]> The Tcpdump Group git mirrors - tcpdump/blob - print-802_11.c
projects / tcpdump / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Use nd_ types, add EXTRACT_ calls.
[tcpdump] / print-802_11.c
1 /*
2 * Copyright (c) 2001
3 * Fortress Technologies, Inc. All rights reserved.
4 * Charlie Lenahan (clenahan@fortresstech.com)
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22
23 /* \summary: IEEE 802.11 printer */
24
25 #ifdef HAVE_CONFIG_H
26 #include "config.h"
27 #endif
28
29 #include <netdissect-stdinc.h>
30
31 #include <string.h>
32
33 #include "netdissect.h"
34 #include "addrtoname.h"
35
36 #include "extract.h"
37
38 #include "cpack.h"
39
40
41 /* Lengths of 802.11 header components. */
42 #define IEEE802_11_FC_LEN 2
43 #define IEEE802_11_DUR_LEN 2
44 #define IEEE802_11_DA_LEN 6
45 #define IEEE802_11_SA_LEN 6
46 #define IEEE802_11_BSSID_LEN 6
47 #define IEEE802_11_RA_LEN 6
48 #define IEEE802_11_TA_LEN 6
49 #define IEEE802_11_ADDR1_LEN 6
50 #define IEEE802_11_SEQ_LEN 2
51 #define IEEE802_11_CTL_LEN 2
52 #define IEEE802_11_CARRIED_FC_LEN 2
53 #define IEEE802_11_HT_CONTROL_LEN 4
54 #define IEEE802_11_IV_LEN 3
55 #define IEEE802_11_KID_LEN 1
56
57 /* Frame check sequence length. */
58 #define IEEE802_11_FCS_LEN 4
59
60 /* Lengths of beacon components. */
61 #define IEEE802_11_TSTAMP_LEN 8
62 #define IEEE802_11_BCNINT_LEN 2
63 #define IEEE802_11_CAPINFO_LEN 2
64 #define IEEE802_11_LISTENINT_LEN 2
65
66 #define IEEE802_11_AID_LEN 2
67 #define IEEE802_11_STATUS_LEN 2
68 #define IEEE802_11_REASON_LEN 2
69
70 /* Length of previous AP in reassocation frame */
71 #define IEEE802_11_AP_LEN 6
72
73 #define T_MGMT 0x0 /* management */
74 #define T_CTRL 0x1 /* control */
75 #define T_DATA 0x2 /* data */
76 #define T_RESV 0x3 /* reserved */
77
78 #define ST_ASSOC_REQUEST 0x0
79 #define ST_ASSOC_RESPONSE 0x1
80 #define ST_REASSOC_REQUEST 0x2
81 #define ST_REASSOC_RESPONSE 0x3
82 #define ST_PROBE_REQUEST 0x4
83 #define ST_PROBE_RESPONSE 0x5
84 /* RESERVED 0x6 */
85 /* RESERVED 0x7 */
86 #define ST_BEACON 0x8
87 #define ST_ATIM 0x9
88 #define ST_DISASSOC 0xA
89 #define ST_AUTH 0xB
90 #define ST_DEAUTH 0xC
91 #define ST_ACTION 0xD
92 /* RESERVED 0xE */
93 /* RESERVED 0xF */
94
95 static const struct tok st_str[] = {
96 { ST_ASSOC_REQUEST, "Assoc Request" },
97 { ST_ASSOC_RESPONSE, "Assoc Response" },
98 { ST_REASSOC_REQUEST, "ReAssoc Request" },
99 { ST_REASSOC_RESPONSE, "ReAssoc Response" },
100 { ST_PROBE_REQUEST, "Probe Request" },
101 { ST_PROBE_RESPONSE, "Probe Response" },
102 { ST_BEACON, "Beacon" },
103 { ST_ATIM, "ATIM" },
104 { ST_DISASSOC, "Disassociation" },
105 { ST_AUTH, "Authentication" },
106 { ST_DEAUTH, "DeAuthentication" },
107 { ST_ACTION, "Action" },
108 { 0, NULL }
109 };
110
111 #define CTRL_CONTROL_WRAPPER 0x7
112 #define CTRL_BAR 0x8
113 #define CTRL_BA 0x9
114 #define CTRL_PS_POLL 0xA
115 #define CTRL_RTS 0xB
116 #define CTRL_CTS 0xC
117 #define CTRL_ACK 0xD
118 #define CTRL_CF_END 0xE
119 #define CTRL_END_ACK 0xF
120
121 static const struct tok ctrl_str[] = {
122 { CTRL_CONTROL_WRAPPER, "Control Wrapper" },
123 { CTRL_BAR, "BAR" },
124 { CTRL_BA, "BA" },
125 { CTRL_PS_POLL, "Power Save-Poll" },
126 { CTRL_RTS, "Request-To-Send" },
127 { CTRL_CTS, "Clear-To-Send" },
128 { CTRL_ACK, "Acknowledgment" },
129 { CTRL_CF_END, "CF-End" },
130 { CTRL_END_ACK, "CF-End+CF-Ack" },
131 { 0, NULL }
132 };
133
134 #define DATA_DATA 0x0
135 #define DATA_DATA_CF_ACK 0x1
136 #define DATA_DATA_CF_POLL 0x2
137 #define DATA_DATA_CF_ACK_POLL 0x3
138 #define DATA_NODATA 0x4
139 #define DATA_NODATA_CF_ACK 0x5
140 #define DATA_NODATA_CF_POLL 0x6
141 #define DATA_NODATA_CF_ACK_POLL 0x7
142
143 #define DATA_QOS_DATA 0x8
144 #define DATA_QOS_DATA_CF_ACK 0x9
145 #define DATA_QOS_DATA_CF_POLL 0xA
146 #define DATA_QOS_DATA_CF_ACK_POLL 0xB
147 #define DATA_QOS_NODATA 0xC
148 #define DATA_QOS_CF_POLL_NODATA 0xE
149 #define DATA_QOS_CF_ACK_POLL_NODATA 0xF
150
151 /*
152 * The subtype field of a data frame is, in effect, composed of 4 flag
153 * bits - CF-Ack, CF-Poll, Null (means the frame doesn't actually have
154 * any data), and QoS.
155 */
156 #define DATA_FRAME_IS_CF_ACK(x) ((x) & 0x01)
157 #define DATA_FRAME_IS_CF_POLL(x) ((x) & 0x02)
158 #define DATA_FRAME_IS_NULL(x) ((x) & 0x04)
159 #define DATA_FRAME_IS_QOS(x) ((x) & 0x08)
160
161 /*
162 * Bits in the frame control field.
163 */
164 #define FC_VERSION(fc) ((fc) & 0x3)
165 #define FC_TYPE(fc) (((fc) >> 2) & 0x3)
166 #define FC_SUBTYPE(fc) (((fc) >> 4) & 0xF)
167 #define FC_TO_DS(fc) ((fc) & 0x0100)
168 #define FC_FROM_DS(fc) ((fc) & 0x0200)
169 #define FC_MORE_FLAG(fc) ((fc) & 0x0400)
170 #define FC_RETRY(fc) ((fc) & 0x0800)
171 #define FC_POWER_MGMT(fc) ((fc) & 0x1000)
172 #define FC_MORE_DATA(fc) ((fc) & 0x2000)
173 #define FC_PROTECTED(fc) ((fc) & 0x4000)
174 #define FC_ORDER(fc) ((fc) & 0x8000)
175
176 struct mgmt_header_t {
177 uint16_t fc;
178 uint16_t duration;
179 uint8_t da[IEEE802_11_DA_LEN];
180 uint8_t sa[IEEE802_11_SA_LEN];
181 uint8_t bssid[IEEE802_11_BSSID_LEN];
182 uint16_t seq_ctrl;
183 };
184
185 #define MGMT_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
186 IEEE802_11_DA_LEN+IEEE802_11_SA_LEN+\
187 IEEE802_11_BSSID_LEN+IEEE802_11_SEQ_LEN)
188
189 #define CAPABILITY_ESS(cap) ((cap) & 0x0001)
190 #define CAPABILITY_IBSS(cap) ((cap) & 0x0002)
191 #define CAPABILITY_CFP(cap) ((cap) & 0x0004)
192 #define CAPABILITY_CFP_REQ(cap) ((cap) & 0x0008)
193 #define CAPABILITY_PRIVACY(cap) ((cap) & 0x0010)
194
195 struct ssid_t {
196 uint8_t element_id;
197 uint8_t length;
198 u_char ssid[33]; /* 32 + 1 for null */
199 };
200
201 struct rates_t {
202 uint8_t element_id;
203 uint8_t length;
204 uint8_t rate[16];
205 };
206
207 struct challenge_t {
208 uint8_t element_id;
209 uint8_t length;
210 uint8_t text[254]; /* 1-253 + 1 for null */
211 };
212
213 struct fh_t {
214 uint8_t element_id;
215 uint8_t length;
216 uint16_t dwell_time;
217 uint8_t hop_set;
218 uint8_t hop_pattern;
219 uint8_t hop_index;
220 };
221
222 struct ds_t {
223 uint8_t element_id;
224 uint8_t length;
225 uint8_t channel;
226 };
227
228 struct cf_t {
229 uint8_t element_id;
230 uint8_t length;
231 uint8_t count;
232 uint8_t period;
233 uint16_t max_duration;
234 uint16_t dur_remaing;
235 };
236
237 struct tim_t {
238 uint8_t element_id;
239 uint8_t length;
240 uint8_t count;
241 uint8_t period;
242 uint8_t bitmap_control;
243 uint8_t bitmap[251];
244 };
245
246 #define E_SSID 0
247 #define E_RATES 1
248 #define E_FH 2
249 #define E_DS 3
250 #define E_CF 4
251 #define E_TIM 5
252 #define E_IBSS 6
253 /* reserved 7 */
254 /* reserved 8 */
255 /* reserved 9 */
256 /* reserved 10 */
257 /* reserved 11 */
258 /* reserved 12 */
259 /* reserved 13 */
260 /* reserved 14 */
261 /* reserved 15 */
262 /* reserved 16 */
263
264 #define E_CHALLENGE 16
265 /* reserved 17 */
266 /* reserved 18 */
267 /* reserved 19 */
268 /* reserved 16 */
269 /* reserved 16 */
270
271
272 struct mgmt_body_t {
273 uint8_t timestamp[IEEE802_11_TSTAMP_LEN];
274 uint16_t beacon_interval;
275 uint16_t listen_interval;
276 uint16_t status_code;
277 uint16_t aid;
278 u_char ap[IEEE802_11_AP_LEN];
279 uint16_t reason_code;
280 uint16_t auth_alg;
281 uint16_t auth_trans_seq_num;
282 int challenge_present;
283 struct challenge_t challenge;
284 uint16_t capability_info;
285 int ssid_present;
286 struct ssid_t ssid;
287 int rates_present;
288 struct rates_t rates;
289 int ds_present;
290 struct ds_t ds;
291 int cf_present;
292 struct cf_t cf;
293 int fh_present;
294 struct fh_t fh;
295 int tim_present;
296 struct tim_t tim;
297 };
298
299 struct ctrl_control_wrapper_hdr_t {
300 uint16_t fc;
301 uint16_t duration;
302 uint8_t addr1[IEEE802_11_ADDR1_LEN];
303 uint16_t carried_fc[IEEE802_11_CARRIED_FC_LEN];
304 uint16_t ht_control[IEEE802_11_HT_CONTROL_LEN];
305 };
306
307 #define CTRL_CONTROL_WRAPPER_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
308 IEEE802_11_ADDR1_LEN+\
309 IEEE802_11_CARRIED_FC_LEN+\
310 IEEE802_11_HT_CONTROL_LEN)
311
312 struct ctrl_rts_hdr_t {
313 uint16_t fc;
314 uint16_t duration;
315 uint8_t ra[IEEE802_11_RA_LEN];
316 uint8_t ta[IEEE802_11_TA_LEN];
317 };
318
319 #define CTRL_RTS_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
320 IEEE802_11_RA_LEN+IEEE802_11_TA_LEN)
321
322 struct ctrl_cts_hdr_t {
323 uint16_t fc;
324 uint16_t duration;
325 uint8_t ra[IEEE802_11_RA_LEN];
326 };
327
328 #define CTRL_CTS_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
329
330 struct ctrl_ack_hdr_t {
331 uint16_t fc;
332 uint16_t duration;
333 uint8_t ra[IEEE802_11_RA_LEN];
334 };
335
336 #define CTRL_ACK_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
337
338 struct ctrl_ps_poll_hdr_t {
339 uint16_t fc;
340 uint16_t aid;
341 uint8_t bssid[IEEE802_11_BSSID_LEN];
342 uint8_t ta[IEEE802_11_TA_LEN];
343 };
344
345 #define CTRL_PS_POLL_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_AID_LEN+\
346 IEEE802_11_BSSID_LEN+IEEE802_11_TA_LEN)
347
348 struct ctrl_end_hdr_t {
349 uint16_t fc;
350 uint16_t duration;
351 uint8_t ra[IEEE802_11_RA_LEN];
352 uint8_t bssid[IEEE802_11_BSSID_LEN];
353 };
354
355 #define CTRL_END_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
356 IEEE802_11_RA_LEN+IEEE802_11_BSSID_LEN)
357
358 struct ctrl_end_ack_hdr_t {
359 uint16_t fc;
360 uint16_t duration;
361 uint8_t ra[IEEE802_11_RA_LEN];
362 uint8_t bssid[IEEE802_11_BSSID_LEN];
363 };
364
365 #define CTRL_END_ACK_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
366 IEEE802_11_RA_LEN+IEEE802_11_BSSID_LEN)
367
368 struct ctrl_ba_hdr_t {
369 uint16_t fc;
370 uint16_t duration;
371 uint8_t ra[IEEE802_11_RA_LEN];
372 };
373
374 #define CTRL_BA_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
375
376 struct ctrl_bar_hdr_t {
377 uint16_t fc;
378 uint16_t dur;
379 uint8_t ra[IEEE802_11_RA_LEN];
380 uint8_t ta[IEEE802_11_TA_LEN];
381 uint16_t ctl;
382 uint16_t seq;
383 };
384
385 #define CTRL_BAR_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
386 IEEE802_11_RA_LEN+IEEE802_11_TA_LEN+\
387 IEEE802_11_CTL_LEN+IEEE802_11_SEQ_LEN)
388
389 struct meshcntl_t {
390 uint8_t flags;
391 uint8_t ttl;
392 uint8_t seq[4];
393 uint8_t addr4[6];
394 uint8_t addr5[6];
395 uint8_t addr6[6];
396 };
397
398 #define IV_IV(iv) ((iv) & 0xFFFFFF)
399 #define IV_PAD(iv) (((iv) >> 24) & 0x3F)
400 #define IV_KEYID(iv) (((iv) >> 30) & 0x03)
401
402 #define PRINT_SSID(p) \
403 if (p.ssid_present) { \
404 ND_PRINT((ndo, " (")); \
405 fn_print(ndo, p.ssid.ssid, NULL); \
406 ND_PRINT((ndo, ")")); \
407 }
408
409 #define PRINT_RATE(_sep, _r, _suf) \
410 ND_PRINT((ndo, "%s%2.1f%s", _sep, (.5 * ((_r) & 0x7f)), _suf))
411 #define PRINT_RATES(p) \
412 if (p.rates_present) { \
413 int z; \
414 const char *sep = " ["; \
415 for (z = 0; z < p.rates.length ; z++) { \
416 PRINT_RATE(sep, p.rates.rate[z], \
417 (p.rates.rate[z] & 0x80 ? "*" : "")); \
418 sep = " "; \
419 } \
420 if (p.rates.length != 0) \
421 ND_PRINT((ndo, " Mbit]")); \
422 }
423
424 #define PRINT_DS_CHANNEL(p) \
425 if (p.ds_present) \
426 ND_PRINT((ndo, " CH: %u", p.ds.channel)); \
427 ND_PRINT((ndo, "%s", \
428 CAPABILITY_PRIVACY(p.capability_info) ? ", PRIVACY" : ""));
429
430 #define MAX_MCS_INDEX 76
431
432 /*
433 * Indices are:
434 *
435 * the MCS index (0-76);
436 *
437 * 0 for 20 MHz, 1 for 40 MHz;
438 *
439 * 0 for a long guard interval, 1 for a short guard interval.
