void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt, size_t len, struct ieee80211_rx_status *rx_status) { struct ieee80211_local *local = sdata->local; struct ieee802_11_elems elems; struct sta_info *sta; enum plink_event event; enum plink_frame_type ftype; size_t baselen; u8 ie_len; u8 *baseaddr; __le16 plid, llid, reason; #ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG static const char *mplstates[] = { [PLINK_LISTEN] = "LISTEN", [PLINK_OPN_SNT] = "OPN-SNT", [PLINK_OPN_RCVD] = "OPN-RCVD", [PLINK_CNF_RCVD] = "CNF_RCVD", [PLINK_ESTAB] = "ESTAB", [PLINK_HOLDING] = "HOLDING", [PLINK_BLOCKED] = "BLOCKED" }; #endif /* need action_code, aux */ if (len < IEEE80211_MIN_ACTION_SIZE + 3) return; if (is_multicast_ether_addr(mgmt->da)) { mpl_dbg("Mesh plink: ignore frame from multicast address"); return; } baseaddr = mgmt->u.action.u.plink_action.variable; baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt; if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) { baseaddr += 4; baselen += 4; } ieee802_11_parse_elems(baseaddr, len - baselen, &elems); if (!elems.peer_link) { mpl_dbg("Mesh plink: missing necessary peer link ie\n"); return; } ftype = mgmt->u.action.u.plink_action.action_code; ie_len = elems.peer_link_len; if ((ftype == PLINK_OPEN && ie_len != 6) || (ftype == PLINK_CONFIRM && ie_len != 8) || (ftype == PLINK_CLOSE && ie_len != 8 && ie_len != 10)) { mpl_dbg("Mesh plink: incorrect plink ie length %d %d\n", ftype, ie_len); return; } if (ftype != PLINK_CLOSE && (!elems.mesh_id || !elems.mesh_config)) { mpl_dbg("Mesh plink: missing necessary ie\n"); return; } /* Note the lines below are correct, the llid in the frame is the plid * from the point of view of this host. */ memcpy(&plid, PLINK_GET_LLID(elems.peer_link), 2); if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 10)) memcpy(&llid, PLINK_GET_PLID(elems.peer_link), 2); rcu_read_lock(); sta = sta_info_get(sdata, mgmt->sa); if (!sta && ftype != PLINK_OPEN) { mpl_dbg("Mesh plink: cls or cnf from unknown peer\n"); rcu_read_unlock(); return; } if (sta && sta->plink_state == PLINK_BLOCKED) { rcu_read_unlock(); return; } /* Now we will figure out the appropriate event... */ event = PLINK_UNDEFINED; if (ftype != PLINK_CLOSE && (!mesh_matches_local(&elems, sdata))) { switch (ftype) { case PLINK_OPEN: event = OPN_RJCT; break; case PLINK_CONFIRM: event = CNF_RJCT; break; case PLINK_CLOSE: /* avoid warning */ break; } spin_lock_bh(&sta->lock); } else if (!sta) { /* ftype == PLINK_OPEN */ u32 rates; rcu_read_unlock(); if (!mesh_plink_free_count(sdata)) { mpl_dbg("Mesh plink error: no more free plinks\n"); return; } rates = ieee80211_sta_get_rates(local, &elems, rx_status->band); sta = mesh_plink_alloc(sdata, mgmt->sa, rates); if (!sta) { mpl_dbg("Mesh plink error: plink table full\n"); return; } if (sta_info_insert_rcu(sta)) { rcu_read_unlock(); return; } event = OPN_ACPT; spin_lock_bh(&sta->lock); } else { spin_lock_bh(&sta->lock); switch (ftype) { case PLINK_OPEN: if (!mesh_plink_free_count(sdata) || (sta->plid && sta->plid != plid)) event = OPN_IGNR; else event = OPN_ACPT; break; case PLINK_CONFIRM: if (!mesh_plink_free_count(sdata) || (sta->llid != llid || sta->plid != plid)) event = CNF_IGNR; else event = CNF_ACPT; break; case PLINK_CLOSE: if (sta->plink_state == PLINK_ESTAB) /* Do not check for llid or plid. This does not * follow the standard but since multiple plinks * per