* Return the transmit key to use in sending a frame to

 * Return the transmit key to use in sending a unicast frame.

 * the specified destination. Multicast traffic always

 * If a unicast key is set we use that.  When no unicast key is set

 * uses the group key.  Otherwise if a unicast key is

 * we fall back to the default transmit key.

 * set we use that.  When no unicast key is set we fall

 */

 * back to the default transmit key.

 */ 

ieee80211_crypto_getkey(struct ieee80211com *ic,

ieee80211_crypto_getucastkey(struct ieee80211com *ic, struct ieee80211_node *ni)

	const u_int8_t mac[IEEE80211_ADDR_LEN], struct ieee80211_node *ni)

#define	KEY_UNDEFINED(k)	((k).wk_cipher == &ieee80211_cipher_none)

        if (KEY_UNDEFINED(ni->ni_ucastkey)) {

	if (IEEE80211_IS_MULTICAST(mac) || KEY_UNDEFINED(ni->ni_ucastkey)) {

                if (ic->ic_def_txkey == IEEE80211_KEYIX_NONE ||

		if (ic->ic_def_txkey == IEEE80211_KEYIX_NONE ||

                    KEY_UNDEFINED(ic->ic_nw_keys[ic->ic_def_txkey]))

		    KEY_UNDEFINED(ic->ic_nw_keys[ic->ic_def_txkey])) {

                        return NULL;

			IEEE80211_DPRINTF(ic, IEEE80211_MSG_OUTPUT,

                return &ic->ic_nw_keys[ic->ic_def_txkey];

			    ("%s: no transmit key, def_txkey %u\n",

        } else {

			    __func__, ic->ic_def_txkey));

                return &ni->ni_ucastkey;

			/* XXX statistic */

        }

			return NULL;

}

		}

		return &ic->ic_nw_keys[ic->ic_def_txkey];

/*

	} else {

 * Return the transmit key to use in sending a multicast frame.

		return &ni->ni_ucastkey;

 * Multicast traffic always uses the group key which is installed as

	}

 * the default tx key.

#undef KEY_UNDEFINED

 */

static inline struct ieee80211_key *

ieee80211_crypto_getmcastkey(struct ieee80211com *ic, struct ieee80211_node *ni)

{

        if (ic->ic_def_txkey == IEEE80211_KEYIX_NONE ||

            KEY_UNDEFINED(ic->ic_nw_keys[ic->ic_def_txkey]))

                return NULL;

        return &ic->ic_nw_keys[ic->ic_def_txkey];

	/*

        /*

	 * Insure space for additional headers.  First

         * Insure space for additional headers.  First identify

	 * identify transmit key to use in calculating any

         * transmit key to use in calculating any buffer adjustments

	 * buffer adjustments required.  This is also used

         * required.  This is also used below to do privacy

	 * below to do privacy encapsulation work.

         * encapsulation work.  Then calculate the 802.11 header

	 *

         * size and any padding required by the driver.

	 * Note key may be NULL if we fall back to the default

         *

	 * transmit key and that is not set.  In that case the

         * Note key may be NULL if we fall back to the default

	 * buffer may not be expanded as needed by the cipher

         * transmit key and that is not set.  In that case the

	 * routines, but they will/should discard it.

         * buffer may not be expanded as needed by the cipher

	 */

         * routines, but they will/should discard it.

	if (ic->ic_flags & IEEE80211_F_PRIVACY)

         */

		key = ieee80211_crypto_getkey(ic, eh.ether_dhost, ni);

        if (ic->ic_flags & IEEE80211_F_PRIVACY) {

	else

                if (ic->ic_opmode == IEEE80211_M_STA ||

		key = NULL;

                    !IEEE80211_IS_MULTICAST(eh.ether_dhost))

                        key = ieee80211_crypto_getucastkey(ic, ni);

                else

                        key = ieee80211_crypto_getmcastkey(ic, ni);

                if (key == NULL && eh.ether_type != htons(ETHERTYPE_PAE)) {

                        IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,

                            ("[%s] no default transmit key (%s) deftxkey %u\n",

                            __func__,

                            ether_sprintf(eh.ether_dhost), ic->ic_def_txkey));

                        ic->ic_stats.is_tx_nodefkey++;

                }

        } else

                key = NULL;

	if (eh.ether_type != __constant_htons(ETHERTYPE_PAE) ||

        if (key != NULL) {

	    (key != NULL && (ic->ic_flags & IEEE80211_F_WPA))) {

                /*

		/*

                 * IEEE 802.1X: send EAPOL frames always in the clear.

		 * IEEE 802.1X: send EAPOL frames always in the clear.

                 * WPA/WPA2: encrypt EAPOL keys when pairwise keys are set.

		 * WPA/WPA2: encrypt EAPOL keys when pairwise keys are set.

                 */

		 */

                if (eh.ether_type != __constant_htons(ETHERTYPE_PAE) ||

		if (key != NULL) {

                    ((ic->ic_flags & IEEE80211_F_WPA) &&

			wh->i_fc[1] |= IEEE80211_FC1_WEP;

                     !KEY_UNDEFINED(ni->ni_ucastkey))) {

			/* XXX do fragmentation */

                        wh->i_fc[1] |= IEEE80211_FC1_WEP;

			if (!ieee80211_crypto_enmic(ic, key, skb)) {

                        /* XXX do fragmentation */

				IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,

                        if (!ieee80211_crypto_enmic(ic, key, skb)) {

				    ("[%s] enmic failed, discard frame\n",

                                IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,

				    ether_sprintf(eh.ether_dhost)));

                                    ("[%s] enmic failed, discard frame\n",

				/* XXX statistic */

                                    ether_sprintf(eh.ether_dhost)));

				goto bad;

                                /* XXX statistic */

			}

                                goto bad;

		}

                        }

	}

                }

        }