440 */
441 static const float ieee80211_float_htrates[MAX_MCS_INDEX+1][2][2] = {
442 /* MCS 0 */
443 { /* 20 Mhz */ { 6.5, /* SGI */ 7.2, },
444 /* 40 Mhz */ { 13.5, /* SGI */ 15.0, },
445 },
446
447 /* MCS 1 */
448 { /* 20 Mhz */ { 13.0, /* SGI */ 14.4, },
449 /* 40 Mhz */ { 27.0, /* SGI */ 30.0, },
450 },
451
452 /* MCS 2 */
453 { /* 20 Mhz */ { 19.5, /* SGI */ 21.7, },
454 /* 40 Mhz */ { 40.5, /* SGI */ 45.0, },
455 },
456
457 /* MCS 3 */
458 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
459 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
460 },
461
462 /* MCS 4 */
463 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
464 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
465 },
466
467 /* MCS 5 */
468 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
469 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
470 },
471
472 /* MCS 6 */
473 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
474 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
475 },
476
477 /* MCS 7 */
478 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
479 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
480 },
481
482 /* MCS 8 */
483 { /* 20 Mhz */ { 13.0, /* SGI */ 14.4, },
484 /* 40 Mhz */ { 27.0, /* SGI */ 30.0, },
485 },
486
487 /* MCS 9 */
488 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
489 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
490 },
491
492 /* MCS 10 */
493 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
494 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
495 },
496
497 /* MCS 11 */
498 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
499 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
500 },
501
502 /* MCS 12 */
503 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
504 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
505 },
506
507 /* MCS 13 */
508 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
509 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
510 },
511
512 /* MCS 14 */
513 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
514 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
515 },
516
517 /* MCS 15 */
518 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
519 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
520 },
521
522 /* MCS 16 */
523 { /* 20 Mhz */ { 19.5, /* SGI */ 21.7, },
524 /* 40 Mhz */ { 40.5, /* SGI */ 45.0, },
525 },
526
527 /* MCS 17 */
528 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
529 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
530 },
531
532 /* MCS 18 */
533 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
534 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
535 },
536
537 /* MCS 19 */
538 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
539 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
540 },
541
542 /* MCS 20 */
543 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
544 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
545 },
546
547 /* MCS 21 */
548 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
549 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
550 },
551
552 /* MCS 22 */
553 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
554 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
555 },
556
557 /* MCS 23 */
558 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
559 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
560 },
561
562 /* MCS 24 */
563 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
564 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
565 },
566
567 /* MCS 25 */
568 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
569 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
570 },
571
572 /* MCS 26 */
573 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
574 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
575 },
576
577 /* MCS 27 */
578 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
579 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
580 },
581
582 /* MCS 28 */
583 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
584 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
585 },
586
587 /* MCS 29 */
588 { /* 20 Mhz */ { 208.0, /* SGI */ 231.1, },
589 /* 40 Mhz */ { 432.0, /* SGI */ 480.0, },
590 },
591
592 /* MCS 30 */
593 { /* 20 Mhz */ { 234.0, /* SGI */ 260.0, },
594 /* 40 Mhz */ { 486.0, /* SGI */ 540.0, },
595 },
596
597 /* MCS 31 */
598 { /* 20 Mhz */ { 260.0, /* SGI */ 288.9, },
599 /* 40 Mhz */ { 540.0, /* SGI */ 600.0, },
600 },
601
602 /* MCS 32 */
603 { /* 20 Mhz */ { 0.0, /* SGI */ 0.0, }, /* not valid */
604 /* 40 Mhz */ { 6.0, /* SGI */ 6.7, },
605 },
606
607 /* MCS 33 */
608 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
609 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
610 },
611
612 /* MCS 34 */
613 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
614 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
615 },
616
617 /* MCS 35 */
618 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
619 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
620 },
621
622 /* MCS 36 */
623 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
624 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
625 },
626
627 /* MCS 37 */
628 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
629 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
630 },
631
632 /* MCS 38 */
633 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
634 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
635 },
636
637 /* MCS 39 */
638 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
639 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
640 },
641
642 /* MCS 40 */
643 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
644 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
645 },
646
647 /* MCS 41 */
648 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
649 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
650 },
651
652 /* MCS 42 */
653 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
654 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
655 },
656
657 /* MCS 43 */
658 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
659 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
660 },
661
662 /* MCS 44 */
663 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
664 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
665 },
666
667 /* MCS 45 */
668 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
669 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
670 },
671
672 /* MCS 46 */
673 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
674 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
675 },
676
677 /* MCS 47 */
678 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
679 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
680 },
681
682 /* MCS 48 */
683 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
684 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
685 },
686
687 /* MCS 49 */
688 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
689 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
690 },
691
692 /* MCS 50 */
693 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
694 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
695 },
696
697 /* MCS 51 */
698 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
699 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
700 },
701
702 /* MCS 52 */
703 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
704 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
705 },
706
707 /* MCS 53 */
708 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
709 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
710 },
711
712 /* MCS 54 */
713 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
714 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
715 },
716
717 /* MCS 55 */
718 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
719 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
720 },
721
722 /* MCS 56 */
723 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
724 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
725 },
726
727 /* MCS 57 */
728 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
729 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
730 },
731
732 /* MCS 58 */
733 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
734 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
735 },
736
737 /* MCS 59 */
738 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
739 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
740 },
741
742 /* MCS 60 */
743 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
744 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
745 },
746
747 /* MCS 61 */
748 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
749 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
750 },
751
752 /* MCS 62 */
753 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
754 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
755 },
756
757 /* MCS 63 */
758 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
759 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
760 },
761
762 /* MCS 64 */
763 { /* 20 Mhz */ { 143.0, /* SGI */ 158.9, },
764 /* 40 Mhz */ { 297.0, /* SGI */ 330.0, },
765 },
766
767 /* MCS 65 */
768 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
769 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
770 },
771
772 /* MCS 66 */
773 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
774 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
775 },
776
777 /* MCS 67 */
778 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
779 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
780 },
781
782 /* MCS 68 */
783 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
784 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
785 },
786
787 /* MCS 69 */
788 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
789 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
790 },
791
792 /* MCS 70 */
793 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
794 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
795 },
796
797 /* MCS 71 */
798 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
799 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
800 },
801
802 /* MCS 72 */
803 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
804 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
805 },
806
807 /* MCS 73 */
808 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
809 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
810 },
811
812 /* MCS 74 */
813 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
814 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
815 },
816
817 /* MCS 75 */
818 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
819 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
820 },
821
822 /* MCS 76 */
823 { /* 20 Mhz */ { 214.5, /* SGI */ 238.3, },
824 /* 40 Mhz */ { 445.5, /* SGI */ 495.0, },
825 },
826 };
827
828 static const char *auth_alg_text[]={"Open System","Shared Key","EAP"};
829 #define NUM_AUTH_ALGS (sizeof auth_alg_text / sizeof auth_alg_text[0])
830
831 static const char *status_text[] = {
832 "Successful", /* 0 */
833 "Unspecified failure", /* 1 */
834 "Reserved", /* 2 */
835 "Reserved", /* 3 */
836 "Reserved", /* 4 */
837 "Reserved", /* 5 */
838 "Reserved", /* 6 */
839 "Reserved", /* 7 */
840 "Reserved", /* 8 */
841 "Reserved", /* 9 */
842 "Cannot Support all requested capabilities in the Capability "
843 "Information field", /* 10 */
844 "Reassociation denied due to inability to confirm that association "
845 "exists", /* 11 */
846 "Association denied due to reason outside the scope of the "
847 "standard", /* 12 */
848 "Responding station does not support the specified authentication "
849 "algorithm ", /* 13 */
850 "Received an Authentication frame with authentication transaction "
851 "sequence number out of expected sequence", /* 14 */
852 "Authentication rejected because of challenge failure", /* 15 */
853 "Authentication rejected due to timeout waiting for next frame in "
854 "sequence", /* 16 */
855 "Association denied because AP is unable to handle additional"
856 "associated stations", /* 17 */
857 "Association denied due to requesting station not supporting all of "
858 "the data rates in BSSBasicRateSet parameter", /* 18 */
859 "Association denied due to requesting station not supporting "
860 "short preamble operation", /* 19 */
861 "Association denied due to requesting station not supporting "
862 "PBCC encoding", /* 20 */
863 "Association denied due to requesting station not supporting "
864 "channel agility", /* 21 */
865 "Association request rejected because Spectrum Management "
866 "capability is required", /* 22 */
867 "Association request rejected because the information in the "
868 "Power Capability element is unacceptable", /* 23 */
869 "Association request rejected because the information in the "
870 "Supported Channels element is unacceptable", /* 24 */
871 "Association denied due to requesting station not supporting "
872 "short slot operation", /* 25 */
873 "Association denied due to requesting station not supporting "
874 "DSSS-OFDM operation", /* 26 */
875 "Association denied because the requested STA does not support HT "
876 "features", /* 27 */
877 "Reserved", /* 28 */
878 "Association denied because the requested STA does not support "
879 "the PCO transition time required by the AP", /* 29 */
880 "Reserved", /* 30 */
881 "Reserved", /* 31 */
882 "Unspecified, QoS-related failure", /* 32 */
883 "Association denied due to QAP having insufficient bandwidth "
884 "to handle another QSTA", /* 33 */
885 "Association denied due to excessive frame loss rates and/or "
886 "poor conditions on current operating channel", /* 34 */
887 "Association (with QBSS) denied due to requesting station not "
888 "supporting the QoS facility", /* 35 */
889 "Association denied due to requesting station not supporting "
890 "Block Ack", /* 36 */
891 "The request has been declined", /* 37 */
892 "The request has not been successful as one or more parameters "
893 "have invalid values", /* 38 */
894 "The TS has not been created because the request cannot be honored. "
895 "Try again with the suggested changes to the TSPEC", /* 39 */
896 "Invalid Information Element", /* 40 */
897 "Group Cipher is not valid", /* 41 */
898 "Pairwise Cipher is not valid", /* 42 */
899 "AKMP is not valid", /* 43 */
900 "Unsupported RSN IE version", /* 44 */
901 "Invalid RSN IE Capabilities", /* 45 */
902 "Cipher suite is rejected per security policy", /* 46 */
903 "The TS has not been created. However, the HC may be capable of "
904 "creating a TS, in response to a request, after the time indicated "
905 "in the TS Delay element", /* 47 */
906 "Direct Link is not allowed in the BSS by policy", /* 48 */
907 "Destination STA is not present within this QBSS.", /* 49 */
908 "The Destination STA is not a QSTA.", /* 50 */
909
910 };
911 #define NUM_STATUSES (sizeof status_text / sizeof status_text[0])
912
913 static const char *reason_text[] = {
914 "Reserved", /* 0 */
915 "Unspecified reason", /* 1 */
916 "Previous authentication no longer valid", /* 2 */
917 "Deauthenticated because sending station is leaving (or has left) "
918 "IBSS or ESS", /* 3 */
919 "Disassociated due to inactivity", /* 4 */
920 "Disassociated because AP is unable to handle all currently "
921 " associated stations", /* 5 */
922 "Class 2 frame received from nonauthenticated station", /* 6 */
923 "Class 3 frame received from nonassociated station", /* 7 */
924 "Disassociated because sending station is leaving "
925 "(or has left) BSS", /* 8 */
926 "Station requesting (re)association is not authenticated with "
927 "responding station", /* 9 */
928 "Disassociated because the information in the Power Capability "
929 "element is unacceptable", /* 10 */
930 "Disassociated because the information in the SupportedChannels "
931 "element is unacceptable", /* 11 */
932 "Invalid Information Element", /* 12 */
933 "Reserved", /* 13 */
934 "Michael MIC failure", /* 14 */
935 "4-Way Handshake timeout", /* 15 */
936 "Group key update timeout", /* 16 */
937 "Information element in 4-Way Handshake different from (Re)Association"
938 "Request/Probe Response/Beacon", /* 17 */
939 "Group Cipher is not valid", /* 18 */
940 "AKMP is not valid", /* 20 */
941 "Unsupported RSN IE version", /* 21 */
942 "Invalid RSN IE Capabilities", /* 22 */
943 "IEEE 802.1X Authentication failed", /* 23 */
944 "Cipher suite is rejected per security policy", /* 24 */
945 "Reserved", /* 25 */
946 "Reserved", /* 26 */
947 "Reserved", /* 27 */
948 "Reserved", /* 28 */
949 "Reserved", /* 29 */
950 "Reserved", /* 30 */
951 "TS deleted because QoS AP lacks sufficient bandwidth for this "
952 "QoS STA due to a change in BSS service characteristics or "
953 "operational mode (e.g. an HT BSS change from 40 MHz channel "
954 "to 20 MHz channel)", /* 31 */
955 "Disassociated for unspecified, QoS-related reason", /* 32 */
956 "Disassociated because QoS AP lacks sufficient bandwidth for this "
957 "QoS STA", /* 33 */
958 "Disassociated because of excessive number of frames that need to be "
959 "acknowledged, but are not acknowledged for AP transmissions "
960 "and/or poor channel conditions", /* 34 */
961 "Disassociated because STA is transmitting outside the limits "
962 "of its TXOPs", /* 35 */
963 "Requested from peer STA as the STA is leaving the BSS "
964 "(or resetting)", /* 36 */
965 "Requested from peer STA as it does not want to use the "
966 "mechanism", /* 37 */
967 "Requested from peer STA as the STA received frames using the "
968 "mechanism for which a set up is required", /* 38 */
969 "Requested from peer STA due to time out", /* 39 */
970 "Reserved", /* 40 */
971 "Reserved", /* 41 */
972 "Reserved", /* 42 */
973 "Reserved", /* 43 */
974 "Reserved", /* 44 */
975 "Peer STA does not support the requested cipher suite", /* 45 */
976 "Association denied due to requesting STA not supporting HT "
977 "features", /* 46 */
978 };
979 #define NUM_REASONS (sizeof reason_text / sizeof reason_text[0])
980
981 static int
982 wep_print(netdissect_options *ndo,
983 const u_char *p)
984 {
985 uint32_t iv;
986
987 if (!ND_TTEST_LEN(p, IEEE802_11_IV_LEN + IEEE802_11_KID_LEN))
988 return 0;
989 iv = EXTRACT_LE_U_4(p);
990
991 ND_PRINT((ndo, " IV:%3x Pad %x KeyID %x", IV_IV(iv), IV_PAD(iv),
992 IV_KEYID(iv)));
993
994 return 1;
995 }
996
997 static int
998 parse_elements(netdissect_options *ndo,
999 struct mgmt_body_t *pbody, const u_char *p, int offset,
1000 u_int length)
1001 {
1002 u_int elementlen;
1003 struct ssid_t ssid;
1004 struct challenge_t challenge;
1005 struct rates_t rates;
1006 struct ds_t ds;
1007 struct cf_t cf;
1008 struct tim_t tim;
1009
1010 /*
1011 * We haven't seen any elements yet.
1012 */
1013 pbody->challenge_present = 0;
1014 pbody->ssid_present = 0;
1015 pbody->rates_present = 0;
1016 pbody->ds_present = 0;
1017 pbody->cf_present = 0;
1018 pbody->tim_present = 0;
1019
1020 while (length != 0) {
1021 /* Make sure we at least have the element ID and length. */
1022 if (!ND_TTEST_2(p + offset))
1023 return 0;
1024 if (length < 2)
1025 return 0;
1026 elementlen = EXTRACT_U_1(p + offset + 1);
1027
1028 /* Make sure we have the entire element. */
1029 if (!ND_TTEST_LEN(p + offset + 2, elementlen))
1030 return 0;
1031 if (length < elementlen + 2)
1032 return 0;
1033
1034 switch (EXTRACT_U_1(p + offset)) {
1035 case E_SSID:
1036 memcpy(&ssid, p + offset, 2);
1037 offset += 2;
1038 length -= 2;
1039 if (ssid.length != 0) {
1040 if (ssid.length > sizeof(ssid.ssid) - 1)
1041 return 0;
1042 memcpy(&ssid.ssid, p + offset, ssid.length);
1043 offset += ssid.length;
1044 length -= ssid.length;
1045 }
1046 ssid.ssid[ssid.length] = '\0';
1047 /*
1048 * Present and not truncated.