sta are not supported, it is necessary in * order to avoid a livelock when MP A sees an * establish peer link to MP B but MP B does not * see it. This can be caused by a timeout in * B's peer link establishment or B beign * restarted. */ event = CLS_ACPT; else if (sta->plid != plid) event = CLS_IGNR; else if (ie_len == 7 && sta->llid != llid) event = CLS_IGNR; else event = CLS_ACPT; break; default: mpl_dbg("Mesh plink: unknown frame subtype\n"); spin_unlock_bh(&sta->lock); rcu_read_unlock(); return; } } mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n", mgmt->sa, mplstates[sta->plink_state], le16_to_cpu(sta->llid), le16_to_cpu(sta->plid), event); reason = 0; switch (sta->plink_state) { /* spin_unlock as soon as state is updated at each case */ case PLINK_LISTEN: switch (event) { case CLS_ACPT: mesh_plink_fsm_restart(sta); spin_unlock_bh(&sta->lock); break; case OPN_ACPT: sta->plink_state = PLINK_OPN_RCVD; sta->plid = plid; get_random_bytes(&llid, 2); sta->llid = llid; mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata)); spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, PLINK_OPEN, sta->sta.addr, llid, 0, 0); mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid, plid, 0); break; default: spin_unlock_bh(&sta->lock); break; } break; case PLINK_OPN_SNT: switch (event) { case OPN_RJCT: case CNF_RJCT: reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION); case CLS_ACPT: if (!reason) reason = cpu_to_le16(MESH_CLOSE_RCVD); sta->reason = reason; sta->plink_state = PLINK_HOLDING; if (!mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata))) sta->ignore_plink_timer = true; llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, plid, reason); break; case OPN_ACPT: /* retry timer is left untouched */ sta->plink_state = PLINK_OPN_RCVD; sta->plid = plid; llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid, plid, 0); break; case CNF_ACPT: sta->plink_state = PLINK_CNF_RCVD; if (!mod_plink_timer(sta, dot11MeshConfirmTimeout(sdata))) sta->ignore_plink_timer = true; spin_unlock_bh(&sta->lock); break; default: spin_unlock_bh(&sta->lock); break; } break; case PLINK_OPN_RCVD: switch (event) { case OPN_RJCT: case CNF_RJCT: reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION); case CLS_ACPT: if (!reason) reason = cpu_to_le16(MESH_CLOSE_RCVD); sta->reason = reason; sta->plink_state = PLINK_HOLDING; if (!mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata))) sta->ignore_plink_timer = true; llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, plid, reason); break; case OPN_ACPT: llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid, plid, 0); break; case CNF_ACPT: del_timer(&sta->plink_timer); sta->plink_state = PLINK_ESTAB; mesh_plink_inc_estab_count(sdata); spin_unlock_bh(&sta->lock); mpl_dbg("Mesh plink with %pM ESTABLISHED\n", sta->sta.addr); break; default: spin_unlock_bh(&sta->lock); break; } break; case PLINK_CNF_RCVD: switch (event) { case OPN_RJCT: case CNF_RJCT: reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION); case CLS_ACPT: if (!reason) reason = cpu_to_le16(MESH_CLOSE_RCVD); sta->reason = reason; sta->plink_state = PLINK_HOLDING; if (!mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata))) sta->ignore_plink_timer = true; llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, plid, reason); break; case OPN_ACPT: del_timer(&sta->plink_timer); sta->plink_state = PLINK_ESTAB; mesh_plink_inc_estab_count(sdata); spin_unlock_bh(&sta->lock); mpl_dbg("Mesh plink with %pM ESTABLISHED\n", sta->sta.addr); mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid, plid, 0); break; default: spin_unlock_bh(&sta->lock); break; } break; case PLINK_ESTAB: switch (event) { case CLS_ACPT: reason = cpu_to_le16(MESH_CLOSE_RCVD); sta->reason = reason; __mesh_plink_deactivate(sta); sta->plink_state = PLINK_HOLDING; llid = sta->llid; mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata)); spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, plid, reason); break; case OPN_ACPT: llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid, plid, 0); break; default: spin_unlock_bh(&sta->lock); break; } break; case PLINK_HOLDING: switch (event) { case CLS_ACPT: if (del_timer(&sta->plink_timer)) sta->ignore_plink_timer = 1; mesh_plink_fsm_restart(sta); spin_unlock_bh(&sta->lock); break; case OPN_ACPT: case CNF_ACPT: case OPN_RJCT: case CNF_RJCT: llid = sta->llid; reason = sta->reason; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, plid, reason); break; default: spin_unlock_bh(&sta->lock); } break; default: /* should not get here, PLINK_BLOCKED is dealt with at the * beggining of the function */ spin_unlock_bh(&sta->lock); break; } rcu_read_unlock(); }
/** * process_ampe_frame - process an ampe frame * @frame: The full frame * @len: The full frame length * @me: The MAC address of the local interface * @cookie: Opaque cookie that will be returned to the caller along with * frames to be transmitted. * * Returns 0 unless something really horrible happened. In other words, even * the frame could not be processed or it was corrupted, the function still * returns 0. */ int process_ampe_frame(struct ieee80211_mgmt_frame *mgmt, int len, unsigned char *me, void *cookie) { struct info_elems elems; struct info_elems our_elems; unsigned char ftype; struct candidate *cand = NULL; enum plink_event event; unsigned char ie_len = 0; unsigned short plid = 0, llid = 0; unsigned char *ies; unsigned short ies_len; #define FAKE_LOSS_PROBABILITY 0 #if (FAKE_LOSS_PROBABILITY > 0) do { unsigned short dice; dice = RAND_bytes((unsigned char *) &dice, sizeof(dice)); if ((dice % 100) < FAKE_LOSS_PROBABILITY) { sae_debug(AMPE_DEBUG_FSM, "Frame dropped\n"); return 0; } } while (0); #endif /* management header, category, action code, mesh id and peering mgmt*/ if (len < 24 + 1 + 1 + 2 + 2) return 0; //if (is_multicast_ether_addr(mgmt->da)) { // sae_debug(AMPE_DEBUG_FSM, "Mesh plink: ignore frame to multicast address"); // return 0; //} ies = start_of_ies(mgmt, len, &ies_len); parse_ies(ies, ies_len, &elems); if (!elems.mesh_peering) { // || !elems.rsn) { sae_debug(AMPE_DEBUG_FSM, "Mesh plink: missing necessary peer link ie\n"); return 0; } ftype = mgmt->action.action_code; ie_len = elems.mesh_peering_len; if ((ftype == PLINK_OPEN && ie_len != 20) || (ftype == PLINK_CONFIRM && ie_len != 22) || (ftype == PLINK_CLOSE && ie_len != 22 && ie_len != 24)) { sae_debug(AMPE_DEBUG_FSM, "Mesh plink: incorrect plink ie length %d %d\n", ftype, ie_len); return 0; } if (ftype != PLINK_CLOSE && (!elems.mesh_id || !elems.mesh_config)) { sae_debug(AMPE_DEBUG_FSM, "Mesh plink: missing necessary ie %p %p\n", elems.mesh_id, elems.mesh_config); return 0; } /* Note the lines below are correct, the llid in the frame is the plid * from the point of view of this host. */ memcpy(&plid, PLINK_GET_LLID(elems.mesh_peering), 2); if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 10)) memcpy(&llid, PLINK_GET_PLID(elems.mesh_peering), 2); /* match BSSBasicRateSet*/ parse_ies(sta_fixed_ies, sta_fixed_ies_len, &our_elems); if (get_basic_rates(&our_elems) != get_basic_rates(&elems)) { sae_debug(AMPE_DEBUG_FSM, "mesh plink: mismatched BSSBasicRateSet!