Commit Graph

265 Commits

Author SHA1 Message Date
Sam Leffler
246b546762 add support for 802.11 packet injection via bpf
Together with:	Andrea Bittau <a.bittau@cs.ucl.ac.uk>
Reviewed by:	arch@
MFC after:	1 month
2006-07-26 03:15:16 +00:00
Sam Leffler
546786c951 add IEEE80211_IOC_BMISSTHRESHOLD for managing the beacon miss
threshold

Submitted by:	Henrik Brix Andersen <henrik@brixandersen.dk>
MFC after:	2 weeks
2006-07-26 03:07:36 +00:00
Sam Leffler
202b0d1101 o move min/max beacon interval and dtim period to public location
o add min/max beacon miss threshold settings
o delete IEEE80211_SWBMISS_THRESHOLD, it was never used

MFC after:	2 weeks
2006-07-26 03:05:34 +00:00
Sam Leffler
5eac3ff784 correct ie length check; need to include fixed part of ie
MFC after:	2 weeks
2006-07-16 21:19:28 +00:00
Sam Leffler
0eda166b8f power save mode state changes should not require clocking the 802.11
state machine; use the reset method instead

MFC after:	2 weeks
2006-07-16 19:10:41 +00:00
Sam Leffler
70326a6eb6 tighten invariant on loops used to parse ie's; this ensures we never
touch data outside the packet (previously we might touch 1 byte); it
also has the happy side effect of working around broken orinoco/agere
firmware that sends malformed association response frames

Help by:	Vladimir Egorin
2006-07-16 16:02:17 +00:00
Sam Leffler
f1bf5adef5 remove duplicate ifname in debug msg
MFC after:	1 week
2006-06-24 18:00:17 +00:00
John Baldwin
edd32c2da2 Use kern_kldload() and kern_kldunload() to load and unload modules when
we intend for the user to be able to unload them later via kldunload(2)
instead of calling linker_load_module() and then directly adjusting the
ref count on the linker file structure.  This makes the resulting
consumer code simpler and cleaner and better hides the linker internals
making it possible to sanely lock the linker.
2006-06-13 21:36:23 +00:00
Christian S.J. Peron
16d878cc99 Fix the following bpf(4) race condition which can result in a panic:
(1) bpf peer attaches to interface netif0
	(2) Packet is received by netif0
	(3) ifp->if_bpf pointer is checked and handed off to bpf
	(4) bpf peer detaches from netif0 resulting in ifp->if_bpf being
	    initialized to NULL.
	(5) ifp->if_bpf is dereferenced by bpf machinery
	(6) Kaboom

This race condition likely explains the various different kernel panics
reported around sending SIGINT to tcpdump or dhclient processes. But really
this race can result in kernel panics anywhere you have frequent bpf attach
and detach operations with high packet per second load.

Summary of changes:

- Remove the bpf interface's "driverp" member
- When we attach bpf interfaces, we now set the ifp->if_bpf member to the
  bpf interface structure. Once this is done, ifp->if_bpf should never be
  NULL. [1]
- Introduce bpf_peers_present function, an inline operation which will do
  a lockless read bpf peer list associated with the interface. It should
  be noted that the bpf code will pickup the bpf_interface lock before adding
  or removing bpf peers. This should serialize the access to the bpf descriptor
  list, removing the race.
- Expose the bpf_if structure in bpf.h so that the bpf_peers_present function
  can use it. This also removes the struct bpf_if; hack that was there.
- Adjust all consumers of the raw if_bpf structure to use bpf_peers_present

Now what happens is:

	(1) Packet is received by netif0
	(2) Check to see if bpf descriptor list is empty
	(3) Pickup the bpf interface lock
	(4) Hand packet off to process

From the attach/detach side:

	(1) Pickup the bpf interface lock
	(2) Add/remove from bpf descriptor list

Now that we are storing the bpf interface structure with the ifnet, there is
is no need to walk the bpf interface list to locate the correct bpf interface.
We now simply look up the interface, and initialize the pointer. This has a
nice side effect of changing a bpf interface attach operation from O(N) (where
N is the number of bpf interfaces), to O(1).

[1] From now on, we can no longer check ifp->if_bpf to tell us whether or
    not we have any bpf peers that might be interested in receiving packets.

In collaboration with:	sam@
MFC after:	1 month
2006-06-02 19:59:33 +00:00
Diomidis Spinellis
132142c572 Move conditional preprocessing out from the IEEE80211_DPRINTF macro
invocation.  Per C99 6.10.3 paragraph 11 preprocessing directives
appearing as macro arguments yield undefined behavior.
2006-06-01 14:06:32 +00:00
Sam Leffler
ee25b8df01 Ensure outbound data packets in hostap mode are delivered only to
stations that are associated by making ieee80211_find_txnode return
NULL when a unicast frame is to be delivered to an unassociated
station.  This will be handled differently in the future but for
now putting the check here allows all drivers to immediately do
the right thing.