1049 *
1050 * If we haven't already seen an SSID IE,
1051 * copy this one, otherwise ignore this one,
1052 * so we later report the first one we saw.
1053 */
1054 if (!pbody->ssid_present) {
1055 pbody->ssid = ssid;
1056 pbody->ssid_present = 1;
1057 }
1058 break;
1059 case E_CHALLENGE:
1060 memcpy(&challenge, p + offset, 2);
1061 offset += 2;
1062 length -= 2;
1063 if (challenge.length != 0) {
1064 if (challenge.length >
1065 sizeof(challenge.text) - 1)
1066 return 0;
1067 memcpy(&challenge.text, p + offset,
1068 challenge.length);
1069 offset += challenge.length;
1070 length -= challenge.length;
1071 }
1072 challenge.text[challenge.length] = '\0';
1073 /*
1074 * Present and not truncated.
1075 *
1076 * If we haven't already seen a challenge IE,
1077 * copy this one, otherwise ignore this one,
1078 * so we later report the first one we saw.
1079 */
1080 if (!pbody->challenge_present) {
1081 pbody->challenge = challenge;
1082 pbody->challenge_present = 1;
1083 }
1084 break;
1085 case E_RATES:
1086 memcpy(&rates, p + offset, 2);
1087 offset += 2;
1088 length -= 2;
1089 if (rates.length != 0) {
1090 if (rates.length > sizeof rates.rate)
1091 return 0;
1092 memcpy(&rates.rate, p + offset, rates.length);
1093 offset += rates.length;
1094 length -= rates.length;
1095 }
1096 /*
1097 * Present and not truncated.
1098 *
1099 * If we haven't already seen a rates IE,
1100 * copy this one if it's not zero-length,
1101 * otherwise ignore this one, so we later
1102 * report the first one we saw.
1103 *
1104 * We ignore zero-length rates IEs as some
1105 * devices seem to put a zero-length rates
1106 * IE, followed by an SSID IE, followed by
1107 * a non-zero-length rates IE into frames,
1108 * even though IEEE Std 802.11-2007 doesn't
1109 * seem to indicate that a zero-length rates
1110 * IE is valid.
1111 */
1112 if (!pbody->rates_present && rates.length != 0) {
1113 pbody->rates = rates;
1114 pbody->rates_present = 1;
1115 }
1116 break;
1117 case E_DS:
1118 memcpy(&ds, p + offset, 2);
1119 offset += 2;
1120 length -= 2;
1121 if (ds.length != 1) {
1122 offset += ds.length;
1123 length -= ds.length;
1124 break;
1125 }
1126 ds.channel = EXTRACT_U_1(p + offset);
1127 offset += 1;
1128 length -= 1;
1129 /*
1130 * Present and not truncated.
1131 *
1132 * If we haven't already seen a DS IE,
1133 * copy this one, otherwise ignore this one,
1134 * so we later report the first one we saw.
1135 */
1136 if (!pbody->ds_present) {
1137 pbody->ds = ds;
1138 pbody->ds_present = 1;
1139 }
1140 break;
1141 case E_CF:
1142 memcpy(&cf, p + offset, 2);
1143 offset += 2;
1144 length -= 2;
1145 if (cf.length != 6) {
1146 offset += cf.length;
1147 length -= cf.length;
1148 break;
1149 }
1150 memcpy(&cf.count, p + offset, 6);
1151 offset += 6;
1152 length -= 6;
1153 /*
1154 * Present and not truncated.
1155 *
1156 * If we haven't already seen a CF IE,
1157 * copy this one, otherwise ignore this one,
1158 * so we later report the first one we saw.
1159 */
1160 if (!pbody->cf_present) {
1161 pbody->cf = cf;
1162 pbody->cf_present = 1;
1163 }
1164 break;
1165 case E_TIM:
1166 memcpy(&tim, p + offset, 2);
1167 offset += 2;
1168 length -= 2;
1169 if (tim.length <= 3U) {
1170 offset += tim.length;
1171 length -= tim.length;
1172 break;
1173 }
1174 if (tim.length - 3U > sizeof tim.bitmap)
1175 return 0;
1176 memcpy(&tim.count, p + offset, 3);
1177 offset += 3;
1178 length -= 3;
1179
1180 memcpy(tim.bitmap, p + offset, tim.length - 3);
1181 offset += tim.length - 3;
1182 length -= tim.length - 3;
1183 /*
1184 * Present and not truncated.
1185 *
1186 * If we haven't already seen a TIM IE,
1187 * copy this one, otherwise ignore this one,
1188 * so we later report the first one we saw.
1189 */
1190 if (!pbody->tim_present) {
1191 pbody->tim = tim;
1192 pbody->tim_present = 1;
1193 }
1194 break;
1195 default:
1196 #if 0
1197 ND_PRINT((ndo, "(1) unhandled element_id (%d) ",
1198 *(p + offset)));
1199 #endif
1200 offset += 2 + elementlen;
1201 length -= 2 + elementlen;
1202 break;
1203 }
1204 }
1205
1206 /* No problems found. */
1207 return 1;
1208 }
1209
1210 /*********************************************************************************
1211 * Print Handle functions for the management frame types
1212 *********************************************************************************/
1213
1214 static int
1215 handle_beacon(netdissect_options *ndo,
1216 const u_char *p, u_int length)
1217 {
1218 struct mgmt_body_t pbody;
1219 int offset = 0;
1220 int ret;
1221
1222 memset(&pbody, 0, sizeof(pbody));
1223
1224 if (!ND_TTEST_LEN(p, IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN + IEEE802_11_CAPINFO_LEN))
1225 return 0;
1226 if (length < IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1227 IEEE802_11_CAPINFO_LEN)
1228 return 0;
1229 memcpy(&pbody.timestamp, p, IEEE802_11_TSTAMP_LEN);
1230 offset += IEEE802_11_TSTAMP_LEN;
1231 length -= IEEE802_11_TSTAMP_LEN;
1232 pbody.beacon_interval = EXTRACT_LE_U_2(p + offset);
1233 offset += IEEE802_11_BCNINT_LEN;
1234 length -= IEEE802_11_BCNINT_LEN;
1235 pbody.capability_info = EXTRACT_LE_U_2(p + offset);
1236 offset += IEEE802_11_CAPINFO_LEN;
1237 length -= IEEE802_11_CAPINFO_LEN;
1238
1239 ret = parse_elements(ndo, &pbody, p, offset, length);
1240
1241 PRINT_SSID(pbody);
1242 PRINT_RATES(pbody);
1243 ND_PRINT((ndo, " %s",
1244 CAPABILITY_ESS(pbody.capability_info) ? "ESS" : "IBSS"));
1245 PRINT_DS_CHANNEL(pbody);
1246
1247 return ret;
1248 }
1249
1250 static int
1251 handle_assoc_request(netdissect_options *ndo,
1252 const u_char *p, u_int length)
1253 {
1254 struct mgmt_body_t pbody;
1255 int offset = 0;
1256 int ret;
1257
1258 memset(&pbody, 0, sizeof(pbody));
1259
1260 if (!ND_TTEST_LEN(p, IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN))
1261 return 0;
1262 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN)
1263 return 0;
1264 pbody.capability_info = EXTRACT_LE_U_2(p);
1265 offset += IEEE802_11_CAPINFO_LEN;
1266 length -= IEEE802_11_CAPINFO_LEN;
1267 pbody.listen_interval = EXTRACT_LE_U_2(p + offset);
1268 offset += IEEE802_11_LISTENINT_LEN;
1269 length -= IEEE802_11_LISTENINT_LEN;
1270
1271 ret = parse_elements(ndo, &pbody, p, offset, length);
1272
1273 PRINT_SSID(pbody);
1274 PRINT_RATES(pbody);
1275 return ret;
1276 }
1277
1278 static int
1279 handle_assoc_response(netdissect_options *ndo,
1280 const u_char *p, u_int length)
1281 {
1282 struct mgmt_body_t pbody;
1283 int offset = 0;
1284 int ret;
1285
1286 memset(&pbody, 0, sizeof(pbody));
1287
1288 if (!ND_TTEST_LEN(p, IEEE802_11_CAPINFO_LEN + IEEE802_11_STATUS_LEN + IEEE802_11_AID_LEN))
1289 return 0;
1290 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_STATUS_LEN +
1291 IEEE802_11_AID_LEN)
1292 return 0;
1293 pbody.capability_info = EXTRACT_LE_U_2(p);
1294 offset += IEEE802_11_CAPINFO_LEN;
1295 length -= IEEE802_11_CAPINFO_LEN;
1296 pbody.status_code = EXTRACT_LE_U_2(p + offset);
1297 offset += IEEE802_11_STATUS_LEN;
1298 length -= IEEE802_11_STATUS_LEN;
1299 pbody.aid = EXTRACT_LE_U_2(p + offset);
1300 offset += IEEE802_11_AID_LEN;
1301 length -= IEEE802_11_AID_LEN;
1302
1303 ret = parse_elements(ndo, &pbody, p, offset, length);
1304
1305 ND_PRINT((ndo, " AID(%x) :%s: %s", ((uint16_t)(pbody.aid << 2 )) >> 2 ,
1306 CAPABILITY_PRIVACY(pbody.capability_info) ? " PRIVACY " : "",
1307 (pbody.status_code < NUM_STATUSES
1308 ? status_text[pbody.status_code]
1309 : "n/a")));
1310
1311 return ret;
1312 }
1313
1314 static int
1315 handle_reassoc_request(netdissect_options *ndo,
1316 const u_char *p, u_int length)
1317 {
1318 struct mgmt_body_t pbody;
1319 int offset = 0;
1320 int ret;
1321
1322 memset(&pbody, 0, sizeof(pbody));
1323
1324 if (!ND_TTEST_LEN(p, IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN + IEEE802_11_AP_LEN))
1325 return 0;
1326 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN +
1327 IEEE802_11_AP_LEN)
1328 return 0;
1329 pbody.capability_info = EXTRACT_LE_U_2(p);
1330 offset += IEEE802_11_CAPINFO_LEN;
1331 length -= IEEE802_11_CAPINFO_LEN;
1332 pbody.listen_interval = EXTRACT_LE_U_2(p + offset);
1333 offset += IEEE802_11_LISTENINT_LEN;
1334 length -= IEEE802_11_LISTENINT_LEN;
1335 memcpy(&pbody.ap, p+offset, IEEE802_11_AP_LEN);
1336 offset += IEEE802_11_AP_LEN;
1337 length -= IEEE802_11_AP_LEN;
1338
1339 ret = parse_elements(ndo, &pbody, p, offset, length);
1340
1341 PRINT_SSID(pbody);
1342 ND_PRINT((ndo, " AP : %s", etheraddr_string(ndo, pbody.ap )));
1343
1344 return ret;
1345 }
1346
1347 static int
1348 handle_reassoc_response(netdissect_options *ndo,
1349 const u_char *p, u_int length)
1350 {
1351 /* Same as a Association Reponse */
1352 return handle_assoc_response(ndo, p, length);
1353 }
1354
1355 static int
1356 handle_probe_request(netdissect_options *ndo,
1357 const u_char *p, u_int length)
1358 {
1359 struct mgmt_body_t pbody;
1360 int offset = 0;
1361 int ret;
1362
1363 memset(&pbody, 0, sizeof(pbody));
1364
1365 ret = parse_elements(ndo, &pbody, p, offset, length);
1366
1367 PRINT_SSID(pbody);
1368 PRINT_RATES(pbody);
1369
1370 return ret;
1371 }
1372
1373 static int
1374 handle_probe_response(netdissect_options *ndo,
1375 const u_char *p, u_int length)
1376 {
1377 struct mgmt_body_t pbody;
1378 int offset = 0;
1379 int ret;
1380
1381 memset(&pbody, 0, sizeof(pbody));
1382
1383 if (!ND_TTEST_LEN(p, IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN + IEEE802_11_CAPINFO_LEN))
1384 return 0;
1385 if (length < IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1386 IEEE802_11_CAPINFO_LEN)
1387 return 0;
1388 memcpy(&pbody.timestamp, p, IEEE802_11_TSTAMP_LEN);
1389 offset += IEEE802_11_TSTAMP_LEN;
1390 length -= IEEE802_11_TSTAMP_LEN;
1391 pbody.beacon_interval = EXTRACT_LE_U_2(p + offset);
1392 offset += IEEE802_11_BCNINT_LEN;
1393 length -= IEEE802_11_BCNINT_LEN;
1394 pbody.capability_info = EXTRACT_LE_U_2(p + offset);
1395 offset += IEEE802_11_CAPINFO_LEN;
1396 length -= IEEE802_11_CAPINFO_LEN;
1397
1398 ret = parse_elements(ndo, &pbody, p, offset, length);
1399
1400 PRINT_SSID(pbody);
1401 PRINT_RATES(pbody);
1402 PRINT_DS_CHANNEL(pbody);
1403
1404 return ret;
1405 }
1406
1407 static int
1408 handle_atim(void)
1409 {
1410 /* the frame body for ATIM is null. */
1411 return 1;
1412 }
1413
1414 static int
1415 handle_disassoc(netdissect_options *ndo,
1416 const u_char *p, u_int length)
1417 {
1418 struct mgmt_body_t pbody;
1419
1420 memset(&pbody, 0, sizeof(pbody));
1421
1422 if (!ND_TTEST_LEN(p, IEEE802_11_REASON_LEN))
1423 return 0;
