Commit | Line | Data |
---|---|---|
ff1d2767 | 1 | #include <linux/etherdevice.h> |
5fad5a2e | 2 | #include <net/ieee80211_crypt.h> |
ff1d2767 JM |
3 | |
4 | #include "hostap_80211.h" | |
5 | #include "hostap.h" | |
5fad5a2e AB |
6 | #include "hostap_ap.h" |
7 | ||
8 | /* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */ | |
9 | /* Ethernet-II snap header (RFC1042 for most EtherTypes) */ | |
10 | static unsigned char rfc1042_header[] = | |
11 | { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 }; | |
12 | /* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */ | |
13 | static unsigned char bridge_tunnel_header[] = | |
14 | { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 }; | |
15 | /* No encapsulation header if EtherType < 0x600 (=length) */ | |
ff1d2767 JM |
16 | |
17 | void hostap_dump_rx_80211(const char *name, struct sk_buff *skb, | |
18 | struct hostap_80211_rx_status *rx_stats) | |
19 | { | |
d041674d | 20 | struct ieee80211_hdr_4addr *hdr; |
ff1d2767 | 21 | u16 fc; |
0795af57 | 22 | DECLARE_MAC_BUF(mac); |
ff1d2767 | 23 | |
d041674d | 24 | hdr = (struct ieee80211_hdr_4addr *) skb->data; |
ff1d2767 JM |
25 | |
26 | printk(KERN_DEBUG "%s: RX signal=%d noise=%d rate=%d len=%d " | |
27 | "jiffies=%ld\n", | |
28 | name, rx_stats->signal, rx_stats->noise, rx_stats->rate, | |
29 | skb->len, jiffies); | |
30 | ||
31 | if (skb->len < 2) | |
32 | return; | |
33 | ||
c0f72ca8 | 34 | fc = le16_to_cpu(hdr->frame_ctl); |
ff1d2767 | 35 | printk(KERN_DEBUG " FC=0x%04x (type=%d:%d)%s%s", |
4339d328 | 36 | fc, WLAN_FC_GET_TYPE(fc) >> 2, WLAN_FC_GET_STYPE(fc) >> 4, |
b2f4a2e3 JM |
37 | fc & IEEE80211_FCTL_TODS ? " [ToDS]" : "", |
38 | fc & IEEE80211_FCTL_FROMDS ? " [FromDS]" : ""); | |
ff1d2767 JM |
39 | |
40 | if (skb->len < IEEE80211_DATA_HDR3_LEN) { | |
41 | printk("\n"); | |
42 | return; | |
43 | } | |
44 | ||
45 | printk(" dur=0x%04x seq=0x%04x\n", le16_to_cpu(hdr->duration_id), | |
c0f72ca8 | 46 | le16_to_cpu(hdr->seq_ctl)); |
ff1d2767 | 47 | |
0795af57 JP |
48 | printk(KERN_DEBUG " A1=%s", print_mac(mac, hdr->addr1)); |
49 | printk(" A2=%s", print_mac(mac, hdr->addr2)); | |
50 | printk(" A3=%s", print_mac(mac, hdr->addr3)); | |
ff1d2767 | 51 | if (skb->len >= 30) |
0795af57 | 52 | printk(" A4=%s", print_mac(mac, hdr->addr4)); |
ff1d2767 JM |
53 | printk("\n"); |
54 | } | |
55 | ||
56 | ||
57 | /* Send RX frame to netif with 802.11 (and possible prism) header. | |
58 | * Called from hardware or software IRQ context. */ | |
59 | int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb, | |
60 | struct hostap_80211_rx_status *rx_stats, int type) | |
61 | { | |
62 | struct hostap_interface *iface; | |
63 | local_info_t *local; | |
64 | int hdrlen, phdrlen, head_need, tail_need; | |
65 | u16 fc; | |
66 | int prism_header, ret; | |
1bcca3c4 | 67 | struct ieee80211_hdr_4addr *fhdr; |
ff1d2767 JM |
68 | |
69 | iface = netdev_priv(dev); | |
70 | local = iface->local; | |
71 | dev->last_rx = jiffies; | |
72 | ||
73 | if (dev->type == ARPHRD_IEEE80211_PRISM) { | |
74 | if (local->monitor_type == PRISM2_MONITOR_PRISM) { | |
75 | prism_header = 1; | |
76 | phdrlen = sizeof(struct linux_wlan_ng_prism_hdr); | |
77 | } else { /* local->monitor_type == PRISM2_MONITOR_CAPHDR */ | |
78 | prism_header = 2; | |
79 | phdrlen = sizeof(struct linux_wlan_ng_cap_hdr); | |
80 | } | |
573b933f PR |
81 | } else if (dev->type == ARPHRD_IEEE80211_RADIOTAP) { |
82 | prism_header = 3; | |
83 | phdrlen = sizeof(struct hostap_radiotap_rx); | |
ff1d2767 JM |
84 | } else { |
85 | prism_header = 0; | |
86 | phdrlen = 0; | |
87 | } | |
88 | ||
1bcca3c4 PR |
89 | fhdr = (struct ieee80211_hdr_4addr *) skb->data; |
90 | fc = le16_to_cpu(fhdr->frame_ctl); | |
ff1d2767 | 91 | |
b2f4a2e3 | 92 | if (type == PRISM2_RX_MGMT && (fc & IEEE80211_FCTL_VERS)) { |
ff1d2767 | 93 | printk(KERN_DEBUG "%s: dropped management frame with header " |
b2f4a2e3 | 94 | "version %d\n", dev->name, fc & IEEE80211_FCTL_VERS); |
ff1d2767 JM |
95 | dev_kfree_skb_any(skb); |
96 | return 0; | |
97 | } | |
98 | ||
99 | hdrlen = hostap_80211_get_hdrlen(fc); | |
100 | ||
101 | /* check if there is enough room for extra data; if not, expand skb | |
102 | * buffer to be large enough for the changes */ | |
103 | head_need = phdrlen; | |
104 | tail_need = 0; | |
105 | #ifdef PRISM2_ADD_BOGUS_CRC | |
106 | tail_need += 4; | |
107 | #endif /* PRISM2_ADD_BOGUS_CRC */ | |
108 | ||
109 | head_need -= skb_headroom(skb); | |
110 | tail_need -= skb_tailroom(skb); | |
111 | ||
112 | if (head_need > 0 || tail_need > 0) { | |
113 | if (pskb_expand_head(skb, head_need > 0 ? head_need : 0, | |
114 | tail_need > 0 ? tail_need : 0, | |
115 | GFP_ATOMIC)) { | |
116 | printk(KERN_DEBUG "%s: prism2_rx_80211 failed to " | |
117 | "reallocate skb buffer\n", dev->name); | |
118 | dev_kfree_skb_any(skb); | |
119 | return 0; | |
120 | } | |
121 | } | |
122 | ||
123 | /* We now have an skb with enough head and tail room, so just insert | |
124 | * the extra data */ | |
125 | ||
126 | #ifdef PRISM2_ADD_BOGUS_CRC | |
127 | memset(skb_put(skb, 4), 0xff, 4); /* Prism2 strips CRC */ | |
128 | #endif /* PRISM2_ADD_BOGUS_CRC */ | |
129 | ||
130 | if (prism_header == 1) { | |
131 | struct linux_wlan_ng_prism_hdr *hdr; | |
132 | hdr = (struct linux_wlan_ng_prism_hdr *) | |
133 | skb_push(skb, phdrlen); | |
134 | memset(hdr, 0, phdrlen); | |
135 | hdr->msgcode = LWNG_CAP_DID_BASE; | |
136 | hdr->msglen = sizeof(*hdr); | |
137 | memcpy(hdr->devname, dev->name, sizeof(hdr->devname)); | |
138 | #define LWNG_SETVAL(f,i,s,l,d) \ | |
139 | hdr->f.did = LWNG_CAP_DID_BASE | (i << 12); \ | |
