]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/mac80211/rx.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
[MAC80211]: remove turbo modes
[mirror_ubuntu-bionic-kernel.git] / net / mac80211 / rx.c
1 /*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
12 #include <linux/kernel.h>
13 #include <linux/skbuff.h>
14 #include <linux/netdevice.h>
15 #include <linux/etherdevice.h>
16 #include <linux/rcupdate.h>
17 #include <net/mac80211.h>
18 #include <net/ieee80211_radiotap.h>
19
20 #include "ieee80211_i.h"
21 #include "ieee80211_led.h"
22 #include "ieee80211_common.h"
23 #include "wep.h"
24 #include "wpa.h"
25 #include "tkip.h"
26 #include "wme.h"
27
28 /* pre-rx handlers
29 *
30 * these don't have dev/sdata fields in the rx data
31 * The sta value should also not be used because it may
32 * be NULL even though a STA (in IBSS mode) will be added.
33 */
34
35 static ieee80211_txrx_result
36 ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data *rx)
37 {
38 u8 *data = rx->skb->data;
39 int tid;
40
41 /* does the frame have a qos control field? */
42 if (WLAN_FC_IS_QOS_DATA(rx->fc)) {
43 u8 *qc = data + ieee80211_get_hdrlen(rx->fc) - QOS_CONTROL_LEN;
44 /* frame has qos control */
45 tid = qc[0] & QOS_CONTROL_TID_MASK;
46 } else {
47 if (unlikely((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)) {
48 /* Separate TID for management frames */
49 tid = NUM_RX_DATA_QUEUES - 1;
50 } else {
51 /* no qos control present */
52 tid = 0; /* 802.1d - Best Effort */
53 }
54 }
55
56 I802_DEBUG_INC(rx->local->wme_rx_queue[tid]);
57 /* only a debug counter, sta might not be assigned properly yet */
58 if (rx->sta)
59 I802_DEBUG_INC(rx->sta->wme_rx_queue[tid]);
60
61 rx->u.rx.queue = tid;
62 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
63 * For now, set skb->priority to 0 for other cases. */
64 rx->skb->priority = (tid > 7) ? 0 : tid;
65
66 return TXRX_CONTINUE;
67 }
68
69 static ieee80211_txrx_result
70 ieee80211_rx_h_load_stats(struct ieee80211_txrx_data *rx)
71 {
72 struct ieee80211_local *local = rx->local;
73 struct sk_buff *skb = rx->skb;
74 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
75 u32 load = 0, hdrtime;
76 struct ieee80211_rate *rate;
77 struct ieee80211_hw_mode *mode = local->hw.conf.mode;
78 int i;
79
80 /* Estimate total channel use caused by this frame */
81
82 if (unlikely(mode->num_rates < 0))
83 return TXRX_CONTINUE;
84
85 rate = &mode->rates[0];
86 for (i = 0; i < mode->num_rates; i++) {
87 if (mode->rates[i].val == rx->u.rx.status->rate) {
88 rate = &mode->rates[i];
89 break;
90 }
91 }
92
93 /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
94 * 1 usec = 1/8 * (1080 / 10) = 13.5 */
95
96 if (mode->mode == MODE_IEEE80211A ||
97 (mode->mode == MODE_IEEE80211G &&
98 rate->flags & IEEE80211_RATE_ERP))
99 hdrtime = CHAN_UTIL_HDR_SHORT;
100 else
101 hdrtime = CHAN_UTIL_HDR_LONG;
102
103 load = hdrtime;
104 if (!is_multicast_ether_addr(hdr->addr1))
105 load += hdrtime;
106
107 load += skb->len * rate->rate_inv;
108
109 /* Divide channel_use by 8 to avoid wrapping around the counter */
110 load >>= CHAN_UTIL_SHIFT;
111 local->channel_use_raw += load;
112 rx->u.rx.load = load;
113
114 return TXRX_CONTINUE;
115 }
116
117 ieee80211_rx_handler ieee80211_rx_pre_handlers[] =
118 {
119 ieee80211_rx_h_parse_qos,
120 ieee80211_rx_h_load_stats,
121 NULL
122 };
123
124 /* rx handlers */
125
126 static ieee80211_txrx_result
127 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data *rx)
128 {
129 if (rx->sta)
130 rx->sta->channel_use_raw += rx->u.rx.load;
131 rx->sdata->channel_use_raw += rx->u.rx.load;
132 return TXRX_CONTINUE;
133 }
134
135 static void
136 ieee80211_rx_monitor(struct net_device *dev, struct sk_buff *skb,
137 struct ieee80211_rx_status *status)
138 {
139 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
140 struct ieee80211_sub_if_data *sdata;
141 struct ieee80211_rate *rate;
142 struct ieee80211_rtap_hdr {
143 struct ieee80211_radiotap_header hdr;
144 u8 flags;
145 u8 rate;
146 __le16 chan_freq;
147 __le16 chan_flags;
148 u8 antsignal;
149 } __attribute__ ((packed)) *rthdr;
150
151 skb->dev = dev;
152
153 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
154
155 if (status->flag & RX_FLAG_RADIOTAP)
156 goto out;
157
158 if (skb_headroom(skb) < sizeof(*rthdr)) {
159 I802_DEBUG_INC(local->rx_expand_skb_head);
160 if (pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC)) {
161 dev_kfree_skb(skb);
162 return;
163 }
164 }
165
166 rthdr = (struct ieee80211_rtap_hdr *) skb_push(skb, sizeof(*rthdr));
167 memset(rthdr, 0, sizeof(*rthdr));
168 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
169 rthdr->hdr.it_present =
170 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
171 (1 << IEEE80211_RADIOTAP_RATE) |
172 (1 << IEEE80211_RADIOTAP_CHANNEL) |
173 (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL));
174 rthdr->flags = local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS ?
175 IEEE80211_RADIOTAP_F_FCS : 0;
176 rate = ieee80211_get_rate(local, status->phymode, status->rate);
177 if (rate)
178 rthdr->rate = rate->rate / 5;
179 rthdr->chan_freq = cpu_to_le16(status->freq);
180 rthdr->chan_flags =
181 status->phymode == MODE_IEEE80211A ?