Reviewed by:	avatar
MFC after:	1 week
2006-04-28 19:06:15 +00:00
Sam Leffler
9cab5ba3f9 back out public safety-specific channel number mapping; we can't do
it until we know it should be applied as otherwise we can map 11a
channels into the 2.4G range and choose the wrong item from the
chanenl array
2006-04-26 16:00:37 +00:00
Sam Leffler
42568791f9 implement set(IEEE80211_IOC_STA_STATS) for hostapd; for
now just make it clear station statistics (could read
a stat block and assign to caller can do partial changes)

Reviewed by:	avatar (previous version)
MFC after:	1 week
2006-03-27 05:22:35 +00:00
Sam Leffler
83a244dbe0 when doing s/w crypto make sure work is done w/ a writable mbuf chain;
this corrects problems with drivers that rely on the host to do
crypto (iwi, ipw, ral, ural, wi (hostap), awi)

Hard work by:	luigi, mlaier
Reviewed by:	luigi, mlaier
MFC after:	1 week
2006-03-15 21:27:08 +00:00
Sam Leffler
ad26242724 fix switching between agressive and non-agressive wmm modes
Obtained from:	atheros
MFC after:	3 days
2006-03-10 06:18:03 +00:00
Sam Leffler
a8eb5364fe use m_dup instead of m_copypacket when doing internal bridging
in case packets are modified (e.g. encrypted)

MFC after:	1 week
2006-03-07 03:55:05 +00:00
Sam Leffler
66ef39690f deliver an l2uf frame on sta join to prime the bridge
Obtained from:	madwifi
MFC after:	1 week
2006-03-06 17:26:16 +00:00
Sam Leffler
097131fffe when scanning channels marked passive defer probe request until
802.11 traffic is seen; fixes problems with ap's hiding their ssid

Obtained from:	atheros
MFC after:	1 week
2006-03-06 17:23:26 +00:00
Sam Leffler
667dad55fc consolidate calculation of capabilities ie
Reviewed by:	avatar
MFC after:	2 weeks
2006-02-25 05:36:43 +00:00
Sam Leffler
386d84f60e honor user-specified key index for global key slots
Submitted by:	Joe Love
Reviewed by:	avatar
MFC after:	1 week
2006-02-21 23:51:19 +00:00
Sam Leffler
d3b3a464a5 treat setting the optional ie to a zero-length datum to mean "delete
the ie"; this helps drivers that (wrongly) check ic_opt_ie against NULL
when making decisions

Reviewed by:	luigi, avatar
MFC after:	3 days
2006-02-20 17:17:00 +00:00
Sam Leffler
97bcffbd74 o make driver override of net80211 parameter state consistent
with methods: instead of honoring non-zero values expect drivers
  to write their own values on return from ieee80211_ifattach
o add a define for the default h/w bmiss count

MFC after:	2 weeks
2006-02-14 17:48:56 +00:00
Sam Leffler
6d049ab343 set the mgt frame tx timer before dispatching the frame to the
driver; this closes a race where a response could be processed
before the timer was started and cause a RUN->SCAN state change
when operating in station mode

Reviewed by:	avatar, dyoung
MFC after:	1 week
2006-02-08 17:30:31 +00:00
Sam Leffler
e99662a623 s/w beacon miss facility; need to add knobs to fiddle with the settings
MFC after:	2 weeks
2006-01-23 21:02:49 +00:00
Sam Leffler
233e00212e switch beacon miss threshold from a time to the number of beacon
frames; the time value was implicitly based on the beacon interval
but never being updated so wrong when the negotiated beacon interval
was not 100 TU
2006-01-23 20:57:30 +00:00
Sam Leffler
336ec6a116 bounds check each ie's length when parsing
Obtained from:	madwifi
MFC after:	1 week
2006-01-23 19:31:00 +00:00
Sam Leffler
239cc3b6ce Rev ioctl to get scan results:
o lock the list walk
o malloc a results buffer instead of copying out one result at a time
  using an on-stack buffer
o fix definition of ieee80211req_scan_result so size of variable-length
  information elements is large enough to hold all possible ie's
  (still only return wpa+wme, at some point may return all)
o make rssi+noise data signed; they should've been so all along
o add a bit more padding for future additions while we're here
o define a new ioctl for new api and add compat code for old ioctl
  under COMPAT_FREEBSD6 (temporarily enabled local to the file)

Reviewed by:	Scott Long
MFC after:	2 weeks
2006-01-18 22:17:50 +00:00
Sam Leffler
a1a5050276 bump the scan generation number before iterating so we're guaranteed
to have a value that's not been used before; this fixes the problem
where the first traversal of the scan list did nothing because the
entries were initialized with the current generation number (a
separate issue)

