llc->llc_un.type_snap.ether_type;
1160                 skb_pull(skb, LLC_SNAPFRAMELEN);
1161                 llc = NULL;
1162         }
1163         eh = (struct ether_header *) skb_push(skb, sizeof(struct ether_header));
1164         switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
1165         case IEEE80211_FC1_DIR_NODS:
1166                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
1167                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
1168                 break;
1169         case IEEE80211_FC1_DIR_TODS:
1170                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
1171                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
1172                 break;
1173         case IEEE80211_FC1_DIR_FROMDS:
1174                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
1175                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
1176                 break;
1177         case IEEE80211_FC1_DIR_DSTODS:
1178                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
1179                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
1180                 break;
1181         }
1182         if (!ALIGNED_POINTER(skb->data + sizeof(*eh), u_int32_t)) {
1183                 struct sk_buff *n;
1184
1185                 /* XXX does this always work? */
1186                 n = skb_copy(skb, GFP_ATOMIC);
1187                 dev_kfree_skb(skb);
1188                 if (n == NULL)
1189                         return NULL;
1190                 skb = n;
1191                 eh = (struct ether_header *) skb->data;
1192         }
1193         if (llc != NULL)
1194                 eh->ether_type = htons(skb->len - sizeof(*eh));
1195         else
1196                 eh->ether_type = ether_type;
1197         return skb;
1198 }
1199
1200 /*
1201  * Install received rate set information in the node's state block.
1202  */
1203 int
1204 ieee80211_setup_rates(struct ieee80211_node *ni,
1205         const u_int8_t *rates, const u_int8_t *xrates, int flags)
1206 {
1207         struct ieee80211_rateset *rs = &ni->ni_rates;
1208
1209         memset(rs, 0, sizeof(*rs));
1210         rs->rs_nrates = rates[1];
1211         memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
1212         if (xrates != NULL) {
1213                 u_int8_t nxrates;
1214                 /*
1215                  * Tack on 11g extended supported rate element.
1216                  */
1217                 nxrates = xrates[1];
1218                 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
1219                         struct ieee80211vap *vap = ni->ni_vap;
1220
1221                         nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
1222                         IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE, ni,
1223                                 "extended rate set too large;"
1224                                 " only using %u of %u rates",
1225                                 nxrates, xrates[1]);
1226                         vap->iv_stats.is_rx_rstoobig++;
1227                 }
1228                 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
1229                 rs->rs_nrates += nxrates;
1230         }
1231         return ieee80211_fix_rate(ni, flags);
1232 }
1233
1234 static void
1235 ieee80211_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
1236         int rssi, u_int32_t rstamp, u_int16_t seq, u_int16_t status)
1237 {
1238         struct ieee80211vap *vap = ni->ni_vap;
1239
1240         if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
1241                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1242                         ni->ni_macaddr, "open auth",
1243                         "bad sta auth mode %u", ni->ni_authmode);
1244                 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1245                 if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1246                         /* XXX hack to workaround calling convention */
1247
1248                         /* XXX To send the frame to the requesting STA, we have to
1249                          * create a node for the station that we're going to reject.
1250                          * The node will be freed automatically */
1251                         if (ni == vap->iv_bss) {
1252                                 ni = ieee80211_dup_bss(vap, wh->i_addr2);
1253                                 if (ni == NULL)
1254                                         return;
1255
1256                                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, 
1257                                 "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr), 
1258                                 ieee80211_node_refcnt(ni));
1259                         }
1260                         IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH,
1261                                 (seq + 1) | (IEEE80211_STATUS_ALG << 16));
1262                         return;
1263                 }
1264         }
1265         switch (vap->iv_opmode) {
1266         case IEEE80211_M_IBSS:
1267                 if (vap->iv_state != IEEE80211_S_RUN ||
1268                     seq != IEEE80211_AUTH_OPEN_REQUEST) {
1269                         vap->iv_stats.is_rx_bad_auth++;
1270                         return;
1271                 }
1272                 ieee80211_new_state(vap, IEEE80211_S_AUTH,
1273                         wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1274                 break;
1275
1276         case IEEE80211_M_AHDEMO:
1277         case IEEE80211_M_WDS:
1278                 /* should not come here */
1279                 break;
1280
1281         case IEEE80211_M_HOSTAP:
1282                 if (vap->iv_state != IEEE80211_S_RUN ||
1283                     seq != IEEE80211_AUTH_OPEN_REQUEST) {
1284                         vap->iv_stats.is_rx_bad_auth++;
1285                         return;
1286                 }
1287                 /* always accept open authentication requests */
1288                 if (ni == vap->iv_bss) {
1289                         ni = ieee80211_dup_bss(vap, wh->i_addr2); 
1290                         if (ni == NULL)
1291                                 return;
1292
1293                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, 
1294                         "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr), 
1295                         ieee80211_node_refcnt(ni));
1296
1297                 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1298                         (void) ieee80211_ref_node(ni);
1299                 /*
1300                  * Mark the node as referenced to reflect that it's
1301                  * reference count has been bumped to ensure it remains
1302                  * after the transaction completes.
1303                  */
1304                 ni->ni_flags |= IEEE80211_NODE_AREF;
1305
1306                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1307                 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1308                         ni, "station authenticated (%s)", "open");
1309                 /*
1310                  * When 802.1x is not in use mark the port
1311                  * authorized at this point so traffic can flow.
1312                  */
1313                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
1314                         ieee80211_node_authorize(ni);
1315                 break;
1316
1317         case IEEE80211_M_STA:
1318                 if (vap->iv_state != IEEE80211_S_AUTH ||
1319                     seq != IEEE80211_AUTH_OPEN_RESPONSE) {
1320                         vap->iv_stats.is_rx_bad_auth++;
1321                         return;
1322                 }
1323                 if (status != 0) {
1324                         IEEE80211_NOTE(vap,
1325                                 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
1326                                 "open auth failed (reason %d)", status);
1327                         vap->iv_stats.is_rx_auth_fail++;
1328                         ieee80211_new_state(vap, IEEE80211_S_SCAN,
1329                                 IEEE80211_SCAN_FAIL_STATUS);
1330                 } else
1331                         ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1332                 break;
1333         case IEEE80211_M_MONITOR:
1334                 break;
1335         }
1336 }
1337
1338 /*
1339  * Send a management frame error response to the specified
1340  * station.  If ni is associated with the station then use
1341  * it; otherwise allocate a temporary node suitable for
1342  * transmitting the frame and then free the reference so
1343  * it will go away as soon as the frame has been transmitted.
1344  */
1345 static void
1346 ieee80211_send_error(struct ieee80211_node *ni,
1347         const u_int8_t *mac, int subtype, int arg)
1348 {
1349         struct ieee80211vap *vap = ni->ni_vap;
1350         int istmp;
1351
1352         if (ni == vap->iv_bss) {
1353                 ni = ieee80211_tmp_node(vap, mac);
1354                 if (ni == NULL) {
1355                         /* XXX msg */
1356                         return;
1357                 }
1358                 istmp = 1;
1359         } else
1360                 istmp = 0;
1361         IEEE80211_SEND_MGMT(ni, subtype, arg);
1362         if (istmp)
1363                 ieee80211_free_node(ni);
1364 }
1365
1366 static int
1367 alloc_challenge(struct ieee80211_node *ni)
1368 {
1369         if (ni->ni_challenge == NULL)
1370                 MALLOC(ni->ni_challenge, u_int32_t*, IEEE80211_CHALLENGE_LEN,
1371                         M_DEVBUF, M_NOWAIT);
1372         if (ni->ni_challenge == NULL) {
1373                 IEEE80211_NOTE(ni->ni_vap,
1374                         IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
1375                         "%s", "shared key challenge alloc failed");
1376                 /* XXX statistic */
1377         }
1378         return (ni->ni_challenge != NULL);
1379 }
1380
1381 /* XXX TODO: add statistics */
1382 static void
1383 ieee80211_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
1384         u_int8_t *frm, u_int8_t *efrm, int rssi, u_int32_t rstamp,
1385         u_int16_t seq, u_int16_t status)
1386 {
1387         struct ieee80211vap *vap = ni->ni_vap;
1388         u_int8_t *challenge;
1389         int allocbs, estatus;
1390
1391         /*
1392          * NB: this can happen as we allow pre-shared key
1393          * authentication to be enabled w/o wep being turned
1394          * on so that configuration of these can be done
1395          * in any order.  It may be better to enforce the
1396          * ordering in which case this check would just be
1397          * for sanity/consistency.
1398          */
1399         estatus = 0;                    /* NB: silence compiler */
1400         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
1401                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1402                         ni->ni_macaddr, "shared key auth",
1403                         "%s", " PRIVACY is disabled");
1404                 estatus = IEEE80211_STATUS_ALG;
1405                 goto bad;
1406         }
1407         /*
1408          * Pre-shared key authentication is evil; accept
1409          * it only if explicitly configured (it is supported
1410          * mainly for compatibility with clients like OS X).
1411          */
1412         if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1413             ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1414                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1415                         ni->ni_macaddr, "shared key auth",
1416                         "bad sta auth mode %u", ni->ni_authmode);
1417                 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1418                 estatus = IEEE80211_STATUS_ALG;
1419                 goto bad;
1420         }
1421
1422         challenge = NULL;
1423         if (frm + 1 < efrm) {
1424                 if ((frm[1] + 2) > (efrm - frm)) {
1425                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1426                                 ni->ni_macaddr, "shared key auth",
1427                                 "ie %d/%d too long",
1428                                 frm[0], (frm[1] + 2) - (efrm - frm));
1429                         vap->iv_stats.is_rx_bad_auth++;
1430                         estatus = IEEE80211_STATUS_CHALLENGE;
1431                         goto bad;
1432                 }
1433                 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1434                         challenge = frm;
1435                 frm += frm[1] + 2;
1436         }
1437         switch (seq) {
1438         case IEEE80211_AUTH_SHARED_CHALLENGE:
1439         case IEEE80211_AUTH_SHARED_RESPONSE:
1440                 if (challenge == NULL) {
1441                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1442                                 ni->ni_macaddr, "shared key auth",
1443                                 "%s", "no challenge");
1444                         vap->iv_stats.is_rx_bad_auth++;
1445                         estatus = IEEE80211_STATUS_CHALLENGE;
1446                         goto bad;
1447                 }
1448                 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1449                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1450                                 ni->ni_macaddr, "shared key auth",
1451                                 "bad challenge len %d", challenge[1]);
1452                         vap->iv_stats.is_rx_bad_auth++;
1453                         estatus = IEEE80211_STATUS_CHALLENGE;
1454                         goto bad;
1455                 }
1456         default:
1457                 break;
1458         }
1459         switch (vap->iv_opmode) {
1460         case IEEE80211_M_MONITOR:
1461         case IEEE80211_M_AHDEMO:
1462         case IEEE80211_M_IBSS:
1463         case IEEE80211_M_WDS:
1464                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1465                         ni->ni_macaddr, "shared key auth",
1466                         "bad operating mode %u", vap->iv_opmode);
1467                 return;
1468         case IEEE80211_M_HOSTAP:
1469                 if (vap->iv_state != IEEE80211_S_RUN) {
1470                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1471                                 ni->ni_macaddr, "shared key auth",
1472                                 "bad state %u", vap->iv_state);
1473                         estatus = IEEE80211_STATUS_ALG; /* XXX */
1474                         goto bad;
1475                 }
1476                 switch (seq) {
1477                 case IEEE80211_AUTH_SHARED_REQUEST:
1478                         if (ni == vap->iv_bss) {
1479                                 ni = ieee80211_dup_bss(vap, wh->i_addr2);
1480                                 if (ni == NULL) {
1481                                         /* NB: no way to return an error */
1482                                         return;
1483                                 }
1484
1485                                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE, 
1486                                 "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr), 
1487                                 ieee80211_node_refcnt(ni));
1488
1489                                 allocbs = 1;
1490                         } else {
1491                                 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1492                                         (void) ieee80211_ref_node(ni);
1493                                 allocbs = 0;
1494                         }
1495                         /*
1496                          * Mark the node as referenced to reflect that it's
1497                          * reference count has been bumped to ensure it remains
1498                          * after the transaction completes.