182 cpu_to_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ) :
183 cpu_to_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ);
184 rthdr->antsignal = status->ssi;
185
186 out:
187 sdata->stats.rx_packets++;
188 sdata->stats.rx_bytes += skb->len;
189
190 skb_set_mac_header(skb, 0);
191 skb->ip_summed = CHECKSUM_UNNECESSARY;
192 skb->pkt_type = PACKET_OTHERHOST;
193 skb->protocol = htons(ETH_P_802_2);
194 memset(skb->cb, 0, sizeof(skb->cb));
195 netif_rx(skb);
196 }
197
198 static ieee80211_txrx_result
199 ieee80211_rx_h_monitor(struct ieee80211_txrx_data *rx)
200 {
201 if (rx->sdata->type == IEEE80211_IF_TYPE_MNTR) {
202 ieee80211_rx_monitor(rx->dev, rx->skb, rx->u.rx.status);
203 return TXRX_QUEUED;
204 }
205
206 if (rx->u.rx.status->flag & RX_FLAG_RADIOTAP)
207 skb_pull(rx->skb, ieee80211_get_radiotap_len(rx->skb->data));
208
209 return TXRX_CONTINUE;
210 }
211
212 static ieee80211_txrx_result
213 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx)
214 {
215 struct ieee80211_local *local = rx->local;
216 struct sk_buff *skb = rx->skb;
217
218 if (unlikely(local->sta_scanning != 0)) {
219 ieee80211_sta_rx_scan(rx->dev, skb, rx->u.rx.status);
220 return TXRX_QUEUED;
221 }
222
223 if (unlikely(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) {
224 /* scanning finished during invoking of handlers */
225 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
226 return TXRX_DROP;
227 }
228
229 return TXRX_CONTINUE;
230 }
231
232 static ieee80211_txrx_result
233 ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
234 {
235 struct ieee80211_hdr *hdr;
236 hdr = (struct ieee80211_hdr *) rx->skb->data;
237
238 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
239 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
240 if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
241 rx->sta->last_seq_ctrl[rx->u.rx.queue] ==
242 hdr->seq_ctrl)) {
243 if (rx->flags & IEEE80211_TXRXD_RXRA_MATCH) {
244 rx->local->dot11FrameDuplicateCount++;
245 rx->sta->num_duplicates++;
246 }
247 return TXRX_DROP;
248 } else
249 rx->sta->last_seq_ctrl[rx->u.rx.queue] = hdr->seq_ctrl;
250 }
251
252 if ((rx->local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) &&
253 rx->skb->len > FCS_LEN)
254 skb_trim(rx->skb, rx->skb->len - FCS_LEN);
255
256 if (unlikely(rx->skb->len < 16)) {
257 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
258 return TXRX_DROP;
259 }
260
261 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
262 rx->skb->pkt_type = PACKET_OTHERHOST;
263 else if (compare_ether_addr(rx->dev->dev_addr, hdr->addr1) == 0)
264 rx->skb->pkt_type = PACKET_HOST;
265 else if (is_multicast_ether_addr(hdr->addr1)) {
266 if (is_broadcast_ether_addr(hdr->addr1))
267 rx->skb->pkt_type = PACKET_BROADCAST;
268 else
269 rx->skb->pkt_type = PACKET_MULTICAST;
270 } else
271 rx->skb->pkt_type = PACKET_OTHERHOST;
272
273 /* Drop disallowed frame classes based on STA auth/assoc state;
274 * IEEE 802.11, Chap 5.5.
275 *
276 * 80211.o does filtering only based on association state, i.e., it
277 * drops Class 3 frames from not associated stations. hostapd sends
278 * deauth/disassoc frames when needed. In addition, hostapd is
279 * responsible for filtering on both auth and assoc states.
280 */
281 if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
282 ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
283 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
284 rx->sdata->type != IEEE80211_IF_TYPE_IBSS &&
285 (!rx->sta || !(rx->sta->flags & WLAN_STA_ASSOC)))) {
286 if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
287 !(rx->fc & IEEE80211_FCTL_TODS) &&
288 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
289 || !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
290 /* Drop IBSS frames and frames for other hosts
291 * silently. */
292 return TXRX_DROP;
293 }
294
295 if (!rx->local->apdev)
296 return TXRX_DROP;
297
298 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
299 ieee80211_msg_sta_not_assoc);
300 return TXRX_QUEUED;
301 }
302
303 return TXRX_CONTINUE;
304 }
305
306
307 static ieee80211_txrx_result
308 ieee80211_rx_h_load_key(struct ieee80211_txrx_data *rx)
309 {
310 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
311 int keyidx;
312 int hdrlen;
313 struct ieee80211_key *stakey = NULL;
314
315 /*
316 * Key selection 101
317 *
318 * There are three types of keys:
319 * - GTK (group keys)
320 * - PTK (pairwise keys)
321 * - STK (station-to-station pairwise keys)
322 *
323 * When selecting a key, we have to distinguish between multicast
324 * (including broadcast) and unicast frames, the latter can only
325 * use PTKs and STKs while the former always use GTKs. Unless, of
326 * course, actual WEP keys ("pre-RSNA") are used, then unicast
327 * frames can also use key indizes like GTKs. Hence, if we don't
328 * have a PTK/STK we check the key index for a WEP key.
329 *
330 * Note that in a regular BSS, multicast frames are sent by the
331 * AP only, associated stations unicast the frame to the AP first
332 * which then multicasts it on their behalf.
333 *
334 * There is also a slight problem in IBSS mode: GTKs are negotiated
335 * with each station, that is something we don't currently handle.
336 * The spec seems to expect that one negotiates the same key with
337 * every station but there's no such requirement; VLANs could be
338 * possible.
339 */
340
341 if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
342 return TXRX_CONTINUE;
343
344 /*
345 * No point in finding a key if the frame is neither
346 * addressed to us nor a multicast frame.
347 */
348 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
349 return TXRX_CONTINUE;
350
351 if (rx->sta)
352 stakey = rcu_dereference(rx->sta->key);
353
354 if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
355 rx->key = stakey;
356 } else {
357 /*
358 * The device doesn't give us the IV so we won't be
359 * able to look up the key. That's ok though, we
360 * don't need to decrypt the frame, we just won't
361 * be able to keep statistics accurate.
362 * Except for key threshold notifications, should
363 * we somehow allow the driver to tell us which key
364 * the hardware used if this flag is set?
365 */
366 if (!(rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV))
367 return TXRX_CONTINUE;
368
369 hdrlen = ieee80211_get_hdrlen(rx->fc);
370
371 if (rx->skb->len < 8 + hdrlen)
372 return TXRX_DROP; /* TODO: count this? */
373
374 /*
375 * no need to call ieee80211_wep_get_keyidx,
376 * it verifies a bunch of things we've done already
377 */
378 keyidx = rx->skb->data[hdrlen + 3] >> 6;
379
380 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
381
382 /*
383 * RSNA-protected unicast frames should always be sent with
384 * pairwise or station-to-station keys, but for WEP we allow
385 * using a key index as well.