140 | hdr->f.status = s; hdr->f.len = l; hdr->f.data = d | |
141 | LWNG_SETVAL(hosttime, 1, 0, 4, jiffies); | |
3e1d3932 | 142 | LWNG_SETVAL(mactime, 2, 0, 4, rx_stats->mac_time); |
ff1d2767 JM |
143 | LWNG_SETVAL(channel, 3, 1 /* no value */, 4, 0); |
144 | LWNG_SETVAL(rssi, 4, 1 /* no value */, 4, 0); | |
145 | LWNG_SETVAL(sq, 5, 1 /* no value */, 4, 0); | |
146 | LWNG_SETVAL(signal, 6, 0, 4, rx_stats->signal); | |
147 | LWNG_SETVAL(noise, 7, 0, 4, rx_stats->noise); | |
148 | LWNG_SETVAL(rate, 8, 0, 4, rx_stats->rate / 5); | |
149 | LWNG_SETVAL(istx, 9, 0, 4, 0); | |
150 | LWNG_SETVAL(frmlen, 10, 0, 4, skb->len - phdrlen); | |
151 | #undef LWNG_SETVAL | |
152 | } else if (prism_header == 2) { | |
153 | struct linux_wlan_ng_cap_hdr *hdr; | |
154 | hdr = (struct linux_wlan_ng_cap_hdr *) | |
155 | skb_push(skb, phdrlen); | |
156 | memset(hdr, 0, phdrlen); | |
157 | hdr->version = htonl(LWNG_CAPHDR_VERSION); | |
158 | hdr->length = htonl(phdrlen); | |
159 | hdr->mactime = __cpu_to_be64(rx_stats->mac_time); | |
160 | hdr->hosttime = __cpu_to_be64(jiffies); | |
161 | hdr->phytype = htonl(4); /* dss_dot11_b */ | |
162 | hdr->channel = htonl(local->channel); | |
163 | hdr->datarate = htonl(rx_stats->rate); | |
164 | hdr->antenna = htonl(0); /* unknown */ | |
165 | hdr->priority = htonl(0); /* unknown */ | |
166 | hdr->ssi_type = htonl(3); /* raw */ | |
167 | hdr->ssi_signal = htonl(rx_stats->signal); | |
168 | hdr->ssi_noise = htonl(rx_stats->noise); | |
169 | hdr->preamble = htonl(0); /* unknown */ | |
170 | hdr->encoding = htonl(1); /* cck */ | |
573b933f PR |
171 | } else if (prism_header == 3) { |
172 | struct hostap_radiotap_rx *hdr; | |
173 | hdr = (struct hostap_radiotap_rx *)skb_push(skb, phdrlen); | |
174 | memset(hdr, 0, phdrlen); | |
175 | hdr->hdr.it_len = cpu_to_le16(phdrlen); | |
176 | hdr->hdr.it_present = | |
177 | cpu_to_le32((1 << IEEE80211_RADIOTAP_TSFT) | | |
178 | (1 << IEEE80211_RADIOTAP_CHANNEL) | | |
179 | (1 << IEEE80211_RADIOTAP_RATE) | | |
180 | (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) | | |
181 | (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE)); | |
182 | hdr->tsft = cpu_to_le64(rx_stats->mac_time); | |
183 | hdr->chan_freq = cpu_to_le16(freq_list[local->channel - 1]); | |
184 | hdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_CCK | | |
185 | IEEE80211_CHAN_2GHZ); | |
186 | hdr->rate = rx_stats->rate / 5; | |
187 | hdr->dbm_antsignal = rx_stats->signal; | |
188 | hdr->dbm_antnoise = rx_stats->noise; | |
ff1d2767 JM |
189 | } |
190 | ||
191 | ret = skb->len - phdrlen; | |
192 | skb->dev = dev; | |
459a98ed | 193 | skb_reset_mac_header(skb); |
ff1d2767 JM |
194 | skb_pull(skb, hdrlen); |
195 | if (prism_header) | |
196 | skb_pull(skb, phdrlen); | |
197 | skb->pkt_type = PACKET_OTHERHOST; | |
198 | skb->protocol = __constant_htons(ETH_P_802_2); | |
199 | memset(skb->cb, 0, sizeof(skb->cb)); | |
200 | netif_rx(skb); | |
201 | ||
202 | return ret; | |
203 | } | |
204 | ||
205 | ||
206 | /* Called only as a tasklet (software IRQ) */ | |
207 | static void monitor_rx(struct net_device *dev, struct sk_buff *skb, | |
208 | struct hostap_80211_rx_status *rx_stats) | |
209 | { | |
210 | struct net_device_stats *stats; | |
211 | int len; | |
212 | ||
213 | len = prism2_rx_80211(dev, skb, rx_stats, PRISM2_RX_MONITOR); | |
214 | stats = hostap_get_stats(dev); | |
215 | stats->rx_packets++; | |
216 | stats->rx_bytes += len; | |
217 | } | |
218 | ||
219 | ||
220 | /* Called only as a tasklet (software IRQ) */ | |
221 | static struct prism2_frag_entry * | |
222 | prism2_frag_cache_find(local_info_t *local, unsigned int seq, | |
223 | unsigned int frag, u8 *src, u8 *dst) | |
224 | { | |
225 | struct prism2_frag_entry *entry; | |
226 | int i; | |
227 | ||
228 | for (i = 0; i < PRISM2_FRAG_CACHE_LEN; i++) { | |
229 | entry = &local->frag_cache[i]; | |
230 | if (entry->skb != NULL && | |
231 | time_after(jiffies, entry->first_frag_time + 2 * HZ)) { | |
232 | printk(KERN_DEBUG "%s: expiring fragment cache entry " | |
233 | "seq=%u last_frag=%u\n", | |
234 | local->dev->name, entry->seq, entry->last_frag); | |
235 | dev_kfree_skb(entry->skb); | |
236 | entry->skb = NULL; | |
237 | } | |
238 | ||
239 | if (entry->skb != NULL && entry->seq == seq && | |
240 | (entry->last_frag + 1 == frag || frag == -1) && | |
241 | memcmp(entry->src_addr, src, ETH_ALEN) == 0 && | |
242 | memcmp(entry->dst_addr, dst, ETH_ALEN) == 0) | |
243 | return entry; | |
244 | } | |
245 | ||
246 | return NULL; | |
247 | } | |
248 | ||
249 | ||
250 | /* Called only as a tasklet (software IRQ) */ | |
251 | static struct sk_buff * | |
d041674d | 252 | prism2_frag_cache_get(local_info_t *local, struct ieee80211_hdr_4addr *hdr) |
ff1d2767 JM |
253 | { |
254 | struct sk_buff *skb = NULL; | |
255 | u16 sc; | |
256 | unsigned int frag, seq; | |
257 | struct prism2_frag_entry *entry; | |
258 | ||
c0f72ca8 | 259 | sc = le16_to_cpu(hdr->seq_ctl); |
ff1d2767 | 260 | frag = WLAN_GET_SEQ_FRAG(sc); |
ebed67d2 | 261 | seq = WLAN_GET_SEQ_SEQ(sc) >> 4; |
ff1d2767 JM |
262 | |
263 | if (frag == 0) { | |
264 | /* Reserve enough space to fit maximum frame length */ | |
265 | skb = dev_alloc_skb(local->dev->mtu + | |
d041674d | 266 | sizeof(struct ieee80211_hdr_4addr) + |
ff1d2767 JM |
267 | 8 /* LLC */ + |
268 | 2 /* alignment */ + | |
269 | 8 /* WEP */ + ETH_ALEN /* WDS */); | |
270 | if (skb == NULL) | |
271 | return NULL; | |
272 | ||
273 | entry = &local->frag_cache[local->frag_next_idx]; | |
274 | local->frag_next_idx++; | |
275 | if (local->frag_next_idx >= PRISM2_FRAG_CACHE_LEN) | |
276 | local->frag_next_idx = 0; | |