1499                          */
1500                         ni->ni_flags |= IEEE80211_NODE_AREF;
1501                         ni->ni_rssi = rssi;
1502                         ni->ni_rstamp = rstamp;
1503                         ni->ni_last_rx = jiffies;
1504                         if (!alloc_challenge(ni)) {
1505                                 /* NB: don't return error so they rexmit */
1506                                 return;
1507                         }
1508                         get_random_bytes(ni->ni_challenge,
1509                                 IEEE80211_CHALLENGE_LEN);
1510                         IEEE80211_NOTE(vap,
1511                                 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
1512                                 "shared key %sauth request", allocbs ? "" : "re");
1513                         break;
1514                 case IEEE80211_AUTH_SHARED_RESPONSE:
1515                         if (ni == vap->iv_bss) {
1516                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1517                                         ni->ni_macaddr, "shared key response",
1518                                         "%s", "unknown station");
1519                                 /* NB: don't send a response */
1520                                 return;
1521                         }
1522                         if (ni->ni_challenge == NULL) {
1523                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1524                                         ni->ni_macaddr, "shared key response",
1525                                         "%s", "no challenge recorded");
1526                                 vap->iv_stats.is_rx_bad_auth++;
1527                                 estatus = IEEE80211_STATUS_CHALLENGE;
1528                                 goto bad;
1529                         }
1530                         if (memcmp(ni->ni_challenge, &challenge[2],
1531                             challenge[1]) != 0) {
1532                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1533                                         ni->ni_macaddr, "shared key response",
1534                                         "%s", "challenge mismatch");
1535                                 vap->iv_stats.is_rx_auth_fail++;
1536                                 estatus = IEEE80211_STATUS_CHALLENGE;
1537                                 goto bad;
1538                         }
1539                         IEEE80211_NOTE(vap,
1540                                 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
1541                                 "station authenticated (%s)", "shared key");
1542                         ieee80211_node_authorize(ni);
1543                         break;
1544                 default:
1545                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1546                                 ni->ni_macaddr, "shared key auth",
1547                                 "bad seq %d", seq);
1548                         vap->iv_stats.is_rx_bad_auth++;
1549                         estatus = IEEE80211_STATUS_SEQUENCE;
1550                         goto bad;
1551                 }
1552                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1553                 break;
1554
1555         case IEEE80211_M_STA:
1556                 if (vap->iv_state != IEEE80211_S_AUTH)
1557                         return;
1558                 switch (seq) {
1559                 case IEEE80211_AUTH_SHARED_PASS:
1560                         if (ni->ni_challenge != NULL) {
1561                                 FREE(ni->ni_challenge, M_DEVBUF);
1562                                 ni->ni_challenge = NULL;
1563                         }
1564                         if (status != 0) {
1565                                 IEEE80211_NOTE_MAC(vap,
1566                                         IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1567                                         ieee80211_getbssid(vap, wh),
1568                                         "shared key auth failed (reason %d)",
1569                                         status);
1570                                 vap->iv_stats.is_rx_auth_fail++;
1571                                 /* XXX IEEE80211_SCAN_FAIL_STATUS */
1572                                 goto bad;
1573                         }
1574                         ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1575                         break;
1576                 case IEEE80211_AUTH_SHARED_CHALLENGE:
1577                         if (!alloc_challenge(ni))
1578                                 goto bad;
1579                         /* XXX could optimize by passing recvd challenge */
1580                         memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1581                         IEEE80211_SEND_MGMT(ni,
1582                                 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1583                         break;
1584                 default:
1585                         IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
1586                                 wh, "shared key auth", "bad seq %d", seq);
1587                         vap->iv_stats.is_rx_bad_auth++;
1588                         goto bad;
1589                 }
1590                 break;
1591         }
1592         return;
1593 bad:
1594         /*
1595          * Send an error response; but only when operating as an AP.
1596          */
1597         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1598                 /* XXX hack to workaround calling convention */
1599                 ieee80211_send_error(ni, wh->i_addr2, 
1600                         IEEE80211_FC0_SUBTYPE_AUTH,
1601                         (seq + 1) | (estatus<<16));
1602         } else if (vap->iv_opmode == IEEE80211_M_STA) {
1603                 /*
1604                  * Kick the state machine.  This short-circuits
1605                  * using the mgt frame timeout to trigger the
1606                  * state transition.
1607                  */
1608                 if (vap->iv_state == IEEE80211_S_AUTH)
1609                         ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
1610         }
1611 }
1612
1613 /* Verify the existence and length of __elem or get out. */
1614 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do {                 \
1615         if ((__elem) == NULL) {                                         \
1616                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID,            \
1617                         wh, ieee80211_mgt_subtype_name[subtype >>       \
1618                                 IEEE80211_FC0_SUBTYPE_SHIFT],           \
1619                         "%s", "no " #__elem );                          \
1620                 vap->iv_stats.is_rx_elem_missing++;                     \
1621                 return;                                                 \
1622         }                                                               \
1623         if ((__elem)[1] > (__maxlen)) {                                 \
1624                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID,            \
1625                         wh, ieee80211_mgt_subtype_name[subtype >>       \
1626                                 IEEE80211_FC0_SUBTYPE_SHIFT],           \
1627                         "bad " #__elem " len %d", (__elem)[1]);         \
1628                 vap->iv_stats.is_rx_elem_toobig++;                      \
1629                 return;                                                 \
1630         }                                                               \
1631 } while (0)
1632
1633 #define IEEE80211_VERIFY_LENGTH(_len, _minlen) do {                     \
1634         if ((_len) < (_minlen)) {                                       \
1635                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID,            \
1636                         wh, ieee80211_mgt_subtype_name[subtype >>       \
1637                                 IEEE80211_FC0_SUBTYPE_SHIFT],           \
1638                         "%s", "ie too short");                          \
1639                 vap->iv_stats.is_rx_elem_toosmall++;                    \
1640                 return;                                                 \
1641         }                                                               \
1642 } while (0)
1643
1644 #ifdef IEEE80211_DEBUG
1645 static void
1646 ieee80211_ssid_mismatch(struct ieee80211vap *vap, const char *tag,
1647         u_int8_t mac[IEEE80211_ADDR_LEN], u_int8_t *ssid)
1648 {
1649         printf("[%s] discard %s frame, ssid mismatch: ",
1650                 ether_sprintf(mac), tag);
1651         ieee80211_print_essid(ssid + 2, ssid[1]);
1652         printf("\n");
1653 }
1654
1655 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do {                          \
1656         if ((_ssid)[1] != 0 &&                                          \
1657             ((_ssid)[1] != (_ni)->ni_esslen ||                          \
1658             memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {   \
1659                 if (ieee80211_msg_input(vap))                           \
1660                         ieee80211_ssid_mismatch(vap,                    \
1661                                 ieee80211_mgt_subtype_name[subtype >>   \
1662                                         IEEE80211_FC0_SUBTYPE_SHIFT],   \
1663                                 wh->i_addr2, _ssid);                    \
1664                 vap->iv_stats.is_rx_ssidmismatch++;                     \
1665                 return;                                                 \
1666         }                                                               \
1667 } while (0)
1668 #else /* !IEEE80211_DEBUG */
1669 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do {                          \
1670         if ((_ssid)[1] != 0 &&                                          \
1671             ((_ssid)[1] != (_ni)->ni_esslen ||                          \
1672             memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {   \
1673                 vap->iv_stats.is_rx_ssidmismatch++;                     \
1674                 return;                                                 \
1675         }                                                               \
1676 } while (0)
1677 #endif /* !IEEE80211_DEBUG */
1678
1679 /* unaligned little endian access */     
1680 #define LE_READ_2(p)                                    \
1681         ((u_int16_t)                                    \
1682          ((((const u_int8_t *)(p))[0]      ) |          \
1683           (((const u_int8_t *)(p))[1] <<  8)))
1684 #define LE_READ_4(p)                                    \
1685         ((u_int32_t)                                    \
1686          ((((const u_int8_t *)(p))[0]      ) |          \
1687           (((const u_int8_t *)(p))[1] <<  8) |          \
1688           (((const u_int8_t *)(p))[2] << 16) |          \
1689           (((const u_int8_t *)(p))[3] << 24)))
1690
1691 static __inline int
1692 iswpaoui(const u_int8_t *frm)
1693 {
1694         return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
1695 }
1696
1697 static __inline int
1698 iswmeoui(const u_int8_t *frm)
1699 {
1700         return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI);
1701 }
1702
1703 static __inline int
1704 iswmeparam(const u_int8_t *frm)
1705 {
1706         return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1707                 frm[6] == WME_PARAM_OUI_SUBTYPE;
1708 }
1709
1710 static __inline int
1711 iswmeinfo(const u_int8_t *frm)
1712 {
1713         return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1714                 frm[6] == WME_INFO_OUI_SUBTYPE;
1715 }
1716
1717 static __inline int
1718 isatherosoui(const u_int8_t *frm)
1719 {
1720         return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
1721 }
1722
1723 /*
1724  * Convert a WPA cipher selector OUI to an internal
1725  * cipher algorithm.  Where appropriate we also
1726  * record any key length.