386 */
387 if (rx->key && rx->key->conf.alg != ALG_WEP &&
388 !is_multicast_ether_addr(hdr->addr1))
389 rx->key = NULL;
390 }
391
392 if (rx->key) {
393 rx->key->tx_rx_count++;
394 if (unlikely(rx->local->key_tx_rx_threshold &&
395 rx->key->tx_rx_count >
396 rx->local->key_tx_rx_threshold)) {
397 ieee80211_key_threshold_notify(rx->dev, rx->key,
398 rx->sta);
399 }
400 }
401
402 return TXRX_CONTINUE;
403 }
404
405 static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
406 {
407 struct ieee80211_sub_if_data *sdata;
408 sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
409
410 if (sdata->bss)
411 atomic_inc(&sdata->bss->num_sta_ps);
412 sta->flags |= WLAN_STA_PS;
413 sta->pspoll = 0;
414 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
415 printk(KERN_DEBUG "%s: STA " MAC_FMT " aid %d enters power "
416 "save mode\n", dev->name, MAC_ARG(sta->addr), sta->aid);
417 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
418 }
419
420 static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
421 {
422 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
423 struct sk_buff *skb;
424 int sent = 0;
425 struct ieee80211_sub_if_data *sdata;
426 struct ieee80211_tx_packet_data *pkt_data;
427
428 sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
429 if (sdata->bss)
430 atomic_dec(&sdata->bss->num_sta_ps);
431 sta->flags &= ~(WLAN_STA_PS | WLAN_STA_TIM);
432 sta->pspoll = 0;
433 if (!skb_queue_empty(&sta->ps_tx_buf)) {
434 if (local->ops->set_tim)
435 local->ops->set_tim(local_to_hw(local), sta->aid, 0);
436 if (sdata->bss)
437 bss_tim_clear(local, sdata->bss, sta->aid);
438 }
439 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
440 printk(KERN_DEBUG "%s: STA " MAC_FMT " aid %d exits power "
441 "save mode\n", dev->name, MAC_ARG(sta->addr), sta->aid);
442 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
443 /* Send all buffered frames to the station */
444 while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
445 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
446 sent++;
447 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
448 dev_queue_xmit(skb);
449 }
450 while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
451 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
452 local->total_ps_buffered--;
453 sent++;
454 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
455 printk(KERN_DEBUG "%s: STA " MAC_FMT " aid %d send PS frame "
456 "since STA not sleeping anymore\n", dev->name,
457 MAC_ARG(sta->addr), sta->aid);
458 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
459 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
460 dev_queue_xmit(skb);
461 }
462
463 return sent;
464 }
465
466 static ieee80211_txrx_result
467 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
468 {
469 struct sta_info *sta = rx->sta;
470 struct net_device *dev = rx->dev;
471 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
472
473 if (!sta)
474 return TXRX_CONTINUE;
475
476 /* Update last_rx only for IBSS packets which are for the current
477 * BSSID to avoid keeping the current IBSS network alive in cases where
478 * other STAs are using different BSSID. */
479 if (rx->sdata->type == IEEE80211_IF_TYPE_IBSS) {
480 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len);
481 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
482 sta->last_rx = jiffies;
483 } else
484 if (!is_multicast_ether_addr(hdr->addr1) ||
485 rx->sdata->type == IEEE80211_IF_TYPE_STA) {
486 /* Update last_rx only for unicast frames in order to prevent
487 * the Probe Request frames (the only broadcast frames from a
488 * STA in infrastructure mode) from keeping a connection alive.
489 */
490 sta->last_rx = jiffies;
491 }
492
493 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
494 return TXRX_CONTINUE;
495
496 sta->rx_fragments++;
497 sta->rx_bytes += rx->skb->len;
498 sta->last_rssi = rx->u.rx.status->ssi;
499 sta->last_signal = rx->u.rx.status->signal;
500 sta->last_noise = rx->u.rx.status->noise;
501
502 if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
503 /* Change STA power saving mode only in the end of a frame
504 * exchange sequence */
505 if ((sta->flags & WLAN_STA_PS) && !(rx->fc & IEEE80211_FCTL_PM))
506 rx->u.rx.sent_ps_buffered += ap_sta_ps_end(dev, sta);
507 else if (!(sta->flags & WLAN_STA_PS) &&
508 (rx->fc & IEEE80211_FCTL_PM))
509 ap_sta_ps_start(dev, sta);
510 }
511
512 /* Drop data::nullfunc frames silently, since they are used only to
513 * control station power saving mode. */
514 if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
515 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
516 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
517 /* Update counter and free packet here to avoid counting this
518 * as a dropped packed. */
519 sta->rx_packets++;
520 dev_kfree_skb(rx->skb);
521 return TXRX_QUEUED;
522 }
523
524 return TXRX_CONTINUE;
525 } /* ieee80211_rx_h_sta_process */
526
527 static ieee80211_txrx_result
528 ieee80211_rx_h_wep_weak_iv_detection(struct ieee80211_txrx_data *rx)
529 {
530 if (!rx->sta || !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
531 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
532 !rx->key || rx->key->conf.alg != ALG_WEP ||
533 !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
534 return TXRX_CONTINUE;
535
536 /* Check for weak IVs, if hwaccel did not remove IV from the frame */
537 if ((rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV) ||
538 !(rx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
539 if (ieee80211_wep_is_weak_iv(rx->skb, rx->key))
540 rx->sta->wep_weak_iv_count++;
541
542 return TXRX_CONTINUE;
543 }
544
545 static ieee80211_txrx_result
546 ieee80211_rx_h_wep_decrypt(struct ieee80211_txrx_data *rx)