1424 if (length < IEEE802_11_REASON_LEN)
1425 return 0;
1426 pbody.reason_code = EXTRACT_LE_U_2(p);
1427
1428 ND_PRINT((ndo, ": %s",
1429 (pbody.reason_code < NUM_REASONS)
1430 ? reason_text[pbody.reason_code]
1431 : "Reserved"));
1432
1433 return 1;
1434 }
1435
1436 static int
1437 handle_auth(netdissect_options *ndo,
1438 const u_char *p, u_int length)
1439 {
1440 struct mgmt_body_t pbody;
1441 int offset = 0;
1442 int ret;
1443
1444 memset(&pbody, 0, sizeof(pbody));
1445
1446 if (!ND_TTEST_6(p))
1447 return 0;
1448 if (length < 6)
1449 return 0;
1450 pbody.auth_alg = EXTRACT_LE_U_2(p);
1451 offset += 2;
1452 length -= 2;
1453 pbody.auth_trans_seq_num = EXTRACT_LE_U_2(p + offset);
1454 offset += 2;
1455 length -= 2;
1456 pbody.status_code = EXTRACT_LE_U_2(p + offset);
1457 offset += 2;
1458 length -= 2;
1459
1460 ret = parse_elements(ndo, &pbody, p, offset, length);
1461
1462 if ((pbody.auth_alg == 1) &&
1463 ((pbody.auth_trans_seq_num == 2) ||
1464 (pbody.auth_trans_seq_num == 3))) {
1465 ND_PRINT((ndo, " (%s)-%x [Challenge Text] %s",
1466 (pbody.auth_alg < NUM_AUTH_ALGS)
1467 ? auth_alg_text[pbody.auth_alg]
1468 : "Reserved",
1469 pbody.auth_trans_seq_num,
1470 ((pbody.auth_trans_seq_num % 2)
1471 ? ((pbody.status_code < NUM_STATUSES)
1472 ? status_text[pbody.status_code]
1473 : "n/a") : "")));
1474 return ret;
1475 }
1476 ND_PRINT((ndo, " (%s)-%x: %s",
1477 (pbody.auth_alg < NUM_AUTH_ALGS)
1478 ? auth_alg_text[pbody.auth_alg]
1479 : "Reserved",
1480 pbody.auth_trans_seq_num,
1481 (pbody.auth_trans_seq_num % 2)
1482 ? ((pbody.status_code < NUM_STATUSES)
1483 ? status_text[pbody.status_code]
1484 : "n/a")
1485 : ""));
1486
1487 return ret;
1488 }
1489
1490 static int
1491 handle_deauth(netdissect_options *ndo,
1492 const uint8_t *src, const u_char *p, u_int length)
1493 {
1494 struct mgmt_body_t pbody;
1495 const char *reason = NULL;
1496
1497 memset(&pbody, 0, sizeof(pbody));
1498
1499 if (!ND_TTEST_LEN(p, IEEE802_11_REASON_LEN))
1500 return 0;
1501 if (length < IEEE802_11_REASON_LEN)
1502 return 0;
1503 pbody.reason_code = EXTRACT_LE_U_2(p);
1504
1505 reason = (pbody.reason_code < NUM_REASONS)
1506 ? reason_text[pbody.reason_code]
1507 : "Reserved";
1508
1509 if (ndo->ndo_eflag) {
1510 ND_PRINT((ndo, ": %s", reason));
1511 } else {
1512 ND_PRINT((ndo, " (%s): %s", etheraddr_string(ndo, src), reason));
1513 }
1514 return 1;
1515 }
1516
1517 #define PRINT_HT_ACTION(v) (\
1518 (v) == 0 ? ND_PRINT((ndo, "TxChWidth")) : \
1519 (v) == 1 ? ND_PRINT((ndo, "MIMOPwrSave")) : \
1520 ND_PRINT((ndo, "Act#%d", (v))) \
1521 )
1522 #define PRINT_BA_ACTION(v) (\
1523 (v) == 0 ? ND_PRINT((ndo, "ADDBA Request")) : \
1524 (v) == 1 ? ND_PRINT((ndo, "ADDBA Response")) : \
1525 (v) == 2 ? ND_PRINT((ndo, "DELBA")) : \
1526 ND_PRINT((ndo, "Act#%d", (v))) \
1527 )
1528 #define PRINT_MESHLINK_ACTION(v) (\
1529 (v) == 0 ? ND_PRINT((ndo, "Request")) : \
1530 (v) == 1 ? ND_PRINT((ndo, "Report")) : \
1531 ND_PRINT((ndo, "Act#%d", (v))) \
1532 )
1533 #define PRINT_MESHPEERING_ACTION(v) (\
1534 (v) == 0 ? ND_PRINT((ndo, "Open")) : \
1535 (v) == 1 ? ND_PRINT((ndo, "Confirm")) : \
1536 (v) == 2 ? ND_PRINT((ndo, "Close")) : \
1537 ND_PRINT((ndo, "Act#%d", (v))) \
1538 )
1539 #define PRINT_MESHPATH_ACTION(v) (\
1540 (v) == 0 ? ND_PRINT((ndo, "Request")) : \
1541 (v) == 1 ? ND_PRINT((ndo, "Report")) : \
1542 (v) == 2 ? ND_PRINT((ndo, "Error")) : \
1543 (v) == 3 ? ND_PRINT((ndo, "RootAnnouncement")) : \
1544 ND_PRINT((ndo, "Act#%d", (v))) \
1545 )
1546
1547 #define PRINT_MESH_ACTION(v) (\
1548 (v) == 0 ? ND_PRINT((ndo, "MeshLink")) : \
1549 (v) == 1 ? ND_PRINT((ndo, "HWMP")) : \
1550 (v) == 2 ? ND_PRINT((ndo, "Gate Announcement")) : \
1551 (v) == 3 ? ND_PRINT((ndo, "Congestion Control")) : \
1552 (v) == 4 ? ND_PRINT((ndo, "MCCA Setup Request")) : \
1553 (v) == 5 ? ND_PRINT((ndo, "MCCA Setup Reply")) : \
1554 (v) == 6 ? ND_PRINT((ndo, "MCCA Advertisement Request")) : \
1555 (v) == 7 ? ND_PRINT((ndo, "MCCA Advertisement")) : \
1556 (v) == 8 ? ND_PRINT((ndo, "MCCA Teardown")) : \
1557 (v) == 9 ? ND_PRINT((ndo, "TBTT Adjustment Request")) : \
1558 (v) == 10 ? ND_PRINT((ndo, "TBTT Adjustment Response")) : \
1559 ND_PRINT((ndo, "Act#%d", (v))) \
1560 )
1561 #define PRINT_MULTIHOP_ACTION(v) (\
1562 (v) == 0 ? ND_PRINT((ndo, "Proxy Update")) : \
1563 (v) == 1 ? ND_PRINT((ndo, "Proxy Update Confirmation")) : \
1564 ND_PRINT((ndo, "Act#%d", (v))) \
1565 )
1566 #define PRINT_SELFPROT_ACTION(v) (\
1567 (v) == 1 ? ND_PRINT((ndo, "Peering Open")) : \
1568 (v) == 2 ? ND_PRINT((ndo, "Peering Confirm")) : \
1569 (v) == 3 ? ND_PRINT((ndo, "Peering Close")) : \
1570 (v) == 4 ? ND_PRINT((ndo, "Group Key Inform")) : \
1571 (v) == 5 ? ND_PRINT((ndo, "Group Key Acknowledge")) : \
1572 ND_PRINT((ndo, "Act#%d", (v))) \
1573 )
1574
1575 static int
1576 handle_action(netdissect_options *ndo,
1577 const uint8_t *src, const u_char *p, u_int length)
1578 {
1579 if (!ND_TTEST_2(p))
1580 return 0;
1581 if (length < 2)
1582 return 0;
1583 if (ndo->ndo_eflag) {
1584 ND_PRINT((ndo, ": "));
1585 } else {
1586 ND_PRINT((ndo, " (%s): ", etheraddr_string(ndo, src)));
1587 }
1588 switch (EXTRACT_U_1(p)) {
1589 case 0: ND_PRINT((ndo, "Spectrum Management Act#%d", EXTRACT_U_1(p + 1))); break;
1590 case 1: ND_PRINT((ndo, "QoS Act#%d", EXTRACT_U_1(p + 1))); break;
1591 case 2: ND_PRINT((ndo, "DLS Act#%d", EXTRACT_U_1(p + 1))); break;
1592 case 3: ND_PRINT((ndo, "BA ")); PRINT_BA_ACTION(EXTRACT_U_1(p + 1)); break;
1593 case 7: ND_PRINT((ndo, "HT ")); PRINT_HT_ACTION(EXTRACT_U_1(p + 1)); break;
1594 case 13: ND_PRINT((ndo, "MeshAction ")); PRINT_MESH_ACTION(EXTRACT_U_1(p + 1)); break;
1595 case 14:
1596 ND_PRINT((ndo, "MultiohopAction "));
1597 PRINT_MULTIHOP_ACTION(EXTRACT_U_1(p + 1)); break;
1598 case 15:
1599 ND_PRINT((ndo, "SelfprotectAction "));
1600 PRINT_SELFPROT_ACTION(EXTRACT_U_1(p + 1)); break;
1601 case 127: ND_PRINT((ndo, "Vendor Act#%d", EXTRACT_U_1(p + 1))); break;
1602 default:
1603 ND_PRINT((ndo, "Reserved(%d) Act#%d", EXTRACT_U_1(p), EXTRACT_U_1(p + 1)));
1604 break;
1605 }
1606 return 1;
1607 }
1608
1609
1610 /*********************************************************************************
1611 * Print Body funcs
1612 *********************************************************************************/
1613
1614
1615 static int
1616 mgmt_body_print(netdissect_options *ndo,
1617 uint16_t fc, const uint8_t *src, const u_char *p, u_int length)
1618 {
1619 ND_PRINT((ndo, "%s", tok2str(st_str, "Unhandled Management subtype(%x)", FC_SUBTYPE(fc))));
1620
1621 /* There may be a problem w/ AP not having this bit set */
1622 if (FC_PROTECTED(fc))
1623 return wep_print(ndo, p);
1624 switch (FC_SUBTYPE(fc)) {
1625 case ST_ASSOC_REQUEST:
1626 return handle_assoc_request(ndo, p, length);
1627 case ST_ASSOC_RESPONSE:
1628 return handle_assoc_response(ndo, p, length);
1629 case ST_REASSOC_REQUEST:
1630 return handle_reassoc_request(ndo, p, length);
1631 case ST_REASSOC_RESPONSE:
1632 return handle_reassoc_response(ndo, p, length);
1633 case ST_PROBE_REQUEST:
1634 return handle_probe_request(ndo, p, length);
1635 case ST_PROBE_RESPONSE:
1636 return handle_probe_response(ndo, p, length);
1637 case ST_BEACON:
1638 return handle_beacon(ndo, p, length);
1639 case ST_ATIM:
1640 return handle_atim();
1641 case ST_DISASSOC:
1642 return handle_disassoc(ndo, p, length);
1643 case ST_AUTH:
1644 return handle_auth(ndo, p, length);
1645 case ST_DEAUTH:
1646 return handle_deauth(ndo, src, p, length);
1647 case ST_ACTION:
1648 return handle_action(ndo, src, p, length);
1649 default:
1650 return 1;
1651 }
1652 }
1653
1654
1655 /*********************************************************************************
1656 * Handles printing all the control frame types
1657 *********************************************************************************/
1658
1659 static int
1660 ctrl_body_print(netdissect_options *ndo,
1661 uint16_t fc, const u_char *p)
1662 {
1663 ND_PRINT((ndo, "%s", tok2str(ctrl_str, "Unknown Ctrl Subtype", FC_SUBTYPE(fc))));
1664 switch (FC_SUBTYPE(fc)) {
1665 case CTRL_CONTROL_WRAPPER:
1666 /* XXX - requires special handling */
1667 break;
1668 case CTRL_BAR:
1669 if (!ND_TTEST_LEN(p, CTRL_BAR_HDRLEN))
1670 return 0;
1671 if (!ndo->ndo_eflag)
1672 ND_PRINT((ndo, " RA:%s TA:%s CTL(%x) SEQ(%u) ",
1673 etheraddr_string(ndo, ((const struct ctrl_bar_hdr_t *)p)->ra),
1674 etheraddr_string(ndo, ((const struct ctrl_bar_hdr_t *)p)->ta),
1675 EXTRACT_LE_U_2(&(((const struct ctrl_bar_hdr_t *)p)->ctl)),
1676 EXTRACT_LE_U_2(&(((const struct ctrl_bar_hdr_t *)p)->seq))));
1677 break;
1678 case CTRL_BA:
1679 if (!ND_TTEST_LEN(p, CTRL_BA_HDRLEN))
1680 return 0;
1681 if (!ndo->ndo_eflag)
1682 ND_PRINT((ndo, " RA:%s ",
1683 etheraddr_string(ndo, ((const struct ctrl_ba_hdr_t *)p)->ra)));
1684 break;
1685 case CTRL_PS_POLL:
1686 if (!ND_TTEST_LEN(p, CTRL_PS_POLL_HDRLEN))
1687 return 0;
1688 ND_PRINT((ndo, " AID(%x)",
1689 EXTRACT_LE_U_2(&(((const struct ctrl_ps_poll_hdr_t *)p)->aid))));
1690 break;
1691 case CTRL_RTS:
1692 if (!ND_TTEST_LEN(p, CTRL_RTS_HDRLEN))
1693 return 0;
1694 if (!ndo->ndo_eflag)
1695 ND_PRINT((ndo, " TA:%s ",
1696 etheraddr_string(ndo, ((const struct ctrl_rts_hdr_t *)p)->ta)));
1697 break;
1698 case CTRL_CTS:
1699 if (!ND_TTEST_LEN(p, CTRL_CTS_HDRLEN))
1700 return 0;
1701 if (!ndo->ndo_eflag)
1702 ND_PRINT((ndo, " RA:%s ",
1703 etheraddr_string(ndo, ((const struct ctrl_cts_hdr_t *)p)->ra)));
1704 break;
1705 case CTRL_ACK:
1706 if (!ND_TTEST_LEN(p, CTRL_ACK_HDRLEN))
1707 return 0;
1708 if (!ndo->ndo_eflag)
1709 ND_PRINT((ndo, " RA:%s ",
1710 etheraddr_string(ndo, ((const struct ctrl_ack_hdr_t *)p)->ra)));
1711 break;
1712 case CTRL_CF_END:
1713 if (!ND_TTEST_LEN(p, CTRL_END_HDRLEN))
1714 return 0;
1715 if (!ndo->ndo_eflag)
1716 ND_PRINT((ndo, " RA:%s ",
1717 etheraddr_string(ndo, ((const struct ctrl_end_hdr_t *)p)->ra)));
1718 break;
1719 case CTRL_END_ACK:
1720 if (!ND_TTEST_LEN(p, CTRL_END_ACK_HDRLEN))
1721 return 0;
1722 if (!ndo->ndo_eflag)
1723 ND_PRINT((ndo, " RA:%s ",
1724 etheraddr_string(ndo, ((const struct ctrl_end_ack_hdr_t *)p)->ra)));
1725 break;
1726 }
1727 return 1;
1728 }
1729
1730 /*
1731 * Data Frame - Address field contents
1732 *
1733 * To Ds | From DS | Addr 1 | Addr 2 | Addr 3 | Addr 4
1734 * 0 | 0 | DA | SA | BSSID | n/a
1735 * 0 | 1 | DA | BSSID | SA | n/a
1736 * 1 | 0 | BSSID | SA | DA | n/a
1737 * 1 | 1 | RA | TA | DA | SA
1738 */
1739
1740 /*
1741 * Function to get source and destination MAC addresses for a data frame.
