]> The Tcpdump Group git mirrors - tcpdump/blob - print-802_11.c
NDOize safeputs() and safeputchar()
[tcpdump] / print-802_11.c
1 /*
2 * Copyright (c) 2001
3 * Fortress Technologies, Inc. All rights reserved.
4 * Charlie Lenahan (clenahan@fortresstech.com)
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22
23 #define NETDISSECT_REWORKED
24 #ifdef HAVE_CONFIG_H
25 #include "config.h"
26 #endif
27
28 #include <tcpdump-stdinc.h>
29
30 #include <string.h>
31
32 #include "interface.h"
33 #include "addrtoname.h"
34
35 #include "extract.h"
36
37 #include "cpack.h"
38
39
40 /* Lengths of 802.11 header components. */
41 #define IEEE802_11_FC_LEN 2
42 #define IEEE802_11_DUR_LEN 2
43 #define IEEE802_11_DA_LEN 6
44 #define IEEE802_11_SA_LEN 6
45 #define IEEE802_11_BSSID_LEN 6
46 #define IEEE802_11_RA_LEN 6
47 #define IEEE802_11_TA_LEN 6
48 #define IEEE802_11_SEQ_LEN 2
49 #define IEEE802_11_CTL_LEN 2
50 #define IEEE802_11_IV_LEN 3
51 #define IEEE802_11_KID_LEN 1
52
53 /* Frame check sequence length. */
54 #define IEEE802_11_FCS_LEN 4
55
56 /* Lengths of beacon components. */
57 #define IEEE802_11_TSTAMP_LEN 8
58 #define IEEE802_11_BCNINT_LEN 2
59 #define IEEE802_11_CAPINFO_LEN 2
60 #define IEEE802_11_LISTENINT_LEN 2
61
62 #define IEEE802_11_AID_LEN 2
63 #define IEEE802_11_STATUS_LEN 2
64 #define IEEE802_11_REASON_LEN 2
65
66 /* Length of previous AP in reassocation frame */
67 #define IEEE802_11_AP_LEN 6
68
69 #define T_MGMT 0x0 /* management */
70 #define T_CTRL 0x1 /* control */
71 #define T_DATA 0x2 /* data */
72 #define T_RESV 0x3 /* reserved */
73
74 #define ST_ASSOC_REQUEST 0x0
75 #define ST_ASSOC_RESPONSE 0x1
76 #define ST_REASSOC_REQUEST 0x2
77 #define ST_REASSOC_RESPONSE 0x3
78 #define ST_PROBE_REQUEST 0x4
79 #define ST_PROBE_RESPONSE 0x5
80 /* RESERVED 0x6 */
81 /* RESERVED 0x7 */
82 #define ST_BEACON 0x8
83 #define ST_ATIM 0x9
84 #define ST_DISASSOC 0xA
85 #define ST_AUTH 0xB
86 #define ST_DEAUTH 0xC
87 #define ST_ACTION 0xD
88 /* RESERVED 0xE */
89 /* RESERVED 0xF */
90
91
92 #define CTRL_CONTROL_WRAPPER 0x7
93 #define CTRL_BAR 0x8
94 #define CTRL_BA 0x9
95 #define CTRL_PS_POLL 0xA
96 #define CTRL_RTS 0xB
97 #define CTRL_CTS 0xC
98 #define CTRL_ACK 0xD
99 #define CTRL_CF_END 0xE
100 #define CTRL_END_ACK 0xF
101
102 #define DATA_DATA 0x0
103 #define DATA_DATA_CF_ACK 0x1
104 #define DATA_DATA_CF_POLL 0x2
105 #define DATA_DATA_CF_ACK_POLL 0x3
106 #define DATA_NODATA 0x4
107 #define DATA_NODATA_CF_ACK 0x5
108 #define DATA_NODATA_CF_POLL 0x6
109 #define DATA_NODATA_CF_ACK_POLL 0x7
110
111 #define DATA_QOS_DATA 0x8
112 #define DATA_QOS_DATA_CF_ACK 0x9
113 #define DATA_QOS_DATA_CF_POLL 0xA
114 #define DATA_QOS_DATA_CF_ACK_POLL 0xB
115 #define DATA_QOS_NODATA 0xC
116 #define DATA_QOS_CF_POLL_NODATA 0xE
117 #define DATA_QOS_CF_ACK_POLL_NODATA 0xF
118
119 /*
120 * The subtype field of a data frame is, in effect, composed of 4 flag
121 * bits - CF-Ack, CF-Poll, Null (means the frame doesn't actually have
122 * any data), and QoS.
123 */
124 #define DATA_FRAME_IS_CF_ACK(x) ((x) & 0x01)
125 #define DATA_FRAME_IS_CF_POLL(x) ((x) & 0x02)
126 #define DATA_FRAME_IS_NULL(x) ((x) & 0x04)
127 #define DATA_FRAME_IS_QOS(x) ((x) & 0x08)
128
129 /*
130 * Bits in the frame control field.
131 */
132 #define FC_VERSION(fc) ((fc) & 0x3)
133 #define FC_TYPE(fc) (((fc) >> 2) & 0x3)
134 #define FC_SUBTYPE(fc) (((fc) >> 4) & 0xF)
135 #define FC_TO_DS(fc) ((fc) & 0x0100)
136 #define FC_FROM_DS(fc) ((fc) & 0x0200)
137 #define FC_MORE_FLAG(fc) ((fc) & 0x0400)
138 #define FC_RETRY(fc) ((fc) & 0x0800)
139 #define FC_POWER_MGMT(fc) ((fc) & 0x1000)
140 #define FC_MORE_DATA(fc) ((fc) & 0x2000)
141 #define FC_WEP(fc) ((fc) & 0x4000)
142 #define FC_ORDER(fc) ((fc) & 0x8000)
143
144 struct mgmt_header_t {
145 u_int16_t fc;
146 u_int16_t duration;
147 u_int8_t da[6];
148 u_int8_t sa[6];
149 u_int8_t bssid[6];
150 u_int16_t seq_ctrl;
151 };
152
153 #define MGMT_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
154 IEEE802_11_DA_LEN+IEEE802_11_SA_LEN+\
155 IEEE802_11_BSSID_LEN+IEEE802_11_SEQ_LEN)
156
157 #define CAPABILITY_ESS(cap) ((cap) & 0x0001)
158 #define CAPABILITY_IBSS(cap) ((cap) & 0x0002)
159 #define CAPABILITY_CFP(cap) ((cap) & 0x0004)
160 #define CAPABILITY_CFP_REQ(cap) ((cap) & 0x0008)
161 #define CAPABILITY_PRIVACY(cap) ((cap) & 0x0010)
162
163 struct ssid_t {
164 u_int8_t element_id;
165 u_int8_t length;
166 u_char ssid[33]; /* 32 + 1 for null */
167 };
168
169 struct rates_t {
170 u_int8_t element_id;
171 u_int8_t length;
172 u_int8_t rate[16];
173 };
174
175 struct challenge_t {
176 u_int8_t element_id;
177 u_int8_t length;
178 u_int8_t text[254]; /* 1-253 + 1 for null */
179 };
180
181 struct fh_t {
182 u_int8_t element_id;
183 u_int8_t length;
184 u_int16_t dwell_time;
185 u_int8_t hop_set;
186 u_int8_t hop_pattern;
187 u_int8_t hop_index;
188 };
189
190 struct ds_t {
191 u_int8_t element_id;
192 u_int8_t length;
193 u_int8_t channel;
194 };
195
196 struct cf_t {
197 u_int8_t element_id;
198 u_int8_t length;
199 u_int8_t count;
200 u_int8_t period;
201 u_int16_t max_duration;
202 u_int16_t dur_remaing;
203 };
204
205 struct tim_t {
206 u_int8_t element_id;
207 u_int8_t length;
208 u_int8_t count;
209 u_int8_t period;
210 u_int8_t bitmap_control;
211 u_int8_t bitmap[251];
212 };
213
214 #define E_SSID 0
215 #define E_RATES 1
216 #define E_FH 2
217 #define E_DS 3
218 #define E_CF 4
219 #define E_TIM 5
220 #define E_IBSS 6
221 /* reserved 7 */
222 /* reserved 8 */
223 /* reserved 9 */
224 /* reserved 10 */
225 /* reserved 11 */
226 /* reserved 12 */
227 /* reserved 13 */
228 /* reserved 14 */
229 /* reserved 15 */
230 /* reserved 16 */
231
232 #define E_CHALLENGE 16
233 /* reserved 17 */
234 /* reserved 18 */
235 /* reserved 19 */
236 /* reserved 16 */
237 /* reserved 16 */
238
239
240 struct mgmt_body_t {
241 u_int8_t timestamp[IEEE802_11_TSTAMP_LEN];
242 u_int16_t beacon_interval;
243 u_int16_t listen_interval;
244 u_int16_t status_code;
245 u_int16_t aid;
246 u_char ap[IEEE802_11_AP_LEN];
247 u_int16_t reason_code;
248 u_int16_t auth_alg;
249 u_int16_t auth_trans_seq_num;
250 int challenge_present;
251 struct challenge_t challenge;
252 u_int16_t capability_info;
253 int ssid_present;
254 struct ssid_t ssid;
255 int rates_present;
256 struct rates_t rates;
257 int ds_present;
258 struct ds_t ds;
259 int cf_present;
260 struct cf_t cf;
261 int fh_present;
262 struct fh_t fh;
263 int tim_present;
264 struct tim_t tim;
265 };
266
267 struct ctrl_rts_t {
268 u_int16_t fc;
269 u_int16_t duration;
270 u_int8_t ra[6];
271 u_int8_t ta[6];
272 u_int8_t fcs[4];
273 };
274
275 #define CTRL_RTS_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
276 IEEE802_11_RA_LEN+IEEE802_11_TA_LEN)
277
278 struct ctrl_cts_t {
279 u_int16_t fc;
280 u_int16_t duration;
281 u_int8_t ra[6];
282 u_int8_t fcs[4];
283 };
284
285 #define CTRL_CTS_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
286
287 struct ctrl_ack_t {
288 u_int16_t fc;
289 u_int16_t duration;
290 u_int8_t ra[6];
291 u_int8_t fcs[4];
292 };
293
294 #define CTRL_ACK_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
295
296 struct ctrl_ps_poll_t {
297 u_int16_t fc;
298 u_int16_t aid;
299 u_int8_t bssid[6];
300 u_int8_t ta[6];
301 u_int8_t fcs[4];
302 };
303
304 #define CTRL_PS_POLL_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_AID_LEN+\
305 IEEE802_11_BSSID_LEN+IEEE802_11_TA_LEN)
306
307 struct ctrl_end_t {
308 u_int16_t fc;
309 u_int16_t duration;
310 u_int8_t ra[6];
311 u_int8_t bssid[6];
312 u_int8_t fcs[4];
313 };
314
315 #define CTRL_END_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
316 IEEE802_11_RA_LEN+IEEE802_11_BSSID_LEN)
317
318 struct ctrl_end_ack_t {
319 u_int16_t fc;
320 u_int16_t duration;
321 u_int8_t ra[6];
322 u_int8_t bssid[6];
323 u_int8_t fcs[4];
324 };
325
326 #define CTRL_END_ACK_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
327 IEEE802_11_RA_LEN+IEEE802_11_BSSID_LEN)
328
329 struct ctrl_ba_t {
330 u_int16_t fc;
331 u_int16_t duration;
332 u_int8_t ra[6];
333 u_int8_t fcs[4];
334 };
335
336 #define CTRL_BA_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
337
338 struct ctrl_bar_t {
339 u_int16_t fc;
340 u_int16_t dur;
341 u_int8_t ra[6];
342 u_int8_t ta[6];
343 u_int16_t ctl;
344 u_int16_t seq;
345 u_int8_t fcs[4];
346 };
347
348 #define CTRL_BAR_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
349 IEEE802_11_RA_LEN+IEEE802_11_TA_LEN+\
350 IEEE802_11_CTL_LEN+IEEE802_11_SEQ_LEN)
351
352 struct meshcntl_t {
353 u_int8_t flags;
354 u_int8_t ttl;
355 u_int8_t seq[4];
356 u_int8_t addr4[6];
357 u_int8_t addr5[6];
358 u_int8_t addr6[6];
359 };
360
361 #define IV_IV(iv) ((iv) & 0xFFFFFF)
362 #define IV_PAD(iv) (((iv) >> 24) & 0x3F)
363 #define IV_KEYID(iv) (((iv) >> 30) & 0x03)
364
365 /* $FreeBSD: src/sys/net80211/ieee80211_radiotap.h,v 1.5 2005/01/22 20:12:05 sam Exp $ */
366 /* NetBSD: ieee802_11_radio.h,v 1.2 2006/02/26 03:04:03 dyoung Exp */
367
368 /*-
369 * Copyright (c) 2003, 2004 David Young. All rights reserved.
370 *
371 * Redistribution and use in source and binary forms, with or without
372 * modification, are permitted provided that the following conditions
373 * are met:
374 * 1. Redistributions of source code must retain the above copyright
375 * notice, this list of conditions and the following disclaimer.
376 * 2. Redistributions in binary form must reproduce the above copyright
377 * notice, this list of conditions and the following disclaimer in the
378 * documentation and/or other materials provided with the distribution.
379 * 3. The name of David Young may not be used to endorse or promote
380 * products derived from this software without specific prior
381 * written permission.
382 *
383 * THIS SOFTWARE IS PROVIDED BY DAVID YOUNG ``AS IS'' AND ANY
384 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
385 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
386 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID
387 * YOUNG BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
388 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
389 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
390 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
391 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
392 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
393 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
394 * OF SUCH DAMAGE.
395 */
396
397 /* A generic radio capture format is desirable. It must be
398 * rigidly defined (e.g., units for fields should be given),
399 * and easily extensible.
400 *
401 * The following is an extensible radio capture format. It is
402 * based on a bitmap indicating which fields are present.
403 *
404 * I am trying to describe precisely what the application programmer
405 * should expect in the following, and for that reason I tell the
406 * units and origin of each measurement (where it applies), or else I
407 * use sufficiently weaselly language ("is a monotonically nondecreasing
408 * function of...") that I cannot set false expectations for lawyerly
409 * readers.
410 */
411
412 /*
413 * The radio capture header precedes the 802.11 header.
414 *
415 * Note well: all radiotap fields are little-endian.
