]> The Tcpdump Group git mirrors - tcpdump/blob - print-802_11.c
projects / tcpdump / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
NDOize OSPFv3 decoder
[tcpdump] / print-802_11.c
1 /*
2 * Copyright (c) 2001
3 * Fortress Technologies, Inc. All rights reserved.
4 * Charlie Lenahan (clenahan@fortresstech.com)
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22
23 #ifdef HAVE_CONFIG_H
24 #include "config.h"
25 #endif
26
27 #include <tcpdump-stdinc.h>
28
29 #include <stdio.h>
30 #include <string.h>
31
32 #include "interface.h"
33 #include "addrtoname.h"
34 #include "ethertype.h"
35
36 #include "extract.h"
37
38 #include "cpack.h"
39
40
41 /* Lengths of 802.11 header components. */
42 #define IEEE802_11_FC_LEN 2
43 #define IEEE802_11_DUR_LEN 2
44 #define IEEE802_11_DA_LEN 6
45 #define IEEE802_11_SA_LEN 6
46 #define IEEE802_11_BSSID_LEN 6
47 #define IEEE802_11_RA_LEN 6
48 #define IEEE802_11_TA_LEN 6
49 #define IEEE802_11_SEQ_LEN 2
50 #define IEEE802_11_CTL_LEN 2
51 #define IEEE802_11_IV_LEN 3
52 #define IEEE802_11_KID_LEN 1
53
54 /* Frame check sequence length. */
55 #define IEEE802_11_FCS_LEN 4
56
57 /* Lengths of beacon components. */
58 #define IEEE802_11_TSTAMP_LEN 8
59 #define IEEE802_11_BCNINT_LEN 2
60 #define IEEE802_11_CAPINFO_LEN 2
61 #define IEEE802_11_LISTENINT_LEN 2
62
63 #define IEEE802_11_AID_LEN 2
64 #define IEEE802_11_STATUS_LEN 2
65 #define IEEE802_11_REASON_LEN 2
66
67 /* Length of previous AP in reassocation frame */
68 #define IEEE802_11_AP_LEN 6
69
70 #define T_MGMT 0x0 /* management */
71 #define T_CTRL 0x1 /* control */
72 #define T_DATA 0x2 /* data */
73 #define T_RESV 0x3 /* reserved */
74
75 #define ST_ASSOC_REQUEST 0x0
76 #define ST_ASSOC_RESPONSE 0x1
77 #define ST_REASSOC_REQUEST 0x2
78 #define ST_REASSOC_RESPONSE 0x3
79 #define ST_PROBE_REQUEST 0x4
80 #define ST_PROBE_RESPONSE 0x5
81 /* RESERVED 0x6 */
82 /* RESERVED 0x7 */
83 #define ST_BEACON 0x8
84 #define ST_ATIM 0x9
85 #define ST_DISASSOC 0xA
86 #define ST_AUTH 0xB
87 #define ST_DEAUTH 0xC
88 #define ST_ACTION 0xD
89 /* RESERVED 0xE */
90 /* RESERVED 0xF */
91
92
93 #define CTRL_CONTROL_WRAPPER 0x7
94 #define CTRL_BAR 0x8
95 #define CTRL_BA 0x9
96 #define CTRL_PS_POLL 0xA
97 #define CTRL_RTS 0xB
98 #define CTRL_CTS 0xC
99 #define CTRL_ACK 0xD
100 #define CTRL_CF_END 0xE
101 #define CTRL_END_ACK 0xF
102
103 #define DATA_DATA 0x0
104 #define DATA_DATA_CF_ACK 0x1
105 #define DATA_DATA_CF_POLL 0x2
106 #define DATA_DATA_CF_ACK_POLL 0x3
107 #define DATA_NODATA 0x4
108 #define DATA_NODATA_CF_ACK 0x5
109 #define DATA_NODATA_CF_POLL 0x6
110 #define DATA_NODATA_CF_ACK_POLL 0x7
111
112 #define DATA_QOS_DATA 0x8
113 #define DATA_QOS_DATA_CF_ACK 0x9
114 #define DATA_QOS_DATA_CF_POLL 0xA
115 #define DATA_QOS_DATA_CF_ACK_POLL 0xB
116 #define DATA_QOS_NODATA 0xC
117 #define DATA_QOS_CF_POLL_NODATA 0xE
118 #define DATA_QOS_CF_ACK_POLL_NODATA 0xF
119
120 /*
121 * The subtype field of a data frame is, in effect, composed of 4 flag
122 * bits - CF-Ack, CF-Poll, Null (means the frame doesn't actually have
123 * any data), and QoS.
124 */
125 #define DATA_FRAME_IS_CF_ACK(x) ((x) & 0x01)
126 #define DATA_FRAME_IS_CF_POLL(x) ((x) & 0x02)
127 #define DATA_FRAME_IS_NULL(x) ((x) & 0x04)
128 #define DATA_FRAME_IS_QOS(x) ((x) & 0x08)
129
130 /*
131 * Bits in the frame control field.
132 */
133 #define FC_VERSION(fc) ((fc) & 0x3)
134 #define FC_TYPE(fc) (((fc) >> 2) & 0x3)
135 #define FC_SUBTYPE(fc) (((fc) >> 4) & 0xF)
136 #define FC_TO_DS(fc) ((fc) & 0x0100)
137 #define FC_FROM_DS(fc) ((fc) & 0x0200)
138 #define FC_MORE_FLAG(fc) ((fc) & 0x0400)
139 #define FC_RETRY(fc) ((fc) & 0x0800)
140 #define FC_POWER_MGMT(fc) ((fc) & 0x1000)
141 #define FC_MORE_DATA(fc) ((fc) & 0x2000)
142 #define FC_WEP(fc) ((fc) & 0x4000)
143 #define FC_ORDER(fc) ((fc) & 0x8000)
144
145 struct mgmt_header_t {
146 u_int16_t fc;
147 u_int16_t duration;
148 u_int8_t da[6];
149 u_int8_t sa[6];
150 u_int8_t bssid[6];
151 u_int16_t seq_ctrl;
152 };
153
154 #define MGMT_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
155 IEEE802_11_DA_LEN+IEEE802_11_SA_LEN+\
156 IEEE802_11_BSSID_LEN+IEEE802_11_SEQ_LEN)
157
158 #define CAPABILITY_ESS(cap) ((cap) & 0x0001)
159 #define CAPABILITY_IBSS(cap) ((cap) & 0x0002)
160 #define CAPABILITY_CFP(cap) ((cap) & 0x0004)
161 #define CAPABILITY_CFP_REQ(cap) ((cap) & 0x0008)
162 #define CAPABILITY_PRIVACY(cap) ((cap) & 0x0010)
163
164 struct ssid_t {
165 u_int8_t element_id;
166 u_int8_t length;
167 u_char ssid[33]; /* 32 + 1 for null */
168 };
169
170 struct rates_t {
171 u_int8_t element_id;
172 u_int8_t length;
173 u_int8_t rate[16];
174 };
175
176 struct challenge_t {
177 u_int8_t element_id;
178 u_int8_t length;
179 u_int8_t text[254]; /* 1-253 + 1 for null */
180 };
181
182 struct fh_t {
183 u_int8_t element_id;
184 u_int8_t length;
185 u_int16_t dwell_time;
186 u_int8_t hop_set;
187 u_int8_t hop_pattern;
188 u_int8_t hop_index;
189 };
190
191 struct ds_t {
192 u_int8_t element_id;
193 u_int8_t length;
194 u_int8_t channel;
195 };
196
197 struct cf_t {
198 u_int8_t element_id;
199 u_int8_t length;
200 u_int8_t count;
201 u_int8_t period;
202 u_int16_t max_duration;
203 u_int16_t dur_remaing;
204 };
205
206 struct tim_t {
207 u_int8_t element_id;
208 u_int8_t length;
209 u_int8_t count;
210 u_int8_t period;
211 u_int8_t bitmap_control;
212 u_int8_t bitmap[251];
213 };
214
215 #define E_SSID 0
216 #define E_RATES 1
217 #define E_FH 2
218 #define E_DS 3
219 #define E_CF 4
220 #define E_TIM 5
221 #define E_IBSS 6
222 /* reserved 7 */
223 /* reserved 8 */
224 /* reserved 9 */
225 /* reserved 10 */
226 /* reserved 11 */
227 /* reserved 12 */
228 /* reserved 13 */
229 /* reserved 14 */
230 /* reserved 15 */
231 /* reserved 16 */
232
233 #define E_CHALLENGE 16
234 /* reserved 17 */
235 /* reserved 18 */
236 /* reserved 19 */
237 /* reserved 16 */
238 /* reserved 16 */
239
240
241 struct mgmt_body_t {
242 u_int8_t timestamp[IEEE802_11_TSTAMP_LEN];
243 u_int16_t beacon_interval;
244 u_int16_t listen_interval;
245 u_int16_t status_code;
246 u_int16_t aid;
247 u_char ap[IEEE802_11_AP_LEN];
248 u_int16_t reason_code;
249 u_int16_t auth_alg;
250 u_int16_t auth_trans_seq_num;
251 int challenge_present;
252 struct challenge_t challenge;
253 u_int16_t capability_info;
254 int ssid_present;
255 struct ssid_t ssid;
256 int rates_present;
257 struct rates_t rates;
258 int ds_present;
259 struct ds_t ds;
260 int cf_present;
261 struct cf_t cf;
262 int fh_present;
263 struct fh_t fh;
264 int tim_present;
265 struct tim_t tim;
266 };
267
268 struct ctrl_rts_t {
269 u_int16_t fc;
270 u_int16_t duration;
271 u_int8_t ra[6];
272 u_int8_t ta[6];
273 u_int8_t fcs[4];
274 };
275
276 #define CTRL_RTS_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
277 IEEE802_11_RA_LEN+IEEE802_11_TA_LEN)
278
279 struct ctrl_cts_t {
280 u_int16_t fc;
281 u_int16_t duration;
282 u_int8_t ra[6];
283 u_int8_t fcs[4];
284 };
285
286 #define CTRL_CTS_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
287
288 struct ctrl_ack_t {
289 u_int16_t fc;
290 u_int16_t duration;
291 u_int8_t ra[6];
292 u_int8_t fcs[4];
293 };
294
295 #define CTRL_ACK_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
296
297 struct ctrl_ps_poll_t {
298 u_int16_t fc;
299 u_int16_t aid;
300 u_int8_t bssid[6];
301 u_int8_t ta[6];
302 u_int8_t fcs[4];
303 };
304
305 #define CTRL_PS_POLL_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_AID_LEN+\
306 IEEE802_11_BSSID_LEN+IEEE802_11_TA_LEN)
307
308 struct ctrl_end_t {
309 u_int16_t fc;
310 u_int16_t duration;
311 u_int8_t ra[6];
312 u_int8_t bssid[6];
313 u_int8_t fcs[4];
314 };
315
316 #define CTRL_END_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
317 IEEE802_11_RA_LEN+IEEE802_11_BSSID_LEN)
318
319 struct ctrl_end_ack_t {
320 u_int16_t fc;
321 u_int16_t duration;
322 u_int8_t ra[6];
323 u_int8_t bssid[6];
324 u_int8_t fcs[4];
325 };
326
327 #define CTRL_END_ACK_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
328 IEEE802_11_RA_LEN+IEEE802_11_BSSID_LEN)
329
330 struct ctrl_ba_t {
331 u_int16_t fc;
332 u_int16_t duration;
333 u_int8_t ra[6];
334 u_int8_t fcs[4];
335 };
336
337 #define CTRL_BA_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
338
339 struct ctrl_bar_t {
340 u_int16_t fc;
341 u_int16_t dur;
342 u_int8_t ra[6];
343 u_int8_t ta[6];
344 u_int16_t ctl;
345 u_int16_t seq;
346 u_int8_t fcs[4];
347 };
348
349 #define CTRL_BAR_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
350 IEEE802_11_RA_LEN+IEEE802_11_TA_LEN+\
351 IEEE802_11_CTL_LEN+IEEE802_11_SEQ_LEN)
352
353 struct meshcntl_t {
354 u_int8_t flags;
355 u_int8_t ttl;
356 u_int8_t seq[4];
357 u_int8_t addr4[6];
358 u_int8_t addr5[6];
359 u_int8_t addr6[6];
360 };
361
362 #define IV_IV(iv) ((iv) & 0xFFFFFF)
363 #define IV_PAD(iv) (((iv) >> 24) & 0x3F)
364 #define IV_KEYID(iv) (((iv) >> 30) & 0x03)
365
366 /* $FreeBSD: src/sys/net80211/ieee80211_radiotap.h,v 1.5 2005/01/22 20:12:05 sam Exp $ */
367 /* NetBSD: ieee802_11_radio.h,v 1.2 2006/02/26 03:04:03 dyoung Exp */
368
369 /*-
370 * Copyright (c) 2003, 2004 David Young. All rights reserved.
371 *
372 * Redistribution and use in source and binary forms, with or without
373 * modification, are permitted provided that the following conditions
374 * are met:
375 * 1. Redistributions of source code must retain the above copyright
376 * notice, this list of conditions and the following disclaimer.
377 * 2. Redistributions in binary form must reproduce the above copyright
378 * notice, this list of conditions and the following disclaimer in the
379 * documentation and/or other materials provided with the distribution.
380 * 3. The name of David Young may not be used to endorse or promote
381 * products derived from this software without specific prior
382 * written permission.
383 *
384 * THIS SOFTWARE IS PROVIDED BY DAVID YOUNG ``AS IS'' AND ANY
385 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
386 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
387 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID
388 * YOUNG BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
389 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
390 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
391 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
392 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
393 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
394 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
395 * OF SUCH DAMAGE.