1727  */
1728 static int
1729 wpa_cipher(u_int8_t *sel, u_int8_t *keylen)
1730 {
1731 #define WPA_SEL(x)      (((x) << 24) | WPA_OUI)
1732         u_int32_t w = LE_READ_4(sel);
1733
1734         switch (w) {
1735         case WPA_SEL(WPA_CSE_NULL):
1736                 return IEEE80211_CIPHER_NONE;
1737         case WPA_SEL(WPA_CSE_WEP40):
1738                 if (keylen)
1739                         *keylen = 40 / NBBY;
1740                 return IEEE80211_CIPHER_WEP;
1741         case WPA_SEL(WPA_CSE_WEP104):
1742                 if (keylen)
1743                         *keylen = 104 / NBBY;
1744                 return IEEE80211_CIPHER_WEP;
1745         case WPA_SEL(WPA_CSE_TKIP):
1746                 return IEEE80211_CIPHER_TKIP;
1747         case WPA_SEL(WPA_CSE_CCMP):
1748                 return IEEE80211_CIPHER_AES_CCM;
1749         }
1750         return 32;              /* NB: so 1<< is discarded */
1751 #undef WPA_SEL
1752 }
1753
1754 /*
1755  * Convert a WPA key management/authentication algorithm
1756  * to an internal code.
1757  */
1758 static int
1759 wpa_keymgmt(u_int8_t *sel)
1760 {
1761 #define WPA_SEL(x)      (((x)<<24)|WPA_OUI)
1762         u_int32_t w = LE_READ_4(sel);
1763
1764         switch (w) {
1765         case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1766                 return WPA_ASE_8021X_UNSPEC;
1767         case WPA_SEL(WPA_ASE_8021X_PSK):
1768                 return WPA_ASE_8021X_PSK;
1769         case WPA_SEL(WPA_ASE_NONE):
1770                 return WPA_ASE_NONE;
1771         }
1772         return 0;               /* NB: so is discarded */
1773 #undef WPA_SEL
1774 }
1775
1776 /*
1777  * Parse a WPA information element to collect parameters
1778  * and validate the parameters against what has been
1779  * configured for the system.
1780  */
1781 static int
1782 ieee80211_parse_wpa(struct ieee80211vap *vap, u_int8_t *frm,
1783         struct ieee80211_rsnparms *rsn_parm, const struct ieee80211_frame *wh)
1784 {
1785         u_int8_t len = frm[1];
1786         u_int32_t w;
1787         int n;
1788
1789         /*
1790          * Check the length once for fixed parts: OUI, type,
1791          * version, mcast cipher, and 2 selector counts.
1792          * Other, variable-length data, must be checked separately.
1793          */
1794         if (!(vap->iv_flags & IEEE80211_F_WPA1)) {
1795                 IEEE80211_DISCARD_IE(vap,
1796                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1797                         wh, "WPA", "vap not WPA, flags 0x%x", vap->iv_flags);
1798                 return IEEE80211_REASON_IE_INVALID;
1799         }
1800         
1801         if (len < 14) {
1802                 IEEE80211_DISCARD_IE(vap,
1803                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1804                         wh, "WPA", "too short, len %u", len);
1805                 return IEEE80211_REASON_IE_INVALID;
1806         }
1807         frm += 6, len -= 4;             /* NB: len is payload only */
1808         /* NB: iswapoui already validated the OUI and type */
1809         w = LE_READ_2(frm);
1810         if (w != WPA_VERSION) {
1811                 IEEE80211_DISCARD_IE(vap,
1812                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1813                         wh, "WPA", "bad version %u", w);
1814                 return IEEE80211_REASON_IE_INVALID;
1815         }
1816         frm += 2;
1817         len -= 2;
1818
1819         /* multicast/group cipher */
1820         w = wpa_cipher(frm, &rsn_parm->rsn_mcastkeylen);
1821         if (w != rsn_parm->rsn_mcastcipher) {
1822                 IEEE80211_DISCARD_IE(vap,
1823                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1824                         wh, "WPA", "mcast cipher mismatch; got %u, expected %u",
1825                         w, rsn_parm->rsn_mcastcipher);
1826                 return IEEE80211_REASON_IE_INVALID;
1827         }
1828         frm += 4;
1829         len -= 4;
1830
1831         /* unicast ciphers */
1832         n = LE_READ_2(frm);
1833         frm += 2;
1834         len -= 2;
1835         if (len < n*4+2) {
1836                 IEEE80211_DISCARD_IE(vap,
1837                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1838                         wh, "WPA", "ucast cipher data too short; len %u, n %u",
1839                         len, n);
1840                 return IEEE80211_REASON_IE_INVALID;
1841         }
1842         w = 0;
1843         for (; n > 0; n--) {
1844                 w |= 1 << wpa_cipher(frm, &rsn_parm->rsn_ucastkeylen);
1845                 frm += 4;
1846                 len -= 4;
1847         }
1848         w &= rsn_parm->rsn_ucastcipherset;
1849         if (w == 0) {
1850                 IEEE80211_DISCARD_IE(vap,
1851                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1852                         wh, "WPA", "%s", "ucast cipher set empty");
1853                 return IEEE80211_REASON_IE_INVALID;
1854         }
1855         if (w & (1 << IEEE80211_CIPHER_TKIP))
1856                 rsn_parm->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1857         else
1858                 rsn_parm->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1859
1860         /* key management algorithms */
1861         n = LE_READ_2(frm);
1862         frm += 2;
1863         len -= 2;
1864         if (len < n * 4) {
1865                 IEEE80211_DISCARD_IE(vap,
1866                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1867                         wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1868                         len, n);
1869                 return IEEE80211_REASON_IE_INVALID;
1870         }
1871         w = 0;
1872         for (; n > 0; n--) {
1873                 w |= wpa_keymgmt(frm);
1874                 frm += 4;
1875                 len -= 4;
1876         }
1877         w &= rsn_parm->rsn_keymgmtset;
1878         if (w == 0) {
1879                 IEEE80211_DISCARD_IE(vap,
1880                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1881                         wh, "WPA", "%s", "no acceptable key mgmt alg");
1882                 return IEEE80211_REASON_IE_INVALID;
1883         }
1884         if (w & WPA_ASE_8021X_UNSPEC)
1885                 rsn_parm->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1886         else
1887                 rsn_parm->rsn_keymgmt = WPA_ASE_8021X_PSK;
1888
1889         if (len > 2)            /* optional capabilities */
1890                 rsn_parm->rsn_caps = LE_READ_2(frm);
1891
1892         return 0;
1893 }
1894
1895 /*
1896  * Convert an RSN cipher selector OUI to an internal
1897  * cipher algorithm.  Where appropriate we also
1898  * record any key length.
1899  */
1900 static int
1901 rsn_cipher(u_int8_t *sel, u_int8_t *keylen)
1902 {
1903 #define RSN_SEL(x)      (((x) << 24) | RSN_OUI)
1904         u_int32_t w = LE_READ_4(sel);
1905
1906         switch (w) {
1907         case RSN_SEL(RSN_CSE_NULL):
1908                 return IEEE80211_CIPHER_NONE;
1909         case RSN_SEL(RSN_CSE_WEP40):
1910                 if (keylen)
1911                         *keylen = 40 / NBBY;
1912                 return IEEE80211_CIPHER_WEP;
1913         case RSN_SEL(RSN_CSE_WEP104):
1914                 if (keylen)
1915                         *keylen = 104 / NBBY;
1916                 return IEEE80211_CIPHER_WEP;
1917         case RSN_SEL(RSN_CSE_TKIP):
1918                 return IEEE80211_CIPHER_TKIP;
1919         case RSN_SEL(RSN_CSE_CCMP):
1920                 return IEEE80211_CIPHER_AES_CCM;
1921         case RSN_SEL(RSN_CSE_WRAP):
1922                 return IEEE80211_CIPHER_AES_OCB;
1923         }
1924         return 32;              /* NB: so 1<< is discarded */
1925 #undef RSN_SEL
1926 }
1927
1928 /*
1929  * Convert an RSN key management/authentication algorithm
1930  * to an internal code.
1931  */
1932 static int
1933 rsn_keymgmt(u_int8_t *sel)
1934 {
1935 #define RSN_SEL(x)      (((x) << 24) | RSN_OUI)
1936         u_int32_t w = LE_READ_4(sel);
1937
1938         switch (w) {
1939         case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1940                 return RSN_ASE_8021X_UNSPEC;
1941         case RSN_SEL(RSN_ASE_8021X_PSK):
1942                 return RSN_ASE_8021X_PSK;
1943         case RSN_SEL(RSN_ASE_NONE):
1944                 return RSN_ASE_NONE;
1945         }
1946         return 0;               /* NB: so is discarded */
1947 #undef RSN_SEL
1948 }
1949
1950 /*
1951  * Parse a WPA/RSN information element to collect parameters
1952  * and validate the parameters against what has been
1953  * configured for the system.
1954  */
1955 static int
1956 ieee80211_parse_rsn(struct ieee80211vap *vap, u_int8_t *frm,
1957         struct ieee80211_rsnparms *rsn_parm, const struct ieee80211_frame *wh)
1958 {
1959         u_int8_t len = frm[1];
1960         u_int32_t w;
1961         int n;
1962
1963         /*
1964          * Check the length once for fixed parts: 
1965          * version, mcast cipher, and 2 selector counts.
1966          * Other, variable-length data, must be checked separately.
