1 #include <linux/etherdevice.h>
3 #include "hostap_80211.h"
6 void hostap_dump_rx_80211(const char *name
, struct sk_buff
*skb
,
7 struct hostap_80211_rx_status
*rx_stats
)
9 struct ieee80211_hdr
*hdr
;
12 hdr
= (struct ieee80211_hdr
*) skb
->data
;
14 printk(KERN_DEBUG
"%s: RX signal=%d noise=%d rate=%d len=%d "
16 name
, rx_stats
->signal
, rx_stats
->noise
, rx_stats
->rate
,
22 fc
= le16_to_cpu(hdr
->frame_ctl
);
23 printk(KERN_DEBUG
" FC=0x%04x (type=%d:%d)%s%s",
24 fc
, WLAN_FC_GET_TYPE(fc
) >> 2, WLAN_FC_GET_STYPE(fc
) >> 4,
25 fc
& IEEE80211_FCTL_TODS
? " [ToDS]" : "",
26 fc
& IEEE80211_FCTL_FROMDS
? " [FromDS]" : "");
28 if (skb
->len
< IEEE80211_DATA_HDR3_LEN
) {
33 printk(" dur=0x%04x seq=0x%04x\n", le16_to_cpu(hdr
->duration_id
),
34 le16_to_cpu(hdr
->seq_ctl
));
36 printk(KERN_DEBUG
" A1=" MACSTR
" A2=" MACSTR
" A3=" MACSTR
,
37 MAC2STR(hdr
->addr1
), MAC2STR(hdr
->addr2
), MAC2STR(hdr
->addr3
));
39 printk(" A4=" MACSTR
, MAC2STR(hdr
->addr4
));
44 /* Send RX frame to netif with 802.11 (and possible prism) header.
45 * Called from hardware or software IRQ context. */
46 int prism2_rx_80211(struct net_device
*dev
, struct sk_buff
*skb
,
47 struct hostap_80211_rx_status
*rx_stats
, int type
)
49 struct hostap_interface
*iface
;
51 int hdrlen
, phdrlen
, head_need
, tail_need
;
53 int prism_header
, ret
;
54 struct ieee80211_hdr
*hdr
;
56 iface
= netdev_priv(dev
);
58 dev
->last_rx
= jiffies
;
60 if (dev
->type
== ARPHRD_IEEE80211_PRISM
) {
61 if (local
->monitor_type
== PRISM2_MONITOR_PRISM
) {
63 phdrlen
= sizeof(struct linux_wlan_ng_prism_hdr
);
64 } else { /* local->monitor_type == PRISM2_MONITOR_CAPHDR */
66 phdrlen
= sizeof(struct linux_wlan_ng_cap_hdr
);
73 hdr
= (struct ieee80211_hdr
*) skb
->data
;
74 fc
= le16_to_cpu(hdr
->frame_ctl
);
76 if (type
== PRISM2_RX_MGMT
&& (fc
& IEEE80211_FCTL_VERS
)) {
77 printk(KERN_DEBUG
"%s: dropped management frame with header "
78 "version %d\n", dev
->name
, fc
& IEEE80211_FCTL_VERS
);
79 dev_kfree_skb_any(skb
);
83 hdrlen
= hostap_80211_get_hdrlen(fc
);
85 /* check if there is enough room for extra data; if not, expand skb
86 * buffer to be large enough for the changes */
89 #ifdef PRISM2_ADD_BOGUS_CRC
91 #endif /* PRISM2_ADD_BOGUS_CRC */
93 head_need
-= skb_headroom(skb
);
94 tail_need
-= skb_tailroom(skb
);
96 if (head_need
> 0 || tail_need
> 0) {
97 if (pskb_expand_head(skb
, head_need
> 0 ? head_need
: 0,
98 tail_need
> 0 ? tail_need
: 0,
100 printk(KERN_DEBUG
"%s: prism2_rx_80211 failed to "
101 "reallocate skb buffer\n", dev
->name
);
102 dev_kfree_skb_any(skb
);
107 /* We now have an skb with enough head and tail room, so just insert
110 #ifdef PRISM2_ADD_BOGUS_CRC
111 memset(skb_put(skb
, 4), 0xff, 4); /* Prism2 strips CRC */
112 #endif /* PRISM2_ADD_BOGUS_CRC */
114 if (prism_header
== 1) {
115 struct linux_wlan_ng_prism_hdr
*hdr
;
116 hdr
= (struct linux_wlan_ng_prism_hdr
*)
117 skb_push(skb
, phdrlen
);
118 memset(hdr
, 0, phdrlen
);
119 hdr
->msgcode
= LWNG_CAP_DID_BASE
;
120 hdr
->msglen
= sizeof(*hdr
);
121 memcpy(hdr
->devname
, dev
->name
, sizeof(hdr
->devname
));
122 #define LWNG_SETVAL(f,i,s,l,d) \
123 hdr->f.did = LWNG_CAP_DID_BASE | (i << 12); \
124 hdr->f.status = s; hdr->f.len = l; hdr->f.data = d
125 LWNG_SETVAL(hosttime
, 1, 0, 4, jiffies
);
126 LWNG_SETVAL(mactime
, 2, 0, 4, rx_stats
->mac_time
);
127 LWNG_SETVAL(channel
, 3, 1 /* no value */, 4, 0);
128 LWNG_SETVAL(rssi
, 4, 1 /* no value */, 4, 0);
129 LWNG_SETVAL(sq
, 5, 1 /* no value */, 4, 0);
130 LWNG_SETVAL(signal
, 6, 0, 4, rx_stats
->signal
);
131 LWNG_SETVAL(noise
, 7, 0, 4, rx_stats
->noise
);
132 LWNG_SETVAL(rate
, 8, 0, 4, rx_stats
->rate
/ 5);
133 LWNG_SETVAL(istx
, 9, 0, 4, 0);
134 LWNG_SETVAL(frmlen
, 10, 0, 4, skb
->len
- phdrlen
);