MFC after:	1 week
2006-01-18 19:56:17 +00:00
Colin Percival
9238d0aff6 Correct a buffer overflow when scanning for 802.11 wireless networks.
Security:	FreeBSD-SA-06:05.80211
2006-01-18 09:03:15 +00:00
Sam Leffler
2204bcfd7c add flag to tag frames w/ a known bad FCS
Obtained from:	netbsd
MFC after:	1 week
2006-01-09 17:04:56 +00:00
Sam Leffler
59a440350c enable "aggressive mode" only when operating in ap or station mode; in
particular this fixes use of wme in adhoc demo mode, it wasn't possible
to set the txop limit because the aggressive mode logic would override

Reviewed by:	apatti
MFC after:	2 weeks
2006-01-02 17:16:27 +00:00
Sam Leffler
0912bac9b3 update erp information element in the beacon frame to reflect
changes in the bss

Reviewed by:	avatar
Obtained from:	atheros
MFC after:	2 weeks
2006-01-02 16:57:20 +00:00
Sam Leffler
399178c917 correct checking for turbo channels: rev 1.24 fixed static turbo channels
but broke handling of the turboG channel; since we aren't ready to revamp
the channel list just check for turboA channels for now so channel 6 is
considered in auto mode

Noticed by:	gibbs
2005-12-30 00:40:36 +00:00
Sam Leffler
9a9162def2 correct (reversed) ms<->tu macros
Reviewed by:	apatti, kcyu
2005-12-29 19:03:45 +00:00
Gleb Smirnoff
d147662cd3 - Fix VLAN_INPUT_TAG() macro, so that it doesn't touch mtag in
case if memory allocation failed.
- Remove fourth argument from VLAN_INPUT_TAG(), that was used
  incorrectly in almost all drivers. Indicate failure with
  mbuf value of NULL.

In collaboration with:	yongari, ru, sam
2005-12-18 18:24:27 +00:00
Sam Leffler
c27e4e31fe make packet bursting configurable (default to on if device is capable) 2005-12-14 19:32:53 +00:00
Sam Leffler
8e292e8ecd When creating neighbor entries for an ahdemo bss apply the local
settings.  In particular this allows us to use QoS frames in a
bss and in turn enables disabling ack's.
2005-12-14 01:18:36 +00:00
Sam Leffler
50d8b493e4 when creating an ahdemo bss use any requested bssid; otherwise use zero
Obtained from:	madwifi
2005-12-14 01:16:22 +00:00
Sam Leffler
259bb4d3b9 allow setting the bssid in any mode
Obtained from:	netbsd
2005-12-14 01:14:22 +00:00
Sam Leffler
d16441fde1 disallow module unload when there are dynamic references
MFC after:	1 week
2005-12-12 19:07:48 +00:00
Sam Leffler
1fd2349de8 propagate current bss state on sta join so, in particular, authmode
is set properly in the new bss node

MFC after:	2 weeks
2005-12-12 18:44:27 +00:00
Sam Leffler
1b49e12042 Bandaid ieee80211_set_chan to handle a channel parameter of "any";
this can happen under certain conditions when scanning.  This logic
will eventually go away with the new scanning code.

While here de-inline the routine.

MFC after:	1 week
2005-12-12 18:42:20 +00:00
Sam Leffler
6cfac1074c o correct auto mode logic for avoiding turbo channels
o correct assumption that a static turbo channel is also
  usable in 11a; the opposite is true

MFC after:	1 week
2005-12-12 18:38:20 +00:00
Sam Leffler
e701e041f2 Add ieee80211_beacon_miss for processing sta mode beacon miss events
in the 802.11 layer: we send a directed probe request frame to the
current ap bmiss_max times (w/o answer) before scanning for a new ap.

MFC after:	2 weeks
2005-12-12 18:04:44 +00:00
Sam Leffler
047f1635dd add some useful definitions that'll be used soon 2005-12-12 17:57:00 +00:00
Sam Leffler
64353cb0ef add fixed rate for sending multicast frames
Obtained from:	atheros
MFC after:	1 week
2005-12-12 17:54:39 +00:00
Sam Leffler
c25442860a change malloc when setting an optional ie to use M_NOWAIT
MFC after:	3 days
2005-12-12 17:40:49 +00:00
Sam Leffler
e55e5e4276 correct parameter check when retrieving the current channel list
MFC after:	3 days
2005-12-12 17:38:53 +00:00
Sam Leffler
a196b35f08 correct handling of dtim for periods > 1
Obtained from:	madwifi
2005-12-05 22:14:13 +00:00
Sam Leffler
be425a0f40 Adhoc mode fixups:
o plug memory leak in adhoc mode: on rx the sender may be the
  current master so simply checking against ic_bss is not enough
  to identify if the packet comes from an unknown sender; must
  also check the mac address
o split neighbor node creation into two routines and fillin state
  of nodes faked up on xmit when a beacon or probe response frame
  is later received; this ensures important state like the rate set
  and advertised capabilities are correct

Obtained from:	netbsd
MFC after:	1 week
2005-12-04 04:50:27 +00:00