1 /* 2 * Copyright 2002-2005, Instant802 Networks, Inc. 3 * Copyright 2005-2006, Devicescape Software, Inc. 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12 #include <linux/kernel.h> 13 #include <linux/skbuff.h> 14 #include <linux/netdevice.h> 15 #include <linux/etherdevice.h> 16 #include <linux/rcupdate.h> 17 #include <net/mac80211.h> 18 #include <net/ieee80211_radiotap.h> 19 20 #include "ieee80211_i.h" 21 #include "ieee80211_led.h" 22 #include "wep.h" 23 #include "wpa.h" 24 #include "tkip.h" 25 #include "wme.h" 26 27 /* 28 * monitor mode reception 29 * 30 * This function cleans up the SKB, i.e. it removes all the stuff 31 * only useful for monitoring. 32 */ 33 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local, 34 struct sk_buff *skb, 35 int rtap_len) 36 { 37 skb_pull(skb, rtap_len); 38 39 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) { 40 if (likely(skb->len > FCS_LEN)) 41 skb_trim(skb, skb->len - FCS_LEN); 42 else { 43 /* driver bug */ 44 WARN_ON(1); 45 dev_kfree_skb(skb); 46 skb = NULL; 47 } 48 } 49 50 return skb; 51 } 52 53 static inline int should_drop_frame(struct ieee80211_rx_status *status, 54 struct sk_buff *skb, 55 int present_fcs_len, 56 int radiotap_len) 57 { 58 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 59 60 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC)) 61 return 1; 62 if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len)) 63 return 1; 64 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FTYPE)) == 65 cpu_to_le16(IEEE80211_FTYPE_CTL)) 66 return 1; 67 return 0; 68 } 69 70 /* 71 * This function copies a received frame to all monitor interfaces and 72 * returns a cleaned-up SKB that no longer includes the FCS nor the 73 * radiotap header the driver might have added. 74 */ 75 static struct sk_buff * 76 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, 77 struct ieee80211_rx_status *status) 78 { 79 struct ieee80211_sub_if_data *sdata; 80 struct ieee80211_rate *rate; 81 int needed_headroom = 0; 82 struct ieee80211_rtap_hdr { 83 struct ieee80211_radiotap_header hdr; 84 u8 flags; 85 u8 rate; 86 __le16 chan_freq; 87 __le16 chan_flags; 88 u8 antsignal; 89 u8 padding_for_rxflags; 90 __le16 rx_flags; 91 } __attribute__ ((packed)) *rthdr; 92 struct sk_buff *skb, *skb2; 93 struct net_device *prev_dev = NULL; 94 int present_fcs_len = 0; 95 int rtap_len = 0; 96 97 /* 98 * First, we may need to make a copy of the skb because 99 * (1) we need to modify it for radiotap (if not present), and 100 * (2) the other RX handlers will modify the skb we got. 101 * 102 * We don't need to, of course, if we aren't going to return 103 * the SKB because it has a bad FCS/PLCP checksum. 104 */ 105 if (status->flag & RX_FLAG_RADIOTAP) 106 rtap_len = ieee80211_get_radiotap_len(origskb->data); 107 else 108 needed_headroom = sizeof(*rthdr); 109 110 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) 111 present_fcs_len = FCS_LEN; 112 113 if (!local->monitors) { 114 if (should_drop_frame(status, origskb, present_fcs_len, 115 rtap_len)) { 116 dev_kfree_skb(origskb); 117 return NULL; 118 } 119 120 return remove_monitor_info(local, origskb, rtap_len); 121 } 122 123 if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) { 124 /* only need to expand headroom if necessary */ 125 skb = origskb; 126 origskb = NULL; 127 128 /* 129 * This shouldn't trigger often because most devices have an 130 * RX header they pull before we get here, and that should 131 * be big enough for our radiotap information. We should 132 * probably export the length to drivers so that we can have 133 * them allocate enough headroom to start with. 134 */ 135 if (skb_headroom(skb) < needed_headroom && 136 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC)) { 137 dev_kfree_skb(skb); 138 return NULL; 139 } 140 } else { 141 /* 142 * Need to make a copy and possibly remove radiotap header 143 * and FCS from the original. 144 */ 145 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC); 146 147 origskb = remove_monitor_info(local, origskb, rtap_len); 148 149 if (!skb) 150 return origskb; 151 } 152 153 /* if necessary, prepend radiotap information */ 154 if (!(status->flag & RX_FLAG_RADIOTAP)) { 155 rthdr = (void *) skb_push(skb, sizeof(*rthdr)); 156 memset(rthdr, 0, sizeof(*rthdr)); 157 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr)); 158 rthdr->hdr.it_present = 159 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) | 160 (1 << IEEE80211_RADIOTAP_RATE) | 161 (1 << IEEE80211_RADIOTAP_CHANNEL) | 162 (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL) | 163 (1 << IEEE80211_RADIOTAP_RX_FLAGS)); 164 rthdr->flags = local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS ? 165 IEEE80211_RADIOTAP_F_FCS : 0; 166 167 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */ 168 rthdr->rx_flags = 0; 169 if (status->flag & 170 (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC)) 171 rthdr->rx_flags |= 172 cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS); 173 174 rate = ieee80211_get_rate(local, status->phymode, 175 status->rate); 176 if (rate) 177 rthdr->rate = rate->rate / 5; 178 179 rthdr->chan_freq = cpu_to_le16(status->freq); 180 181 if (status->phymode == MODE_IEEE80211A) 182 rthdr->chan_flags = 183 cpu_to_le16(IEEE80211_CHAN_OFDM | 184 IEEE80211_CHAN_5GHZ); 185 else 186 rthdr->chan_flags = 187 cpu_to_le16(IEEE80211_CHAN_DYN | 188 IEEE80211_CHAN_2GHZ); 189 190 rthdr->antsignal = status->ssi; 191 } 192 193 skb_set_mac_header(skb, 0); 194 skb->ip_summed = CHECKSUM_UNNECESSARY; 195 skb->pkt_type = PACKET_OTHERHOST; 196 skb->protocol = htons(ETH_P_802_2); 197 198 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 199 if (!netif_running(sdata->dev)) 200 continue; 201 202 if (sdata->type != IEEE80211_IF_TYPE_MNTR) 203 continue; 204 205 if (prev_dev) { 206 skb2 = skb_clone(skb, GFP_ATOMIC); 207 if (skb2) { 208 skb2->dev = prev_dev; 209 netif_rx(skb2); 210 } 211 } 212 213 prev_dev = sdata->dev; 214 sdata->dev->stats.rx_packets++; 215 sdata->dev->stats.rx_bytes += skb->len; 216 } 217 218 if (prev_dev) { 219 skb->dev = prev_dev; 220 netif_rx(skb); 221 } else 222 dev_kfree_skb(skb); 223 224 return origskb; 225 } 226 227 228 /* pre-rx handlers 229 * 230 * these don't have dev/sdata fields in the rx data 231 * The sta value should also not be used because it may 232 * be NULL even though a STA (in IBSS mode) will be added. 