1967          */
1968         if (!(vap->iv_flags & IEEE80211_F_WPA2)) {
1969                 IEEE80211_DISCARD_IE(vap,
1970                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1971                         wh, "RSN", "vap not RSN, flags 0x%x", vap->iv_flags);
1972                 return IEEE80211_REASON_IE_INVALID;
1973         }
1974         
1975         if (len < 10) {
1976                 IEEE80211_DISCARD_IE(vap,
1977                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1978                         wh, "RSN", "too short, len %u", len);
1979                 return IEEE80211_REASON_IE_INVALID;
1980         }
1981         frm += 2;
1982         w = LE_READ_2(frm);
1983         if (w != RSN_VERSION) {
1984                 IEEE80211_DISCARD_IE(vap,
1985                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1986                         wh, "RSN", "bad version %u", w);
1987                 return IEEE80211_REASON_IE_INVALID;
1988         }
1989         frm += 2;
1990         len -= 2;
1991
1992         /* multicast/group cipher */
1993         w = rsn_cipher(frm, &rsn_parm->rsn_mcastkeylen);
1994         if (w != rsn_parm->rsn_mcastcipher) {
1995                 IEEE80211_DISCARD_IE(vap,
1996                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1997                         wh, "RSN", "mcast cipher mismatch; got %u, expected %u",
1998                         w, rsn_parm->rsn_mcastcipher);
1999                 return IEEE80211_REASON_IE_INVALID;
2000         }
2001         frm += 4;
2002         len -= 4;
2003
2004         /* unicast ciphers */
2005         n = LE_READ_2(frm);
2006         frm += 2;
2007         len -= 2;
2008         if (len < n * 4 + 2) {
2009                 IEEE80211_DISCARD_IE(vap,
2010                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
2011                         wh, "RSN", "ucast cipher data too short; len %u, n %u",
2012                         len, n);
2013                 return IEEE80211_REASON_IE_INVALID;
2014         }
2015         w = 0;
2016         for (; n > 0; n--) {
2017                 w |= 1 << rsn_cipher(frm, &rsn_parm->rsn_ucastkeylen);
2018                 frm += 4;
2019                 len -= 4;
2020         }
2021         w &= rsn_parm->rsn_ucastcipherset;
2022         if (w == 0) {
2023                 IEEE80211_DISCARD_IE(vap,
2024                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
2025                         wh, "RSN", "%s", "ucast cipher set empty");
2026                 return IEEE80211_REASON_IE_INVALID;
2027         }
2028         if (w & (1<<IEEE80211_CIPHER_TKIP))
2029                 rsn_parm->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
2030         else
2031                 rsn_parm->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
2032
2033         /* key management algorithms */
2034         n = LE_READ_2(frm);
2035         frm += 2;
2036         len -= 2;
2037         if (len < n * 4) {
2038                 IEEE80211_DISCARD_IE(vap, 
2039                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
2040                         wh, "RSN", "key mgmt alg data too short; len %u, n %u",
2041                         len, n);
2042                 return IEEE80211_REASON_IE_INVALID;
2043         }
2044         w = 0;
2045         for (; n > 0; n--) {
2046                 w |= rsn_keymgmt(frm);
2047                 frm += 4;
2048                 len -= 4;
2049         }
2050         w &= rsn_parm->rsn_keymgmtset;
2051         if (w == 0) {
2052                 IEEE80211_DISCARD_IE(vap,
2053                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
2054                         wh, "RSN", "%s", "no acceptable key mgmt alg");
2055                 return IEEE80211_REASON_IE_INVALID;
2056         }
2057         if (w & RSN_ASE_8021X_UNSPEC)
2058                 rsn_parm->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
2059         else
2060                 rsn_parm->rsn_keymgmt = RSN_ASE_8021X_PSK;
2061
2062         /* optional RSN capabilities */
2063         if (len > 2)
2064                 rsn_parm->rsn_caps = LE_READ_2(frm);
2065         /* XXXPMKID */
2066
2067         return 0;
2068 }
2069
2070 void
2071 ieee80211_saveie(u_int8_t **iep, const u_int8_t *ie)
2072 {
2073         u_int ielen = ie[1] + 2;
2074         /*
2075          * Record information element for later use.
2076          */
2077         if (*iep == NULL || (*iep)[1] != ie[1]) {
2078                 if (*iep != NULL)
2079                         FREE(*iep, M_DEVBUF);
2080                 MALLOC(*iep, void*, ielen, M_DEVBUF, M_NOWAIT);
2081         }
2082         if (*iep != NULL)
2083                 memcpy(*iep, ie, ielen);
2084 }
2085 EXPORT_SYMBOL(ieee80211_saveie);
2086
2087 static int
2088 ieee80211_parse_wmeie(u_int8_t *frm, const struct ieee80211_frame *wh, 
2089                                           struct ieee80211_node *ni)
2090 {
2091         u_int len = frm[1];
2092
2093         if (len != 7) {
2094                 IEEE80211_DISCARD_IE(ni->ni_vap,
2095                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
2096                         wh, "WME IE", "too short, len %u", len);
2097                 return -1;
2098         }
2099         ni->ni_uapsd = frm[WME_CAPINFO_IE_OFFSET];
2100         if (ni->ni_uapsd) {
2101                 ni->ni_flags |= IEEE80211_NODE_UAPSD;
2102                 switch (WME_UAPSD_MAXSP(ni->ni_uapsd)) {
2103                 case 1: 
2104                         ni->ni_uapsd_maxsp = 2; break;
2105                 case 2: 
2106                         ni->ni_uapsd_maxsp = 4; break;
2107                 case 3: 
2108                         ni->ni_uapsd_maxsp = 6; break;
2109                 default:  
2110                         ni->ni_uapsd_maxsp = WME_UAPSD_NODE_MAXQDEPTH;
2111                 }
2112         }
2113         IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_POWER, ni,
2114                 "UAPSD bit settings from STA: %02x", ni->ni_uapsd);
2115
2116         return 1;
2117 }
2118
2119 static int
2120 ieee80211_parse_wmeparams(struct ieee80211vap *vap, u_int8_t *frm,
2121         const struct ieee80211_frame *wh, u_int8_t *qosinfo)
2122 {
2123 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
2124         struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
2125         u_int len = frm[1], qosinfo_count;
2126         int i;
2127
2128         *qosinfo = 0;
2129
2130         if (len < sizeof(struct ieee80211_wme_param)-2) {
2131                 IEEE80211_DISCARD_IE(vap,
2132                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
2133                         wh, "WME", "too short, len %u", len);
2134                 return -1;
2135         }
2136         *qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
2137         qosinfo_count = *qosinfo & WME_QOSINFO_COUNT;
2138         /* XXX do proper check for wraparound */
2139         if (qosinfo_count == wme->wme_wmeChanParams.cap_info_count)
2140                 return 0;
2141         frm += __offsetof(struct ieee80211_wme_param, params_acParams);
2142         for (i = 0; i < WME_NUM_AC; i++) {
2143                 struct wmeParams *wmep =
2144                         &wme->wme_wmeChanParams.cap_wmeParams[i];
2145                 /* NB: ACI not used */
2146                 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
2147                 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
2148                 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
2149                 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
2150                 wmep->wmep_txopLimit = LE_READ_2(frm + 2);
2151                 frm += 4;
2152         }
2153         wme->wme_wmeChanParams.cap_info_count = qosinfo_count;
2154         return 1;
2155 #undef MS
2156 }
2157
2158 static void
2159 ieee80211_parse_athParams(struct ieee80211_node *ni, u_int8_t *ie)
2160 {
2161 #ifdef ATH_SUPERG_DYNTURBO
2162         struct ieee80211vap *vap = ni->ni_vap;
2163         struct ieee80211com *ic = ni->ni_ic;
2164 #endif /* ATH_SUPERG_DYNTURBO */
2165         struct ieee80211_ie_athAdvCap *athIe =
2166                 (struct ieee80211_ie_athAdvCap *) ie;
2167
2168         ni->ni_ath_flags = athIe->athAdvCap_capability;
2169         if (ni->ni_ath_flags & IEEE80211_ATHC_COMP)
2170                 ni->ni_ath_defkeyindex = LE_READ_2(&athIe->athAdvCap_defKeyIndex);
2171 #if 0
2172         /* NB: too noisy */
2173         IEEE80211_NOTE(vap, IEEE80211_MSG_SUPG, ni,
2174                 "recv ath params: caps 0x%x flags 0x%x defkeyix %u",
2175                 athIe->athAdvCap_capability, ni->ni_ath_flags,
2176                 ni->ni_ath_defkeyindex);
2177 #endif
2178 #ifdef ATH_SUPERG_DYNTURBO
2179         if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_ATHC_TURBOP)) {
2180                 u_int16_t curflags, newflags;
2181
2182                 /*
2183                  * Check for turbo mode switch.  Calculate flags
2184                  * for the new mode and effect the switch.
2185                  */
2186                 newflags = curflags = ic->ic_bsschan->ic_flags;
2187                 /* NB: ATHC_BOOST is not in ic_ath_cap, so get it from the ie */
2188                 if (athIe->athAdvCap_capability & IEEE80211_ATHC_BOOST) 
2189                         newflags |= IEEE80211_CHAN_TURBO;
2190                 else
2191                         newflags &= ~IEEE80211_CHAN_TURBO;
2192                 if (newflags != curflags)
2193                         ieee80211_dturbo_switch(ic, newflags);
2194         }
2195 #endif /* ATH_SUPERG_DYNTURBO */
2196 }
2197
2198 static void
2199 forward_mgmt_to_app(struct ieee80211vap *vap, int subtype, struct sk_buff *skb,
2200         struct ieee80211_frame *wh)
2201 {
2202         struct net_device *dev = vap->iv_dev;
2203         int filter_type = 0;
2204
2205         switch (subtype) {
2206         case IEEE80211_FC0_SUBTYPE_BEACON:
2207                 filter_type = IEEE80211_FILTER_TYPE_BEACON;
2208                 break;
2209         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2210                 filter_type = IEEE80211_FILTER_TYPE_PROBE_REQ;
2211                 break;
2212         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2213                 filter_type = IEEE80211_FILTER_TYPE_PROBE_RESP;
2214                 break;
2215         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2216         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
2217                 filter_type = IEEE80211_FILTER_TYPE_ASSOC_REQ;
2218                 break;
2219         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2220         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2221                 filter_type = IEEE80211_FILTER_TYPE_ASSOC_RESP;
2222                 break;
2223         case IEEE80211_FC0_SUBTYPE_AUTH:
2224                 filter_type = IEEE80211_FILTER_TYPE_AUTH;
2225                 break;
2226         case IEEE80211_FC0_SUBTYPE_DEAUTH:
2227                 filter_type = IEEE80211_FILTER_TYPE_DEAUTH;
2228                 break;
2229         case IEEE80211_FC0_SUBTYPE_DISASSOC:
2230                 filter_type = IEEE80211_FILTER_TYPE_DISASSOC;
2231                 break;
2232         default:
2233                 break;
2234         }
2235
2236         if (filter_type && ((vap->app_filter & filter_type) == filter_type)) {
2237                 struct sk_buff *skb1;
2238
2239                 skb1 = skb_copy(skb, GFP_ATOMIC);
2240                 if (skb1 == NULL)
2241                         return;
2242                 skb1->dev = dev;
2243                 skb_reset_mac_header(skb1);
2244                 
2245                 skb1->ip_summed = CHECKSUM_NONE;
2246                 skb1->pkt_type = PACKET_OTHERHOST;
2247                 skb1->protocol = __constant_htons(0x0019);  /* ETH_P_80211_RAW */
2248
2249                 netif_rx(skb1);
2250         }
2251 }
2252
2253 void
2254 ieee80211_saveath(struct ieee80211_node *ni, u_int8_t *ie)
2255 {
2256         const struct ieee80211_ie_athAdvCap *athIe =
2257                 (const struct ieee80211_ie_athAdvCap *) ie;
2258
2259         ni->ni_ath_flags = athIe->athAdvCap_capability;
2260         if (ni->ni_ath_flags & IEEE80211_ATHC_COMP)
2261                 ni->ni_ath_defkeyindex = LE_READ_2(&athIe->athAdvCap_defKeyIndex);
2262         ieee80211_saveie(&ni->ni_ath_ie, ie);
2263 }
2264
2265 struct ieee80211_channel *
2266 ieee80211_doth_findchan(struct ieee80211vap *vap, u_int8_t chan)
2267 {
2268         struct ieee80211com *ic = vap->iv_ic;
2269         struct ieee80211_channel *c;
2270         int flags, freq;
2271
2272         /* NB: try first to preserve turbo */
2273         flags = ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL;
2274         freq = ieee80211_ieee2mhz(chan, 0);
2275         c = ieee80211_find_channel(ic, freq, flags);
2276         if (c == NULL)
2277                 c = ieee80211_find_channel(ic, freq, 0);
2278         return c;
2279 }
2280
2281 static void
2282 ieee80211_doth_cancel_cs(struct ieee80211vap *vap)
2283 {
2284         del_timer(&vap->iv_csa_timer);
2285         if (vap->iv_csa_jiffies) 
2286                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2287                                 "channel switch canceled (was: to %u in %u "
2288                                 "tbtt, mode %u)\n", vap->iv_csa_chan->ic_ieee,
2289                                 vap->iv_csa_count, vap->iv_csa_mode);
2290         vap->iv_csa_jiffies = 0;
2291 }
2292
2293 static void
2294 ieee80211_doth_switch_channel(struct ieee80211vap *vap)
2295 {
2296         struct ieee80211com *ic = vap->iv_ic;
2297
2298         IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2299                         "%s: Channel switch to %d NOW!\n",
2300                         __func__, vap->iv_csa_chan->ic_ieee);
2301 #if 0
2302         /* XXX does not belong here? */
2303         /* XXX doesn't stop management frames */
2304         /* XXX who restarts the queue? */
2305         /* NB: for now, error here is non-catastrophic.