136 } else if (prism_header
== 2) {
137 struct linux_wlan_ng_cap_hdr
*hdr
;
138 hdr
= (struct linux_wlan_ng_cap_hdr
*)
139 skb_push(skb
, phdrlen
);
140 memset(hdr
, 0, phdrlen
);
141 hdr
->version
= htonl(LWNG_CAPHDR_VERSION
);
142 hdr
->length
= htonl(phdrlen
);
143 hdr
->mactime
= __cpu_to_be64(rx_stats
->mac_time
);
144 hdr
->hosttime
= __cpu_to_be64(jiffies
);
145 hdr
->phytype
= htonl(4); /* dss_dot11_b */
146 hdr
->channel
= htonl(local
->channel
);
147 hdr
->datarate
= htonl(rx_stats
->rate
);
148 hdr
->antenna
= htonl(0); /* unknown */
149 hdr
->priority
= htonl(0); /* unknown */
150 hdr
->ssi_type
= htonl(3); /* raw */
151 hdr
->ssi_signal
= htonl(rx_stats
->signal
);
152 hdr
->ssi_noise
= htonl(rx_stats
->noise
);
153 hdr
->preamble
= htonl(0); /* unknown */
154 hdr
->encoding
= htonl(1); /* cck */
157 ret
= skb
->len
- phdrlen
;
159 skb
->mac
.raw
= skb
->data
;
160 skb_pull(skb
, hdrlen
);
162 skb_pull(skb
, phdrlen
);
163 skb
->pkt_type
= PACKET_OTHERHOST
;
164 skb
->protocol
= __constant_htons(ETH_P_802_2
);
165 memset(skb
->cb
, 0, sizeof(skb
->cb
));
172 /* Called only as a tasklet (software IRQ) */
173 static void monitor_rx(struct net_device
*dev
, struct sk_buff
*skb
,
174 struct hostap_80211_rx_status
*rx_stats
)
176 struct net_device_stats
*stats
;
179 len
= prism2_rx_80211(dev
, skb
, rx_stats
, PRISM2_RX_MONITOR
);
180 stats
= hostap_get_stats(dev
);
182 stats
->rx_bytes
+= len
;
186 /* Called only as a tasklet (software IRQ) */
187 static struct prism2_frag_entry
*
188 prism2_frag_cache_find(local_info_t
*local
, unsigned int seq
,
189 unsigned int frag
, u8
*src
, u8
*dst
)
191 struct prism2_frag_entry
*entry
;
194 for (i
= 0; i
< PRISM2_FRAG_CACHE_LEN
; i
++) {
195 entry
= &local
->frag_cache
[i
];
196 if (entry
->skb
!= NULL
&&
197 time_after(jiffies
, entry
->first_frag_time
+ 2 * HZ
)) {
198 printk(KERN_DEBUG
"%s: expiring fragment cache entry "
199 "seq=%u last_frag=%u\n",
200 local
->dev
->name
, entry
->seq
, entry
->last_frag
);
201 dev_kfree_skb(entry
->skb
);
205 if (entry
->skb
!= NULL
&& entry
->seq
== seq
&&
206 (entry
->last_frag
+ 1 == frag
|| frag
== -1) &&
207 memcmp(entry
->src_addr
, src
, ETH_ALEN
) == 0 &&
208 memcmp(entry
->dst_addr
, dst
, ETH_ALEN
) == 0)
216 /* Called only as a tasklet (software IRQ) */
217 static struct sk_buff
*
218 prism2_frag_cache_get(local_info_t
*local
, struct ieee80211_hdr
*hdr
)
220 struct sk_buff
*skb
= NULL
;
222 unsigned int frag
, seq
;
223 struct prism2_frag_entry
*entry
;
225 sc
= le16_to_cpu(hdr
->seq_ctl
);
226 frag
= WLAN_GET_SEQ_FRAG(sc
);
227 seq
= WLAN_GET_SEQ_SEQ(sc
) >> 4;
230 /* Reserve enough space to fit maximum frame length */
231 skb
= dev_alloc_skb(local
->dev
->mtu
+
232 sizeof(struct ieee80211_hdr
) +
235 8 /* WEP */ + ETH_ALEN
/* WDS */);
239 entry
= &local
->frag_cache
[local
->frag_next_idx
];
240 local
->frag_next_idx
++;
241 if (local
->frag_next_idx
>= PRISM2_FRAG_CACHE_LEN
)
242 local
->frag_next_idx
= 0;
244 if (entry
->skb
!= NULL
)
245 dev_kfree_skb(entry
->skb
);
247 entry
->first_frag_time
= jiffies
;
249 entry
->last_frag
= frag
;
251 memcpy(entry
->src_addr
, hdr
->addr2
, ETH_ALEN
);
252 memcpy(entry
->dst_addr
, hdr
->addr1
, ETH_ALEN
);
254 /* received a fragment of a frame for which the head fragment
255 * should have already been received */
256 entry
= prism2_frag_cache_find(local
, seq
, frag
, hdr
->addr2
,
259 entry
->last_frag
= frag
;
268 /* Called only as a tasklet (software IRQ) */
269 static int prism2_frag_cache_invalidate(local_info_t
*local
,
270 struct ieee80211_hdr
*hdr
)
274 struct prism2_frag_entry
*entry
;
276 sc
= le16_to_cpu(hdr
->seq_ctl
);
277 seq
= WLAN_GET_SEQ_SEQ(sc
) >> 4;
279 entry
= prism2_frag_cache_find(local
, seq
, -1, hdr
->addr2
, hdr