1742 */
1743 static void
1744 get_data_src_dst_mac(uint16_t fc, const u_char *p, const uint8_t **srcp,
1745 const uint8_t **dstp)
1746 {
1747 #define ADDR1 (p + 4)
1748 #define ADDR2 (p + 10)
1749 #define ADDR3 (p + 16)
1750 #define ADDR4 (p + 24)
1751
1752 if (!FC_TO_DS(fc)) {
1753 if (!FC_FROM_DS(fc)) {
1754 /* not To DS and not From DS */
1755 *srcp = ADDR2;
1756 *dstp = ADDR1;
1757 } else {
1758 /* not To DS and From DS */
1759 *srcp = ADDR3;
1760 *dstp = ADDR1;
1761 }
1762 } else {
1763 if (!FC_FROM_DS(fc)) {
1764 /* From DS and not To DS */
1765 *srcp = ADDR2;
1766 *dstp = ADDR3;
1767 } else {
1768 /* To DS and From DS */
1769 *srcp = ADDR4;
1770 *dstp = ADDR3;
1771 }
1772 }
1773
1774 #undef ADDR1
1775 #undef ADDR2
1776 #undef ADDR3
1777 #undef ADDR4
1778 }
1779
1780 static void
1781 get_mgmt_src_dst_mac(const u_char *p, const uint8_t **srcp, const uint8_t **dstp)
1782 {
1783 const struct mgmt_header_t *hp = (const struct mgmt_header_t *) p;
1784
1785 if (srcp != NULL)
1786 *srcp = hp->sa;
1787 if (dstp != NULL)
1788 *dstp = hp->da;
1789 }
1790
1791 /*
1792 * Print Header funcs
1793 */
1794
1795 static void
1796 data_header_print(netdissect_options *ndo, uint16_t fc, const u_char *p)
1797 {
1798 u_int subtype = FC_SUBTYPE(fc);
1799
1800 if (DATA_FRAME_IS_CF_ACK(subtype) || DATA_FRAME_IS_CF_POLL(subtype) ||
1801 DATA_FRAME_IS_QOS(subtype)) {
1802 ND_PRINT((ndo, "CF "));
1803 if (DATA_FRAME_IS_CF_ACK(subtype)) {
1804 if (DATA_FRAME_IS_CF_POLL(subtype))
1805 ND_PRINT((ndo, "Ack/Poll"));
1806 else
1807 ND_PRINT((ndo, "Ack"));
1808 } else {
1809 if (DATA_FRAME_IS_CF_POLL(subtype))
1810 ND_PRINT((ndo, "Poll"));
1811 }
1812 if (DATA_FRAME_IS_QOS(subtype))
1813 ND_PRINT((ndo, "+QoS"));
1814 ND_PRINT((ndo, " "));
1815 }
1816
1817 #define ADDR1 (p + 4)
1818 #define ADDR2 (p + 10)
1819 #define ADDR3 (p + 16)
1820 #define ADDR4 (p + 24)
1821
1822 if (!FC_TO_DS(fc) && !FC_FROM_DS(fc)) {
1823 ND_PRINT((ndo, "DA:%s SA:%s BSSID:%s ",
1824 etheraddr_string(ndo, ADDR1), etheraddr_string(ndo, ADDR2),
1825 etheraddr_string(ndo, ADDR3)));
1826 } else if (!FC_TO_DS(fc) && FC_FROM_DS(fc)) {
1827 ND_PRINT((ndo, "DA:%s BSSID:%s SA:%s ",
1828 etheraddr_string(ndo, ADDR1), etheraddr_string(ndo, ADDR2),
1829 etheraddr_string(ndo, ADDR3)));
1830 } else if (FC_TO_DS(fc) && !FC_FROM_DS(fc)) {
1831 ND_PRINT((ndo, "BSSID:%s SA:%s DA:%s ",
1832 etheraddr_string(ndo, ADDR1), etheraddr_string(ndo, ADDR2),
1833 etheraddr_string(ndo, ADDR3)));
1834 } else if (FC_TO_DS(fc) && FC_FROM_DS(fc)) {
1835 ND_PRINT((ndo, "RA:%s TA:%s DA:%s SA:%s ",
1836 etheraddr_string(ndo, ADDR1), etheraddr_string(ndo, ADDR2),
1837 etheraddr_string(ndo, ADDR3), etheraddr_string(ndo, ADDR4)));
1838 }
1839
1840 #undef ADDR1
1841 #undef ADDR2
1842 #undef ADDR3
1843 #undef ADDR4
1844 }
1845
1846 static void
1847 mgmt_header_print(netdissect_options *ndo, const u_char *p)
1848 {
1849 const struct mgmt_header_t *hp = (const struct mgmt_header_t *) p;
1850
1851 ND_PRINT((ndo, "BSSID:%s DA:%s SA:%s ",
1852 etheraddr_string(ndo, (hp)->bssid), etheraddr_string(ndo, (hp)->da),
1853 etheraddr_string(ndo, (hp)->sa)));
1854 }
1855
1856 static void
1857 ctrl_header_print(netdissect_options *ndo, uint16_t fc, const u_char *p)
1858 {
1859 switch (FC_SUBTYPE(fc)) {
1860 case CTRL_BAR:
1861 ND_PRINT((ndo, " RA:%s TA:%s CTL(%x) SEQ(%u) ",
1862 etheraddr_string(ndo, ((const struct ctrl_bar_hdr_t *)p)->ra),
1863 etheraddr_string(ndo, ((const struct ctrl_bar_hdr_t *)p)->ta),
1864 EXTRACT_LE_U_2(&(((const struct ctrl_bar_hdr_t *)p)->ctl)),
1865 EXTRACT_LE_U_2(&(((const struct ctrl_bar_hdr_t *)p)->seq))));
1866 break;
1867 case CTRL_BA:
1868 ND_PRINT((ndo, "RA:%s ",
1869 etheraddr_string(ndo, ((const struct ctrl_ba_hdr_t *)p)->ra)));
1870 break;
1871 case CTRL_PS_POLL:
1872 ND_PRINT((ndo, "BSSID:%s TA:%s ",
1873 etheraddr_string(ndo, ((const struct ctrl_ps_poll_hdr_t *)p)->bssid),
1874 etheraddr_string(ndo, ((const struct ctrl_ps_poll_hdr_t *)p)->ta)));
1875 break;
1876 case CTRL_RTS:
1877 ND_PRINT((ndo, "RA:%s TA:%s ",
1878 etheraddr_string(ndo, ((const struct ctrl_rts_hdr_t *)p)->ra),
1879 etheraddr_string(ndo, ((const struct ctrl_rts_hdr_t *)p)->ta)));
1880 break;
1881 case CTRL_CTS:
1882 ND_PRINT((ndo, "RA:%s ",
1883 etheraddr_string(ndo, ((const struct ctrl_cts_hdr_t *)p)->ra)));
1884 break;
1885 case CTRL_ACK:
1886 ND_PRINT((ndo, "RA:%s ",
1887 etheraddr_string(ndo, ((const struct ctrl_ack_hdr_t *)p)->ra)));
1888 break;
1889 case CTRL_CF_END:
1890 ND_PRINT((ndo, "RA:%s BSSID:%s ",
1891 etheraddr_string(ndo, ((const struct ctrl_end_hdr_t *)p)->ra),
1892 etheraddr_string(ndo, ((const struct ctrl_end_hdr_t *)p)->bssid)));
1893 break;
1894 case CTRL_END_ACK:
1895 ND_PRINT((ndo, "RA:%s BSSID:%s ",
1896 etheraddr_string(ndo, ((const struct ctrl_end_ack_hdr_t *)p)->ra),
1897 etheraddr_string(ndo, ((const struct ctrl_end_ack_hdr_t *)p)->bssid)));
1898 break;
1899 default:
1900 /* We shouldn't get here - we should already have quit */
1901 break;
1902 }
1903 }
1904
1905 static int
1906 extract_header_length(netdissect_options *ndo,
1907 uint16_t fc)
1908 {
1909 int len;
1910
1911 switch (FC_TYPE(fc)) {
1912 case T_MGMT:
1913 return MGMT_HDRLEN;
1914 case T_CTRL:
1915 switch (FC_SUBTYPE(fc)) {
1916 case CTRL_CONTROL_WRAPPER:
1917 return CTRL_CONTROL_WRAPPER_HDRLEN;
1918 case CTRL_BAR:
1919 return CTRL_BAR_HDRLEN;
1920 case CTRL_BA:
1921 return CTRL_BA_HDRLEN;
1922 case CTRL_PS_POLL:
1923 return CTRL_PS_POLL_HDRLEN;
1924 case CTRL_RTS:
1925 return CTRL_RTS_HDRLEN;
1926 case CTRL_CTS:
1927 return CTRL_CTS_HDRLEN;
1928 case CTRL_ACK:
1929 return CTRL_ACK_HDRLEN;
1930 case CTRL_CF_END:
1931 return CTRL_END_HDRLEN;
1932 case CTRL_END_ACK:
1933 return CTRL_END_ACK_HDRLEN;
1934 default:
1935 ND_PRINT((ndo, "unknown 802.11 ctrl frame subtype (%d)", FC_SUBTYPE(fc)));
1936 return 0;
1937 }
1938 case T_DATA:
1939 len = (FC_TO_DS(fc) && FC_FROM_DS(fc)) ? 30 : 24;
1940 if (DATA_FRAME_IS_QOS(FC_SUBTYPE(fc)))
1941 len += 2;
1942 return len;
1943 default:
1944 ND_PRINT((ndo, "unknown 802.11 frame type (%d)", FC_TYPE(fc)));
1945 return 0;
1946 }
1947 }
1948
1949 static int
1950 extract_mesh_header_length(const u_char *p)
1951 {
1952 return (EXTRACT_U_1(p) &~ 3) ? 0 : 6*(1 + (EXTRACT_U_1(p) & 3));
1953 }
1954
1955 /*
1956 * Print the 802.11 MAC header.
1957 */
1958 static void
1959 ieee_802_11_hdr_print(netdissect_options *ndo,
1960 uint16_t fc, const u_char *p, u_int hdrlen,
1961 u_int meshdrlen)
1962 {
1963 if (ndo->ndo_vflag) {
1964 if (FC_MORE_DATA(fc))
1965 ND_PRINT((ndo, "More Data "));
1966 if (FC_MORE_FLAG(fc))
1967 ND_PRINT((ndo, "More Fragments "));
1968 if (FC_POWER_MGMT(fc))
1969 ND_PRINT((ndo, "Pwr Mgmt "));
1970 if (FC_RETRY(fc))
1971 ND_PRINT((ndo, "Retry "));
1972 if (FC_ORDER(fc))
1973 ND_PRINT((ndo, "Strictly Ordered "));
1974 if (FC_PROTECTED(fc))
1975 ND_PRINT((ndo, "Protected "));
1976 if (FC_TYPE(fc) != T_CTRL || FC_SUBTYPE(fc) != CTRL_PS_POLL)
1977 ND_PRINT((ndo, "%dus ",
1978 EXTRACT_LE_U_2(&((const struct mgmt_header_t *)p)->duration)));
1979 }
1980 if (meshdrlen != 0) {
1981 const struct meshcntl_t *mc =
1982 (const struct meshcntl_t *)(p + hdrlen - meshdrlen);
1983 int ae = mc->flags & 3;
1984
1985 ND_PRINT((ndo, "MeshData (AE %d TTL %u seq %u", ae, mc->ttl,
1986 EXTRACT_LE_U_4(mc->seq)));
1987 if (ae > 0)
1988 ND_PRINT((ndo, " A4:%s", etheraddr_string(ndo, mc->addr4)));
1989 if (ae > 1)
1990 ND_PRINT((ndo, " A5:%s", etheraddr_string(ndo, mc->addr5)));
1991 if (ae > 2)
1992 ND_PRINT((ndo, " A6:%s", etheraddr_string(ndo, mc->addr6)));
1993 ND_PRINT((ndo, ") "));
1994 }
1995
1996 switch (FC_TYPE(fc)) {
1997 case T_MGMT:
1998 mgmt_header_print(ndo, p);
1999 break;
2000 case T_CTRL:
2001 ctrl_header_print(ndo, fc, p);
2002 break;
2003 case T_DATA:
2004 data_header_print(ndo, fc, p);
2005 break;
2006 default:
2007 break;
2008 }
2009 }
2010
2011 #ifndef roundup2
2012 #define roundup2(x, y) (((x)+((y)-1))&(~((y)-1))) /* if y is powers of two */
2013 #endif
2014
2015 static const char tstr[] = "[|802.11]";
2016
2017 static u_int
2018 ieee802_11_print(netdissect_options *ndo,
2019 const u_char *p, u_int length, u_int orig_caplen, int pad,
2020 u_int fcslen)
2021 {
2022 uint16_t fc;
2023 u_int caplen, hdrlen, meshdrlen;
2024 struct lladdr_info src, dst;
2025 int llc_hdrlen;
2026
2027 caplen = orig_caplen;
2028 /* Remove FCS, if present */
2029 if (length < fcslen) {
2030 ND_PRINT((ndo, "%s", tstr));
2031 return caplen;
2032 }
2033 length -= fcslen;
2034 if (caplen > length) {
2035 /* Amount of FCS in actual packet data, if any */
2036 fcslen = caplen - length;
2037 caplen -= fcslen;
2038 ndo->ndo_snapend -= fcslen;
2039 }
2040
2041 if (caplen < IEEE802_11_FC_LEN) {
2042 ND_PRINT((ndo, "%s", tstr));
2043 return orig_caplen;
2044 }
2045
2046 fc = EXTRACT_LE_U_2(p);
2047 hdrlen = extract_header_length(ndo, fc);
2048 if (hdrlen == 0) {
2049 /* Unknown frame type or control frame subtype; quit. */
2050 return (0);
2051 }
2052 if (pad)
2053 hdrlen = roundup2(hdrlen, 4);
2054 if (ndo->ndo_Hflag && FC_TYPE(fc) == T_DATA &&
2055 DATA_FRAME_IS_QOS(FC_SUBTYPE(fc))) {
2056 meshdrlen = extract_mesh_header_length(p+hdrlen);
2057 hdrlen += meshdrlen;
2058 } else
2059 meshdrlen = 0;
2060
2061 if (caplen < hdrlen) {
2062 ND_PRINT((ndo, "%s", tstr));
2063 return hdrlen;
2064 }
2065
2066 if (ndo->ndo_eflag)
2067 ieee_802_11_hdr_print(ndo, fc, p, hdrlen, meshdrlen);
2068
2069 /*
2070 * Go past the 802.11 header.
2071 */
2072 length -= hdrlen;
2073 caplen -= hdrlen;
2074 p += hdrlen;
2075
2076 src.addr_string = etheraddr_string;
2077 dst.addr_string = etheraddr_string;
2078 switch (FC_TYPE(fc)) {
2079 case T_MGMT:
2080 get_mgmt_src_dst_mac(p - hdrlen, &src.addr, &dst.addr);
2081 if (!mgmt_body_print(ndo, fc, src.addr, p, length)) {
2082 ND_PRINT((ndo, "%s", tstr));
2083 return hdrlen;
2084 }
2085 break;
2086 case T_CTRL:
2087 if (!ctrl_body_print(ndo, fc, p - hdrlen)) {
2088 ND_PRINT((ndo, "%s", tstr));
2089 return hdrlen;
2090 }
2091 break;
2092 case T_DATA:
2093 if (DATA_FRAME_IS_NULL(FC_SUBTYPE(fc)))
2094 return hdrlen; /* no-data frame */
2095 /* There may be a problem w/ AP not having this bit set */
2096 if (FC_PROTECTED(fc)) {
2097 ND_PRINT((ndo, "Data"));
2098 if (!wep_print(ndo, p)) {
2099 ND_PRINT((ndo, "%s", tstr));
2100 return hdrlen;
2101 }
2102 } else {
2103 get_data_src_dst_mac(fc, p - hdrlen, &src.addr, &dst.addr);
2104 llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
2105 if (llc_hdrlen < 0) {
2106 /*
2107 * Some kinds of LLC packet we cannot
2108 * handle intelligently
2109 */
2110 if (!ndo->ndo_suppress_default_print)
2111 ND_DEFAULTPRINT(p, caplen);
2112 llc_hdrlen = -llc_hdrlen;
2113 }
2114 hdrlen += llc_hdrlen;
2115 }
2116 break;
2117 default:
2118 /* We shouldn't get here - we should already have quit */
2119 break;
2120 }
2121
2122 return hdrlen;
2123 }
2124
2125 /*
2126 * This is the top level routine of the printer. 'p' points
2127 * to the 802.11 header of the packet, 'h->ts' is the timestamp,
2128 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
2129 * is the number of bytes actually captured.
2130 */
2131 u_int
2132 ieee802_11_if_print(netdissect_options *ndo,
2133 const struct pcap_pkthdr *h, const u_char *p)
2134 {
2135 return ieee802_11_print(ndo, p, h->len, h->caplen, 0, 0);
2136 }
2137
2138
2139 /* $FreeBSD: src/sys/net80211/ieee80211_radiotap.h,v 1.5 2005/01/22 20:12:05 sam Exp $ */
2140 /* NetBSD: ieee802_11_radio.h,v 1.2 2006/02/26 03:04:03 dyoung Exp */
2141
2142 /*-
2143 * Copyright (c) 2003, 2004 David Young. All rights reserved.
2144 *
2145 * Redistribution and use in source and binary forms, with or without
2146 * modification, are permitted provided that the following conditions
2147 * are met:
2148 * 1. Redistributions of source code must retain the above copyright
2149 * notice, this list of conditions and the following disclaimer.
2150 * 2. Redistributions in binary form must reproduce the above copyright
2151 * notice, this list of conditions and the following disclaimer in the
2152 * documentation and/or other materials provided with the distribution.
2153 * 3. The name of David Young may not be used to endorse or promote
2154 * products derived from this software without specific prior
2155 * written permission.
2156 *
2157 * THIS SOFTWARE IS PROVIDED BY DAVID YOUNG ``AS IS'' AND ANY
2158 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
2159 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
2160 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID
2161 * YOUNG BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
2162 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
2163 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
2164 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
2165 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
2166 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
2167 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
2168 * OF SUCH DAMAGE.
2169 */
2170
2171 /* A generic radio capture format is desirable. It must be
2172 * rigidly defined (e.g., units for fields should be given),
2173 * and easily extensible.
2174 *
2175 * The following is an extensible radio capture format. It is
2176 * based on a bitmap indicating which fields are present.
2177 *
2178 * I am trying to describe precisely what the application programmer
2179 * should expect in the following, and for that reason I tell the
2180 * units and origin of each measurement (where it applies), or else I
2181 * use sufficiently weaselly language ("is a monotonically nondecreasing
2182 * function of...") that I cannot set false expectations for lawyerly
2183 * readers.
2184 */
2185
2186 /*
2187 * The radio capture header precedes the 802.11 header.
2188 *
2189 * Note well: all radiotap fields are little-endian.
2190 */
2191 struct ieee80211_radiotap_header {
2192 uint8_t it_version; /* Version 0. Only increases
2193 * for drastic changes,
2194 * introduction of compatible
2195 * new fields does not count.