2306          *     in the future we may need to ensure we
2307          *     stop xmit on this channel.
2308          */
2309         netif_stop_queue(ic->ic_dev);
2310 #endif
2311
2312         vap->iv_csa_jiffies = 0; /* supress "cancel" msg */
2313         ieee80211_doth_cancel_cs(vap);
2314
2315         ic->ic_prevchan = ic->ic_curchan;
2316         ic->ic_curchan = ic->ic_bsschan = vap->iv_csa_chan;
2317         ic->ic_set_channel(ic);
2318 }
2319
2320 static void
2321 ieee80211_doth_switch_channel_tmr(unsigned long arg)
2322 {
2323         struct ieee80211vap *vap = (struct ieee80211vap *)arg;
2324         ieee80211_doth_switch_channel(vap);
2325 }
2326
2327 static int
2328 ieee80211_parse_csaie(struct ieee80211_node *ni, u_int8_t *frm,
2329         const struct ieee80211_frame *wh)
2330 {
2331         struct ieee80211vap *vap = ni->ni_vap;
2332         struct ieee80211com *ic = vap->iv_ic;
2333         struct ieee80211_channel *c;
2334         struct ieee80211_ie_csa *csa_ie = (struct ieee80211_ie_csa *)frm;
2335
2336         if (!frm) {
2337                 /* we had CS underway but now we got Beacon without CSA IE */
2338                 /* XXX abuse? */
2339
2340                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2341                                 "%s: channel switch is scheduled, but we got "
2342                                 "Beacon without CSA IE!\n", __func__);
2343
2344                 ieee80211_doth_cancel_cs(vap);
2345                 return 0;
2346         }
2347
2348         if (csa_ie->csa_len != 3) {
2349                 IEEE80211_DISCARD_IE(vap,
2350                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
2351                         wh, "channel switch", "invalid length %u",
2352                         csa_ie->csa_len);
2353                 return -1;
2354         }
2355
2356         if (isclr(ic->ic_chan_avail, csa_ie->csa_chan)) {
2357                 IEEE80211_DISCARD_IE(vap,
2358                         IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
2359                         wh, "channel switch", "invalid channel %u", 
2360                         csa_ie->csa_chan);
2361                 return -1;
2362         }
2363
2364         if ((c = ieee80211_doth_findchan(vap, csa_ie->csa_chan)) == NULL) {
2365                 /* XXX something wrong */
2366                 IEEE80211_DISCARD_IE(vap,
2367                                 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
2368                                 wh, "channel switch",
2369                                 "channel %u lookup failed", csa_ie->csa_chan);
2370                 return -1;
2371         }
2372
2373         IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2374                 "%s: channel switch to %u in %u tbtt (mode %u) announced\n",
2375                 __func__, csa_ie->csa_chan, csa_ie->csa_count,
2376                 csa_ie->csa_mode);
2377
2378         if (vap->iv_csa_jiffies) {
2379                 /* CSA was received recently */
2380                 if (c != vap->iv_csa_chan) {
2381                         /* XXX abuse? */
2382                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2383                                         "%s: channel switch channel "
2384                                         "changed from %u to %u!\n", __func__,
2385                                         vap->iv_csa_chan->ic_ieee,
2386                                         csa_ie->csa_chan);
2387
2388                         if (vap->iv_csa_count > IEEE80211_CSA_PROTECTION_PERIOD)
2389                                 ieee80211_doth_cancel_cs(vap);
2390                         return 0;
2391                 }
2392
2393                 if (csa_ie->csa_mode != vap->iv_csa_mode) {
2394                         /* Can be abused, but with no (to little) impact. */
2395
2396                         /* CS mode change has no influence on our actions since
2397                          * we don't respect cs modes at all (yet). Complain and
2398                          * forget. */
2399                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2400                                         "%s: channel switch mode changed from "
2401                                         "%u to %u!\n", __func__, 
2402                                         vap->iv_csa_mode, csa_ie->csa_mode);
2403                 }
2404
2405                 if (csa_ie->csa_count >= vap->iv_csa_count) {
2406                         /* XXX abuse? what for? */
2407                         IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2408                                         "%s: channel switch count didn't "
2409                                         "decrease (%u -> %u)!\n", __func__,
2410                                         vap->iv_csa_count, csa_ie->csa_count);
2411                         return 0;
2412                 }
2413
2414                 {
2415                         u_int32_t elapsed = IEEE80211_JIFFIES_TO_TU(
2416                             jiffies - vap->iv_csa_jiffies);
2417                         u_int32_t cnt_diff = vap->iv_csa_count -
2418                           csa_ie->csa_count;
2419                         u_int32_t expected = ni->ni_intval * cnt_diff;
2420                         int32_t delta = elapsed - expected;
2421                         if (delta < 0)
2422                                 delta = -delta;
2423                         if (delta > IEEE80211_CSA_SANITY_THRESHOLD) {
2424                                 /* XXX abuse? for now, it's safer to cancel CS
2425                                  * than to follow it blindly */
2426                                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_DOTH,
2427                                                 "%s: %u.%02u bintvals elapsed, "
2428                                                 "but count dropped by %u (delta"
2429                                                 " = %u TUs)\n", __func__,
2430                                                 elapsed / ni->ni_intval,
2431                                                 elapsed * 100 / ni->ni_intval 
2432                                                 % 100, cnt_diff, delta);
2433
2434                                 ieee80211_doth_cancel_cs(vap);
2435                                 return 0;
2436                         }
2437                 }
2438
2439                 vap->iv_csa_count = csa_ie->csa_count;
2440                 mod_timer(&vap->iv_csa_timer, jiffies + 
2441                                 IEEE80211_TU_TO_JIFFIES(vap->iv_csa_count
2442                                   * ni->ni_intval + 10));
2443         } else {
2444                 /* CSA wasn't received recently, so this is the first one in
2445                  * the sequence. */
2446
2447                 if (csa_ie->csa_count < IEEE80211_CSA_PROTECTION_PERIOD) {
2448                         /* XXX abuse? */
2449                         IEEE80211_DISCARD_IE(vap,
2450                                         IEEE80211_MSG_ELEMID | 
2451                                         IEEE80211_MSG_DOTH,
2452                                         wh, "channel switch",
2453                                         "initial announcement: channel switch"
2454                                         " would occur too soon (in %u tbtt)",
2455                                         csa_ie->csa_count);
2456                         return 0;
2457                 }
2458
2459                 vap->iv_csa_mode = csa_ie->csa_mode;
2460                 vap->iv_csa_count = csa_ie->csa_count;
2461                 vap->iv_csa_chan = c;
2462
2463                 vap->iv_csa_timer.function = ieee80211_doth_switch_channel_tmr;
2464                 vap->iv_csa_timer.data = (unsigned long)vap;
2465                 vap->iv_csa_timer.expires = jiffies + IEEE80211_TU_TO_JIFFIES(
2466                     vap->iv_csa_count * ni->ni_intval + 10);
2467                 add_timer(&vap->iv_csa_timer);
2468         }
2469
2470         vap->iv_csa_jiffies = jiffies;
2471
2472         if (vap->iv_csa_count <= 1)
2473                 ieee80211_doth_switch_channel(vap);
2474
2475         return 0;
2476 }
2477
2478 /* XXX. Not the right place for such a definition */
2479 struct l2_update_frame {
2480         struct ether_header eh;
2481         u8 dsap;
2482         u8 ssap;
2483         u8 control;
2484         u8 xid[3];
2485 }  __packed;
2486
2487 static void
2488 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
2489 {
2490         struct ieee80211vap *vap = ni->ni_vap;
2491         struct net_device *dev = vap->iv_dev;
2492         struct sk_buff *skb;
2493         struct l2_update_frame *l2uf;
2494         struct ether_header *eh;
2495         
2496         skb = dev_alloc_skb(sizeof(*l2uf));
2497         if (!skb) {
2498                 printk("ieee80211_deliver_l2uf: no buf available\n");
2499                 return;
2500         }
2501         skb_put(skb, sizeof(*l2uf));    
2502         l2uf = (struct l2_update_frame *)(skb->data);
2503         eh = &l2uf->eh;
2504         /* dst: Broadcast address */
2505         IEEE80211_ADDR_COPY(eh->ether_dhost, dev->broadcast);
2506         /* src: associated STA */
2507         IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
2508         eh->ether_type = htons(skb->len - sizeof(*eh));
2509         
2510         l2uf->dsap = 0;
2511         l2uf->ssap = 0;
2512         l2uf->control = 0xf5;
2513         l2uf->xid[0] = 0x81;
2514         l2uf->xid[1] = 0x80;
2515         l2uf->xid[2] = 0x00;
2516         
2517         skb->dev = dev;
2518         skb->protocol = eth_type_trans(skb, dev);
2519         skb_reset_mac_header(skb);
2520
2521         ieee80211_deliver_data(ni, skb);
2522         return;
2523 }
2524
2525 static __inline int
2526 contbgscan(struct ieee80211vap *vap)
2527 {
2528         struct ieee80211com *ic = vap->iv_ic;
2529
2530         return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
2531                 time_after(jiffies, ic->ic_lastdata + vap->iv_bgscanidle));
2532 }
2533
2534 static __inline int
2535 startbgscan(struct ieee80211vap *vap)
2536 {
2537         struct ieee80211com *ic = vap->iv_ic;
2538
2539         return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
2540                 !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
2541                 time_after(jiffies, ic->ic_lastscan + vap->iv_bgscanintvl) &&
2542                 time_after(jiffies, ic->ic_lastdata + vap->iv_bgscanidle));
2543 }
2544
2545
2546 /*
2547  * Context: SoftIRQ
2548  */
2549 void
2550 ieee80211_recv_mgmt(struct ieee80211_node *ni, struct sk_buff *skb,
2551         int subtype, int rssi, u_int32_t rstamp)
2552 {
2553 #define ISPROBE(_st)    ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
2554 #define ISREASSOC(_st)  ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
2555         struct ieee80211vap *vap = ni->ni_vap;
2556         struct ieee80211com *ic = vap->iv_ic;
2557         struct ieee80211_frame *wh;
2558         u_int8_t *frm, *efrm;
2559         u_int8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath;
2560         u_int8_t rate;
2561         int reassoc, resp, allocbs;
2562         u_int8_t qosinfo;
2563
2564         wh = (struct ieee80211_frame *) skb->data;
2565         frm = (u_int8_t *)&wh[1];
2566         efrm = skb->data + skb->len;
2567
2568         /* forward management frame to application */
2569         if (vap->iv_opmode != IEEE80211_M_MONITOR)
2570                 forward_mgmt_to_app(vap, subtype, skb, wh);
2571
2572         switch (subtype) {
2573         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2574         case IEEE80211_FC0_SUBTYPE_BEACON: {
2575                 struct ieee80211_scanparams scan;
2576
2577                 /*
2578                  * We process beacon/probe response frames:
2579                  *    o when scanning, or
2580                  *    o station mode when associated (to collect state
2581                  *      updates such as 802.11g slot time), or
2582                  *    o adhoc mode (to discover neighbors)
2583                  * Frames otherwise received are discarded.