->addr1
);
282 printk(KERN_DEBUG
"%s: could not invalidate fragment cache "
284 local
->dev
->name
, seq
);
293 static struct hostap_bss_info
*__hostap_get_bss(local_info_t
*local
, u8
*bssid
,
294 u8
*ssid
, size_t ssid_len
)
296 struct list_head
*ptr
;
297 struct hostap_bss_info
*bss
;
299 list_for_each(ptr
, &local
->bss_list
) {
300 bss
= list_entry(ptr
, struct hostap_bss_info
, list
);
301 if (memcmp(bss
->bssid
, bssid
, ETH_ALEN
) == 0 &&
303 (ssid_len
== bss
->ssid_len
&&
304 memcmp(ssid
, bss
->ssid
, ssid_len
) == 0))) {
305 list_move(&bss
->list
, &local
->bss_list
);
314 static struct hostap_bss_info
*__hostap_add_bss(local_info_t
*local
, u8
*bssid
,
315 u8
*ssid
, size_t ssid_len
)
317 struct hostap_bss_info
*bss
;
319 if (local
->num_bss_info
>= HOSTAP_MAX_BSS_COUNT
) {
320 bss
= list_entry(local
->bss_list
.prev
,
321 struct hostap_bss_info
, list
);
322 list_del(&bss
->list
);
323 local
->num_bss_info
--;
325 bss
= (struct hostap_bss_info
*)
326 kmalloc(sizeof(*bss
), GFP_ATOMIC
);
331 memset(bss
, 0, sizeof(*bss
));
332 memcpy(bss
->bssid
, bssid
, ETH_ALEN
);
333 memcpy(bss
->ssid
, ssid
, ssid_len
);
334 bss
->ssid_len
= ssid_len
;
335 local
->num_bss_info
++;
336 list_add(&bss
->list
, &local
->bss_list
);
341 static void __hostap_expire_bss(local_info_t
*local
)
343 struct hostap_bss_info
*bss
;
345 while (local
->num_bss_info
> 0) {
346 bss
= list_entry(local
->bss_list
.prev
,
347 struct hostap_bss_info
, list
);
348 if (!time_after(jiffies
, bss
->last_update
+ 60 * HZ
))
351 list_del(&bss
->list
);
352 local
->num_bss_info
--;
358 /* Both IEEE 802.11 Beacon and Probe Response frames have similar structure, so
359 * the same routine can be used to parse both of them. */
360 static void hostap_rx_sta_beacon(local_info_t
*local
, struct sk_buff
*skb
,
363 struct hostap_ieee80211_mgmt
*mgmt
;
366 u8
*ssid
= NULL
, *wpa
= NULL
, *rsn
= NULL
;
367 size_t ssid_len
= 0, wpa_len
= 0, rsn_len
= 0;
368 struct hostap_bss_info
*bss
;
370 if (skb
->len
< IEEE80211_MGMT_HDR_LEN
+ sizeof(mgmt
->u
.beacon
))
373 mgmt
= (struct hostap_ieee80211_mgmt
*) skb
->data
;
374 pos
= mgmt
->u
.beacon
.variable
;
375 left
= skb
->len
- (pos
- skb
->data
);
378 if (2 + pos
[1] > left
)
379 return; /* parse failed */
385 case WLAN_EID_GENERIC
:
387 pos
[2] == 0x00 && pos
[3] == 0x50 &&
388 pos
[4] == 0xf2 && pos
[5] == 1) {
390 wpa_len
= pos
[1] + 2;
395 rsn_len
= pos
[1] + 2;
397 case WLAN_EID_DS_PARAMS
:
406 if (wpa_len
> MAX_WPA_IE_LEN
)
407 wpa_len
= MAX_WPA_IE_LEN
;
408 if (rsn_len
> MAX_WPA_IE_LEN
)
409 rsn_len
= MAX_WPA_IE_LEN
;
410 if (ssid_len
> sizeof(bss
->ssid
))
411 ssid_len
= sizeof(bss
->ssid
);
413 spin_lock(&local
->lock
);
414 bss
= __hostap_get_bss(local
, mgmt
->bssid
, ssid
, ssid_len
);
416 bss
= __hostap_add_bss(local
, mgmt
->bssid
, ssid
, ssid_len
);
418 bss
->last_update
= jiffies
;
420 bss
->capab_info
= le16_to_cpu(mgmt
->u
.beacon
.capab_info
);
422 memcpy(bss
->wpa_ie
, wpa
, wpa_len
);
423 bss
->wpa_ie_len
= wpa_len
;
427 memcpy(bss
->rsn_ie
, rsn
, rsn_len
);
428 bss
->rsn_ie_len
= rsn_len
;
433 __hostap_expire_bss(local
);
434 spin_unlock(&local
->lock
);
439 hostap_rx_frame_mgmt(local_info_t
*local
, struct sk_buff
*skb
,
440 struct hostap_80211_rx_status
*rx_stats
, u16 type
,
443 if (local
->iw_mode
== IW_MODE_MASTER
) {
444 hostap_update_sta_ps(local
, (struct ieee80211_hdr
*)
448 if (local
->hostapd
&& type
== IEEE80211_FTYPE_MGMT
) {
449 if (stype
== IEEE80211_STYPE_BEACON
&&
450 local
->iw_mode
== IW_MODE_MASTER
) {
451 struct sk_buff
*skb2
;
452 /* Process beacon frames also in kernel driver to
453 * update STA(AP) table statistics */
454 skb2
= skb_clone(skb
, GFP_ATOMIC
);
456 hostap_rx(skb2
->dev
, skb2
, rx_stats
);
