1#include <linux/etherdevice.h> 2#include <linux/slab.h> 3#include <linux/export.h> 4#include <net/lib80211.h> 5#include <linux/if_arp.h> 6 7#include "hostap_80211.h" 8#include "hostap.h" 9#include "hostap_ap.h" 10 11/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */ 12/* Ethernet-II snap header (RFC1042 for most EtherTypes) */ 13static unsigned char rfc1042_header[] = 14{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 }; 15/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */ 16static unsigned char bridge_tunnel_header[] = 17{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 }; 18/* No encapsulation header if EtherType < 0x600 (=length) */ 19 20void hostap_dump_rx_80211(const char *name, struct sk_buff *skb, 21 struct hostap_80211_rx_status *rx_stats) 22{ 23 struct ieee80211_hdr *hdr; 24 u16 fc; 25 26 hdr = (struct ieee80211_hdr *) skb->data; 27 28 printk(KERN_DEBUG "%s: RX signal=%d noise=%d rate=%d len=%d " 29 "jiffies=%ld\n", 30 name, rx_stats->signal, rx_stats->noise, rx_stats->rate, 31 skb->len, jiffies); 32 33 if (skb->len < 2) 34 return; 35 36 fc = le16_to_cpu(hdr->frame_control); 37 printk(KERN_DEBUG " FC=0x%04x (type=%d:%d)%s%s", 38 fc, (fc & IEEE80211_FCTL_FTYPE) >> 2, 39 (fc & IEEE80211_FCTL_STYPE) >> 4, 40 fc & IEEE80211_FCTL_TODS ? " [ToDS]" : "", 41 fc & IEEE80211_FCTL_FROMDS ? " [FromDS]" : ""); 42 43 if (skb->len < IEEE80211_DATA_HDR3_LEN) { 44 printk("\n"); 45 return; 46 } 47 48 printk(" dur=0x%04x seq=0x%04x\n", le16_to_cpu(hdr->duration_id), 49 le16_to_cpu(hdr->seq_ctrl)); 50 51 printk(KERN_DEBUG " A1=%pM", hdr->addr1); 52 printk(" A2=%pM", hdr->addr2); 53 printk(" A3=%pM", hdr->addr3); 54 if (skb->len >= 30) 55 printk(" A4=%pM", hdr->addr4); 56 printk("\n"); 57} 58 59 60/* Send RX frame to netif with 802.11 (and possible prism) header. 61 * Called from hardware or software IRQ context. */ 62int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb, 63 struct hostap_80211_rx_status *rx_stats, int type) 64{ 65 struct hostap_interface *iface; 66 local_info_t *local; 67 int hdrlen, phdrlen, head_need, tail_need; 68 u16 fc; 69 int prism_header, ret; 70 struct ieee80211_hdr *fhdr; 71 72 iface = netdev_priv(dev); 73 local = iface->local; 74 75 if (dev->type == ARPHRD_IEEE80211_PRISM) { 76 if (local->monitor_type == PRISM2_MONITOR_PRISM) { 77 prism_header = 1; 78 phdrlen = sizeof(struct linux_wlan_ng_prism_hdr); 79 } else { /* local->monitor_type == PRISM2_MONITOR_CAPHDR */ 80 prism_header = 2; 81 phdrlen = sizeof(struct linux_wlan_ng_cap_hdr); 82 } 83 } else if (dev->type == ARPHRD_IEEE80211_RADIOTAP) { 84 prism_header = 3; 85 phdrlen = sizeof(struct hostap_radiotap_rx); 86 } else { 87 prism_header = 0; 88 phdrlen = 0; 89 } 90 91 fhdr = (struct ieee80211_hdr *) skb->data; 92 fc = le16_to_cpu(fhdr->frame_control); 93 94 if (type == PRISM2_RX_MGMT && (fc & IEEE80211_FCTL_VERS)) { 95 printk(KERN_DEBUG "%s: dropped management frame with header " 96 "version %d\n", dev->name, fc & IEEE80211_FCTL_VERS); 97 dev_kfree_skb_any(skb); 98 return 0; 99 } 100 101 hdrlen = hostap_80211_get_hdrlen(fhdr->frame_control); 102 103 /* check if there is enough room for extra data; if not, expand skb 104 * buffer to be large enough for the changes */ 105 head_need = phdrlen; 106 tail_need = 0; 107#ifdef PRISM2_ADD_BOGUS_CRC 108 tail_need += 4; 109#endif /* PRISM2_ADD_BOGUS_CRC */ 110 111 head_need -= skb_headroom(skb); 112 tail_need -= skb_tailroom(skb); 113 114 if (head_need > 0 || tail_need > 0) { 115 if (pskb_expand_head(skb, head_need > 0 ? head_need : 0, 116 tail_need > 0 ? tail_need : 0, 117 GFP_ATOMIC)) { 118 printk(KERN_DEBUG "%s: prism2_rx_80211 failed to " 119 "reallocate skb buffer\n", dev->name); 120 dev_kfree_skb_any(skb); 121 return 0; 122 } 123 } 124 125 /* We now have an skb with enough head and tail room, so just insert 126 * the extra data */ 127 128#ifdef PRISM2_ADD_BOGUS_CRC 129 memset(skb_put(skb, 4), 0xff, 4); /* Prism2 strips CRC */ 130#endif /* PRISM2_ADD_BOGUS_CRC */ 131 132 if (prism_header == 1) { 133 struct linux_wlan_ng_prism_hdr *hdr; 134 hdr = (struct linux_wlan_ng_prism_hdr *) 135 skb_push(skb, phdrlen); 136 memset(hdr, 0, phdrlen); 137 hdr->msgcode = LWNG_CAP_DID_BASE; 138 hdr->msglen = sizeof(*hdr); 139 memcpy(hdr->devname, dev->name, sizeof(hdr->devname)); 140#define LWNG_SETVAL(f,i,s,l,d) \ 141hdr->f.did = LWNG_CAP_DID_BASE | (i << 12); \ 142hdr->f.status = s; hdr->f.len = l; hdr->f.data = d 143 LWNG_SETVAL(hosttime, 1, 0, 4, jiffies); 144 LWNG_SETVAL(mactime, 2, 0, 4, rx_stats->mac_time); 145 LWNG_SETVAL(channel, 3, 1 /* no value */, 4, 0); 146 LWNG_SETVAL(rssi, 4, 1 /* no value */, 4, 0); 147 LWNG_SETVAL(sq, 5, 1 /* no value */, 4, 0); 148 LWNG_SETVAL(signal, 6, 0, 4, rx_stats->signal); 149 LWNG_SETVAL(noise, 7, 0, 4, rx_stats->noise); 150 LWNG_SETVAL(rate, 8, 0, 4, rx_stats->rate / 5); 151 LWNG_SETVAL(istx, 9, 0, 4, 0); 152 LWNG_SETVAL(frmlen, 10, 0, 4, skb->len - phdrlen); 153#undef LWNG_SETVAL 154 } else if (prism_header == 2) { 155 struct linux_wlan_ng_cap_hdr *hdr; 156 hdr = (struct linux_wlan_ng_cap_hdr *) 157 skb_push(skb, phdrlen); 158 memset(hdr, 0, phdrlen); 159 hdr->version = htonl(LWNG_CAPHDR_VERSION); 160 hdr->length = htonl(phdrlen); 161 hdr->mactime = __cpu_to_be64(rx_stats->mac_time); 162 hdr->hosttime = __cpu_to_be64(jiffies); 163 hdr->phytype = htonl(4); /* dss_dot11_b */ 164 hdr->channel = htonl(local->channel); 165 hdr->datarate = htonl(rx_stats->rate); 166 hdr->antenna = htonl(0); /* unknown */ 167 hdr->priority = htonl(0); /* unknown */ 168 hdr->ssi_type = htonl(3); /* raw */ 169 hdr->ssi_signal = htonl(rx_stats->signal); 170 hdr->ssi_noise = htonl(rx_stats->noise); 171 hdr->preamble = htonl(0); /* unknown */ 172 hdr->encoding = htonl(1); /* cck */ 173 } else if (prism_header == 3) { 174 struct hostap_radiotap_rx *hdr; 175 hdr = (struct hostap_radiotap_rx *)skb_push(skb, phdrlen); 176 memset(hdr, 0, phdrlen); 177 hdr->hdr.it_len = cpu_to_le16(phdrlen); 178 hdr->hdr.it_present = 179 cpu_to_le32((1 << IEEE80211_RADIOTAP_TSFT) | 180 (1 << IEEE80211_RADIOTAP_CHANNEL) | 181 (1 << IEEE80211_RADIOTAP_RATE) | 182 (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) | 183 (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE)); 184 hdr->tsft = cpu_to_le64(rx_stats->mac_time); 185 hdr->chan_freq = cpu_to_le16(freq_list[local->channel - 1]); 186 hdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_CCK | 187 IEEE80211_CHAN_2GHZ); 188 hdr->rate = rx_stats->rate / 5; 189 hdr->dbm_antsignal = rx_stats->signal; 190 hdr->dbm_antnoise = rx_stats->noise; 191 } 192 193 ret = skb->len - phdrlen; 194 skb->dev = dev; 195 skb_reset_mac_header(skb); 196 skb_pull(skb, hdrlen); 197 if (prism_header) 198 skb_pull(skb, phdrlen); 199 skb->pkt_type = PACKET_OTHERHOST; 200 skb->protocol = cpu_to_be16(ETH_P_802_2); 201 memset(skb->cb, 0, sizeof(skb->cb)); 202 netif_rx(skb); 203 204 return ret; 205} 206 207 208/* Called only as a tasklet (software IRQ) */ 209static void monitor_rx(struct net_device *dev, struct sk_buff *skb, 210 struct hostap_80211_rx_status *rx_stats) 211{ 212 int len; 213 214 len = prism2_rx_80211(dev, skb, rx_stats, PRISM2_RX_MONITOR); 215 dev->stats.rx_packets++; 216 dev->stats.rx_bytes += len; 217} 218 219 220/* Called only as a tasklet (software IRQ) */ 221static struct prism2_frag_entry * 222prism2_frag_cache_find(local_info_t *local, unsigned int seq, 223 unsigned int frag, u8 *src, u8 *dst) 224{ 225 struct prism2_frag_entry *entry; 226 int i; 227 228 for (i = 0; i < PRISM2_FRAG_CACHE_LEN; i++) { 229 entry = &local->frag_cache[i]; 230 if (entry->skb != NULL && 231 time_after(jiffies, entry->first_frag_time + 2 * HZ)) { 232 printk(KERN_DEBUG "%s: expiring fragment cache entry " 233 "seq=%u last_frag=%u\n", 234 local->dev->name, entry->seq, entry->last_frag); 235 dev_kfree_skb(entry->skb); 236 entry->skb = NULL; 237 } 238 239 if (entry->skb != NULL && entry->seq == seq && 240 (entry->last_frag + 1 == frag || frag == -1) && 241 memcmp(entry->src_addr, src, ETH_ALEN) == 0 && 242 memcmp(entry->dst_addr, dst, ETH_ALEN) == 0) 243 return entry; 244 } 245 246 return NULL; 247} 248 249 250/* Called only as a tasklet (software IRQ) */ 251static struct sk_buff * 252prism2_frag_cache_get(local_info_t *local, struct ieee80211_hdr *hdr) 253{ 254 struct sk_buff *skb = NULL; 255 u16 sc; 256 unsigned int frag, seq; 257 struct prism2_frag_entry *entry; 258 259 sc = le16_to_cpu(hdr->seq_ctrl); 260 frag = sc & IEEE80211_SCTL_FRAG; 261 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 262 263 if (frag == 0) { 264 /* Reserve enough space to fit maximum frame length */ 265 skb = dev_alloc_skb(local->dev->mtu + 266 sizeof(struct ieee80211_hdr) + 267 8 /* LLC */ + 268 2 /* alignment */ + 269 8 /* WEP */ + ETH_ALEN /* WDS */); 270 if (skb == NULL) 271 return NULL; 272 273 entry = &local->frag_cache[local->frag_next_idx]; 274 local->frag_next_idx++; 275 if (local->frag_next_idx >= PRISM2_FRAG_CACHE_LEN) 276 local->frag_next_idx = 0; 277 278 if (entry->skb != NULL) 279 dev_kfree_skb(entry->skb); 280 281 entry->first_frag_time = jiffies; 282 entry->seq = seq; 283 entry->last_frag = frag; 284 entry->skb = skb; 285 memcpy(entry->src_addr, hdr->addr2, ETH_ALEN); 286 memcpy(entry->dst_addr, hdr->addr1, ETH_ALEN); 287 } else { 288 /* received a fragment of a frame for which the head fragment 289 * should have already been received */ 290 entry = prism2_frag_cache_find(local, seq, frag, hdr->addr2, 291 hdr->addr1); 292 if (entry != NULL) { 293 entry->last_frag = frag; 294 skb = entry->skb; 295 } 296 } 297 298 return skb; 299} 300 301 302/* Called only as a tasklet (software IRQ) */ 303static int prism2_frag_cache_invalidate(local_info_t *local, 304 struct ieee80211_hdr *hdr) 305{ 306 u16 sc; 307 unsigned int seq; 308 struct prism2_frag_entry *entry; 309 310 sc = le16_to_cpu(hdr->seq_ctrl); 311 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 312 313 entry = prism2_frag_cache_find(local, seq, -1, hdr->addr2, hdr->addr1); 314 315 if (entry == NULL) { 316 printk(KERN_DEBUG "%s: could not invalidate fragment cache " 317 "entry (seq=%u)\n", 318 local->dev->name, seq); 319 return -1; 320 } 321 322 entry->skb = NULL; 323 return 0; 324} 325 326 327static struct hostap_bss_info *__hostap_get_bss(local_info_t *local, u8 *bssid, 328 u8 *ssid, size_t ssid_len) 329{ 330 struct list_head *ptr; 331 struct hostap_bss_info *bss; 332 333 list_for_each(ptr, &local->bss_list) { 334 bss = list_entry(ptr, struct hostap_bss_info, list); 335 if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0 && 336 (ssid == NULL || 337 (ssid_len == bss->ssid_len && 338 memcmp(ssid, bss->ssid, ssid_len) == 0))) { 339 list_move(&bss->list, &local->bss_list); 340 return bss; 341 } 342 } 343 344 return NULL; 345} 346 347 348static struct hostap_bss_info *__hostap_add_bss(local_info_t *local, u8 *bssid, 349 u8 *ssid, size_t ssid_len) 350{ 351 struct hostap_bss_info *bss; 352 353 if (local->num_bss_info >= HOSTAP_MAX_BSS_COUNT) { 354 bss = list_entry(local->bss_list.prev, 355 struct hostap_bss_info, list); 356 list_del(&bss->list); 357 local->num_bss_info--; 358 } else { 359 bss = kmalloc(sizeof(*bss), GFP_ATOMIC); 360 if (bss == NULL) 361 return NULL; 362 } 363 364 memset(bss, 0, sizeof(*bss)); 365 memcpy(bss->bssid, bssid, ETH_ALEN); 366 memcpy(bss->ssid, ssid, ssid_len); 367 bss->ssid_len = ssid_len; 368 local->num_bss_info++; 369 list_add(&bss->list, &local->bss_list); 370 return bss; 371} 372 373 374static void __hostap_expire_bss(local_info_t *local) 375{ 376 struct hostap_bss_info *bss; 377 378 while (local->num_bss_info > 0) { 379 bss = list_entry(local->bss_list.prev, 380 struct hostap_bss_info, list); 381 if (!time_after(jiffies, bss->last_update + 60 * HZ)) 382 break; 383 384 list_del(&bss->list); 385 local->num_bss_info--; 386 kfree(bss); 387 } 388} 389 390 391/* Both IEEE 802.11 Beacon and Probe Response frames have similar structure, so 392 * the same routine can be used to parse both of them. */ 393static void hostap_rx_sta_beacon(local_info_t *local, struct sk_buff *skb, 394 int stype) 395{ 396 struct hostap_ieee80211_mgmt *mgmt; 397 int left, chan = 0; 398 u8 *pos; 399 u8 *ssid = NULL, *wpa = NULL, *rsn = NULL; 400 size_t ssid_len = 0, wpa_len = 0, rsn_len = 0; 401 struct hostap_bss_info *bss; 402 403 if (skb->len < IEEE80211_MGMT_HDR_LEN + sizeof(mgmt->u.beacon)) 404 return; 405 406 mgmt = (struct hostap_ieee80211_mgmt *) skb->data; 407 pos = mgmt->u.beacon.variable; 408 left = skb->len - (pos - skb->data); 409 410 while (left >= 2) { 411 if (2 + pos[1] > left) 412 return; /* parse failed */ 413 switch (*pos) { 414 case WLAN_EID_SSID: 415 ssid = pos + 2; 416 ssid_len = pos[1]; 417 break; 418 case WLAN_EID_VENDOR_SPECIFIC: 419 if (pos[1] >= 4 && 420 pos[2] == 0x00 && pos[3] == 0x50 && 421 pos[4] == 0xf2 && pos[5] == 1) { 422 wpa = pos; 423 wpa_len = pos[1] + 2; 424 } 425 break; 426 case WLAN_EID_RSN: 427 rsn = pos; 428 rsn_len = pos[1] + 2; 429 break; 430 case WLAN_EID_DS_PARAMS: 431 if (pos[1] >= 1) 432 chan = pos[2]; 433 break; 434 } 