277 | ||
278 | if (entry->skb != NULL) | |
279 | dev_kfree_skb(entry->skb); | |
280 | ||
281 | entry->first_frag_time = jiffies; | |
282 | entry->seq = seq; | |
283 | entry->last_frag = frag; | |
284 | entry->skb = skb; | |
285 | memcpy(entry->src_addr, hdr->addr2, ETH_ALEN); | |
286 | memcpy(entry->dst_addr, hdr->addr1, ETH_ALEN); | |
287 | } else { | |
288 | /* received a fragment of a frame for which the head fragment | |
289 | * should have already been received */ | |
290 | entry = prism2_frag_cache_find(local, seq, frag, hdr->addr2, | |
291 | hdr->addr1); | |
292 | if (entry != NULL) { | |
293 | entry->last_frag = frag; | |
294 | skb = entry->skb; | |
295 | } | |
296 | } | |
297 | ||
298 | return skb; | |
299 | } | |
300 | ||
301 | ||
302 | /* Called only as a tasklet (software IRQ) */ | |
303 | static int prism2_frag_cache_invalidate(local_info_t *local, | |
d041674d | 304 | struct ieee80211_hdr_4addr *hdr) |
ff1d2767 JM |
305 | { |
306 | u16 sc; | |
307 | unsigned int seq; | |
308 | struct prism2_frag_entry *entry; | |
309 | ||
c0f72ca8 | 310 | sc = le16_to_cpu(hdr->seq_ctl); |
ebed67d2 | 311 | seq = WLAN_GET_SEQ_SEQ(sc) >> 4; |
ff1d2767 JM |
312 | |
313 | entry = prism2_frag_cache_find(local, seq, -1, hdr->addr2, hdr->addr1); | |
314 | ||
315 | if (entry == NULL) { | |
316 | printk(KERN_DEBUG "%s: could not invalidate fragment cache " | |
317 | "entry (seq=%u)\n", | |
318 | local->dev->name, seq); | |
319 | return -1; | |
320 | } | |
321 | ||
322 | entry->skb = NULL; | |
323 | return 0; | |
324 | } | |
325 | ||
326 | ||
327 | static struct hostap_bss_info *__hostap_get_bss(local_info_t *local, u8 *bssid, | |
328 | u8 *ssid, size_t ssid_len) | |
329 | { | |
330 | struct list_head *ptr; | |
331 | struct hostap_bss_info *bss; | |
332 | ||
333 | list_for_each(ptr, &local->bss_list) { | |
334 | bss = list_entry(ptr, struct hostap_bss_info, list); | |
335 | if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0 && | |
336 | (ssid == NULL || | |
337 | (ssid_len == bss->ssid_len && | |
338 | memcmp(ssid, bss->ssid, ssid_len) == 0))) { | |
339 | list_move(&bss->list, &local->bss_list); | |
340 | return bss; | |
341 | } | |
342 | } | |
343 | ||
344 | return NULL; | |
345 | } | |
346 | ||
347 | ||
348 | static struct hostap_bss_info *__hostap_add_bss(local_info_t *local, u8 *bssid, | |
349 | u8 *ssid, size_t ssid_len) | |
350 | { | |
351 | struct hostap_bss_info *bss; | |
352 | ||
353 | if (local->num_bss_info >= HOSTAP_MAX_BSS_COUNT) { | |
354 | bss = list_entry(local->bss_list.prev, | |
355 | struct hostap_bss_info, list); | |
356 | list_del(&bss->list); | |
357 | local->num_bss_info--; | |
358 | } else { | |
359 | bss = (struct hostap_bss_info *) | |
360 | kmalloc(sizeof(*bss), GFP_ATOMIC); | |
361 | if (bss == NULL) | |
362 | return NULL; | |
363 | } | |
364 | ||
365 | memset(bss, 0, sizeof(*bss)); | |
366 | memcpy(bss->bssid, bssid, ETH_ALEN); | |
367 | memcpy(bss->ssid, ssid, ssid_len); | |
368 | bss->ssid_len = ssid_len; | |
369 | local->num_bss_info++; | |
370 | list_add(&bss->list, &local->bss_list); | |
371 | return bss; | |
372 | } | |
373 | ||
374 | ||
375 | static void __hostap_expire_bss(local_info_t *local) | |
376 | { | |
377 | struct hostap_bss_info *bss; | |
378 | ||
379 | while (local->num_bss_info > 0) { | |
380 | bss = list_entry(local->bss_list.prev, | |
381 | struct hostap_bss_info, list); | |
382 | if (!time_after(jiffies, bss->last_update + 60 * HZ)) | |
383 | break; | |
384 | ||
385 | list_del(&bss->list); | |
386 | local->num_bss_info--; | |
387 | kfree(bss); | |
388 | } | |
389 | } | |
390 | ||
391 | ||
392 | /* Both IEEE 802.11 Beacon and Probe Response frames have similar structure, so | |
393 | * the same routine can be used to parse both of them. */ | |
394 | static void hostap_rx_sta_beacon(local_info_t *local, struct sk_buff *skb, | |
395 | int stype) | |
396 | { | |
397 | struct hostap_ieee80211_mgmt *mgmt; | |
398 | int left, chan = 0; | |
399 | u8 *pos; | |
400 | u8 *ssid = NULL, *wpa = NULL, *rsn = NULL; | |
401 | size_t ssid_len = 0, wpa_len = 0, rsn_len = 0; | |
402 | struct hostap_bss_info *bss; | |
403 | ||
404 | if (skb->len < IEEE80211_MGMT_HDR_LEN + sizeof(mgmt->u.beacon)) | |
405 | return; | |
406 | ||
407 | mgmt = (struct hostap_ieee80211_mgmt *) skb->data; | |
408 | pos = mgmt->u.beacon.variable; | |
409 | left = skb->len - (pos - skb->data); | |
410 | ||
411 | while (left >= 2) { | |
412 | if (2 + pos[1] > left) | |
413 | return; /* parse failed */ | |
414 | switch (*pos) { | |
415 | case WLAN_EID_SSID: | |
416 | ssid = pos + 2; | |
417 | ssid_len = pos[1]; | |
418 | break; | |
419 | case WLAN_EID_GENERIC: | |
420 | if (pos[1] >= 4 && | |
421 | pos[2] == 0x00 && pos[3] == 0x50 && | |
422 | pos[4] == 0xf2 && pos[5] == 1) { | |
423 | wpa = pos; | |
424 | wpa_len = pos[1] + 2; | |
425 | } | |
426 | break; | |
427 | case WLAN_EID_RSN: | |
428 | rsn = pos; | |
429 | rsn_len = pos[1] + 2; | |
430 | break; | |
431 | case WLAN_EID_DS_PARAMS: | |
432 | if (pos[1] >= 1) | |
433 | chan = pos[2]; | |
434 | break; | |
435 | } | |
436 | left -= 2 + pos[1]; | |
437 | pos += 2 + pos[1]; | |
438 | } | |
439 | ||
440 | if (wpa_len > MAX_WPA_IE_LEN) | |
441 | wpa_len = MAX_WPA_IE_LEN; | |
442 | if (rsn_len > MAX_WPA_IE_LEN) | |
443 | rsn_len = MAX_WPA_IE_LEN; | |
444 | if (ssid_len > sizeof(bss->ssid)) | |
445 | ssid_len = sizeof(bss->ssid); | |
446 | ||
447 | spin_lock(&local->lock); | |
448 | bss = __hostap_get_bss(local, mgmt->bssid, ssid, ssid_len); | |
449 | if (bss == NULL) | |
450 | bss = __hostap_add_bss(local, mgmt->bssid, ssid, ssid_len); | |
451 | if (bss) { | |