459 /* send management frames to the user space daemon for
461 local
->apdevstats
.rx_packets
++;
462 local
->apdevstats
.rx_bytes
+= skb
->len
;
463 if (local
->apdev
== NULL
)
465 prism2_rx_80211(local
->apdev
, skb
, rx_stats
, PRISM2_RX_MGMT
);
469 if (local
->iw_mode
== IW_MODE_MASTER
) {
470 if (type
!= IEEE80211_FTYPE_MGMT
&&
471 type
!= IEEE80211_FTYPE_CTL
) {
472 printk(KERN_DEBUG
"%s: unknown management frame "
473 "(type=0x%02x, stype=0x%02x) dropped\n",
474 skb
->dev
->name
, type
>> 2, stype
>> 4);
478 hostap_rx(skb
->dev
, skb
, rx_stats
);
480 } else if (type
== IEEE80211_FTYPE_MGMT
&&
481 (stype
== IEEE80211_STYPE_BEACON
||
482 stype
== IEEE80211_STYPE_PROBE_RESP
)) {
483 hostap_rx_sta_beacon(local
, skb
, stype
);
485 } else if (type
== IEEE80211_FTYPE_MGMT
&&
486 (stype
== IEEE80211_STYPE_ASSOC_RESP
||
487 stype
== IEEE80211_STYPE_REASSOC_RESP
)) {
488 /* Ignore (Re)AssocResp silently since these are not currently
489 * needed but are still received when WPA/RSN mode is enabled.
493 printk(KERN_DEBUG
"%s: hostap_rx_frame_mgmt: dropped unhandled"
494 " management frame in non-Host AP mode (type=%d:%d)\n",
495 skb
->dev
->name
, type
>> 2, stype
>> 4);
501 /* Called only as a tasklet (software IRQ) */
502 static inline struct net_device
*prism2_rx_get_wds(local_info_t
*local
,
505 struct hostap_interface
*iface
= NULL
;
506 struct list_head
*ptr
;
508 read_lock_bh(&local
->iface_lock
);
509 list_for_each(ptr
, &local
->hostap_interfaces
) {
510 iface
= list_entry(ptr
, struct hostap_interface
, list
);
511 if (iface
->type
== HOSTAP_INTERFACE_WDS
&&
512 memcmp(iface
->u
.wds
.remote_addr
, addr
, ETH_ALEN
) == 0)
516 read_unlock_bh(&local
->iface_lock
);
518 return iface
? iface
->dev
: NULL
;
523 hostap_rx_frame_wds(local_info_t
*local
, struct ieee80211_hdr
*hdr
,
524 u16 fc
, struct net_device
**wds
)
526 /* FIX: is this really supposed to accept WDS frames only in Master
527 * mode? What about Repeater or Managed with WDS frames? */
528 if ((fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) !=
529 (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
) &&
530 (local
->iw_mode
!= IW_MODE_MASTER
|| !(fc
& IEEE80211_FCTL_TODS
)))
531 return 0; /* not a WDS frame */
533 /* Possible WDS frame: either IEEE 802.11 compliant (if FromDS)
534 * or own non-standard frame with 4th address after payload */
535 if (memcmp(hdr
->addr1
, local
->dev
->dev_addr
, ETH_ALEN
) != 0 &&
536 (hdr
->addr1
[0] != 0xff || hdr
->addr1
[1] != 0xff ||
537 hdr
->addr1
[2] != 0xff || hdr
->addr1
[3] != 0xff ||
538 hdr
->addr1
[4] != 0xff || hdr
->addr1
[5] != 0xff)) {
539 /* RA (or BSSID) is not ours - drop */
540 PDEBUG(DEBUG_EXTRA
, "%s: received WDS frame with "
541 "not own or broadcast %s=" MACSTR
"\n",
543 fc
& IEEE80211_FCTL_FROMDS
? "RA" : "BSSID",
544 MAC2STR(hdr
->addr1
));
548 /* check if the frame came from a registered WDS connection */
549 *wds
= prism2_rx_get_wds(local
, hdr
->addr2
);
550 if (*wds
== NULL
&& fc
& IEEE80211_FCTL_FROMDS
&&
551 (local
->iw_mode
!= IW_MODE_INFRA
||
552 !(local
->wds_type
& HOSTAP_WDS_AP_CLIENT
) ||
553 memcmp(hdr
->addr2
, local
->bssid
, ETH_ALEN
) != 0)) {
554 /* require that WDS link has been registered with TA or the
555 * frame is from current AP when using 'AP client mode' */
556 PDEBUG(DEBUG_EXTRA
, "%s: received WDS[4 addr] frame "
557 "from unknown TA=" MACSTR
"\n",
558 local
->dev
->name
, MAC2STR(hdr
->addr2
));
559 if (local
->ap
&& local
->ap
->autom_ap_wds
)
560 hostap_wds_link_oper(local
, hdr
->addr2
, WDS_ADD
);
564 if (*wds
&& !(fc
& IEEE80211_FCTL_FROMDS
) && local
->ap
&&
565 hostap_is_sta_assoc(local
->ap
, hdr
->addr2
)) {
566 /* STA is actually associated with us even though it has a
567 * registered WDS link. Assume it is in 'AP client' mode.