396 */
397
398 /* A generic radio capture format is desirable. It must be
399 * rigidly defined (e.g., units for fields should be given),
400 * and easily extensible.
401 *
402 * The following is an extensible radio capture format. It is
403 * based on a bitmap indicating which fields are present.
404 *
405 * I am trying to describe precisely what the application programmer
406 * should expect in the following, and for that reason I tell the
407 * units and origin of each measurement (where it applies), or else I
408 * use sufficiently weaselly language ("is a monotonically nondecreasing
409 * function of...") that I cannot set false expectations for lawyerly
410 * readers.
411 */
412
413 /*
414 * The radio capture header precedes the 802.11 header.
415 *
416 * Note well: all radiotap fields are little-endian.
417 */
418 struct ieee80211_radiotap_header {
419 u_int8_t it_version; /* Version 0. Only increases
420 * for drastic changes,
421 * introduction of compatible
422 * new fields does not count.
423 */
424 u_int8_t it_pad;
425 u_int16_t it_len; /* length of the whole
426 * header in bytes, including
427 * it_version, it_pad,
428 * it_len, and data fields.
429 */
430 u_int32_t it_present; /* A bitmap telling which
431 * fields are present. Set bit 31
432 * (0x80000000) to extend the
433 * bitmap by another 32 bits.
434 * Additional extensions are made
435 * by setting bit 31.
436 */
437 };
438
439 /* Name Data type Units
440 * ---- --------- -----
441 *
442 * IEEE80211_RADIOTAP_TSFT u_int64_t microseconds
443 *
444 * Value in microseconds of the MAC's 64-bit 802.11 Time
445 * Synchronization Function timer when the first bit of the
446 * MPDU arrived at the MAC. For received frames, only.
447 *
448 * IEEE80211_RADIOTAP_CHANNEL 2 x u_int16_t MHz, bitmap
449 *
450 * Tx/Rx frequency in MHz, followed by flags (see below).
451 * Note that IEEE80211_RADIOTAP_XCHANNEL must be used to
452 * represent an HT channel as there is not enough room in
453 * the flags word.
454 *
455 * IEEE80211_RADIOTAP_FHSS u_int16_t see below
456 *
457 * For frequency-hopping radios, the hop set (first byte)
458 * and pattern (second byte).
459 *
460 * IEEE80211_RADIOTAP_RATE u_int8_t 500kb/s or index
461 *
462 * Tx/Rx data rate. If bit 0x80 is set then it represents an
463 * an MCS index and not an IEEE rate.
464 *
465 * IEEE80211_RADIOTAP_DBM_ANTSIGNAL int8_t decibels from
466 * one milliwatt (dBm)
467 *
468 * RF signal power at the antenna, decibel difference from
469 * one milliwatt.
470 *
471 * IEEE80211_RADIOTAP_DBM_ANTNOISE int8_t decibels from
472 * one milliwatt (dBm)
473 *
474 * RF noise power at the antenna, decibel difference from one
475 * milliwatt.
476 *
477 * IEEE80211_RADIOTAP_DB_ANTSIGNAL u_int8_t decibel (dB)
478 *
479 * RF signal power at the antenna, decibel difference from an
480 * arbitrary, fixed reference.
481 *
482 * IEEE80211_RADIOTAP_DB_ANTNOISE u_int8_t decibel (dB)
483 *
484 * RF noise power at the antenna, decibel difference from an
485 * arbitrary, fixed reference point.
486 *
487 * IEEE80211_RADIOTAP_LOCK_QUALITY u_int16_t unitless
488 *
489 * Quality of Barker code lock. Unitless. Monotonically
490 * nondecreasing with "better" lock strength. Called "Signal
491 * Quality" in datasheets. (Is there a standard way to measure
492 * this?)
493 *
494 * IEEE80211_RADIOTAP_TX_ATTENUATION u_int16_t unitless
495 *
496 * Transmit power expressed as unitless distance from max
497 * power set at factory calibration. 0 is max power.
498 * Monotonically nondecreasing with lower power levels.
499 *
500 * IEEE80211_RADIOTAP_DB_TX_ATTENUATION u_int16_t decibels (dB)
501 *
502 * Transmit power expressed as decibel distance from max power
503 * set at factory calibration. 0 is max power. Monotonically
504 * nondecreasing with lower power levels.
505 *
506 * IEEE80211_RADIOTAP_DBM_TX_POWER int8_t decibels from
507 * one milliwatt (dBm)
508 *
509 * Transmit power expressed as dBm (decibels from a 1 milliwatt
510 * reference). This is the absolute power level measured at
511 * the antenna port.
512 *
513 * IEEE80211_RADIOTAP_FLAGS u_int8_t bitmap
514 *
515 * Properties of transmitted and received frames. See flags
516 * defined below.
517 *
518 * IEEE80211_RADIOTAP_ANTENNA u_int8_t antenna index
519 *
520 * Unitless indication of the Rx/Tx antenna for this packet.
521 * The first antenna is antenna 0.
522 *
523 * IEEE80211_RADIOTAP_RX_FLAGS u_int16_t bitmap
524 *
525 * Properties of received frames. See flags defined below.
526 *
527 * IEEE80211_RADIOTAP_XCHANNEL u_int32_t bitmap
528 * u_int16_t MHz
529 * u_int8_t channel number
530 * u_int8_t .5 dBm
531 *
532 * Extended channel specification: flags (see below) followed by
533 * frequency in MHz, the corresponding IEEE channel number, and
534 * finally the maximum regulatory transmit power cap in .5 dBm
535 * units. This property supersedes IEEE80211_RADIOTAP_CHANNEL
536 * and only one of the two should be present.
537 *
538 * IEEE80211_RADIOTAP_MCS u_int8_t known
539 * u_int8_t flags
540 * u_int8_t mcs
541 *
542 * Bitset indicating which fields have known values, followed
543 * by bitset of flag values, followed by the MCS rate index as
544 * in IEEE 802.11n.
545 *
546 * IEEE80211_RADIOTAP_VENDOR_NAMESPACE
547 * u_int8_t OUI[3]
548 * u_int8_t subspace
549 * u_int16_t length
550 *
551 * The Vendor Namespace Field contains three sub-fields. The first
552 * sub-field is 3 bytes long. It contains the vendor's IEEE 802
553 * Organizationally Unique Identifier (OUI). The fourth byte is a
554 * vendor-specific "namespace selector."
555 *
556 */
557 enum ieee80211_radiotap_type {
558 IEEE80211_RADIOTAP_TSFT = 0,
559 IEEE80211_RADIOTAP_FLAGS = 1,
560 IEEE80211_RADIOTAP_RATE = 2,
561 IEEE80211_RADIOTAP_CHANNEL = 3,
562 IEEE80211_RADIOTAP_FHSS = 4,
563 IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
564 IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
565 IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
566 IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
567 IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
568 IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
569 IEEE80211_RADIOTAP_ANTENNA = 11,
570 IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
571 IEEE80211_RADIOTAP_DB_ANTNOISE = 13,
572 IEEE80211_RADIOTAP_RX_FLAGS = 14,
573 /* NB: gap for netbsd definitions */
574 IEEE80211_RADIOTAP_XCHANNEL = 18,
575 IEEE80211_RADIOTAP_MCS = 19,
576 IEEE80211_RADIOTAP_NAMESPACE = 29,
577 IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30,
578 IEEE80211_RADIOTAP_EXT = 31
579 };
580
581 /* channel attributes */
582 #define IEEE80211_CHAN_TURBO 0x00010 /* Turbo channel */
583 #define IEEE80211_CHAN_CCK 0x00020 /* CCK channel */
584 #define IEEE80211_CHAN_OFDM 0x00040 /* OFDM channel */
585 #define IEEE80211_CHAN_2GHZ 0x00080 /* 2 GHz spectrum channel. */
586 #define IEEE80211_CHAN_5GHZ 0x00100 /* 5 GHz spectrum channel */
587 #define IEEE80211_CHAN_PASSIVE 0x00200 /* Only passive scan allowed */
588 #define IEEE80211_CHAN_DYN 0x00400 /* Dynamic CCK-OFDM channel */
589 #define IEEE80211_CHAN_GFSK 0x00800 /* GFSK channel (FHSS PHY) */
590 #define IEEE80211_CHAN_GSM 0x01000 /* 900 MHz spectrum channel */
591 #define IEEE80211_CHAN_STURBO 0x02000 /* 11a static turbo channel only */
592 #define IEEE80211_CHAN_HALF 0x04000 /* Half rate channel */
593 #define IEEE80211_CHAN_QUARTER 0x08000 /* Quarter rate channel */
594 #define IEEE80211_CHAN_HT20 0x10000 /* HT 20 channel */
595 #define IEEE80211_CHAN_HT40U 0x20000 /* HT 40 channel w/ ext above */
596 #define IEEE80211_CHAN_HT40D 0x40000 /* HT 40 channel w/ ext below */
597
598 /* Useful combinations of channel characteristics, borrowed from Ethereal */
599 #define IEEE80211_CHAN_A \
600 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
601 #define IEEE80211_CHAN_B \
602 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
603 #define IEEE80211_CHAN_G \
604 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
605 #define IEEE80211_CHAN_TA \
606 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM | IEEE80211_CHAN_TURBO)
607 #define IEEE80211_CHAN_TG \
608 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN | IEEE80211_CHAN_TURBO)
609
610
611 /* For IEEE80211_RADIOTAP_FLAGS */
612 #define IEEE80211_RADIOTAP_F_CFP 0x01 /* sent/received
613 * during CFP
614 */
615 #define IEEE80211_RADIOTAP_F_SHORTPRE 0x02 /* sent/received
616 * with short
617 * preamble
618 */
619 #define IEEE80211_RADIOTAP_F_WEP 0x04 /* sent/received
620 * with WEP encryption
621 */
622 #define IEEE80211_RADIOTAP_F_FRAG 0x08 /* sent/received
623 * with fragmentation
624 */
625 #define IEEE80211_RADIOTAP_F_FCS 0x10 /* frame includes FCS */
626 #define IEEE80211_RADIOTAP_F_DATAPAD 0x20 /* frame has padding between
627 * 802.11 header and payload
628 * (to 32-bit boundary)
629 */
630 #define IEEE80211_RADIOTAP_F_BADFCS 0x40 /* does not pass FCS check */
631
632 /* For IEEE80211_RADIOTAP_RX_FLAGS */
633 #define IEEE80211_RADIOTAP_F_RX_BADFCS 0x0001 /* frame failed crc check */
634 #define IEEE80211_RADIOTAP_F_RX_PLCP_CRC 0x0002 /* frame failed PLCP CRC check */
635
636 /* For IEEE80211_RADIOTAP_MCS known */
637 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN 0x01
638 #define IEEE80211_RADIOTAP_MCS_MCS_INDEX_KNOWN 0x02 /* MCS index field */
639 #define IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN 0x04
640 #define IEEE80211_RADIOTAP_MCS_HT_FORMAT_KNOWN 0x08
641 #define IEEE80211_RADIOTAP_MCS_FEC_TYPE_KNOWN 0x10
642 #define IEEE80211_RADIOTAP_MCS_STBC_KNOWN 0x20
643
644 /* For IEEE80211_RADIOTAP_MCS flags */
645 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK 0x03
646 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20 0
647 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_40 1
648 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20L 2
649 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20U 3
650 #define IEEE80211_RADIOTAP_MCS_SHORT_GI 0x04 /* short guard interval */
651 #define IEEE80211_RADIOTAP_MCS_HT_GREENFIELD 0x08
652 #define IEEE80211_RADIOTAP_MCS_FEC_LDPC 0x10
653 #define IEEE80211_RADIOTAP_MCS_STBC_MASK 0x60
654 #define IEEE80211_RADIOTAP_MCS_STBC_1 1
655 #define IEEE80211_RADIOTAP_MCS_STBC_2 2
656 #define IEEE80211_RADIOTAP_MCS_STBC_3 3
657 #define IEEE80211_RADIOTAP_MCS_STBC_SHIFT 5
658
659 static const char tstr[] = "[|802.11]";
660
661 /* Radiotap state */
662 /* This is used to save state when parsing/processing parameters */
663 struct radiotap_state
664 {
665 u_int32_t present;
666
667 u_int8_t rate;
668 };
669
670 #define PRINT_SSID(p) \
671 if (p.ssid_present) { \
672 printf(" ("); \
673 fn_print(p.ssid.ssid, NULL); \
674 printf(")"); \
675 }
676
677 #define PRINT_RATE(_sep, _r, _suf) \
678 printf("%s%2.1f%s", _sep, (.5 * ((_r) & 0x7f)), _suf)
679 #define PRINT_RATES(p) \
680 if (p.rates_present) { \
681 int z; \
682 const char *sep = " ["; \
683 for (z = 0; z < p.rates.length ; z++) { \
684 PRINT_RATE(sep, p.rates.rate[z], \
685 (p.rates.rate[z] & 0x80 ? "*" : "")); \
686 sep = " "; \
687 } \
688 if (p.rates.length != 0) \
689 printf(" Mbit]"); \
690 }
691
692 #define PRINT_DS_CHANNEL(p) \
693 if (p.ds_present) \
694 printf(" CH: %u", p.ds.channel); \
695 printf("%s", \
696 CAPABILITY_PRIVACY(p.capability_info) ? ", PRIVACY" : "" );
697
698 #define MAX_MCS_INDEX 76
699
700 /*
701 * Indices are:
702 *
703 * the MCS index (0-76);
704 *
705 * 0 for 20 MHz, 1 for 40 MHz;
706 *
707 * 0 for a long guard interval, 1 for a short guard interval.