452 | bss->last_update = jiffies; | |
453 | bss->count++; | |
454 | bss->capab_info = le16_to_cpu(mgmt->u.beacon.capab_info); | |
455 | if (wpa) { | |
456 | memcpy(bss->wpa_ie, wpa, wpa_len); | |
457 | bss->wpa_ie_len = wpa_len; | |
458 | } else | |
459 | bss->wpa_ie_len = 0; | |
460 | if (rsn) { | |
461 | memcpy(bss->rsn_ie, rsn, rsn_len); | |
462 | bss->rsn_ie_len = rsn_len; | |
463 | } else | |
464 | bss->rsn_ie_len = 0; | |
465 | bss->chan = chan; | |
466 | } | |
467 | __hostap_expire_bss(local); | |
468 | spin_unlock(&local->lock); | |
469 | } | |
470 | ||
471 | ||
858119e1 | 472 | static int |
ff1d2767 JM |
473 | hostap_rx_frame_mgmt(local_info_t *local, struct sk_buff *skb, |
474 | struct hostap_80211_rx_status *rx_stats, u16 type, | |
475 | u16 stype) | |
476 | { | |
477 | if (local->iw_mode == IW_MODE_MASTER) { | |
d041674d | 478 | hostap_update_sta_ps(local, (struct ieee80211_hdr_4addr *) |
ff1d2767 JM |
479 | skb->data); |
480 | } | |
481 | ||
4339d328 JM |
482 | if (local->hostapd && type == IEEE80211_FTYPE_MGMT) { |
483 | if (stype == IEEE80211_STYPE_BEACON && | |
ff1d2767 JM |
484 | local->iw_mode == IW_MODE_MASTER) { |
485 | struct sk_buff *skb2; | |
486 | /* Process beacon frames also in kernel driver to | |
487 | * update STA(AP) table statistics */ | |
488 | skb2 = skb_clone(skb, GFP_ATOMIC); | |
489 | if (skb2) | |
490 | hostap_rx(skb2->dev, skb2, rx_stats); | |
491 | } | |
492 | ||
493 | /* send management frames to the user space daemon for | |
494 | * processing */ | |
495 | local->apdevstats.rx_packets++; | |
496 | local->apdevstats.rx_bytes += skb->len; | |
497 | if (local->apdev == NULL) | |
498 | return -1; | |
499 | prism2_rx_80211(local->apdev, skb, rx_stats, PRISM2_RX_MGMT); | |
500 | return 0; | |
501 | } | |
502 | ||
503 | if (local->iw_mode == IW_MODE_MASTER) { | |
4339d328 JM |
504 | if (type != IEEE80211_FTYPE_MGMT && |
505 | type != IEEE80211_FTYPE_CTL) { | |
ff1d2767 JM |
506 | printk(KERN_DEBUG "%s: unknown management frame " |
507 | "(type=0x%02x, stype=0x%02x) dropped\n", | |
4339d328 | 508 | skb->dev->name, type >> 2, stype >> 4); |
ff1d2767 JM |
509 | return -1; |
510 | } | |
511 | ||
512 | hostap_rx(skb->dev, skb, rx_stats); | |
513 | return 0; | |
4339d328 JM |
514 | } else if (type == IEEE80211_FTYPE_MGMT && |
515 | (stype == IEEE80211_STYPE_BEACON || | |
516 | stype == IEEE80211_STYPE_PROBE_RESP)) { | |
ff1d2767 JM |
517 | hostap_rx_sta_beacon(local, skb, stype); |
518 | return -1; | |
4339d328 JM |
519 | } else if (type == IEEE80211_FTYPE_MGMT && |
520 | (stype == IEEE80211_STYPE_ASSOC_RESP || | |
521 | stype == IEEE80211_STYPE_REASSOC_RESP)) { | |
ff1d2767 JM |
522 | /* Ignore (Re)AssocResp silently since these are not currently |
523 | * needed but are still received when WPA/RSN mode is enabled. | |
524 | */ | |
525 | return -1; | |
526 | } else { | |
527 | printk(KERN_DEBUG "%s: hostap_rx_frame_mgmt: dropped unhandled" | |
528 | " management frame in non-Host AP mode (type=%d:%d)\n", | |
4339d328 | 529 | skb->dev->name, type >> 2, stype >> 4); |
ff1d2767 JM |
530 | return -1; |
531 | } | |
532 | } | |
533 | ||
534 | ||
535 | /* Called only as a tasklet (software IRQ) */ | |
858119e1 | 536 | static struct net_device *prism2_rx_get_wds(local_info_t *local, |
ff1d2767 JM |
537 | u8 *addr) |
538 | { | |
539 | struct hostap_interface *iface = NULL; | |
540 | struct list_head *ptr; | |
541 | ||
542 | read_lock_bh(&local->iface_lock); | |
543 | list_for_each(ptr, &local->hostap_interfaces) { | |
544 | iface = list_entry(ptr, struct hostap_interface, list); | |
545 | if (iface->type == HOSTAP_INTERFACE_WDS && | |
546 | memcmp(iface->u.wds.remote_addr, addr, ETH_ALEN) == 0) | |
547 | break; | |
548 | iface = NULL; | |
549 | } | |
550 | read_unlock_bh(&local->iface_lock); | |
551 | ||
552 | return iface ? iface->dev : NULL; | |
553 | } | |
554 | ||
555 | ||
858119e1 | 556 | static int |
d041674d | 557 | hostap_rx_frame_wds(local_info_t *local, struct ieee80211_hdr_4addr *hdr, |
ff1d2767 JM |
558 | u16 fc, struct net_device **wds) |
559 | { | |
0795af57 | 560 | DECLARE_MAC_BUF(mac); |
ff1d2767 JM |
561 | /* FIX: is this really supposed to accept WDS frames only in Master |
562 | * mode? What about Repeater or Managed with WDS frames? */ | |
b2f4a2e3 JM |
563 | if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) != |
564 | (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS) && | |
565 | (local->iw_mode != IW_MODE_MASTER || !(fc & IEEE80211_FCTL_TODS))) | |
ff1d2767 JM |
566 | return 0; /* not a WDS frame */ |
567 | ||
568 | /* Possible WDS frame: either IEEE 802.11 compliant (if FromDS) | |
569 | * or own non-standard frame with 4th address after payload */ | |
570 | if (memcmp(hdr->addr1, local->dev->dev_addr, ETH_ALEN) != 0 && | |
571 | (hdr->addr1[0] != 0xff || hdr->addr1[1] != 0xff || | |
572 | hdr->addr1[2] != 0xff || hdr->addr1[3] != 0xff || | |
573 | hdr->addr1[4] != 0xff || hdr->addr1[5] != 0xff)) { | |
574 | /* RA (or BSSID) is not ours - drop */ | |
15ea0ebc | 575 | PDEBUG(DEBUG_EXTRA2, "%s: received WDS frame with " |
0795af57 | 576 | "not own or broadcast %s=%s\n", |
b2f4a2e3 JM |
577 | local->dev->name, |
578 | fc & IEEE80211_FCTL_FROMDS ? "RA" : "BSSID", | |
0795af57 | 579 | print_mac(mac, hdr->addr1)); |
ff1d2767 JM |
580 | return -1; |
581 | } | |
582 | ||
583 | /* check if the frame came from a registered WDS connection */ | |
584 | *wds = prism2_rx_get_wds(local, hdr->addr2); | |
b2f4a2e3 | 585 | if (*wds == NULL && fc & IEEE80211_FCTL_FROMDS && |
ff1d2767 JM |
586 | (local->iw_mode != IW_MODE_INFRA || |
