void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt,
size_t len, struct ieee80211_rx_status *rx_status)
{
struct ieee80211_local *local = sdata->local;
struct ieee802_11_elems elems;
struct sta_info *sta;
enum plink_event event;
enum plink_frame_type ftype;
size_t baselen;
u8 ie_len;
u8 *baseaddr;
__le16 plid, llid, reason;
#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
static const char *mplstates[] = {
[PLINK_LISTEN] = "LISTEN",
[PLINK_OPN_SNT] = "OPN-SNT",
[PLINK_OPN_RCVD] = "OPN-RCVD",
[PLINK_CNF_RCVD] = "CNF_RCVD",
[PLINK_ESTAB] = "ESTAB",
[PLINK_HOLDING] = "HOLDING",
[PLINK_BLOCKED] = "BLOCKED"
};
#endif
/* need action_code, aux */
if (len < IEEE80211_MIN_ACTION_SIZE + 3)
return;
if (is_multicast_ether_addr(mgmt->da)) {
mpl_dbg("Mesh plink: ignore frame from multicast address");
return;
}
baseaddr = mgmt->u.action.u.plink_action.variable;
baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt;
if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) {
baseaddr += 4;
baselen += 4;
}
ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
if (!elems.peer_link) {
mpl_dbg("Mesh plink: missing necessary peer link ie\n");
return;
}
ftype = mgmt->u.action.u.plink_action.action_code;
ie_len = elems.peer_link_len;
if ((ftype == PLINK_OPEN && ie_len != 6) ||
(ftype == PLINK_CONFIRM && ie_len != 8) ||
(ftype == PLINK_CLOSE && ie_len != 8 && ie_len != 10)) {
mpl_dbg("Mesh plink: incorrect plink ie length %d %d\n",
ftype, ie_len);
return;
}
if (ftype != PLINK_CLOSE && (!elems.mesh_id || !elems.mesh_config)) {
mpl_dbg("Mesh plink: missing necessary ie\n");
return;
}
/* Note the lines below are correct, the llid in the frame is the plid
* from the point of view of this host.
*/
memcpy(&plid, PLINK_GET_LLID(elems.peer_link), 2);
if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 10))
memcpy(&llid, PLINK_GET_PLID(elems.peer_link), 2);
rcu_read_lock();
sta = sta_info_get(sdata, mgmt->sa);
if (!sta && ftype != PLINK_OPEN) {
mpl_dbg("Mesh plink: cls or cnf from unknown peer\n");
rcu_read_unlock();
return;
}
if (sta && sta->plink_state == PLINK_BLOCKED) {
rcu_read_unlock();
return;
}
/* Now we will figure out the appropriate event... */
event = PLINK_UNDEFINED;
if (ftype != PLINK_CLOSE && (!mesh_matches_local(&elems, sdata))) {
switch (ftype) {
case PLINK_OPEN:
event = OPN_RJCT;
break;
case PLINK_CONFIRM:
event = CNF_RJCT;
break;
case PLINK_CLOSE:
/* avoid warning */
break;
}
spin_lock_bh(&sta->lock);
} else if (!sta) {
/* ftype == PLINK_OPEN */
u32 rates;
rcu_read_unlock();
if (!mesh_plink_free_count(sdata)) {
mpl_dbg("Mesh plink error: no more free plinks\n");
return;
}
rates = ieee80211_sta_get_rates(local, &elems, rx_status->band);
sta = mesh_plink_alloc(sdata, mgmt->sa, rates);
if (!sta) {
mpl_dbg("Mesh plink error: plink table full\n");
return;
}
if (sta_info_insert_rcu(sta)) {
rcu_read_unlock();
return;
}
event = OPN_ACPT;
spin_lock_bh(&sta->lock);
} else {
spin_lock_bh(&sta->lock);
switch (ftype) {
case PLINK_OPEN:
if (!mesh_plink_free_count(sdata) ||
(sta->plid && sta->plid != plid))
event = OPN_IGNR;
else
event = OPN_ACPT;
break;
case PLINK_CONFIRM:
if (!mesh_plink_free_count(sdata) ||
(sta->llid != llid || sta->plid != plid))
event = CNF_IGNR;
else
event = CNF_ACPT;
break;
case PLINK_CLOSE:
if (sta->plink_state == PLINK_ESTAB)
/* Do not check for llid or plid. This does not
* follow the standard but since multiple plinks
* per sta are not supported, it is necessary in
* order to avoid a livelock when MP A sees an
* establish peer link to MP B but MP B does not
* see it. This can be caused by a timeout in
* B's peer link establishment or B beign
* restarted.