568 * Since this is a 3-addr frame, assume it is not (bogus) WDS
569 * frame and process it like any normal ToDS frame from
578 static int hostap_is_eapol_frame(local_info_t
*local
, struct sk_buff
*skb
)
580 struct net_device
*dev
= local
->dev
;
582 struct ieee80211_hdr
*hdr
;
588 hdr
= (struct ieee80211_hdr
*) skb
->data
;
589 fc
= le16_to_cpu(hdr
->frame_ctl
);
591 /* check that the frame is unicast frame to us */
592 if ((fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) ==
593 IEEE80211_FCTL_TODS
&&
594 memcmp(hdr
->addr1
, dev
->dev_addr
, ETH_ALEN
) == 0 &&
595 memcmp(hdr
->addr3
, dev
->dev_addr
, ETH_ALEN
) == 0) {
596 /* ToDS frame with own addr BSSID and DA */
597 } else if ((fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) ==
598 IEEE80211_FCTL_FROMDS
&&
599 memcmp(hdr
->addr1
, dev
->dev_addr
, ETH_ALEN
) == 0) {
600 /* FromDS frame with own addr as DA */
604 if (skb
->len
< 24 + 8)
607 /* check for port access entity Ethernet type */
608 pos
= skb
->data
+ 24;
609 ethertype
= (pos
[6] << 8) | pos
[7];
610 if (ethertype
== ETH_P_PAE
)
617 /* Called only as a tasklet (software IRQ) */
619 hostap_rx_frame_decrypt(local_info_t
*local
, struct sk_buff
*skb
,
620 struct ieee80211_crypt_data
*crypt
)
622 struct ieee80211_hdr
*hdr
;
625 if (crypt
== NULL
|| crypt
->ops
->decrypt_mpdu
== NULL
)
628 hdr
= (struct ieee80211_hdr
*) skb
->data
;
629 hdrlen
= hostap_80211_get_hdrlen(le16_to_cpu(hdr
->frame_ctl
));
631 if (local
->tkip_countermeasures
&&
632 strcmp(crypt
->ops
->name
, "TKIP") == 0) {
633 if (net_ratelimit()) {
634 printk(KERN_DEBUG
"%s: TKIP countermeasures: dropped "
635 "received packet from " MACSTR
"\n",
636 local
->dev
->name
, MAC2STR(hdr
->addr2
));
641 atomic_inc(&crypt
->refcnt
);
642 res
= crypt
->ops
->decrypt_mpdu(skb
, hdrlen
, crypt
->priv
);
643 atomic_dec(&crypt
->refcnt
);
645 printk(KERN_DEBUG
"%s: decryption failed (SA=" MACSTR
647 local
->dev
->name
, MAC2STR(hdr
->addr2
), res
);
648 local
->comm_tallies
.rx_discards_wep_undecryptable
++;
656 /* Called only as a tasklet (software IRQ) */
658 hostap_rx_frame_decrypt_msdu(local_info_t
*local
, struct sk_buff
*skb
,
659 int keyidx
, struct ieee80211_crypt_data
*crypt
)
661 struct ieee80211_hdr
*hdr
;
664 if (crypt
== NULL
|| crypt
->ops
->decrypt_msdu
== NULL
)
667 hdr
= (struct ieee80211_hdr
*) skb
->data
;
668 hdrlen
= hostap_80211_get_hdrlen(le16_to_cpu(hdr
->frame_ctl
));
670 atomic_inc(&crypt
->refcnt
);
671 res
= crypt
->ops
->decrypt_msdu(skb
, keyidx
, hdrlen
, crypt
->priv
);
672 atomic_dec(&crypt
->refcnt
);
674 printk(KERN_DEBUG
"%s: MSDU decryption/MIC verification failed"
675 " (SA=" MACSTR
" keyidx=%d)\n",
676 local
->dev
->name
, MAC2STR(hdr
->addr2
), keyidx
);
684 /* All received frames are sent to this function. @skb contains the frame in
685 * IEEE 802.11 format, i.e., in the format it was sent over air.