587 | !(local->wds_type & HOSTAP_WDS_AP_CLIENT) || | |
588 | memcmp(hdr->addr2, local->bssid, ETH_ALEN) != 0)) { | |
589 | /* require that WDS link has been registered with TA or the | |
590 | * frame is from current AP when using 'AP client mode' */ | |
591 | PDEBUG(DEBUG_EXTRA, "%s: received WDS[4 addr] frame " | |
0795af57 JP |
592 | "from unknown TA=%s\n", |
593 | local->dev->name, print_mac(mac, hdr->addr2)); | |
ff1d2767 JM |
594 | if (local->ap && local->ap->autom_ap_wds) |
595 | hostap_wds_link_oper(local, hdr->addr2, WDS_ADD); | |
596 | return -1; | |
597 | } | |
598 | ||
b2f4a2e3 | 599 | if (*wds && !(fc & IEEE80211_FCTL_FROMDS) && local->ap && |
ff1d2767 JM |
600 | hostap_is_sta_assoc(local->ap, hdr->addr2)) { |
601 | /* STA is actually associated with us even though it has a | |
602 | * registered WDS link. Assume it is in 'AP client' mode. | |
603 | * Since this is a 3-addr frame, assume it is not (bogus) WDS | |
604 | * frame and process it like any normal ToDS frame from | |
605 | * associated STA. */ | |
606 | *wds = NULL; | |
607 | } | |
608 | ||
609 | return 0; | |
610 | } | |
611 | ||
612 | ||
613 | static int hostap_is_eapol_frame(local_info_t *local, struct sk_buff *skb) | |
614 | { | |
615 | struct net_device *dev = local->dev; | |
616 | u16 fc, ethertype; | |
d041674d | 617 | struct ieee80211_hdr_4addr *hdr; |
ff1d2767 JM |
618 | u8 *pos; |
619 | ||
620 | if (skb->len < 24) | |
621 | return 0; | |
622 | ||
d041674d | 623 | hdr = (struct ieee80211_hdr_4addr *) skb->data; |
c0f72ca8 | 624 | fc = le16_to_cpu(hdr->frame_ctl); |
ff1d2767 JM |
625 | |
626 | /* check that the frame is unicast frame to us */ | |
b2f4a2e3 JM |
627 | if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == |
628 | IEEE80211_FCTL_TODS && | |
ff1d2767 JM |
629 | memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 && |
630 | memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) { | |
631 | /* ToDS frame with own addr BSSID and DA */ | |
b2f4a2e3 JM |
632 | } else if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == |
633 | IEEE80211_FCTL_FROMDS && | |
ff1d2767 JM |
634 | memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) { |
635 | /* FromDS frame with own addr as DA */ | |
636 | } else | |
637 | return 0; | |
638 | ||
639 | if (skb->len < 24 + 8) | |
640 | return 0; | |
641 | ||
642 | /* check for port access entity Ethernet type */ | |
643 | pos = skb->data + 24; | |
644 | ethertype = (pos[6] << 8) | pos[7]; | |
645 | if (ethertype == ETH_P_PAE) | |
646 | return 1; | |
647 | ||
648 | return 0; | |
649 | } | |
650 | ||
651 | ||
652 | /* Called only as a tasklet (software IRQ) */ | |
858119e1 | 653 | static int |
ff1d2767 | 654 | hostap_rx_frame_decrypt(local_info_t *local, struct sk_buff *skb, |
62fe7e37 | 655 | struct ieee80211_crypt_data *crypt) |
ff1d2767 | 656 | { |
d041674d | 657 | struct ieee80211_hdr_4addr *hdr; |
ff1d2767 JM |
658 | int res, hdrlen; |
659 | ||
660 | if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL) | |
661 | return 0; | |
662 | ||
d041674d | 663 | hdr = (struct ieee80211_hdr_4addr *) skb->data; |
c0f72ca8 | 664 | hdrlen = hostap_80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl)); |
ff1d2767 JM |
665 | |
666 | if (local->tkip_countermeasures && | |
667 | strcmp(crypt->ops->name, "TKIP") == 0) { | |
668 | if (net_ratelimit()) { | |
669 | printk(KERN_DEBUG "%s: TKIP countermeasures: dropped " | |
21f644f3 DM |
670 | "received packet from " MAC_FMT "\n", |
671 | local->dev->name, | |
672 | hdr->addr2[0], hdr->addr2[1], hdr->addr2[2], | |
673 | hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]); | |
ff1d2767 JM |
674 | } |
675 | return -1; | |
676 | } | |
677 | ||
678 | atomic_inc(&crypt->refcnt); | |
679 | res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv); | |
680 | atomic_dec(&crypt->refcnt); | |
681 | if (res < 0) { | |
21f644f3 | 682 | printk(KERN_DEBUG "%s: decryption failed (SA=" MAC_FMT |
ff1d2767 | 683 | ") res=%d\n", |
21f644f3 DM |
684 | local->dev->name, |
685 | hdr->addr2[0], hdr->addr2[1], hdr->addr2[2], | |
686 | hdr->addr2[3], hdr->addr2[4], hdr->addr2[5], | |
687 | res); | |
ff1d2767 JM |
688 | local->comm_tallies.rx_discards_wep_undecryptable++; |
689 | return -1; | |
690 | } | |
691 | ||
692 | return res; | |
693 | } | |
694 | ||
695 | ||
696 | /* Called only as a tasklet (software IRQ) */ | |
858119e1 | 697 | static int |
ff1d2767 | 698 | hostap_rx_frame_decrypt_msdu(local_info_t *local, struct sk_buff *skb, |
62fe7e37 | 699 | int keyidx, struct ieee80211_crypt_data *crypt) |
ff1d2767 | 700 | { |
d041674d | 701 | struct ieee80211_hdr_4addr *hdr; |
ff1d2767 | 702 | int res, hdrlen; |
0795af57 | 703 | DECLARE_MAC_BUF(mac); |
ff1d2767 JM |
704 | |
705 | if (crypt == NULL || crypt->ops->decrypt_msdu == NULL) | |
706 | return 0; | |
707 | ||
d041674d | 708 | hdr = (struct ieee80211_hdr_4addr *) skb->data; |
c0f72ca8 | 709 | hdrlen = hostap_80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl)); |
ff1d2767 JM |
710 | |
711 | atomic_inc(&crypt->refcnt); | |
712 | res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv); | |
713 | atomic_dec(&crypt->refcnt); | |
714 | if (res < 0) { | |
715 | printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed" | |
0795af57 JP |
716 | " (SA=%s keyidx=%d)\n", |
717 | local->dev->name, print_mac(mac, hdr->addr2), keyidx); | |
ff1d2767 JM |
718 | return -1; |
719 | } | |
720 | ||
721 | return 0; | |
722 | } | |
723 | ||
724 | ||
725 | /* All received frames are sent to this function. @skb contains the frame in | |
726 | * IEEE 802.11 format, i.e., in the format it was sent over air. | |