*/
event = CLS_ACPT;
else if (sta->plid != plid)
event = CLS_IGNR;
else if (ie_len == 7 && sta->llid != llid)
event = CLS_IGNR;
else
event = CLS_ACPT;
break;
default:
mpl_dbg("Mesh plink: unknown frame subtype\n");
spin_unlock_bh(&sta->lock);
rcu_read_unlock();
return;
}
}
mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n",
mgmt->sa, mplstates[sta->plink_state],
le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
event);
reason = 0;
switch (sta->plink_state) {
/* spin_unlock as soon as state is updated at each case */
case PLINK_LISTEN:
switch (event) {
case CLS_ACPT:
mesh_plink_fsm_restart(sta);
spin_unlock_bh(&sta->lock);
break;
case OPN_ACPT:
sta->plink_state = PLINK_OPN_RCVD;
sta->plid = plid;
get_random_bytes(&llid, 2);
sta->llid = llid;
mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, PLINK_OPEN, sta->sta.addr, llid,
0, 0);
mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr,
llid, plid, 0);
break;
default:
spin_unlock_bh(&sta->lock);
break;
}
break;
case PLINK_OPN_SNT:
switch (event) {
case OPN_RJCT:
case CNF_RJCT:
reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
case CLS_ACPT:
if (!reason)
reason = cpu_to_le16(MESH_CLOSE_RCVD);
sta->reason = reason;
sta->plink_state = PLINK_HOLDING;
if (!mod_plink_timer(sta,
dot11MeshHoldingTimeout(sdata)))
sta->ignore_plink_timer = true;
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
plid, reason);
break;
case OPN_ACPT:
/* retry timer is left untouched */
sta->plink_state = PLINK_OPN_RCVD;
sta->plid = plid;
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
plid, 0);
break;
case CNF_ACPT:
sta->plink_state = PLINK_CNF_RCVD;
if (!mod_plink_timer(sta,
dot11MeshConfirmTimeout(sdata)))
sta->ignore_plink_timer = true;
spin_unlock_bh(&sta->lock);
break;
default:
spin_unlock_bh(&sta->lock);
break;
}
break;
case PLINK_OPN_RCVD:
switch (event) {
case OPN_RJCT:
case CNF_RJCT:
reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
case CLS_ACPT:
if (!reason)
reason = cpu_to_le16(MESH_CLOSE_RCVD);
sta->reason = reason;
sta->plink_state = PLINK_HOLDING;
if (!mod_plink_timer(sta,
dot11MeshHoldingTimeout(sdata)))
sta->ignore_plink_timer = true;
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
plid, reason);
break;
case OPN_ACPT:
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
plid, 0);
break;
case CNF_ACPT:
del_timer(&sta->plink_timer);
sta->plink_state = PLINK_ESTAB;
mesh_plink_inc_estab_count(sdata);
spin_unlock_bh(&sta->lock);
mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
sta->sta.addr);
break;
default:
spin_unlock_bh(&sta->lock);
break;
}
break;
case PLINK_CNF_RCVD:
switch (event) {
case OPN_RJCT:
case CNF_RJCT:
reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
case CLS_ACPT:
if (!reason)
reason = cpu_to_le16(MESH_CLOSE_RCVD);
sta->reason = reason;
sta->plink_state = PLINK_HOLDING;
if (!mod_plink_timer(sta,
dot11MeshHoldingTimeout(sdata)))
sta->ignore_plink_timer = true;
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
plid, reason);
break;
case OPN_ACPT:
del_timer(&sta->plink_timer);
sta->plink_state = PLINK_ESTAB;
mesh_plink_inc_estab_count(sdata);
spin_unlock_bh(&sta->lock);
mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
sta->sta.addr);
mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
plid, 0);
break;
default:
spin_unlock_bh(&sta->lock);
break;
}
break;
case PLINK_ESTAB:
switch (event) {
case CLS_ACPT:
reason = cpu_to_le16(MESH_CLOSE_RCVD);
sta->reason = reason;
__mesh_plink_deactivate(sta);
sta->plink_state = PLINK_HOLDING;
llid = sta->llid;
mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
plid, reason);
break;
case OPN_ACPT:
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
plid, 0);
break;
default:
spin_unlock_bh(&sta->lock);
break;
}
break;
case PLINK_HOLDING:
switch (event) {
case CLS_ACPT:
if (del_timer(&sta->plink_timer))
sta->ignore_plink_timer = 1;
mesh_plink_fsm_restart(sta);
spin_unlock_bh(&sta->lock);
break;
case OPN_ACPT:
case CNF_ACPT:
case OPN_RJCT:
case CNF_RJCT:
llid = sta->llid;
reason = sta->reason;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr,
llid, plid, reason);
break;
default:
spin_unlock_bh(&sta->lock);
}
break;
default:
/* should not get here, PLINK_BLOCKED is dealt with at the
* beggining of the function
*/
spin_unlock_bh(&sta->lock);
break;
}
rcu_read_unlock();
}
/**
* process_ampe_frame - process an ampe frame
* @frame: The full frame
* @len: The full frame length
* @me: The MAC address of the local interface
* @cookie: Opaque cookie that will be returned to the caller along with
* frames to be transmitted.
*
* Returns 0 unless something really horrible happened. In other words, even
* the frame could not be processed or it was corrupted, the function still
* returns 0.
*/
int process_ampe_frame(struct ieee80211_mgmt_frame *mgmt, int len,
unsigned char *me, void *cookie)
{
struct info_elems elems;
struct info_elems our_elems;
unsigned char ftype;
struct candidate *cand = NULL;
enum plink_event event;
unsigned char ie_len = 0;
unsigned short plid = 0, llid = 0;
unsigned char *ies;
unsigned short ies_len;
#define FAKE_LOSS_PROBABILITY 0
#if (FAKE_LOSS_PROBABILITY > 0)
do {
unsigned short dice;
dice = RAND_bytes((unsigned char *) &dice, sizeof(dice));
if ((dice % 100) < FAKE_LOSS_PROBABILITY) {
sae_debug(AMPE_DEBUG_FSM, "Frame dropped\n");
return 0;
}
} while (0);
#endif
/* management header, category, action code, mesh id and peering mgmt*/
if (len < 24 + 1 + 1 + 2 + 2)
return 0;
//if (is_multicast_ether_addr(mgmt->da)) {
// sae_debug(AMPE_DEBUG_FSM, "Mesh plink: ignore frame to multicast address");
// return 0;
//}
ies = start_of_ies(mgmt, len, &ies_len);
parse_ies(ies, ies_len, &elems);
if (!elems.mesh_peering) { // || !elems.rsn) {
sae_debug(AMPE_DEBUG_FSM, "Mesh plink: missing necessary peer link ie\n");
return 0;
}
ftype = mgmt->action.action_code;
ie_len = elems.mesh_peering_len;
if ((ftype == PLINK_OPEN && ie_len != 20) ||
(ftype == PLINK_CONFIRM && ie_len != 22) ||
(ftype == PLINK_CLOSE && ie_len != 22 && ie_len != 24)) {
sae_debug(AMPE_DEBUG_FSM, "Mesh plink: incorrect plink ie length %d %d\n",
ftype, ie_len);
return 0;
}
if (ftype != PLINK_CLOSE && (!elems.mesh_id || !elems.mesh_config)) {
sae_debug(AMPE_DEBUG_FSM, "Mesh plink: missing necessary ie %p %p\n", elems.mesh_id, elems.mesh_config);
return 0;
}
/* Note the lines below are correct, the llid in the frame is the plid
* from the point of view of this host.