547 {
548 if ((rx->key && rx->key->conf.alg != ALG_WEP) ||
549 !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
550 ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
551 ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
552 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)))
553 return TXRX_CONTINUE;
554
555 if (!rx->key) {
556 if (net_ratelimit())
557 printk(KERN_DEBUG "%s: RX WEP frame, but no key set\n",
558 rx->dev->name);
559 return TXRX_DROP;
560 }
561
562 if (!(rx->u.rx.status->flag & RX_FLAG_DECRYPTED) ||
563 !(rx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
564 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key)) {
565 if (net_ratelimit())
566 printk(KERN_DEBUG "%s: RX WEP frame, decrypt "
567 "failed\n", rx->dev->name);
568 return TXRX_DROP;
569 }
570 } else if (rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV) {
571 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
572 /* remove ICV */
573 skb_trim(rx->skb, rx->skb->len - 4);
574 }
575
576 return TXRX_CONTINUE;
577 }
578
579 static inline struct ieee80211_fragment_entry *
580 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
581 unsigned int frag, unsigned int seq, int rx_queue,
582 struct sk_buff **skb)
583 {
584 struct ieee80211_fragment_entry *entry;
585 int idx;
586
587 idx = sdata->fragment_next;
588 entry = &sdata->fragments[sdata->fragment_next++];
589 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
590 sdata->fragment_next = 0;
591
592 if (!skb_queue_empty(&entry->skb_list)) {
593 #ifdef CONFIG_MAC80211_DEBUG
594 struct ieee80211_hdr *hdr =
595 (struct ieee80211_hdr *) entry->skb_list.next->data;
596 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
597 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
598 "addr1=" MAC_FMT " addr2=" MAC_FMT "\n",
599 sdata->dev->name, idx,
600 jiffies - entry->first_frag_time, entry->seq,
601 entry->last_frag, MAC_ARG(hdr->addr1),
602 MAC_ARG(hdr->addr2));
603 #endif /* CONFIG_MAC80211_DEBUG */
604 __skb_queue_purge(&entry->skb_list);
605 }
606
607 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
608 *skb = NULL;
609 entry->first_frag_time = jiffies;
610 entry->seq = seq;
611 entry->rx_queue = rx_queue;
612 entry->last_frag = frag;
613 entry->ccmp = 0;
614 entry->extra_len = 0;
615
616 return entry;
617 }
618
619 static inline struct ieee80211_fragment_entry *
620 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
621 u16 fc, unsigned int frag, unsigned int seq,
622 int rx_queue, struct ieee80211_hdr *hdr)
623 {
624 struct ieee80211_fragment_entry *entry;
625 int i, idx;
626
627 idx = sdata->fragment_next;
628 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
629 struct ieee80211_hdr *f_hdr;
630 u16 f_fc;
631
632 idx--;
633 if (idx < 0)
634 idx = IEEE80211_FRAGMENT_MAX - 1;
635
636 entry = &sdata->fragments[idx];
637 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
638 entry->rx_queue != rx_queue ||
639 entry->last_frag + 1 != frag)
640 continue;
641
642 f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
643 f_fc = le16_to_cpu(f_hdr->frame_control);
644
645 if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
646 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
647 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
648 continue;
649
650 if (entry->first_frag_time + 2 * HZ < jiffies) {
651 __skb_queue_purge(&entry->skb_list);
652 continue;
653 }
654 return entry;
655 }
656
657 return NULL;
658 }
659
660 static ieee80211_txrx_result
661 ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
662 {
663 struct ieee80211_hdr *hdr;
664 u16 sc;
665 unsigned int frag, seq;
666 struct ieee80211_fragment_entry *entry;
667 struct sk_buff *skb;
668
669 hdr = (struct ieee80211_hdr *) rx->skb->data;
670 sc = le16_to_cpu(hdr->seq_ctrl);
671 frag = sc & IEEE80211_SCTL_FRAG;
672
673 if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
674 (rx->skb)->len < 24 ||
675 is_multicast_ether_addr(hdr->addr1))) {
676 /* not fragmented */
677 goto out;
678 }
679 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
680
681 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
682
683 if (frag == 0) {
684 /* This is the first fragment of a new frame. */
685 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
686 rx->u.rx.queue, &(rx->skb));
687 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
688 (rx->fc & IEEE80211_FCTL_PROTECTED)) {
689 /* Store CCMP PN so that we can verify that the next
690 * fragment has a sequential PN value. */
691 entry->ccmp = 1;
692 memcpy(entry->last_pn,
693 rx->key->u.ccmp.rx_pn[rx->u.rx.queue],
694 CCMP_PN_LEN);
695 }
696 return TXRX_QUEUED;
697 }
698
699 /* This is a fragment for a frame that should already be pending in
700 * fragment cache. Add this fragment to the end of the pending entry.
701 */
702 entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
703 rx->u.rx.queue, hdr);
704 if (!entry) {
705 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
706 return TXRX_DROP;
707 }
708
709 /* Verify that MPDUs within one MSDU have sequential PN values.
710 * (IEEE 802.11i, 8.3.3.4.5) */
711 if (entry->ccmp) {
712 int i;
713 u8 pn[CCMP_PN_LEN], *rpn;
714 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
715 return TXRX_DROP;
716 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
717 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
718 pn[i]++;
719 if (pn[i])
720 break;
721 }
722 rpn = rx->key->u.ccmp.rx_pn[rx->u.rx.queue];
723 if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) {
724 if (net_ratelimit())
725 printk(KERN_DEBUG "%s: defrag: CCMP PN not "
726 "sequential A2=" MAC_FMT
727 " PN=%02x%02x%02x%02x%02x%02x "
728 "(expected %02x%02x%02x%02x%02x%02x)\n",
729 rx->dev->name, MAC_ARG(hdr->addr2),