233 */ 234 235 static ieee80211_txrx_result 236 ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data *rx) 237 { 238 u8 *data = rx->skb->data; 239 int tid; 240 241 /* does the frame have a qos control field? */ 242 if (WLAN_FC_IS_QOS_DATA(rx->fc)) { 243 u8 *qc = data + ieee80211_get_hdrlen(rx->fc) - QOS_CONTROL_LEN; 244 /* frame has qos control */ 245 tid = qc[0] & QOS_CONTROL_TID_MASK; 246 } else { 247 if (unlikely((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)) { 248 /* Separate TID for management frames */ 249 tid = NUM_RX_DATA_QUEUES - 1; 250 } else { 251 /* no qos control present */ 252 tid = 0; /* 802.1d - Best Effort */ 253 } 254 } 255 256 I802_DEBUG_INC(rx->local->wme_rx_queue[tid]); 257 /* only a debug counter, sta might not be assigned properly yet */ 258 if (rx->sta) 259 I802_DEBUG_INC(rx->sta->wme_rx_queue[tid]); 260 261 rx->u.rx.queue = tid; 262 /* Set skb->priority to 1d tag if highest order bit of TID is not set. 263 * For now, set skb->priority to 0 for other cases. */ 264 rx->skb->priority = (tid > 7) ? 0 : tid; 265 266 return TXRX_CONTINUE; 267 } 268 269 static ieee80211_txrx_result 270 ieee80211_rx_h_load_stats(struct ieee80211_txrx_data *rx) 271 { 272 struct ieee80211_local *local = rx->local; 273 struct sk_buff *skb = rx->skb; 274 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 275 u32 load = 0, hdrtime; 276 struct ieee80211_rate *rate; 277 struct ieee80211_hw_mode *mode = local->hw.conf.mode; 278 int i; 279 280 /* Estimate total channel use caused by this frame */ 281 282 if (unlikely(mode->num_rates < 0)) 283 return TXRX_CONTINUE; 284 285 rate = &mode->rates[0]; 286 for (i = 0; i < mode->num_rates; i++) { 287 if (mode->rates[i].val == rx->u.rx.status->rate) { 288 rate = &mode->rates[i]; 289 break; 290 } 291 } 292 293 /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values, 294 * 1 usec = 1/8 * (1080 / 10) = 13.5 */ 295 296 if (mode->mode == MODE_IEEE80211A || 297 (mode->mode == MODE_IEEE80211G && 298 rate->flags & IEEE80211_RATE_ERP)) 299 hdrtime = CHAN_UTIL_HDR_SHORT; 300 else 301 hdrtime = CHAN_UTIL_HDR_LONG; 302 303 load = hdrtime; 304 if (!is_multicast_ether_addr(hdr->addr1)) 305 load += hdrtime; 306 307 load += skb->len * rate->rate_inv; 308 309 /* Divide channel_use by 8 to avoid wrapping around the counter */ 310 load >>= CHAN_UTIL_SHIFT; 311 local->channel_use_raw += load; 312 rx->u.rx.load = load; 313 314 return TXRX_CONTINUE; 315 } 316 317 ieee80211_rx_handler ieee80211_rx_pre_handlers[] = 318 { 319 ieee80211_rx_h_parse_qos, 320 ieee80211_rx_h_load_stats, 321 NULL 322 }; 323 324 /* rx handlers */ 325 326 static ieee80211_txrx_result 327 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data *rx) 328 { 329 if (rx->sta) 330 rx->sta->channel_use_raw += rx->u.rx.load; 331 rx->sdata->channel_use_raw += rx->u.rx.load; 332 return TXRX_CONTINUE; 333 } 334 335 static ieee80211_txrx_result 336 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx) 337 { 338 struct ieee80211_local *local = rx->local; 339 struct sk_buff *skb = rx->skb; 340 341 if (unlikely(local->sta_scanning != 0)) { 342 ieee80211_sta_rx_scan(rx->dev, skb, rx->u.rx.status); 343 return TXRX_QUEUED; 344 } 345 346 if (unlikely(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) { 347 /* scanning finished during invoking of handlers */ 348 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan); 349 return TXRX_DROP; 350 } 351 352 return TXRX_CONTINUE; 353 } 354 355 static ieee80211_txrx_result 356 ieee80211_rx_h_check(struct ieee80211_txrx_data *rx) 357 { 358 struct ieee80211_hdr *hdr; 359 hdr = (struct ieee80211_hdr *) rx->skb->data; 360 361 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */ 362 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) { 363 if (unlikely(rx->fc & IEEE80211_FCTL_RETRY && 364 rx->sta->last_seq_ctrl[rx->u.rx.queue] == 365 hdr->seq_ctrl)) { 366 if (rx->flags & IEEE80211_TXRXD_RXRA_MATCH) { 367 rx->local->dot11FrameDuplicateCount++; 368 rx->sta->num_duplicates++; 369 } 370 return TXRX_DROP; 371 } else 372 rx->sta->last_seq_ctrl[rx->u.rx.queue] = hdr->seq_ctrl; 373 } 374 375 if (unlikely(rx->skb->len < 16)) { 376 I802_DEBUG_INC(rx->local->rx_handlers_drop_short); 377 return TXRX_DROP; 378 } 379 380 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) 381 rx->skb->pkt_type = PACKET_OTHERHOST; 382 else if (compare_ether_addr(rx->dev->dev_addr, hdr->addr1) == 0) 383 rx->skb->pkt_type = PACKET_HOST; 384 else if (is_multicast_ether_addr(hdr->addr1)) { 385 if (is_broadcast_ether_addr(hdr->addr1)) 386 rx->skb->pkt_type = PACKET_BROADCAST; 387 else 388 rx->skb->pkt_type = PACKET_MULTICAST; 389 } else 390 rx->skb->pkt_type = PACKET_OTHERHOST; 391 392 /* Drop disallowed frame classes based on STA auth/assoc state; 393 * IEEE 802.11, Chap 5.5. 394 * 395 * 80211.o does filtering only based on association state, i.e., it 396 * drops Class 3 frames from not associated stations. hostapd sends 397 * deauth/disassoc frames when needed. In addition, hostapd is 398 * responsible for filtering on both auth and assoc states. 399 */ 400 if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA || 401 ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL && 402 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) && 403 rx->sdata->type != IEEE80211_IF_TYPE_IBSS && 404 (!rx->sta || !(rx->sta->flags & WLAN_STA_ASSOC)))) { 405 if ((!(rx->fc & IEEE80211_FCTL_FROMDS) && 406 !(rx->fc & IEEE80211_FCTL_TODS) && 407 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) 408 || !