708 */
709 static const float ieee80211_float_htrates[MAX_MCS_INDEX+1][2][2] = {
710 /* MCS 0 */
711 { /* 20 Mhz */ { 6.5, /* SGI */ 7.2, },
712 /* 40 Mhz */ { 13.5, /* SGI */ 15.0, },
713 },
714
715 /* MCS 1 */
716 { /* 20 Mhz */ { 13.0, /* SGI */ 14.4, },
717 /* 40 Mhz */ { 27.0, /* SGI */ 30.0, },
718 },
719
720 /* MCS 2 */
721 { /* 20 Mhz */ { 19.5, /* SGI */ 21.7, },
722 /* 40 Mhz */ { 40.5, /* SGI */ 45.0, },
723 },
724
725 /* MCS 3 */
726 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
727 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
728 },
729
730 /* MCS 4 */
731 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
732 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
733 },
734
735 /* MCS 5 */
736 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
737 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
738 },
739
740 /* MCS 6 */
741 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
742 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
743 },
744
745 /* MCS 7 */
746 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
747 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
748 },
749
750 /* MCS 8 */
751 { /* 20 Mhz */ { 13.0, /* SGI */ 14.4, },
752 /* 40 Mhz */ { 27.0, /* SGI */ 30.0, },
753 },
754
755 /* MCS 9 */
756 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
757 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
758 },
759
760 /* MCS 10 */
761 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
762 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
763 },
764
765 /* MCS 11 */
766 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
767 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
768 },
769
770 /* MCS 12 */
771 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
772 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
773 },
774
775 /* MCS 13 */
776 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
777 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
778 },
779
780 /* MCS 14 */
781 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
782 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
783 },
784
785 /* MCS 15 */
786 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
787 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
788 },
789
790 /* MCS 16 */
791 { /* 20 Mhz */ { 19.5, /* SGI */ 21.7, },
792 /* 40 Mhz */ { 40.5, /* SGI */ 45.0, },
793 },
794
795 /* MCS 17 */
796 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
797 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
798 },
799
800 /* MCS 18 */
801 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
802 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
803 },
804
805 /* MCS 19 */
806 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
807 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
808 },
809
810 /* MCS 20 */
811 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
812 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
813 },
814
815 /* MCS 21 */
816 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
817 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
818 },
819
820 /* MCS 22 */
821 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
822 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
823 },
824
825 /* MCS 23 */
826 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
827 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
828 },
829
830 /* MCS 24 */
831 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
832 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
833 },
834
835 /* MCS 25 */
836 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
837 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
838 },
839
840 /* MCS 26 */
841 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
842 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
843 },
844
845 /* MCS 27 */
846 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
847 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
848 },
849
850 /* MCS 28 */
851 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
852 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
853 },
854
855 /* MCS 29 */
856 { /* 20 Mhz */ { 208.0, /* SGI */ 231.1, },
857 /* 40 Mhz */ { 432.0, /* SGI */ 480.0, },
858 },
859
860 /* MCS 30 */
861 { /* 20 Mhz */ { 234.0, /* SGI */ 260.0, },
862 /* 40 Mhz */ { 486.0, /* SGI */ 540.0, },
863 },
864
865 /* MCS 31 */
866 { /* 20 Mhz */ { 260.0, /* SGI */ 288.9, },
867 /* 40 Mhz */ { 540.0, /* SGI */ 600.0, },
868 },
869
870 /* MCS 32 */
871 { /* 20 Mhz */ { 0.0, /* SGI */ 0.0, }, /* not valid */
872 /* 40 Mhz */ { 6.0, /* SGI */ 6.7, },
873 },
874
875 /* MCS 33 */
876 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
877 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
878 },
879
880 /* MCS 34 */
881 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
882 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
883 },
884
885 /* MCS 35 */
886 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
887 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
888 },
889
890 /* MCS 36 */
891 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
892 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
893 },
894
895 /* MCS 37 */
896 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
897 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
898 },
899
900 /* MCS 38 */
901 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
902 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
903 },
904
905 /* MCS 39 */
906 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
907 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
908 },
909
910 /* MCS 40 */
911 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
912 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
913 },
914
915 /* MCS 41 */
916 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
917 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
918 },
919
920 /* MCS 42 */
921 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
922 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
923 },
924
925 /* MCS 43 */
926 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
927 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
928 },
929
930 /* MCS 44 */
931 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
932 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
933 },
934
935 /* MCS 45 */
936 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
937 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
938 },
939
940 /* MCS 46 */
941 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
942 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
943 },
944
945 /* MCS 47 */
946 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
947 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
948 },
949
950 /* MCS 48 */
951 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
952 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
953 },
954
955 /* MCS 49 */
956 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
957 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
958 },
959
960 /* MCS 50 */
961 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
962 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
963 },
964
965 /* MCS 51 */
966 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
967 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
968 },
969
970 /* MCS 52 */
971 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
972 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
973 },
974
975 /* MCS 53 */
976 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
977 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
978 },
979
980 /* MCS 54 */
981 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
982 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
983 },
984
985 /* MCS 55 */
986 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
987 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
988 },
989
990 /* MCS 56 */
991 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
992 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
993 },
994
995 /* MCS 57 */
996 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
997 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
998 },
999
1000 /* MCS 58 */
1001 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
1002 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
1003 },
1004
1005 /* MCS 59 */
1006 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1007 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1008 },
1009
1010 /* MCS 60 */
1011 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
1012 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
1013 },
1014
1015 /* MCS 61 */
1016 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1017 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1018 },
1019
1020 /* MCS 62 */
1021 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
1022 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
1023 },
1024
1025 /* MCS 63 */
1026 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
1027 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
1028 },
1029
1030 /* MCS 64 */
1031 { /* 20 Mhz */ { 143.0, /* SGI */ 158.9, },
1032 /* 40 Mhz */ { 297.0, /* SGI */ 330.0, },
1033 },
1034
1035 /* MCS 65 */
1036 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
1037 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
1038 },
1039
1040 /* MCS 66 */
1041 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1042 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1043 },
1044
1045 /* MCS 67 */
1046 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
1047 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
1048 },
1049
1050 /* MCS 68 */
1051 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1052 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1053 },
1054
1055 /* MCS 69 */
1056 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
1057 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
1058 },
1059
1060 /* MCS 70 */
1061 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
1062 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
1063 },
1064
1065 /* MCS 71 */
1066 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
1067 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
1068 },
1069
1070 /* MCS 72 */
1071 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
1072 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
1073 },
1074
1075 /* MCS 73 */
1076 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
1077 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
1078 },
1079
1080 /* MCS 74 */
1081 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
1082 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
1083 },
1084
1085 /* MCS 75 */
1086 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
1087 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
1088 },
1089
1090 /* MCS 76 */
1091 { /* 20 Mhz */ { 214.5, /* SGI */ 238.3, },
1092 /* 40 Mhz */ { 445.5, /* SGI */ 495.0, },
1093 },
1094 };
1095
1096 static const char *auth_alg_text[]={"Open System","Shared Key","EAP"};
1097 #define NUM_AUTH_ALGS (sizeof auth_alg_text / sizeof auth_alg_text[0])
1098
1099 static const char *status_text[] = {
1100 "Successful", /* 0 */
1101 "Unspecified failure", /* 1 */
1102 "Reserved", /* 2 */
1103 "Reserved", /* 3 */
1104 "Reserved", /* 4 */
1105 "Reserved", /* 5 */
1106 "Reserved", /* 6 */
1107 "Reserved", /* 7 */
1108 "Reserved", /* 8 */
1109 "Reserved", /* 9 */
1110 "Cannot Support all requested capabilities in the Capability "
1111 "Information field", /* 10 */
1112 "Reassociation denied due to inability to confirm that association "
1113 "exists", /* 11 */
1114 "Association denied due to reason outside the scope of the "
1115 "standard", /* 12 */
1116 "Responding station does not support the specified authentication "
1117 "algorithm ", /* 13 */
1118 "Received an Authentication frame with authentication transaction "
1119 "sequence number out of expected sequence", /* 14 */
1120 "Authentication rejected because of challenge failure", /* 15 */
1121 "Authentication rejected due to timeout waiting for next frame in "
1122 "sequence", /* 16 */
1123 "Association denied because AP is unable to handle additional"
1124 "associated stations", /* 17 */
1125 "Association denied due to requesting station not supporting all of "
1126 "the data rates in BSSBasicRateSet parameter", /* 18 */
1127 "Association denied due to requesting station not supporting "
1128 "short preamble operation", /* 19 */
1129 "Association denied due to requesting station not supporting "
1130 "PBCC encoding", /* 20 */
1131 "Association denied due to requesting station not supporting "
1132 "channel agility", /* 21 */
1133 "Association request rejected because Spectrum Management "
1134 "capability is required", /* 22 */
1135 "Association request rejected because the information in the "
1136 "Power Capability element is unacceptable", /* 23 */
1137 "Association request rejected because the information in the "
1138 "Supported Channels element is unacceptable", /* 24 */
1139 "Association denied due to requesting station not supporting "
1140 "short slot operation", /* 25 */
1141 "Association denied due to requesting station not supporting "
1142 "DSSS-OFDM operation", /* 26 */
1143 "Association denied because the requested STA does not support HT "
1144 "features", /* 27 */
1145 "Reserved", /* 28 */
1146 "Association denied because the requested STA does not support "
1147 "the PCO transition time required by the AP", /* 29 */
1148 "Reserved", /* 30 */
1149 "Reserved", /* 31 */
1150 "Unspecified, QoS-related failure", /* 32 */
1151 "Association denied due to QAP having insufficient bandwidth "
1152 "to handle another QSTA", /* 33 */
1153 "Association denied due to excessive frame loss rates and/or "
1154 "poor conditions on current operating channel", /* 34 */
1155 "Association (with QBSS) denied due to requesting station not "
1156 "supporting the QoS facility", /* 35 */
1157 "Association denied due to requesting station not supporting "
1158 "Block Ack", /* 36 */
1159 "The request has been declined", /* 37 */
1160 "The request has not been successful as one or more parameters "
1161 "have invalid values", /* 38 */
1162 "The TS has not been created because the request cannot be honored. "
1163 "However, a suggested TSPEC is provided so that the initiating QSTA"
1164 "may attempt to set another TS with the suggested changes to the "
1165 "TSPEC", /* 39 */
1166 "Invalid Information Element", /* 40 */
1167 "Group Cipher is not valid", /* 41 */
1168 "Pairwise Cipher is not valid", /* 42 */
1169 "AKMP is not valid", /* 43 */
1170 "Unsupported RSN IE version", /* 44 */
1171 "Invalid RSN IE Capabilities", /* 45 */
1172 "Cipher suite is rejected per security policy", /* 46 */
1173 "The TS has not been created. However, the HC may be capable of "
1174 "creating a TS, in response to a request, after the time indicated "
1175 "in the TS Delay element", /* 47 */
1176 "Direct Link is not allowed in the BSS by policy", /* 48 */
1177 "Destination STA is not present within this QBSS.", /* 49 */
1178 "The Destination STA is not a QSTA.", /* 50 */
1179
1180 };
1181 #define NUM_STATUSES (sizeof status_text / sizeof status_text[0])
1182
1183 static const char *reason_text[] = {
1184 "Reserved", /* 0 */
1185 "Unspecified reason", /* 1 */
1186 "Previous authentication no longer valid", /* 2 */
1187 "Deauthenticated because sending station is leaving (or has left) "
1188 "IBSS or ESS", /* 3 */
1189 "Disassociated due to inactivity", /* 4 */
1190 "Disassociated because AP is unable to handle all currently "
1191 " associated stations", /* 5 */
1192 "Class 2 frame received from nonauthenticated station", /* 6 */
1193 "Class 3 frame received from nonassociated station", /* 7 */
1194 "Disassociated because sending station is leaving "
1195 "(or has left) BSS", /* 8 */
1196 "Station requesting (re)association is not authenticated with "
1197 "responding station", /* 9 */
1198 "Disassociated because the information in the Power Capability "
1199 "element is unacceptable", /* 10 */
1200 "Disassociated because the information in the SupportedChannels "
1201 "element is unacceptable", /* 11 */
1202 "Invalid Information Element", /* 12 */
1203 "Reserved", /* 13 */
1204 "Michael MIC failure", /* 14 */
1205 "4-Way Handshake timeout", /* 15 */
1206 "Group key update timeout", /* 16 */
1207 "Information element in 4-Way Handshake different from (Re)Association"
1208 "Request/Probe Response/Beacon", /* 17 */
1209 "Group Cipher is not valid", /* 18 */
1210 "AKMP is not valid", /* 20 */
1211 "Unsupported RSN IE version", /* 21 */
1212 "Invalid RSN IE Capabilities", /* 22 */
1213 "IEEE 802.1X Authentication failed", /* 23 */
1214 "Cipher suite is rejected per security policy", /* 24 */
1215 "Reserved", /* 25 */
1216 "Reserved", /* 26 */
1217 "Reserved", /* 27 */
1218 "Reserved", /* 28 */
1219 "Reserved", /* 29 */
1220 "Reserved", /* 30 */
1221 "TS deleted because QoS AP lacks sufficient bandwidth for this "
1222 "QoS STA due to a change in BSS service characteristics or "
1223 "operational mode (e.g. an HT BSS change from 40 MHz channel "
1224 "to 20 MHz channel)", /* 31 */
1225 "Disassociated for unspecified, QoS-related reason", /* 32 */
1226 "Disassociated because QoS AP lacks sufficient bandwidth for this "
1227 "QoS STA", /* 33 */
1228 "Disassociated because of excessive number of frames that need to be "
1229 "acknowledged, but are not acknowledged for AP transmissions "
1230 "and/or poor channel conditions", /* 34 */
1231 "Disassociated because STA is transmitting outside the limits "
1232 "of its TXOPs", /* 35 */
1233 "Requested from peer STA as the STA is leaving the BSS "
1234 "(or resetting)", /* 36 */
1235 "Requested from peer STA as it does not want to use the "
1236 "mechanism", /* 37 */
1237 "Requested from peer STA as the STA received frames using the "
1238 "mechanism for which a set up is required", /* 38 */
1239 "Requested from peer STA due to time out", /* 39 */
1240 "Reserved", /* 40 */
1241 "Reserved", /* 41 */
1242 "Reserved", /* 42 */
1243 "Reserved", /* 43 */
1244 "Reserved", /* 44 */
1245 "Peer STA does not support the requested cipher suite", /* 45 */
1246 "Association denied due to requesting STA not supporting HT "
1247 "features", /* 46 */
1248 };
1249 #define NUM_REASONS (sizeof reason_text / sizeof reason_text[0])
1250
1251 static int
1252 wep_print(const u_char *p)
1253 {
1254 u_int32_t iv;
1255
1256 if (!TTEST2(*p, IEEE802_11_IV_LEN + IEEE802_11_KID_LEN))
1257 return 0;
1258 iv = EXTRACT_LE_32BITS(p);
1259
1260 printf("Data IV:%3x Pad %x KeyID %x", IV_IV(iv), IV_PAD(iv),
1261 IV_KEYID(iv));
1262
1263 return 1;
1264 }
1265
1266 static int
1267 parse_elements(struct mgmt_body_t *pbody, const u_char *p, int offset,
1268 u_int length)
1269 {
1270 u_int elementlen;
1271 struct ssid_t ssid;
1272 struct challenge_t challenge;
1273 struct rates_t rates;
1274 struct ds_t ds;
1275 struct cf_t cf;
1276 struct tim_t tim;
1277
1278 /*
1279 * We haven't seen any elements yet.