416 */
417 struct ieee80211_radiotap_header {
418 u_int8_t it_version; /* Version 0. Only increases
419 * for drastic changes,
420 * introduction of compatible
421 * new fields does not count.
422 */
423 u_int8_t it_pad;
424 u_int16_t it_len; /* length of the whole
425 * header in bytes, including
426 * it_version, it_pad,
427 * it_len, and data fields.
428 */
429 u_int32_t it_present; /* A bitmap telling which
430 * fields are present. Set bit 31
431 * (0x80000000) to extend the
432 * bitmap by another 32 bits.
433 * Additional extensions are made
434 * by setting bit 31.
435 */
436 };
437
438 /* Name Data type Units
439 * ---- --------- -----
440 *
441 * IEEE80211_RADIOTAP_TSFT u_int64_t microseconds
442 *
443 * Value in microseconds of the MAC's 64-bit 802.11 Time
444 * Synchronization Function timer when the first bit of the
445 * MPDU arrived at the MAC. For received frames, only.
446 *
447 * IEEE80211_RADIOTAP_CHANNEL 2 x u_int16_t MHz, bitmap
448 *
449 * Tx/Rx frequency in MHz, followed by flags (see below).
450 * Note that IEEE80211_RADIOTAP_XCHANNEL must be used to
451 * represent an HT channel as there is not enough room in
452 * the flags word.
453 *
454 * IEEE80211_RADIOTAP_FHSS u_int16_t see below
455 *
456 * For frequency-hopping radios, the hop set (first byte)
457 * and pattern (second byte).
458 *
459 * IEEE80211_RADIOTAP_RATE u_int8_t 500kb/s or index
460 *
461 * Tx/Rx data rate. If bit 0x80 is set then it represents an
462 * an MCS index and not an IEEE rate.
463 *
464 * IEEE80211_RADIOTAP_DBM_ANTSIGNAL int8_t decibels from
465 * one milliwatt (dBm)
466 *
467 * RF signal power at the antenna, decibel difference from
468 * one milliwatt.
469 *
470 * IEEE80211_RADIOTAP_DBM_ANTNOISE int8_t decibels from
471 * one milliwatt (dBm)
472 *
473 * RF noise power at the antenna, decibel difference from one
474 * milliwatt.
475 *
476 * IEEE80211_RADIOTAP_DB_ANTSIGNAL u_int8_t decibel (dB)
477 *
478 * RF signal power at the antenna, decibel difference from an
479 * arbitrary, fixed reference.
480 *
481 * IEEE80211_RADIOTAP_DB_ANTNOISE u_int8_t decibel (dB)
482 *
483 * RF noise power at the antenna, decibel difference from an
484 * arbitrary, fixed reference point.
485 *
486 * IEEE80211_RADIOTAP_LOCK_QUALITY u_int16_t unitless
487 *
488 * Quality of Barker code lock. Unitless. Monotonically
489 * nondecreasing with "better" lock strength. Called "Signal
490 * Quality" in datasheets. (Is there a standard way to measure
491 * this?)
492 *
493 * IEEE80211_RADIOTAP_TX_ATTENUATION u_int16_t unitless
494 *
495 * Transmit power expressed as unitless distance from max
496 * power set at factory calibration. 0 is max power.
497 * Monotonically nondecreasing with lower power levels.
498 *
499 * IEEE80211_RADIOTAP_DB_TX_ATTENUATION u_int16_t decibels (dB)
500 *
501 * Transmit power expressed as decibel distance from max power
502 * set at factory calibration. 0 is max power. Monotonically
503 * nondecreasing with lower power levels.
504 *
505 * IEEE80211_RADIOTAP_DBM_TX_POWER int8_t decibels from
506 * one milliwatt (dBm)
507 *
508 * Transmit power expressed as dBm (decibels from a 1 milliwatt
509 * reference). This is the absolute power level measured at
510 * the antenna port.
511 *
512 * IEEE80211_RADIOTAP_FLAGS u_int8_t bitmap
513 *
514 * Properties of transmitted and received frames. See flags
515 * defined below.
516 *
517 * IEEE80211_RADIOTAP_ANTENNA u_int8_t antenna index
518 *
519 * Unitless indication of the Rx/Tx antenna for this packet.
520 * The first antenna is antenna 0.
521 *
522 * IEEE80211_RADIOTAP_RX_FLAGS u_int16_t bitmap
523 *
524 * Properties of received frames. See flags defined below.
525 *
526 * IEEE80211_RADIOTAP_XCHANNEL u_int32_t bitmap
527 * u_int16_t MHz
528 * u_int8_t channel number
529 * u_int8_t .5 dBm
530 *
531 * Extended channel specification: flags (see below) followed by
532 * frequency in MHz, the corresponding IEEE channel number, and
533 * finally the maximum regulatory transmit power cap in .5 dBm
534 * units. This property supersedes IEEE80211_RADIOTAP_CHANNEL
535 * and only one of the two should be present.
536 *
537 * IEEE80211_RADIOTAP_MCS u_int8_t known
538 * u_int8_t flags
539 * u_int8_t mcs
540 *
541 * Bitset indicating which fields have known values, followed
542 * by bitset of flag values, followed by the MCS rate index as
543 * in IEEE 802.11n.
544 *
545 * IEEE80211_RADIOTAP_VENDOR_NAMESPACE
546 * u_int8_t OUI[3]
547 * u_int8_t subspace
548 * u_int16_t length
549 *
550 * The Vendor Namespace Field contains three sub-fields. The first
551 * sub-field is 3 bytes long. It contains the vendor's IEEE 802
552 * Organizationally Unique Identifier (OUI). The fourth byte is a
553 * vendor-specific "namespace selector."
554 *
555 */
556 enum ieee80211_radiotap_type {
557 IEEE80211_RADIOTAP_TSFT = 0,
558 IEEE80211_RADIOTAP_FLAGS = 1,
559 IEEE80211_RADIOTAP_RATE = 2,
560 IEEE80211_RADIOTAP_CHANNEL = 3,
561 IEEE80211_RADIOTAP_FHSS = 4,
562 IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
563 IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
564 IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
565 IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
566 IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
567 IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
568 IEEE80211_RADIOTAP_ANTENNA = 11,
569 IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
570 IEEE80211_RADIOTAP_DB_ANTNOISE = 13,
571 IEEE80211_RADIOTAP_RX_FLAGS = 14,
572 /* NB: gap for netbsd definitions */
573 IEEE80211_RADIOTAP_XCHANNEL = 18,
574 IEEE80211_RADIOTAP_MCS = 19,
575 IEEE80211_RADIOTAP_NAMESPACE = 29,
576 IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30,
577 IEEE80211_RADIOTAP_EXT = 31
578 };
579
580 /* channel attributes */
581 #define IEEE80211_CHAN_TURBO 0x00010 /* Turbo channel */
582 #define IEEE80211_CHAN_CCK 0x00020 /* CCK channel */
583 #define IEEE80211_CHAN_OFDM 0x00040 /* OFDM channel */
584 #define IEEE80211_CHAN_2GHZ 0x00080 /* 2 GHz spectrum channel. */
585 #define IEEE80211_CHAN_5GHZ 0x00100 /* 5 GHz spectrum channel */
586 #define IEEE80211_CHAN_PASSIVE 0x00200 /* Only passive scan allowed */
587 #define IEEE80211_CHAN_DYN 0x00400 /* Dynamic CCK-OFDM channel */
588 #define IEEE80211_CHAN_GFSK 0x00800 /* GFSK channel (FHSS PHY) */
589 #define IEEE80211_CHAN_GSM 0x01000 /* 900 MHz spectrum channel */
590 #define IEEE80211_CHAN_STURBO 0x02000 /* 11a static turbo channel only */
591 #define IEEE80211_CHAN_HALF 0x04000 /* Half rate channel */
592 #define IEEE80211_CHAN_QUARTER 0x08000 /* Quarter rate channel */
593 #define IEEE80211_CHAN_HT20 0x10000 /* HT 20 channel */
594 #define IEEE80211_CHAN_HT40U 0x20000 /* HT 40 channel w/ ext above */
595 #define IEEE80211_CHAN_HT40D 0x40000 /* HT 40 channel w/ ext below */
596
597 /* Useful combinations of channel characteristics, borrowed from Ethereal */
598 #define IEEE80211_CHAN_A \
599 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
600 #define IEEE80211_CHAN_B \
601 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
602 #define IEEE80211_CHAN_G \
603 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
604 #define IEEE80211_CHAN_TA \
605 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM | IEEE80211_CHAN_TURBO)
606 #define IEEE80211_CHAN_TG \
607 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN | IEEE80211_CHAN_TURBO)
608
609
610 /* For IEEE80211_RADIOTAP_FLAGS */
611 #define IEEE80211_RADIOTAP_F_CFP 0x01 /* sent/received
612 * during CFP
613 */
614 #define IEEE80211_RADIOTAP_F_SHORTPRE 0x02 /* sent/received
615 * with short
616 * preamble
617 */
618 #define IEEE80211_RADIOTAP_F_WEP 0x04 /* sent/received
619 * with WEP encryption
620 */
621 #define IEEE80211_RADIOTAP_F_FRAG 0x08 /* sent/received
622 * with fragmentation
623 */
624 #define IEEE80211_RADIOTAP_F_FCS 0x10 /* frame includes FCS */
625 #define IEEE80211_RADIOTAP_F_DATAPAD 0x20 /* frame has padding between
626 * 802.11 header and payload
627 * (to 32-bit boundary)
628 */
629 #define IEEE80211_RADIOTAP_F_BADFCS 0x40 /* does not pass FCS check */
630
631 /* For IEEE80211_RADIOTAP_RX_FLAGS */
632 #define IEEE80211_RADIOTAP_F_RX_BADFCS 0x0001 /* frame failed crc check */
633 #define IEEE80211_RADIOTAP_F_RX_PLCP_CRC 0x0002 /* frame failed PLCP CRC check */
634
635 /* For IEEE80211_RADIOTAP_MCS known */
636 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN 0x01
637 #define IEEE80211_RADIOTAP_MCS_MCS_INDEX_KNOWN 0x02 /* MCS index field */
638 #define IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN 0x04
639 #define IEEE80211_RADIOTAP_MCS_HT_FORMAT_KNOWN 0x08
640 #define IEEE80211_RADIOTAP_MCS_FEC_TYPE_KNOWN 0x10
641 #define IEEE80211_RADIOTAP_MCS_STBC_KNOWN 0x20
642
643 /* For IEEE80211_RADIOTAP_MCS flags */
644 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK 0x03
645 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20 0
646 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_40 1
647 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20L 2
648 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20U 3
649 #define IEEE80211_RADIOTAP_MCS_SHORT_GI 0x04 /* short guard interval */
650 #define IEEE80211_RADIOTAP_MCS_HT_GREENFIELD 0x08
651 #define IEEE80211_RADIOTAP_MCS_FEC_LDPC 0x10
652 #define IEEE80211_RADIOTAP_MCS_STBC_MASK 0x60
653 #define IEEE80211_RADIOTAP_MCS_STBC_1 1
654 #define IEEE80211_RADIOTAP_MCS_STBC_2 2
655 #define IEEE80211_RADIOTAP_MCS_STBC_3 3
656 #define IEEE80211_RADIOTAP_MCS_STBC_SHIFT 5
657
658 static const char tstr[] = "[|802.11]";
659
660 /* Radiotap state */
661 /* This is used to save state when parsing/processing parameters */
662 struct radiotap_state
663 {
664 u_int32_t present;
665
666 u_int8_t rate;
667 };
668
669 #define PRINT_SSID(p) \
670 if (p.ssid_present) { \
671 ND_PRINT((ndo, " (")); \
672 fn_print(p.ssid.ssid, NULL); \
673 ND_PRINT((ndo, ")")); \
674 }
675
676 #define PRINT_RATE(_sep, _r, _suf) \
677 ND_PRINT((ndo, "%s%2.1f%s", _sep, (.5 * ((_r) & 0x7f)), _suf))
678 #define PRINT_RATES(p) \
679 if (p.rates_present) { \
680 int z; \
681 const char *sep = " ["; \
682 for (z = 0; z < p.rates.length ; z++) { \
683 PRINT_RATE(sep, p.rates.rate[z], \
684 (p.rates.rate[z] & 0x80 ? "*" : "")); \
685 sep = " "; \
686 } \
687 if (p.rates.length != 0) \
688 ND_PRINT((ndo, " Mbit]")); \
689 }
690
691 #define PRINT_DS_CHANNEL(p) \
692 if (p.ds_present) \
693 ND_PRINT((ndo, " CH: %u", p.ds.channel)); \
694 ND_PRINT((ndo, "%s", \
695 CAPABILITY_PRIVACY(p.capability_info) ? ", PRIVACY" : ""));
696
697 #define MAX_MCS_INDEX 76
698
699 /*
700 * Indices are:
701 *
702 * the MCS index (0-76);
703 *
704 * 0 for 20 MHz, 1 for 40 MHz;
705 *
706 * 0 for a long guard interval, 1 for a short guard interval.