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) { 409 /* Drop IBSS frames and frames for other hosts 410 * silently. */ 411 return TXRX_DROP; 412 } 413 414 return TXRX_DROP; 415 } 416 417 return TXRX_CONTINUE; 418 } 419 420 421 static ieee80211_txrx_result 422 ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx) 423 { 424 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data; 425 int keyidx; 426 int hdrlen; 427 ieee80211_txrx_result result = TXRX_DROP; 428 struct ieee80211_key *stakey = NULL; 429 430 /* 431 * Key selection 101 432 * 433 * There are three types of keys: 434 * - GTK (group keys) 435 * - PTK (pairwise keys) 436 * - STK (station-to-station pairwise keys) 437 * 438 * When selecting a key, we have to distinguish between multicast 439 * (including broadcast) and unicast frames, the latter can only 440 * use PTKs and STKs while the former always use GTKs. Unless, of 441 * course, actual WEP keys ("pre-RSNA") are used, then unicast 442 * frames can also use key indizes like GTKs. Hence, if we don't 443 * have a PTK/STK we check the key index for a WEP key. 444 * 445 * Note that in a regular BSS, multicast frames are sent by the 446 * AP only, associated stations unicast the frame to the AP first 447 * which then multicasts it on their behalf. 448 * 449 * There is also a slight problem in IBSS mode: GTKs are negotiated 450 * with each station, that is something we don't currently handle. 451 * The spec seems to expect that one negotiates the same key with 452 * every station but there's no such requirement; VLANs could be 453 * possible. 454 */ 455 456 if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) 457 return TXRX_CONTINUE; 458 459 /* 460 * No point in finding a key and decrypting if the frame is neither 461 * addressed to us nor a multicast frame. 462 */ 463 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) 464 return TXRX_CONTINUE; 465 466 if (rx->sta) 467 stakey = rcu_dereference(rx->sta->key); 468 469 if (!is_multicast_ether_addr(hdr->addr1) && stakey) { 470 rx->key = stakey; 471 } else { 472 /* 473 * The device doesn't give us the IV so we won't be 474 * able to look up the key. That's ok though, we 475 * don't need to decrypt the frame, we just won't 476 * be able to keep statistics accurate. 477 * Except for key threshold notifications, should 478 * we somehow allow the driver to tell us which key 479 * the hardware used if this flag is set? 480 */ 481 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) && 482 (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED)) 483 return TXRX_CONTINUE; 484 485 hdrlen = ieee80211_get_hdrlen(rx->fc); 486 487 if (rx->skb->len < 8 + hdrlen) 488 return TXRX_DROP; /* TODO: count this? */ 489 490 /* 491 * no need to call ieee80211_wep_get_keyidx, 492 * it verifies a bunch of things we've done already 493 */ 494 keyidx = rx->skb->data[hdrlen + 3] >> 6; 495 496 rx->key = rcu_dereference(rx->sdata->keys[keyidx]); 497 498 /* 499 * RSNA-protected unicast frames should always be sent with 500 * pairwise or station-to-station keys, but for WEP we allow 501 * using a key index as well. 502 */ 503 if (rx->key && rx->key->conf.alg != ALG_WEP && 504 !is_multicast_ether_addr(hdr->addr1)) 505 rx->key = NULL; 506 } 507 508 if (rx->key) { 509 rx->key->tx_rx_count++; 510 /* TODO: add threshold stuff again */ 511 } else { 512 if (net_ratelimit()) 513 printk(KERN_DEBUG "%s: RX protected frame," 514 " but have no key\n", rx->dev->name); 515 return TXRX_DROP; 516 } 517 518 /* Check for weak IVs if possible */ 519 if (rx->sta && rx->key->conf.alg == ALG_WEP && 520 ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) && 521 (!(rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED) || 522 !(rx->u.rx.status->flag & RX_FLAG_DECRYPTED)) && 523 ieee80211_wep_is_weak_iv(rx->skb, rx->key)) 524 rx->sta->wep_weak_iv_count++; 525 526 switch (rx->key->conf.alg) { 527 case ALG_WEP: 528 result = ieee80211_crypto_wep_decrypt(rx); 529 break; 530 case ALG_TKIP: 531 result = ieee80211_crypto_tkip_decrypt(rx); 532 break; 533 case ALG_CCMP: 534 result = ieee80211_crypto_ccmp_decrypt(rx); 535 break; 536 } 537 538 /* either the frame has been decrypted or will be dropped */ 539 rx->u.rx.status->flag |= RX_FLAG_DECRYPTED; 540 541 return result; 542 } 543 544 static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta) 545 { 546 struct ieee80211_sub_if_data *sdata; 547 DECLARE_MAC_BUF(mac); 548 549 sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev); 550 551 if (sdata->bss) 552 atomic_inc(&sdata->bss->num_sta_ps); 553 sta->flags |= WLAN_STA_PS; 554 sta->pspoll = 0; 555 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG 556 printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n", 557 dev->name, print_mac(mac, sta->addr), sta->aid); 558 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */ 559 } 560 561 static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta) 562 { 563 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr); 564 struct sk_buff *skb; 565 int sent = 0; 566 struct ieee80211_sub_if_data *sdata; 567 struct ieee80211_tx_packet_data *pkt_data; 568 DECLARE_MAC_BUF(mac); 569 570 sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev); 571 if (sdata->bss) 572 atomic_dec(&sdata->bss->num_sta_ps); 573 sta->flags &= ~(WLAN_STA_PS | WLAN_STA_TIM); 574 sta->pspoll = 0; 575 if (!skb_queue_empty(&sta->ps_tx_buf)) { 576 if (local->ops->set_tim) 577 local->ops->set_tim(local_to_hw(local), sta->aid, 0); 578 if (sdata->bss) 579 bss_tim_clear(local, sdata->bss, sta->aid); 580 } 581 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG 582 printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n", 583 dev->name, print_mac(mac, sta->addr), sta->aid); 584 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */ 585 /* Send all buffered frames to the station */ 586 while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) { 587 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb; 588 sent++; 589 pkt_data->flags |= IEEE80211_TXPD_REQUEUE; 590 dev_queue_xmit(skb); 591 } 592 while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) { 593 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb; 594 local->total_ps_buffered--; 595 sent++; 596 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG 597 printk(KERN_DEBUG "%s: STA %s aid %d send PS frame " 598 "since STA not sleeping anymore\n", dev->name, 599 print_mac(mac, sta->addr), sta->aid); 600 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */ 601 