686 * This function is called only as a tasklet (software IRQ). */
687 void hostap_80211_rx(struct net_device
*dev
, struct sk_buff
*skb
,
688 struct hostap_80211_rx_status
*rx_stats
)
690 struct hostap_interface
*iface
;
692 struct ieee80211_hdr
*hdr
;
694 u16 fc
, type
, stype
, sc
;
695 struct net_device
*wds
= NULL
;
696 struct net_device_stats
*stats
;
699 struct sk_buff
*skb2
= NULL
;
701 int frame_authorized
= 0;
702 int from_assoc_ap
= 0;
705 struct ieee80211_crypt_data
*crypt
= NULL
;
709 iface
= netdev_priv(dev
);
710 local
= iface
->local
;
711 iface
->stats
.rx_packets
++;
712 iface
->stats
.rx_bytes
+= skb
->len
;
714 /* dev is the master radio device; change this to be the default
715 * virtual interface (this may be changed to WDS device below) */
717 iface
= netdev_priv(dev
);
719 hdr
= (struct ieee80211_hdr
*) skb
->data
;
720 stats
= hostap_get_stats(dev
);
725 fc
= le16_to_cpu(hdr
->frame_ctl
);
726 type
= WLAN_FC_GET_TYPE(fc
);
727 stype
= WLAN_FC_GET_STYPE(fc
);
728 sc
= le16_to_cpu(hdr
->seq_ctl
);
729 frag
= WLAN_GET_SEQ_FRAG(sc
);
730 hdrlen
= hostap_80211_get_hdrlen(fc
);
732 /* Put this code here so that we avoid duplicating it in all
733 * Rx paths. - Jean II */
734 #ifdef IW_WIRELESS_SPY /* defined in iw_handler.h */
735 /* If spy monitoring on */
736 if (iface
->spy_data
.spy_number
> 0) {
737 struct iw_quality wstats
;
738 wstats
.level
= rx_stats
->signal
;
739 wstats
.noise
= rx_stats
->noise
;
740 wstats
.updated
= 6; /* No qual value */
741 /* Update spy records */
742 wireless_spy_update(dev
, hdr
->addr2
, &wstats
);
744 #endif /* IW_WIRELESS_SPY */
745 hostap_update_rx_stats(local
->ap
, hdr
, rx_stats
);
747 if (local
->iw_mode
== IW_MODE_MONITOR
) {
748 monitor_rx(dev
, skb
, rx_stats
);
752 if (local
->host_decrypt
) {
754 if (skb
->len
>= hdrlen
+ 3)
755 idx
= skb
->data
[hdrlen
+ 3] >> 6;
756 crypt
= local
->crypt
[idx
];
759 /* Use station specific key to override default keys if the
760 * receiver address is a unicast address ("individual RA"). If
761 * bcrx_sta_key parameter is set, station specific key is used
762 * even with broad/multicast targets (this is against IEEE
763 * 802.11, but makes it easier to use different keys with
764 * stations that do not support WEP key mapping). */
766 if (!(hdr
->addr1
[0] & 0x01) || local
->bcrx_sta_key
)
767 (void) hostap_handle_sta_crypto(local
, hdr
, &crypt
,
770 /* allow NULL decrypt to indicate an station specific override
771 * for default encryption */
772 if (crypt
&& (crypt
->ops
== NULL
||
773 crypt
->ops
->decrypt_mpdu
== NULL
))
776 if (!crypt
&& (fc
& IEEE80211_FCTL_PROTECTED
)) {
778 /* This seems to be triggered by some (multicast?)