1280 */
1281 pbody->challenge_present = 0;
1282 pbody->ssid_present = 0;
1283 pbody->rates_present = 0;
1284 pbody->ds_present = 0;
1285 pbody->cf_present = 0;
1286 pbody->tim_present = 0;
1287
1288 while (length != 0) {
1289 if (!TTEST2(*(p + offset), 1))
1290 return 0;
1291 if (length < 1)
1292 return 0;
1293 switch (*(p + offset)) {
1294 case E_SSID:
1295 if (!TTEST2(*(p + offset), 2))
1296 return 0;
1297 if (length < 2)
1298 return 0;
1299 memcpy(&ssid, p + offset, 2);
1300 offset += 2;
1301 length -= 2;
1302 if (ssid.length != 0) {
1303 if (ssid.length > sizeof(ssid.ssid) - 1)
1304 return 0;
1305 if (!TTEST2(*(p + offset), ssid.length))
1306 return 0;
1307 if (length < ssid.length)
1308 return 0;
1309 memcpy(&ssid.ssid, p + offset, ssid.length);
1310 offset += ssid.length;
1311 length -= ssid.length;
1312 }
1313 ssid.ssid[ssid.length] = '\0';
1314 /*
1315 * Present and not truncated.
1316 *
1317 * If we haven't already seen an SSID IE,
1318 * copy this one, otherwise ignore this one,
1319 * so we later report the first one we saw.
1320 */
1321 if (!pbody->ssid_present) {
1322 pbody->ssid = ssid;
1323 pbody->ssid_present = 1;
1324 }
1325 break;
1326 case E_CHALLENGE:
1327 if (!TTEST2(*(p + offset), 2))
1328 return 0;
1329 if (length < 2)
1330 return 0;
1331 memcpy(&challenge, p + offset, 2);
1332 offset += 2;
1333 length -= 2;
1334 if (challenge.length != 0) {
1335 if (challenge.length >
1336 sizeof(challenge.text) - 1)
1337 return 0;
1338 if (!TTEST2(*(p + offset), challenge.length))
1339 return 0;
1340 if (length < challenge.length)
1341 return 0;
1342 memcpy(&challenge.text, p + offset,
1343 challenge.length);
1344 offset += challenge.length;
1345 length -= challenge.length;
1346 }
1347 challenge.text[challenge.length] = '\0';
1348 /*
1349 * Present and not truncated.
1350 *
1351 * If we haven't already seen a challenge IE,
1352 * copy this one, otherwise ignore this one,
1353 * so we later report the first one we saw.
1354 */
1355 if (!pbody->challenge_present) {
1356 pbody->challenge = challenge;
1357 pbody->challenge_present = 1;
1358 }
1359 break;
1360 case E_RATES:
1361 if (!TTEST2(*(p + offset), 2))
1362 return 0;
1363 if (length < 2)
1364 return 0;
1365 memcpy(&rates, p + offset, 2);
1366 offset += 2;
1367 length -= 2;
1368 if (rates.length != 0) {
1369 if (rates.length > sizeof rates.rate)
1370 return 0;
1371 if (!TTEST2(*(p + offset), rates.length))
1372 return 0;
1373 if (length < rates.length)
1374 return 0;
1375 memcpy(&rates.rate, p + offset, rates.length);
1376 offset += rates.length;
1377 length -= rates.length;
1378 }
1379 /*
1380 * Present and not truncated.
1381 *
1382 * If we haven't already seen a rates IE,
1383 * copy this one if it's not zero-length,
1384 * otherwise ignore this one, so we later
1385 * report the first one we saw.
1386 *
1387 * We ignore zero-length rates IEs as some
1388 * devices seem to put a zero-length rates
1389 * IE, followed by an SSID IE, followed by
1390 * a non-zero-length rates IE into frames,
1391 * even though IEEE Std 802.11-2007 doesn't
1392 * seem to indicate that a zero-length rates
1393 * IE is valid.
1394 */
1395 if (!pbody->rates_present && rates.length != 0) {
1396 pbody->rates = rates;
1397 pbody->rates_present = 1;
1398 }
1399 break;
1400 case E_DS:
1401 if (!TTEST2(*(p + offset), 3))
1402 return 0;
1403 if (length < 3)
1404 return 0;
1405 memcpy(&ds, p + offset, 3);
1406 offset += 3;
1407 length -= 3;
1408 /*
1409 * Present and not truncated.
1410 *
1411 * If we haven't already seen a DS IE,
1412 * copy this one, otherwise ignore this one,
1413 * so we later report the first one we saw.
1414 */
1415 if (!pbody->ds_present) {
1416 pbody->ds = ds;
1417 pbody->ds_present = 1;
1418 }
1419 break;
1420 case E_CF:
1421 if (!TTEST2(*(p + offset), 8))
1422 return 0;
1423 if (length < 8)
1424 return 0;
1425 memcpy(&cf, p + offset, 8);
1426 offset += 8;
1427 length -= 8;
1428 /*
1429 * Present and not truncated.
1430 *
1431 * If we haven't already seen a CF IE,
1432 * copy this one, otherwise ignore this one,
1433 * so we later report the first one we saw.
1434 */
1435 if (!pbody->cf_present) {
1436 pbody->cf = cf;
1437 pbody->cf_present = 1;
1438 }
1439 break;
1440 case E_TIM:
1441 if (!TTEST2(*(p + offset), 2))
1442 return 0;
1443 if (length < 2)
1444 return 0;
1445 memcpy(&tim, p + offset, 2);
1446 offset += 2;
1447 length -= 2;
1448 if (!TTEST2(*(p + offset), 3))
1449 return 0;
1450 if (length < 3)
1451 return 0;
1452 memcpy(&tim.count, p + offset, 3);
1453 offset += 3;
1454 length -= 3;
1455
1456 if (tim.length <= 3)
1457 break;
1458 if (tim.length - 3 > (int)sizeof tim.bitmap)
1459 return 0;
1460 if (!TTEST2(*(p + offset), tim.length - 3))
1461 return 0;
1462 if (length < (u_int)(tim.length - 3))
1463 return 0;
1464 memcpy(tim.bitmap, p + (tim.length - 3),
1465 (tim.length - 3));
1466 offset += tim.length - 3;
1467 length -= tim.length - 3;
1468 /*
1469 * Present and not truncated.
1470 *
1471 * If we haven't already seen a TIM IE,
1472 * copy this one, otherwise ignore this one,
1473 * so we later report the first one we saw.
1474 */
1475 if (!pbody->tim_present) {
1476 pbody->tim = tim;
1477 pbody->tim_present = 1;
1478 }
1479 break;
1480 default:
1481 #if 0
1482 printf("(1) unhandled element_id (%d) ",
1483 *(p + offset));
1484 #endif
1485 if (!TTEST2(*(p + offset), 2))
1486 return 0;
1487 if (length < 2)
1488 return 0;
1489 elementlen = *(p + offset + 1);
1490 if (!TTEST2(*(p + offset + 2), elementlen))
1491 return 0;
1492 if (length < elementlen + 2)
1493 return 0;
1494 offset += elementlen + 2;
1495 length -= elementlen + 2;
1496 break;
1497 }
1498 }
1499
1500 /* No problems found. */
1501 return 1;
1502 }
1503
1504 /*********************************************************************************
1505 * Print Handle functions for the management frame types
1506 *********************************************************************************/
1507
1508 static int
1509 handle_beacon(const u_char *p, u_int length)
1510 {
1511 struct mgmt_body_t pbody;
1512 int offset = 0;
1513 int ret;
1514
1515 memset(&pbody, 0, sizeof(pbody));
1516
1517 if (!TTEST2(*p, IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1518 IEEE802_11_CAPINFO_LEN))
1519 return 0;
1520 if (length < IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1521 IEEE802_11_CAPINFO_LEN)
1522 return 0;
1523 memcpy(&pbody.timestamp, p, IEEE802_11_TSTAMP_LEN);
1524 offset += IEEE802_11_TSTAMP_LEN;
1525 length -= IEEE802_11_TSTAMP_LEN;
1526 pbody.beacon_interval = EXTRACT_LE_16BITS(p+offset);
1527 offset += IEEE802_11_BCNINT_LEN;
1528 length -= IEEE802_11_BCNINT_LEN;
1529 pbody.capability_info = EXTRACT_LE_16BITS(p+offset);
1530 offset += IEEE802_11_CAPINFO_LEN;
1531 length -= IEEE802_11_CAPINFO_LEN;
1532
1533 ret = parse_elements(&pbody, p, offset, length);
1534
1535 PRINT_SSID(pbody);
1536 PRINT_RATES(pbody);
1537 printf(" %s",
1538 CAPABILITY_ESS(pbody.capability_info) ? "ESS" : "IBSS");
1539 PRINT_DS_CHANNEL(pbody);
1540
1541 return ret;
1542 }
1543
1544 static int
1545 handle_assoc_request(const u_char *p, u_int length)
1546 {
1547 struct mgmt_body_t pbody;
1548 int offset = 0;
1549 int ret;
1550
1551 memset(&pbody, 0, sizeof(pbody));
1552
1553 if (!TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN))
1554 return 0;
1555 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN)
1556 return 0;
1557 pbody.capability_info = EXTRACT_LE_16BITS(p);
1558 offset += IEEE802_11_CAPINFO_LEN;
1559 length -= IEEE802_11_CAPINFO_LEN;
1560 pbody.listen_interval = EXTRACT_LE_16BITS(p+offset);
1561 offset += IEEE802_11_LISTENINT_LEN;
1562 length -= IEEE802_11_LISTENINT_LEN;
1563
1564 ret = parse_elements(&pbody, p, offset, length);
1565
1566 PRINT_SSID(pbody);
1567 PRINT_RATES(pbody);
1568 return ret;
1569 }
1570
1571 static int
1572 handle_assoc_response(const u_char *p, u_int length)
1573 {
1574 struct mgmt_body_t pbody;
1575 int offset = 0;
1576 int ret;
1577
1578 memset(&pbody, 0, sizeof(pbody));
1579
1580 if (!TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_STATUS_LEN +
1581 IEEE802_11_AID_LEN))
1582 return 0;
1583 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_STATUS_LEN +
1584 IEEE802_11_AID_LEN)
1585 return 0;
1586 pbody.capability_info = EXTRACT_LE_16BITS(p);
1587 offset += IEEE802_11_CAPINFO_LEN;
1588 length -= IEEE802_11_CAPINFO_LEN;
1589 pbody.status_code = EXTRACT_LE_16BITS(p+offset);
1590 offset += IEEE802_11_STATUS_LEN;
1591 length -= IEEE802_11_STATUS_LEN;
1592 pbody.aid = EXTRACT_LE_16BITS(p+offset);
1593 offset += IEEE802_11_AID_LEN;
1594 length -= IEEE802_11_AID_LEN;
1595
1596 ret = parse_elements(&pbody, p, offset, length);
1597
1598 printf(" AID(%x) :%s: %s", ((u_int16_t)(pbody.aid << 2 )) >> 2 ,
1599 CAPABILITY_PRIVACY(pbody.capability_info) ? " PRIVACY " : "",
1600 (pbody.status_code < NUM_STATUSES
1601 ? status_text[pbody.status_code]
1602 : "n/a"));
1603
1604 return ret;
1605 }
1606
1607 static int
1608 handle_reassoc_request(const u_char *p, u_int length)
1609 {
1610 struct mgmt_body_t pbody;
1611 int offset = 0;
1612 int ret;