435 left -= 2 + pos[1]; 436 pos += 2 + pos[1]; 437 } 438 439 if (wpa_len > MAX_WPA_IE_LEN) 440 wpa_len = MAX_WPA_IE_LEN; 441 if (rsn_len > MAX_WPA_IE_LEN) 442 rsn_len = MAX_WPA_IE_LEN; 443 if (ssid_len > sizeof(bss->ssid)) 444 ssid_len = sizeof(bss->ssid); 445 446 spin_lock(&local->lock); 447 bss = __hostap_get_bss(local, mgmt->bssid, ssid, ssid_len); 448 if (bss == NULL) 449 bss = __hostap_add_bss(local, mgmt->bssid, ssid, ssid_len); 450 if (bss) { 451 bss->last_update = jiffies; 452 bss->count++; 453 bss->capab_info = le16_to_cpu(mgmt->u.beacon.capab_info); 454 if (wpa) { 455 memcpy(bss->wpa_ie, wpa, wpa_len); 456 bss->wpa_ie_len = wpa_len; 457 } else 458 bss->wpa_ie_len = 0; 459 if (rsn) { 460 memcpy(bss->rsn_ie, rsn, rsn_len); 461 bss->rsn_ie_len = rsn_len; 462 } else 463 bss->rsn_ie_len = 0; 464 bss->chan = chan; 465 } 466 __hostap_expire_bss(local); 467 spin_unlock(&local->lock); 468} 469 470 471static int 472hostap_rx_frame_mgmt(local_info_t *local, struct sk_buff *skb, 473 struct hostap_80211_rx_status *rx_stats, u16 type, 474 u16 stype) 475{ 476 if (local->iw_mode == IW_MODE_MASTER) 477 hostap_update_sta_ps(local, (struct ieee80211_hdr *) skb->data); 478 479 if (local->hostapd && type == IEEE80211_FTYPE_MGMT) { 480 if (stype == IEEE80211_STYPE_BEACON && 481 local->iw_mode == IW_MODE_MASTER) { 482 struct sk_buff *skb2; 483 /* Process beacon frames also in kernel driver to 484 * update STA(AP) table statistics */ 485 skb2 = skb_clone(skb, GFP_ATOMIC); 486 if (skb2) 487 hostap_rx(skb2->dev, skb2, rx_stats); 488 } 489 490 /* send management frames to the user space daemon for 491 * processing */ 492 local->apdevstats.rx_packets++; 493 local->apdevstats.rx_bytes += skb->len; 494 if (local->apdev == NULL) 495 return -1; 496 prism2_rx_80211(local->apdev, skb, rx_stats, PRISM2_RX_MGMT); 497 return 0; 498 } 499 500 if (local->iw_mode == IW_MODE_MASTER) { 501 if (type != IEEE80211_FTYPE_MGMT && 502 type != IEEE80211_FTYPE_CTL) { 503 printk(KERN_DEBUG "%s: unknown management frame " 504 "(type=0x%02x, stype=0x%02x) dropped\n", 505 skb->dev->name, type >> 2, stype >> 4); 506 return -1; 507 } 508 509 hostap_rx(skb->dev, skb, rx_stats); 510 return 0; 511 } else if (type == IEEE80211_FTYPE_MGMT && 512 (stype == IEEE80211_STYPE_BEACON || 513 stype == IEEE80211_STYPE_PROBE_RESP)) { 514 hostap_rx_sta_beacon(local, skb, stype); 515 return -1; 516 } else if (type == IEEE80211_FTYPE_MGMT && 517 (stype == IEEE80211_STYPE_ASSOC_RESP || 518 stype == IEEE80211_STYPE_REASSOC_RESP)) { 519 /* Ignore (Re)AssocResp silently since these are not currently 520 * needed but are still received when WPA/RSN mode is enabled. 521 */ 522 return -1; 523 } else { 524 printk(KERN_DEBUG "%s: hostap_rx_frame_mgmt: dropped unhandled" 525 " management frame in non-Host AP mode (type=%d:%d)\n", 526 skb->dev->name, type >> 2, stype >> 4); 527 return -1; 528 } 529} 530 531 532/* Called only as a tasklet (software IRQ) */ 533static struct net_device *prism2_rx_get_wds(local_info_t *local, 534 u8 *addr) 535{ 536 struct hostap_interface *iface = NULL; 537 struct list_head *ptr; 538 539 read_lock_bh(&local->iface_lock); 540 list_for_each(ptr, &local->hostap_interfaces) { 541 iface = list_entry(ptr, struct hostap_interface, list); 542 if (iface->type == HOSTAP_INTERFACE_WDS && 543 memcmp(iface->u.wds.remote_addr, addr, ETH_ALEN) == 0) 544 break; 545 iface = NULL; 546 } 547 read_unlock_bh(&local->iface_lock); 548 549 return iface ? iface->dev : NULL; 550} 551 552 553static int 554hostap_rx_frame_wds(local_info_t *local, struct ieee80211_hdr *hdr, u16 fc, 555 struct net_device **wds) 556{ 557 /* FIX: is this really supposed to accept WDS frames only in Master 558 * mode? What about Repeater or Managed with WDS frames? */ 559 if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) != 560 (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS) && 561 (local->iw_mode != IW_MODE_MASTER || !