pkt_data->flags |= IEEE80211_TXPD_REQUEUE; 602 dev_queue_xmit(skb); 603 } 604 605 return sent; 606 } 607 608 static ieee80211_txrx_result 609 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx) 610 { 611 struct sta_info *sta = rx->sta; 612 struct net_device *dev = rx->dev; 613 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data; 614 615 if (!sta) 616 return TXRX_CONTINUE; 617 618 /* Update last_rx only for IBSS packets which are for the current 619 * BSSID to avoid keeping the current IBSS network alive in cases where 620 * other STAs are using different BSSID. */ 621 if (rx->sdata->type == IEEE80211_IF_TYPE_IBSS) { 622 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len); 623 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0) 624 sta->last_rx = jiffies; 625 } else 626 if (!is_multicast_ether_addr(hdr->addr1) || 627 rx->sdata->type == IEEE80211_IF_TYPE_STA) { 628 /* Update last_rx only for unicast frames in order to prevent 629 * the Probe Request frames (the only broadcast frames from a 630 * STA in infrastructure mode) from keeping a connection alive. 631 */ 632 sta->last_rx = jiffies; 633 } 634 635 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) 636 return TXRX_CONTINUE; 637 638 sta->rx_fragments++; 639 sta->rx_bytes += rx->skb->len; 640 sta->last_rssi = rx->u.rx.status->ssi; 641 sta->last_signal = rx->u.rx.status->signal; 642 sta->last_noise = rx->u.rx.status->noise; 643 644 if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) { 645 /* Change STA power saving mode only in the end of a frame 646 * exchange sequence */ 647 if ((sta->flags & WLAN_STA_PS) && !(rx->fc & IEEE80211_FCTL_PM)) 648 rx->u.rx.sent_ps_buffered += ap_sta_ps_end(dev, sta); 649 else if (!(sta->flags & WLAN_STA_PS) && 650 (rx->fc & IEEE80211_FCTL_PM)) 651 ap_sta_ps_start(dev, sta); 652 } 653 654 /* Drop data::nullfunc frames silently, since they are used only to 655 * control station power saving mode. */ 656 if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA && 657 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) { 658 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc); 659 /* Update counter and free packet here to avoid counting this 660 * as a dropped packed. */ 661 sta->rx_packets++; 662 dev_kfree_skb(rx->skb); 663 return TXRX_QUEUED; 664 } 665 666 return TXRX_CONTINUE; 667 } /* ieee80211_rx_h_sta_process */ 668 669 static inline struct ieee80211_fragment_entry * 670 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, 671 unsigned int frag, unsigned int seq, int rx_queue, 672 struct sk_buff **skb) 673 { 674 struct ieee80211_fragment_entry *entry; 675 int idx; 676 677 idx = sdata->fragment_next; 678 entry = &sdata->fragments[sdata->fragment_next++]; 679 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX) 680 sdata->fragment_next = 0; 681 682 if (!skb_queue_empty(&entry->skb_list)) { 683 #ifdef CONFIG_MAC80211_DEBUG 684 struct ieee80211_hdr *hdr = 685 (struct ieee80211_hdr *) entry->skb_list.next->data; 686 DECLARE_MAC_BUF(mac); 687 DECLARE_MAC_BUF(mac2); 688 printk(KERN_DEBUG "%s: RX reassembly removed oldest " 689 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d " 690 "addr1=%s addr2=%s\n", 691 sdata->dev->name, idx, 692 jiffies - entry->first_frag_time, entry->seq, 693 entry->last_frag, print_mac(mac, hdr->addr1), 694 print_mac(mac2, hdr->addr2)); 695 #endif /* CONFIG_MAC80211_DEBUG */ 696 __skb_queue_purge(&entry->skb_list); 697 } 698 699 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ 700 *skb = NULL; 701 entry->first_frag_time = jiffies; 702 entry->seq = seq; 703 entry->rx_queue = rx_queue; 704 entry->last_frag = frag; 705 entry->ccmp = 0; 706 entry->extra_len = 0; 707 708 return entry; 709 } 710 711 static inline struct ieee80211_fragment_entry * 712 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, 713 u16 fc, unsigned int frag, unsigned int seq, 714 int rx_queue, struct ieee80211_hdr *hdr) 715 { 716 struct ieee80211_fragment_entry *entry; 717 int i, idx; 718 719 idx = sdata->fragment_next; 720 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { 721 struct ieee80211_hdr *f_hdr; 722 u16 f_fc; 723 724 idx--; 725 if (idx < 0) 726 idx = IEEE80211_FRAGMENT_MAX - 1; 727 728 entry = &sdata->fragments[idx]; 729 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || 730 entry->rx_queue != rx_queue || 731 entry->last_frag + 1 != frag) 732 continue; 733 734 f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data; 735 f_fc = le16_to_cpu(f_hdr->frame_control); 736 737 if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) || 738 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 || 739 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0) 740 continue; 741 742 if (entry->first_frag_time + 2 * HZ < jiffies) { 743 __skb_queue_purge(&entry->skb_list); 744 continue; 745 } 746 return entry; 747 } 748 749 return NULL; 750 } 751 752 static ieee80211_txrx_result 753 ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx) 754 { 755 struct ieee80211_hdr *hdr; 756 u16 sc; 757 unsigned int frag, seq; 758 struct ieee80211_fragment_entry *entry; 759 struct sk_buff *skb; 760 DECLARE_MAC_BUF(mac); 761 762 hdr = (struct ieee80211_hdr *) rx->skb->data; 763 sc = le16_to_cpu(hdr->seq_ctrl); 764 frag = sc & IEEE80211_SCTL_FRAG; 765 766 if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) || 767 (rx->skb)->len < 24 || 768 is_multicast_ether_addr(hdr->addr1))) { 769 /* not fragmented */ 770 goto out; 771 } 772 I802_DEBUG_INC(rx->local->rx_handlers_fragments); 773 774 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 775 776 if (frag == 0) { 777 /* This is the first fragment of a new frame. */ 778 entry = ieee80211_reassemble_add(rx->sdata, frag, seq, 779 rx->u.rx.queue, &(rx->skb)); 780 if (rx->key && rx->key->conf.alg == ALG_CCMP && 781 (rx->fc & IEEE80211_FCTL_PROTECTED)) { 782 /* Store CCMP PN so that we can verify that the next 783 * fragment has a sequential PN value. */ 784 entry->ccmp = 1; 785 memcpy(entry->last_pn, 786 rx->key->u.ccmp.rx_pn[rx->u.rx.queue], 787 CCMP_PN_LEN); 788 } 789 return TXRX_QUEUED; 790 } 791 792 /* This is a fragment for a frame that should already be pending in 793 * fragment cache. Add this fragment to the end of the pending entry. 