730 rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
731 rpn[5], pn[0], pn[1], pn[2], pn[3],
732 pn[4], pn[5]);
733 return TXRX_DROP;
734 }
735 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
736 }
737
738 skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
739 __skb_queue_tail(&entry->skb_list, rx->skb);
740 entry->last_frag = frag;
741 entry->extra_len += rx->skb->len;
742 if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
743 rx->skb = NULL;
744 return TXRX_QUEUED;
745 }
746
747 rx->skb = __skb_dequeue(&entry->skb_list);
748 if (skb_tailroom(rx->skb) < entry->extra_len) {
749 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
750 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
751 GFP_ATOMIC))) {
752 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
753 __skb_queue_purge(&entry->skb_list);
754 return TXRX_DROP;
755 }
756 }
757 while ((skb = __skb_dequeue(&entry->skb_list))) {
758 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
759 dev_kfree_skb(skb);
760 }
761
762 /* Complete frame has been reassembled - process it now */
763 rx->flags |= IEEE80211_TXRXD_FRAGMENTED;
764
765 out:
766 if (rx->sta)
767 rx->sta->rx_packets++;
768 if (is_multicast_ether_addr(hdr->addr1))
769 rx->local->dot11MulticastReceivedFrameCount++;
770 else
771 ieee80211_led_rx(rx->local);
772 return TXRX_CONTINUE;
773 }
774
775 static ieee80211_txrx_result
776 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
777 {
778 struct sk_buff *skb;
779 int no_pending_pkts;
780
781 if (likely(!rx->sta ||
782 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
783 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
784 !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)))
785 return TXRX_CONTINUE;
786
787 skb = skb_dequeue(&rx->sta->tx_filtered);
788 if (!skb) {
789 skb = skb_dequeue(&rx->sta->ps_tx_buf);
790 if (skb)
791 rx->local->total_ps_buffered--;
792 }
793 no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
794 skb_queue_empty(&rx->sta->ps_tx_buf);
795
796 if (skb) {
797 struct ieee80211_hdr *hdr =
798 (struct ieee80211_hdr *) skb->data;
799
800 /* tell TX path to send one frame even though the STA may
801 * still remain is PS mode after this frame exchange */
802 rx->sta->pspoll = 1;
803
804 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
805 printk(KERN_DEBUG "STA " MAC_FMT " aid %d: PS Poll (entries "
806 "after %d)\n",
807 MAC_ARG(rx->sta->addr), rx->sta->aid,
808 skb_queue_len(&rx->sta->ps_tx_buf));
809 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
810
811 /* Use MoreData flag to indicate whether there are more
812 * buffered frames for this STA */
813 if (no_pending_pkts) {
814 hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
815 rx->sta->flags &= ~WLAN_STA_TIM;
816 } else
817 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
818
819 dev_queue_xmit(skb);
820
821 if (no_pending_pkts) {
822 if (rx->local->ops->set_tim)
823 rx->local->ops->set_tim(local_to_hw(rx->local),
824 rx->sta->aid, 0);
825 if (rx->sdata->bss)
826 bss_tim_clear(rx->local, rx->sdata->bss, rx->sta->aid);
827 }
828 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
829 } else if (!rx->u.rx.sent_ps_buffered) {
830 printk(KERN_DEBUG "%s: STA " MAC_FMT " sent PS Poll even "
831 "though there is no buffered frames for it\n",
832 rx->dev->name, MAC_ARG(rx->sta->addr));
833 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
834
835 }
836
837 /* Free PS Poll skb here instead of returning TXRX_DROP that would
838 * count as an dropped frame. */
839 dev_kfree_skb(rx->skb);
840
841 return TXRX_QUEUED;
842 }
843
844 static ieee80211_txrx_result
845 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
846 {
847 u16 fc = rx->fc;
848 u8 *data = rx->skb->data;
849 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
850
851 if (!WLAN_FC_IS_QOS_DATA(fc))
852 return TXRX_CONTINUE;
853
854 /* remove the qos control field, update frame type and meta-data */
855 memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
856 hdr = (struct ieee80211_hdr *) skb_pull(rx->skb, 2);
857 /* change frame type to non QOS */
858 rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
859 hdr->frame_control = cpu_to_le16(fc);
860
861 return TXRX_CONTINUE;
862 }
863
864 static ieee80211_txrx_result
865 ieee80211_rx_h_802_1x_pae(struct ieee80211_txrx_data *rx)
866 {
867 if (rx->sdata->eapol && ieee80211_is_eapol(rx->skb) &&
868 rx->sdata->type != IEEE80211_IF_TYPE_STA &&
869 (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
870 /* Pass both encrypted and unencrypted EAPOL frames to user
871 * space for processing. */
872 if (!rx->local->apdev)
873 return TXRX_DROP;
874 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
875 ieee80211_msg_normal);
876 return TXRX_QUEUED;
877 }
878
879 if (unlikely(rx->sdata->ieee802_1x &&
880 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
881 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
882 (!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED)) &&
883 !ieee80211_is_eapol(rx->skb))) {
884 #ifdef CONFIG_MAC80211_DEBUG
885 struct ieee80211_hdr *hdr =
886 (struct ieee80211_hdr *) rx->skb->data;
887 printk(KERN_DEBUG "%s: dropped frame from " MAC_FMT
888 " (unauthorized port)\n", rx->dev->name,
889 MAC_ARG(hdr->addr2));
890 #endif /* CONFIG_MAC80211_DEBUG */
891 return TXRX_DROP;
892 }
893
894 return TXRX_CONTINUE;
895 }
896
897 static ieee80211_txrx_result
898 ieee80211_rx_h_drop_unencrypted(struct ieee80211_txrx_data *rx)
899 {
900 /*
901 * Pass through unencrypted frames if the hardware might have
902 * decrypted them already without telling us, but that can only
903 * be true if we either didn't find a key or the found key is
904 * uploaded to the hardware.