*/
memcpy(&plid, PLINK_GET_LLID(elems.mesh_peering), 2);
if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 10))
memcpy(&llid, PLINK_GET_PLID(elems.mesh_peering), 2);
/* match BSSBasicRateSet*/
parse_ies(sta_fixed_ies, sta_fixed_ies_len, &our_elems);
if (get_basic_rates(&our_elems) != get_basic_rates(&elems)) {
sae_debug(AMPE_DEBUG_FSM, "mesh plink: mismatched BSSBasicRateSet!\n");
return 0;
}
/* "1" here means only get peers in SAE_ACCEPTED */
if ((cand = find_peer(mgmt->sa, 1)) == NULL) {
sae_debug(AMPE_DEBUG_FSM, "Mesh plink: plink open from unauthed peer "MACSTR"\n",
MAC2STR(mgmt->sa));
return 0;
}
if (cand->my_lid == 0)
peer_ampe_init(&e_conf, cand, me, cookie);
if (elems.sup_rates) {
memcpy(cand->sup_rates, elems.sup_rates,
elems.sup_rates_len);
cand->sup_rates_len = elems.sup_rates_len;
if (elems.ext_rates) {
memcpy(cand->sup_rates + elems.sup_rates_len,
elems.ext_rates, elems.ext_rates_len);
cand->sup_rates_len += elems.ext_rates_len;
}
}
check_frame_protection(cand, mgmt, len, &elems);
cand->cookie = cookie;
if (cand->link_state == PLINK_BLOCKED) {
return 0;
}
/* Now we will figure out the appropriate event... */
event = PLINK_UNDEFINED;
// if (ftype != PLINK_CLOSE && (!mesh_matches_local(&elems, sdata))) {
if (ftype != PLINK_CLOSE) {
switch (ftype) {
case PLINK_OPEN:
event = OPN_RJCT;
break;
case PLINK_CONFIRM:
event = CNF_RJCT;
break;
case PLINK_CLOSE:
break;
}
}
switch (ftype) {
case PLINK_OPEN:
if (!plink_free_count() ||
(cand->peer_lid && cand->peer_lid != plid))
event = OPN_IGNR;
else {
cand->peer_lid = plid;
event = OPN_ACPT;
}
break;
case PLINK_CONFIRM:
if (!plink_free_count() ||
(cand->my_lid != llid || cand->peer_lid != plid))
event = CNF_IGNR;
else
event = CNF_ACPT;
break;
case PLINK_CLOSE:
if (cand->link_state == PLINK_ESTAB)
/* Do not check for llid or plid. This does not
* follow the standard but since multiple plinks
* per cand are not supported, it is necessary in
* order to avoid a livelock when MP A sees an
* establish peer link to MP B but MP B does not
* see it. This can be caused by a timeout in
* B's peer link establishment or B beign
* restarted.
*/
event = CLS_ACPT;
else if (cand->peer_lid != plid)
event = CLS_IGNR;
else if (ie_len == 7 && cand->my_lid != llid)
event = CLS_IGNR;
else
event = CLS_ACPT;
break;
default:
sae_debug(AMPE_DEBUG_FSM, "Mesh plink: unknown frame subtype\n");
return 0;
}
sae_debug(AMPE_DEBUG_FSM, "Mesh plink (peer, state, llid, plid, event): " MACSTR " %s %d %d %d\n",
MAC2STR(mgmt->sa), mplstates[cand->link_state],
le16toh(cand->my_lid), le16toh(cand->peer_lid),
event);
fsm_step(cand, event);
return 0;
}
void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt,
size_t len, struct ieee80211_rx_status *rx_status)
{
struct ieee80211_local *local = sdata->local;
struct ieee802_11_elems elems;
struct sta_info *sta;
enum plink_event event;
enum ieee80211_self_protected_actioncode ftype;
size_t baselen;
bool deactivated, matches_local = true;
u8 ie_len;
u8 *baseaddr;
__le16 plid, llid, reason;
#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
static const char *mplstates[] = {
[NL80211_PLINK_LISTEN] = "LISTEN",
[NL80211_PLINK_OPN_SNT] = "OPN-SNT",
[NL80211_PLINK_OPN_RCVD] = "OPN-RCVD",
[NL80211_PLINK_CNF_RCVD] = "CNF_RCVD",
[NL80211_PLINK_ESTAB] = "ESTAB",
[NL80211_PLINK_HOLDING] = "HOLDING",
[NL80211_PLINK_BLOCKED] = "BLOCKED"
};
#endif
/* */
if (len < IEEE80211_MIN_ACTION_SIZE + 3)
return;
if (is_multicast_ether_addr(mgmt->da)) {