(fc & IEEE80211_FCTL_TODS))) 562 return 0; /* not a WDS frame */ 563 564 /* Possible WDS frame: either IEEE 802.11 compliant (if FromDS) 565 * or own non-standard frame with 4th address after payload */ 566 if (!ether_addr_equal(hdr->addr1, local->dev->dev_addr) && 567 (hdr->addr1[0] != 0xff || hdr->addr1[1] != 0xff || 568 hdr->addr1[2] != 0xff || hdr->addr1[3] != 0xff || 569 hdr->addr1[4] != 0xff || hdr->addr1[5] != 0xff)) { 570 /* RA (or BSSID) is not ours - drop */ 571 PDEBUG(DEBUG_EXTRA2, "%s: received WDS frame with " 572 "not own or broadcast %s=%pM\n", 573 local->dev->name, 574 fc & IEEE80211_FCTL_FROMDS ? "RA" : "BSSID", 575 hdr->addr1); 576 return -1; 577 } 578 579 /* check if the frame came from a registered WDS connection */ 580 *wds = prism2_rx_get_wds(local, hdr->addr2); 581 if (*wds == NULL && fc & IEEE80211_FCTL_FROMDS && 582 (local->iw_mode != IW_MODE_INFRA || 583 !(local->wds_type & HOSTAP_WDS_AP_CLIENT) || 584 memcmp(hdr->addr2, local->bssid, ETH_ALEN) != 0)) { 585 /* require that WDS link has been registered with TA or the 586 * frame is from current AP when using 'AP client mode' */ 587 PDEBUG(DEBUG_EXTRA, "%s: received WDS[4 addr] frame " 588 "from unknown TA=%pM\n", 589 local->dev->name, hdr->addr2); 590 if (local->ap && local->ap->autom_ap_wds) 591 hostap_wds_link_oper(local, hdr->addr2, WDS_ADD); 592 return -1; 593 } 594 595 if (*wds && !(fc & IEEE80211_FCTL_FROMDS) && local->ap && 596 hostap_is_sta_assoc(local->ap, hdr->addr2)) { 597 /* STA is actually associated with us even though it has a 598 * registered WDS link. Assume it is in 'AP client' mode. 599 * Since this is a 3-addr frame, assume it is not (bogus) WDS 600 * frame and process it like any normal ToDS frame from 601 * associated STA. */ 602 *wds = NULL; 603 } 604 605 return 0; 606} 607 608 609static int hostap_is_eapol_frame(local_info_t *local, struct sk_buff *skb) 610{ 611 struct net_device *dev = local->dev; 612 u16 fc, ethertype; 613 struct ieee80211_hdr *hdr; 614 u8 *pos; 615 616 if (skb->len < 24) 617 return 0; 618 619 hdr = (struct ieee80211_hdr *) skb->data; 620 fc = le16_to_cpu(hdr->frame_control); 621 622 /* check that the frame is unicast frame to us */ 623 if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == 624 IEEE80211_FCTL_TODS && 625 ether_addr_equal(hdr->addr1, dev->dev_addr) && 626 ether_addr_equal(hdr->addr3, dev->dev_addr)) { 627 /* ToDS frame with own addr BSSID and DA */ 628 } else if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == 629 IEEE80211_FCTL_FROMDS && 630 ether_addr_equal(hdr->addr1, dev->dev_addr)) { 631 /* FromDS frame with own addr as DA */ 632 } else 633 return 0; 634 635 if (skb->len < 24 + 8) 636 return 0; 637 638 /* check for port access entity Ethernet type */ 639 pos = skb->data + 24; 640 ethertype = (pos[6] << 8) | pos[7]; 641 if (ethertype == ETH_P_PAE) 642 return 1; 643 644 return 0; 645} 646 647 648/* Called only as a tasklet (software IRQ) */ 649static int 650hostap_rx_frame_decrypt(local_info_t *local, struct sk_buff *skb, 651 struct lib80211_crypt_data *crypt) 652{ 653 struct ieee80211_hdr *hdr; 654 int res, hdrlen; 655 656 if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL) 657 return 0; 658 659 hdr = (struct ieee80211_hdr *) skb->data; 660 hdrlen = hostap_80211_get_hdrlen(hdr->frame_control); 661 662 if (local->tkip_countermeasures && 663 strcmp(crypt->ops->name, "TKIP") == 0) { 664 if (net_ratelimit()) { 665 printk(KERN_DEBUG "%s: TKIP countermeasures: dropped " 666 "received packet from %pM\n", 667 local->dev->name, hdr->addr2); 668 } 669 return -1; 670 } 671 672 atomic_inc(&crypt->refcnt); 673 res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv); 674 atomic_dec(&crypt->refcnt); 675 if (res < 0) { 676 printk(KERN_DEBUG "%s: decryption failed (SA=%pM) res=%d\n", 677 local->dev->name, hdr->addr2, res); 678 local->comm_tallies.rx_discards_wep_undecryptable++; 679 return -1; 680 } 681 682 return res; 683} 684 685 686/* Called only as a tasklet (software IRQ) */ 687static int 688hostap_rx_frame_decrypt_msdu(local_info_t *local, struct sk_buff *skb, 689 int keyidx, struct lib80211_crypt_data *crypt) 690{ 691 struct ieee80211_hdr *hdr; 692 int res, hdrlen; 693 694 if (crypt == NULL || crypt->ops->decrypt_msdu == NULL) 695 return 0; 696 697 hdr = (struct ieee80211_hdr *) skb->data; 698 hdrlen = hostap_80211_get_hdrlen(hdr->frame_control); 699 700 atomic_inc(&crypt->refcnt); 701 res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv); 702 atomic_dec(&crypt->refcnt); 703 if (res < 0) { 704 printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed" 705 " (SA=%pM keyidx=%d)\n", 706 local->dev->name, hdr->addr2, keyidx); 707 return -1; 708 } 709 710 return 0; 711} 712 713 714/* All received frames are sent to this