905 */
906 if ((rx->local->hw.flags & IEEE80211_HW_DEVICE_HIDES_WEP) &&
907 (!rx->key || (rx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)))
908 return TXRX_CONTINUE;
909
910 /* Drop unencrypted frames if key is set. */
911 if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
912 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
913 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
914 (rx->key || rx->sdata->drop_unencrypted) &&
915 (rx->sdata->eapol == 0 ||
916 !ieee80211_is_eapol(rx->skb)))) {
917 if (net_ratelimit())
918 printk(KERN_DEBUG "%s: RX non-WEP frame, but expected "
919 "encryption\n", rx->dev->name);
920 return TXRX_DROP;
921 }
922 return TXRX_CONTINUE;
923 }
924
925 static ieee80211_txrx_result
926 ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
927 {
928 struct net_device *dev = rx->dev;
929 struct ieee80211_local *local = rx->local;
930 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
931 u16 fc, hdrlen, ethertype;
932 u8 *payload;
933 u8 dst[ETH_ALEN];
934 u8 src[ETH_ALEN];
935 struct sk_buff *skb = rx->skb, *skb2;
936 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
937
938 fc = rx->fc;
939 if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
940 return TXRX_CONTINUE;
941
942 if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
943 return TXRX_DROP;
944
945 hdrlen = ieee80211_get_hdrlen(fc);
946
947 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
948 * header
949 * IEEE 802.11 address fields:
950 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
951 * 0 0 DA SA BSSID n/a
952 * 0 1 DA BSSID SA n/a
953 * 1 0 BSSID SA DA n/a
954 * 1 1 RA TA DA SA
955 */
956
957 switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
958 case IEEE80211_FCTL_TODS:
959 /* BSSID SA DA */
960 memcpy(dst, hdr->addr3, ETH_ALEN);
961 memcpy(src, hdr->addr2, ETH_ALEN);
962
963 if (unlikely(sdata->type != IEEE80211_IF_TYPE_AP &&
964 sdata->type != IEEE80211_IF_TYPE_VLAN)) {
965 if (net_ratelimit())
966 printk(KERN_DEBUG "%s: dropped ToDS frame "
967 "(BSSID=" MAC_FMT
968 " SA=" MAC_FMT
969 " DA=" MAC_FMT ")\n",
970 dev->name,
971 MAC_ARG(hdr->addr1),
972 MAC_ARG(hdr->addr2),
973 MAC_ARG(hdr->addr3));
974 return TXRX_DROP;
975 }
976 break;
977 case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
978 /* RA TA DA SA */
979 memcpy(dst, hdr->addr3, ETH_ALEN);
980 memcpy(src, hdr->addr4, ETH_ALEN);
981
982 if (unlikely(sdata->type != IEEE80211_IF_TYPE_WDS)) {
983 if (net_ratelimit())
984 printk(KERN_DEBUG "%s: dropped FromDS&ToDS "
985 "frame (RA=" MAC_FMT
986 " TA=" MAC_FMT " DA=" MAC_FMT
987 " SA=" MAC_FMT ")\n",
988 rx->dev->name,
989 MAC_ARG(hdr->addr1),
990 MAC_ARG(hdr->addr2),
991 MAC_ARG(hdr->addr3),
992 MAC_ARG(hdr->addr4));
993 return TXRX_DROP;
994 }
995 break;
996 case IEEE80211_FCTL_FROMDS:
997 /* DA BSSID SA */
998 memcpy(dst, hdr->addr1, ETH_ALEN);
999 memcpy(src, hdr->addr3, ETH_ALEN);
1000
1001 if (sdata->type != IEEE80211_IF_TYPE_STA ||
1002 (is_multicast_ether_addr(dst) &&
1003 !compare_ether_addr(src, dev->dev_addr)))
1004 return TXRX_DROP;
1005 break;
1006 case 0:
1007 /* DA SA BSSID */
1008 memcpy(dst, hdr->addr1, ETH_ALEN);
1009 memcpy(src, hdr->addr2, ETH_ALEN);
1010
1011 if (sdata->type != IEEE80211_IF_TYPE_IBSS) {
1012 if (net_ratelimit()) {
1013 printk(KERN_DEBUG "%s: dropped IBSS frame (DA="
1014 MAC_FMT " SA=" MAC_FMT " BSSID=" MAC_FMT
1015 ")\n",
1016 dev->name, MAC_ARG(hdr->addr1),
1017 MAC_ARG(hdr->addr2),
1018 MAC_ARG(hdr->addr3));
1019 }
1020 return TXRX_DROP;
1021 }
1022 break;
1023 }
1024
1025 payload = skb->data + hdrlen;
1026
1027 if (unlikely(skb->len - hdrlen < 8)) {
1028 if (net_ratelimit()) {
1029 printk(KERN_DEBUG "%s: RX too short data frame "
1030 "payload\n", dev->name);
1031 }
1032 return TXRX_DROP;
1033 }
1034
1035 ethertype = (payload[6] << 8) | payload[7];
1036
1037 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1038 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1039 compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1040 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1041 * replace EtherType */
1042 skb_pull(skb, hdrlen + 6);
1043 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1044 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1045 } else {
1046 struct ethhdr *ehdr;
1047 __be16 len;
1048 skb_pull(skb, hdrlen);
1049 len = htons(skb->len);
1050 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1051 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1052 memcpy(ehdr->h_source, src, ETH_ALEN);
1053 ehdr->h_proto = len;
1054 }
1055 skb->dev = dev;
1056
1057 skb2 = NULL;
1058
1059 sdata->stats.rx_packets++;
1060 sdata->stats.rx_bytes += skb->len;
1061
1062 if (local->bridge_packets && (sdata->type == IEEE80211_IF_TYPE_AP
1063 || sdata->type == IEEE80211_IF_TYPE_VLAN) &&
1064 (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
1065 if (is_multicast_ether_addr(skb->data)) {
1066 /* send multicast frames both to higher layers in
1067 * local net stack and back to the wireless media */
1068 skb2 = skb_copy(skb, GFP_ATOMIC);
1069 if (!skb2 && net_ratelimit())
1070 printk(KERN_DEBUG "%s: failed to clone "
1071 "multicast frame\n", dev->name);
1072 } else {
1073 struct sta_info *dsta;
1074 dsta = sta_info_get(local, skb->data);
1075 if (dsta && !dsta->dev) {
1076 if (net_ratelimit())
1077 printk(KERN_DEBUG "Station with null "
1078 "dev structure!\n");
1079 } else if (dsta && dsta->dev == dev) {
1080 /* Destination station is associated to this
1081 * AP, so send the frame directly to it and
1082 * do not pass the frame to local net stack.