794 */ 795 entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq, 796 rx->u.rx.queue, hdr); 797 if (!entry) { 798 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 799 return TXRX_DROP; 800 } 801 802 /* Verify that MPDUs within one MSDU have sequential PN values. 803 * (IEEE 802.11i, 8.3.3.4.5) */ 804 if (entry->ccmp) { 805 int i; 806 u8 pn[CCMP_PN_LEN], *rpn; 807 if (!rx->key || rx->key->conf.alg != ALG_CCMP) 808 return TXRX_DROP; 809 memcpy(pn, entry->last_pn, CCMP_PN_LEN); 810 for (i = CCMP_PN_LEN - 1; i >= 0; i--) { 811 pn[i]++; 812 if (pn[i]) 813 break; 814 } 815 rpn = rx->key->u.ccmp.rx_pn[rx->u.rx.queue]; 816 if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) { 817 if (net_ratelimit()) 818 printk(KERN_DEBUG "%s: defrag: CCMP PN not " 819 "sequential A2=%s" 820 " PN=%02x%02x%02x%02x%02x%02x " 821 "(expected %02x%02x%02x%02x%02x%02x)\n", 822 rx->dev->name, print_mac(mac, hdr->addr2), 823 rpn[0], rpn[1], rpn[2], rpn[3], rpn[4], 824 rpn[5], pn[0], pn[1], pn[2], pn[3], 825 pn[4], pn[5]); 826 return TXRX_DROP; 827 } 828 memcpy(entry->last_pn, pn, CCMP_PN_LEN); 829 } 830 831 skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc)); 832 __skb_queue_tail(&entry->skb_list, rx->skb); 833 entry->last_frag = frag; 834 entry->extra_len += rx->skb->len; 835 if (rx->fc & IEEE80211_FCTL_MOREFRAGS) { 836 rx->skb = NULL; 837 return TXRX_QUEUED; 838 } 839 840 rx->skb = __skb_dequeue(&entry->skb_list); 841 if (skb_tailroom(rx->skb) < entry->extra_len) { 842 I802_DEBUG_INC(rx->local->rx_expand_skb_head2); 843 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len, 844 GFP_ATOMIC))) { 845 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 846 __skb_queue_purge(&entry->skb_list); 847 return TXRX_DROP; 848 } 849 } 850 while ((skb = __skb_dequeue(&entry->skb_list))) { 851 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len); 852 dev_kfree_skb(skb); 853 } 854 855 /* Complete frame has been reassembled - process it now */ 856 rx->flags |= IEEE80211_TXRXD_FRAGMENTED; 857 858 out: 859 if (rx->sta) 860 rx->sta->rx_packets++; 861 if (is_multicast_ether_addr(hdr->addr1)) 862 rx->local->dot11MulticastReceivedFrameCount++; 863 else 864 ieee80211_led_rx(rx->local); 865 return TXRX_CONTINUE; 866 } 867 868 static ieee80211_txrx_result 869 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx) 870 { 871 struct sk_buff *skb; 872 int no_pending_pkts; 873 DECLARE_MAC_BUF(mac); 874 875 if (likely(!rx->sta || 876 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL || 877 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL || 878 !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))) 879 return TXRX_CONTINUE; 880 881 skb = skb_dequeue(&rx->sta->tx_filtered); 882 if (!skb) { 883 skb = skb_dequeue(&rx->sta->ps_tx_buf); 884 if (skb) 885 rx->local->total_ps_buffered--; 886 } 887 no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) && 888 skb_queue_empty(&rx->sta->ps_tx_buf); 889 890 if (skb) { 891 struct ieee80211_hdr *hdr = 892 (struct ieee80211_hdr *) skb->data; 893 894 /* tell TX path to send one frame even though the STA may 895 * still remain is PS mode after this frame exchange */ 896 rx->sta->pspoll = 1; 897 898 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG 899 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n", 900 print_mac(mac, rx->sta->addr), rx->sta->aid, 901 skb_queue_len(&rx->sta->ps_tx_buf)); 902 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */ 903 904 /* Use MoreData flag to indicate whether there are more 905 * buffered frames for this STA */ 906 if (no_pending_pkts) { 907 hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA); 908 rx->sta->flags &= ~WLAN_STA_TIM; 909 } else 910 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA); 911 912 dev_queue_xmit(skb); 913 914 if (no_pending_pkts) { 915 if (rx->local->ops->set_tim) 916 rx->local->ops->set_tim(local_to_hw(rx->local), 917 rx->sta->aid, 0); 918 if (rx->sdata->bss) 919 bss_tim_clear(rx->local, rx->sdata->bss, rx->sta->aid); 920 } 921 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG 922 } else if (!rx->u.rx.sent_ps_buffered) { 923 printk(KERN_DEBUG "%s: STA %s sent PS Poll even " 924 "though there is no buffered frames for it\n", 925 rx->dev->name, print_mac(mac, rx->sta->addr)); 926 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */ 927 928 } 929 930 /* Free PS Poll skb here instead of returning TXRX_DROP that would 931 * count as an dropped frame. */ 932 dev_kfree_skb(rx->skb); 933 934 return TXRX_QUEUED; 935 } 936 937 static ieee80211_txrx_result 938 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx) 939 { 940 u16 fc = rx->fc; 941 u8 *data = rx->skb->data; 942 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data; 943 944 if (!WLAN_FC_IS_QOS_DATA(fc)) 945 return TXRX_CONTINUE; 946 947 /* remove the qos control field, update frame type and meta-data */ 948 memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2); 949 hdr = (struct ieee80211_hdr *) skb_pull(rx->skb, 2); 950 /* change frame type to non QOS */ 951 rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA; 952 hdr->frame_control = cpu_to_le16(fc); 953 954 return TXRX_CONTINUE; 955 } 956 957 static ieee80211_txrx_result 958 ieee80211_rx_h_802_1x_pae(struct ieee80211_txrx_data *rx) 959 { 960 if (rx->sdata->eapol && ieee80211_is_eapol(rx->skb) && 961 rx->sdata->type != IEEE80211_IF_TYPE_STA && 962 (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) 963 return TXRX_CONTINUE; 964 965 if (unlikely(rx->sdata->ieee802_1x && 966 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA && 967 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC && 968 (!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED)) && 969 !ieee80211_is_eapol(rx->skb))) { 970 #ifdef CONFIG_MAC80211_DEBUG 971 struct ieee80211_hdr *hdr = 972 (struct ieee80211_hdr *) rx->skb->data; 973 DECLARE_MAC_BUF(mac); 974 printk(KERN_DEBUG "%s: dropped frame from %s" 975 " (unauthorized port)\n", rx->dev->name, 976 print_mac(mac, hdr->addr2)); 977 #endif /* CONFIG_MAC80211_DEBUG */ 978 return TXRX_DROP; 979 } 980 981 return TXRX_CONTINUE; 982 } 983 984 static ieee80211_txrx_result 985 ieee80211_rx_h_drop_unencrypted(struct ieee80211_txrx_data *rx) 986 { 987 /* 988 * Pass through unencrypted frames if the hardware has 989 * decrypted them already. 