707 */
708 static const float ieee80211_float_htrates[MAX_MCS_INDEX+1][2][2] = {
709 /* MCS 0 */
710 { /* 20 Mhz */ { 6.5, /* SGI */ 7.2, },
711 /* 40 Mhz */ { 13.5, /* SGI */ 15.0, },
712 },
713
714 /* MCS 1 */
715 { /* 20 Mhz */ { 13.0, /* SGI */ 14.4, },
716 /* 40 Mhz */ { 27.0, /* SGI */ 30.0, },
717 },
718
719 /* MCS 2 */
720 { /* 20 Mhz */ { 19.5, /* SGI */ 21.7, },
721 /* 40 Mhz */ { 40.5, /* SGI */ 45.0, },
722 },
723
724 /* MCS 3 */
725 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
726 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
727 },
728
729 /* MCS 4 */
730 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
731 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
732 },
733
734 /* MCS 5 */
735 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
736 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
737 },
738
739 /* MCS 6 */
740 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
741 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
742 },
743
744 /* MCS 7 */
745 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
746 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
747 },
748
749 /* MCS 8 */
750 { /* 20 Mhz */ { 13.0, /* SGI */ 14.4, },
751 /* 40 Mhz */ { 27.0, /* SGI */ 30.0, },
752 },
753
754 /* MCS 9 */
755 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
756 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
757 },
758
759 /* MCS 10 */
760 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
761 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
762 },
763
764 /* MCS 11 */
765 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
766 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
767 },
768
769 /* MCS 12 */
770 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
771 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
772 },
773
774 /* MCS 13 */
775 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
776 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
777 },
778
779 /* MCS 14 */
780 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
781 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
782 },
783
784 /* MCS 15 */
785 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
786 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
787 },
788
789 /* MCS 16 */
790 { /* 20 Mhz */ { 19.5, /* SGI */ 21.7, },
791 /* 40 Mhz */ { 40.5, /* SGI */ 45.0, },
792 },
793
794 /* MCS 17 */
795 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
796 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
797 },
798
799 /* MCS 18 */
800 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
801 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
802 },
803
804 /* MCS 19 */
805 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
806 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
807 },
808
809 /* MCS 20 */
810 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
811 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
812 },
813
814 /* MCS 21 */
815 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
816 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
817 },
818
819 /* MCS 22 */
820 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
821 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
822 },
823
824 /* MCS 23 */
825 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
826 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
827 },
828
829 /* MCS 24 */
830 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
831 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
832 },
833
834 /* MCS 25 */
835 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
836 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
837 },
838
839 /* MCS 26 */
840 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
841 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
842 },
843
844 /* MCS 27 */
845 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
846 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
847 },
848
849 /* MCS 28 */
850 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
851 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
852 },
853
854 /* MCS 29 */
855 { /* 20 Mhz */ { 208.0, /* SGI */ 231.1, },
856 /* 40 Mhz */ { 432.0, /* SGI */ 480.0, },
857 },
858
859 /* MCS 30 */
860 { /* 20 Mhz */ { 234.0, /* SGI */ 260.0, },
861 /* 40 Mhz */ { 486.0, /* SGI */ 540.0, },
862 },
863
864 /* MCS 31 */
865 { /* 20 Mhz */ { 260.0, /* SGI */ 288.9, },
866 /* 40 Mhz */ { 540.0, /* SGI */ 600.0, },
867 },
868
869 /* MCS 32 */
870 { /* 20 Mhz */ { 0.0, /* SGI */ 0.0, }, /* not valid */
871 /* 40 Mhz */ { 6.0, /* SGI */ 6.7, },
872 },
873
874 /* MCS 33 */
875 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
876 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
877 },
878
879 /* MCS 34 */
880 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
881 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
882 },
883
884 /* MCS 35 */
885 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
886 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
887 },
888
889 /* MCS 36 */
890 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
891 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
892 },
893
894 /* MCS 37 */
895 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
896 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
897 },
898
899 /* MCS 38 */
900 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
901 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
902 },
903
904 /* MCS 39 */
905 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
906 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
907 },
908
909 /* MCS 40 */
910 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
911 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
912 },
913
914 /* MCS 41 */
915 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
916 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
917 },
918
919 /* MCS 42 */
920 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
921 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
922 },
923
924 /* MCS 43 */
925 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
926 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
927 },
928
929 /* MCS 44 */
930 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
931 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
932 },
933
934 /* MCS 45 */
935 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
936 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
937 },
938
939 /* MCS 46 */
940 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
941 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
942 },
943
944 /* MCS 47 */
945 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
946 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
947 },
948
949 /* MCS 48 */
950 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
951 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
952 },
953
954 /* MCS 49 */
955 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
956 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
957 },
958
959 /* MCS 50 */
960 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
961 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
962 },
963
964 /* MCS 51 */
965 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
966 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
967 },
968
969 /* MCS 52 */
970 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
971 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
972 },
973
974 /* MCS 53 */
975 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
976 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
977 },
978
979 /* MCS 54 */
980 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
981 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
982 },
983
984 /* MCS 55 */
985 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
986 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
987 },
988
989 /* MCS 56 */
990 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
991 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
992 },
993
994 /* MCS 57 */
995 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
996 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
997 },
998
999 /* MCS 58 */
1000 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
1001 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
1002 },
1003
1004 /* MCS 59 */
1005 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1006 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1007 },
1008
1009 /* MCS 60 */
1010 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
1011 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
1012 },
1013
1014 /* MCS 61 */
1015 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1016 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1017 },
1018
1019 /* MCS 62 */
1020 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
1021 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
1022 },
1023
1024 /* MCS 63 */
1025 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
1026 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
1027 },
1028
1029 /* MCS 64 */
1030 { /* 20 Mhz */ { 143.0, /* SGI */ 158.9, },
1031 /* 40 Mhz */ { 297.0, /* SGI */ 330.0, },
1032 },
1033
1034 /* MCS 65 */
1035 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
1036 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
1037 },
1038
1039 /* MCS 66 */
1040 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1041 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1042 },
1043
1044 /* MCS 67 */
1045 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
1046 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
1047 },
1048
1049 /* MCS 68 */
1050 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1051 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1052 },
1053
1054 /* MCS 69 */
1055 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
1056 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
1057 },
1058
1059 /* MCS 70 */
1060 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
1061 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
1062 },
1063
1064 /* MCS 71 */
1065 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
1066 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
1067 },
1068
1069 /* MCS 72 */
1070 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
1071 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
1072 },
1073
1074 /* MCS 73 */
1075 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
1076 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
1077 },
1078
1079 /* MCS 74 */
1080 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
1081 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
1082 },
1083
1084 /* MCS 75 */
1085 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
1086 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
1087 },
1088
1089 /* MCS 76 */
1090 { /* 20 Mhz */ { 214.5, /* SGI */ 238.3, },
1091 /* 40 Mhz */ { 445.5, /* SGI */ 495.0, },
1092 },
1093 };
1094
1095 static const char *auth_alg_text[]={"Open System","Shared Key","EAP"};
1096 #define NUM_AUTH_ALGS (sizeof auth_alg_text / sizeof auth_alg_text[0])
1097
1098 static const char *status_text[] = {
1099 "Successful", /* 0 */
1100 "Unspecified failure", /* 1 */
1101 "Reserved", /* 2 */
1102 "Reserved", /* 3 */
1103 "Reserved", /* 4 */
1104 "Reserved", /* 5 */
1105 "Reserved", /* 6 */
1106 "Reserved", /* 7 */
1107 "Reserved", /* 8 */
1108 "Reserved", /* 9 */
1109 "Cannot Support all requested capabilities in the Capability "
1110 "Information field", /* 10 */
1111 "Reassociation denied due to inability to confirm that association "
1112 "exists", /* 11 */
1113 "Association denied due to reason outside the scope of the "
1114 "standard", /* 12 */
1115 "Responding station does not support the specified authentication "
1116 "algorithm ", /* 13 */
1117 "Received an Authentication frame with authentication transaction "
1118 "sequence number out of expected sequence", /* 14 */
1119 "Authentication rejected because of challenge failure", /* 15 */
1120 "Authentication rejected due to timeout waiting for next frame in "
1121 "sequence", /* 16 */
1122 "Association denied because AP is unable to handle additional"
1123 "associated stations", /* 17 */
1124 "Association denied due to requesting station not supporting all of "
1125 "the data rates in BSSBasicRateSet parameter", /* 18 */
1126 "Association denied due to requesting station not supporting "
1127 "short preamble operation", /* 19 */
1128 "Association denied due to requesting station not supporting "
1129 "PBCC encoding", /* 20 */
1130 "Association denied due to requesting station not supporting "
1131 "channel agility", /* 21 */
1132 "Association request rejected because Spectrum Management "
1133 "capability is required", /* 22 */
1134 "Association request rejected because the information in the "
1135 "Power Capability element is unacceptable", /* 23 */
1136 "Association request rejected because the information in the "
1137 "Supported Channels element is unacceptable", /* 24 */
1138 "Association denied due to requesting station not supporting "
1139 "short slot operation", /* 25 */
1140 "Association denied due to requesting station not supporting "
1141 "DSSS-OFDM operation", /* 26 */
1142 "Association denied because the requested STA does not support HT "
1143 "features", /* 27 */
1144 "Reserved", /* 28 */
1145 "Association denied because the requested STA does not support "
1146 "the PCO transition time required by the AP", /* 29 */
1147 "Reserved", /* 30 */
1148 "Reserved", /* 31 */
1149 "Unspecified, QoS-related failure", /* 32 */
1150 "Association denied due to QAP having insufficient bandwidth "
1151 "to handle another QSTA", /* 33 */
1152 "Association denied due to excessive frame loss rates and/or "
1153 "poor conditions on current operating channel", /* 34 */
1154 "Association (with QBSS) denied due to requesting station not "
1155 "supporting the QoS facility", /* 35 */
1156 "Association denied due to requesting station not supporting "
1157 "Block Ack", /* 36 */
1158 "The request has been declined", /* 37 */
1159 "The request has not been successful as one or more parameters "
1160 "have invalid values", /* 38 */
1161 "The TS has not been created because the request cannot be honored. "
1162 "However, a suggested TSPEC is provided so that the initiating QSTA"
1163 "may attempt to set another TS with the suggested changes to the "
1164 "TSPEC", /* 39 */
1165 "Invalid Information Element", /* 40 */
1166 "Group Cipher is not valid", /* 41 */
1167 "Pairwise Cipher is not valid", /* 42 */
1168 "AKMP is not valid", /* 43 */
1169 "Unsupported RSN IE version", /* 44 */
1170 "Invalid RSN IE Capabilities", /* 45 */
1171 "Cipher suite is rejected per security policy", /* 46 */
1172 "The TS has not been created. However, the HC may be capable of "
1173 "creating a TS, in response to a request, after the time indicated "
1174 "in the TS Delay element", /* 47 */
1175 "Direct Link is not allowed in the BSS by policy", /* 48 */
1176 "Destination STA is not present within this QBSS.", /* 49 */
1177 "The Destination STA is not a QSTA.", /* 50 */
1178
1179 };
1180 #define NUM_STATUSES (sizeof status_text / sizeof status_text[0])
1181
1182 static const char *reason_text[] = {
1183 "Reserved", /* 0 */
1184 "Unspecified reason", /* 1 */
1185 "Previous authentication no longer valid", /* 2 */
1186 "Deauthenticated because sending station is leaving (or has left) "
1187 "IBSS or ESS", /* 3 */
1188 "Disassociated due to inactivity", /* 4 */
1189 "Disassociated because AP is unable to handle all currently "
1190 " associated stations", /* 5 */
1191 "Class 2 frame received from nonauthenticated station", /* 6 */
1192 "Class 3 frame received from nonassociated station", /* 7 */
1193 "Disassociated because sending station is leaving "
1194 "(or has left) BSS", /* 8 */
1195 "Station requesting (re)association is not authenticated with "
1196 "responding station", /* 9 */
1197 "Disassociated because the information in the Power Capability "
1198 "element is unacceptable", /* 10 */
1199 "Disassociated because the information in the SupportedChannels "
1200 "element is unacceptable", /* 11 */
1201 "Invalid Information Element", /* 12 */
1202 "Reserved", /* 13 */
1203 "Michael MIC failure", /* 14 */
1204 "4-Way Handshake timeout", /* 15 */
1205 "Group key update timeout", /* 16 */
1206 "Information element in 4-Way Handshake different from (Re)Association"
1207 "Request/Probe Response/Beacon", /* 17 */
1208 "Group Cipher is not valid", /* 18 */
1209 "AKMP is not valid", /* 20 */
1210 "Unsupported RSN IE version", /* 21 */
1211 "Invalid RSN IE Capabilities", /* 22 */
1212 "IEEE 802.1X Authentication failed", /* 23 */
1213 "Cipher suite is rejected per security policy", /* 24 */
1214 "Reserved", /* 25 */
1215 "Reserved", /* 26 */
1216 "Reserved", /* 27 */
1217 "Reserved", /* 28 */
1218 "Reserved", /* 29 */
1219 "Reserved", /* 30 */
1220 "TS deleted because QoS AP lacks sufficient bandwidth for this "
1221 "QoS STA due to a change in BSS service characteristics or "
1222 "operational mode (e.g. an HT BSS change from 40 MHz channel "
1223 "to 20 MHz channel)", /* 31 */
1224 "Disassociated for unspecified, QoS-related reason", /* 32 */
1225 "Disassociated because QoS AP lacks sufficient bandwidth for this "
1226 "QoS STA", /* 33 */
1227 "Disassociated because of excessive number of frames that need to be "
1228 "acknowledged, but are not acknowledged for AP transmissions "
1229 "and/or poor channel conditions", /* 34 */
1230 "Disassociated because STA is transmitting outside the limits "
1231 "of its TXOPs", /* 35 */
1232 "Requested from peer STA as the STA is leaving the BSS "
1233 "(or resetting)", /* 36 */
1234 "Requested from peer STA as it does not want to use the "
1235 "mechanism", /* 37 */
1236 "Requested from peer STA as the STA received frames using the "
1237 "mechanism for which a set up is required", /* 38 */
1238 "Requested from peer STA due to time out", /* 39 */
1239 "Reserved", /* 40 */
1240 "Reserved", /* 41 */
1241 "Reserved", /* 42 */
1242 "Reserved", /* 43 */
1243 "Reserved", /* 44 */
1244 "Peer STA does not support the requested cipher suite", /* 45 */
1245 "Association denied due to requesting STA not supporting HT "
1246 "features", /* 46 */
1247 };
1248 #define NUM_REASONS (sizeof reason_text / sizeof reason_text[0])
1249
1250 static int
1251 wep_print(netdissect_options *ndo,
1252 const u_char *p)
1253 {
1254 u_int32_t iv;
1255
1256 if (!ND_TTEST2(*p, IEEE802_11_IV_LEN + IEEE802_11_KID_LEN))
1257 return 0;
1258 iv = EXTRACT_LE_32BITS(p);
1259
1260 ND_PRINT((ndo, "Data IV:%3x Pad %x KeyID %x", IV_IV(iv), IV_PAD(iv),
1261 IV_KEYID(iv)));
1262
1263 return 1;
1264 }
1265
1266 static int
1267 parse_elements(netdissect_options *ndo,
1268 struct mgmt_body_t *pbody, const u_char *p, int offset,
1269 u_int length)
1270 {
1271 u_int elementlen;
1272 struct ssid_t ssid;
1273 struct challenge_t challenge;
1274 struct rates_t rates;
1275 struct ds_t ds;
1276 struct cf_t cf;
1277 struct tim_t tim;
1278
1279 /*
1280 * We haven't seen any elements yet.