1083 */
1084 skb2 = skb;
1085 skb = NULL;
1086 }
1087 if (dsta)
1088 sta_info_put(dsta);
1089 }
1090 }
1091
1092 if (skb) {
1093 /* deliver to local stack */
1094 skb->protocol = eth_type_trans(skb, dev);
1095 memset(skb->cb, 0, sizeof(skb->cb));
1096 netif_rx(skb);
1097 }
1098
1099 if (skb2) {
1100 /* send to wireless media */
1101 skb2->protocol = __constant_htons(ETH_P_802_3);
1102 skb_set_network_header(skb2, 0);
1103 skb_set_mac_header(skb2, 0);
1104 dev_queue_xmit(skb2);
1105 }
1106
1107 return TXRX_QUEUED;
1108 }
1109
1110 static ieee80211_txrx_result
1111 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx)
1112 {
1113 struct ieee80211_sub_if_data *sdata;
1114
1115 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
1116 return TXRX_DROP;
1117
1118 sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1119 if ((sdata->type == IEEE80211_IF_TYPE_STA ||
1120 sdata->type == IEEE80211_IF_TYPE_IBSS) &&
1121 !rx->local->user_space_mlme) {
1122 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->u.rx.status);
1123 } else {
1124 /* Management frames are sent to hostapd for processing */
1125 if (!rx->local->apdev)
1126 return TXRX_DROP;
1127 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
1128 ieee80211_msg_normal);
1129 }
1130 return TXRX_QUEUED;
1131 }
1132
1133 static inline ieee80211_txrx_result __ieee80211_invoke_rx_handlers(
1134 struct ieee80211_local *local,
1135 ieee80211_rx_handler *handlers,
1136 struct ieee80211_txrx_data *rx,
1137 struct sta_info *sta)
1138 {
1139 ieee80211_rx_handler *handler;
1140 ieee80211_txrx_result res = TXRX_DROP;
1141
1142 for (handler = handlers; *handler != NULL; handler++) {
1143 res = (*handler)(rx);
1144
1145 switch (res) {
1146 case TXRX_CONTINUE:
1147 continue;
1148 case TXRX_DROP:
1149 I802_DEBUG_INC(local->rx_handlers_drop);
1150 if (sta)
1151 sta->rx_dropped++;
1152 break;
1153 case TXRX_QUEUED:
1154 I802_DEBUG_INC(local->rx_handlers_queued);
1155 break;
1156 }
1157 break;
1158 }
1159
1160 if (res == TXRX_DROP)
1161 dev_kfree_skb(rx->skb);
1162 return res;
1163 }
1164
1165 static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local *local,
1166 ieee80211_rx_handler *handlers,
1167 struct ieee80211_txrx_data *rx,
1168 struct sta_info *sta)
1169 {
1170 if (__ieee80211_invoke_rx_handlers(local, handlers, rx, sta) ==
1171 TXRX_CONTINUE)
1172 dev_kfree_skb(rx->skb);
1173 }
1174
1175 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1176 struct ieee80211_hdr *hdr,
1177 struct sta_info *sta,
1178 struct ieee80211_txrx_data *rx)
1179 {
1180 int keyidx, hdrlen;
1181
1182 hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb);
1183 if (rx->skb->len >= hdrlen + 4)
1184 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1185 else
1186 keyidx = -1;
1187
1188 /* TODO: verify that this is not triggered by fragmented
1189 * frames (hw does not verify MIC for them). */
1190 if (net_ratelimit())
1191 printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC "
1192 "failure from " MAC_FMT " to " MAC_FMT " keyidx=%d\n",
1193 dev->name, MAC_ARG(hdr->addr2), MAC_ARG(hdr->addr1),
1194 keyidx);
1195
1196 if (!sta) {
1197 /* Some hardware versions seem to generate incorrect
1198 * Michael MIC reports; ignore them to avoid triggering
1199 * countermeasures. */
1200 if (net_ratelimit())
1201 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1202 "error for unknown address " MAC_FMT "\n",
1203 dev->name, MAC_ARG(hdr->addr2));
1204 goto ignore;
1205 }
1206
1207 if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) {
1208 if (net_ratelimit())
1209 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1210 "error for a frame with no ISWEP flag (src "
1211 MAC_FMT ")\n", dev->name, MAC_ARG(hdr->addr2));
1212 goto ignore;
1213 }
1214
1215 if ((rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV) &&
1216 rx->sdata->type == IEEE80211_IF_TYPE_AP && keyidx) {
1217 /* AP with Pairwise keys support should never receive Michael
1218 * MIC errors for non-zero keyidx because these are reserved
1219 * for group keys and only the AP is sending real multicast
1220 * frames in BSS. */
1221 if (net_ratelimit())
1222 printk(KERN_DEBUG "%s: ignored Michael MIC error for "
1223 "a frame with non-zero keyidx (%d)"
1224 " (src " MAC_FMT ")\n", dev->name, keyidx,
1225 MAC_ARG(hdr->addr2));
1226 goto ignore;
1227 }
1228
1229 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
1230 ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
1231 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) {
1232 if (net_ratelimit())
1233 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1234 "error for a frame that cannot be encrypted "
1235 "(fc=0x%04x) (src " MAC_FMT ")\n",
1236 dev->name, rx->fc, MAC_ARG(hdr->addr2));
1237 goto ignore;
1238 }
1239
1240 /* TODO: consider verifying the MIC error report with software
1241 * implementation if we get too many spurious reports from the
1242 * hardware. */
1243
1244 mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr);
1245 ignore:
1246 dev_kfree_skb(rx->skb);
1247 rx->skb = NULL;
1248 }
1249
1250 ieee80211_rx_handler ieee80211_rx_handlers[] =
1251 {
1252 ieee80211_rx_h_if_stats,
1253 ieee80211_rx_h_monitor,
1254 ieee80211_rx_h_passive_scan,
1255 ieee80211_rx_h_check,
1256 ieee80211_rx_h_load_key,
1257 ieee80211_rx_h_sta_process,
1258 ieee80211_rx_h_ccmp_decrypt,
1259 ieee80211_rx_h_tkip_decrypt,
1260 ieee80211_rx_h_wep_weak_iv_detection,
1261 ieee80211_rx_h_wep_decrypt,
1262 ieee80211_rx_h_defragment,
1263 ieee80211_rx_h_ps_poll,
1264 ieee80211_rx_h_michael_mic_verify,
1265 /* this must be after decryption - so header is counted in MPDU mic
1266 * must be before pae and data, so QOS_DATA format frames
1267 * are not passed to user space by these functions
1268 */
1269 ieee80211_rx_h_remove_qos_control,
1270 ieee80211_rx_h_802_1x_pae,
1271 ieee80211_rx_h_drop_unencrypted,
1272 ieee80211_rx_h_data,
1273 ieee80211_rx_h_mgmt,
1274 NULL
1275 };
1276
1277 /* main receive path */
1278
1279 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
1280 u8 *bssid, struct ieee80211_txrx_data *rx,
1281 struct ieee80211_hdr *hdr)
1282 {
1283 int multicast = is_multicast_ether_addr(hdr->addr1);
1284
1285 switch (sdata->type) {
1286 case IEEE80211_IF_TYPE_STA:
1287 if (!bssid)
1288 return 0;
1289 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1290 if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1291 return 0;
1292 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1293 } else if (!multicast &&
1294 compare_ether_addr(sdata->dev->dev_addr,
1295 hdr->addr1) != 0) {
1296 if (!(sdata->flags & IEEE80211_SDATA_PROMISC))
1297 return 0;
1298 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1299 }
1300 break;
1301 case IEEE80211_IF_TYPE_IBSS:
1302 if (!bssid)
1303 return 0;
1304 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1305 if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1306 return 0;
1307 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1308 } else if (!multicast &&
1309 compare_ether_addr(sdata->dev->dev_addr,
1310 hdr->addr1) != 0) {
1311 if (!(sdata->flags & IEEE80211_SDATA_PROMISC))
1312 return 0;
1313 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1314 } else if (!rx->sta)
1315 rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb,
1316 bssid, hdr->addr2);
1317 break;
1318 case IEEE80211_IF_TYPE_AP:
1319 if (!bssid) {
1320 if (compare_ether_addr(sdata->dev->dev_addr,
1321 hdr->addr1))
1322 return 0;
1323 } else if (!ieee80211_bssid_match(bssid,
1324 sdata->dev->dev_addr)) {
1325 if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1326 return 0;
1327 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1328 }
1329 if (sdata->dev == sdata->local->mdev &&
1330 !(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1331 /* do not receive anything via
1332 * master device when not scanning */
1333 return 0;
1334 break;
1335 case IEEE80211_IF_TYPE_WDS:
1336 if (bssid ||
1337 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
1338 return 0;
1339 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
1340 return 0;
1341 break;
1342 }
1343
1344 return 1;
1345 }
1346
1347 /*
1348 * This is the receive path handler. It is called by a low level driver when an
1349 * 802.11 MPDU is received from the hardware.