1613
1614 memset(&pbody, 0, sizeof(pbody));
1615
1616 if (!TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN +
1617 IEEE802_11_AP_LEN))
1618 return 0;
1619 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN +
1620 IEEE802_11_AP_LEN)
1621 return 0;
1622 pbody.capability_info = EXTRACT_LE_16BITS(p);
1623 offset += IEEE802_11_CAPINFO_LEN;
1624 length -= IEEE802_11_CAPINFO_LEN;
1625 pbody.listen_interval = EXTRACT_LE_16BITS(p+offset);
1626 offset += IEEE802_11_LISTENINT_LEN;
1627 length -= IEEE802_11_LISTENINT_LEN;
1628 memcpy(&pbody.ap, p+offset, IEEE802_11_AP_LEN);
1629 offset += IEEE802_11_AP_LEN;
1630 length -= IEEE802_11_AP_LEN;
1631
1632 ret = parse_elements(&pbody, p, offset, length);
1633
1634 PRINT_SSID(pbody);
1635 printf(" AP : %s", etheraddr_string( pbody.ap ));
1636
1637 return ret;
1638 }
1639
1640 static int
1641 handle_reassoc_response(const u_char *p, u_int length)
1642 {
1643 /* Same as a Association Reponse */
1644 return handle_assoc_response(p, length);
1645 }
1646
1647 static int
1648 handle_probe_request(const u_char *p, u_int length)
1649 {
1650 struct mgmt_body_t pbody;
1651 int offset = 0;
1652 int ret;
1653
1654 memset(&pbody, 0, sizeof(pbody));
1655
1656 ret = parse_elements(&pbody, p, offset, length);
1657
1658 PRINT_SSID(pbody);
1659 PRINT_RATES(pbody);
1660
1661 return ret;
1662 }
1663
1664 static int
1665 handle_probe_response(const u_char *p, u_int length)
1666 {
1667 struct mgmt_body_t pbody;
1668 int offset = 0;
1669 int ret;
1670
1671 memset(&pbody, 0, sizeof(pbody));
1672
1673 if (!TTEST2(*p, IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1674 IEEE802_11_CAPINFO_LEN))
1675 return 0;
1676 if (length < IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1677 IEEE802_11_CAPINFO_LEN)
1678 return 0;
1679 memcpy(&pbody.timestamp, p, IEEE802_11_TSTAMP_LEN);
1680 offset += IEEE802_11_TSTAMP_LEN;
1681 length -= IEEE802_11_TSTAMP_LEN;
1682 pbody.beacon_interval = EXTRACT_LE_16BITS(p+offset);
1683 offset += IEEE802_11_BCNINT_LEN;
1684 length -= IEEE802_11_BCNINT_LEN;
1685 pbody.capability_info = EXTRACT_LE_16BITS(p+offset);
1686 offset += IEEE802_11_CAPINFO_LEN;
1687 length -= IEEE802_11_CAPINFO_LEN;
1688
1689 ret = parse_elements(&pbody, p, offset, length);
1690
1691 PRINT_SSID(pbody);
1692 PRINT_RATES(pbody);
1693 PRINT_DS_CHANNEL(pbody);
1694
1695 return ret;
1696 }
1697
1698 static int
1699 handle_atim(void)
1700 {
1701 /* the frame body for ATIM is null. */
1702 return 1;
1703 }
1704
1705 static int
1706 handle_disassoc(const u_char *p, u_int length)
1707 {
1708 struct mgmt_body_t pbody;
1709
1710 memset(&pbody, 0, sizeof(pbody));
1711
1712 if (!TTEST2(*p, IEEE802_11_REASON_LEN))
1713 return 0;
1714 if (length < IEEE802_11_REASON_LEN)
1715 return 0;
1716 pbody.reason_code = EXTRACT_LE_16BITS(p);
1717
1718 printf(": %s",
1719 (pbody.reason_code < NUM_REASONS)
1720 ? reason_text[pbody.reason_code]
1721 : "Reserved" );
1722
1723 return 1;
1724 }
1725
1726 static int
1727 handle_auth(const u_char *p, u_int length)
1728 {
1729 struct mgmt_body_t pbody;
1730 int offset = 0;
1731 int ret;
1732
1733 memset(&pbody, 0, sizeof(pbody));
1734
1735 if (!TTEST2(*p, 6))
1736 return 0;
1737 if (length < 6)
1738 return 0;
1739 pbody.auth_alg = EXTRACT_LE_16BITS(p);
1740 offset += 2;
1741 length -= 2;
1742 pbody.auth_trans_seq_num = EXTRACT_LE_16BITS(p + offset);
1743 offset += 2;
1744 length -= 2;
1745 pbody.status_code = EXTRACT_LE_16BITS(p + offset);
1746 offset += 2;
1747 length -= 2;
1748
1749 ret = parse_elements(&pbody, p, offset, length);
1750
1751 if ((pbody.auth_alg == 1) &&
1752 ((pbody.auth_trans_seq_num == 2) ||
1753 (pbody.auth_trans_seq_num == 3))) {
1754 printf(" (%s)-%x [Challenge Text] %s",
1755 (pbody.auth_alg < NUM_AUTH_ALGS)
1756 ? auth_alg_text[pbody.auth_alg]
1757 : "Reserved",
1758 pbody.auth_trans_seq_num,
1759 ((pbody.auth_trans_seq_num % 2)
1760 ? ((pbody.status_code < NUM_STATUSES)
1761 ? status_text[pbody.status_code]
1762 : "n/a") : ""));
1763 return ret;
1764 }
1765 printf(" (%s)-%x: %s",
1766 (pbody.auth_alg < NUM_AUTH_ALGS)
1767 ? auth_alg_text[pbody.auth_alg]
1768 : "Reserved",
1769 pbody.auth_trans_seq_num,
1770 (pbody.auth_trans_seq_num % 2)
1771 ? ((pbody.status_code < NUM_STATUSES)
1772 ? status_text[pbody.status_code]
1773 : "n/a")
1774 : "");
1775
1776 return ret;
1777 }
1778
1779 static int
1780 handle_deauth(const struct mgmt_header_t *pmh, const u_char *p, u_int length)
1781 {
1782 struct mgmt_body_t pbody;
1783 const char *reason = NULL;
1784
1785 memset(&pbody, 0, sizeof(pbody));
1786
1787 if (!TTEST2(*p, IEEE802_11_REASON_LEN))
1788 return 0;
1789 if (length < IEEE802_11_REASON_LEN)
1790 return 0;
1791 pbody.reason_code = EXTRACT_LE_16BITS(p);
1792
1793 reason = (pbody.reason_code < NUM_REASONS)
1794 ? reason_text[pbody.reason_code]
1795 : "Reserved";
1796
1797 if (eflag) {
1798 printf(": %s", reason);
1799 } else {
1800 printf(" (%s): %s", etheraddr_string(pmh->sa), reason);
1801 }
1802 return 1;
1803 }
1804
1805 #define PRINT_HT_ACTION(v) (\
1806 (v) == 0 ? printf("TxChWidth") : \
1807 (v) == 1 ? printf("MIMOPwrSave") : \
1808 printf("Act#%d", (v)) \
1809 )
1810 #define PRINT_BA_ACTION(v) (\
1811 (v) == 0 ? printf("ADDBA Request") : \
1812 (v) == 1 ? printf("ADDBA Response") : \
1813 (v) == 2 ? printf("DELBA") : \
1814 printf("Act#%d", (v)) \
1815 )
1816 #define PRINT_MESHLINK_ACTION(v) (\
1817 (v) == 0 ? printf("Request") : \
1818 (v) == 1 ? printf("Report") : \
1819 printf("Act#%d", (v)) \
1820 )
1821 #define PRINT_MESHPEERING_ACTION(v) (\
1822 (v) == 0 ? printf("Open") : \
1823 (v) == 1 ? printf("Confirm") : \
1824 (v) == 2 ? printf("Close") : \
1825 printf("Act#%d", (v)) \
1826 )
1827 #define PRINT_MESHPATH_ACTION(v) (\
1828 (v) == 0 ? printf("Request") : \
1829 (v) == 1 ? printf("Report") : \
1830 (v) == 2 ? printf("Error") : \
1831 (v) == 3 ? printf("RootAnnouncement") : \
1832 printf("Act#%d", (v)) \
1833 )
1834
1835 #define PRINT_MESH_ACTION(v) (\
1836 (v) == 0 ? printf("MeshLink") : \
1837 (v) == 1 ? printf("HWMP") : \
1838 (v) == 2 ? printf("Gate Announcement") : \
1839 (v) == 3 ? printf("Congestion Control") : \
1840 (v) == 4 ? printf("MCCA Setup Request") : \
1841 (v) == 5 ? printf("MCCA Setup Reply") : \
1842 (v) == 6 ? printf("MCCA Advertisement Request") : \
1843 (v) == 7 ? printf("MCCA Advertisement") : \
1844 (v) == 8 ? printf("MCCA Teardown") : \
1845 (v) == 9 ? printf("TBTT Adjustment Request") : \
1846 (v) == 10 ? printf("TBTT Adjustment Response") : \
1847 printf("Act#%d", (v)) \
1848 )
1849 #define PRINT_MULTIHOP_ACTION(v) (\
1850 (v) == 0 ? printf("Proxy Update") : \
1851 (v) == 1 ? printf("Proxy Update Confirmation") : \
1852 printf("Act#%d", (v)) \
1853 )
1854 #define PRINT_SELFPROT_ACTION(v) (\
1855 (v) == 1 ? printf("Peering Open") : \
1856 (v) == 2 ? printf("Peering Confirm") : \
1857 (v) == 3 ? printf("Peering Close") : \
1858 (v) == 4 ? printf("Group Key Inform") : \
1859 (v) == 5 ? printf("Group Key Acknowledge") : \
1860 printf("Act#%d", (v)) \
1861 )
1862
1863 static int
1864 handle_action(const struct mgmt_header_t *pmh, const u_char *p, u_int length)
1865 {
1866 if (!TTEST2(*p, 2))
1867 return 0;
1868 if (length < 2)
1869 return 0;
1870 if (eflag) {
1871 printf(": ");
1872 } else {
1873 printf(" (%s): ", etheraddr_string(pmh->sa));
1874 }
1875 switch (p[0]) {
1876 case 0: printf("Spectrum Management Act#%d", p[1]); break;
1877 case 1: printf("QoS Act#%d", p[1]); break;
1878 case 2: printf("DLS Act#%d", p[1]); break;
1879 case 3: printf("BA "); PRINT_BA_ACTION(p[1]); break;
1880 case 7: printf("HT "); PRINT_HT_ACTION(p[1]); break;
1881 case 13: printf("MeshAction "); PRINT_MESH_ACTION(p[1]); break;
1882 case 14:
1883 printf("MultiohopAction ");
1884 PRINT_MULTIHOP_ACTION(p[1]); break;
1885 case 15:
1886 printf("SelfprotectAction ");
1887 PRINT_SELFPROT_ACTION(p[1]); break;
1888 case 127: printf("Vendor Act#%d", p[1]); break;
1889 default:
1890 printf("Reserved(%d) Act#%d", p[0], p[1]);
1891 break;
1892 }
1893 return 1;
1894 }
1895
1896
1897 /*********************************************************************************
1898 * Print Body funcs
1899 *********************************************************************************/
1900
1901
1902 static int
1903 mgmt_body_print(u_int16_t fc, const struct mgmt_header_t *pmh,
1904 const u_char *p, u_int length)
1905 {
1906 switch (FC_SUBTYPE(fc)) {
1907 case ST_ASSOC_REQUEST:
1908 printf("Assoc Request");
1909 return handle_assoc_request(p, length);
1910 case ST_ASSOC_RESPONSE:
1911 printf("Assoc Response");
1912 return handle_assoc_response(p, length);
1913 case ST_REASSOC_REQUEST:
1914 printf("ReAssoc Request");
1915 return handle_reassoc_request(p, length);
1916 case ST_REASSOC_RESPONSE:
1917 printf("ReAssoc Response");
1918 return handle_reassoc_response(p, length);
1919 case ST_PROBE_REQUEST:
1920 printf("Probe Request");
1921 return handle_probe_request(p, length);
1922 case ST_PROBE_RESPONSE:
1923 printf("Probe Response");
1924 return handle_probe_response(p, length);
1925 case ST_BEACON:
1926 printf("Beacon");