2584                  */ 
2585                 if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
2586                     (vap->iv_opmode == IEEE80211_M_STA && ni->ni_associd) ||
2587                     vap->iv_opmode == IEEE80211_M_IBSS)) {
2588                         vap->iv_stats.is_rx_mgtdiscard++;
2589                         return;
2590                 }
2591                 /*
2592                  * beacon/probe response frame format
2593                  *      [8] time stamp
2594                  *      [2] beacon interval
2595                  *      [2] capability information
2596                  *      [tlv] ssid
2597                  *      [tlv] supported rates
2598                  *      [tlv] country information
2599                  *      [tlv] parameter set (FH/DS)
2600                  *      [tlv] erp information
2601                  *      [tlv] extended supported rates
2602                  *      [tlv] WME
2603                  *      [tlv] WPA or RSN
2604                  *      [tlv] Atheros Advanced Capabilities
2605                  */
2606                 IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
2607                 memset(&scan, 0, sizeof(scan));
2608                 scan.tstamp  = frm;
2609                 frm += 8;
2610                 scan.bintval = le16toh(*(__le16 *)frm);
2611                 frm += 2;
2612                 scan.capinfo = le16toh(*(__le16 *)frm);
2613                 frm += 2;
2614                 scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
2615                 scan.chan = scan.bchan;
2616
2617                 while (frm < efrm) {
2618                         /* Agere element in beacon */
2619                         if ((*frm == IEEE80211_ELEMID_AGERE1) ||
2620                             (*frm == IEEE80211_ELEMID_AGERE2)) {
2621                                 frm = efrm;
2622                                 continue;
2623                         }
2624
2625                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
2626                         switch (*frm) {
2627                         case IEEE80211_ELEMID_SSID:
2628                                 scan.ssid = frm;
2629                                 break;
2630                         case IEEE80211_ELEMID_RATES:
2631                                 scan.rates = frm;
2632                                 break;
2633                         case IEEE80211_ELEMID_COUNTRY:
2634                                 scan.country = frm;
2635                                 break;
2636                         case IEEE80211_ELEMID_FHPARMS:
2637                                 if (ic->ic_phytype == IEEE80211_T_FH) {
2638                                         scan.fhdwell = LE_READ_2(&frm[2]);
2639                                         scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
2640                                         scan.fhindex = frm[6];
2641                                 }
2642                                 break;
2643                         case IEEE80211_ELEMID_DSPARMS:
2644                                 /*
2645                                  * XXX hack this since depending on phytype
2646                                  * is problematic for multi-mode devices.
2647                                  */
2648                                 if (ic->ic_phytype != IEEE80211_T_FH)
2649                                         scan.chan = frm[2];
2650                                 break;
2651                         case IEEE80211_ELEMID_TIM:
2652                                 /* XXX ATIM? */
2653                                 scan.tim = frm;
2654                                 scan.timoff = frm - skb->data;
2655                                 break;
2656                         case IEEE80211_ELEMID_IBSSPARMS:
2657                                 break;
2658                         case IEEE80211_ELEMID_XRATES:
2659                                 scan.xrates = frm;
2660                                 break;
2661                         case IEEE80211_ELEMID_ERP:
2662                                 if (frm[1] != 1) {
2663                                         IEEE80211_DISCARD_IE(vap,
2664                                                 IEEE80211_MSG_ELEMID, wh, "ERP",
2665                                                 "bad len %u", frm[1]);
2666                                         vap->iv_stats.is_rx_elem_toobig++;
2667                                         break;
2668                                 }
2669                                 scan.erp = frm[2];
2670                                 break;
2671                         case IEEE80211_ELEMID_RSN:
2672                                 scan.rsn = frm;
2673                                 break;
2674                         case IEEE80211_ELEMID_VENDOR:
2675                                 if (iswpaoui(frm))
2676                                         scan.wpa = frm;
2677                                 else if (iswmeparam(frm) || iswmeinfo(frm))
2678                                         scan.wme = frm;
2679                                 else if (isatherosoui(frm))
2680                                         scan.ath = frm;
2681                                 break;
2682                         case IEEE80211_ELEMID_CHANSWITCHANN:
2683                                 if (ic->ic_flags & IEEE80211_F_DOTH)
2684                                         scan.csa = frm;
2685                                 break;
2686                         default:
2687                                 IEEE80211_DISCARD_IE(vap, IEEE80211_MSG_ELEMID,
2688                                         wh, "unhandled",
2689                                         "id %u, len %u", *frm, frm[1]);
2690                                 vap->iv_stats.is_rx_elem_unknown++;
2691                                 break;
2692                         }
2693                         frm += frm[1] + 2;
2694                 }
2695                 if (frm > efrm)
2696                         return;
2697                 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
2698                 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
2699 #if IEEE80211_CHAN_MAX < 255
2700                 if (scan.chan > IEEE80211_CHAN_MAX) {
2701                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID,
2702                                 wh, ieee80211_mgt_subtype_name[subtype >>
2703                                         IEEE80211_FC0_SUBTYPE_SHIFT],
2704                                 "invalid channel %u", scan.chan);
2705                         vap->iv_stats.is_rx_badchan++;
2706                         return;
2707                 }
2708 #endif
2709                 if (scan.chan != scan.bchan &&
2710                     ic->ic_phytype != IEEE80211_T_FH) {
2711                         /*
2712                          * Frame was received on a channel different from the
2713                          * one indicated in the DS params element id;
2714                          * silently discard it.
2715                          *
2716                          * NB: this can happen due to signal leakage.
2717                          *     But we should take it for FH phy because
2718                          *     the rssi value should be correct even for
2719                          *     different hop pattern in FH.
2720                          */
2721                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID,
2722                                 wh, ieee80211_mgt_subtype_name[subtype >>
2723                                         IEEE80211_FC0_SUBTYPE_SHIFT],
2724                                 "for off-channel %u", scan.chan);
2725                         vap->iv_stats.is_rx_chanmismatch++;
2726                         return;
2727                 }
2728
2729                 /* IEEE802.11 does not specify the allowed range for 
2730                  * beacon interval. We discard any beacons with a 
2731                  * beacon interval outside of an arbitrary range in
2732                  * order to protect against attack.
2733                  */
2734                 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval && 
2735                      scan.bintval <= IEEE80211_BINTVAL_MAX)) {
2736                         IEEE80211_DISCARD(vap, IEEE80211_MSG_SCAN,
2737                                 wh, "beacon", "invalid beacon interval (%u)", 
2738                                 scan.bintval);
2739                         return;
2740                 }
2741                 
2742                 /*
2743                  * Count frame now that we know it's to be processed.
2744                  */
2745                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
2746                         IEEE80211_NODE_STAT(ni, rx_beacons);
2747                 else
2748                         IEEE80211_NODE_STAT(ni, rx_proberesp);
2749
2750                 /*
2751                  * When operating in station mode, check for state updates.
2752                  * Be careful to ignore beacons received while doing a
2753                  * background scan.  We consider only 11g/WMM stuff right now.