function. @skb contains the frame in 715 * IEEE 802.11 format, i.e., in the format it was sent over air. 716 * This function is called only as a tasklet (software IRQ). */ 717void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb, 718 struct hostap_80211_rx_status *rx_stats) 719{ 720 struct hostap_interface *iface; 721 local_info_t *local; 722 struct ieee80211_hdr *hdr; 723 size_t hdrlen; 724 u16 fc, type, stype, sc; 725 struct net_device *wds = NULL; 726 unsigned int frag; 727 u8 *payload; 728 struct sk_buff *skb2 = NULL; 729 u16 ethertype; 730 int frame_authorized = 0; 731 int from_assoc_ap = 0; 732 u8 dst[ETH_ALEN]; 733 u8 src[ETH_ALEN]; 734 struct lib80211_crypt_data *crypt = NULL; 735 void *sta = NULL; 736 int keyidx = 0; 737 738 iface = netdev_priv(dev); 739 local = iface->local; 740 iface->stats.rx_packets++; 741 iface->stats.rx_bytes += skb->len; 742 743 /* dev is the master radio device; change this to be the default 744 * virtual interface (this may be changed to WDS device below) */ 745 dev = local->ddev; 746 iface = netdev_priv(dev); 747 748 hdr = (struct ieee80211_hdr *) skb->data; 749 750 if (skb->len < 10) 751 goto rx_dropped; 752 753 fc = le16_to_cpu(hdr->frame_control); 754 type = fc & IEEE80211_FCTL_FTYPE; 755 stype = fc & IEEE80211_FCTL_STYPE; 756 sc = le16_to_cpu(hdr->seq_ctrl); 757 frag = sc & IEEE80211_SCTL_FRAG; 758 hdrlen = hostap_80211_get_hdrlen(hdr->frame_control); 759 760 /* Put this code here so that we avoid duplicating it in all 761 * Rx paths. - Jean II */ 762#ifdef IW_WIRELESS_SPY /* defined in iw_handler.h */ 763 /* If spy monitoring on */ 764 if (iface->spy_data.spy_number > 0) { 765 struct iw_quality wstats; 766 wstats.level = rx_stats->signal; 767 wstats.noise = rx_stats->noise; 768 wstats.updated = IW_QUAL_LEVEL_UPDATED | IW_QUAL_NOISE_UPDATED 769 | IW_QUAL_QUAL_INVALID | IW_QUAL_DBM; 770 /* Update spy records */ 771 wireless_spy_update(dev, hdr->addr2, &wstats); 772 } 773#endif /* IW_WIRELESS_SPY */ 774 hostap_update_rx_stats(local->ap, hdr, rx_stats); 775 776 if (local->iw_mode == IW_MODE_MONITOR) { 777 monitor_rx(dev, skb, rx_stats); 778 return; 779 } 780 781 if (local->host_decrypt) { 782 int idx = 0; 783 if (skb->len >= hdrlen + 3) 784 idx = skb->data[hdrlen + 3] >> 6; 785 crypt = local->crypt_info.crypt[idx]; 786 sta = NULL; 787 788 /* Use station specific key to override default keys if the 789 * receiver address is a unicast address ("individual RA"). If 790 * bcrx_sta_key parameter is set, station specific key is used 791 * even with broad/multicast targets (this is against IEEE 792 * 802.11, but makes it easier to use different keys with 793 * stations that do not support WEP key mapping). */ 794 795 if (!(hdr->addr1[0] & 0x01) || local->bcrx_sta_key) 796 (void) hostap_handle_sta_crypto(local, hdr, &crypt, 797 &sta); 798 799 /* allow NULL decrypt to indicate an station specific override 800 * for default encryption */ 801 if (crypt && (crypt->ops == NULL || 802 crypt->ops->decrypt_mpdu == NULL)) 803 crypt = NULL; 804 805 if (!crypt && (fc & IEEE80211_FCTL_PROTECTED)) { 806#if 0 807 /* This seems to be triggered by some (multicast?) 808 * frames from other than current BSS, so just drop the 809 * frames silently instead of filling system log with 810 * these reports. */ 811 printk(KERN_DEBUG "%s: WEP decryption failed (not set)" 812 " (SA=%pM)\n", 813 local->dev->name, hdr->addr2); 814#endif 815 local->comm_tallies.rx_discards_wep_undecryptable++; 816 goto rx_dropped; 817 } 818 } 819 820 if (type != IEEE80211_FTYPE_DATA) { 821 if (type == IEEE80211_FTYPE_MGMT && 822 stype == IEEE80211_STYPE_AUTH && 823 fc & IEEE80211_FCTL_PROTECTED && local->host_decrypt && 824 (keyidx = hostap_rx_frame_decrypt(local, skb, crypt)) < 0) 825 { 826 printk(KERN_DEBUG "%s: failed to decrypt mgmt::auth " 827 "from %pM\n", dev->name, hdr->addr2); 828 /* TODO: could inform hostapd about this so that it 829 * could send auth failure report */ 830 goto rx_dropped; 831 } 832 833 if (hostap_rx_frame_mgmt(local, skb, rx_stats, type, stype)) 834 goto rx_dropped; 835 else 836 goto rx_exit; 837 } 838 839 /* Data frame - extract src/dst addresses */ 840 if (skb->len < IEEE80211_DATA_HDR3_LEN) 841 goto rx_dropped; 842 843 switch (fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) { 844 case IEEE80211_FCTL_FROMDS: 845 