990 */ 991 if (rx->u.rx.status->flag & RX_FLAG_DECRYPTED) 992 return TXRX_CONTINUE; 993 994 /* Drop unencrypted frames if key is set. */ 995 if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) && 996 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA && 997 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC && 998 rx->sdata->drop_unencrypted && 999 (rx->sdata->eapol == 0 || !ieee80211_is_eapol(rx->skb)))) { 1000 if (net_ratelimit()) 1001 printk(KERN_DEBUG "%s: RX non-WEP frame, but expected " 1002 "encryption\n", rx->dev->name); 1003 return TXRX_DROP; 1004 } 1005 return TXRX_CONTINUE; 1006 } 1007 1008 static ieee80211_txrx_result 1009 ieee80211_rx_h_data(struct ieee80211_txrx_data *rx) 1010 { 1011 struct net_device *dev = rx->dev; 1012 struct ieee80211_local *local = rx->local; 1013 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data; 1014 u16 fc, hdrlen, ethertype; 1015 u8 *payload; 1016 u8 dst[ETH_ALEN]; 1017 u8 src[ETH_ALEN]; 1018 struct sk_buff *skb = rx->skb, *skb2; 1019 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); 1020 DECLARE_MAC_BUF(mac); 1021 DECLARE_MAC_BUF(mac2); 1022 DECLARE_MAC_BUF(mac3); 1023 DECLARE_MAC_BUF(mac4); 1024 1025 fc = rx->fc; 1026 if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)) 1027 return TXRX_CONTINUE; 1028 1029 if (unlikely(!WLAN_FC_DATA_PRESENT(fc))) 1030 return TXRX_DROP; 1031 1032 hdrlen = ieee80211_get_hdrlen(fc); 1033 1034 /* convert IEEE 802.11 header + possible LLC headers into Ethernet 1035 * header 1036 * IEEE 802.11 address fields: 1037 * ToDS FromDS Addr1 Addr2 Addr3 Addr4 1038 * 0 0 DA SA BSSID n/a 1039 * 0 1 DA BSSID SA n/a 1040 * 1 0 BSSID SA DA n/a 1041 * 1 1 RA TA DA SA 1042 */ 1043 1044 switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) { 1045 case IEEE80211_FCTL_TODS: 1046 /* BSSID SA DA */ 1047 memcpy(dst, hdr->addr3, ETH_ALEN); 1048 memcpy(src, hdr->addr2, ETH_ALEN); 1049 1050 if (unlikely(sdata->type != IEEE80211_IF_TYPE_AP && 1051 sdata->type != IEEE80211_IF_TYPE_VLAN)) { 1052 if (net_ratelimit()) 1053 printk(KERN_DEBUG "%s: dropped ToDS frame " 1054 "(BSSID=%s SA=%s DA=%s)\n", 1055 dev->name, 1056 print_mac(mac, hdr->addr1), 1057 print_mac(mac2, hdr->addr2), 1058 print_mac(mac3, hdr->addr3)); 1059 return TXRX_DROP; 1060 } 1061 break; 1062 case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS): 1063 /* RA TA DA SA */ 1064 memcpy(dst, hdr->addr3, ETH_ALEN); 1065 memcpy(src, hdr->addr4, ETH_ALEN); 1066 1067 if (unlikely(sdata->type != IEEE80211_IF_TYPE_WDS)) { 1068 if (net_ratelimit()) 1069 printk(KERN_DEBUG "%s: dropped FromDS&ToDS " 1070 "frame (RA=%s TA=%s DA=%s SA=%s)\n", 1071 rx->dev->name, 1072 print_mac(mac, hdr->addr1), 1073 print_mac(mac2, hdr->addr2), 1074 print_mac(mac3, hdr->addr3), 1075 print_mac(mac4, hdr->addr4)); 1076 return TXRX_DROP; 1077 } 1078 break; 1079 case IEEE80211_FCTL_FROMDS: 1080 /* DA BSSID SA */ 1081 memcpy(dst, hdr->addr1, ETH_ALEN); 1082 memcpy(src, hdr->addr3, ETH_ALEN); 1083 1084 if (sdata->type != IEEE80211_IF_TYPE_STA || 1085 (is_multicast_ether_addr(dst) && 1086 !compare_ether_addr(src, dev->dev_addr))) 1087 return TXRX_DROP; 1088 break; 1089 case 0: 1090 /* DA SA BSSID */ 1091 memcpy(dst, hdr->addr1, ETH_ALEN); 1092 memcpy(src, hdr->addr2, ETH_ALEN); 1093 1094 if (sdata->type != IEEE80211_IF_TYPE_IBSS) { 1095 if (net_ratelimit()) { 1096 printk(KERN_DEBUG "%s: dropped IBSS frame " 1097 "(DA=%s SA=%s BSSID=%s)\n", 1098 dev->name, 1099 print_mac(mac, hdr->addr1), 1100 print_mac(mac2, hdr->addr2), 1101 print_mac(mac3, hdr->addr3)); 1102 } 1103 return TXRX_DROP; 1104 } 1105 break; 1106 } 1107 1108 payload = skb->data + hdrlen; 1109 1110 if (unlikely(skb->len - hdrlen < 8)) { 1111 if (net_ratelimit()) { 1112 printk(KERN_DEBUG "%s: RX too short data frame " 1113 "payload\n", dev->name); 1114 } 1115 return TXRX_DROP; 1116 } 1117 1118 ethertype = (payload[6] << 8) | payload[7]; 1119 1120 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 && 1121 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) || 1122 compare_ether_addr(payload, bridge_tunnel_header) == 0)) { 1123 /* remove RFC1042 or Bridge-Tunnel encapsulation and 1124 * replace EtherType */ 1125 skb_pull(skb, hdrlen + 6); 1126 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN); 1127 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN); 1128 } else { 1129 struct ethhdr *ehdr; 1130 __be16 len; 1131 skb_pull(skb, hdrlen); 1132 len = htons(skb->len); 1133 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr)); 1134 memcpy(ehdr->h_dest, dst, ETH_ALEN); 1135 memcpy(ehdr->h_source, src, ETH_ALEN); 1136 ehdr->h_proto = len; 1137 } 1138 skb->dev = dev; 1139 1140 skb2 = NULL; 1141 1142 dev->stats.rx_packets++; 1143 dev->stats.rx_bytes += skb->len; 1144 1145 if (local->bridge_packets && (sdata->type == IEEE80211_IF_TYPE_AP 1146 || sdata->type == IEEE80211_IF_TYPE_VLAN) && 1147 (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) { 1148 if (is_multicast_ether_addr(skb->data)) { 1149 /* send multicast frames both to higher layers in 1150 * local net stack and back to the wireless media */ 1151 skb2 = skb_copy(skb, GFP_ATOMIC); 1152 if (!skb2 && net_ratelimit()) 1153 printk(KERN_DEBUG "%s: failed to clone " 1154 "multicast frame\n", dev->name); 1155 } else { 1156 struct sta_info *dsta; 1157 dsta = sta_info_get(local, skb->data); 1158 if (dsta && !dsta->dev) { 1159 if (net_ratelimit()) 1160 printk(KERN_DEBUG "Station with null " 1161 "dev structure!\n"); 1162 } else if (dsta && dsta->dev == dev) { 1163 /* Destination station is associated to this 1164 * AP, so send the frame directly to it and 1165 * do not pass the frame to local net stack. 