2754                  */
2755                 if (vap->iv_opmode == IEEE80211_M_STA &&
2756                     ni->ni_associd != 0 &&
2757                     IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid)) {
2758                         /* record tsf of last beacon */
2759                         memcpy(ni->ni_tstamp.data, scan.tstamp,
2760                                 sizeof(ni->ni_tstamp));
2761                         if (ni->ni_intval != scan.bintval) {
2762                                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2763                                               "beacon interval divergence: was %u, now %u",
2764                                         ni->ni_intval, scan.bintval);
2765                                if (!ni->ni_intval_end) {
2766                                        int msecs = 0; /* silence compiler */
2767                                        ni->ni_intval_cnt = 0;
2768                                        ni->ni_intval_old = ni->ni_intval;
2769                                        msecs = (ni->ni_intval_old * 1024 * 10) / 1000;
2770                                        ni->ni_intval_end = jiffies +
2771                                                msecs_to_jiffies(msecs);
2772                                        IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2773                                                       "scheduling beacon interval measurement for %u msecs",
2774                                                       msecs);
2775                                }
2776                                if (scan.bintval > ni->ni_intval) {
2777                                        ni->ni_intval = scan.bintval;
2778                                        vap->iv_flags_ext |= IEEE80211_FEXT_APPIE_UPDATE;
2779                                }
2780                                /* XXX statistic */
2781                        }
2782                        if (ni->ni_intval_end) {
2783                                if (scan.bintval == ni->ni_intval_old)
2784                                        ni->ni_intval_cnt++;
2785                                if (!time_before(jiffies, ni->ni_intval_end)) {
2786                                        IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2787                                                       "beacon interval measurement finished, old value repeated: %u times",
2788                                                       ni->ni_intval_cnt);
2789                                        ni->ni_intval_end = 0;
2790                                        if (ni->ni_intval_cnt == 0) {
2791                                                IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2792                                                               "reprogramming bmiss timer from %u to %u",
2793                                                               ni->ni_intval_old, scan.bintval);
2794                                 ni->ni_intval = scan.bintval;
2795                                                vap->iv_flags_ext |= IEEE80211_FEXT_APPIE_UPDATE;
2796                                        } else {
2797                                                IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2798                                                               "ignoring the divergence (maybe someone tried to spoof the AP?)", 0);
2799                                        }
2800                                 }
2801                                 /* XXX statistic */
2802                         }
2803                         if (ni->ni_erp != scan.erp) {
2804                                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2805                                         "erp change: was 0x%x, now 0x%x",
2806                                         ni->ni_erp, scan.erp);
2807                                 if (scan.erp & IEEE80211_ERP_USE_PROTECTION)
2808                                         ic->ic_flags |= IEEE80211_F_USEPROT;
2809                                 else
2810                                         ic->ic_flags &= ~IEEE80211_F_USEPROT;
2811                                 ni->ni_erp = scan.erp;
2812                                 /* XXX statistic */
2813                         }
2814                         if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
2815                                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2816                                         "capabilities change: was 0x%x, now 0x%x",
2817                                         ni->ni_capinfo, scan.capinfo);
2818                                 /*
2819                                  * NB: we assume short preamble doesn't
2820                                  *     change dynamically
2821                                  */
2822                                 ieee80211_set_shortslottime(ic,
2823                                         IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
2824                                         (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2825                                 ni->ni_capinfo = scan.capinfo;
2826                                 /* XXX statistic */
2827                         }
2828                         if (scan.wme != NULL &&
2829                             (ni->ni_flags & IEEE80211_NODE_QOS)) {
2830                                 int _retval;
2831                                 if ((_retval = ieee80211_parse_wmeparams(vap, scan.wme, wh, &qosinfo)) >= 0) {
2832                                         if (qosinfo & WME_CAPINFO_UAPSD_EN)
2833                                                 ni->ni_flags |= IEEE80211_NODE_UAPSD;
2834                                         if (_retval > 0)
2835                                                 ieee80211_wme_updateparams(vap);
2836                                 }
2837                         } else
2838                                 ni->ni_flags &= ~IEEE80211_NODE_UAPSD;
2839                         if (scan.ath != NULL)
2840                                 ieee80211_parse_athParams(ni, scan.ath);
2841                         if (scan.csa != NULL || vap->iv_csa_jiffies)
2842                                 ieee80211_parse_csaie(ni, scan.csa, wh);
2843                         if (scan.tim != NULL) {
2844                                 /*
2845                                  * Check the TIM. For now we drop out of
2846                                  * power save mode for any reason.
2847                                  */
2848                                 struct ieee80211_tim_ie *tim =
2849                                     (struct ieee80211_tim_ie *) scan.tim;
2850                                 int aid = IEEE80211_AID(ni->ni_associd);
2851                                 int ix = aid / NBBY;
2852                                 int min = tim->tim_bitctl &~ 1;
2853                                 int max = tim->tim_len + min - 4;
2854                                 if ((tim->tim_bitctl&1) ||
2855                                     (min <= ix && ix <= max &&
2856                                     isset(tim->tim_bitmap - min, aid)))
2857                                         ieee80211_sta_pwrsave(vap, 0);
2858                                 vap->iv_dtim_count = tim->tim_count;
2859                         }
2860
2861                         /* WDS/Repeater: re-schedule software beacon timer for STA */
2862                         if (vap->iv_state == IEEE80211_S_RUN &&
2863                             vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS) {
2864                                 mod_timer(&vap->iv_swbmiss, jiffies + vap->iv_swbmiss_period);
2865                         }
2866                         
2867                         /*
2868                          * If scanning, pass the info to the scan module.
2869                          * Otherwise, check if it's the right time to do
2870                          * a background scan.  Background scanning must
2871                          * be enabled and we must not be operating in the
2872                          * turbo phase of dynamic turbo mode.  Then,
2873                          * it's been a while since the last background
2874                          * scan and if no data frames have come through
2875                          * recently, kick off a scan.  Note that this
2876                          * is the mechanism by which a background scan
2877                          * is started _and_ continued each time we
2878                          * return on-channel to receive a beacon from
2879                          * our ap.
2880                          */
2881                         if (ic->ic_flags & IEEE80211_F_SCAN)
2882                                 ieee80211_add_scan(vap, &scan, wh,
2883                                         subtype, rssi, rstamp);
2884                         else if (contbgscan(vap) || startbgscan(vap))
2885                                 ieee80211_bg_scan(vap);
2886                         return;
2887                 }
2888                 /*
2889                  * If scanning, just pass information to the scan module.
2890                  */
2891                 if (ic->ic_flags & IEEE80211_F_SCAN) {
2892                         ieee80211_add_scan(vap, &scan, wh, subtype, rssi, rstamp);
2893                         return;
2894                 }
2895                 if ((vap->iv_opmode == IEEE80211_M_IBSS) && 
2896                                 (scan.capinfo & IEEE80211_CAPINFO_IBSS)) {
2897                         if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2898                                 /* Create a new entry in the neighbor table. */
2899                                 ni = ieee80211_add_neighbor(vap, wh, &scan);
2900                         } else {
2901                                 /*
2902                                  * Copy data from beacon to neighbor table.
2903                                  * Some of this information might change after
2904                                  * ieee80211_add_neighbor(), so we just copy
2905                                  * everything over to be safe.
2906                                  */
2907                                 ni->ni_esslen = scan.ssid[1];
2908                                 memcpy(ni->ni_essid, scan.ssid + 2, scan.ssid[1]);
2909                                 IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
2910                                 memcpy(ni->ni_tstamp.data, scan.tstamp,
2911                                         sizeof(ni->ni_tstamp));
2912                                 ni->ni_intval = IEEE80211_BINTVAL_SANITISE(scan.bintval);
2913                                 ni->ni_capinfo = scan.capinfo;
2914                                 ni->ni_chan = ic->ic_curchan;
2915                                 ni->ni_fhdwell = scan.fhdwell;
2916                                 ni->ni_fhindex = scan.fhindex;
2917                                 ni->ni_erp = scan.erp;
2918                                 ni->ni_timoff = scan.timoff;
2919                                 if (scan.wme != NULL)
2920                                         ieee80211_saveie(&ni->ni_wme_ie, scan.wme);
2921                                 if (scan.wpa != NULL)
2922                                         ieee80211_saveie(&ni->ni_wpa_ie, scan.wpa);
2923                                 if (scan.rsn != NULL)
2924                                         ieee80211_saveie(&ni->ni_rsn_ie, scan.rsn);
2925                                 if (scan.ath != NULL)
2926                                         ieee80211_saveath(ni, scan.ath);
2927
2928                                 /* NB: must be after ni_chan is setup */
2929                                 ieee80211_setup_rates(ni, scan.rates,
2930                                         scan.xrates, IEEE80211_F_DOSORT);
2931                         }
2932                         if (ni != NULL) {
2933                                 ni->ni_rssi = rssi;
2934                                 ni->ni_rstamp = rstamp;
2935                                 ni->ni_last_rx = jiffies;
2936                         }
2937                 }
2938                 break;
2939         }
2940
2941         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2942                 if (vap->iv_opmode == IEEE80211_M_STA ||
2943                     vap->iv_opmode == IEEE80211_M_AHDEMO ||
2944                     vap->iv_state != IEEE80211_S_RUN) {
2945                         vap->iv_stats.is_rx_mgtdiscard++;
2946                         return;
2947                 }
2948                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
2949                         /* frame must be directed */
2950                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
2951                         return;
2952                 }
2953
2954 /*
2955  * XR vap does not process  probe requests.
2956  */
2957 #ifdef ATH_SUPERG_XR
2958         if(vap->iv_flags & IEEE80211_F_XR ) 
2959                 return;
2960 #endif
2961                 /*
2962                  * prreq frame format
2963                  *      [tlv] ssid
2964                  *      [tlv] supported rates
2965                  *      [tlv] extended supported rates
2966                  *      [tlv] Atheros Advanced Capabilities
2967                  */
2968                 ssid = rates = xrates = ath = NULL;
2969                 while (frm < efrm) {
2970                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
2971                         switch (*frm) {
2972                         case IEEE80211_ELEMID_SSID:
2973                                 ssid = frm;
2974                                 break;
2975                         case IEEE80211_ELEMID_RATES:
2976                                 rates = frm;
2977                                 break;
2978                         case IEEE80211_ELEMID_XRATES:
2979                                 xrates = frm;
2980                                 break;
2981                         case IEEE80211_ELEMID_VENDOR:
2982                                 if (isatherosoui(frm))
2983                                         ath = frm;
2984                                 /* XXX Atheros OUI support */
2985                                 break;
2986                         }
2987                         frm += frm[1] + 2;
2988                 }
2989                 if (frm > efrm)
2990                         return;
2991                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2992                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2993                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid);
2994                 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
2995                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2996                                 wh, ieee80211_mgt_subtype_name[subtype >>
2997                                         IEEE80211_FC0_SUBTYPE_SHIFT],
2998                                 "%s", "no ssid with ssid suppression enabled");
2999                         vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
3000                         return;
3001                 }
3002                 if (ni == vap->iv_bss) {
3003                         if (vap->iv_opmode == IEEE80211_M_IBSS) {
3004                                 /*
3005                                  * XXX Cannot tell if the sender is operating
3006                                  * in ibss mode.  But we need a new node to
3007                                  * send the response so blindly add them to the
3008                                  * neighbor table.