1927 return handle_beacon(p, length);
1928 case ST_ATIM:
1929 printf("ATIM");
1930 return handle_atim();
1931 case ST_DISASSOC:
1932 printf("Disassociation");
1933 return handle_disassoc(p, length);
1934 case ST_AUTH:
1935 printf("Authentication");
1936 if (!TTEST2(*p, 3))
1937 return 0;
1938 if ((p[0] == 0 ) && (p[1] == 0) && (p[2] == 0)) {
1939 printf("Authentication (Shared-Key)-3 ");
1940 return wep_print(p);
1941 }
1942 return handle_auth(p, length);
1943 case ST_DEAUTH:
1944 printf("DeAuthentication");
1945 return handle_deauth(pmh, p, length);
1946 break;
1947 case ST_ACTION:
1948 printf("Action");
1949 return handle_action(pmh, p, length);
1950 break;
1951 default:
1952 printf("Unhandled Management subtype(%x)",
1953 FC_SUBTYPE(fc));
1954 return 1;
1955 }
1956 }
1957
1958
1959 /*********************************************************************************
1960 * Handles printing all the control frame types
1961 *********************************************************************************/
1962
1963 static int
1964 ctrl_body_print(u_int16_t fc, const u_char *p)
1965 {
1966 switch (FC_SUBTYPE(fc)) {
1967 case CTRL_CONTROL_WRAPPER:
1968 printf("Control Wrapper");
1969 /* XXX - requires special handling */
1970 break;
1971 case CTRL_BAR:
1972 printf("BAR");
1973 if (!TTEST2(*p, CTRL_BAR_HDRLEN))
1974 return 0;
1975 if (!eflag)
1976 printf(" RA:%s TA:%s CTL(%x) SEQ(%u) ",
1977 etheraddr_string(((const struct ctrl_bar_t *)p)->ra),
1978 etheraddr_string(((const struct ctrl_bar_t *)p)->ta),
1979 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->ctl)),
1980 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->seq)));
1981 break;
1982 case CTRL_BA:
1983 printf("BA");
1984 if (!TTEST2(*p, CTRL_BA_HDRLEN))
1985 return 0;
1986 if (!eflag)
1987 printf(" RA:%s ",
1988 etheraddr_string(((const struct ctrl_ba_t *)p)->ra));
1989 break;
1990 case CTRL_PS_POLL:
1991 printf("Power Save-Poll");
1992 if (!TTEST2(*p, CTRL_PS_POLL_HDRLEN))
1993 return 0;
1994 printf(" AID(%x)",
1995 EXTRACT_LE_16BITS(&(((const struct ctrl_ps_poll_t *)p)->aid)));
1996 break;
1997 case CTRL_RTS:
1998 printf("Request-To-Send");
1999 if (!TTEST2(*p, CTRL_RTS_HDRLEN))
2000 return 0;
2001 if (!eflag)
2002 printf(" TA:%s ",
2003 etheraddr_string(((const struct ctrl_rts_t *)p)->ta));
2004 break;
2005 case CTRL_CTS:
2006 printf("Clear-To-Send");
2007 if (!TTEST2(*p, CTRL_CTS_HDRLEN))
2008 return 0;
2009 if (!eflag)
2010 printf(" RA:%s ",
2011 etheraddr_string(((const struct ctrl_cts_t *)p)->ra));
2012 break;
2013 case CTRL_ACK:
2014 printf("Acknowledgment");
2015 if (!TTEST2(*p, CTRL_ACK_HDRLEN))
2016 return 0;
2017 if (!eflag)
2018 printf(" RA:%s ",
2019 etheraddr_string(((const struct ctrl_ack_t *)p)->ra));
2020 break;
2021 case CTRL_CF_END:
2022 printf("CF-End");
2023 if (!TTEST2(*p, CTRL_END_HDRLEN))
2024 return 0;
2025 if (!eflag)
2026 printf(" RA:%s ",
2027 etheraddr_string(((const struct ctrl_end_t *)p)->ra));
2028 break;
2029 case CTRL_END_ACK:
2030 printf("CF-End+CF-Ack");
2031 if (!TTEST2(*p, CTRL_END_ACK_HDRLEN))
2032 return 0;
2033 if (!eflag)
2034 printf(" RA:%s ",
2035 etheraddr_string(((const struct ctrl_end_ack_t *)p)->ra));
2036 break;
2037 default:
2038 printf("Unknown Ctrl Subtype");
2039 }
2040 return 1;
2041 }
2042
2043 /*
2044 * Print Header funcs
2045 */
2046
2047 /*
2048 * Data Frame - Address field contents
2049 *
2050 * To Ds | From DS | Addr 1 | Addr 2 | Addr 3 | Addr 4
2051 * 0 | 0 | DA | SA | BSSID | n/a
2052 * 0 | 1 | DA | BSSID | SA | n/a
2053 * 1 | 0 | BSSID | SA | DA | n/a
2054 * 1 | 1 | RA | TA | DA | SA
2055 */
2056
2057 static void
2058 data_header_print(u_int16_t fc, const u_char *p, const u_int8_t **srcp,
2059 const u_int8_t **dstp)
2060 {
2061 u_int subtype = FC_SUBTYPE(fc);
2062
2063 if (DATA_FRAME_IS_CF_ACK(subtype) || DATA_FRAME_IS_CF_POLL(subtype) ||
2064 DATA_FRAME_IS_QOS(subtype)) {
2065 printf("CF ");
2066 if (DATA_FRAME_IS_CF_ACK(subtype)) {
2067 if (DATA_FRAME_IS_CF_POLL(subtype))
2068 printf("Ack/Poll");
2069 else
2070 printf("Ack");
2071 } else {
2072 if (DATA_FRAME_IS_CF_POLL(subtype))
2073 printf("Poll");
2074 }
2075 if (DATA_FRAME_IS_QOS(subtype))
2076 printf("+QoS");
2077 printf(" ");
2078 }
2079
2080 #define ADDR1 (p + 4)
2081 #define ADDR2 (p + 10)
2082 #define ADDR3 (p + 16)
2083 #define ADDR4 (p + 24)
2084
2085 if (!FC_TO_DS(fc) && !FC_FROM_DS(fc)) {
2086 if (srcp != NULL)
2087 *srcp = ADDR2;
2088 if (dstp != NULL)
2089 *dstp = ADDR1;
2090 if (!eflag)
2091 return;
2092 printf("DA:%s SA:%s BSSID:%s ",
2093 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2094 etheraddr_string(ADDR3));
2095 } else if (!FC_TO_DS(fc) && FC_FROM_DS(fc)) {
2096 if (srcp != NULL)
2097 *srcp = ADDR3;
2098 if (dstp != NULL)
2099 *dstp = ADDR1;
2100 if (!eflag)
2101 return;
2102 printf("DA:%s BSSID:%s SA:%s ",
2103 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2104 etheraddr_string(ADDR3));
2105 } else if (FC_TO_DS(fc) && !FC_FROM_DS(fc)) {
2106 if (srcp != NULL)
2107 *srcp = ADDR2;
2108 if (dstp != NULL)
2109 *dstp = ADDR3;
2110 if (!eflag)
2111 return;
2112 printf("BSSID:%s SA:%s DA:%s ",
2113 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2114 etheraddr_string(ADDR3));
2115 } else if (FC_TO_DS(fc) && FC_FROM_DS(fc)) {
2116 if (srcp != NULL)
2117 *srcp = ADDR4;
2118 if (dstp != NULL)
2119 *dstp = ADDR3;
2120 if (!eflag)
2121 return;
2122 printf("RA:%s TA:%s DA:%s SA:%s ",
2123 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2124 etheraddr_string(ADDR3), etheraddr_string(ADDR4));
2125 }
2126
2127 #undef ADDR1
2128 #undef ADDR2
2129 #undef ADDR3
2130 #undef ADDR4
2131 }
2132
2133 static void
2134 mgmt_header_print(const u_char *p, const u_int8_t **srcp,
2135 const u_int8_t **dstp)
2136 {
2137 const struct mgmt_header_t *hp = (const struct mgmt_header_t *) p;
2138
2139 if (srcp != NULL)
2140 *srcp = hp->sa;
2141 if (dstp != NULL)
2142 *dstp = hp->da;
2143 if (!eflag)
2144 return;
2145
2146 printf("BSSID:%s DA:%s SA:%s ",
2147 etheraddr_string((hp)->bssid), etheraddr_string((hp)->da),
2148 etheraddr_string((hp)->sa));
2149 }
2150
2151 static void
2152 ctrl_header_print(u_int16_t fc, const u_char *p, const u_int8_t **srcp,
2153 const u_int8_t **dstp)
2154 {
2155 if (srcp != NULL)
2156 *srcp = NULL;
2157 if (dstp != NULL)
2158 *dstp = NULL;
2159 if (!eflag)
2160 return;
2161
2162 switch (FC_SUBTYPE(fc)) {
2163 case CTRL_BAR:
2164 printf(" RA:%s TA:%s CTL(%x) SEQ(%u) ",
2165 etheraddr_string(((const struct ctrl_bar_t *)p)->ra),
2166 etheraddr_string(((const struct ctrl_bar_t *)p)->ta),
2167 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->ctl)),
2168 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->seq)));
2169 break;
2170 case CTRL_BA:
2171 printf("RA:%s ",
2172 etheraddr_string(((const struct ctrl_ba_t *)p)->ra));
2173 break;
2174 case CTRL_PS_POLL:
2175 printf("BSSID:%s TA:%s ",
2176 etheraddr_string(((const struct ctrl_ps_poll_t *)p)->bssid),
2177 etheraddr_string(((const struct ctrl_ps_poll_t *)p)->ta));
2178 break;
2179 case CTRL_RTS:
2180 printf("RA:%s TA:%s ",
2181 etheraddr_string(((const struct ctrl_rts_t *)p)->ra),
2182 etheraddr_string(((const struct ctrl_rts_t *)p)->ta));
2183 break;
2184 case CTRL_CTS:
2185 printf("RA:%s ",
2186 etheraddr_string(((const struct ctrl_cts_t *)p)->ra));
2187 break;
2188 case CTRL_ACK:
2189 printf("RA:%s ",
2190 etheraddr_string(((const struct ctrl_ack_t *)p)->ra));
2191 break;
2192 case CTRL_CF_END:
2193 printf("RA:%s BSSID:%s ",
2194 etheraddr_string(((const struct ctrl_end_t *)p)->ra),
2195 etheraddr_string(((const struct ctrl_end_t *)p)->bssid));
2196 break;
2197 case CTRL_END_ACK:
2198 printf("RA:%s BSSID:%s ",
2199 etheraddr_string(((const struct ctrl_end_ack_t *)p)->ra),
2200 etheraddr_string(((const struct ctrl_end_ack_t *)p)->bssid));
2201 break;
2202 default:
2203 printf("(H) Unknown Ctrl Subtype");
2204 break;
2205 }
2206 }
2207
2208 static int
2209 extract_header_length(u_int16_t fc)
2210 {
2211 int len;
2212
2213 switch (FC_TYPE(fc)) {
2214 case T_MGMT:
2215 return MGMT_HDRLEN;
2216 case T_CTRL:
2217 switch (FC_SUBTYPE(fc)) {
2218 case CTRL_BAR:
2219 return CTRL_BAR_HDRLEN;
2220 case CTRL_PS_POLL:
2221 return CTRL_PS_POLL_HDRLEN;
2222 case CTRL_RTS:
2223 return CTRL_RTS_HDRLEN;
2224 case CTRL_CTS:
2225 return CTRL_CTS_HDRLEN;
2226 case CTRL_ACK:
2227 return CTRL_ACK_HDRLEN;
2228 case CTRL_CF_END:
2229 return CTRL_END_HDRLEN;
2230 case CTRL_END_ACK:
2231 return CTRL_END_ACK_HDRLEN;
2232 default:
2233 return 0;
2234 }
2235 case T_DATA:
2236 len = (FC_TO_DS(fc) && FC_FROM_DS(fc)) ? 30 : 24;
2237 if (DATA_FRAME_IS_QOS(FC_SUBTYPE(fc)))
2238 len += 2;
2239 return len;
2240 default:
2241 printf("unknown IEEE802.11 frame type (%d)", FC_TYPE(fc));
2242 return 0;
2243 }
2244 }
2245
2246 static int
2247 extract_mesh_header_length(const u_char *p)
2248 {
2249 return (p[0] &~ 3) ? 0 : 6*(1 + (p[0] & 3));
2250 }
2251
2252 /*
2253 * Print the 802.11 MAC header if eflag is set, and set "*srcp" and "*dstp"
2254 * to point to the source and destination MAC addresses in any case if
2255 * "srcp" and "dstp" aren't null.