1281 */
1282 pbody->challenge_present = 0;
1283 pbody->ssid_present = 0;
1284 pbody->rates_present = 0;
1285 pbody->ds_present = 0;
1286 pbody->cf_present = 0;
1287 pbody->tim_present = 0;
1288
1289 while (length != 0) {
1290 if (!ND_TTEST2(*(p + offset), 1))
1291 return 0;
1292 if (length < 1)
1293 return 0;
1294 switch (*(p + offset)) {
1295 case E_SSID:
1296 if (!ND_TTEST2(*(p + offset), 2))
1297 return 0;
1298 if (length < 2)
1299 return 0;
1300 memcpy(&ssid, p + offset, 2);
1301 offset += 2;
1302 length -= 2;
1303 if (ssid.length != 0) {
1304 if (ssid.length > sizeof(ssid.ssid) - 1)
1305 return 0;
1306 if (!ND_TTEST2(*(p + offset), ssid.length))
1307 return 0;
1308 if (length < ssid.length)
1309 return 0;
1310 memcpy(&ssid.ssid, p + offset, ssid.length);
1311 offset += ssid.length;
1312 length -= ssid.length;
1313 }
1314 ssid.ssid[ssid.length] = '\0';
1315 /*
1316 * Present and not truncated.
1317 *
1318 * If we haven't already seen an SSID IE,
1319 * copy this one, otherwise ignore this one,
1320 * so we later report the first one we saw.
1321 */
1322 if (!pbody->ssid_present) {
1323 pbody->ssid = ssid;
1324 pbody->ssid_present = 1;
1325 }
1326 break;
1327 case E_CHALLENGE:
1328 if (!ND_TTEST2(*(p + offset), 2))
1329 return 0;
1330 if (length < 2)
1331 return 0;
1332 memcpy(&challenge, p + offset, 2);
1333 offset += 2;
1334 length -= 2;
1335 if (challenge.length != 0) {
1336 if (challenge.length >
1337 sizeof(challenge.text) - 1)
1338 return 0;
1339 if (!ND_TTEST2(*(p + offset), challenge.length))
1340 return 0;
1341 if (length < challenge.length)
1342 return 0;
1343 memcpy(&challenge.text, p + offset,
1344 challenge.length);
1345 offset += challenge.length;
1346 length -= challenge.length;
1347 }
1348 challenge.text[challenge.length] = '\0';
1349 /*
1350 * Present and not truncated.
1351 *
1352 * If we haven't already seen a challenge IE,
1353 * copy this one, otherwise ignore this one,
1354 * so we later report the first one we saw.
1355 */
1356 if (!pbody->challenge_present) {
1357 pbody->challenge = challenge;
1358 pbody->challenge_present = 1;
1359 }
1360 break;
1361 case E_RATES:
1362 if (!ND_TTEST2(*(p + offset), 2))
1363 return 0;
1364 if (length < 2)
1365 return 0;
1366 memcpy(&rates, p + offset, 2);
1367 offset += 2;
1368 length -= 2;
1369 if (rates.length != 0) {
1370 if (rates.length > sizeof rates.rate)
1371 return 0;
1372 if (!ND_TTEST2(*(p + offset), rates.length))
1373 return 0;
1374 if (length < rates.length)
1375 return 0;
1376 memcpy(&rates.rate, p + offset, rates.length);
1377 offset += rates.length;
1378 length -= rates.length;
1379 }
1380 /*
1381 * Present and not truncated.
1382 *
1383 * If we haven't already seen a rates IE,
1384 * copy this one if it's not zero-length,
1385 * otherwise ignore this one, so we later
1386 * report the first one we saw.
1387 *
1388 * We ignore zero-length rates IEs as some
1389 * devices seem to put a zero-length rates
1390 * IE, followed by an SSID IE, followed by
1391 * a non-zero-length rates IE into frames,
1392 * even though IEEE Std 802.11-2007 doesn't
1393 * seem to indicate that a zero-length rates
1394 * IE is valid.
1395 */
1396 if (!pbody->rates_present && rates.length != 0) {
1397 pbody->rates = rates;
1398 pbody->rates_present = 1;
1399 }
1400 break;
1401 case E_DS:
1402 if (!ND_TTEST2(*(p + offset), 3))
1403 return 0;
1404 if (length < 3)
1405 return 0;
1406 memcpy(&ds, p + offset, 3);
1407 offset += 3;
1408 length -= 3;
1409 /*
1410 * Present and not truncated.
1411 *
1412 * If we haven't already seen a DS IE,
1413 * copy this one, otherwise ignore this one,
1414 * so we later report the first one we saw.
1415 */
1416 if (!pbody->ds_present) {
1417 pbody->ds = ds;
1418 pbody->ds_present = 1;
1419 }
1420 break;
1421 case E_CF:
1422 if (!ND_TTEST2(*(p + offset), 8))
1423 return 0;
1424 if (length < 8)
1425 return 0;
1426 memcpy(&cf, p + offset, 8);
1427 offset += 8;
1428 length -= 8;
1429 /*
1430 * Present and not truncated.
1431 *
1432 * If we haven't already seen a CF IE,
1433 * copy this one, otherwise ignore this one,
1434 * so we later report the first one we saw.
1435 */
1436 if (!pbody->cf_present) {
1437 pbody->cf = cf;
1438 pbody->cf_present = 1;
1439 }
1440 break;
1441 case E_TIM:
1442 if (!ND_TTEST2(*(p + offset), 2))
1443 return 0;
1444 if (length < 2)
1445 return 0;
1446 memcpy(&tim, p + offset, 2);
1447 offset += 2;
1448 length -= 2;
1449 if (!ND_TTEST2(*(p + offset), 3))
1450 return 0;
1451 if (length < 3)
1452 return 0;
1453 memcpy(&tim.count, p + offset, 3);
1454 offset += 3;
1455 length -= 3;
1456
1457 if (tim.length <= 3)
1458 break;
1459 if (tim.length - 3 > (int)sizeof tim.bitmap)
1460 return 0;
1461 if (!ND_TTEST2(*(p + offset), tim.length - 3))
1462 return 0;
1463 if (length < (u_int)(tim.length - 3))
1464 return 0;
1465 memcpy(tim.bitmap, p + (tim.length - 3),
1466 (tim.length - 3));
1467 offset += tim.length - 3;
1468 length -= tim.length - 3;
1469 /*
1470 * Present and not truncated.
1471 *
1472 * If we haven't already seen a TIM IE,
1473 * copy this one, otherwise ignore this one,
1474 * so we later report the first one we saw.
1475 */
1476 if (!pbody->tim_present) {
1477 pbody->tim = tim;
1478 pbody->tim_present = 1;
1479 }
1480 break;
1481 default:
1482 #if 0
1483 ND_PRINT((ndo, "(1) unhandled element_id (%d) ",
1484 *(p + offset)));
1485 #endif
1486 if (!ND_TTEST2(*(p + offset), 2))
1487 return 0;
1488 if (length < 2)
1489 return 0;
1490 elementlen = *(p + offset + 1);
1491 if (!ND_TTEST2(*(p + offset + 2), elementlen))
1492 return 0;
1493 if (length < elementlen + 2)
1494 return 0;
1495 offset += elementlen + 2;
1496 length -= elementlen + 2;
1497 break;
1498 }
1499 }
1500
1501 /* No problems found. */
1502 return 1;
1503 }
1504
1505 /*********************************************************************************
1506 * Print Handle functions for the management frame types
1507 *********************************************************************************/
1508
1509 static int
1510 handle_beacon(netdissect_options *ndo,
1511 const u_char *p, u_int length)
1512 {
1513 struct mgmt_body_t pbody;
1514 int offset = 0;
1515 int ret;
1516
1517 memset(&pbody, 0, sizeof(pbody));
1518
1519 if (!ND_TTEST2(*p, IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1520 IEEE802_11_CAPINFO_LEN))
1521 return 0;
1522 if (length < IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1523 IEEE802_11_CAPINFO_LEN)
1524 return 0;
1525 memcpy(&pbody.timestamp, p, IEEE802_11_TSTAMP_LEN);
1526 offset += IEEE802_11_TSTAMP_LEN;
1527 length -= IEEE802_11_TSTAMP_LEN;
1528 pbody.beacon_interval = EXTRACT_LE_16BITS(p+offset);
1529 offset += IEEE802_11_BCNINT_LEN;
1530 length -= IEEE802_11_BCNINT_LEN;
1531 pbody.capability_info = EXTRACT_LE_16BITS(p+offset);
1532 offset += IEEE802_11_CAPINFO_LEN;
1533 length -= IEEE802_11_CAPINFO_LEN;
1534
1535 ret = parse_elements(ndo, &pbody, p, offset, length);
1536
1537 PRINT_SSID(pbody);
1538 PRINT_RATES(pbody);
1539 ND_PRINT((ndo, " %s",
1540 CAPABILITY_ESS(pbody.capability_info) ? "ESS" : "IBSS"));
1541 PRINT_DS_CHANNEL(pbody);
1542
1543 return ret;
1544 }
1545
1546 static int
1547 handle_assoc_request(netdissect_options *ndo,
1548 const u_char *p, u_int length)
1549 {
1550 struct mgmt_body_t pbody;
1551 int offset = 0;
1552 int ret;
1553
1554 memset(&pbody, 0, sizeof(pbody));
1555
1556 if (!ND_TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN))
1557 return 0;
1558 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN)
1559 return 0;
1560 pbody.capability_info = EXTRACT_LE_16BITS(p);
1561 offset += IEEE802_11_CAPINFO_LEN;
1562 length -= IEEE802_11_CAPINFO_LEN;
1563 pbody.listen_interval = EXTRACT_LE_16BITS(p+offset);
1564 offset += IEEE802_11_LISTENINT_LEN;
1565 length -= IEEE802_11_LISTENINT_LEN;
1566
1567 ret = parse_elements(ndo, &pbody, p, offset, length);
1568
1569 PRINT_SSID(pbody);
1570 PRINT_RATES(pbody);
1571 return ret;
1572 }
1573
1574 static int
1575 handle_assoc_response(netdissect_options *ndo,
1576 const u_char *p, u_int length)
1577 {
1578 struct mgmt_body_t pbody;
1579 int offset = 0;
1580 int ret;
1581
1582 memset(&pbody, 0, sizeof(pbody));
1583
1584 if (!ND_TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_STATUS_LEN +
1585 IEEE802_11_AID_LEN))
1586 return 0;
1587 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_STATUS_LEN +
1588 IEEE802_11_AID_LEN)
1589 return 0;
1590 pbody.capability_info = EXTRACT_LE_16BITS(p);
1591 offset += IEEE802_11_CAPINFO_LEN;
1592 length -= IEEE802_11_CAPINFO_LEN;
1593 pbody.status_code = EXTRACT_LE_16BITS(p+offset);
1594 offset += IEEE802_11_STATUS_LEN;
1595 length -= IEEE802_11_STATUS_LEN;
1596 pbody.aid = EXTRACT_LE_16BITS(p+offset);
1597 offset += IEEE802_11_AID_LEN;
1598 length -= IEEE802_11_AID_LEN;
1599
1600 ret = parse_elements(ndo, &pbody, p, offset, length);
1601
1602 ND_PRINT((ndo, " AID(%x) :%s: %s", ((u_int16_t)(pbody.aid << 2 )) >> 2 ,
1603 CAPABILITY_PRIVACY(pbody.capability_info) ? " PRIVACY " : "",
1604 (pbody.status_code < NUM_STATUSES
1605 ? status_text[pbody.status_code]
1606 : "n/a")));
1607
1608 return ret;
1609 }
1610
1611 static int
1612 handle_reassoc_request(netdissect_options *ndo,
1613 const u_char *p, u_int length)
1614 {
1615 struct mgmt_body_t pbody;
1616 int offset = 0;
1617 int ret;
1618
1619 memset(&pbody, 0, sizeof(pbody));
1620
1621 if (!ND_TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN +
1622 IEEE802_11_AP_LEN))
1623 return 0;
1624 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN +
1625 IEEE802_11_AP_LEN)
1626 return 0;
1627 pbody.capability_info = EXTRACT_LE_16BITS(p);
1628 offset += IEEE802_11_CAPINFO_LEN;
1629 length -= IEEE802_11_CAPINFO_LEN;
1630 pbody.listen_interval = EXTRACT_LE_16BITS(p+offset);
1631 offset += IEEE802_11_LISTENINT_LEN;
1632 length -= IEEE802_11_LISTENINT_LEN;
1633 memcpy(&pbody.ap, p+offset, IEEE802_11_AP_LEN);
1634 offset += IEEE802_11_AP_LEN;
1635 length -= IEEE802_11_AP_LEN;
1636
1637 ret = parse_elements(ndo, &pbody, p, offset, length);
1638
1639 PRINT_SSID(pbody);
1640 ND_PRINT((ndo, " AP : %s", etheraddr_string( pbody.ap )));
1641
1642 return ret;
1643 }
1644
1645 static int
1646 handle_reassoc_response(netdissect_options *ndo,
1647 const u_char *p, u_int length)
1648 {
1649 /* Same as a Association Reponse */
1650 return handle_assoc_response(ndo, p, length);
1651 }
1652
1653 static int
1654 handle_probe_request(netdissect_options *ndo,
1655 const u_char *p, u_int length)
1656 {
1657 struct mgmt_body_t pbody;
1658 int offset = 0;
1659 int ret;
1660
1661 memset(&pbody, 0, sizeof(pbody));
1662
1663 ret = parse_elements(ndo, &pbody, p, offset, length);
1664
1665 PRINT_SSID(pbody);
1666 PRINT_RATES(pbody);
1667
1668 return ret;
1669 }
1670
1671 static int