1350 */
1351 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
1352 struct ieee80211_rx_status *status)
1353 {
1354 struct ieee80211_local *local = hw_to_local(hw);
1355 struct ieee80211_sub_if_data *sdata;
1356 struct sta_info *sta;
1357 struct ieee80211_hdr *hdr;
1358 struct ieee80211_txrx_data rx;
1359 u16 type;
1360 int radiotap_len = 0, prepres;
1361 struct ieee80211_sub_if_data *prev = NULL;
1362 struct sk_buff *skb_new;
1363 u8 *bssid;
1364
1365 if (status->flag & RX_FLAG_RADIOTAP) {
1366 radiotap_len = ieee80211_get_radiotap_len(skb->data);
1367 skb_pull(skb, radiotap_len);
1368 }
1369
1370 /*
1371 * key references are protected using RCU and this requires that
1372 * we are in a read-site RCU section during receive processing
1373 */
1374 rcu_read_lock();
1375
1376 hdr = (struct ieee80211_hdr *) skb->data;
1377 memset(&rx, 0, sizeof(rx));
1378 rx.skb = skb;
1379 rx.local = local;
1380
1381 rx.u.rx.status = status;
1382 rx.fc = skb->len >= 2 ? le16_to_cpu(hdr->frame_control) : 0;
1383 type = rx.fc & IEEE80211_FCTL_FTYPE;
1384 if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
1385 local->dot11ReceivedFragmentCount++;
1386
1387 if (skb->len >= 16) {
1388 sta = rx.sta = sta_info_get(local, hdr->addr2);
1389 if (sta) {
1390 rx.dev = rx.sta->dev;
1391 rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev);
1392 }
1393 } else
1394 sta = rx.sta = NULL;
1395
1396 if ((status->flag & RX_FLAG_MMIC_ERROR)) {
1397 ieee80211_rx_michael_mic_report(local->mdev, hdr, sta, &rx);
1398 goto end;
1399 }
1400
1401 if (unlikely(local->sta_scanning))
1402 rx.flags |= IEEE80211_TXRXD_RXIN_SCAN;
1403
1404 if (__ieee80211_invoke_rx_handlers(local, local->rx_pre_handlers, &rx,
1405 sta) != TXRX_CONTINUE)
1406 goto end;
1407 skb = rx.skb;
1408
1409 skb_push(skb, radiotap_len);
1410 if (sta && !(sta->flags & (WLAN_STA_WDS | WLAN_STA_ASSOC_AP)) &&
1411 !local->iff_promiscs && !is_multicast_ether_addr(hdr->addr1)) {
1412 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
1413 ieee80211_invoke_rx_handlers(local, local->rx_handlers, &rx,
1414 rx.sta);
1415 sta_info_put(sta);
1416 rcu_read_unlock();
1417 return;
1418 }
1419
1420 bssid = ieee80211_get_bssid(hdr, skb->len - radiotap_len);
1421
1422 read_lock(&local->sub_if_lock);
1423 list_for_each_entry(sdata, &local->sub_if_list, list) {
1424 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
1425
1426 if (!netif_running(sdata->dev))
1427 continue;
1428
1429 prepres = prepare_for_handlers(sdata, bssid, &rx, hdr);
1430 /* prepare_for_handlers can change sta */
1431 sta = rx.sta;
1432
1433 if (!prepres)
1434 continue;
1435
1436 /*
1437 * frame is destined for this interface, but if it's not
1438 * also for the previous one we handle that after the
1439 * loop to avoid copying the SKB once too much
1440 */
1441
1442 if (!prev) {
1443 prev = sdata;
1444 continue;
1445 }
1446
1447 /*
1448 * frame was destined for the previous interface
1449 * so invoke RX handlers for it
1450 */
1451
1452 skb_new = skb_copy(skb, GFP_ATOMIC);
1453 if (!skb_new) {
1454 if (net_ratelimit())
1455 printk(KERN_DEBUG "%s: failed to copy "
1456 "multicast frame for %s",
1457 local->mdev->name, prev->dev->name);
1458 continue;
1459 }
1460 rx.skb = skb_new;
1461 rx.dev = prev->dev;
1462 rx.sdata = prev;
1463 ieee80211_invoke_rx_handlers(local, local->rx_handlers,
1464 &rx, sta);
1465 prev = sdata;
1466 }
1467 if (prev) {
1468 rx.skb = skb;
1469 rx.dev = prev->dev;
1470 rx.sdata = prev;
1471 ieee80211_invoke_rx_handlers(local, local->rx_handlers,
1472 &rx, sta);
1473 } else
1474 dev_kfree_skb(skb);
1475 read_unlock(&local->sub_if_lock);
1476
1477 end:
1478 rcu_read_unlock();
1479
1480 if (sta)
1481 sta_info_put(sta);
1482 }
1483 EXPORT_SYMBOL(__ieee80211_rx);
1484
1485 /* This is a version of the rx handler that can be called from hard irq
1486 * context. Post the skb on the queue and schedule the tasklet */
1487 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
1488 struct ieee80211_rx_status *status)
1489 {
1490 struct ieee80211_local *local = hw_to_local(hw);
1491
1492 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
1493
1494 skb->dev = local->mdev;
1495 /* copy status into skb->cb for use by tasklet */
1496 memcpy(skb->cb, status, sizeof(*status));
1497 skb->pkt_type = IEEE80211_RX_MSG;
1498 skb_queue_tail(&local->skb_queue, skb);
1499 tasklet_schedule(&local->tasklet);
1500 }
1501 EXPORT_SYMBOL(ieee80211_rx_irqsafe);
ubuntu-bionic-kernel mirror