\n"); return 0; } /* "1" here means only get peers in SAE_ACCEPTED */ if ((cand = find_peer(mgmt->sa, 1)) == NULL) { sae_debug(AMPE_DEBUG_FSM, "Mesh plink: plink open from unauthed peer "MACSTR"\n", MAC2STR(mgmt->sa)); return 0; } if (cand->my_lid == 0) peer_ampe_init(&e_conf, cand, me, cookie); if (elems.sup_rates) { memcpy(cand->sup_rates, elems.sup_rates, elems.sup_rates_len); cand->sup_rates_len = elems.sup_rates_len; if (elems.ext_rates) { memcpy(cand->sup_rates + elems.sup_rates_len, elems.ext_rates, elems.ext_rates_len); cand->sup_rates_len += elems.ext_rates_len; } } check_frame_protection(cand, mgmt, len, &elems); cand->cookie = cookie; if (cand->link_state == PLINK_BLOCKED) { return 0; } /* Now we will figure out the appropriate event... */ event = PLINK_UNDEFINED; // if (ftype != PLINK_CLOSE && (!mesh_matches_local(&elems, sdata))) { if (ftype != PLINK_CLOSE) { switch (ftype) { case PLINK_OPEN: event = OPN_RJCT; break; case PLINK_CONFIRM: event = CNF_RJCT; break; case PLINK_CLOSE: break; } } switch (ftype) { case PLINK_OPEN: if (!plink_free_count() || (cand->peer_lid && cand->peer_lid != plid)) event = OPN_IGNR; else { cand->peer_lid = plid; event = OPN_ACPT; } break; case PLINK_CONFIRM: if (!plink_free_count() || (cand->my_lid != llid || cand->peer_lid != plid)) event = CNF_IGNR; else event = CNF_ACPT; break; case PLINK_CLOSE: if (cand->link_state == PLINK_ESTAB) /* Do not check for llid or plid. This does not * follow the standard but since multiple plinks * per cand are not supported, it is necessary in * order to avoid a livelock when MP A sees an * establish peer link to MP B but MP B does not * see it. This can be caused by a timeout in * B's peer link establishment or B beign * restarted. */ event = CLS_ACPT; else if (cand->peer_lid != plid) event = CLS_IGNR; else if (ie_len == 7 && cand->my_lid != llid) event = CLS_IGNR; else event = CLS_ACPT; break; default: sae_debug(AMPE_DEBUG_FSM, "Mesh plink: unknown frame subtype\n"); return 0; } sae_debug(AMPE_DEBUG_FSM, "Mesh plink (peer, state, llid, plid, event): " MACSTR " %s %d %d %d\n", MAC2STR(mgmt->sa), mplstates[cand->link_state], le16toh(cand->my_lid), le16toh(cand->peer_lid), event); fsm_step(cand, event); return 0; }
void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt, size_t len, struct ieee80211_rx_status *rx_status) { struct ieee80211_local *local = sdata->local; struct ieee802_11_elems elems; struct sta_info *sta; enum plink_event event; enum ieee80211_self_protected_actioncode ftype; size_t baselen; bool deactivated, matches_local = true; u8 ie_len; u8 *baseaddr; __le16 plid, llid, reason; #ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG static const char *mplstates[] = { [NL80211_PLINK_LISTEN] = "LISTEN", [NL80211_PLINK_OPN_SNT] = "OPN-SNT", [NL80211_PLINK_OPN_RCVD] = "OPN-RCVD", [NL80211_PLINK_CNF_RCVD] = "CNF_RCVD", [NL80211_PLINK_ESTAB] = "ESTAB", [NL80211_PLINK_HOLDING] = "HOLDING", [NL80211_PLINK_BLOCKED] = "BLOCKED" }; #endif /* */ if (len < IEEE80211_MIN_ACTION_SIZE + 3) return; if (is_multicast_ether_addr(mgmt->da)) { mpl_dbg("Mesh plink: ignore frame from multicast address"); return; } baseaddr = mgmt->u.action.u.self_prot.variable; baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt; if (mgmt->u.action.u.self_prot.action_code == WLAN_SP_MESH_PEERING_CONFIRM) { baseaddr += 4; baselen += 4; } ieee802_11_parse_elems(baseaddr, len - baselen, &elems); if (!elems.peering) { mpl_dbg("Mesh plink: missing necessary peer link ie\n"); return; } if (elems.rsn_len && sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) { mpl_dbg("Mesh plink: can't establish link with secure peer\n"); return; } ftype = mgmt->u.action.u.self_prot.action_code; ie_len = elems.peering_len; if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) || (ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) || (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6 && ie_len != 8)) { mpl_dbg("Mesh plink: incorrect plink ie length %d %d\n", ftype, ie_len); return; } if (ftype != WLAN_SP_MESH_PEERING_CLOSE && (!elems.mesh_id || !elems.mesh_config)) { mpl_dbg("Mesh plink: missing necessary ie\n"); return; } /* */ memcpy(&plid, PLINK_GET_LLID(elems.peering), 2); if (ftype == WLAN_SP_MESH_PEERING_CONFIRM || (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8)) memcpy(&llid, PLINK_GET_PLID(elems.peering), 2); rcu_read_lock(); sta = sta_info_get(sdata, mgmt->sa); if (!sta && ftype != WLAN_SP_MESH_PEERING_OPEN) { mpl_dbg("Mesh plink: cls or cnf from unknown peer\n"); rcu_read_unlock(); return; } if (ftype == WLAN_SP_MESH_PEERING_OPEN && !rssi_threshold_check(sta, sdata)) { mpl_dbg("Mesh plink: %pM does not meet rssi threshold\n", mgmt->sa); rcu_read_unlock(); return; } if (sta && !test_sta_flag(sta, WLAN_STA_AUTH)) { mpl_dbg("Mesh plink: Action frame from non-authed peer\n"); rcu_read_unlock(); return; } if (sta && sta->plink_state == NL80211_PLINK_BLOCKED) { rcu_read_unlock(); return; } /* */ event = PLINK_UNDEFINED; if (ftype != WLAN_SP_MESH_PEERING_CLOSE && (!mesh_matches_local(&elems, sdata))) { matches_local = false; switch (ftype) { case WLAN_SP_MESH_PEERING_OPEN: event = OPN_RJCT; break; case WLAN_SP_MESH_PEERING_CONFIRM: event = CNF_RJCT; break; default: break; } } if (!sta && !matches_local) { rcu_read_unlock(); reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG); llid = 0; mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, mgmt->sa, llid, plid, reason); return; } else if (!sta) { /* */ u32 rates; rcu_read_unlock(); if (!mesh_plink_free_count(sdata)) { mpl_dbg("Mesh plink error: no more free plinks\n"); return; } rates = ieee80211_sta_get_rates(local, &elems, rx_status->band); sta = mesh_plink_alloc(sdata, mgmt->sa, rates, &elems); if (!sta) { mpl_dbg("Mesh plink error: plink table full\n"); return; } if (sta_info_insert_rcu(sta)) { rcu_read_unlock(); return; } event = OPN_ACPT; spin_lock_bh(&sta->lock); } else if (matches_local) { spin_lock_bh(&sta->lock); switch (ftype) { case WLAN_SP_MESH_PEERING_OPEN: if (!mesh_plink_free_count(sdata) || (sta->plid && sta->plid != plid)) event = OPN_IGNR; else event = OPN_ACPT; break; case WLAN_SP_MESH_PEERING_CONFIRM: if (!mesh_plink_free_count(sdata) || (sta->llid != llid || sta->plid != plid)) event = CNF_IGNR; else event = CNF_ACPT; break; case WLAN_SP_MESH_PEERING_CLOSE: if (sta->plink_state == NL80211_PLINK_ESTAB) /* */ event = CLS_ACPT; else if (sta->plid != plid) event = CLS_IGNR; else if (ie_len == 7 && sta->llid != llid) event = CLS_IGNR; else event = CLS_ACPT; break; default: mpl_dbg("Mesh plink: unknown frame subtype\n"); spin_unlock_bh(&sta->lock); rcu_read_unlock(); return; } } else { spin_lock_bh(&sta->lock); } mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n", mgmt->sa, mplstates[sta->plink_state], le16_to_cpu(sta->llid), le16_to_cpu(sta->plid), event); reason = 0; switch (sta->plink_state) { /* */ case NL80211_PLINK_LISTEN: switch (event) { case CLS_ACPT: mesh_plink_fsm_restart(sta); spin_unlock_bh(&sta->lock); break; case OPN_ACPT: sta->plink_state = NL80211_PLINK_OPN_RCVD; sta->plid = plid; get_random_bytes(&llid, 2); sta->llid = llid; mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata)); spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN, sta->sta.addr, llid, 0, 0); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CONFIRM, sta->sta.addr, llid, plid, 0); break; default: spin_unlock_bh(&sta->lock); break; } break; case NL80211_PLINK_OPN_SNT: switch (event) { case OPN_RJCT: case CNF_RJCT: reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG); case CLS_ACPT: if (!reason) reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE); sta->reason = reason; sta->plink_state = NL80211_PLINK_HOLDING; if (!mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata))) sta->ignore_plink_timer = true; llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, sta->sta.addr, llid, plid, reason); break; case OPN_ACPT: /* */ sta->plink_state = NL80211_PLINK_OPN_RCVD; sta->plid = plid; llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CONFIRM, sta->sta.addr, llid, plid, 0); break; case CNF_ACPT: sta->plink_state = NL80211_PLINK_CNF_RCVD; if (!mod_plink_timer(sta, dot11MeshConfirmTimeout(sdata))) sta->ignore_plink_timer = true; spin_unlock_bh(&sta->lock); break; default: spin_unlock_bh(&sta->lock); break; } break; case NL80211_PLINK_OPN_RCVD: switch (event) { case OPN_RJCT: case CNF_RJCT: reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG); case CLS_ACPT: if (!reason) reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE); sta->reason = reason; sta->plink_state = NL80211_PLINK_HOLDING; if (!mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata))) sta->ignore_plink_timer = true; llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, sta->sta.addr, llid, plid, reason); break; case OPN_ACPT: llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CONFIRM, sta->sta.addr, llid, plid, 0); break; case CNF_ACPT: del_timer(&sta->plink_timer); sta->plink_state = NL80211_PLINK_ESTAB; spin_unlock_bh(&sta->lock); mesh_plink_inc_estab_count(sdata); ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON); mpl_dbg("Mesh plink with %pM ESTABLISHED\n", sta->sta.addr); break; default: spin_unlock_bh(&sta->lock); break; } break; case NL80211_PLINK_CNF_RCVD: switch (event) { case OPN_RJCT: case CNF_RJCT: reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG); case CLS_ACPT: if (!reason) reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE); sta->reason = reason; sta->plink_state = NL80211_PLINK_HOLDING; if (!mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata))) sta->ignore_plink_timer = true; llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, sta->sta.addr, llid, plid, reason); break; case OPN_ACPT: del_timer(&sta->plink_timer); sta->plink_state = NL80211_PLINK_ESTAB; spin_unlock_bh(&sta->lock); mesh_plink_inc_estab_count(sdata); ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON); mpl_dbg("Mesh plink with %pM ESTABLISHED\n", sta->sta.addr); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CONFIRM, sta->sta.addr, llid, plid, 0); break; default: spin_unlock_bh(&sta->lock); break; } break; case NL80211_PLINK_ESTAB: switch (event) { case CLS_ACPT: reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE); sta->reason = reason; deactivated = __mesh_plink_deactivate(sta); sta->plink_state = NL80211_PLINK_HOLDING; llid = sta->llid; mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata)); spin_unlock_bh(&sta->lock); if (deactivated) ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, sta->sta.addr, llid, plid, reason); break; case OPN_ACPT: llid = sta->llid; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CONFIRM, sta->sta.addr, llid, plid, 0); break; default: spin_unlock_bh(&sta->lock); break; } break; case NL80211_PLINK_HOLDING: switch (event) { case CLS_ACPT: if (del_timer(&sta->plink_timer)) sta->ignore_plink_timer = 1; mesh_plink_fsm_restart(sta); spin_unlock_bh(&sta->lock); break; case OPN_ACPT: case CNF_ACPT: case OPN_RJCT: case CNF_RJCT: llid = sta->llid; reason = sta->reason; spin_unlock_bh(&sta->lock); mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE, sta->sta.addr, llid, plid, reason); break; default: spin_unlock_bh(&sta->lock); } break; default: /* */ spin_unlock_bh(&sta->lock); break; } rcu_read_unlock(); }
/** * process_ampe_frame - process an ampe frame * @frame: The full frame * @len: The full frame length * @me: The MAC address of the local interface * @cookie: Opaque cookie that will be returned to the caller along with * frames to be transmitted. * * Returns 0 unless something really horrible happened. In other words, even * the frame could not be processed or it was corrupted, the function still * returns 0. */ int process_ampe_frame( struct ieee80211_mgmt_frame *mgmt, int len, unsigned char *me, void *cookie) { struct info_elems elems; struct info_elems our_elems; unsigned char ftype; struct candidate *cand = NULL; enum plink_event event; unsigned char ie_len = 0; unsigned short plid = 0, llid = 0; unsigned char *ies; unsigned short ies_len; size_t pmkid_len; #define FAKE_LOSS_PROBABILITY 0 #if (FAKE_LOSS_PROBABILITY > 0) do { unsigned short dice; dice = RAND_bytes((unsigned char *)&dice, sizeof(dice)); if ((dice % 100) < FAKE_LOSS_PROBABILITY) { sae_debug(AMPE_DEBUG_FSM, "Frame dropped\n"); return 0; } } while (0); #endif /* management header, category, action code, mesh id and peering mgmt*/ if (len < 24 + 1 + 1 + 2 + 2) return 0; ies = start_of_ies(mgmt, len, &ies_len); parse_ies(ies, ies_len, &elems); if (!elems.mesh_peering) { sae_debug(AMPE_DEBUG_FSM, "Mesh plink: missing necessary peer link ie\n"); return 0; } ftype = mgmt->action.action_code; ie_len = elems.mesh_peering_len; pmkid_len = ampe_conf.mesh->conf->is_secure ? sizeof(cand->pmkid) : 0; if ((ftype == PLINK_OPEN && ie_len != 4 + pmkid_len) || (ftype == PLINK_CONFIRM && ie_len != 6 + pmkid_len) || (ftype == PLINK_CLOSE && ie_len != 6 + pmkid_len && ie_len != 8 + pmkid_len)) { sae_debug( AMPE_DEBUG_FSM, "Mesh plink: incorrect plink ie length %d %d\n", ftype, ie_len); return 0; } if (ftype != PLINK_CLOSE && (!elems.mesh_id || !elems.mesh_config)) { sae_debug( AMPE_DEBUG_FSM, "Mesh plink: missing necessary ie %p %p\n", elems.mesh_id, elems.mesh_config); return 