1672 handle_probe_response(netdissect_options *ndo,
1673 const u_char *p, u_int length)
1674 {
1675 struct mgmt_body_t pbody;
1676 int offset = 0;
1677 int ret;
1678
1679 memset(&pbody, 0, sizeof(pbody));
1680
1681 if (!ND_TTEST2(*p, IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1682 IEEE802_11_CAPINFO_LEN))
1683 return 0;
1684 if (length < IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1685 IEEE802_11_CAPINFO_LEN)
1686 return 0;
1687 memcpy(&pbody.timestamp, p, IEEE802_11_TSTAMP_LEN);
1688 offset += IEEE802_11_TSTAMP_LEN;
1689 length -= IEEE802_11_TSTAMP_LEN;
1690 pbody.beacon_interval = EXTRACT_LE_16BITS(p+offset);
1691 offset += IEEE802_11_BCNINT_LEN;
1692 length -= IEEE802_11_BCNINT_LEN;
1693 pbody.capability_info = EXTRACT_LE_16BITS(p+offset);
1694 offset += IEEE802_11_CAPINFO_LEN;
1695 length -= IEEE802_11_CAPINFO_LEN;
1696
1697 ret = parse_elements(ndo, &pbody, p, offset, length);
1698
1699 PRINT_SSID(pbody);
1700 PRINT_RATES(pbody);
1701 PRINT_DS_CHANNEL(pbody);
1702
1703 return ret;
1704 }
1705
1706 static int
1707 handle_atim(void)
1708 {
1709 /* the frame body for ATIM is null. */
1710 return 1;
1711 }
1712
1713 static int
1714 handle_disassoc(netdissect_options *ndo,
1715 const u_char *p, u_int length)
1716 {
1717 struct mgmt_body_t pbody;
1718
1719 memset(&pbody, 0, sizeof(pbody));
1720
1721 if (!ND_TTEST2(*p, IEEE802_11_REASON_LEN))
1722 return 0;
1723 if (length < IEEE802_11_REASON_LEN)
1724 return 0;
1725 pbody.reason_code = EXTRACT_LE_16BITS(p);
1726
1727 ND_PRINT((ndo, ": %s",
1728 (pbody.reason_code < NUM_REASONS)
1729 ? reason_text[pbody.reason_code]
1730 : "Reserved"));
1731
1732 return 1;
1733 }
1734
1735 static int
1736 handle_auth(netdissect_options *ndo,
1737 const u_char *p, u_int length)
1738 {
1739 struct mgmt_body_t pbody;
1740 int offset = 0;
1741 int ret;
1742
1743 memset(&pbody, 0, sizeof(pbody));
1744
1745 if (!ND_TTEST2(*p, 6))
1746 return 0;
1747 if (length < 6)
1748 return 0;
1749 pbody.auth_alg = EXTRACT_LE_16BITS(p);
1750 offset += 2;
1751 length -= 2;
1752 pbody.auth_trans_seq_num = EXTRACT_LE_16BITS(p + offset);
1753 offset += 2;
1754 length -= 2;
1755 pbody.status_code = EXTRACT_LE_16BITS(p + offset);
1756 offset += 2;
1757 length -= 2;
1758
1759 ret = parse_elements(ndo, &pbody, p, offset, length);
1760
1761 if ((pbody.auth_alg == 1) &&
1762 ((pbody.auth_trans_seq_num == 2) ||
1763 (pbody.auth_trans_seq_num == 3))) {
1764 ND_PRINT((ndo, " (%s)-%x [Challenge Text] %s",
1765 (pbody.auth_alg < NUM_AUTH_ALGS)
1766 ? auth_alg_text[pbody.auth_alg]
1767 : "Reserved",
1768 pbody.auth_trans_seq_num,
1769 ((pbody.auth_trans_seq_num % 2)
1770 ? ((pbody.status_code < NUM_STATUSES)
1771 ? status_text[pbody.status_code]
1772 : "n/a") : "")));
1773 return ret;
1774 }
1775 ND_PRINT((ndo, " (%s)-%x: %s",
1776 (pbody.auth_alg < NUM_AUTH_ALGS)
1777 ? auth_alg_text[pbody.auth_alg]
1778 : "Reserved",
1779 pbody.auth_trans_seq_num,
1780 (pbody.auth_trans_seq_num % 2)
1781 ? ((pbody.status_code < NUM_STATUSES)
1782 ? status_text[pbody.status_code]
1783 : "n/a")
1784 : ""));
1785
1786 return ret;
1787 }
1788
1789 static int
1790 handle_deauth(netdissect_options *ndo,
1791 const struct mgmt_header_t *pmh, const u_char *p, u_int length)
1792 {
1793 struct mgmt_body_t pbody;
1794 const char *reason = NULL;
1795
1796 memset(&pbody, 0, sizeof(pbody));
1797
1798 if (!ND_TTEST2(*p, IEEE802_11_REASON_LEN))
1799 return 0;
1800 if (length < IEEE802_11_REASON_LEN)
1801 return 0;
1802 pbody.reason_code = EXTRACT_LE_16BITS(p);
1803
1804 reason = (pbody.reason_code < NUM_REASONS)
1805 ? reason_text[pbody.reason_code]
1806 : "Reserved";
1807
1808 if (ndo->ndo_eflag) {
1809 ND_PRINT((ndo, ": %s", reason));
1810 } else {
1811 ND_PRINT((ndo, " (%s): %s", etheraddr_string(pmh->sa), reason));
1812 }
1813 return 1;
1814 }
1815
1816 #define PRINT_HT_ACTION(v) (\
1817 (v) == 0 ? ND_PRINT((ndo, "TxChWidth")) : \
1818 (v) == 1 ? ND_PRINT((ndo, "MIMOPwrSave")) : \
1819 ND_PRINT((ndo, "Act#%d", (v))) \
1820 )
1821 #define PRINT_BA_ACTION(v) (\
1822 (v) == 0 ? ND_PRINT((ndo, "ADDBA Request")) : \
1823 (v) == 1 ? ND_PRINT((ndo, "ADDBA Response")) : \
1824 (v) == 2 ? ND_PRINT((ndo, "DELBA")) : \
1825 ND_PRINT((ndo, "Act#%d", (v))) \
1826 )
1827 #define PRINT_MESHLINK_ACTION(v) (\
1828 (v) == 0 ? ND_PRINT((ndo, "Request")) : \
1829 (v) == 1 ? ND_PRINT((ndo, "Report")) : \
1830 ND_PRINT((ndo, "Act#%d", (v))) \
1831 )
1832 #define PRINT_MESHPEERING_ACTION(v) (\
1833 (v) == 0 ? ND_PRINT((ndo, "Open")) : \
1834 (v) == 1 ? ND_PRINT((ndo, "Confirm")) : \
1835 (v) == 2 ? ND_PRINT((ndo, "Close")) : \
1836 ND_PRINT((ndo, "Act#%d", (v))) \
1837 )
1838 #define PRINT_MESHPATH_ACTION(v) (\
1839 (v) == 0 ? ND_PRINT((ndo, "Request")) : \
1840 (v) == 1 ? ND_PRINT((ndo, "Report")) : \
1841 (v) == 2 ? ND_PRINT((ndo, "Error")) : \
1842 (v) == 3 ? ND_PRINT((ndo, "RootAnnouncement")) : \
1843 ND_PRINT((ndo, "Act#%d", (v))) \
1844 )
1845
1846 #define PRINT_MESH_ACTION(v) (\
1847 (v) == 0 ? ND_PRINT((ndo, "MeshLink")) : \
1848 (v) == 1 ? ND_PRINT((ndo, "HWMP")) : \
1849 (v) == 2 ? ND_PRINT((ndo, "Gate Announcement")) : \
1850 (v) == 3 ? ND_PRINT((ndo, "Congestion Control")) : \
1851 (v) == 4 ? ND_PRINT((ndo, "MCCA Setup Request")) : \
1852 (v) == 5 ? ND_PRINT((ndo, "MCCA Setup Reply")) : \
1853 (v) == 6 ? ND_PRINT((ndo, "MCCA Advertisement Request")) : \
1854 (v) == 7 ? ND_PRINT((ndo, "MCCA Advertisement")) : \
1855 (v) == 8 ? ND_PRINT((ndo, "MCCA Teardown")) : \
1856 (v) == 9 ? ND_PRINT((ndo, "TBTT Adjustment Request")) : \
1857 (v) == 10 ? ND_PRINT((ndo, "TBTT Adjustment Response")) : \
1858 ND_PRINT((ndo, "Act#%d", (v))) \
1859 )
1860 #define PRINT_MULTIHOP_ACTION(v) (\
1861 (v) == 0 ? ND_PRINT((ndo, "Proxy Update")) : \
1862 (v) == 1 ? ND_PRINT((ndo, "Proxy Update Confirmation")) : \
1863 ND_PRINT((ndo, "Act#%d", (v))) \
1864 )
1865 #define PRINT_SELFPROT_ACTION(v) (\
1866 (v) == 1 ? ND_PRINT((ndo, "Peering Open")) : \
1867 (v) == 2 ? ND_PRINT((ndo, "Peering Confirm")) : \
1868 (v) == 3 ? ND_PRINT((ndo, "Peering Close")) : \
1869 (v) == 4 ? ND_PRINT((ndo, "Group Key Inform")) : \
1870 (v) == 5 ? ND_PRINT((ndo, "Group Key Acknowledge")) : \
1871 ND_PRINT((ndo, "Act#%d", (v))) \
1872 )
1873
1874 static int
1875 handle_action(netdissect_options *ndo,
1876 const struct mgmt_header_t *pmh, const u_char *p, u_int length)
1877 {
1878 if (!ND_TTEST2(*p, 2))
1879 return 0;
1880 if (length < 2)
1881 return 0;
1882 if (ndo->ndo_eflag) {
1883 ND_PRINT((ndo, ": "));
1884 } else {
1885 ND_PRINT((ndo, " (%s): ", etheraddr_string(pmh->sa)));
1886 }
1887 switch (p[0]) {
1888 case 0: ND_PRINT((ndo, "Spectrum Management Act#%d", p[1])); break;
1889 case 1: ND_PRINT((ndo, "QoS Act#%d", p[1])); break;
1890 case 2: ND_PRINT((ndo, "DLS Act#%d", p[1])); break;
1891 case 3: ND_PRINT((ndo, "BA ")); PRINT_BA_ACTION(p[1]); break;
1892 case 7: ND_PRINT((ndo, "HT ")); PRINT_HT_ACTION(p[1]); break;
1893 case 13: ND_PRINT((ndo, "MeshAction ")); PRINT_MESH_ACTION(p[1]); break;
1894 case 14:
1895 ND_PRINT((ndo, "MultiohopAction "));
1896 PRINT_MULTIHOP_ACTION(p[1]); break;
1897 case 15:
1898 ND_PRINT((ndo, "SelfprotectAction "));
1899 PRINT_SELFPROT_ACTION(p[1]); break;
1900 case 127: ND_PRINT((ndo, "Vendor Act#%d", p[1])); break;
1901 default:
1902 ND_PRINT((ndo, "Reserved(%d) Act#%d", p[0], p[1]));
1903 break;
1904 }
1905 return 1;
1906 }
1907
1908
1909 /*********************************************************************************
1910 * Print Body funcs
1911 *********************************************************************************/
1912
1913
1914 static int
1915 mgmt_body_print(netdissect_options *ndo,
1916 u_int16_t fc, const struct mgmt_header_t *pmh,
1917 const u_char *p, u_int length)
1918 {
1919 switch (FC_SUBTYPE(fc)) {
1920 case ST_ASSOC_REQUEST:
1921 ND_PRINT((ndo, "Assoc Request"));
1922 return handle_assoc_request(ndo, p, length);
1923 case ST_ASSOC_RESPONSE:
1924 ND_PRINT((ndo, "Assoc Response"));
1925 return handle_assoc_response(ndo, p, length);
1926 case ST_REASSOC_REQUEST:
1927 ND_PRINT((ndo, "ReAssoc Request"));
1928 return handle_reassoc_request(ndo, p, length);
1929 case ST_REASSOC_RESPONSE:
1930 ND_PRINT((ndo, "ReAssoc Response"));
1931 return handle_reassoc_response(ndo, p, length);
1932 case ST_PROBE_REQUEST:
1933 ND_PRINT((ndo, "Probe Request"));
1934 return handle_probe_request(ndo, p, length);
1935 case ST_PROBE_RESPONSE:
1936 ND_PRINT((ndo, "Probe Response"));
1937 return handle_probe_response(ndo, p, length);
1938 case ST_BEACON:
1939 ND_PRINT((ndo, "Beacon"));
1940 return handle_beacon(ndo, p, length);
1941 case ST_ATIM:
1942 ND_PRINT((ndo, "ATIM"));
1943 return handle_atim();
1944 case ST_DISASSOC:
1945 ND_PRINT((ndo, "Disassociation"));
1946 return handle_disassoc(ndo, p, length);
1947 case ST_AUTH:
1948 ND_PRINT((ndo, "Authentication"));
1949 if (!ND_TTEST2(*p, 3))
1950 return 0;
1951 if ((p[0] == 0 ) && (p[1] == 0) && (p[2] == 0)) {
1952 ND_PRINT((ndo, "Authentication (Shared-Key)-3 "));
1953 return wep_print(ndo, p);
1954 }
1955 return handle_auth(ndo, p, length);
1956 case ST_DEAUTH:
1957 ND_PRINT((ndo, "DeAuthentication"));
1958 return handle_deauth(ndo, pmh, p, length);
1959 break;
1960 case ST_ACTION:
1961 ND_PRINT((ndo, "Action"));
1962 return handle_action(ndo, pmh, p, length);
1963 break;
1964 default:
1965 ND_PRINT((ndo, "Unhandled Management subtype(%x)",
1966 FC_SUBTYPE(fc)));
1967 return 1;
1968 }
1969 }
1970
1971
1972 /*********************************************************************************
1973 * Handles printing all the control frame types
1974 *********************************************************************************/
1975
1976 static int
1977 ctrl_body_print(netdissect_options *ndo,
1978 u_int16_t fc, const u_char *p)
1979 {
1980 switch (FC_SUBTYPE(fc)) {
1981 case CTRL_CONTROL_WRAPPER:
1982 ND_PRINT((ndo, "Control Wrapper"));
1983 /* XXX - requires special handling */
1984 break;
1985 case CTRL_BAR:
1986 ND_PRINT((ndo, "BAR"));
1987 if (!ND_TTEST2(*p, CTRL_BAR_HDRLEN))
1988 return 0;
1989 if (!ndo->ndo_eflag)
1990 ND_PRINT((ndo, " RA:%s TA:%s CTL(%x) SEQ(%u) ",
1991 etheraddr_string(((const struct ctrl_bar_t *)p)->ra),
1992 etheraddr_string(((const struct ctrl_bar_t *)p)->ta),
1993 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->ctl)),
1994 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->seq))));
1995 break;
1996 case CTRL_BA:
1997 ND_PRINT((ndo, "BA"));
1998 if (!ND_TTEST2(*p, CTRL_BA_HDRLEN))
1999 return 0;
2000 if (!ndo->ndo_eflag)
2001 ND_PRINT((ndo, " RA:%s ",
2002 etheraddr_string(((const struct ctrl_ba_t *)p)->ra)));
2003 break;
2004 case CTRL_PS_POLL:
2005 ND_PRINT((ndo, "Power Save-Poll"));
2006 if (!ND_TTEST2(*p, CTRL_PS_POLL_HDRLEN))
2007 return 0;
2008 ND_PRINT((ndo, " AID(%x)",