727 | * This function is called only as a tasklet (software IRQ). */ | |
728 | void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb, | |
729 | struct hostap_80211_rx_status *rx_stats) | |
730 | { | |
731 | struct hostap_interface *iface; | |
732 | local_info_t *local; | |
d041674d | 733 | struct ieee80211_hdr_4addr *hdr; |
ff1d2767 JM |
734 | size_t hdrlen; |
735 | u16 fc, type, stype, sc; | |
736 | struct net_device *wds = NULL; | |
737 | struct net_device_stats *stats; | |
738 | unsigned int frag; | |
739 | u8 *payload; | |
740 | struct sk_buff *skb2 = NULL; | |
741 | u16 ethertype; | |
742 | int frame_authorized = 0; | |
743 | int from_assoc_ap = 0; | |
744 | u8 dst[ETH_ALEN]; | |
745 | u8 src[ETH_ALEN]; | |
62fe7e37 | 746 | struct ieee80211_crypt_data *crypt = NULL; |
ff1d2767 JM |
747 | void *sta = NULL; |
748 | int keyidx = 0; | |
749 | ||
750 | iface = netdev_priv(dev); | |
751 | local = iface->local; | |
752 | iface->stats.rx_packets++; | |
753 | iface->stats.rx_bytes += skb->len; | |
754 | ||
755 | /* dev is the master radio device; change this to be the default | |
756 | * virtual interface (this may be changed to WDS device below) */ | |
757 | dev = local->ddev; | |
758 | iface = netdev_priv(dev); | |
759 | ||
d041674d | 760 | hdr = (struct ieee80211_hdr_4addr *) skb->data; |
ff1d2767 JM |
761 | stats = hostap_get_stats(dev); |
762 | ||
763 | if (skb->len < 10) | |
764 | goto rx_dropped; | |
765 | ||
c0f72ca8 | 766 | fc = le16_to_cpu(hdr->frame_ctl); |
4339d328 JM |
767 | type = WLAN_FC_GET_TYPE(fc); |
768 | stype = WLAN_FC_GET_STYPE(fc); | |
c0f72ca8 | 769 | sc = le16_to_cpu(hdr->seq_ctl); |
ff1d2767 JM |
770 | frag = WLAN_GET_SEQ_FRAG(sc); |
771 | hdrlen = hostap_80211_get_hdrlen(fc); | |
772 | ||
773 | /* Put this code here so that we avoid duplicating it in all | |
774 | * Rx paths. - Jean II */ | |
775 | #ifdef IW_WIRELESS_SPY /* defined in iw_handler.h */ | |
776 | /* If spy monitoring on */ | |
777 | if (iface->spy_data.spy_number > 0) { | |
778 | struct iw_quality wstats; | |
779 | wstats.level = rx_stats->signal; | |
780 | wstats.noise = rx_stats->noise; | |
c28df16e JT |
781 | wstats.updated = IW_QUAL_LEVEL_UPDATED | IW_QUAL_NOISE_UPDATED |
782 | | IW_QUAL_QUAL_INVALID | IW_QUAL_DBM; | |
ff1d2767 JM |
783 | /* Update spy records */ |
784 | wireless_spy_update(dev, hdr->addr2, &wstats); | |
785 | } | |
786 | #endif /* IW_WIRELESS_SPY */ | |
787 | hostap_update_rx_stats(local->ap, hdr, rx_stats); | |
788 | ||
789 | if (local->iw_mode == IW_MODE_MONITOR) { | |
790 | monitor_rx(dev, skb, rx_stats); | |
791 | return; | |
792 | } | |
793 | ||
794 | if (local->host_decrypt) { | |
795 | int idx = 0; | |
796 | if (skb->len >= hdrlen + 3) | |
797 | idx = skb->data[hdrlen + 3] >> 6; | |
798 | crypt = local->crypt[idx]; | |
799 | sta = NULL; | |
800 | ||
801 | /* Use station specific key to override default keys if the | |
802 | * receiver address is a unicast address ("individual RA"). If | |
803 | * bcrx_sta_key parameter is set, station specific key is used | |
804 | * even with broad/multicast targets (this is against IEEE | |
805 | * 802.11, but makes it easier to use different keys with | |
806 | * stations that do not support WEP key mapping). */ | |
807 | ||
808 | if (!(hdr->addr1[0] & 0x01) || local->bcrx_sta_key) | |
809 | (void) hostap_handle_sta_crypto(local, hdr, &crypt, | |
810 | &sta); | |
811 | ||
812 | /* allow NULL decrypt to indicate an station specific override | |
813 | * for default encryption */ | |
814 | if (crypt && (crypt->ops == NULL || | |
815 | crypt->ops->decrypt_mpdu == NULL)) | |
816 | crypt = NULL; | |
817 | ||
831a179f | 818 | if (!crypt && (fc & IEEE80211_FCTL_PROTECTED)) { |
ff1d2767 JM |
819 | #if 0 |
820 | /* This seems to be triggered by some (multicast?) | |
821 | * frames from other than current BSS, so just drop the | |
822 | * frames silently instead of filling system log with | |
823 | * these reports. */ | |
824 | printk(KERN_DEBUG "%s: WEP decryption failed (not set)" | |
21f644f3 DM |
825 | " (SA=" MAC_FMT ")\n", |
826 | local->dev->name, | |
827 | hdr->addr2[0], hdr->addr2[1], hdr->addr2[2], | |
828 | hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]); | |
ff1d2767 JM |
829 | #endif |
830 | local->comm_tallies.rx_discards_wep_undecryptable++; | |
831 | goto rx_dropped; | |
832 | } | |
833 | } | |
834 | ||
4339d328 JM |
835 | if (type != IEEE80211_FTYPE_DATA) { |
836 | if (type == IEEE80211_FTYPE_MGMT && | |
837 | stype == IEEE80211_STYPE_AUTH && | |
831a179f | 838 | fc & IEEE80211_FCTL_PROTECTED && local->host_decrypt && |
ff1d2767 JM |
839 | (keyidx = hostap_rx_frame_decrypt(local, skb, crypt)) < 0) |
840 | { | |
841 | printk(KERN_DEBUG "%s: failed to decrypt mgmt::auth " | |
21f644f3 DM |
842 | "from " MAC_FMT "\n", dev->name, |
843 | hdr->addr2[0], hdr->addr2[1], hdr->addr2[2], | |
844 | hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]); | |
ff1d2767 JM |
845 | /* TODO: could inform hostapd about this so that it |
846 | * could send auth failure report */ | |
847 | goto rx_dropped; | |
848 | } | |
849 | ||
850 | if (hostap_rx_frame_mgmt(local, skb, rx_stats, type, stype)) | |
851 | goto rx_dropped; | |
852 | else | |
853 | goto rx_exit; | |
854 | } | |
855 | ||
856 | /* Data frame - extract src/dst addresses */ | |
857 | if (skb->len < IEEE80211_DATA_HDR3_LEN) | |
858 | goto rx_dropped; | |
859 | ||
b2f4a2e3 JM |
860 | switch (fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) { |
861 | case IEEE80211_FCTL_FROMDS: | |
ff1d2767 JM |
862 | memcpy(dst, hdr->addr1, ETH_ALEN); |
863 | memcpy(src, hdr->addr3, ETH_ALEN); | |