779 * frames from other than current BSS, so just drop the
780 * frames silently instead of filling system log with
782 printk(KERN_DEBUG
"%s: WEP decryption failed (not set)"
783 " (SA=" MACSTR
")\n",
784 local
->dev
->name
, MAC2STR(hdr
->addr2
));
786 local
->comm_tallies
.rx_discards_wep_undecryptable
++;
791 if (type
!= IEEE80211_FTYPE_DATA
) {
792 if (type
== IEEE80211_FTYPE_MGMT
&&
793 stype
== IEEE80211_STYPE_AUTH
&&
794 fc
& IEEE80211_FCTL_PROTECTED
&& local
->host_decrypt
&&
795 (keyidx
= hostap_rx_frame_decrypt(local
, skb
, crypt
)) < 0)
797 printk(KERN_DEBUG
"%s: failed to decrypt mgmt::auth "
798 "from " MACSTR
"\n", dev
->name
,
799 MAC2STR(hdr
->addr2
));
800 /* TODO: could inform hostapd about this so that it
801 * could send auth failure report */
805 if (hostap_rx_frame_mgmt(local
, skb
, rx_stats
, type
, stype
))
811 /* Data frame - extract src/dst addresses */
812 if (skb
->len
< IEEE80211_DATA_HDR3_LEN
)
815 switch (fc
& (IEEE80211_FCTL_FROMDS
| IEEE80211_FCTL_TODS
)) {
816 case IEEE80211_FCTL_FROMDS
:
817 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
818 memcpy(src
, hdr
->addr3
, ETH_ALEN
);
820 case IEEE80211_FCTL_TODS
:
821 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
822 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
824 case IEEE80211_FCTL_FROMDS
| IEEE80211_FCTL_TODS
:
825 if (skb
->len
< IEEE80211_DATA_HDR4_LEN
)
827 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
828 memcpy(src
, hdr
->addr4
, ETH_ALEN
);
831 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
832 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
836 if (hostap_rx_frame_wds(local
, hdr
, fc
, &wds
))
839 skb
->dev
= dev
= wds
;
840 stats
= hostap_get_stats(dev
);
843 if (local
->iw_mode
== IW_MODE_MASTER
&& !wds
&&
844 (fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) ==
845 IEEE80211_FCTL_FROMDS
&&
847 memcmp(hdr
->addr2
, local
->assoc_ap_addr
, ETH_ALEN
) == 0) {
848 /* Frame from BSSID of the AP for which we are a client */
849 skb
->dev
= dev
= local
->stadev
;
850 stats
= hostap_get_stats(dev
);
854 dev
->last_rx
= jiffies
;
856 if ((local
->iw_mode
== IW_MODE_MASTER
||
857 local
->iw_mode
== IW_MODE_REPEAT
) &&
859 switch (hostap_handle_sta_rx(local
, dev
, skb
, rx_stats
,
861 case AP_RX_CONTINUE_NOT_AUTHORIZED
:
862 frame_authorized
= 0;
865 frame_authorized
= 1;
874 /* Nullfunc frames may have PS-bit set, so they must be passed to
875 * hostap_handle_sta_rx() before being dropped here. */
876 if (stype
!= IEEE80211_STYPE_DATA
&&
877 stype
!= IEEE80211_STYPE_DATA_CFACK
&&
878 stype
!= IEEE80211_STYPE_DATA_CFPOLL
&&
879 stype
!= IEEE80211_STYPE_DATA_CFACKPOLL
) {
880 if (stype
!= IEEE80211_STYPE_NULLFUNC
)
881 printk(KERN_DEBUG
"%s: RX: dropped data frame "
882 "with no data (type=0x%02x, subtype=0x%02x)\n",
883 dev
->name
, type
>> 2, stype
>> 4);
887 /* skb: hdr + (possibly fragmented, possibly encrypted) payload */
889 if (local
->host_decrypt
&& (fc
& IEEE80211_FCTL_PROTECTED
) &&
890 (keyidx
= hostap_rx_frame_decrypt(local
, skb
, crypt
)) < 0)
892 hdr
= (struct ieee80211_hdr
*) skb
->data
;
894 /* skb: hdr + (possibly fragmented) plaintext payload */
896 if (local
->host_decrypt
&& (fc
& IEEE80211_FCTL_PROTECTED
) &&
897 (frag
!= 0 || (fc
& IEEE80211_FCTL_MOREFRAGS
))) {
899 struct sk_buff
*frag_skb
=
900 prism2_frag_cache_get(local
, hdr
);
902 printk(KERN_DEBUG
"%s: Rx cannot get skb from "
903 "fragment cache (morefrag=%d seq=%u frag=%u)\n",
904 dev
->name
, (fc
& IEEE80211_FCTL_MOREFRAGS
) != 0,
905 WLAN_GET_SEQ_SEQ(sc
) >> 4, frag
);
913 if (frag_skb
->tail
+ flen
> frag_skb
->end
) {
914 printk(KERN_WARNING
"%s: host decrypted and "
915 "reassembled frame did not fit skb\n",
917 prism2_frag_cache_invalidate(local
, hdr
);
922 /* copy first fragment (including full headers) into
923 * beginning of the fragment cache skb */
924 memcpy(skb_put(frag_skb
, flen
), skb
->data
, flen
);
926 /* append frame payload to the end of the fragment
928 memcpy(skb_put(frag_skb
, flen
), skb
->data
+ hdrlen
,
934 if (fc
& IEEE80211_FCTL_MOREFRAGS
) {
935 /* more fragments expected - leave the skb in fragment
936 * cache for now; it will be delivered to upper layers
937 * after all fragments have been received */
941 /* this was the last fragment and the frame will be