2009 EXTRACT_LE_16BITS(&(((const struct ctrl_ps_poll_t *)p)->aid))));
2010 break;
2011 case CTRL_RTS:
2012 ND_PRINT((ndo, "Request-To-Send"));
2013 if (!ND_TTEST2(*p, CTRL_RTS_HDRLEN))
2014 return 0;
2015 if (!ndo->ndo_eflag)
2016 ND_PRINT((ndo, " TA:%s ",
2017 etheraddr_string(((const struct ctrl_rts_t *)p)->ta)));
2018 break;
2019 case CTRL_CTS:
2020 ND_PRINT((ndo, "Clear-To-Send"));
2021 if (!ND_TTEST2(*p, CTRL_CTS_HDRLEN))
2022 return 0;
2023 if (!ndo->ndo_eflag)
2024 ND_PRINT((ndo, " RA:%s ",
2025 etheraddr_string(((const struct ctrl_cts_t *)p)->ra)));
2026 break;
2027 case CTRL_ACK:
2028 ND_PRINT((ndo, "Acknowledgment"));
2029 if (!ND_TTEST2(*p, CTRL_ACK_HDRLEN))
2030 return 0;
2031 if (!ndo->ndo_eflag)
2032 ND_PRINT((ndo, " RA:%s ",
2033 etheraddr_string(((const struct ctrl_ack_t *)p)->ra)));
2034 break;
2035 case CTRL_CF_END:
2036 ND_PRINT((ndo, "CF-End"));
2037 if (!ND_TTEST2(*p, CTRL_END_HDRLEN))
2038 return 0;
2039 if (!ndo->ndo_eflag)
2040 ND_PRINT((ndo, " RA:%s ",
2041 etheraddr_string(((const struct ctrl_end_t *)p)->ra)));
2042 break;
2043 case CTRL_END_ACK:
2044 ND_PRINT((ndo, "CF-End+CF-Ack"));
2045 if (!ND_TTEST2(*p, CTRL_END_ACK_HDRLEN))
2046 return 0;
2047 if (!ndo->ndo_eflag)
2048 ND_PRINT((ndo, " RA:%s ",
2049 etheraddr_string(((const struct ctrl_end_ack_t *)p)->ra)));
2050 break;
2051 default:
2052 ND_PRINT((ndo, "Unknown Ctrl Subtype"));
2053 }
2054 return 1;
2055 }
2056
2057 /*
2058 * Print Header funcs
2059 */
2060
2061 /*
2062 * Data Frame - Address field contents
2063 *
2064 * To Ds | From DS | Addr 1 | Addr 2 | Addr 3 | Addr 4
2065 * 0 | 0 | DA | SA | BSSID | n/a
2066 * 0 | 1 | DA | BSSID | SA | n/a
2067 * 1 | 0 | BSSID | SA | DA | n/a
2068 * 1 | 1 | RA | TA | DA | SA
2069 */
2070
2071 static void
2072 data_header_print(netdissect_options *ndo,
2073 u_int16_t fc, const u_char *p, const u_int8_t **srcp,
2074 const u_int8_t **dstp)
2075 {
2076 u_int subtype = FC_SUBTYPE(fc);
2077
2078 if (DATA_FRAME_IS_CF_ACK(subtype) || DATA_FRAME_IS_CF_POLL(subtype) ||
2079 DATA_FRAME_IS_QOS(subtype)) {
2080 ND_PRINT((ndo, "CF "));
2081 if (DATA_FRAME_IS_CF_ACK(subtype)) {
2082 if (DATA_FRAME_IS_CF_POLL(subtype))
2083 ND_PRINT((ndo, "Ack/Poll"));
2084 else
2085 ND_PRINT((ndo, "Ack"));
2086 } else {
2087 if (DATA_FRAME_IS_CF_POLL(subtype))
2088 ND_PRINT((ndo, "Poll"));
2089 }
2090 if (DATA_FRAME_IS_QOS(subtype))
2091 ND_PRINT((ndo, "+QoS"));
2092 ND_PRINT((ndo, " "));
2093 }
2094
2095 #define ADDR1 (p + 4)
2096 #define ADDR2 (p + 10)
2097 #define ADDR3 (p + 16)
2098 #define ADDR4 (p + 24)
2099
2100 if (!FC_TO_DS(fc) && !FC_FROM_DS(fc)) {
2101 if (srcp != NULL)
2102 *srcp = ADDR2;
2103 if (dstp != NULL)
2104 *dstp = ADDR1;
2105 if (!ndo->ndo_eflag)
2106 return;
2107 ND_PRINT((ndo, "DA:%s SA:%s BSSID:%s ",
2108 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2109 etheraddr_string(ADDR3)));
2110 } else if (!FC_TO_DS(fc) && FC_FROM_DS(fc)) {
2111 if (srcp != NULL)
2112 *srcp = ADDR3;
2113 if (dstp != NULL)
2114 *dstp = ADDR1;
2115 if (!ndo->ndo_eflag)
2116 return;
2117 ND_PRINT((ndo, "DA:%s BSSID:%s SA:%s ",
2118 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2119 etheraddr_string(ADDR3)));
2120 } else if (FC_TO_DS(fc) && !FC_FROM_DS(fc)) {
2121 if (srcp != NULL)
2122 *srcp = ADDR2;
2123 if (dstp != NULL)
2124 *dstp = ADDR3;
2125 if (!ndo->ndo_eflag)
2126 return;
2127 ND_PRINT((ndo, "BSSID:%s SA:%s DA:%s ",
2128 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2129 etheraddr_string(ADDR3)));
2130 } else if (FC_TO_DS(fc) && FC_FROM_DS(fc)) {
2131 if (srcp != NULL)
2132 *srcp = ADDR4;
2133 if (dstp != NULL)
2134 *dstp = ADDR3;
2135 if (!ndo->ndo_eflag)
2136 return;
2137 ND_PRINT((ndo, "RA:%s TA:%s DA:%s SA:%s ",
2138 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2139 etheraddr_string(ADDR3), etheraddr_string(ADDR4)));
2140 }
2141
2142 #undef ADDR1
2143 #undef ADDR2
2144 #undef ADDR3
2145 #undef ADDR4
2146 }
2147
2148 static void
2149 mgmt_header_print(netdissect_options *ndo,
2150 const u_char *p, const u_int8_t **srcp, const u_int8_t **dstp)
2151 {
2152 const struct mgmt_header_t *hp = (const struct mgmt_header_t *) p;
2153
2154 if (srcp != NULL)
2155 *srcp = hp->sa;
2156 if (dstp != NULL)
2157 *dstp = hp->da;
2158 if (!ndo->ndo_eflag)
2159 return;
2160
2161 ND_PRINT((ndo, "BSSID:%s DA:%s SA:%s ",
2162 etheraddr_string((hp)->bssid), etheraddr_string((hp)->da),
2163 etheraddr_string((hp)->sa)));
2164 }
2165
2166 static void
2167 ctrl_header_print(netdissect_options *ndo,
2168 u_int16_t fc, const u_char *p, const u_int8_t **srcp,
2169 const u_int8_t **dstp)
2170 {
2171 if (srcp != NULL)
2172 *srcp = NULL;
2173 if (dstp != NULL)
2174 *dstp = NULL;
2175 if (!ndo->ndo_eflag)
2176 return;
2177
2178 switch (FC_SUBTYPE(fc)) {
2179 case CTRL_BAR:
2180 ND_PRINT((ndo, " RA:%s TA:%s CTL(%x) SEQ(%u) ",
2181 etheraddr_string(((const struct ctrl_bar_t *)p)->ra),
2182 etheraddr_string(((const struct ctrl_bar_t *)p)->ta),
2183 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->ctl)),
2184 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->seq))));
2185 break;
2186 case CTRL_BA:
2187 ND_PRINT((ndo, "RA:%s ",
2188 etheraddr_string(((const struct ctrl_ba_t *)p)->ra)));
2189 break;
2190 case CTRL_PS_POLL:
2191 ND_PRINT((ndo, "BSSID:%s TA:%s ",
2192 etheraddr_string(((const struct ctrl_ps_poll_t *)p)->bssid),
2193 etheraddr_string(((const struct ctrl_ps_poll_t *)p)->ta)));
2194 break;
2195 case CTRL_RTS:
2196 ND_PRINT((ndo, "RA:%s TA:%s ",
2197 etheraddr_string(((const struct ctrl_rts_t *)p)->ra),
2198 etheraddr_string(((const struct ctrl_rts_t *)p)->ta)));
2199 break;
2200 case CTRL_CTS:
2201 ND_PRINT((ndo, "RA:%s ",
2202 etheraddr_string(((const struct ctrl_cts_t *)p)->ra)));
2203 break;
2204 case CTRL_ACK:
2205 ND_PRINT((ndo, "RA:%s ",
2206 etheraddr_string(((const struct ctrl_ack_t *)p)->ra)));
2207 break;
2208 case CTRL_CF_END:
2209 ND_PRINT((ndo, "RA:%s BSSID:%s ",
2210 etheraddr_string(((const struct ctrl_end_t *)p)->ra),
2211 etheraddr_string(((const struct ctrl_end_t *)p)->bssid)));
2212 break;
2213 case CTRL_END_ACK:
2214 ND_PRINT((ndo, "RA:%s BSSID:%s ",
2215 etheraddr_string(((const struct ctrl_end_ack_t *)p)->ra),
2216 etheraddr_string(((const struct ctrl_end_ack_t *)p)->bssid)));
2217 break;
2218 default:
2219 ND_PRINT((ndo, "(H) Unknown Ctrl Subtype"));
2220 break;
2221 }
2222 }
2223
2224 static int
2225 extract_header_length(netdissect_options *ndo,
2226 u_int16_t fc)
2227 {
2228 int len;
2229
2230 switch (FC_TYPE(fc)) {
2231 case T_MGMT:
2232 return MGMT_HDRLEN;
2233 case T_CTRL:
2234 switch (FC_SUBTYPE(fc)) {
2235 case CTRL_BAR:
2236 return CTRL_BAR_HDRLEN;
2237 case CTRL_PS_POLL:
2238 return CTRL_PS_POLL_HDRLEN;
2239 case CTRL_RTS:
2240 return CTRL_RTS_HDRLEN;
2241 case CTRL_CTS:
2242 return CTRL_CTS_HDRLEN;
2243 case CTRL_ACK:
2244 return CTRL_ACK_HDRLEN;
2245 case CTRL_CF_END:
2246 return CTRL_END_HDRLEN;
2247 case CTRL_END_ACK:
2248 return CTRL_END_ACK_HDRLEN;
2249 default:
2250 return 0;
2251 }
2252 case T_DATA:
2253 len = (FC_TO_DS(fc) && FC_FROM_DS(fc)) ? 30 : 24;
2254 if (DATA_FRAME_IS_QOS(FC_SUBTYPE(fc)))
2255 len += 2;
2256 return len;
2257 default:
2258 ND_PRINT((ndo, "unknown IEEE802.11 frame type (%d)", FC_TYPE(fc)));
2259 return 0;
2260 }
2261 }
2262
2263 static int
2264 extract_mesh_header_length(const u_char *p)
2265 {
2266 return (p[0] &~ 3) ? 0 : 6*(1 + (p[0] & 3));
2267 }
2268
2269 /*
2270 * Print the 802.11 MAC header if eflag is set, and set "*srcp" and "*dstp"
2271 * to point to the source and destination MAC addresses in any case if
2272 * "srcp" and "dstp" aren't null.
2273 */
2274 static void
2275 ieee_802_11_hdr_print(netdissect_options *ndo,
2276 u_int16_t fc, const u_char *p, u_int hdrlen,
2277 u_int meshdrlen, const u_int8_t **srcp,
2278 const u_int8_t **dstp)
2279 {
2280 if (ndo->ndo_vflag) {
2281 if (FC_MORE_DATA(fc))
2282 ND_PRINT((ndo, "More Data "));
2283 if (FC_MORE_FLAG(fc))
2284 ND_PRINT((ndo, "More Fragments "));
2285 if (FC_POWER_MGMT(fc))
2286 ND_PRINT((ndo, "Pwr Mgmt "));
2287 if (FC_RETRY(fc))
2288 ND_PRINT((ndo, "Retry "));
2289 if (FC_ORDER(fc))
2290 ND_PRINT((ndo, "Strictly Ordered "));
2291 if (FC_WEP(fc))
2292 ND_PRINT((ndo, "WEP Encrypted "));
2293 if (FC_TYPE(fc) != T_CTRL || FC_SUBTYPE(fc) != CTRL_PS_POLL)
2294 ND_PRINT((ndo, "%dus ",
2295 EXTRACT_LE_16BITS(
2296 &((const struct mgmt_header_t *)p)->duration)));
2297 }
2298 if (meshdrlen != 0) {
2299 const struct meshcntl_t *mc =
2300 (const struct meshcntl_t *)&p[hdrlen - meshdrlen];
2301 int ae = mc->flags & 3;
2302
2303 ND_PRINT((ndo, "MeshData (AE %d TTL %u seq %u", ae, mc->ttl,
2304 EXTRACT_LE_32BITS(mc->seq)));
2305 if (ae > 0)
2306 ND_PRINT((ndo, " A4:%s", etheraddr_string(mc->addr4)));
2307 if (ae > 1)
2308 ND_PRINT((ndo, " A5:%s", etheraddr_string(mc->addr5)));
2309 if (ae > 2)
2310 ND_PRINT((ndo, " A6:%s", etheraddr_string(mc->addr6)));
2311 ND_PRINT((ndo, ") "));
2312 }
2313
2314 switch (FC_TYPE(fc)) {
2315 case T_MGMT:
2316 mgmt_header_print(ndo, p, srcp, dstp);
2317 break;
2318 case T_CTRL:
2319 ctrl_header_print(ndo, fc, p, srcp, dstp);
2320 break;
2321 case T_DATA:
2322 data_header_print(ndo, fc, p, srcp, dstp);
2323 break;
2324 default:
2325 ND_PRINT((ndo, "(header) unknown IEEE802.11 frame type (%d)",
2326 FC_TYPE(fc)));
2327 *srcp = NULL;
2328 *dstp = NULL;
2329 break;
2330 }
2331 }
2332
2333 #ifndef roundup2
2334 #define roundup2(x, y) (((x)+((y)-1))&(~((y)-1))) /* if y is powers of two */
2335 #endif
2336
2337 static u_int
2338 ieee802_11_print(netdissect_options *ndo,
2339 const u_char *p, u_int length, u_int orig_caplen, int pad,
2340 u_int fcslen)
2341 {
2342 u_int16_t fc;
2343 u_int caplen, hdrlen, meshdrlen;
2344 const u_int8_t *src, *dst;
2345 u_short extracted_ethertype;
2346
2347 caplen = orig_caplen;
2348 /* Remove FCS, if present */
2349 if (length < fcslen) {
2350 ND_PRINT((ndo, "%s", tstr));
2351 return caplen;
2352 }
2353 length -= fcslen;
2354 if (caplen > length) {
2355 /* Amount of FCS in actual packet data, if any */
2356 fcslen = caplen - length;
2357 caplen -= fcslen;
2358 ndo->ndo_snapend -= fcslen;
2359 }
2360
2361 if (caplen < IEEE802_11_FC_LEN) {
2362 ND_PRINT((ndo, "%s", tstr));
2363 return orig_caplen;
2364 }
2365
2366 fc = EXTRACT_LE_16BITS(p);
2367 hdrlen = extract_header_length(ndo, fc);
2368 if (pad)
2369 hdrlen = roundup2(hdrlen, 4);
2370 if (ndo->ndo_Hflag && FC_TYPE(fc) == T_DATA &&
2371 DATA_FRAME_IS_QOS(FC_SUBTYPE(fc))) {
2372 meshdrlen = extract_mesh_header_length(p+hdrlen);
2373 hdrlen += meshdrlen;
2374 } else
2375 meshdrlen = 0;
2376
2377
2378 if (caplen < hdrlen) {
2379 ND_PRINT((ndo, "%s", tstr));
2380 return hdrlen;
2381 }
2382
2383 ieee_802_11_hdr_print(ndo, fc, p, hdrlen, meshdrlen, &src, &dst);
2384
2385 /*
2386 * Go past the 802.11 header.