0; } /* Note the lines below are correct, the llid in the frame is the plid * from the point of view of this host. */ memcpy(&plid, PLINK_GET_LLID(elems.mesh_peering), 2); if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 10)) memcpy(&llid, PLINK_GET_PLID(elems.mesh_peering), 2); /* match BSSBasicRateSet*/ parse_ies(sta_fixed_ies, sta_fixed_ies_len, &our_elems); if (ftype != PLINK_CLOSE && get_basic_rates(&our_elems) != get_basic_rates(&elems)) { sae_debug(AMPE_DEBUG_FSM, "mesh plink: mismatched BSSBasicRateSet!\n"); return 0; } /* require authed peers if secure mesh */ if (ampe_conf.mesh->conf->is_secure) { /* "1" here means only get peers in SAE_ACCEPTED */ if ((cand = find_peer(mgmt->sa, 1)) == NULL) { sae_debug( AMPE_DEBUG_FSM, "Mesh plink: plink open from unauthed peer " MACSTR "\n", MAC2STR(mgmt->sa)); return 0; } } else { /* * In open mesh, there's no auth stage, so we create the station * when the first mgmt frame or beacon is received. Do that now * if we haven't already and this is a plink open frame. */ cand = find_peer(mgmt->sa, 0); if (!cand) { if (ftype != PLINK_OPEN) { sae_debug( AMPE_DEBUG_FSM, "Mesh plink: ignoring non-open frame from neighbor " MACSTR "\n", MAC2STR(mgmt->sa)); return 0; } cand = create_candidate(mgmt->sa, me, 0, cookie); if (!cand) { sae_debug( AMPE_DEBUG_FSM, "Mesh plink: could not create new peer " MACSTR "\n", MAC2STR(mgmt->sa)); return 0; } } } if (cand->my_lid == 0) peer_ampe_init(&e_conf, cand, cookie); ampe_set_peer_ies(cand, &elems); if (!protection_is_valid(cand, mgmt, len, &elems)) return 0; cand->cookie = cookie; if (cand->link_state == PLINK_BLOCKED) { return 0; } /* Now we will figure out the appropriate event... */ event = PLINK_UNDEFINED; switch (ftype) { case PLINK_OPEN: if (!matches_local(ampe_conf.mesh, cand, &elems)) event = OPN_RJCT; else if (!plink_free_count(ampe_conf.mesh)) { log_reject(cand, "no free peer links"); event = REQ_RJCT; } else if (cand->peer_lid && cand->peer_lid != plid) { log_reject(cand, "invalid peer link id"); event = REQ_RJCT; } else { cand->peer_lid = plid; event = OPN_ACPT; } break; case PLINK_CONFIRM: if (!matches_local(ampe_conf.mesh, cand, &elems)) event = CNF_RJCT; else if (!plink_free_count(ampe_conf.mesh)) { log_reject(cand, "no free peer links"); event = REQ_RJCT; } else if (cand->my_lid != llid) { log_reject(cand, "invalid local link id"); event = REQ_RJCT; } else if (cand->peer_lid != plid) { log_reject(cand, "invalid peer link id"); event = REQ_RJCT; } else event = CNF_ACPT; break; case PLINK_CLOSE: if (cand->link_state == PLINK_ESTAB) /* Do not check for llid or plid. This does not * follow the standard but since multiple plinks * per cand are not supported, it is necessary in * order to avoid a livelock when MP A sees an * establish peer link to MP B but MP B does not * see it. This can be caused by a timeout in * B's peer link establishment or B beign * restarted. */ event = CLS_ACPT; else if (cand->peer_lid != plid) event = CLS_IGNR; else if (ie_len == 7 && cand->my_lid != llid) event = CLS_IGNR; else event = CLS_ACPT; break; default: sae_debug(AMPE_DEBUG_FSM, "Mesh plink: unknown frame subtype\n"); return 0; } sae_debug( AMPE_DEBUG_FSM, "Mesh plink peer=" MACSTR " state=%s llid=%d plid=%d event=%s\n", MAC2STR(mgmt->sa), mpl_states[cand->link_state], le16toh(cand->my_lid), le16toh(cand->peer_lid), mpl_events[event]); fsm_step(cand, event); return 0; }