2256 */
2257 static void
2258 ieee_802_11_hdr_print(u_int16_t fc, const u_char *p, u_int hdrlen,
2259 u_int meshdrlen, const u_int8_t **srcp, const u_int8_t **dstp)
2260 {
2261 if (vflag) {
2262 if (FC_MORE_DATA(fc))
2263 printf("More Data ");
2264 if (FC_MORE_FLAG(fc))
2265 printf("More Fragments ");
2266 if (FC_POWER_MGMT(fc))
2267 printf("Pwr Mgmt ");
2268 if (FC_RETRY(fc))
2269 printf("Retry ");
2270 if (FC_ORDER(fc))
2271 printf("Strictly Ordered ");
2272 if (FC_WEP(fc))
2273 printf("WEP Encrypted ");
2274 if (FC_TYPE(fc) != T_CTRL || FC_SUBTYPE(fc) != CTRL_PS_POLL)
2275 printf("%dus ",
2276 EXTRACT_LE_16BITS(
2277 &((const struct mgmt_header_t *)p)->duration));
2278 }
2279 if (meshdrlen != 0) {
2280 const struct meshcntl_t *mc =
2281 (const struct meshcntl_t *)&p[hdrlen - meshdrlen];
2282 int ae = mc->flags & 3;
2283
2284 printf("MeshData (AE %d TTL %u seq %u", ae, mc->ttl,
2285 EXTRACT_LE_32BITS(mc->seq));
2286 if (ae > 0)
2287 printf(" A4:%s", etheraddr_string(mc->addr4));
2288 if (ae > 1)
2289 printf(" A5:%s", etheraddr_string(mc->addr5));
2290 if (ae > 2)
2291 printf(" A6:%s", etheraddr_string(mc->addr6));
2292 printf(") ");
2293 }
2294
2295 switch (FC_TYPE(fc)) {
2296 case T_MGMT:
2297 mgmt_header_print(p, srcp, dstp);
2298 break;
2299 case T_CTRL:
2300 ctrl_header_print(fc, p, srcp, dstp);
2301 break;
2302 case T_DATA:
2303 data_header_print(fc, p, srcp, dstp);
2304 break;
2305 default:
2306 printf("(header) unknown IEEE802.11 frame type (%d)",
2307 FC_TYPE(fc));
2308 *srcp = NULL;
2309 *dstp = NULL;
2310 break;
2311 }
2312 }
2313
2314 #ifndef roundup2
2315 #define roundup2(x, y) (((x)+((y)-1))&(~((y)-1))) /* if y is powers of two */
2316 #endif
2317
2318 static u_int
2319 ieee802_11_print(const u_char *p, u_int length, u_int orig_caplen, int pad,
2320 u_int fcslen)
2321 {
2322 u_int16_t fc;
2323 u_int caplen, hdrlen, meshdrlen;
2324 const u_int8_t *src, *dst;
2325 u_short extracted_ethertype;
2326
2327 caplen = orig_caplen;
2328 /* Remove FCS, if present */
2329 if (length < fcslen) {
2330 printf("%s", tstr);
2331 return caplen;
2332 }
2333 length -= fcslen;
2334 if (caplen > length) {
2335 /* Amount of FCS in actual packet data, if any */
2336 fcslen = caplen - length;
2337 caplen -= fcslen;
2338 snapend -= fcslen;
2339 }
2340
2341 if (caplen < IEEE802_11_FC_LEN) {
2342 printf("%s", tstr);
2343 return orig_caplen;
2344 }
2345
2346 fc = EXTRACT_LE_16BITS(p);
2347 hdrlen = extract_header_length(fc);
2348 if (pad)
2349 hdrlen = roundup2(hdrlen, 4);
2350 if (Hflag && FC_TYPE(fc) == T_DATA &&
2351 DATA_FRAME_IS_QOS(FC_SUBTYPE(fc))) {
2352 meshdrlen = extract_mesh_header_length(p+hdrlen);
2353 hdrlen += meshdrlen;
2354 } else
2355 meshdrlen = 0;
2356
2357
2358 if (caplen < hdrlen) {
2359 printf("%s", tstr);
2360 return hdrlen;
2361 }
2362
2363 ieee_802_11_hdr_print(fc, p, hdrlen, meshdrlen, &src, &dst);
2364
2365 /*
2366 * Go past the 802.11 header.
2367 */
2368 length -= hdrlen;
2369 caplen -= hdrlen;
2370 p += hdrlen;
2371
2372 switch (FC_TYPE(fc)) {
2373 case T_MGMT:
2374 if (!mgmt_body_print(fc,
2375 (const struct mgmt_header_t *)(p - hdrlen), p, length)) {
2376 printf("%s", tstr);
2377 return hdrlen;
2378 }
2379 break;
2380 case T_CTRL:
2381 if (!ctrl_body_print(fc, p - hdrlen)) {
2382 printf("%s", tstr);
2383 return hdrlen;
2384 }
2385 break;
2386 case T_DATA:
2387 if (DATA_FRAME_IS_NULL(FC_SUBTYPE(fc)))
2388 return hdrlen; /* no-data frame */
2389 /* There may be a problem w/ AP not having this bit set */
2390 if (FC_WEP(fc)) {
2391 if (!wep_print(p)) {
2392 printf("%s", tstr);
2393 return hdrlen;
2394 }
2395 } else if (llc_print(gndo, p, length, caplen, dst, src,
2396 &extracted_ethertype) == 0) {
2397 /*
2398 * Some kinds of LLC packet we cannot
2399 * handle intelligently
2400 */
2401 if (!eflag)
2402 ieee_802_11_hdr_print(fc, p - hdrlen, hdrlen,
2403 meshdrlen, NULL, NULL);
2404 if (extracted_ethertype)
2405 printf("(LLC %s) ",
2406 etherproto_string(
2407 htons(extracted_ethertype)));
2408 if (!suppress_default_print)
2409 default_print(p, caplen);
2410 }
2411 break;
2412 default:
2413 printf("unknown 802.11 frame type (%d)", FC_TYPE(fc));
2414 break;
2415 }
2416
2417 return hdrlen;
2418 }
2419
2420 /*
2421 * This is the top level routine of the printer. 'p' points
2422 * to the 802.11 header of the packet, 'h->ts' is the timestamp,
2423 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
2424 * is the number of bytes actually captured.
2425 */
2426 u_int
2427 ieee802_11_if_print(const struct pcap_pkthdr *h, const u_char *p)
2428 {
2429 return ieee802_11_print(p, h->len, h->caplen, 0, 0);
2430 }
2431
2432 #define IEEE80211_CHAN_FHSS \
2433 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_GFSK)
2434 #define IEEE80211_CHAN_A \
2435 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2436 #define IEEE80211_CHAN_B \
2437 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
2438 #define IEEE80211_CHAN_PUREG \
2439 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_OFDM)
2440 #define IEEE80211_CHAN_G \
2441 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
2442
2443 #define IS_CHAN_FHSS(flags) \
2444 ((flags & IEEE80211_CHAN_FHSS) == IEEE80211_CHAN_FHSS)
2445 #define IS_CHAN_A(flags) \
2446 ((flags & IEEE80211_CHAN_A) == IEEE80211_CHAN_A)
2447 #define IS_CHAN_B(flags) \
2448 ((flags & IEEE80211_CHAN_B) == IEEE80211_CHAN_B)
2449 #define IS_CHAN_PUREG(flags) \
2450 ((flags & IEEE80211_CHAN_PUREG) == IEEE80211_CHAN_PUREG)
2451 #define IS_CHAN_G(flags) \
2452 ((flags & IEEE80211_CHAN_G) == IEEE80211_CHAN_G)
2453 #define IS_CHAN_ANYG(flags) \
2454 (IS_CHAN_PUREG(flags) || IS_CHAN_G(flags))
2455
2456 static void
2457 print_chaninfo(int freq, int flags)
2458 {
2459 printf("%u MHz", freq);
2460 if (IS_CHAN_FHSS(flags))
2461 printf(" FHSS");
2462 if (IS_CHAN_A(flags)) {
2463 if (flags & IEEE80211_CHAN_HALF)
2464 printf(" 11a/10Mhz");
2465 else if (flags & IEEE80211_CHAN_QUARTER)
2466 printf(" 11a/5Mhz");
2467 else
2468 printf(" 11a");
2469 }
2470 if (IS_CHAN_ANYG(flags)) {
2471 if (flags & IEEE80211_CHAN_HALF)
2472 printf(" 11g/10Mhz");
2473 else if (flags & IEEE80211_CHAN_QUARTER)
2474 printf(" 11g/5Mhz");
2475 else
2476 printf(" 11g");
2477 } else if (IS_CHAN_B(flags))
2478 printf(" 11b");
2479 if (flags & IEEE80211_CHAN_TURBO)
2480 printf(" Turbo");
2481 if (flags & IEEE80211_CHAN_HT20)
2482 printf(" ht/20");
2483 else if (flags & IEEE80211_CHAN_HT40D)
2484 printf(" ht/40-");
2485 else if (flags & IEEE80211_CHAN_HT40U)
2486 printf(" ht/40+");
2487 printf(" ");
2488 }
2489
2490 static int
2491 print_radiotap_field(struct cpack_state *s, u_int32_t bit, u_int8_t *flags,
2492 struct radiotap_state *state, u_int32_t presentflags)
2493 {
2494 union {
2495 int8_t i8;
2496 u_int8_t u8;
2497 int16_t i16;
2498 u_int16_t u16;
2499 u_int32_t u32;
2500 u_int64_t u64;
2501 } u, u2, u3, u4;
2502 int rc;
2503
2504 switch (bit) {
2505 case IEEE80211_RADIOTAP_FLAGS:
2506 rc = cpack_uint8(s, &u.u8);
2507 if (rc != 0)
2508 break;
2509 *flags = u.u8;
2510 break;
2511 case IEEE80211_RADIOTAP_RATE:
2512 rc = cpack_uint8(s, &u.u8);
2513 if (rc != 0)
2514 break;
2515
2516 /* Save state rate */
2517 state->rate = u.u8;
2518 break;
2519 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
2520 case IEEE80211_RADIOTAP_DB_ANTNOISE:
2521 case IEEE80211_RADIOTAP_ANTENNA:
2522 rc = cpack_uint8(s, &u.u8);
2523 break;
2524 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
2525 case IEEE80211_RADIOTAP_DBM_ANTNOISE:
2526 rc = cpack_int8(s, &u.i8);
2527 break;
2528 case IEEE80211_RADIOTAP_CHANNEL:
2529 rc = cpack_uint16(s, &u.u16);
2530 if (rc != 0)
2531 break;
2532 rc = cpack_uint16(s, &u2.u16);
2533 break;
2534 case IEEE80211_RADIOTAP_FHSS:
2535 case IEEE80211_RADIOTAP_LOCK_QUALITY:
2536 case IEEE80211_RADIOTAP_TX_ATTENUATION:
2537 case IEEE80211_RADIOTAP_RX_FLAGS:
2538 rc = cpack_uint16(s, &u.u16);
2539 break;
2540 case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
2541 rc = cpack_uint8(s, &u.u8);
2542 break;
2543 case IEEE80211_RADIOTAP_DBM_TX_POWER:
2544 rc = cpack_int8(s, &u.i8);
2545 break;
2546 case IEEE80211_RADIOTAP_TSFT:
2547 rc = cpack_uint64(s, &u.u64);
2548 break;
2549 case IEEE80211_RADIOTAP_XCHANNEL:
2550 rc = cpack_uint32(s, &u.u32);
2551 if (rc != 0)
2552 break;
2553 rc = cpack_uint16(s, &u2.u16);
2554 if (rc != 0)
2555 break;
2556 rc = cpack_uint8(s, &u3.u8);
2557 if (rc != 0)
2558 break;
2559 rc = cpack_uint8(s, &u4.u8);
2560 break;
2561 case IEEE80211_RADIOTAP_MCS:
2562 rc = cpack_uint8(s, &u.u8);
2563 if (rc != 0)
2564 break;
2565 rc = cpack_uint8(s, &u2.u8);
2566 if (rc != 0)
2567 break;
2568 rc = cpack_uint8(s, &u3.u8);
2569 break;
2570 case IEEE80211_RADIOTAP_VENDOR_NAMESPACE: {
2571 u_int8_t vns[3];
2572 u_int16_t length;
2573 u_int8_t subspace;
2574
2575 if ((cpack_align_and_reserve(s, 2)) == NULL) {
2576 rc = -1;
2577 break;
2578 }
2579
2580 rc = cpack_uint8(s, &vns[0]);
2581 if (rc != 0)
2582 break;
2583 rc = cpack_uint8(s, &vns[1]);
2584 if (rc != 0)
2585 break;
2586 rc = cpack_uint8(s, &vns[2]);
2587 if (rc != 0)
2588 break;
2589 rc = cpack_uint8(s, &subspace);
2590 if (rc != 0)
2591 break;
2592 rc = cpack_uint16(s, &length);
2593 if (rc != 0)
2594 break;
2595
2596 /* Skip up to length */
2597 s->c_next += length;
2598 break;
2599 }
2600 default:
2601 /* this bit indicates a field whose
2602 * size we do not know, so we cannot
2603 * proceed. Just print the bit number.
2604 */
2605 printf("[bit %u] ", bit);
2606 return -1;
2607 }
2608
2609 if (rc != 0) {
2610 printf("%s", tstr);
2611 return rc;
2612 }
2613
2614 /* Preserve the state present flags */
2615 state->present = presentflags;
2616
2617 switch (bit) {
2618 case IEEE80211_RADIOTAP_CHANNEL:
2619 /*
2620 * If CHANNEL and XCHANNEL are both present, skip
2621 * CHANNEL.
2622 */
2623 if (presentflags & (1 << IEEE80211_RADIOTAP_XCHANNEL))
2624 break;
2625 print_chaninfo(u.u16, u2.u16);
2626 break;
2627 case IEEE80211_RADIOTAP_FHSS:
2628 printf("fhset %d fhpat %d ", u.u16 & 0xff, (u.u16 >> 8) & 0xff);
2629 break;
2630 case IEEE80211_RADIOTAP_RATE:
2631 /*
2632 * XXX On FreeBSD rate & 0x80 means we have an MCS. On
2633 * Linux and AirPcap it does not. (What about
2634 * Mac OS X, NetBSD, OpenBSD, and DragonFly BSD?)
2635 *
2636 * This is an issue either for proprietary extensions
2637 * to 11a or 11g, which do exist, or for 11n
2638 * implementations that stuff a rate value into
2639 * this field, which also appear to exist.
2640 *
2641 * We currently handle that by assuming that
2642 * if the 0x80 bit is set *and* the remaining
2643 * bits have a value between 0 and 15 it's
2644 * an MCS value, otherwise it's a rate. If
2645 * there are cases where systems that use
2646 * "0x80 + MCS index" for MCS indices > 15,
2647 * or stuff a rate value here between 64 and
2648 * 71.5 Mb/s in here, we'll need a preference
2649 * setting. Such rates do exist, e.g. 11n
2650 * MCS 7 at 20 MHz with a long guard interval.
2651 */
2652 if (u.u8 >= 0x80 && u.u8 <= 0x8f) {
2653 /*
2654 * XXX - we don't know the channel width
2655 * or guard interval length, so we can't
2656 * convert this to a data rate.
2657 *
2658 * If you want us to show a data rate,
2659 * use the MCS field, not the Rate field;
2660 * the MCS field includes not only the
2661 * MCS index, it also includes bandwidth
2662 * and guard interval information.