mpl_dbg("Mesh plink: ignore frame from multicast address");
return;
}
baseaddr = mgmt->u.action.u.self_prot.variable;
baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt;
if (mgmt->u.action.u.self_prot.action_code ==
WLAN_SP_MESH_PEERING_CONFIRM) {
baseaddr += 4;
baselen += 4;
}
ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
if (!elems.peering) {
mpl_dbg("Mesh plink: missing necessary peer link ie\n");
return;
}
if (elems.rsn_len &&
sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) {
mpl_dbg("Mesh plink: can't establish link with secure peer\n");
return;
}
ftype = mgmt->u.action.u.self_prot.action_code;
ie_len = elems.peering_len;
if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) ||
(ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) ||
(ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6
&& ie_len != 8)) {
mpl_dbg("Mesh plink: incorrect plink ie length %d %d\n",
ftype, ie_len);
return;
}
if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
(!elems.mesh_id || !elems.mesh_config)) {
mpl_dbg("Mesh plink: missing necessary ie\n");
return;
}
/*
*/
memcpy(&plid, PLINK_GET_LLID(elems.peering), 2);
if (ftype == WLAN_SP_MESH_PEERING_CONFIRM ||
(ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
memcpy(&llid, PLINK_GET_PLID(elems.peering), 2);
rcu_read_lock();
sta = sta_info_get(sdata, mgmt->sa);
if (!sta && ftype != WLAN_SP_MESH_PEERING_OPEN) {
mpl_dbg("Mesh plink: cls or cnf from unknown peer\n");
rcu_read_unlock();
return;
}
if (ftype == WLAN_SP_MESH_PEERING_OPEN &&
!rssi_threshold_check(sta, sdata)) {
mpl_dbg("Mesh plink: %pM does not meet rssi threshold\n",
mgmt->sa);
rcu_read_unlock();
return;
}
if (sta && !test_sta_flag(sta, WLAN_STA_AUTH)) {
mpl_dbg("Mesh plink: Action frame from non-authed peer\n");
rcu_read_unlock();
return;
}
if (sta && sta->plink_state == NL80211_PLINK_BLOCKED) {
rcu_read_unlock();
return;
}
/* */
event = PLINK_UNDEFINED;
if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
(!mesh_matches_local(&elems, sdata))) {
matches_local = false;
switch (ftype) {
case WLAN_SP_MESH_PEERING_OPEN:
event = OPN_RJCT;
break;
case WLAN_SP_MESH_PEERING_CONFIRM:
event = CNF_RJCT;
break;
default:
break;
}
}
if (!sta && !matches_local) {
rcu_read_unlock();
reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
llid = 0;
mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
mgmt->sa, llid, plid, reason);
return;
} else if (!sta) {
/* */
u32 rates;
rcu_read_unlock();
if (!mesh_plink_free_count(sdata)) {
mpl_dbg("Mesh plink error: no more free plinks\n");
return;
}
rates = ieee80211_sta_get_rates(local, &elems, rx_status->band);
sta = mesh_plink_alloc(sdata, mgmt->sa, rates, &elems);
if (!sta) {
mpl_dbg("Mesh plink error: plink table full\n");
return;
}
if (sta_info_insert_rcu(sta)) {
rcu_read_unlock();
return;
}
event = OPN_ACPT;
spin_lock_bh(&sta->lock);
} else if (matches_local) {
spin_lock_bh(&sta->lock);
switch (ftype) {
case WLAN_SP_MESH_PEERING_OPEN:
if (!mesh_plink_free_count(sdata) ||
(sta->plid && sta->plid != plid))
event = OPN_IGNR;
else
event = OPN_ACPT;
break;
case WLAN_SP_MESH_PEERING_CONFIRM:
if (!mesh_plink_free_count(sdata) ||
(sta->llid != llid || sta->plid != plid))
event = CNF_IGNR;
else
event = CNF_ACPT;
break;
case WLAN_SP_MESH_PEERING_CLOSE:
if (sta->plink_state == NL80211_PLINK_ESTAB)
/*
*/
event = CLS_ACPT;
else if (sta->plid != plid)
event = CLS_IGNR;
else if (ie_len == 7 && sta->llid != llid)