942 * delivered, so remove skb from fragment cache */
944 hdr
= (struct ieee80211_hdr
*) skb
->data
;
945 prism2_frag_cache_invalidate(local
, hdr
);
948 /* skb: hdr + (possible reassembled) full MSDU payload; possibly still
949 * encrypted/authenticated */
951 if (local
->host_decrypt
&& (fc
& IEEE80211_FCTL_PROTECTED
) &&
952 hostap_rx_frame_decrypt_msdu(local
, skb
, keyidx
, crypt
))
955 hdr
= (struct ieee80211_hdr
*) skb
->data
;
956 if (crypt
&& !(fc
& IEEE80211_FCTL_PROTECTED
) && !local
->open_wep
) {
957 if (local
->ieee_802_1x
&&
958 hostap_is_eapol_frame(local
, skb
)) {
959 /* pass unencrypted EAPOL frames even if encryption is
961 PDEBUG(DEBUG_EXTRA2
, "%s: RX: IEEE 802.1X - passing "
962 "unencrypted EAPOL frame\n", local
->dev
->name
);
964 printk(KERN_DEBUG
"%s: encryption configured, but RX "
965 "frame not encrypted (SA=" MACSTR
")\n",
966 local
->dev
->name
, MAC2STR(hdr
->addr2
));
971 if (local
->drop_unencrypted
&& !(fc
& IEEE80211_FCTL_PROTECTED
) &&
972 !hostap_is_eapol_frame(local
, skb
)) {
973 if (net_ratelimit()) {
974 printk(KERN_DEBUG
"%s: dropped unencrypted RX data "
975 "frame from " MACSTR
" (drop_unencrypted=1)\n",
976 dev
->name
, MAC2STR(hdr
->addr2
));
981 /* skb: hdr + (possible reassembled) full plaintext payload */
983 payload
= skb
->data
+ hdrlen
;
984 ethertype
= (payload
[6] << 8) | payload
[7];
986 /* If IEEE 802.1X is used, check whether the port is authorized to send
987 * the received frame. */
988 if (local
->ieee_802_1x
&& local
->iw_mode
== IW_MODE_MASTER
) {
989 if (ethertype
== ETH_P_PAE
) {
990 PDEBUG(DEBUG_EXTRA2
, "%s: RX: IEEE 802.1X frame\n",
992 if (local
->hostapd
&& local
->apdev
) {
993 /* Send IEEE 802.1X frames to the user
994 * space daemon for processing */
995 prism2_rx_80211(local
->apdev
, skb
, rx_stats
,
997 local
->apdevstats
.rx_packets
++;
998 local
->apdevstats
.rx_bytes
+= skb
->len
;
1001 } else if (!frame_authorized
) {
1002 printk(KERN_DEBUG
"%s: dropped frame from "
1003 "unauthorized port (IEEE 802.1X): "
1004 "ethertype=0x%04x\n",
1005 dev
->name
, ethertype
);
1010 /* convert hdr + possible LLC headers into Ethernet header */
1011 if (skb
->len
- hdrlen
>= 8 &&
1012 ((memcmp(payload
, rfc1042_header
, 6) == 0 &&
1013 ethertype
!= ETH_P_AARP
&& ethertype
!= ETH_P_IPX
) ||
1014 memcmp(payload
, bridge_tunnel_header
, 6) == 0)) {
1015 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1016 * replace EtherType */
1017 skb_pull(skb
, hdrlen
+ 6);
1018 memcpy(skb_push(skb
, ETH_ALEN
), src
, ETH_ALEN
);
1019 memcpy(skb_push(skb
, ETH_ALEN
), dst
, ETH_ALEN
);
1022 /* Leave Ethernet header part of hdr and full payload */
1023 skb_pull(skb
, hdrlen
);
1024 len
= htons(skb
->len
);
1025 memcpy(skb_push(skb
, 2), &len
, 2);
1026 memcpy(skb_push(skb
, ETH_ALEN
), src
, ETH_ALEN
);
1027 memcpy(skb_push(skb
, ETH_ALEN
), dst
, ETH_ALEN
);
1030 if (wds
&& ((fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) ==
1031 IEEE80211_FCTL_TODS
) &&
1032 skb
->len
>= ETH_HLEN
+ ETH_ALEN
) {
1033 /* Non-standard frame: get addr4 from its bogus location after
1035 memcpy(skb
->data
+ ETH_ALEN
,
1036 skb
->data
+ skb
->len
- ETH_ALEN
, ETH_ALEN
);
1037 skb_trim(skb
, skb
->len
- ETH_ALEN
);
1040 stats
->rx_packets
++;
1041 stats
->rx_bytes
+= skb
->len
;
1043 if (local
->iw_mode
== IW_MODE_MASTER
&& !wds
&&
1044 local
->ap
->bridge_packets
) {
1045 if (dst
[0] & 0x01) {
1046 /* copy multicast frame both to the higher layers and
1047 * to the wireless media */
1048 local
->ap
->bridged_multicast
++;
1049 skb2
= skb_clone(skb
, GFP_ATOMIC
);
1051 printk(KERN_DEBUG
"%s: skb_clone failed for "
1052 "multicast frame\n", dev
->name
);
1053 } else if (hostap_is_sta_authorized(local
->ap
, dst
)) {
1054 /* send frame directly to the associated STA using
1055 * wireless media and not passing to higher layers */
1056 local
->ap
->bridged_unicast
++;
1063 /* send to wireless media */
1064 skb2
->protocol
= __constant_htons(ETH_P_802_3
);
1065 skb2
->mac
.raw
= skb2
->nh
.raw
= skb2
->data
;
1066 /* skb2->nh.raw = skb2->data + ETH_HLEN; */
1068 dev_queue_xmit(skb2
);
1072 skb
->protocol
= eth_type_trans(skb
, dev
);
1073 memset(skb
->cb
, 0, sizeof(skb
->cb
));
1080 hostap_handle_sta_release(sta
);
1086 stats
->rx_dropped
++;
1091 EXPORT_SYMBOL(hostap_80211_rx
);