2663 *
2664 * XXX - can we get the channel width
2665 * from XChannel and the guard interval
2666 * information from Flags, at least on
2667 * FreeBSD?
2668 */
2669 printf("MCS %u ", u.u8 & 0x7f);
2670 } else
2671 printf("%2.1f Mb/s ", .5*u.u8);
2672 break;
2673 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
2674 printf("%ddB signal ", u.i8);
2675 break;
2676 case IEEE80211_RADIOTAP_DBM_ANTNOISE:
2677 printf("%ddB noise ", u.i8);
2678 break;
2679 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
2680 printf("%ddB signal ", u.u8);
2681 break;
2682 case IEEE80211_RADIOTAP_DB_ANTNOISE:
2683 printf("%ddB noise ", u.u8);
2684 break;
2685 case IEEE80211_RADIOTAP_LOCK_QUALITY:
2686 printf("%u sq ", u.u16);
2687 break;
2688 case IEEE80211_RADIOTAP_TX_ATTENUATION:
2689 printf("%d tx power ", -(int)u.u16);
2690 break;
2691 case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
2692 printf("%ddB tx power ", -(int)u.u8);
2693 break;
2694 case IEEE80211_RADIOTAP_DBM_TX_POWER:
2695 printf("%ddBm tx power ", u.i8);
2696 break;
2697 case IEEE80211_RADIOTAP_FLAGS:
2698 if (u.u8 & IEEE80211_RADIOTAP_F_CFP)
2699 printf("cfp ");
2700 if (u.u8 & IEEE80211_RADIOTAP_F_SHORTPRE)
2701 printf("short preamble ");
2702 if (u.u8 & IEEE80211_RADIOTAP_F_WEP)
2703 printf("wep ");
2704 if (u.u8 & IEEE80211_RADIOTAP_F_FRAG)
2705 printf("fragmented ");
2706 if (u.u8 & IEEE80211_RADIOTAP_F_BADFCS)
2707 printf("bad-fcs ");
2708 break;
2709 case IEEE80211_RADIOTAP_ANTENNA:
2710 printf("antenna %d ", u.u8);
2711 break;
2712 case IEEE80211_RADIOTAP_TSFT:
2713 printf("%" PRIu64 "us tsft ", u.u64);
2714 break;
2715 case IEEE80211_RADIOTAP_RX_FLAGS:
2716 /* Do nothing for now */
2717 break;
2718 case IEEE80211_RADIOTAP_XCHANNEL:
2719 print_chaninfo(u2.u16, u.u32);
2720 break;
2721 case IEEE80211_RADIOTAP_MCS: {
2722 static const char *bandwidth[4] = {
2723 "20 MHz",
2724 "40 MHz",
2725 "20 MHz (L)",
2726 "20 MHz (U)"
2727 };
2728 float htrate;
2729
2730 if (u.u8 & IEEE80211_RADIOTAP_MCS_MCS_INDEX_KNOWN) {
2731 /*
2732 * We know the MCS index.
2733 */
2734 if (u3.u8 <= MAX_MCS_INDEX) {
2735 /*
2736 * And it's in-range.
2737 */
2738 if (u.u8 & (IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN|IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN)) {
2739 /*
2740 * And we know both the bandwidth and
2741 * the guard interval, so we can look
2742 * up the rate.
2743 */
2744 htrate =
2745 ieee80211_float_htrates \
2746 [u3.u8] \
2747 [((u2.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK) == IEEE80211_RADIOTAP_MCS_BANDWIDTH_40 ? 1 : 0)] \
2748 [((u2.u8 & IEEE80211_RADIOTAP_MCS_SHORT_GI) ? 1 : 0)];
2749 } else {
2750 /*
2751 * We don't know both the bandwidth
2752 * and the guard interval, so we can
2753 * only report the MCS index.
2754 */
2755 htrate = 0.0;
2756 }
2757 } else {
2758 /*
2759 * The MCS value is out of range.
2760 */
2761 htrate = 0.0;
2762 }
2763 if (htrate != 0.0) {
2764 /*
2765 * We have the rate.
2766 * Print it.
2767 */
2768 printf("%.1f Mb/s MCS %u ", htrate, u3.u8);
2769 } else {
2770 /*
2771 * We at least have the MCS index.
2772 * Print it.
2773 */
2774 printf("MCS %u ", u3.u8);
2775 }
2776 }
2777 if (u.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN) {
2778 printf("%s ",
2779 bandwidth[u2.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK]);
2780 }
2781 if (u.u8 & IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN) {
2782 printf("%s GI ",
2783 (u2.u8 & IEEE80211_RADIOTAP_MCS_SHORT_GI) ?
2784 "short" : "lon");
2785 }
2786 if (u.u8 & IEEE80211_RADIOTAP_MCS_HT_FORMAT_KNOWN) {
2787 printf("%s ",
2788 (u2.u8 & IEEE80211_RADIOTAP_MCS_HT_GREENFIELD) ?
2789 "greenfield" : "mixed");
2790 }
2791 if (u.u8 & IEEE80211_RADIOTAP_MCS_FEC_TYPE_KNOWN) {
2792 printf("%s FEC ",
2793 (u2.u8 & IEEE80211_RADIOTAP_MCS_FEC_LDPC) ?
2794 "LDPC" : "BCC");
2795 }
2796 if (u.u8 & IEEE80211_RADIOTAP_MCS_STBC_KNOWN) {
2797 printf("RX-STBC%u ",
2798 (u2.u8 & IEEE80211_RADIOTAP_MCS_STBC_MASK) >> IEEE80211_RADIOTAP_MCS_STBC_SHIFT);
2799 }
2800
2801 break;
2802 }
2803 }
2804 return 0;
2805 }
2806
2807 static u_int
2808 ieee802_11_radio_print(const u_char *p, u_int length, u_int caplen)
2809 {
2810 #define BITNO_32(x) (((x) >> 16) ? 16 + BITNO_16((x) >> 16) : BITNO_16((x)))
2811 #define BITNO_16(x) (((x) >> 8) ? 8 + BITNO_8((x) >> 8) : BITNO_8((x)))
2812 #define BITNO_8(x) (((x) >> 4) ? 4 + BITNO_4((x) >> 4) : BITNO_4((x)))
2813 #define BITNO_4(x) (((x) >> 2) ? 2 + BITNO_2((x) >> 2) : BITNO_2((x)))
2814 #define BITNO_2(x) (((x) & 2) ? 1 : 0)
2815 #define BIT(n) (1U << n)
2816 #define IS_EXTENDED(__p) \
2817 (EXTRACT_LE_32BITS(__p) & BIT(IEEE80211_RADIOTAP_EXT)) != 0
2818
2819 struct cpack_state cpacker;
2820 struct ieee80211_radiotap_header *hdr;
2821 u_int32_t present, next_present;
2822 u_int32_t presentflags = 0;
2823 u_int32_t *presentp, *last_presentp;
2824 enum ieee80211_radiotap_type bit;
2825 int bit0;
2826 u_int len;
2827 u_int8_t flags;
2828 int pad;
2829 u_int fcslen;
2830 struct radiotap_state state;
2831
2832 if (caplen < sizeof(*hdr)) {
2833 printf("%s", tstr);
2834 return caplen;
2835 }
2836
2837 hdr = (struct ieee80211_radiotap_header *)p;
2838
2839 len = EXTRACT_LE_16BITS(&hdr->it_len);
2840
2841 if (caplen < len) {
2842 printf("%s", tstr);
2843 return caplen;
2844 }
2845 cpack_init(&cpacker, (u_int8_t *)hdr, len); /* align against header start */
2846 cpack_advance(&cpacker, sizeof(*hdr)); /* includes the 1st bitmap */
2847 for (last_presentp = &hdr->it_present;
2848 IS_EXTENDED(last_presentp) &&
2849 (u_char*)(last_presentp + 1) <= p + len;
2850 last_presentp++)
2851 cpack_advance(&cpacker, sizeof(hdr->it_present)); /* more bitmaps */
2852
2853 /* are there more bitmap extensions than bytes in header? */
2854 if (IS_EXTENDED(last_presentp)) {
2855 printf("%s", tstr);
2856 return caplen;
2857 }
2858
2859 /* Assume no flags */
2860 flags = 0;
2861 /* Assume no Atheros padding between 802.11 header and body */
2862 pad = 0;
2863 /* Assume no FCS at end of frame */
2864 fcslen = 0;
2865 for (bit0 = 0, presentp = &hdr->it_present; presentp <= last_presentp;
2866 presentp++, bit0 += 32) {
2867 presentflags = EXTRACT_LE_32BITS(presentp);
2868
2869 /* Clear state. */
2870 memset(&state, 0, sizeof(state));
2871
2872 for (present = EXTRACT_LE_32BITS(presentp); present;
2873 present = next_present) {
2874 /* clear the least significant bit that is set */
2875 next_present = present & (present - 1);
2876
2877 /* extract the least significant bit that is set */
2878 bit = (enum ieee80211_radiotap_type)
2879 (bit0 + BITNO_32(present ^ next_present));
2880
2881 if (print_radiotap_field(&cpacker, bit, &flags, &state, presentflags) != 0)
2882 goto out;
2883 }
2884 }
2885
2886 out:
2887 if (flags & IEEE80211_RADIOTAP_F_DATAPAD)
2888 pad = 1; /* Atheros padding */
2889 if (flags & IEEE80211_RADIOTAP_F_FCS)
2890 fcslen = 4; /* FCS at end of packet */
2891 return len + ieee802_11_print(p + len, length - len, caplen - len, pad,
2892 fcslen);
2893 #undef BITNO_32
2894 #undef BITNO_16
2895 #undef BITNO_8
2896 #undef BITNO_4
2897 #undef BITNO_2
2898 #undef BIT
2899 }
2900
2901 static u_int
2902 ieee802_11_avs_radio_print(const u_char *p, u_int length, u_int caplen)
2903 {
2904 u_int32_t caphdr_len;
2905
2906 if (caplen < 8) {
2907 printf("%s", tstr);
2908 return caplen;
2909 }
2910
2911 caphdr_len = EXTRACT_32BITS(p + 4);
2912 if (caphdr_len < 8) {
2913 /*
2914 * Yow! The capture header length is claimed not
2915 * to be large enough to include even the version
2916 * cookie or capture header length!
2917 */
2918 printf("%s", tstr);
2919 return caplen;
2920 }
2921
2922 if (caplen < caphdr_len) {
2923 printf("%s", tstr);
2924 return caplen;
2925 }
2926
2927 return caphdr_len + ieee802_11_print(p + caphdr_len,
2928 length - caphdr_len, caplen - caphdr_len, 0, 0);
2929 }
2930
2931 #define PRISM_HDR_LEN 144
2932
2933 #define WLANCAP_MAGIC_COOKIE_BASE 0x80211000
2934 #define WLANCAP_MAGIC_COOKIE_V1 0x80211001
2935 #define WLANCAP_MAGIC_COOKIE_V2 0x80211002
2936
2937 /*
2938 * For DLT_PRISM_HEADER; like DLT_IEEE802_11, but with an extra header,
2939 * containing information such as radio information, which we
2940 * currently ignore.
2941 *
2942 * If, however, the packet begins with WLANCAP_MAGIC_COOKIE_V1 or
2943 * WLANCAP_MAGIC_COOKIE_V2, it's really DLT_IEEE802_11_RADIO_AVS
2944 * (currently, on Linux, there's no ARPHRD_ type for
2945 * DLT_IEEE802_11_RADIO_AVS, as there is a ARPHRD_IEEE80211_PRISM
2946 * for DLT_PRISM_HEADER, so ARPHRD_IEEE80211_PRISM is used for
2947 * the AVS header, and the first 4 bytes of the header are used to
2948 * indicate whether it's a Prism header or an AVS header).
2949 */
2950 u_int
2951 prism_if_print(const struct pcap_pkthdr *h, const u_char *p)
2952 {
2953 u_int caplen = h->caplen;
2954 u_int length = h->len;
2955 u_int32_t msgcode;
2956
2957 if (caplen < 4) {
2958 printf("%s", tstr);
2959 return caplen;
2960 }
2961
2962 msgcode = EXTRACT_32BITS(p);
2963 if (msgcode == WLANCAP_MAGIC_COOKIE_V1 ||
2964 msgcode == WLANCAP_MAGIC_COOKIE_V2)
2965 return ieee802_11_avs_radio_print(p, length, caplen);
2966
2967 if (caplen < PRISM_HDR_LEN) {
2968 printf("%s", tstr);
2969 return caplen;
2970 }
2971
2972 return PRISM_HDR_LEN + ieee802_11_print(p + PRISM_HDR_LEN,
2973 length - PRISM_HDR_LEN, caplen - PRISM_HDR_LEN, 0, 0);
2974 }
2975
2976 /*
2977 * For DLT_IEEE802_11_RADIO; like DLT_IEEE802_11, but with an extra
2978 * header, containing information such as radio information.
2979 */
2980 u_int
2981 ieee802_11_radio_if_print(const struct pcap_pkthdr *h, const u_char *p)
2982 {
2983 return ieee802_11_radio_print(p, h->len, h->caplen);
2984 }
2985
2986 /*
2987 * For DLT_IEEE802_11_RADIO_AVS; like DLT_IEEE802_11, but with an
2988 * extra header, containing information such as radio information,
2989 * which we currently ignore.
2990 */
2991 u_int
2992 ieee802_11_radio_avs_if_print(const struct pcap_pkthdr *h, const u_char *p)
2993 {
2994 return ieee802_11_avs_radio_print(p, h->len, h->caplen);
2995 }
[mirror] the TCPdump network dissector