event = CLS_IGNR;
else
event = CLS_ACPT;
break;
default:
mpl_dbg("Mesh plink: unknown frame subtype\n");
spin_unlock_bh(&sta->lock);
rcu_read_unlock();
return;
}
} else {
spin_lock_bh(&sta->lock);
}
mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n",
mgmt->sa, mplstates[sta->plink_state],
le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
event);
reason = 0;
switch (sta->plink_state) {
/* */
case NL80211_PLINK_LISTEN:
switch (event) {
case CLS_ACPT:
mesh_plink_fsm_restart(sta);
spin_unlock_bh(&sta->lock);
break;
case OPN_ACPT:
sta->plink_state = NL80211_PLINK_OPN_RCVD;
sta->plid = plid;
get_random_bytes(&llid, 2);
sta->llid = llid;
mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata,
WLAN_SP_MESH_PEERING_OPEN,
sta->sta.addr, llid, 0, 0);
mesh_plink_frame_tx(sdata,
WLAN_SP_MESH_PEERING_CONFIRM,
sta->sta.addr, llid, plid, 0);
break;
default:
spin_unlock_bh(&sta->lock);
break;
}
break;
case NL80211_PLINK_OPN_SNT:
switch (event) {
case OPN_RJCT:
case CNF_RJCT:
reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
case CLS_ACPT:
if (!reason)
reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
sta->reason = reason;
sta->plink_state = NL80211_PLINK_HOLDING;
if (!mod_plink_timer(sta,
dot11MeshHoldingTimeout(sdata)))
sta->ignore_plink_timer = true;
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata,
WLAN_SP_MESH_PEERING_CLOSE,
sta->sta.addr, llid, plid, reason);
break;
case OPN_ACPT:
/* */
sta->plink_state = NL80211_PLINK_OPN_RCVD;
sta->plid = plid;
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata,
WLAN_SP_MESH_PEERING_CONFIRM,
sta->sta.addr, llid, plid, 0);
break;
case CNF_ACPT:
sta->plink_state = NL80211_PLINK_CNF_RCVD;
if (!mod_plink_timer(sta,
dot11MeshConfirmTimeout(sdata)))
sta->ignore_plink_timer = true;
spin_unlock_bh(&sta->lock);
break;
default:
spin_unlock_bh(&sta->lock);
break;
}
break;
case NL80211_PLINK_OPN_RCVD:
switch (event) {
case OPN_RJCT:
case CNF_RJCT:
reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
case CLS_ACPT:
if (!reason)
reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
sta->reason = reason;
sta->plink_state = NL80211_PLINK_HOLDING;
if (!mod_plink_timer(sta,
dot11MeshHoldingTimeout(sdata)))
sta->ignore_plink_timer = true;
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
sta->sta.addr, llid, plid, reason);
break;
case OPN_ACPT:
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata,
WLAN_SP_MESH_PEERING_CONFIRM,
sta->sta.addr, llid, plid, 0);
break;
case CNF_ACPT:
del_timer(&sta->plink_timer);
sta->plink_state = NL80211_PLINK_ESTAB;
spin_unlock_bh(&sta->lock);
mesh_plink_inc_estab_count(sdata);
ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
sta->sta.addr);
break;
default:
spin_unlock_bh(&sta->lock);
break;
}
break;
case NL80211_PLINK_CNF_RCVD:
switch (event) {
case OPN_RJCT:
case CNF_RJCT:
reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
case CLS_ACPT:
if (!reason)
reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
sta->reason = reason;
sta->plink_state = NL80211_PLINK_HOLDING;
if (!mod_plink_timer(sta,
dot11MeshHoldingTimeout(sdata)))
sta->ignore_plink_timer = true;
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata,
WLAN_SP_MESH_PEERING_CLOSE,
sta->sta.addr, llid, plid, reason);
break;
case OPN_ACPT:
del_timer(&sta->plink_timer);
sta->plink_state = NL80211_PLINK_ESTAB;
spin_unlock_bh(&sta->lock);
mesh_plink_inc_estab_count(sdata);
ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