1166 */ 1167 skb2 = skb; 1168 skb = NULL; 1169 } 1170 if (dsta) 1171 sta_info_put(dsta); 1172 } 1173 } 1174 1175 if (skb) { 1176 /* deliver to local stack */ 1177 skb->protocol = eth_type_trans(skb, dev); 1178 memset(skb->cb, 0, sizeof(skb->cb)); 1179 netif_rx(skb); 1180 } 1181 1182 if (skb2) { 1183 /* send to wireless media */ 1184 skb2->protocol = __constant_htons(ETH_P_802_3); 1185 skb_set_network_header(skb2, 0); 1186 skb_set_mac_header(skb2, 0); 1187 dev_queue_xmit(skb2); 1188 } 1189 1190 return TXRX_QUEUED; 1191 } 1192 1193 static ieee80211_txrx_result 1194 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx) 1195 { 1196 struct ieee80211_sub_if_data *sdata; 1197 1198 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) 1199 return TXRX_DROP; 1200 1201 sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev); 1202 if ((sdata->type == IEEE80211_IF_TYPE_STA || 1203 sdata->type == IEEE80211_IF_TYPE_IBSS) && 1204 !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)) 1205 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->u.rx.status); 1206 else 1207 return TXRX_DROP; 1208 1209 return TXRX_QUEUED; 1210 } 1211 1212 static inline ieee80211_txrx_result __ieee80211_invoke_rx_handlers( 1213 struct ieee80211_local *local, 1214 ieee80211_rx_handler *handlers, 1215 struct ieee80211_txrx_data *rx, 1216 struct sta_info *sta) 1217 { 1218 ieee80211_rx_handler *handler; 1219 ieee80211_txrx_result res = TXRX_DROP; 1220 1221 for (handler = handlers; *handler != NULL; handler++) { 1222 res = (*handler)(rx); 1223 1224 switch (res) { 1225 case TXRX_CONTINUE: 1226 continue; 1227 case TXRX_DROP: 1228 I802_DEBUG_INC(local->rx_handlers_drop); 1229 if (sta) 1230 sta->rx_dropped++; 1231 break; 1232 case TXRX_QUEUED: 1233 I802_DEBUG_INC(local->rx_handlers_queued); 1234 break; 1235 } 1236 break; 1237 } 1238 1239 if (res == TXRX_DROP) 1240 dev_kfree_skb(rx->skb); 1241 return res; 1242 } 1243 1244 static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local *local, 1245 ieee80211_rx_handler *handlers, 1246 struct ieee80211_txrx_data *rx, 1247 struct sta_info *sta) 1248 { 1249 if (__ieee80211_invoke_rx_handlers(local, handlers, rx, sta) == 1250 TXRX_CONTINUE) 1251 dev_kfree_skb(rx->skb); 1252 } 1253 1254 static void ieee80211_rx_michael_mic_report(struct net_device *dev, 1255 struct ieee80211_hdr *hdr, 1256 struct sta_info *sta, 1257 struct ieee80211_txrx_data *rx) 1258 { 1259 int keyidx, hdrlen; 1260 DECLARE_MAC_BUF(mac); 1261 DECLARE_MAC_BUF(mac2); 1262 1263 hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb); 1264 if (rx->skb->len >= hdrlen + 4) 1265 keyidx = rx->skb->data[hdrlen + 3] >> 6; 1266 else 1267 keyidx = -1; 1268 1269 if (net_ratelimit()) 1270 printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC " 1271 "failure from %s to %s keyidx=%d\n", 1272 dev->name, print_mac(mac, hdr->addr2), 1273 print_mac(mac2, hdr->addr1), keyidx); 1274 1275 if (!sta) { 1276 /* 1277 * Some hardware seem to generate incorrect Michael MIC 1278 * reports; ignore them to avoid triggering countermeasures. 1279 */ 1280 if (net_ratelimit()) 1281 printk(KERN_DEBUG "%s: ignored spurious Michael MIC " 1282 "error for unknown address %s\n", 1283 dev->name, print_mac(mac, hdr->addr2)); 1284 goto ignore; 1285 } 1286 1287 if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) { 1288 if (net_ratelimit()) 1289 printk(KERN_DEBUG "%s: ignored spurious Michael MIC " 1290 "error for a frame with no PROTECTED flag (src " 1291 "%s)\n", dev->name, print_mac(mac, hdr->addr2)); 1292 goto ignore; 1293 } 1294 1295 if (rx->sdata->type == IEEE80211_IF_TYPE_AP && keyidx) { 1296 /* 1297 * APs with pairwise keys should never receive Michael MIC 1298 * errors for non-zero keyidx because these are reserved for 1299 * group keys and only the AP is sending real multicast 1300 * frames in the BSS. 1301 */ 1302 if (net_ratelimit()) 1303 printk(KERN_DEBUG "%s: ignored Michael MIC error for " 1304 "a frame with non-zero keyidx (%d)" 1305 " (src %s)\n", dev->name, keyidx, 1306 print_mac(mac, hdr->addr2)); 1307 goto ignore; 1308 } 1309 1310 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA && 1311 ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT || 1312 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) { 1313 if (net_ratelimit()) 1314 printk(KERN_DEBUG "%s: ignored spurious Michael MIC " 1315 "error for a frame that cannot be encrypted " 1316 "(fc=0x%04x) (src %s)\n", 1317 dev->name, rx->fc, print_mac(mac, hdr->addr2)); 1318 goto ignore; 1319 } 1320 1321 mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr); 1322 ignore: 1323 dev_kfree_skb(rx->skb); 1324 rx->skb = NULL; 1325 } 1326 1327 ieee80211_rx_handler ieee80211_rx_handlers[] = 1328 { 1329 ieee80211_rx_h_if_stats, 1330 ieee80211_rx_h_passive_scan, 1331 ieee80211_rx_h_check, 1332 ieee80211_rx_h_decrypt, 1333 ieee80211_rx_h_sta_process, 1334 ieee80211_rx_h_defragment, 1335 ieee80211_rx_h_ps_poll, 1336 ieee80211_rx_h_michael_mic_verify, 1337 /* this must be after decryption - so header is counted in MPDU mic 1338 * must be before pae and data, so QOS_DATA format frames 1339 * are not passed to user space by these functions 1340 */ 1341 ieee80211_rx_h_remove_qos_control, 1342 ieee80211_rx_h_802_1x_pae, 1343 ieee80211_rx_h_drop_unencrypted, 1344 ieee80211_rx_h_data, 1345 ieee80211_rx_h_mgmt, 1346 NULL 1347 }; 1348 1349 /* main receive path */ 1350 1351 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata, 1352 u8 *bssid, struct ieee80211_txrx_data *rx, 1353 struct ieee80211_hdr *hdr) 1354 { 1355 int multicast = is_multicast_ether_addr(hdr->addr1); 1356 1357 switch (sdata->type) { 1358 case IEEE80211_IF_TYPE_STA: 1359 if (!bssid) 1360 return 0; 1361 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) { 1362 if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) 1363 return 0; 1364 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH; 1365 } else if (!multicast && 1366 compare_ether_addr(sdata->dev->dev_addr, 1367 hdr->addr1) != 0) { 1368 if (!(sdata->dev->flags & IFF_PROMISC)) 1369 return 0; 1370 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH; 1371 } 1372 break; 1373 case IEEE80211_IF_TYPE_IBSS: 1374 if (!bssid) 1375 return 0; 1376 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) { 1377 if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) 1378 return 0; 1379 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH; 1380 } else if (!multicast && 1381 compare_ether_addr(sdata->dev->dev_addr, 1382 hdr->addr1) != 0) { 1383 if (!