2387 */
2388 length -= hdrlen;
2389 caplen -= hdrlen;
2390 p += hdrlen;
2391
2392 switch (FC_TYPE(fc)) {
2393 case T_MGMT:
2394 if (!mgmt_body_print(ndo, fc,
2395 (const struct mgmt_header_t *)(p - hdrlen), p, length)) {
2396 ND_PRINT((ndo, "%s", tstr));
2397 return hdrlen;
2398 }
2399 break;
2400 case T_CTRL:
2401 if (!ctrl_body_print(ndo, fc, p - hdrlen)) {
2402 ND_PRINT((ndo, "%s", tstr));
2403 return hdrlen;
2404 }
2405 break;
2406 case T_DATA:
2407 if (DATA_FRAME_IS_NULL(FC_SUBTYPE(fc)))
2408 return hdrlen; /* no-data frame */
2409 /* There may be a problem w/ AP not having this bit set */
2410 if (FC_WEP(fc)) {
2411 if (!wep_print(ndo, p)) {
2412 ND_PRINT((ndo, "%s", tstr));
2413 return hdrlen;
2414 }
2415 } else if (llc_print(ndo, p, length, caplen, dst, src,
2416 &extracted_ethertype) == 0) {
2417 /*
2418 * Some kinds of LLC packet we cannot
2419 * handle intelligently
2420 */
2421 if (!ndo->ndo_eflag)
2422 ieee_802_11_hdr_print(ndo, fc, p - hdrlen, hdrlen,
2423 meshdrlen, NULL, NULL);
2424 if (extracted_ethertype)
2425 ND_PRINT((ndo, "(LLC %s) ",
2426 etherproto_string(
2427 htons(extracted_ethertype))));
2428 if (!ndo->ndo_suppress_default_print)
2429 ND_DEFAULTPRINT(p, caplen);
2430 }
2431 break;
2432 default:
2433 ND_PRINT((ndo, "unknown 802.11 frame type (%d)", FC_TYPE(fc)));
2434 break;
2435 }
2436
2437 return hdrlen;
2438 }
2439
2440 /*
2441 * This is the top level routine of the printer. 'p' points
2442 * to the 802.11 header of the packet, 'h->ts' is the timestamp,
2443 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
2444 * is the number of bytes actually captured.
2445 */
2446 u_int
2447 ieee802_11_if_print(netdissect_options *ndo,
2448 const struct pcap_pkthdr *h, const u_char *p)
2449 {
2450 return ieee802_11_print(ndo, p, h->len, h->caplen, 0, 0);
2451 }
2452
2453 #define IEEE80211_CHAN_FHSS \
2454 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_GFSK)
2455 #define IEEE80211_CHAN_A \
2456 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2457 #define IEEE80211_CHAN_B \
2458 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
2459 #define IEEE80211_CHAN_PUREG \
2460 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_OFDM)
2461 #define IEEE80211_CHAN_G \
2462 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
2463
2464 #define IS_CHAN_FHSS(flags) \
2465 ((flags & IEEE80211_CHAN_FHSS) == IEEE80211_CHAN_FHSS)
2466 #define IS_CHAN_A(flags) \
2467 ((flags & IEEE80211_CHAN_A) == IEEE80211_CHAN_A)
2468 #define IS_CHAN_B(flags) \
2469 ((flags & IEEE80211_CHAN_B) == IEEE80211_CHAN_B)
2470 #define IS_CHAN_PUREG(flags) \
2471 ((flags & IEEE80211_CHAN_PUREG) == IEEE80211_CHAN_PUREG)
2472 #define IS_CHAN_G(flags) \
2473 ((flags & IEEE80211_CHAN_G) == IEEE80211_CHAN_G)
2474 #define IS_CHAN_ANYG(flags) \
2475 (IS_CHAN_PUREG(flags) || IS_CHAN_G(flags))
2476
2477 static void
2478 print_chaninfo(netdissect_options *ndo,
2479 int freq, int flags)
2480 {
2481 ND_PRINT((ndo, "%u MHz", freq));
2482 if (IS_CHAN_FHSS(flags))
2483 ND_PRINT((ndo, " FHSS"));
2484 if (IS_CHAN_A(flags)) {
2485 if (flags & IEEE80211_CHAN_HALF)
2486 ND_PRINT((ndo, " 11a/10Mhz"));
2487 else if (flags & IEEE80211_CHAN_QUARTER)
2488 ND_PRINT((ndo, " 11a/5Mhz"));
2489 else
2490 ND_PRINT((ndo, " 11a"));
2491 }
2492 if (IS_CHAN_ANYG(flags)) {
2493 if (flags & IEEE80211_CHAN_HALF)
2494 ND_PRINT((ndo, " 11g/10Mhz"));
2495 else if (flags & IEEE80211_CHAN_QUARTER)
2496 ND_PRINT((ndo, " 11g/5Mhz"));
2497 else
2498 ND_PRINT((ndo, " 11g"));
2499 } else if (IS_CHAN_B(flags))
2500 ND_PRINT((ndo, " 11b"));
2501 if (flags & IEEE80211_CHAN_TURBO)
2502 ND_PRINT((ndo, " Turbo"));
2503 if (flags & IEEE80211_CHAN_HT20)
2504 ND_PRINT((ndo, " ht/20"));
2505 else if (flags & IEEE80211_CHAN_HT40D)
2506 ND_PRINT((ndo, " ht/40-"));
2507 else if (flags & IEEE80211_CHAN_HT40U)
2508 ND_PRINT((ndo, " ht/40+"));
2509 ND_PRINT((ndo, " "));
2510 }
2511
2512 static int
2513 print_radiotap_field(netdissect_options *ndo,
2514 struct cpack_state *s, u_int32_t bit, u_int8_t *flags,
2515 struct radiotap_state *state, u_int32_t presentflags)
2516 {
2517 union {
2518 int8_t i8;
2519 u_int8_t u8;
2520 int16_t i16;
2521 u_int16_t u16;
2522 u_int32_t u32;
2523 u_int64_t u64;
2524 } u, u2, u3, u4;
2525 int rc;
2526
2527 switch (bit) {
2528 case IEEE80211_RADIOTAP_FLAGS:
2529 rc = cpack_uint8(s, &u.u8);
2530 if (rc != 0)
2531 break;
2532 *flags = u.u8;
2533 break;
2534 case IEEE80211_RADIOTAP_RATE:
2535 rc = cpack_uint8(s, &u.u8);
2536 if (rc != 0)
2537 break;
2538
2539 /* Save state rate */
2540 state->rate = u.u8;
2541 break;
2542 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
2543 case IEEE80211_RADIOTAP_DB_ANTNOISE:
2544 case IEEE80211_RADIOTAP_ANTENNA:
2545 rc = cpack_uint8(s, &u.u8);
2546 break;
2547 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
2548 case IEEE80211_RADIOTAP_DBM_ANTNOISE:
2549 rc = cpack_int8(s, &u.i8);
2550 break;
2551 case IEEE80211_RADIOTAP_CHANNEL:
2552 rc = cpack_uint16(s, &u.u16);
2553 if (rc != 0)
2554 break;
2555 rc = cpack_uint16(s, &u2.u16);
2556 break;
2557 case IEEE80211_RADIOTAP_FHSS:
2558 case IEEE80211_RADIOTAP_LOCK_QUALITY:
2559 case IEEE80211_RADIOTAP_TX_ATTENUATION:
2560 case IEEE80211_RADIOTAP_RX_FLAGS:
2561 rc = cpack_uint16(s, &u.u16);
2562 break;
2563 case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
2564 rc = cpack_uint8(s, &u.u8);
2565 break;
2566 case IEEE80211_RADIOTAP_DBM_TX_POWER:
2567 rc = cpack_int8(s, &u.i8);
2568 break;
2569 case IEEE80211_RADIOTAP_TSFT:
2570 rc = cpack_uint64(s, &u.u64);
2571 break;
2572 case IEEE80211_RADIOTAP_XCHANNEL:
2573 rc = cpack_uint32(s, &u.u32);
2574 if (rc != 0)
2575 break;
2576 rc = cpack_uint16(s, &u2.u16);
2577 if (rc != 0)
2578 break;
2579 rc = cpack_uint8(s, &u3.u8);
2580 if (rc != 0)
2581 break;
2582 rc = cpack_uint8(s, &u4.u8);
2583 break;
2584 case IEEE80211_RADIOTAP_MCS:
2585 rc = cpack_uint8(s, &u.u8);
2586 if (rc != 0)
2587 break;
2588 rc = cpack_uint8(s, &u2.u8);
2589 if (rc != 0)
2590 break;
2591 rc = cpack_uint8(s, &u3.u8);
2592 break;
2593 case IEEE80211_RADIOTAP_VENDOR_NAMESPACE: {
2594 u_int8_t vns[3];
2595 u_int16_t length;
2596 u_int8_t subspace;
2597
2598 if ((cpack_align_and_reserve(s, 2)) == NULL) {
2599 rc = -1;
2600 break;
2601 }
2602
2603 rc = cpack_uint8(s, &vns[0]);
2604 if (rc != 0)
2605 break;
2606 rc = cpack_uint8(s, &vns[1]);
2607 if (rc != 0)
2608 break;
2609 rc = cpack_uint8(s, &vns[2]);
2610 if (rc != 0)
2611 break;
2612 rc = cpack_uint8(s, &subspace);
2613 if (rc != 0)
2614 break;
2615 rc = cpack_uint16(s, &length);
2616 if (rc != 0)
2617 break;
2618
2619 /* Skip up to length */
2620 s->c_next += length;
2621 break;
2622 }
2623 default:
2624 /* this bit indicates a field whose
2625 * size we do not know, so we cannot
2626 * proceed. Just print the bit number.
2627 */
2628 ND_PRINT((ndo, "[bit %u] ", bit));
2629 return -1;
2630 }
2631
2632 if (rc != 0) {
2633 ND_PRINT((ndo, "%s", tstr));
2634 return rc;
2635 }
2636
2637 /* Preserve the state present flags */
2638 state->present = presentflags;
2639
2640 switch (bit) {
2641 case IEEE80211_RADIOTAP_CHANNEL:
2642 /*
2643 * If CHANNEL and XCHANNEL are both present, skip
2644 * CHANNEL.
2645 */
2646 if (presentflags & (1 << IEEE80211_RADIOTAP_XCHANNEL))
2647 break;
2648 print_chaninfo(ndo, u.u16, u2.u16);
2649 break;
2650 case IEEE80211_RADIOTAP_FHSS:
2651 ND_PRINT((ndo, "fhset %d fhpat %d ", u.u16 & 0xff, (u.u16 >> 8) & 0xff));
2652 break;
2653 case IEEE80211_RADIOTAP_RATE:
2654 /*
2655 * XXX On FreeBSD rate & 0x80 means we have an MCS. On
2656 * Linux and AirPcap it does not. (What about
2657 * Mac OS X, NetBSD, OpenBSD, and DragonFly BSD?)
2658 *
2659 * This is an issue either for proprietary extensions
2660 * to 11a or 11g, which do exist, or for 11n
2661 * implementations that stuff a rate value into
2662 * this field, which also appear to exist.
2663 *
2664 * We currently handle that by assuming that
2665 * if the 0x80 bit is set *and* the remaining
2666 * bits have a value between 0 and 15 it's
2667 * an MCS value, otherwise it's a rate. If
2668 * there are cases where systems that use
2669 * "0x80 + MCS index" for MCS indices > 15,
2670 * or stuff a rate value here between 64 and
2671 * 71.5 Mb/s in here, we'll need a preference
2672 * setting. Such rates do exist, e.g. 11n
2673 * MCS 7 at 20 MHz with a long guard interval.
2674 */
2675 if (u.u8 >= 0x80 && u.u8 <= 0x8f) {
2676 /*
2677 * XXX - we don't know the channel width
2678 * or guard interval length, so we can't
2679 * convert this to a data rate.
2680 *
2681 * If you want us to show a data rate,
2682 * use the MCS field, not the Rate field;
2683 * the MCS field includes not only the
2684 * MCS index, it also includes bandwidth
2685 * and guard interval information.
2686 *
2687 * XXX - can we get the channel width
2688 * from XChannel and the guard interval
2689 * information from Flags, at least on
2690 * FreeBSD?