sta->sta.addr);
mesh_plink_frame_tx(sdata,
WLAN_SP_MESH_PEERING_CONFIRM,
sta->sta.addr, llid, plid, 0);
break;
default:
spin_unlock_bh(&sta->lock);
break;
}
break;
case NL80211_PLINK_ESTAB:
switch (event) {
case CLS_ACPT:
reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
sta->reason = reason;
deactivated = __mesh_plink_deactivate(sta);
sta->plink_state = NL80211_PLINK_HOLDING;
llid = sta->llid;
mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
spin_unlock_bh(&sta->lock);
if (deactivated)
ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
sta->sta.addr, llid, plid, reason);
break;
case OPN_ACPT:
llid = sta->llid;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata,
WLAN_SP_MESH_PEERING_CONFIRM,
sta->sta.addr, llid, plid, 0);
break;
default:
spin_unlock_bh(&sta->lock);
break;
}
break;
case NL80211_PLINK_HOLDING:
switch (event) {
case CLS_ACPT:
if (del_timer(&sta->plink_timer))
sta->ignore_plink_timer = 1;
mesh_plink_fsm_restart(sta);
spin_unlock_bh(&sta->lock);
break;
case OPN_ACPT:
case CNF_ACPT:
case OPN_RJCT:
case CNF_RJCT:
llid = sta->llid;
reason = sta->reason;
spin_unlock_bh(&sta->lock);
mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
sta->sta.addr, llid, plid, reason);
break;
default:
spin_unlock_bh(&sta->lock);
}
break;
default:
/*
*/
spin_unlock_bh(&sta->lock);
break;
}
rcu_read_unlock();
}
/**
* process_ampe_frame - process an ampe frame
* @frame: The full frame
* @len: The full frame length
* @me: The MAC address of the local interface
* @cookie: Opaque cookie that will be returned to the caller along with
* frames to be transmitted.
*
* Returns 0 unless something really horrible happened. In other words, even
* the frame could not be processed or it was corrupted, the function still
* returns 0.
*/
int process_ampe_frame(
struct ieee80211_mgmt_frame *mgmt,
int len,
unsigned char *me,
void *cookie) {
struct info_elems elems;
struct info_elems our_elems;
unsigned char ftype;
struct candidate *cand = NULL;
enum plink_event event;
unsigned char ie_len = 0;
unsigned short plid = 0, llid = 0;
unsigned char *ies;
unsigned short ies_len;
size_t pmkid_len;
#define FAKE_LOSS_PROBABILITY 0
#if (FAKE_LOSS_PROBABILITY > 0)
do {
unsigned short dice;
dice = RAND_bytes((unsigned char *)&dice, sizeof(dice));
if ((dice % 100) < FAKE_LOSS_PROBABILITY) {
sae_debug(AMPE_DEBUG_FSM, "Frame dropped\n");
return 0;
}
} while (0);
#endif
/* management header, category, action code, mesh id and peering mgmt*/
if (len < 24 + 1 + 1 + 2 + 2)
return 0;
ies = start_of_ies(mgmt, len, &ies_len);
parse_ies(ies, ies_len, &elems);
if (!elems.mesh_peering) {
sae_debug(AMPE_DEBUG_FSM, "Mesh plink: missing necessary peer link ie\n");
return 0;
}
ftype = mgmt->action.action_code;
ie_len = elems.mesh_peering_len;
pmkid_len = ampe_conf.mesh->conf->is_secure ? sizeof(cand->pmkid) : 0;
if ((ftype == PLINK_OPEN && ie_len != 4 + pmkid_len) ||
(ftype == PLINK_CONFIRM && ie_len != 6 + pmkid_len) ||
(ftype == PLINK_CLOSE && ie_len != 6 + pmkid_len &&
ie_len != 8 + pmkid_len)) {
sae_debug(
AMPE_DEBUG_FSM,
"Mesh plink: incorrect plink ie length %d %d\n",
ftype,
ie_len);
return 0;
}
if (ftype != PLINK_CLOSE && (!elems.mesh_id || !elems.mesh_config)) {
sae_debug(
AMPE_DEBUG_FSM,
"Mesh plink: missing necessary ie %p %p\n",
elems.mesh_id,
elems.mesh_config);
return 0;
}
/* Note the lines below are correct, the llid in the frame is the plid
* from the point of view of this host.