2196 */
2197 uint8_t it_pad;
2198 uint16_t it_len; /* length of the whole
2199 * header in bytes, including
2200 * it_version, it_pad,
2201 * it_len, and data fields.
2202 */
2203 uint32_t it_present; /* A bitmap telling which
2204 * fields are present. Set bit 31
2205 * (0x80000000) to extend the
2206 * bitmap by another 32 bits.
2207 * Additional extensions are made
2208 * by setting bit 31.
2209 */
2210 };
2211
2212 /* Name Data type Units
2213 * ---- --------- -----
2214 *
2215 * IEEE80211_RADIOTAP_TSFT uint64_t microseconds
2216 *
2217 * Value in microseconds of the MAC's 64-bit 802.11 Time
2218 * Synchronization Function timer when the first bit of the
2219 * MPDU arrived at the MAC. For received frames, only.
2220 *
2221 * IEEE80211_RADIOTAP_CHANNEL 2 x uint16_t MHz, bitmap
2222 *
2223 * Tx/Rx frequency in MHz, followed by flags (see below).
2224 * Note that IEEE80211_RADIOTAP_XCHANNEL must be used to
2225 * represent an HT channel as there is not enough room in
2226 * the flags word.
2227 *
2228 * IEEE80211_RADIOTAP_FHSS uint16_t see below
2229 *
2230 * For frequency-hopping radios, the hop set (first byte)
2231 * and pattern (second byte).
2232 *
2233 * IEEE80211_RADIOTAP_RATE uint8_t 500kb/s or index
2234 *
2235 * Tx/Rx data rate. If bit 0x80 is set then it represents an
2236 * an MCS index and not an IEEE rate.
2237 *
2238 * IEEE80211_RADIOTAP_DBM_ANTSIGNAL int8_t decibels from
2239 * one milliwatt (dBm)
2240 *
2241 * RF signal power at the antenna, decibel difference from
2242 * one milliwatt.
2243 *
2244 * IEEE80211_RADIOTAP_DBM_ANTNOISE int8_t decibels from
2245 * one milliwatt (dBm)
2246 *
2247 * RF noise power at the antenna, decibel difference from one
2248 * milliwatt.
2249 *
2250 * IEEE80211_RADIOTAP_DB_ANTSIGNAL uint8_t decibel (dB)
2251 *
2252 * RF signal power at the antenna, decibel difference from an
2253 * arbitrary, fixed reference.
2254 *
2255 * IEEE80211_RADIOTAP_DB_ANTNOISE uint8_t decibel (dB)
2256 *
2257 * RF noise power at the antenna, decibel difference from an
2258 * arbitrary, fixed reference point.
2259 *
2260 * IEEE80211_RADIOTAP_LOCK_QUALITY uint16_t unitless
2261 *
2262 * Quality of Barker code lock. Unitless. Monotonically
2263 * nondecreasing with "better" lock strength. Called "Signal
2264 * Quality" in datasheets. (Is there a standard way to measure
2265 * this?)
2266 *
2267 * IEEE80211_RADIOTAP_TX_ATTENUATION uint16_t unitless
2268 *
2269 * Transmit power expressed as unitless distance from max
2270 * power set at factory calibration. 0 is max power.
2271 * Monotonically nondecreasing with lower power levels.
2272 *
2273 * IEEE80211_RADIOTAP_DB_TX_ATTENUATION uint16_t decibels (dB)
2274 *
2275 * Transmit power expressed as decibel distance from max power
2276 * set at factory calibration. 0 is max power. Monotonically
2277 * nondecreasing with lower power levels.
2278 *
2279 * IEEE80211_RADIOTAP_DBM_TX_POWER int8_t decibels from
2280 * one milliwatt (dBm)
2281 *
2282 * Transmit power expressed as dBm (decibels from a 1 milliwatt
2283 * reference). This is the absolute power level measured at
2284 * the antenna port.
2285 *
2286 * IEEE80211_RADIOTAP_FLAGS uint8_t bitmap
2287 *
2288 * Properties of transmitted and received frames. See flags
2289 * defined below.
2290 *
2291 * IEEE80211_RADIOTAP_ANTENNA uint8_t antenna index
2292 *
2293 * Unitless indication of the Rx/Tx antenna for this packet.
2294 * The first antenna is antenna 0.
2295 *
2296 * IEEE80211_RADIOTAP_RX_FLAGS uint16_t bitmap
2297 *
2298 * Properties of received frames. See flags defined below.
2299 *
2300 * IEEE80211_RADIOTAP_XCHANNEL uint32_t bitmap
2301 * uint16_t MHz
2302 * uint8_t channel number
2303 * uint8_t .5 dBm
2304 *
2305 * Extended channel specification: flags (see below) followed by
2306 * frequency in MHz, the corresponding IEEE channel number, and
2307 * finally the maximum regulatory transmit power cap in .5 dBm
2308 * units. This property supersedes IEEE80211_RADIOTAP_CHANNEL
2309 * and only one of the two should be present.
2310 *
2311 * IEEE80211_RADIOTAP_MCS uint8_t known
2312 * uint8_t flags
2313 * uint8_t mcs
2314 *
2315 * Bitset indicating which fields have known values, followed
2316 * by bitset of flag values, followed by the MCS rate index as
2317 * in IEEE 802.11n.
2318 *
2319 *
2320 * IEEE80211_RADIOTAP_AMPDU_STATUS u32, u16, u8, u8 unitless
2321 *
2322 * Contains the AMPDU information for the subframe.
2323 *
2324 * IEEE80211_RADIOTAP_VHT u16, u8, u8, u8[4], u8, u8, u16
2325 *
2326 * Contains VHT information about this frame.
2327 *
2328 * IEEE80211_RADIOTAP_VENDOR_NAMESPACE
2329 * uint8_t OUI[3]
2330 * uint8_t subspace
2331 * uint16_t length
2332 *
2333 * The Vendor Namespace Field contains three sub-fields. The first
2334 * sub-field is 3 bytes long. It contains the vendor's IEEE 802
2335 * Organizationally Unique Identifier (OUI). The fourth byte is a
2336 * vendor-specific "namespace selector."
2337 *
2338 */
2339 enum ieee80211_radiotap_type {
2340 IEEE80211_RADIOTAP_TSFT = 0,
2341 IEEE80211_RADIOTAP_FLAGS = 1,
2342 IEEE80211_RADIOTAP_RATE = 2,
2343 IEEE80211_RADIOTAP_CHANNEL = 3,
2344 IEEE80211_RADIOTAP_FHSS = 4,
2345 IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
2346 IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
2347 IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
2348 IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
2349 IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
2350 IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
2351 IEEE80211_RADIOTAP_ANTENNA = 11,
2352 IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
2353 IEEE80211_RADIOTAP_DB_ANTNOISE = 13,
2354 IEEE80211_RADIOTAP_RX_FLAGS = 14,
2355 /* NB: gap for netbsd definitions */
2356 IEEE80211_RADIOTAP_XCHANNEL = 18,
2357 IEEE80211_RADIOTAP_MCS = 19,
2358 IEEE80211_RADIOTAP_AMPDU_STATUS = 20,
2359 IEEE80211_RADIOTAP_VHT = 21,
2360 IEEE80211_RADIOTAP_NAMESPACE = 29,
2361 IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30,
2362 IEEE80211_RADIOTAP_EXT = 31
2363 };
2364
2365 /* channel attributes */
2366 #define IEEE80211_CHAN_TURBO 0x00010 /* Turbo channel */
2367 #define IEEE80211_CHAN_CCK 0x00020 /* CCK channel */
2368 #define IEEE80211_CHAN_OFDM 0x00040 /* OFDM channel */
2369 #define IEEE80211_CHAN_2GHZ 0x00080 /* 2 GHz spectrum channel. */
2370 #define IEEE80211_CHAN_5GHZ 0x00100 /* 5 GHz spectrum channel */
2371 #define IEEE80211_CHAN_PASSIVE 0x00200 /* Only passive scan allowed */
2372 #define IEEE80211_CHAN_DYN 0x00400 /* Dynamic CCK-OFDM channel */
2373 #define IEEE80211_CHAN_GFSK 0x00800 /* GFSK channel (FHSS PHY) */
2374 #define IEEE80211_CHAN_GSM 0x01000 /* 900 MHz spectrum channel */
2375 #define IEEE80211_CHAN_STURBO 0x02000 /* 11a static turbo channel only */
2376 #define IEEE80211_CHAN_HALF 0x04000 /* Half rate channel */
2377 #define IEEE80211_CHAN_QUARTER 0x08000 /* Quarter rate channel */
2378 #define IEEE80211_CHAN_HT20 0x10000 /* HT 20 channel */
2379 #define IEEE80211_CHAN_HT40U 0x20000 /* HT 40 channel w/ ext above */
2380 #define IEEE80211_CHAN_HT40D 0x40000 /* HT 40 channel w/ ext below */
2381
2382 /* Useful combinations of channel characteristics, borrowed from Ethereal */
2383 #define IEEE80211_CHAN_A \
2384 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2385 #define IEEE80211_CHAN_B \
2386 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
2387 #define IEEE80211_CHAN_G \
2388 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
2389 #define IEEE80211_CHAN_TA \
2390 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM | IEEE80211_CHAN_TURBO)
2391 #define IEEE80211_CHAN_TG \
2392 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN | IEEE80211_CHAN_TURBO)
2393
2394
2395 /* For IEEE80211_RADIOTAP_FLAGS */
2396 #define IEEE80211_RADIOTAP_F_CFP 0x01 /* sent/received
2397 * during CFP
2398 */
2399 #define IEEE80211_RADIOTAP_F_SHORTPRE 0x02 /* sent/received
2400 * with short
2401 * preamble
2402 */
2403 #define IEEE80211_RADIOTAP_F_WEP 0x04 /* sent/received
2404 * with WEP encryption
2405 */
2406 #define IEEE80211_RADIOTAP_F_FRAG 0x08 /* sent/received
2407 * with fragmentation
2408 */
2409 #define IEEE80211_RADIOTAP_F_FCS 0x10 /* frame includes FCS */
2410 #define IEEE80211_RADIOTAP_F_DATAPAD 0x20 /* frame has padding between
2411 * 802.11 header and payload
2412 * (to 32-bit boundary)
2413 */
2414 #define IEEE80211_RADIOTAP_F_BADFCS 0x40 /* does not pass FCS check */
2415
2416 /* For IEEE80211_RADIOTAP_RX_FLAGS */
2417 #define IEEE80211_RADIOTAP_F_RX_BADFCS 0x0001 /* frame failed crc check */
2418 #define IEEE80211_RADIOTAP_F_RX_PLCP_CRC 0x0002 /* frame failed PLCP CRC check */
2419
2420 /* For IEEE80211_RADIOTAP_MCS known */
2421 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN 0x01
2422 #define IEEE80211_RADIOTAP_MCS_MCS_INDEX_KNOWN 0x02 /* MCS index field */
2423 #define IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN 0x04
2424 #define IEEE80211_RADIOTAP_MCS_HT_FORMAT_KNOWN 0x08
2425 #define IEEE80211_RADIOTAP_MCS_FEC_TYPE_KNOWN 0x10
2426 #define IEEE80211_RADIOTAP_MCS_STBC_KNOWN 0x20
2427 #define IEEE80211_RADIOTAP_MCS_NESS_KNOWN 0x40
2428 #define IEEE80211_RADIOTAP_MCS_NESS_BIT_1 0x80
2429
2430 /* For IEEE80211_RADIOTAP_MCS flags */
2431 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK 0x03
2432 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20 0
2433 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_40 1
2434 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20L 2
2435 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20U 3
2436 #define IEEE80211_RADIOTAP_MCS_SHORT_GI 0x04 /* short guard interval */
2437 #define IEEE80211_RADIOTAP_MCS_HT_GREENFIELD 0x08
2438 #define IEEE80211_RADIOTAP_MCS_FEC_LDPC 0x10
2439 #define IEEE80211_RADIOTAP_MCS_STBC_MASK 0x60
2440 #define IEEE80211_RADIOTAP_MCS_STBC_1 1
2441 #define IEEE80211_RADIOTAP_MCS_STBC_2 2
2442 #define IEEE80211_RADIOTAP_MCS_STBC_3 3
2443 #define IEEE80211_RADIOTAP_MCS_STBC_SHIFT 5
2444 #define IEEE80211_RADIOTAP_MCS_NESS_BIT_0 0x80
2445
2446 /* For IEEE80211_RADIOTAP_AMPDU_STATUS */
2447 #define IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN 0x0001
2448 #define IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN 0x0002
2449 #define IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN 0x0004
2450 #define IEEE80211_RADIOTAP_AMPDU_IS_LAST 0x0008
2451 #define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR 0x0010
2452 #define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN 0x0020
2453
2454 /* For IEEE80211_RADIOTAP_VHT known */
2455 #define IEEE80211_RADIOTAP_VHT_STBC_KNOWN 0x0001
2456 #define IEEE80211_RADIOTAP_VHT_TXOP_PS_NA_KNOWN 0x0002
2457 #define IEEE80211_RADIOTAP_VHT_GUARD_INTERVAL_KNOWN 0x0004
2458 #define IEEE80211_RADIOTAP_VHT_SGI_NSYM_DIS_KNOWN 0x0008
2459 #define IEEE80211_RADIOTAP_VHT_LDPC_EXTRA_OFDM_SYM_KNOWN 0x0010
2460 #define IEEE80211_RADIOTAP_VHT_BEAMFORMED_KNOWN 0x0020
2461 #define IEEE80211_RADIOTAP_VHT_BANDWIDTH_KNOWN 0x0040
2462 #define IEEE80211_RADIOTAP_VHT_GROUP_ID_KNOWN 0x0080
2463 #define IEEE80211_RADIOTAP_VHT_PARTIAL_AID_KNOWN 0x0100
2464
2465 /* For IEEE80211_RADIOTAP_VHT flags */
2466 #define IEEE80211_RADIOTAP_VHT_STBC 0x01
2467 #define IEEE80211_RADIOTAP_VHT_TXOP_PS_NA 0x02
2468 #define IEEE80211_RADIOTAP_VHT_SHORT_GI 0x04
2469 #define IEEE80211_RADIOTAP_VHT_SGI_NSYM_M10_9 0x08
2470 #define IEEE80211_RADIOTAP_VHT_LDPC_EXTRA_OFDM_SYM 0x10
2471 #define IEEE80211_RADIOTAP_VHT_BEAMFORMED 0x20
2472
2473 #define IEEE80211_RADIOTAP_VHT_BANDWIDTH_MASK 0x1f
2474
2475 #define IEEE80211_RADIOTAP_VHT_NSS_MASK 0x0f
2476 #define IEEE80211_RADIOTAP_VHT_MCS_MASK 0xf0
2477 #define IEEE80211_RADIOTAP_VHT_MCS_SHIFT 4
2478
2479 #define IEEE80211_RADIOTAP_CODING_LDPC_USERn 0x01
2480
2481 #define IEEE80211_CHAN_FHSS \
2482 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_GFSK)
2483 #define IEEE80211_CHAN_A \
2484 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2485 #define IEEE80211_CHAN_B \
2486 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
2487 #define IEEE80211_CHAN_PUREG \
2488 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_OFDM)
2489 #define IEEE80211_CHAN_G \
2490 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
2491
2492 #define IS_CHAN_FHSS(flags) \
2493 ((flags & IEEE80211_CHAN_FHSS) == IEEE80211_CHAN_FHSS)
2494 #define IS_CHAN_A(flags) \
2495 ((flags & IEEE80211_CHAN_A) == IEEE80211_CHAN_A)
2496 #define IS_CHAN_B(flags) \
2497 ((flags & IEEE80211_CHAN_B) == IEEE80211_CHAN_B)
2498 #define IS_CHAN_PUREG(flags) \
2499 ((flags & IEEE80211_CHAN_PUREG) == IEEE80211_CHAN_PUREG)
2500 #define IS_CHAN_G(flags) \
2501 ((flags & IEEE80211_CHAN_G) == IEEE80211_CHAN_G)
2502 #define IS_CHAN_ANYG(flags) \
2503 (IS_CHAN_PUREG(flags) || IS_CHAN_G(flags))
2504
2505 static void
2506 print_chaninfo(netdissect_options *ndo,
2507 uint16_t freq, int flags, int presentflags)
2508 {
2509 ND_PRINT((ndo, "%u MHz", freq));
2510 if (presentflags & (1 << IEEE80211_RADIOTAP_MCS)) {
2511 /*
2512 * We have the MCS field, so this is 11n, regardless
2513 * of what the channel flags say.