memcpy(dst, hdr->addr1, ETH_ALEN); 846 memcpy(src, hdr->addr3, ETH_ALEN); 847 break; 848 case IEEE80211_FCTL_TODS: 849 memcpy(dst, hdr->addr3, ETH_ALEN); 850 memcpy(src, hdr->addr2, ETH_ALEN); 851 break; 852 case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS: 853 if (skb->len < IEEE80211_DATA_HDR4_LEN) 854 goto rx_dropped; 855 memcpy(dst, hdr->addr3, ETH_ALEN); 856 memcpy(src, hdr->addr4, ETH_ALEN); 857 break; 858 case 0: 859 memcpy(dst, hdr->addr1, ETH_ALEN); 860 memcpy(src, hdr->addr2, ETH_ALEN); 861 break; 862 } 863 864 if (hostap_rx_frame_wds(local, hdr, fc, &wds)) 865 goto rx_dropped; 866 if (wds) 867 skb->dev = dev = wds; 868 869 if (local->iw_mode == IW_MODE_MASTER && !wds && 870 (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == 871 IEEE80211_FCTL_FROMDS && 872 local->stadev && 873 memcmp(hdr->addr2, local->assoc_ap_addr, ETH_ALEN) == 0) { 874 /* Frame from BSSID of the AP for which we are a client */ 875 skb->dev = dev = local->stadev; 876 from_assoc_ap = 1; 877 } 878 879 if ((local->iw_mode == IW_MODE_MASTER || 880 local->iw_mode == IW_MODE_REPEAT) && 881 !from_assoc_ap) { 882 switch (hostap_handle_sta_rx(local, dev, skb, rx_stats, 883 wds != NULL)) { 884 case AP_RX_CONTINUE_NOT_AUTHORIZED: 885 frame_authorized = 0; 886 break; 887 case AP_RX_CONTINUE: 888 frame_authorized = 1; 889 break; 890 case AP_RX_DROP: 891 goto rx_dropped; 892 case AP_RX_EXIT: 893 goto rx_exit; 894 } 895 } 896 897 /* Nullfunc frames may have PS-bit set, so they must be passed to 898 * hostap_handle_sta_rx() before being dropped here. */ 899 if (stype != IEEE80211_STYPE_DATA && 900 stype != IEEE80211_STYPE_DATA_CFACK && 901 stype != IEEE80211_STYPE_DATA_CFPOLL && 902 stype != IEEE80211_STYPE_DATA_CFACKPOLL) { 903 if (stype != IEEE80211_STYPE_NULLFUNC) 904 printk(KERN_DEBUG "%s: RX: dropped data frame " 905 "with no data (type=0x%02x, subtype=0x%02x)\n", 906 dev->name, type >> 2, stype >> 4); 907 goto rx_dropped; 908 } 909 910 /* skb: hdr + (possibly fragmented, possibly encrypted) payload */ 911 912 if (local->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) && 913 (keyidx = hostap_rx_frame_decrypt(local, skb, crypt)) < 0) 914 goto rx_dropped; 915 hdr = (struct ieee80211_hdr *) skb->data; 916 917 /* skb: hdr + (possibly fragmented) plaintext payload */ 918 919 if (local->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) && 920 (frag != 0 || (fc & IEEE80211_FCTL_MOREFRAGS))) { 921 int flen; 922 struct sk_buff *frag_skb = 923 prism2_frag_cache_get(local, hdr); 924 if (!frag_skb) { 925 printk(KERN_DEBUG "%s: Rx cannot get skb from " 926 "fragment cache (morefrag=%d seq=%u frag=%u)\n", 927 dev->name, (fc & IEEE80211_FCTL_MOREFRAGS) != 0, 928 (sc & IEEE80211_SCTL_SEQ) >> 4, frag); 929 goto rx_dropped; 930 } 931 932 flen = skb->len; 933 if (frag != 0) 934 flen -= hdrlen; 935 936 if (frag_skb->tail + flen > frag_skb->end) { 937 printk(KERN_WARNING "%s: host decrypted and " 938 "reassembled frame did not fit skb\n", 939 dev->name); 940 prism2_frag_cache_invalidate(local, hdr); 941 goto rx_dropped; 942 } 943 944 if (frag == 0) { 945 /* copy first fragment (including full headers) into 946 * beginning of the fragment cache skb */ 947 skb_copy_from_linear_data(skb, skb_put(frag_skb, flen), 948 flen); 949 } else { 950 /* append frame payload to the end of the fragment 951 * cache skb */ 952 skb_copy_from_linear_data_offset(skb, hdrlen, 953 skb_put(frag_skb, 954 flen), flen); 955 } 956 dev_kfree_skb(skb); 957 skb = NULL; 958 959 if (fc & IEEE80211_FCTL_MOREFRAGS) { 960 /* more fragments expected - leave the skb in fragment 961 * cache for now; it will be delivered to upper layers 962 * after all fragments have been received */ 963 goto rx_exit; 964 } 965 966 /* this was the last fragment and the frame will be 967 * delivered, so remove skb from fragment cache */ 968 skb = frag_skb; 969 hdr = (struct ieee80211_hdr *) skb->data; 970 prism2_frag_cache_invalidate(local, hdr); 971 } 972 973 /* skb: hdr + (possible reassembled) full MSDU payload; possibly still 974 * encrypted/authenticated */ 975 976 if (local->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) && 977 hostap_rx_frame_decrypt_msdu(local, skb, keyidx, crypt)) 978 goto rx_dropped; 979 980 hdr = (struct ieee80211_hdr *) skb->data; 981 if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !local->open_wep) { 982 if (local->ieee_802_1x && 983 hostap_is_eapol_frame(local, skb)) { 984 /* pass unencrypted EAPOL frames even if encryption is 985 * configured */ 986 PDEBUG(DEBUG_EXTRA2, "%s: RX: IEEE 802.1X - passing " 987 "unencrypted EAPOL frame\n", local->dev->name); 988 } else { 989 printk(KERN_DEBUG "%s: encryption configured, but RX " 990 "frame not encrypted (SA=%pM)\n", 991 local->dev->name, hdr->addr2); 992 goto rx_dropped; 993 } 994 } 995 996 if (local->drop_unencrypted && !