864 | break; | |
b2f4a2e3 | 865 | case IEEE80211_FCTL_TODS: |
ff1d2767 JM |
866 | memcpy(dst, hdr->addr3, ETH_ALEN); |
867 | memcpy(src, hdr->addr2, ETH_ALEN); | |
868 | break; | |
b2f4a2e3 | 869 | case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS: |
ff1d2767 JM |
870 | if (skb->len < IEEE80211_DATA_HDR4_LEN) |
871 | goto rx_dropped; | |
872 | memcpy(dst, hdr->addr3, ETH_ALEN); | |
873 | memcpy(src, hdr->addr4, ETH_ALEN); | |
874 | break; | |
875 | case 0: | |
876 | memcpy(dst, hdr->addr1, ETH_ALEN); | |
877 | memcpy(src, hdr->addr2, ETH_ALEN); | |
878 | break; | |
879 | } | |
880 | ||
881 | if (hostap_rx_frame_wds(local, hdr, fc, &wds)) | |
882 | goto rx_dropped; | |
883 | if (wds) { | |
884 | skb->dev = dev = wds; | |
885 | stats = hostap_get_stats(dev); | |
886 | } | |
887 | ||
888 | if (local->iw_mode == IW_MODE_MASTER && !wds && | |
b2f4a2e3 JM |
889 | (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == |
890 | IEEE80211_FCTL_FROMDS && | |
ff1d2767 JM |
891 | local->stadev && |
892 | memcmp(hdr->addr2, local->assoc_ap_addr, ETH_ALEN) == 0) { | |
893 | /* Frame from BSSID of the AP for which we are a client */ | |
894 | skb->dev = dev = local->stadev; | |
895 | stats = hostap_get_stats(dev); | |
896 | from_assoc_ap = 1; | |
897 | } | |
898 | ||
899 | dev->last_rx = jiffies; | |
900 | ||
901 | if ((local->iw_mode == IW_MODE_MASTER || | |
902 | local->iw_mode == IW_MODE_REPEAT) && | |
903 | !from_assoc_ap) { | |
904 | switch (hostap_handle_sta_rx(local, dev, skb, rx_stats, | |
905 | wds != NULL)) { | |
906 | case AP_RX_CONTINUE_NOT_AUTHORIZED: | |
907 | frame_authorized = 0; | |
908 | break; | |
909 | case AP_RX_CONTINUE: | |
910 | frame_authorized = 1; | |
911 | break; | |
912 | case AP_RX_DROP: | |
913 | goto rx_dropped; | |
914 | case AP_RX_EXIT: | |
915 | goto rx_exit; | |
916 | } | |
917 | } | |
918 | ||
919 | /* Nullfunc frames may have PS-bit set, so they must be passed to | |
920 | * hostap_handle_sta_rx() before being dropped here. */ | |
4339d328 JM |
921 | if (stype != IEEE80211_STYPE_DATA && |
922 | stype != IEEE80211_STYPE_DATA_CFACK && | |
923 | stype != IEEE80211_STYPE_DATA_CFPOLL && | |
924 | stype != IEEE80211_STYPE_DATA_CFACKPOLL) { | |
925 | if (stype != IEEE80211_STYPE_NULLFUNC) | |
ff1d2767 JM |
926 | printk(KERN_DEBUG "%s: RX: dropped data frame " |
927 | "with no data (type=0x%02x, subtype=0x%02x)\n", | |
4339d328 | 928 | dev->name, type >> 2, stype >> 4); |
ff1d2767 JM |
929 | goto rx_dropped; |
930 | } | |
931 | ||
932 | /* skb: hdr + (possibly fragmented, possibly encrypted) payload */ | |
933 | ||
831a179f | 934 | if (local->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) && |
ff1d2767 JM |
935 | (keyidx = hostap_rx_frame_decrypt(local, skb, crypt)) < 0) |
936 | goto rx_dropped; | |
d041674d | 937 | hdr = (struct ieee80211_hdr_4addr *) skb->data; |
ff1d2767 JM |
938 | |
939 | /* skb: hdr + (possibly fragmented) plaintext payload */ | |
940 | ||
831a179f | 941 | if (local->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) && |
b2f4a2e3 | 942 | (frag != 0 || (fc & IEEE80211_FCTL_MOREFRAGS))) { |
ff1d2767 JM |
943 | int flen; |
944 | struct sk_buff *frag_skb = | |
945 | prism2_frag_cache_get(local, hdr); | |
946 | if (!frag_skb) { | |
947 | printk(KERN_DEBUG "%s: Rx cannot get skb from " | |
948 | "fragment cache (morefrag=%d seq=%u frag=%u)\n", | |
b2f4a2e3 | 949 | dev->name, (fc & IEEE80211_FCTL_MOREFRAGS) != 0, |
ebed67d2 | 950 | WLAN_GET_SEQ_SEQ(sc) >> 4, frag); |
ff1d2767 JM |
951 | goto rx_dropped; |
952 | } | |
953 | ||
954 | flen = skb->len; | |
955 | if (frag != 0) | |
956 | flen -= hdrlen; | |
957 | ||
4305b541 | 958 | if (frag_skb->tail + flen > frag_skb->end) { |
ff1d2767 JM |
959 | printk(KERN_WARNING "%s: host decrypted and " |
960 | "reassembled frame did not fit skb\n", | |
961 | dev->name); | |
962 | prism2_frag_cache_invalidate(local, hdr); | |
963 | goto rx_dropped; | |
964 | } | |
965 | ||
966 | if (frag == 0) { | |
967 | /* copy first fragment (including full headers) into | |
968 | * beginning of the fragment cache skb */ | |
d626f62b ACM |
969 | skb_copy_from_linear_data(skb, skb_put(frag_skb, flen), |
970 | flen); | |
ff1d2767 JM |
971 | } else { |
972 | /* append frame payload to the end of the fragment | |
973 | * cache skb */ | |
d626f62b ACM |
974 | skb_copy_from_linear_data_offset(skb, hdrlen, |
975 | skb_put(frag_skb, | |
976 | flen), flen); | |
ff1d2767 JM |
977 | } |
978 | dev_kfree_skb(skb); | |
979 | skb = NULL; | |
980 | ||
b2f4a2e3 | 981 | if (fc & IEEE80211_FCTL_MOREFRAGS) { |
ff1d2767 JM |
982 | /* more fragments expected - leave the skb in fragment |
983 | * cache for now; it will be delivered to upper layers | |
984 | * after all fragments have been received */ | |
985 | goto rx_exit; | |
986 | } | |
987 | ||
988 | /* this was the last fragment and the frame will be | |
989 | * delivered, so remove skb from fragment cache */ | |
990 | skb = frag_skb; | |
d041674d | 991 | hdr = (struct ieee80211_hdr_4addr *) skb->data; |
ff1d2767 JM |
992 | prism2_frag_cache_invalidate(local, hdr); |
993 | } | |
994 | ||
995 | /* skb: hdr + (possible reassembled) full MSDU payload; possibly still | |
996 | * encrypted/authenticated */ | |
997 | ||
831a179f | 998 | if (local->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) && |
ff1d2767 JM |
999 | hostap_rx_frame_decrypt_msdu(local, skb, keyidx, crypt)) |
1000 | goto rx_dropped; | |
1001 | ||
d041674d | 1002 | hdr = (struct ieee80211_hdr_4addr *) skb->data; |
831a179f | 1003 | if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !local->open_wep) { |
ff1d2767 JM |