2514 */
2515 ND_PRINT((ndo, " 11n"));
2516 } else {
2517 if (IS_CHAN_FHSS(flags))
2518 ND_PRINT((ndo, " FHSS"));
2519 if (IS_CHAN_A(flags)) {
2520 if (flags & IEEE80211_CHAN_HALF)
2521 ND_PRINT((ndo, " 11a/10Mhz"));
2522 else if (flags & IEEE80211_CHAN_QUARTER)
2523 ND_PRINT((ndo, " 11a/5Mhz"));
2524 else
2525 ND_PRINT((ndo, " 11a"));
2526 }
2527 if (IS_CHAN_ANYG(flags)) {
2528 if (flags & IEEE80211_CHAN_HALF)
2529 ND_PRINT((ndo, " 11g/10Mhz"));
2530 else if (flags & IEEE80211_CHAN_QUARTER)
2531 ND_PRINT((ndo, " 11g/5Mhz"));
2532 else
2533 ND_PRINT((ndo, " 11g"));
2534 } else if (IS_CHAN_B(flags))
2535 ND_PRINT((ndo, " 11b"));
2536 if (flags & IEEE80211_CHAN_TURBO)
2537 ND_PRINT((ndo, " Turbo"));
2538 }
2539 /*
2540 * These apply to 11n.
2541 */
2542 if (flags & IEEE80211_CHAN_HT20)
2543 ND_PRINT((ndo, " ht/20"));
2544 else if (flags & IEEE80211_CHAN_HT40D)
2545 ND_PRINT((ndo, " ht/40-"));
2546 else if (flags & IEEE80211_CHAN_HT40U)
2547 ND_PRINT((ndo, " ht/40+"));
2548 ND_PRINT((ndo, " "));
2549 }
2550
2551 static int
2552 print_radiotap_field(netdissect_options *ndo,
2553 struct cpack_state *s, uint32_t bit, uint8_t *flagsp,
2554 uint32_t presentflags)
2555 {
2556 u_int i;
2557 int rc;
2558
2559 switch (bit) {
2560
2561 case IEEE80211_RADIOTAP_TSFT: {
2562 uint64_t tsft;
2563
2564 rc = cpack_uint64(s, &tsft);
2565 if (rc != 0)
2566 goto trunc;
2567 ND_PRINT((ndo, "%" PRIu64 "us tsft ", tsft));
2568 break;
2569 }
2570
2571 case IEEE80211_RADIOTAP_FLAGS: {
2572 uint8_t flagsval;
2573
2574 rc = cpack_uint8(s, &flagsval);
2575 if (rc != 0)
2576 goto trunc;
2577 *flagsp = flagsval;
2578 if (flagsval & IEEE80211_RADIOTAP_F_CFP)
2579 ND_PRINT((ndo, "cfp "));
2580 if (flagsval & IEEE80211_RADIOTAP_F_SHORTPRE)
2581 ND_PRINT((ndo, "short preamble "));
2582 if (flagsval & IEEE80211_RADIOTAP_F_WEP)
2583 ND_PRINT((ndo, "wep "));
2584 if (flagsval & IEEE80211_RADIOTAP_F_FRAG)
2585 ND_PRINT((ndo, "fragmented "));
2586 if (flagsval & IEEE80211_RADIOTAP_F_BADFCS)
2587 ND_PRINT((ndo, "bad-fcs "));
2588 break;
2589 }
2590
2591 case IEEE80211_RADIOTAP_RATE: {
2592 uint8_t rate;
2593
2594 rc = cpack_uint8(s, &rate);
2595 if (rc != 0)
2596 goto trunc;
2597 /*
2598 * XXX On FreeBSD rate & 0x80 means we have an MCS. On
2599 * Linux and AirPcap it does not. (What about
2600 * Mac OS X, NetBSD, OpenBSD, and DragonFly BSD?)
2601 *
2602 * This is an issue either for proprietary extensions
2603 * to 11a or 11g, which do exist, or for 11n
2604 * implementations that stuff a rate value into
2605 * this field, which also appear to exist.
2606 *
2607 * We currently handle that by assuming that
2608 * if the 0x80 bit is set *and* the remaining
2609 * bits have a value between 0 and 15 it's
2610 * an MCS value, otherwise it's a rate. If
2611 * there are cases where systems that use
2612 * "0x80 + MCS index" for MCS indices > 15,
2613 * or stuff a rate value here between 64 and
2614 * 71.5 Mb/s in here, we'll need a preference
2615 * setting. Such rates do exist, e.g. 11n
2616 * MCS 7 at 20 MHz with a long guard interval.
2617 */
2618 if (rate >= 0x80 && rate <= 0x8f) {
2619 /*
2620 * XXX - we don't know the channel width
2621 * or guard interval length, so we can't
2622 * convert this to a data rate.
2623 *
2624 * If you want us to show a data rate,
2625 * use the MCS field, not the Rate field;
2626 * the MCS field includes not only the
2627 * MCS index, it also includes bandwidth
2628 * and guard interval information.
2629 *
2630 * XXX - can we get the channel width
2631 * from XChannel and the guard interval
2632 * information from Flags, at least on
2633 * FreeBSD?
2634 */
2635 ND_PRINT((ndo, "MCS %u ", rate & 0x7f));
2636 } else
2637 ND_PRINT((ndo, "%2.1f Mb/s ", .5 * rate));
2638 break;
2639 }
2640
2641 case IEEE80211_RADIOTAP_CHANNEL: {
2642 uint16_t frequency;
2643 uint16_t flags;
2644
2645 rc = cpack_uint16(s, &frequency);
2646 if (rc != 0)
2647 goto trunc;
2648 rc = cpack_uint16(s, &flags);
2649 if (rc != 0)
2650 goto trunc;
2651 /*
2652 * If CHANNEL and XCHANNEL are both present, skip
2653 * CHANNEL.
2654 */
2655 if (presentflags & (1 << IEEE80211_RADIOTAP_XCHANNEL))
2656 break;
2657 print_chaninfo(ndo, frequency, flags, presentflags);
2658 break;
2659 }
2660
2661 case IEEE80211_RADIOTAP_FHSS: {
2662 uint8_t hopset;
2663 uint8_t hoppat;
2664
2665 rc = cpack_uint8(s, &hopset);
2666 if (rc != 0)
2667 goto trunc;
2668 rc = cpack_uint8(s, &hoppat);
2669 if (rc != 0)
2670 goto trunc;
2671 ND_PRINT((ndo, "fhset %d fhpat %d ", hopset, hoppat));
2672 break;
2673 }
2674
2675 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL: {
2676 int8_t dbm_antsignal;
2677
2678 rc = cpack_int8(s, &dbm_antsignal);
2679 if (rc != 0)
2680 goto trunc;
2681 ND_PRINT((ndo, "%ddBm signal ", dbm_antsignal));
2682 break;
2683 }
2684
2685 case IEEE80211_RADIOTAP_DBM_ANTNOISE: {
2686 int8_t dbm_antnoise;
2687
2688 rc = cpack_int8(s, &dbm_antnoise);
2689 if (rc != 0)
2690 goto trunc;
2691 ND_PRINT((ndo, "%ddBm noise ", dbm_antnoise));
2692 break;
2693 }
2694
2695 case IEEE80211_RADIOTAP_LOCK_QUALITY: {
2696 uint16_t lock_quality;
2697
2698 rc = cpack_uint16(s, &lock_quality);
2699 if (rc != 0)
2700 goto trunc;
2701 ND_PRINT((ndo, "%u sq ", lock_quality));
2702 break;
2703 }
2704
2705 case IEEE80211_RADIOTAP_TX_ATTENUATION: {
2706 int16_t tx_attenuation;
2707
2708 rc = cpack_int16(s, &tx_attenuation);
2709 if (rc != 0)
2710 goto trunc;
2711 ND_PRINT((ndo, "%d tx power ", -tx_attenuation));
2712 break;
2713 }
2714
2715 case IEEE80211_RADIOTAP_DB_TX_ATTENUATION: {
2716 int8_t db_tx_attenuation;
2717
2718 rc = cpack_int8(s, &db_tx_attenuation);
2719 if (rc != 0)
2720 goto trunc;
2721 ND_PRINT((ndo, "%ddB tx attenuation ", -db_tx_attenuation));
2722 break;
2723 }
2724
2725 case IEEE80211_RADIOTAP_DBM_TX_POWER: {
2726 int8_t dbm_tx_power;
2727
2728 rc = cpack_int8(s, &dbm_tx_power);
2729 if (rc != 0)
2730 goto trunc;
2731 ND_PRINT((ndo, "%ddBm tx power ", dbm_tx_power));
2732 break;
2733 }
2734
2735 case IEEE80211_RADIOTAP_ANTENNA: {
2736 uint8_t antenna;
2737
2738 rc = cpack_uint8(s, &antenna);
2739 if (rc != 0)
2740 goto trunc;
2741 ND_PRINT((ndo, "antenna %u ", antenna));
2742 break;
2743 }
2744
2745 case IEEE80211_RADIOTAP_DB_ANTSIGNAL: {
2746 uint8_t db_antsignal;
2747
2748 rc = cpack_uint8(s, &db_antsignal);
2749 if (rc != 0)
2750 goto trunc;
2751 ND_PRINT((ndo, "%ddB signal ", db_antsignal));
2752 break;
2753 }
2754
2755 case IEEE80211_RADIOTAP_DB_ANTNOISE: {
2756 uint8_t db_antnoise;
2757
2758 rc = cpack_uint8(s, &db_antnoise);
2759 if (rc != 0)
2760 goto trunc;
2761 ND_PRINT((ndo, "%ddB noise ", db_antnoise));
2762 break;
2763 }
2764
2765 case IEEE80211_RADIOTAP_RX_FLAGS: {
2766 uint16_t rx_flags;
2767
2768 rc = cpack_uint16(s, &rx_flags);
2769 if (rc != 0)
2770 goto trunc;
2771 /* Do nothing for now */
2772 break;
2773 }
2774
2775 case IEEE80211_RADIOTAP_XCHANNEL: {
2776 uint32_t flags;
2777 uint16_t frequency;
2778 uint8_t channel;
2779 uint8_t maxpower;
2780
2781 rc = cpack_uint32(s, &flags);
2782 if (rc != 0)
2783 goto trunc;
2784 rc = cpack_uint16(s, &frequency);
2785 if (rc != 0)
2786 goto trunc;
2787 rc = cpack_uint8(s, &channel);
2788 if (rc != 0)
2789 goto trunc;
2790 rc = cpack_uint8(s, &maxpower);
2791 if (rc != 0)
2792 goto trunc;
2793 print_chaninfo(ndo, frequency, flags, presentflags);
2794 break;
2795 }
2796
2797 case IEEE80211_RADIOTAP_MCS: {
2798 uint8_t known;
2799 uint8_t flags;
2800 uint8_t mcs_index;
2801 static const char *ht_bandwidth[4] = {
2802 "20 MHz",
2803 "40 MHz",
2804 "20 MHz (L)",
2805 "20 MHz (U)"
2806 };
2807 float htrate;
2808
2809 rc = cpack_uint8(s, &known);
2810 if (rc != 0)
2811 goto trunc;
2812 rc = cpack_uint8(s, &flags);
2813 if (rc != 0)
2814 goto trunc;
2815 rc = cpack_uint8(s, &mcs_index);
2816 if (rc != 0)
2817 goto trunc;
2818 if (known & IEEE80211_RADIOTAP_MCS_MCS_INDEX_KNOWN) {
2819 /*
2820 * We know the MCS index.
2821 */
2822 if (mcs_index <= MAX_MCS_INDEX) {
2823 /*
2824 * And it's in-range.
2825 */
2826 if (known & (IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN|IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN)) {
2827 /*
2828 * And we know both the bandwidth and
2829 * the guard interval, so we can look
2830 * up the rate.
2831 */
2832 htrate =
2833 ieee80211_float_htrates \
2834 [mcs_index] \
2835 [((flags & IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK) == IEEE80211_RADIOTAP_MCS_BANDWIDTH_40 ? 1 : 0)] \
2836 [((flags & IEEE80211_RADIOTAP_MCS_SHORT_GI) ? 1 : 0)];
2837 } else {
2838 /*
2839 * We don't know both the bandwidth
2840 * and the guard interval, so we can
2841 * only report the MCS index.
2842 */
2843 htrate = 0.0;
2844 }
2845 } else {
2846 /*
2847 * The MCS value is out of range.
2848 */
2849 htrate = 0.0;
2850 }
2851 if (htrate != 0.0) {
2852 /*
2853 * We have the rate.
2854 * Print it.
2855 */
2856 ND_PRINT((ndo, "%.1f Mb/s MCS %u ", htrate, mcs_index));
2857 } else {
2858 /*
2859 * We at least have the MCS index.
2860 * Print it.
2861 */
2862 ND_PRINT((ndo, "MCS %u ", mcs_index));
2863 }
2864 }
2865 if (known & IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN) {
2866 ND_PRINT((ndo, "%s ",
2867 ht_bandwidth[flags & IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK]));
2868 }
2869 if (known & IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN) {
2870 ND_PRINT((ndo, "%s GI ",
2871 (flags & IEEE80211_RADIOTAP_MCS_SHORT_GI) ?
2872 "short" : "long"));
2873 }
2874 if (known & IEEE80211_RADIOTAP_MCS_HT_FORMAT_KNOWN) {
2875 ND_PRINT((ndo, "%s ",
2876 (flags & IEEE80211_RADIOTAP_MCS_HT_GREENFIELD) ?
2877 "greenfield" : "mixed"));
2878 }
2879 if (known & IEEE80211_RADIOTAP_MCS_FEC_TYPE_KNOWN) {
2880 ND_PRINT((ndo, "%s FEC ",
2881 (flags & IEEE80211_RADIOTAP_MCS_FEC_LDPC) ?