3009                                  */
3010                                 ni = ieee80211_fakeup_adhoc_node(vap,
3011                                         wh->i_addr2);
3012                         } else {
3013                                 ni = ieee80211_tmp_node(vap, wh->i_addr2);
3014                         }
3015                         if (ni == NULL)
3016                                 return;
3017                         allocbs = 1;
3018                 } else
3019                         allocbs = 0;
3020                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
3021                         "%s", "recv probe req");
3022                 ni->ni_rssi = rssi;
3023                 ni->ni_rstamp = rstamp;
3024                 ni->ni_last_rx = jiffies;
3025                 rate = ieee80211_setup_rates(ni, rates, xrates,
3026                         IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
3027                         IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
3028                 if (rate & IEEE80211_RATE_BASIC) {
3029                         IEEE80211_DISCARD(vap, IEEE80211_MSG_XRATE,
3030                                 wh, ieee80211_mgt_subtype_name[subtype >>
3031                                         IEEE80211_FC0_SUBTYPE_SHIFT],
3032                                 "%s", "recv'd rate set invalid");
3033                 } else {
3034                         IEEE80211_SEND_MGMT(ni,
3035                                 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
3036                 }
3037                 if (allocbs && vap->iv_opmode != IEEE80211_M_IBSS) {
3038                         /*
3039                          * Temporary node created just to send a
3040                          * response, reclaim immediately
3041                          */
3042                         ieee80211_free_node(ni);
3043                 } else if (ath != NULL)
3044                         ieee80211_saveath(ni, ath);
3045                 break;
3046
3047         case IEEE80211_FC0_SUBTYPE_AUTH: {
3048                 u_int16_t algo, seq, status;
3049                 /*
3050                  * auth frame format
3051                  *      [2] algorithm
3052                  *      [2] sequence
3053                  *      [2] status
3054                  *      [tlv*] challenge
3055                  */
3056                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
3057                 algo   = le16toh(*(__le16 *)frm);
3058                 seq    = le16toh(*(__le16 *)(frm + 2));
3059                 status = le16toh(*(__le16 *)(frm + 4));
3060 #ifdef ATH_SUPERG_XR
3061                 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
3062                         /*
3063                          * node roaming between XR and normal vaps. 
3064                          * this can only happen in AP mode. disaccociate from
3065                          * previous vap first.
3066                          */
3067                         if (vap->iv_xrvap) {
3068                                 if (ni == vap->iv_bss)
3069                                         ni = vap->iv_xrvap->iv_bss;
3070                                 else {
3071                                         ieee80211_node_leave(ni);
3072                                         ieee80211_node_reset(ni, vap->iv_xrvap);
3073                                 }
3074                                 vap = vap->iv_xrvap;
3075                         } else {
3076                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
3077                                         wh, "auth", "%s", "not to pier xr bssid");
3078                                 return;
3079                         }
3080                 }
3081 #endif
3082                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
3083                         "recv auth frame with algorithm %d seq %d", algo, seq);
3084                 /*
3085                  * Consult the ACL policy module if setup.
3086                  */
3087                 if (vap->iv_acl != NULL &&
3088                     !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
3089                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
3090                                 wh, "auth", "%s", "disallowed by ACL");
3091                         vap->iv_stats.is_rx_acl++;
3092                         return;
3093                 }
3094                 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
3095                         IEEE80211_DISCARD(vap,
3096                                 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
3097                                 wh, "auth", "%s", "TKIP countermeasures enabled");
3098                         vap->iv_stats.is_rx_auth_countermeasures++;
3099                         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
3100                                 ieee80211_send_error(ni, wh->i_addr2,
3101                                         IEEE80211_FC0_SUBTYPE_AUTH,
3102                                         IEEE80211_REASON_MIC_FAILURE);
3103                         }
3104                         return;
3105                 }
3106                 if (algo == IEEE80211_AUTH_ALG_SHARED)
3107                         ieee80211_auth_shared(ni, wh, frm + 6, efrm, rssi,
3108                                 rstamp, seq, status);
3109                 else if (algo == IEEE80211_AUTH_ALG_OPEN)
3110                         ieee80211_auth_open(ni, wh, rssi, rstamp, seq, status);
3111                 else {
3112                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
3113                                 wh, "auth", "unsupported alg %d", algo);
3114                         vap->iv_stats.is_rx_auth_unsupported++;
3115                         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
3116                                 /* XXX not right */
3117                                 ieee80211_send_error(ni, wh->i_addr2,
3118                                         IEEE80211_FC0_SUBTYPE_AUTH,
3119                                         (seq+1) | (IEEE80211_STATUS_ALG << 16));
3120                         }
3121                         return;
3122                 } 
3123                 break;
3124         }
3125
3126         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
3127         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
3128                 u_int16_t capinfo, bintval;
3129                 struct ieee80211_rsnparms rsn_parm;
3130                 u_int8_t reason;
3131
3132                 if (vap->iv_opmode != IEEE80211_M_HOSTAP ||
3133                     vap->iv_state != IEEE80211_S_RUN) {
3134                         vap->iv_stats.is_rx_mgtdiscard++;
3135                         return;
3136                 }
3137
3138                 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
3139                         reassoc = 1;
3140                         resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
3141                 } else {
3142                         reassoc = 0;
3143                         resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
3144                 }
3145
3146                 /*
3147                  * asreq frame format
3148                  *      [2] capability information
3149                  *      [2] listen interval
3150                  *      [6*] current AP address (reassoc only)
3151                  *      [tlv] ssid
3152                  *      [tlv] supported rates
3153                  *      [tlv] extended supported rates
3154                  *      [tlv] wpa or RSN
3155                  *      [tlv] WME
3156                  *      [tlv] Atheros Advanced Capabilities
3157                  */
3158                 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4));
3159                 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
3160                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
3161                                 wh, ieee80211_mgt_subtype_name[subtype >>
3162                                         IEEE80211_FC0_SUBTYPE_SHIFT],
3163                                 "%s", "wrong bssid");
3164                         vap->iv_stats.is_rx_assoc_bss++;
3165                         return;
3166                 }
3167                 capinfo = le16toh(*(__le16 *)frm);
3168                 frm += 2;
3169                 bintval = le16toh(*(__le16 *)frm);
3170                 frm += 2;
3171                 if (reassoc)
3172                         frm += 6;       /* ignore current AP info */
3173                 ssid = rates = xrates = wpa = rsn = wme = ath = NULL;
3174                 while (frm < efrm) {
3175                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
3176                         switch (*frm) {
3177                         case IEEE80211_ELEMID_SSID:
3178                                 ssid = frm;
3179                                 break;
3180                         case IEEE80211_ELEMID_RATES:
3181                                 rates = frm;
3182                                 break;
3183                         case IEEE80211_ELEMID_XRATES:
3184                                 xrates = frm;
3185                                 break;
3186                         /* XXX verify only one of RSN and WPA ie's? */
3187                         case IEEE80211_ELEMID_RSN:
3188                                 if (vap->iv_flags & IEEE80211_F_WPA2)
3189                                         rsn = frm;
3190                                 else
3191                                         IEEE80211_DPRINTF(vap,
3192                                                 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
3193                                                 "[%s] ignoring RSN IE in association request\n",
3194                                                 ether_sprintf(wh->i_addr2));
3195                                 break;
3196                         case IEEE80211_ELEMID_VENDOR:
3197                                 /* don't override RSN element
3198                                  * XXX: actually the driver should report both WPA versions,
3199                                  * so wpa_supplicant can choose and also detect downgrade attacks
3200                                  */
3201                                 if (iswpaoui(frm) && !wpa) {
3202                                         if (vap->iv_flags & IEEE80211_F_WPA1)
3203                                                 wpa = frm;
3204                                         else
3205                                                 IEEE80211_DPRINTF(vap,
3206                                                         IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
3207                                                         "[%s] ignoring WPA IE in association request\n",
3208                                                         ether_sprintf(wh->i_addr2));
3209                                 } else if (iswmeinfo(frm))
3210                                         wme = frm;
3211                                 else if (isatherosoui(frm))
3212                                         ath = frm;
3213                                 break;
3214                         }
3215                         frm += frm[1] + 2;
3216                 }
3217                 if (frm > efrm)
3218                         return;
3219                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
3220                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
3221                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid);
3222
3223                 if (ni == vap->iv_bss) {
3224                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
3225                                 "deny %s request, sta not authenticated",
3226                                 reassoc ? "reassoc" : "assoc");
3227                         ieee80211_send_error(ni, wh->i_addr2,
3228                                 IEEE80211_FC0_SUBTYPE_DEAUTH,
3229                                 IEEE80211_REASON_ASSOC_NOT_AUTHED);
3230                         vap->iv_stats.is_rx_assoc_notauth++;
3231                         return;
3232                 }
3233                 
3234                 /* Assert right associstion security credentials */
3235                 /* XXX Divy. Incomplete */
3236                 if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) {
3237                         IEEE80211_DPRINTF(vap,
3238                                 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
3239                                 "[%s] no WPA/RSN IE in association request\n",
3240                                 ether_sprintf(wh->i_addr2));
3241                         IEEE80211_SEND_MGMT(ni,
3242                                 IEEE80211_FC0_SUBTYPE_DEAUTH,
3243                                 IEEE80211_REASON_RSN_REQUIRED);
3244                         ieee80211_node_leave(ni);
3245                         /* XXX distinguish WPA/RSN? */
3246                         vap->iv_stats.is_rx_assoc_badwpaie++;
3247                         return; 
3248                 }
3249                                 
3250                 if (rsn != NULL) {
3251                         /*
3252                          * Parse WPA information element.  Note that
3253                          * we initialize the param block from the node
3254                          * state so that information in the IE overrides
3255                          * our defaults.  The resulting parameters are
3256                          * installed below after the association is assured.
3257                          */
3258                         rsn_parm = ni->ni_rsn;
3259                         if (rsn[0] != IEEE80211_ELEMID_RSN)
3260                                 reason = ieee80211_parse_wpa(vap, rsn, &rsn_parm, wh);
3261                         else
3262                                 reason = ieee80211_parse_rsn(vap, rsn, &rsn_parm, wh);
3263                         if (reason != 0) {
3264                                 IEEE80211_SEND_MGMT(ni,
3265                                         IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
3266                                 ieee80211_node_leave(ni);
3267                                 /* XXX distinguish WPA/RSN? */
3268                                 vap->iv_stats.is_rx_assoc_badwpaie++;
3269                                 return;
3270                         }
3271                         IEEE80211_NOTE_MAC(vap,
3272                                 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
3273                                 wh->i_addr2,
3274                                 "%s ie: mc %u/%u uc %u/%u key %u caps 0x%x",
3275                                 rsn[0] != IEEE80211_ELEMID_RSN ?  "WPA" : "RSN",
3276                                 rsn_parm.rsn_mcastcipher, rsn_parm.rsn_mcastkeylen,
3277                                 rsn_parm.rsn_ucastcipher, rsn_parm.rsn_ucastkeylen,
3278                                 rsn_parm.rsn_keymgmt, rsn_parm.rsn_caps);
3279                 }
3280                 /* discard challenge after association */
3281                 if (ni->ni_challenge != NULL) {
3282                         FREE(ni->ni_challenge, M_DEVBUF);
3283                         ni->ni_challenge = NULL;
3284                 }
3285                 /* 802.11 spec says to ignore station's privacy bit */
3286                 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
3287                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
3288                                 "deny %s request, capability mismatch 0x%x",