1004 | if (local->ieee_802_1x && |
1005 | hostap_is_eapol_frame(local, skb)) { | |
1006 | /* pass unencrypted EAPOL frames even if encryption is | |
1007 | * configured */ | |
1008 | PDEBUG(DEBUG_EXTRA2, "%s: RX: IEEE 802.1X - passing " | |
1009 | "unencrypted EAPOL frame\n", local->dev->name); | |
1010 | } else { | |
1011 | printk(KERN_DEBUG "%s: encryption configured, but RX " | |
21f644f3 DM |
1012 | "frame not encrypted (SA=" MAC_FMT ")\n", |
1013 | local->dev->name, | |
1014 | hdr->addr2[0], hdr->addr2[1], hdr->addr2[2], | |
1015 | hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]); | |
ff1d2767 JM |
1016 | goto rx_dropped; |
1017 | } | |
1018 | } | |
1019 | ||
831a179f | 1020 | if (local->drop_unencrypted && !(fc & IEEE80211_FCTL_PROTECTED) && |
ff1d2767 JM |
1021 | !hostap_is_eapol_frame(local, skb)) { |
1022 | if (net_ratelimit()) { | |
1023 | printk(KERN_DEBUG "%s: dropped unencrypted RX data " | |
21f644f3 DM |
1024 | "frame from " MAC_FMT " (drop_unencrypted=1)\n", |
1025 | dev->name, | |
1026 | hdr->addr2[0], hdr->addr2[1], hdr->addr2[2], | |
1027 | hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]); | |
ff1d2767 JM |
1028 | } |
1029 | goto rx_dropped; | |
1030 | } | |
1031 | ||
1032 | /* skb: hdr + (possible reassembled) full plaintext payload */ | |
1033 | ||
1034 | payload = skb->data + hdrlen; | |
1035 | ethertype = (payload[6] << 8) | payload[7]; | |
1036 | ||
1037 | /* If IEEE 802.1X is used, check whether the port is authorized to send | |
1038 | * the received frame. */ | |
1039 | if (local->ieee_802_1x && local->iw_mode == IW_MODE_MASTER) { | |
1040 | if (ethertype == ETH_P_PAE) { | |
1041 | PDEBUG(DEBUG_EXTRA2, "%s: RX: IEEE 802.1X frame\n", | |
1042 | dev->name); | |
1043 | if (local->hostapd && local->apdev) { | |
1044 | /* Send IEEE 802.1X frames to the user | |
1045 | * space daemon for processing */ | |
1046 | prism2_rx_80211(local->apdev, skb, rx_stats, | |
1047 | PRISM2_RX_MGMT); | |
1048 | local->apdevstats.rx_packets++; | |
1049 | local->apdevstats.rx_bytes += skb->len; | |
1050 | goto rx_exit; | |
1051 | } | |
1052 | } else if (!frame_authorized) { | |
1053 | printk(KERN_DEBUG "%s: dropped frame from " | |
1054 | "unauthorized port (IEEE 802.1X): " | |
1055 | "ethertype=0x%04x\n", | |
1056 | dev->name, ethertype); | |
1057 | goto rx_dropped; | |
1058 | } | |
1059 | } | |
1060 | ||
1061 | /* convert hdr + possible LLC headers into Ethernet header */ | |
1062 | if (skb->len - hdrlen >= 8 && | |
1063 | ((memcmp(payload, rfc1042_header, 6) == 0 && | |
1064 | ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) || | |
1065 | memcmp(payload, bridge_tunnel_header, 6) == 0)) { | |
1066 | /* remove RFC1042 or Bridge-Tunnel encapsulation and | |
1067 | * replace EtherType */ | |
1068 | skb_pull(skb, hdrlen + 6); | |
1069 | memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN); | |
1070 | memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN); | |
1071 | } else { | |
8a9faf3c | 1072 | __be16 len; |
ff1d2767 JM |
1073 | /* Leave Ethernet header part of hdr and full payload */ |
1074 | skb_pull(skb, hdrlen); | |
1075 | len = htons(skb->len); | |
1076 | memcpy(skb_push(skb, 2), &len, 2); | |
1077 | memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN); | |
1078 | memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN); | |
1079 | } | |
1080 | ||
b2f4a2e3 JM |
1081 | if (wds && ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == |
1082 | IEEE80211_FCTL_TODS) && | |
ff1d2767 JM |
1083 | skb->len >= ETH_HLEN + ETH_ALEN) { |
1084 | /* Non-standard frame: get addr4 from its bogus location after | |
1085 | * the payload */ | |
d626f62b ACM |
1086 | skb_copy_from_linear_data_offset(skb, skb->len - ETH_ALEN, |
1087 | skb->data + ETH_ALEN, | |
1088 | ETH_ALEN); | |
ff1d2767 JM |
1089 | skb_trim(skb, skb->len - ETH_ALEN); |
1090 | } | |
1091 | ||
1092 | stats->rx_packets++; | |
1093 | stats->rx_bytes += skb->len; | |
1094 | ||
1095 | if (local->iw_mode == IW_MODE_MASTER && !wds && | |
1096 | local->ap->bridge_packets) { | |
1097 | if (dst[0] & 0x01) { | |
1098 | /* copy multicast frame both to the higher layers and | |
1099 | * to the wireless media */ | |
1100 | local->ap->bridged_multicast++; | |
1101 | skb2 = skb_clone(skb, GFP_ATOMIC); | |
1102 | if (skb2 == NULL) | |
1103 | printk(KERN_DEBUG "%s: skb_clone failed for " | |
1104 | "multicast frame\n", dev->name); | |
1105 | } else if (hostap_is_sta_authorized(local->ap, dst)) { | |
1106 | /* send frame directly to the associated STA using | |
1107 | * wireless media and not passing to higher layers */ | |
1108 | local->ap->bridged_unicast++; | |
1109 | skb2 = skb; | |
1110 | skb = NULL; | |
1111 | } | |
1112 | } | |
1113 | ||
1114 | if (skb2 != NULL) { | |
1115 | /* send to wireless media */ | |
459a98ed | 1116 | skb2->dev = dev; |
ff1d2767 | 1117 | skb2->protocol = __constant_htons(ETH_P_802_3); |
459a98ed | 1118 | skb_reset_mac_header(skb2); |
c1d2bbe1 | 1119 | skb_reset_network_header(skb2); |
b0e380b1 | 1120 | /* skb2->network_header += ETH_HLEN; */ |
ff1d2767 JM |
1121 | dev_queue_xmit(skb2); |
1122 | } | |
1123 | ||
1124 | if (skb) { | |
1125 | skb->protocol = eth_type_trans(skb, dev); | |
1126 | memset(skb->cb, 0, sizeof(skb->cb)); | |
ff1d2767 JM |
1127 | netif_rx(skb); |
1128 | } | |
1129 | ||
1130 | rx_exit: | |
1131 | if (sta) | |
1132 | hostap_handle_sta_release(sta); | |
1133 | return; | |
1134 | ||
1135 | rx_dropped: | |
1136 | dev_kfree_skb(skb); | |
1137 | ||
1138 | stats->rx_dropped++; | |
1139 | goto rx_exit; | |
1140 | } | |
1141 | ||
1142 | ||
1143 | EXPORT_SYMBOL(hostap_80211_rx); |