2882 "LDPC" : "BCC"));
2883 }
2884 if (known & IEEE80211_RADIOTAP_MCS_STBC_KNOWN) {
2885 ND_PRINT((ndo, "RX-STBC%u ",
2886 (flags & IEEE80211_RADIOTAP_MCS_STBC_MASK) >> IEEE80211_RADIOTAP_MCS_STBC_SHIFT));
2887 }
2888 break;
2889 }
2890
2891 case IEEE80211_RADIOTAP_AMPDU_STATUS: {
2892 uint32_t reference_num;
2893 uint16_t flags;
2894 uint8_t delim_crc;
2895 uint8_t reserved;
2896
2897 rc = cpack_uint32(s, &reference_num);
2898 if (rc != 0)
2899 goto trunc;
2900 rc = cpack_uint16(s, &flags);
2901 if (rc != 0)
2902 goto trunc;
2903 rc = cpack_uint8(s, &delim_crc);
2904 if (rc != 0)
2905 goto trunc;
2906 rc = cpack_uint8(s, &reserved);
2907 if (rc != 0)
2908 goto trunc;
2909 /* Do nothing for now */
2910 break;
2911 }
2912
2913 case IEEE80211_RADIOTAP_VHT: {
2914 uint16_t known;
2915 uint8_t flags;
2916 uint8_t bandwidth;
2917 uint8_t mcs_nss[4];
2918 uint8_t coding;
2919 uint8_t group_id;
2920 uint16_t partial_aid;
2921 static const char *vht_bandwidth[32] = {
2922 "20 MHz",
2923 "40 MHz",
2924 "20 MHz (L)",
2925 "20 MHz (U)",
2926 "80 MHz",
2927 "80 MHz (L)",
2928 "80 MHz (U)",
2929 "80 MHz (LL)",
2930 "80 MHz (LU)",
2931 "80 MHz (UL)",
2932 "80 MHz (UU)",
2933 "160 MHz",
2934 "160 MHz (L)",
2935 "160 MHz (U)",
2936 "160 MHz (LL)",
2937 "160 MHz (LU)",
2938 "160 MHz (UL)",
2939 "160 MHz (UU)",
2940 "160 MHz (LLL)",
2941 "160 MHz (LLU)",
2942 "160 MHz (LUL)",
2943 "160 MHz (UUU)",
2944 "160 MHz (ULL)",
2945 "160 MHz (ULU)",
2946 "160 MHz (UUL)",
2947 "160 MHz (UUU)",
2948 "unknown (26)",
2949 "unknown (27)",
2950 "unknown (28)",
2951 "unknown (29)",
2952 "unknown (30)",
2953 "unknown (31)"
2954 };
2955
2956 rc = cpack_uint16(s, &known);
2957 if (rc != 0)
2958 goto trunc;
2959 rc = cpack_uint8(s, &flags);
2960 if (rc != 0)
2961 goto trunc;
2962 rc = cpack_uint8(s, &bandwidth);
2963 if (rc != 0)
2964 goto trunc;
2965 for (i = 0; i < 4; i++) {
2966 rc = cpack_uint8(s, &mcs_nss[i]);
2967 if (rc != 0)
2968 goto trunc;
2969 }
2970 rc = cpack_uint8(s, &coding);
2971 if (rc != 0)
2972 goto trunc;
2973 rc = cpack_uint8(s, &group_id);
2974 if (rc != 0)
2975 goto trunc;
2976 rc = cpack_uint16(s, &partial_aid);
2977 if (rc != 0)
2978 goto trunc;
2979 for (i = 0; i < 4; i++) {
2980 u_int nss, mcs;
2981 nss = mcs_nss[i] & IEEE80211_RADIOTAP_VHT_NSS_MASK;
2982 mcs = (mcs_nss[i] & IEEE80211_RADIOTAP_VHT_MCS_MASK) >> IEEE80211_RADIOTAP_VHT_MCS_SHIFT;
2983
2984 if (nss == 0)
2985 continue;
2986
2987 ND_PRINT((ndo, "User %u MCS %u ", i, mcs));
2988 ND_PRINT((ndo, "%s FEC ",
2989 (coding & (IEEE80211_RADIOTAP_CODING_LDPC_USERn << i)) ?
2990 "LDPC" : "BCC"));
2991 }
2992 if (known & IEEE80211_RADIOTAP_VHT_BANDWIDTH_KNOWN) {
2993 ND_PRINT((ndo, "%s ",
2994 vht_bandwidth[bandwidth & IEEE80211_RADIOTAP_VHT_BANDWIDTH_MASK]));
2995 }
2996 if (known & IEEE80211_RADIOTAP_VHT_GUARD_INTERVAL_KNOWN) {
2997 ND_PRINT((ndo, "%s GI ",
2998 (flags & IEEE80211_RADIOTAP_VHT_SHORT_GI) ?
2999 "short" : "long"));
3000 }
3001 break;
3002 }
3003
3004 default:
3005 /* this bit indicates a field whose
3006 * size we do not know, so we cannot
3007 * proceed. Just print the bit number.
3008 */
3009 ND_PRINT((ndo, "[bit %u] ", bit));
3010 return -1;
3011 }
3012
3013 return 0;
3014
3015 trunc:
3016 ND_PRINT((ndo, "%s", tstr));
3017 return rc;
3018 }
3019
3020
3021 static int
3022 print_in_radiotap_namespace(netdissect_options *ndo,
3023 struct cpack_state *s, uint8_t *flags,
3024 uint32_t presentflags, int bit0)
3025 {
3026 #define BITNO_32(x) (((x) >> 16) ? 16 + BITNO_16((x) >> 16) : BITNO_16((x)))
3027 #define BITNO_16(x) (((x) >> 8) ? 8 + BITNO_8((x) >> 8) : BITNO_8((x)))
3028 #define BITNO_8(x) (((x) >> 4) ? 4 + BITNO_4((x) >> 4) : BITNO_4((x)))
3029 #define BITNO_4(x) (((x) >> 2) ? 2 + BITNO_2((x) >> 2) : BITNO_2((x)))
3030 #define BITNO_2(x) (((x) & 2) ? 1 : 0)
3031 uint32_t present, next_present;
3032 int bitno;
3033 enum ieee80211_radiotap_type bit;
3034 int rc;
3035
3036 for (present = presentflags; present; present = next_present) {
3037 /*
3038 * Clear the least significant bit that is set.
3039 */
3040 next_present = present & (present - 1);
3041
3042 /*
3043 * Get the bit number, within this presence word,
3044 * of the remaining least significant bit that
3045 * is set.
3046 */
3047 bitno = BITNO_32(present ^ next_present);
3048
3049 /*
3050 * Stop if this is one of the "same meaning
3051 * in all presence flags" bits.
3052 */
3053 if (bitno >= IEEE80211_RADIOTAP_NAMESPACE)
3054 break;
3055
3056 /*
3057 * Get the radiotap bit number of that bit.
3058 */
3059 bit = (enum ieee80211_radiotap_type)(bit0 + bitno);
3060
3061 rc = print_radiotap_field(ndo, s, bit, flags, presentflags);
3062 if (rc != 0)
3063 return rc;
3064 }
3065
3066 return 0;
3067 }
3068
3069 static u_int
3070 ieee802_11_radio_print(netdissect_options *ndo,
3071 const u_char *p, u_int length, u_int caplen)
3072 {
3073 #define BIT(n) (1U << n)
3074 #define IS_EXTENDED(__p) \
3075 (EXTRACT_LE_U_4(__p) & BIT(IEEE80211_RADIOTAP_EXT)) != 0
3076
3077 struct cpack_state cpacker;
3078 const struct ieee80211_radiotap_header *hdr;
3079 uint32_t presentflags;
3080 const uint32_t *presentp, *last_presentp;
3081 int vendor_namespace;
3082 uint8_t vendor_oui[3];
3083 uint8_t vendor_subnamespace;
3084 uint16_t skip_length;
3085 int bit0;
3086 u_int len;
3087 uint8_t flags;
3088 int pad;
3089 u_int fcslen;
3090
3091 if (caplen < sizeof(*hdr)) {
3092 ND_PRINT((ndo, "%s", tstr));
3093 return caplen;
3094 }
3095
3096 hdr = (const struct ieee80211_radiotap_header *)p;
3097
3098 len = EXTRACT_LE_U_2(&hdr->it_len);
3099
3100 /*
3101 * If we don't have the entire radiotap header, just give up.
3102 */
3103 if (caplen < len) {
3104 ND_PRINT((ndo, "%s", tstr));
3105 return caplen;
3106 }
3107 cpack_init(&cpacker, (const uint8_t *)hdr, len); /* align against header start */
3108 cpack_advance(&cpacker, sizeof(*hdr)); /* includes the 1st bitmap */
3109 for (last_presentp = &hdr->it_present;
3110 (const u_char*)(last_presentp + 1) <= p + len &&
3111 IS_EXTENDED(last_presentp);
3112 last_presentp++)
3113 cpack_advance(&cpacker, sizeof(hdr->it_present)); /* more bitmaps */
3114
3115 /* are there more bitmap extensions than bytes in header? */
3116 if ((const u_char*)(last_presentp + 1) > p + len) {
3117 ND_PRINT((ndo, "%s", tstr));
3118 return caplen;
3119 }
3120
3121 /*
3122 * Start out at the beginning of the default radiotap namespace.
3123 */
3124 bit0 = 0;
3125 vendor_namespace = 0;
3126 memset(vendor_oui, 0, 3);
3127 vendor_subnamespace = 0;
3128 skip_length = 0;
3129 /* Assume no flags */
3130 flags = 0;
3131 /* Assume no Atheros padding between 802.11 header and body */
3132 pad = 0;
3133 /* Assume no FCS at end of frame */
3134 fcslen = 0;
3135 for (presentp = &hdr->it_present; presentp <= last_presentp;
3136 presentp++) {
3137 presentflags = EXTRACT_LE_U_4(presentp);
3138
3139 /*
3140 * If this is a vendor namespace, we don't handle it.
3141 */
3142 if (vendor_namespace) {
3143 /*
3144 * Skip past the stuff we don't understand.
3145 * If we add support for any vendor namespaces,
3146 * it'd be added here; use vendor_oui and
3147 * vendor_subnamespace to interpret the fields.
3148 */
3149 if (cpack_advance(&cpacker, skip_length) != 0) {
3150 /*
3151 * Ran out of space in the packet.
3152 */
3153 break;
3154 }
3155
3156 /*
3157 * We've skipped it all; nothing more to
3158 * skip.
3159 */
3160 skip_length = 0;
3161 } else {
3162 if (print_in_radiotap_namespace(ndo, &cpacker,
3163 &flags, presentflags, bit0) != 0) {
3164 /*
3165 * Fatal error - can't process anything
3166 * more in the radiotap header.
3167 */
3168 break;
3169 }
3170 }
3171
3172 /*
3173 * Handle the namespace switch bits; we've already handled
3174 * the extension bit in all but the last word above.
3175 */
3176 switch (presentflags &
3177 (BIT(IEEE80211_RADIOTAP_NAMESPACE)|BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE))) {
3178
3179 case 0:
3180 /*
3181 * We're not changing namespaces.
3182 * advance to the next 32 bits in the current
3183 * namespace.
3184 */
3185 bit0 += 32;
3186 break;
3187
3188 case BIT(IEEE80211_RADIOTAP_NAMESPACE):
3189 /*
3190 * We're switching to the radiotap namespace.
3191 * Reset the presence-bitmap index to 0, and
3192 * reset the namespace to the default radiotap
3193 * namespace.
3194 */
3195 bit0 = 0;
3196 vendor_namespace = 0;
3197 memset(vendor_oui, 0, 3);
3198 vendor_subnamespace = 0;
3199 skip_length = 0;
3200 break;
3201
3202 case BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE):
3203 /*
3204 * We're switching to a vendor namespace.
3205 * Reset the presence-bitmap index to 0,
3206 * note that we're in a vendor namespace,
3207 * and fetch the fields of the Vendor Namespace
3208 * item.
3209 */
3210 bit0 = 0;
3211 vendor_namespace = 1;
3212 if ((cpack_align_and_reserve(&cpacker, 2)) == NULL) {
3213 ND_PRINT((ndo, "%s", tstr));
3214 break;
3215 }
3216 if (cpack_uint8(&cpacker, &vendor_oui[0]) != 0) {
3217 ND_PRINT((ndo, "%s", tstr));
3218 break;
3219 }
3220 if (cpack_uint8(&cpacker, &vendor_oui[1]) != 0) {
3221 ND_PRINT((ndo, "%s", tstr));
3222 break;
3223 }
3224 if (cpack_uint8(&cpacker, &vendor_oui[2]) != 0) {
3225 ND_PRINT((ndo, "%s", tstr));
3226 break;
3227 }
3228 if (cpack_uint8(&cpacker, &vendor_subnamespace) != 0) {
3229 ND_PRINT((ndo, "%s", tstr));
3230 break;
3231 }
3232 if (cpack_uint16(&cpacker, &skip_length) != 0) {
3233 ND_PRINT((ndo, "%s", tstr));
3234 break;
3235 }
3236 break;
3237
3238 default:
3239 /*
3240 * Illegal combination. The behavior in this
3241 * case is undefined by the radiotap spec; we
3242 * just ignore both bits.
3243 */
3244 break;
3245 }
3246 }
3247
3248 if (flags & IEEE80211_RADIOTAP_F_DATAPAD)
3249 pad = 1; /* Atheros padding */
3250 if (flags & IEEE80211_RADIOTAP_F_FCS)
3251 fcslen = 4; /* FCS at end of packet */
3252 return len + ieee802_11_print(ndo, p + len, length - len, caplen - len, pad,
3253 fcslen);
3254 #undef BITNO_32
3255 #undef BITNO_16
3256 #undef BITNO_8
3257 #undef BITNO_4
3258 #undef BITNO_2
3259 #undef BIT
3260 }
3261
3262 static u_int
3263 ieee802_11_avs_radio_print(netdissect_options *ndo,
3264 const u_char *p, u_int length, u_int caplen)
3265 {
3266 uint32_t caphdr_len;
3267
3268 if (caplen < 8) {
3269 ND_PRINT((ndo, "%s", tstr));
3270 return caplen;
3271 }
3272
3273 caphdr_len = EXTRACT_BE_U_4(p + 4);
3274 if (caphdr_len < 8) {
3275 /*
3276 * Yow! The capture header length is claimed not
3277 * to be large enough to include even the version
3278 * cookie or capture header length!
3279 */
3280 ND_PRINT((ndo, "%s", tstr));
3281 return caplen;
3282 }
3283
3284 if (caplen < caphdr_len) {
3285 ND_PRINT((ndo, "%s", tstr));
3286 return caplen;
3287 }
3288
3289 return caphdr_len + ieee802_11_print(ndo, p + caphdr_len,
3290 length - caphdr_len, caplen - caphdr_len, 0, 0);
3291 }
3292
3293 #define PRISM_HDR_LEN 144
3294
3295 #define WLANCAP_MAGIC_COOKIE_BASE 0x80211000
3296 #define WLANCAP_MAGIC_COOKIE_V1 0x80211001
3297 #define WLANCAP_MAGIC_COOKIE_V2 0x80211002
3298
3299 /*
3300 * For DLT_PRISM_HEADER; like DLT_IEEE802_11, but with an extra header,
3301 * containing information such as radio information, which we
3302 * currently ignore.
3303 *
3304 * If, however, the packet begins with WLANCAP_MAGIC_COOKIE_V1 or
3305 * WLANCAP_MAGIC_COOKIE_V2, it's really DLT_IEEE802_11_RADIO_AVS
3306 * (currently, on Linux, there's no ARPHRD_ type for
3307 * DLT_IEEE802_11_RADIO_AVS, as there is a ARPHRD_IEEE80211_PRISM
3308 * for DLT_PRISM_HEADER, so ARPHRD_IEEE80211_PRISM is used for
3309 * the AVS header, and the first 4 bytes of the header are used to
3310 * indicate whether it's a Prism header or an AVS header).
3311 */
3312 u_int
3313 prism_if_print(netdissect_options *ndo,
3314 const struct pcap_pkthdr *h, const u_char *p)
3315 {
3316 u_int caplen = h->caplen;
3317 u_int length = h->len;
3318 uint32_t msgcode;
3319
3320 if (caplen < 4) {
3321 ND_PRINT((ndo, "%s", tstr));
3322 return caplen;
3323 }
3324
3325 msgcode = EXTRACT_BE_U_4(p);
3326 if (msgcode == WLANCAP_MAGIC_COOKIE_V1 ||
3327 msgcode == WLANCAP_MAGIC_COOKIE_V2)
3328 return ieee802_11_avs_radio_print(ndo, p, length, caplen);
3329
3330 if (caplen < PRISM_HDR_LEN) {
3331 ND_PRINT((ndo, "%s", tstr));
3332 return caplen;
3333 }
3334
3335 return PRISM_HDR_LEN + ieee802_11_print(ndo, p + PRISM_HDR_LEN,
3336 length - PRISM_HDR_LEN, caplen - PRISM_HDR_LEN, 0, 0);
3337 }
3338
3339 /*
3340 * For DLT_IEEE802_11_RADIO; like DLT_IEEE802_11, but with an extra
3341 * header, containing information such as radio information.
3342 */
3343 u_int
3344 ieee802_11_radio_if_print(netdissect_options *ndo,
3345 const struct pcap_pkthdr *h, const u_char *p)
3346 {
3347 return ieee802_11_radio_print(ndo, p, h->len, h->caplen);
3348 }
3349
3350 /*
3351 * For DLT_IEEE802_11_RADIO_AVS; like DLT_IEEE802_11, but with an
3352 * extra header, containing information such as radio information,
3353 * which we currently ignore.
3354 */
3355 u_int
3356 ieee802_11_radio_avs_if_print(netdissect_options *ndo,
3357 const struct pcap_pkthdr *h, const u_char *p)
3358 {
3359 return ieee802_11_avs_radio_print(ndo, p, h->len, h->caplen);
3360 }
[mirror] the TCPdump network dissector