(fc & IEEE80211_FCTL_PROTECTED) && 997 !hostap_is_eapol_frame(local, skb)) { 998 if (net_ratelimit()) { 999 printk(KERN_DEBUG "%s: dropped unencrypted RX data " 1000 "frame from %pM (drop_unencrypted=1)\n", 1001 dev->name, hdr->addr2); 1002 } 1003 goto rx_dropped; 1004 } 1005 1006 /* skb: hdr + (possible reassembled) full plaintext payload */ 1007 1008 payload = skb->data + hdrlen; 1009 ethertype = (payload[6] << 8) | payload[7]; 1010 1011 /* If IEEE 802.1X is used, check whether the port is authorized to send 1012 * the received frame. */ 1013 if (local->ieee_802_1x && local->iw_mode == IW_MODE_MASTER) { 1014 if (ethertype == ETH_P_PAE) { 1015 PDEBUG(DEBUG_EXTRA2, "%s: RX: IEEE 802.1X frame\n", 1016 dev->name); 1017 if (local->hostapd && local->apdev) { 1018 /* Send IEEE 802.1X frames to the user 1019 * space daemon for processing */ 1020 prism2_rx_80211(local->apdev, skb, rx_stats, 1021 PRISM2_RX_MGMT); 1022 local->apdevstats.rx_packets++; 1023 local->apdevstats.rx_bytes += skb->len; 1024 goto rx_exit; 1025 } 1026 } else if (!frame_authorized) { 1027 printk(KERN_DEBUG "%s: dropped frame from " 1028 "unauthorized port (IEEE 802.1X): " 1029 "ethertype=0x%04x\n", 1030 dev->name, ethertype); 1031 goto rx_dropped; 1032 } 1033 } 1034 1035 /* convert hdr + possible LLC headers into Ethernet header */ 1036 if (skb->len - hdrlen >= 8 && 1037 ((memcmp(payload, rfc1042_header, 6) == 0 && 1038 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) || 1039 memcmp(payload, bridge_tunnel_header, 6) == 0)) { 1040 /* remove RFC1042 or Bridge-Tunnel encapsulation and 1041 * replace EtherType */ 1042 skb_pull(skb, hdrlen + 6); 1043 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN); 1044 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN); 1045 } else { 1046 __be16 len; 1047 /* Leave Ethernet header part of hdr and full payload */ 1048 skb_pull(skb, hdrlen); 1049 len = htons(skb->len); 1050 memcpy(skb_push(skb, 2), &len, 2); 1051 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN); 1052 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN); 1053 } 1054 1055 if (wds && ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == 1056 IEEE80211_FCTL_TODS) && 1057 skb->len >= ETH_HLEN + ETH_ALEN) { 1058 /* Non-standard frame: get addr4 from its bogus location after 1059 * the payload */ 1060 skb_copy_from_linear_data_offset(skb, skb->len - ETH_ALEN, 1061 skb->data + ETH_ALEN, 1062 ETH_ALEN); 1063 skb_trim(skb, skb->len - ETH_ALEN); 1064 } 1065 1066 dev->stats.rx_packets++; 1067 dev->stats.rx_bytes += skb->len; 1068 1069 if (local->iw_mode == IW_MODE_MASTER && !wds && 1070 local->ap->bridge_packets) { 1071 if (dst[0] & 0x01) { 1072 /* copy multicast frame both to the higher layers and 1073 * to the wireless media */ 1074 local->ap->bridged_multicast++; 1075 skb2 = skb_clone(skb, GFP_ATOMIC); 1076 if (skb2 == NULL) 1077 printk(KERN_DEBUG "%s: skb_clone failed for " 1078 "multicast frame\n", dev->name); 1079 } else if (hostap_is_sta_authorized(local->ap, dst)) { 1080 /* send frame directly to the associated STA using 1081 * wireless media and not passing to higher layers */ 1082 local->ap->bridged_unicast++; 1083 skb2 = skb; 1084 skb = NULL; 1085 } 1086 } 1087 1088 if (skb2 != NULL) { 1089 /* send to wireless media */ 1090 skb2->dev = dev; 1091 skb2->protocol = cpu_to_be16(ETH_P_802_3); 1092 skb_reset_mac_header(skb2); 1093 skb_reset_network_header(skb2); 1094 /* skb2->network_header += ETH_HLEN; */ 1095 dev_queue_xmit(skb2); 1096 } 1097 1098 if (skb) { 1099 skb->protocol = eth_type_trans(skb, dev); 1100 memset(skb->cb, 0, sizeof(skb->cb)); 1101 netif_rx(skb); 1102 } 1103 1104 rx_exit: 1105 if (sta) 1106 hostap_handle_sta_release(sta); 1107 return; 1108 1109 rx_dropped: 1110 dev_kfree_skb(skb); 1111 1112 dev->stats.rx_dropped++; 1113 goto rx_exit; 1114} 1115 1116 1117EXPORT_SYMBOL(hostap_80211_rx); 1118