2691 */
2692 ND_PRINT((ndo, "MCS %u ", u.u8 & 0x7f));
2693 } else
2694 ND_PRINT((ndo, "%2.1f Mb/s ", .5 * u.u8));
2695 break;
2696 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
2697 ND_PRINT((ndo, "%ddB signal ", u.i8));
2698 break;
2699 case IEEE80211_RADIOTAP_DBM_ANTNOISE:
2700 ND_PRINT((ndo, "%ddB noise ", u.i8));
2701 break;
2702 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
2703 ND_PRINT((ndo, "%ddB signal ", u.u8));
2704 break;
2705 case IEEE80211_RADIOTAP_DB_ANTNOISE:
2706 ND_PRINT((ndo, "%ddB noise ", u.u8));
2707 break;
2708 case IEEE80211_RADIOTAP_LOCK_QUALITY:
2709 ND_PRINT((ndo, "%u sq ", u.u16));
2710 break;
2711 case IEEE80211_RADIOTAP_TX_ATTENUATION:
2712 ND_PRINT((ndo, "%d tx power ", -(int)u.u16));
2713 break;
2714 case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
2715 ND_PRINT((ndo, "%ddB tx power ", -(int)u.u8));
2716 break;
2717 case IEEE80211_RADIOTAP_DBM_TX_POWER:
2718 ND_PRINT((ndo, "%ddBm tx power ", u.i8));
2719 break;
2720 case IEEE80211_RADIOTAP_FLAGS:
2721 if (u.u8 & IEEE80211_RADIOTAP_F_CFP)
2722 ND_PRINT((ndo, "cfp "));
2723 if (u.u8 & IEEE80211_RADIOTAP_F_SHORTPRE)
2724 ND_PRINT((ndo, "short preamble "));
2725 if (u.u8 & IEEE80211_RADIOTAP_F_WEP)
2726 ND_PRINT((ndo, "wep "));
2727 if (u.u8 & IEEE80211_RADIOTAP_F_FRAG)
2728 ND_PRINT((ndo, "fragmented "));
2729 if (u.u8 & IEEE80211_RADIOTAP_F_BADFCS)
2730 ND_PRINT((ndo, "bad-fcs "));
2731 break;
2732 case IEEE80211_RADIOTAP_ANTENNA:
2733 ND_PRINT((ndo, "antenna %d ", u.u8));
2734 break;
2735 case IEEE80211_RADIOTAP_TSFT:
2736 ND_PRINT((ndo, "%" PRIu64 "us tsft ", u.u64));
2737 break;
2738 case IEEE80211_RADIOTAP_RX_FLAGS:
2739 /* Do nothing for now */
2740 break;
2741 case IEEE80211_RADIOTAP_XCHANNEL:
2742 print_chaninfo(ndo, u2.u16, u.u32);
2743 break;
2744 case IEEE80211_RADIOTAP_MCS: {
2745 static const char *bandwidth[4] = {
2746 "20 MHz",
2747 "40 MHz",
2748 "20 MHz (L)",
2749 "20 MHz (U)"
2750 };
2751 float htrate;
2752
2753 if (u.u8 & IEEE80211_RADIOTAP_MCS_MCS_INDEX_KNOWN) {
2754 /*
2755 * We know the MCS index.
2756 */
2757 if (u3.u8 <= MAX_MCS_INDEX) {
2758 /*
2759 * And it's in-range.
2760 */
2761 if (u.u8 & (IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN|IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN)) {
2762 /*
2763 * And we know both the bandwidth and
2764 * the guard interval, so we can look
2765 * up the rate.
2766 */
2767 htrate =
2768 ieee80211_float_htrates \
2769 [u3.u8] \
2770 [((u2.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK) == IEEE80211_RADIOTAP_MCS_BANDWIDTH_40 ? 1 : 0)] \
2771 [((u2.u8 & IEEE80211_RADIOTAP_MCS_SHORT_GI) ? 1 : 0)];
2772 } else {
2773 /*
2774 * We don't know both the bandwidth
2775 * and the guard interval, so we can
2776 * only report the MCS index.
2777 */
2778 htrate = 0.0;
2779 }
2780 } else {
2781 /*
2782 * The MCS value is out of range.
2783 */
2784 htrate = 0.0;
2785 }
2786 if (htrate != 0.0) {
2787 /*
2788 * We have the rate.
2789 * Print it.
2790 */
2791 ND_PRINT((ndo, "%.1f Mb/s MCS %u ", htrate, u3.u8));
2792 } else {
2793 /*
2794 * We at least have the MCS index.
2795 * Print it.
2796 */
2797 ND_PRINT((ndo, "MCS %u ", u3.u8));
2798 }
2799 }
2800 if (u.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN) {
2801 ND_PRINT((ndo, "%s ",
2802 bandwidth[u2.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK]));
2803 }
2804 if (u.u8 & IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN) {
2805 ND_PRINT((ndo, "%s GI ",
2806 (u2.u8 & IEEE80211_RADIOTAP_MCS_SHORT_GI) ?
2807 "short" : "lon"));
2808 }
2809 if (u.u8 & IEEE80211_RADIOTAP_MCS_HT_FORMAT_KNOWN) {
2810 ND_PRINT((ndo, "%s ",
2811 (u2.u8 & IEEE80211_RADIOTAP_MCS_HT_GREENFIELD) ?
2812 "greenfield" : "mixed"));
2813 }
2814 if (u.u8 & IEEE80211_RADIOTAP_MCS_FEC_TYPE_KNOWN) {
2815 ND_PRINT((ndo, "%s FEC ",
2816 (u2.u8 & IEEE80211_RADIOTAP_MCS_FEC_LDPC) ?
2817 "LDPC" : "BCC"));
2818 }
2819 if (u.u8 & IEEE80211_RADIOTAP_MCS_STBC_KNOWN) {
2820 ND_PRINT((ndo, "RX-STBC%u ",
2821 (u2.u8 & IEEE80211_RADIOTAP_MCS_STBC_MASK) >> IEEE80211_RADIOTAP_MCS_STBC_SHIFT));
2822 }
2823
2824 break;
2825 }
2826 }
2827 return 0;
2828 }
2829
2830 static u_int
2831 ieee802_11_radio_print(netdissect_options *ndo,
2832 const u_char *p, u_int length, u_int caplen)
2833 {
2834 #define BITNO_32(x) (((x) >> 16) ? 16 + BITNO_16((x) >> 16) : BITNO_16((x)))
2835 #define BITNO_16(x) (((x) >> 8) ? 8 + BITNO_8((x) >> 8) : BITNO_8((x)))
2836 #define BITNO_8(x) (((x) >> 4) ? 4 + BITNO_4((x) >> 4) : BITNO_4((x)))
2837 #define BITNO_4(x) (((x) >> 2) ? 2 + BITNO_2((x) >> 2) : BITNO_2((x)))
2838 #define BITNO_2(x) (((x) & 2) ? 1 : 0)
2839 #define BIT(n) (1U << n)
2840 #define IS_EXTENDED(__p) \
2841 (EXTRACT_LE_32BITS(__p) & BIT(IEEE80211_RADIOTAP_EXT)) != 0
2842
2843 struct cpack_state cpacker;
2844 struct ieee80211_radiotap_header *hdr;
2845 u_int32_t present, next_present;
2846 u_int32_t presentflags = 0;
2847 u_int32_t *presentp, *last_presentp;
2848 enum ieee80211_radiotap_type bit;
2849 int bit0;
2850 u_int len;
2851 u_int8_t flags;
2852 int pad;
2853 u_int fcslen;
2854 struct radiotap_state state;
2855
2856 if (caplen < sizeof(*hdr)) {
2857 ND_PRINT((ndo, "%s", tstr));
2858 return caplen;
2859 }
2860
2861 hdr = (struct ieee80211_radiotap_header *)p;
2862
2863 len = EXTRACT_LE_16BITS(&hdr->it_len);
2864
2865 if (caplen < len) {
2866 ND_PRINT((ndo, "%s", tstr));
2867 return caplen;
2868 }
2869 cpack_init(&cpacker, (u_int8_t *)hdr, len); /* align against header start */
2870 cpack_advance(&cpacker, sizeof(*hdr)); /* includes the 1st bitmap */
2871 for (last_presentp = &hdr->it_present;
2872 IS_EXTENDED(last_presentp) &&
2873 (u_char*)(last_presentp + 1) <= p + len;
2874 last_presentp++)
2875 cpack_advance(&cpacker, sizeof(hdr->it_present)); /* more bitmaps */
2876
2877 /* are there more bitmap extensions than bytes in header? */
2878 if (IS_EXTENDED(last_presentp)) {
2879 ND_PRINT((ndo, "%s", tstr));
2880 return caplen;
2881 }
2882
2883 /* Assume no flags */
2884 flags = 0;
2885 /* Assume no Atheros padding between 802.11 header and body */
2886 pad = 0;
2887 /* Assume no FCS at end of frame */
2888 fcslen = 0;
2889 for (bit0 = 0, presentp = &hdr->it_present; presentp <= last_presentp;
2890 presentp++, bit0 += 32) {
2891 presentflags = EXTRACT_LE_32BITS(presentp);
2892
2893 /* Clear state. */
2894 memset(&state, 0, sizeof(state));
2895
2896 for (present = EXTRACT_LE_32BITS(presentp); present;
2897 present = next_present) {
2898 /* clear the least significant bit that is set */
2899 next_present = present & (present - 1);
2900
2901 /* extract the least significant bit that is set */
2902 bit = (enum ieee80211_radiotap_type)
2903 (bit0 + BITNO_32(present ^ next_present));
2904
2905 if (print_radiotap_field(ndo, &cpacker, bit, &flags, &state, presentflags) != 0)
2906 goto out;
2907 }
2908 }
2909
2910 out:
2911 if (flags & IEEE80211_RADIOTAP_F_DATAPAD)
2912 pad = 1; /* Atheros padding */
2913 if (flags & IEEE80211_RADIOTAP_F_FCS)
2914 fcslen = 4; /* FCS at end of packet */
2915 return len + ieee802_11_print(ndo, p + len, length - len, caplen - len, pad,
2916 fcslen);
2917 #undef BITNO_32
2918 #undef BITNO_16
2919 #undef BITNO_8
2920 #undef BITNO_4
2921 #undef BITNO_2
2922 #undef BIT
2923 }
2924
2925 static u_int
2926 ieee802_11_avs_radio_print(netdissect_options *ndo,
2927 const u_char *p, u_int length, u_int caplen)
2928 {
2929 u_int32_t caphdr_len;
2930
2931 if (caplen < 8) {
2932 ND_PRINT((ndo, "%s", tstr));
2933 return caplen;
2934 }
2935
2936 caphdr_len = EXTRACT_32BITS(p + 4);
2937 if (caphdr_len < 8) {
2938 /*
2939 * Yow! The capture header length is claimed not
2940 * to be large enough to include even the version
2941 * cookie or capture header length!
2942 */
2943 ND_PRINT((ndo, "%s", tstr));
2944 return caplen;
2945 }
2946
2947 if (caplen < caphdr_len) {
2948 ND_PRINT((ndo, "%s", tstr));
2949 return caplen;
2950 }
2951
2952 return caphdr_len + ieee802_11_print(ndo, p + caphdr_len,
2953 length - caphdr_len, caplen - caphdr_len, 0, 0);
2954 }
2955
2956 #define PRISM_HDR_LEN 144
2957
2958 #define WLANCAP_MAGIC_COOKIE_BASE 0x80211000
2959 #define WLANCAP_MAGIC_COOKIE_V1 0x80211001
2960 #define WLANCAP_MAGIC_COOKIE_V2 0x80211002
2961
2962 /*
2963 * For DLT_PRISM_HEADER; like DLT_IEEE802_11, but with an extra header,
2964 * containing information such as radio information, which we
2965 * currently ignore.
2966 *
2967 * If, however, the packet begins with WLANCAP_MAGIC_COOKIE_V1 or
2968 * WLANCAP_MAGIC_COOKIE_V2, it's really DLT_IEEE802_11_RADIO_AVS
2969 * (currently, on Linux, there's no ARPHRD_ type for
2970 * DLT_IEEE802_11_RADIO_AVS, as there is a ARPHRD_IEEE80211_PRISM
2971 * for DLT_PRISM_HEADER, so ARPHRD_IEEE80211_PRISM is used for
2972 * the AVS header, and the first 4 bytes of the header are used to
2973 * indicate whether it's a Prism header or an AVS header).
2974 */
2975 u_int
2976 prism_if_print(netdissect_options *ndo,
2977 const struct pcap_pkthdr *h, const u_char *p)
2978 {
2979 u_int caplen = h->caplen;
2980 u_int length = h->len;
2981 u_int32_t msgcode;
2982
2983 if (caplen < 4) {
2984 ND_PRINT((ndo, "%s", tstr));
2985 return caplen;
2986 }
2987
2988 msgcode = EXTRACT_32BITS(p);
2989 if (msgcode == WLANCAP_MAGIC_COOKIE_V1 ||
2990 msgcode == WLANCAP_MAGIC_COOKIE_V2)
2991 return ieee802_11_avs_radio_print(ndo, p, length, caplen);
2992
2993 if (caplen < PRISM_HDR_LEN) {
2994 ND_PRINT((ndo, "%s", tstr));
2995 return caplen;
2996 }
2997
2998 return PRISM_HDR_LEN + ieee802_11_print(ndo, p + PRISM_HDR_LEN,
2999 length - PRISM_HDR_LEN, caplen - PRISM_HDR_LEN, 0, 0);
3000 }
3001
3002 /*
3003 * For DLT_IEEE802_11_RADIO; like DLT_IEEE802_11, but with an extra
3004 * header, containing information such as radio information.
3005 */
3006 u_int
3007 ieee802_11_radio_if_print(netdissect_options *ndo,
3008 const struct pcap_pkthdr *h, const u_char *p)
3009 {
3010 return ieee802_11_radio_print(ndo, p, h->len, h->caplen);
3011 }
3012
3013 /*
3014 * For DLT_IEEE802_11_RADIO_AVS; like DLT_IEEE802_11, but with an
3015 * extra header, containing information such as radio information,
3016 * which we currently ignore.
3017 */
3018 u_int
3019 ieee802_11_radio_avs_if_print(netdissect_options *ndo,
3020 const struct pcap_pkthdr *h, const u_char *p)
3021 {
3022 return ieee802_11_avs_radio_print(ndo, p, h->len, h->caplen);
3023 }