*/
memcpy(&plid, PLINK_GET_LLID(elems.mesh_peering), 2);
if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 10))
memcpy(&llid, PLINK_GET_PLID(elems.mesh_peering), 2);
/* match BSSBasicRateSet*/
parse_ies(sta_fixed_ies, sta_fixed_ies_len, &our_elems);
if (ftype != PLINK_CLOSE &&
get_basic_rates(&our_elems) != get_basic_rates(&elems)) {
sae_debug(AMPE_DEBUG_FSM, "mesh plink: mismatched BSSBasicRateSet!\n");
return 0;
}
/* require authed peers if secure mesh */
if (ampe_conf.mesh->conf->is_secure) {
/* "1" here means only get peers in SAE_ACCEPTED */
if ((cand = find_peer(mgmt->sa, 1)) == NULL) {
sae_debug(
AMPE_DEBUG_FSM,
"Mesh plink: plink open from unauthed peer " MACSTR "\n",
MAC2STR(mgmt->sa));
return 0;
}
} else {
/*
* In open mesh, there's no auth stage, so we create the station
* when the first mgmt frame or beacon is received. Do that now
* if we haven't already and this is a plink open frame.
*/
cand = find_peer(mgmt->sa, 0);
if (!cand) {
if (ftype != PLINK_OPEN) {
sae_debug(
AMPE_DEBUG_FSM,
"Mesh plink: ignoring non-open frame from neighbor " MACSTR "\n",
MAC2STR(mgmt->sa));
return 0;
}
cand = create_candidate(mgmt->sa, me, 0, cookie);
if (!cand) {
sae_debug(
AMPE_DEBUG_FSM,
"Mesh plink: could not create new peer " MACSTR "\n",
MAC2STR(mgmt->sa));
return 0;
}
}
}
if (cand->my_lid == 0)
peer_ampe_init(&e_conf, cand, cookie);
ampe_set_peer_ies(cand, &elems);
if (!protection_is_valid(cand, mgmt, len, &elems))
return 0;
cand->cookie = cookie;
if (cand->link_state == PLINK_BLOCKED) {
return 0;
}
/* Now we will figure out the appropriate event... */
event = PLINK_UNDEFINED;
switch (ftype) {
case PLINK_OPEN:
if (!matches_local(ampe_conf.mesh, cand, &elems))
event = OPN_RJCT;
else if (!plink_free_count(ampe_conf.mesh)) {
log_reject(cand, "no free peer links");
event = REQ_RJCT;
} else if (cand->peer_lid && cand->peer_lid != plid) {
log_reject(cand, "invalid peer link id");
event = REQ_RJCT;
} else {
cand->peer_lid = plid;
event = OPN_ACPT;
}
break;
case PLINK_CONFIRM:
if (!matches_local(ampe_conf.mesh, cand, &elems))
event = CNF_RJCT;
else if (!plink_free_count(ampe_conf.mesh)) {
log_reject(cand, "no free peer links");
event = REQ_RJCT;
} else if (cand->my_lid != llid) {
log_reject(cand, "invalid local link id");
event = REQ_RJCT;
} else if (cand->peer_lid != plid) {
log_reject(cand, "invalid peer link id");
event = REQ_RJCT;
} else
event = CNF_ACPT;
break;
case PLINK_CLOSE:
if (cand->link_state == PLINK_ESTAB)
/* Do not check for llid or plid. This does not
* follow the standard but since multiple plinks
* per cand are not supported, it is necessary in
* order to avoid a livelock when MP A sees an
* establish peer link to MP B but MP B does not
* see it. This can be caused by a timeout in
* B's peer link establishment or B beign
* restarted.
*/
event = CLS_ACPT;
else if (cand->peer_lid != plid)
event = CLS_IGNR;
else if (ie_len == 7 && cand->my_lid != llid)
event = CLS_IGNR;
else
event = CLS_ACPT;
break;
default:
sae_debug(AMPE_DEBUG_FSM, "Mesh plink: unknown frame subtype\n");
return 0;
}
sae_debug(
AMPE_DEBUG_FSM,
"Mesh plink peer=" MACSTR " state=%s llid=%d plid=%d event=%s\n",
MAC2STR(mgmt->sa),
mpl_states[cand->link_state],
le16toh(cand->my_lid),
le16toh(cand->peer_lid),
mpl_events[event]);
fsm_step(cand, event);
return 0;
}