(sdata->dev->flags & IFF_PROMISC)) 1384 return 0; 1385 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH; 1386 } else if (!rx->sta) 1387 rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb, 1388 bssid, hdr->addr2); 1389 break; 1390 case IEEE80211_IF_TYPE_VLAN: 1391 case IEEE80211_IF_TYPE_AP: 1392 if (!bssid) { 1393 if (compare_ether_addr(sdata->dev->dev_addr, 1394 hdr->addr1)) 1395 return 0; 1396 } else if (!ieee80211_bssid_match(bssid, 1397 sdata->dev->dev_addr)) { 1398 if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) 1399 return 0; 1400 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH; 1401 } 1402 if (sdata->dev == sdata->local->mdev && 1403 !(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) 1404 /* do not receive anything via 1405 * master device when not scanning */ 1406 return 0; 1407 break; 1408 case IEEE80211_IF_TYPE_WDS: 1409 if (bssid || 1410 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA) 1411 return 0; 1412 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2)) 1413 return 0; 1414 break; 1415 case IEEE80211_IF_TYPE_MNTR: 1416 /* take everything */ 1417 break; 1418 case IEEE80211_IF_TYPE_INVALID: 1419 /* should never get here */ 1420 WARN_ON(1); 1421 break; 1422 } 1423 1424 return 1; 1425 } 1426 1427 /* 1428 * This is the receive path handler. It is called by a low level driver when an 1429 * 802.11 MPDU is received from the hardware. 1430 */ 1431 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb, 1432 struct ieee80211_rx_status *status) 1433 { 1434 struct ieee80211_local *local = hw_to_local(hw); 1435 struct ieee80211_sub_if_data *sdata; 1436 struct sta_info *sta; 1437 struct ieee80211_hdr *hdr; 1438 struct ieee80211_txrx_data rx; 1439 u16 type; 1440 int prepres; 1441 struct ieee80211_sub_if_data *prev = NULL; 1442 struct sk_buff *skb_new; 1443 u8 *bssid; 1444 1445 /* 1446 * key references and virtual interfaces are protected using RCU 1447 * and this requires that we are in a read-side RCU section during 1448 * receive processing 1449 */ 1450 rcu_read_lock(); 1451 1452 /* 1453 * Frames with failed FCS/PLCP checksum are not returned, 1454 * all other frames are returned without radiotap header 1455 * if it was previously present. 1456 * Also, frames with less than 16 bytes are dropped. 1457 */ 1458 skb = ieee80211_rx_monitor(local, skb, status); 1459 if (!skb) { 1460 rcu_read_unlock(); 1461 return; 1462 } 1463 1464 hdr = (struct ieee80211_hdr *) skb->data; 1465 memset(&rx, 0, sizeof(rx)); 1466 rx.skb = skb; 1467 rx.local = local; 1468 1469 rx.u.rx.status = status; 1470 rx.fc = le16_to_cpu(hdr->frame_control); 1471 type = rx.fc & IEEE80211_FCTL_FTYPE; 1472 1473 if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT) 1474 local->dot11ReceivedFragmentCount++; 1475 1476 sta = rx.sta = sta_info_get(local, hdr->addr2); 1477 if (sta) { 1478 rx.dev = rx.sta->dev; 1479 rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev); 1480 } 1481 1482 if ((status->flag & RX_FLAG_MMIC_ERROR)) { 1483 ieee80211_rx_michael_mic_report(local->mdev, hdr, sta, &rx); 1484 goto end; 1485 } 1486 1487 if (unlikely(local->sta_scanning)) 1488 rx.flags |= IEEE80211_TXRXD_RXIN_SCAN; 1489 1490 if (__ieee80211_invoke_rx_handlers(local, local->rx_pre_handlers, &rx, 1491 sta) != TXRX_CONTINUE) 1492 goto end; 1493 skb = rx.skb; 1494 1495 if (sta && !(sta->flags & (WLAN_STA_WDS | WLAN_STA_ASSOC_AP)) && 1496 !atomic_read(&local->iff_promiscs) && 1497 !is_multicast_ether_addr(hdr->addr1)) { 1498 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH; 1499 ieee80211_invoke_rx_handlers(local, local->rx_handlers, &rx, 1500 rx.sta); 1501 sta_info_put(sta); 1502 rcu_read_unlock(); 1503 return; 1504 } 1505 1506 bssid = ieee80211_get_bssid(hdr, skb->len); 1507 1508 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 1509 if (!netif_running(sdata->dev)) 1510 continue; 1511 1512 if (sdata->type == IEEE80211_IF_TYPE_MNTR) 1513 continue; 1514 1515 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH; 1516 prepres = prepare_for_handlers(sdata, bssid, &rx, hdr); 1517 /* prepare_for_handlers can change sta */ 1518 sta = rx.sta; 1519 1520 if (!prepres) 1521 continue; 1522 1523 /* 1524 * frame is destined for this interface, but if it's not 1525 * also for the previous one we handle that after the 1526 * loop to avoid copying the SKB once too much 1527 */ 1528 1529 if (!prev) { 1530 prev = sdata; 1531 continue; 1532 } 1533 1534 /* 1535 * frame was destined for the previous interface 1536 * so invoke RX handlers for it 1537 */ 1538 1539 skb_new = skb_copy(skb, GFP_ATOMIC); 1540 if (!skb_new) { 1541 if (net_ratelimit()) 1542 printk(KERN_DEBUG "%s: failed to copy " 1543 "multicast frame for %s", 1544 wiphy_name(local->hw.wiphy), 1545 prev->dev->name); 1546 continue; 1547 } 1548 rx.skb = skb_new; 1549 rx.dev = prev->dev; 1550 rx.sdata = prev; 1551 ieee80211_invoke_rx_handlers(local, local->rx_handlers, 1552 &rx, sta); 1553 prev = sdata; 1554 } 1555 if (prev) { 1556 rx.skb = skb; 1557 rx.dev = prev->dev; 1558 rx.sdata = prev; 1559 ieee80211_invoke_rx_handlers(local, local->rx_handlers, 1560 &rx, sta); 1561 } else 1562 dev_kfree_skb(skb); 1563 1564 end: 1565 rcu_read_unlock(); 1566 1567 if (sta) 1568 sta_info_put(sta); 1569 } 1570 EXPORT_SYMBOL(__ieee80211_rx); 1571 1572 /* This is a version of the rx handler that can be called from hard irq 1573 * context. Post the skb on the queue and schedule the tasklet */ 1574 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb, 1575 struct ieee80211_rx_status *status) 1576 { 1577 struct ieee80211_local *local = hw_to_local(hw); 1578 1579 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb)); 1580 1581 skb->dev = local->mdev; 1582 /* copy status into skb->cb for use by tasklet */ 1583 memcpy(skb->cb, status, sizeof(*status)); 1584 skb->pkt_type = IEEE80211_RX_MSG; 1585 skb_queue_tail(&local->skb_queue, skb); 1586 tasklet_schedule(&local->tasklet); 1587 } 1588 EXPORT_SYMBOL(ieee80211_rx_irqsafe); 1589