1 /*
2 *************************************************************************
3 * Ralink Tech Inc.
4 * 5F., No.36, Taiyuan St., Jhubei City,
5 * Hsinchu County 302,
6 * Taiwan, R.O.C.
7 *
8 * (c) Copyright 2002-2007, Ralink Technology, Inc.
9 *
10 * This program is free software; you can redistribute it and/or modify *
11 * it under the terms of the GNU General Public License as published by *
12 * the Free Software Foundation; either version 2 of the License, or *
13 * (at your option) any later version. *
14 * *
15 * This program is distributed in the hope that it will be useful, *
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
18 * GNU General Public License for more details. *
19 * *
20 * You should have received a copy of the GNU General Public License *
21 * along with this program; if not, write to the *
22 * Free Software Foundation, Inc., *
23 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
24 * *
25 *************************************************************************
26
27 Module Name:
28 sanity.c
29
30 Abstract:
31
32 Revision History:
33 Who When What
34 -------- ---------- ----------------------------------------------
35 John Chang 2004-09-01 add WMM support
36 */
37 #include "../rt_config.h"
38
39
40 extern UCHAR CISCO_OUI[];
41
42 extern UCHAR WPA_OUI[];
43 extern UCHAR RSN_OUI[];
44 extern UCHAR WME_INFO_ELEM[];
45 extern UCHAR WME_PARM_ELEM[];
46 extern UCHAR Ccx2QosInfo[];
47 extern UCHAR RALINK_OUI[];
48 extern UCHAR BROADCOM_OUI[];
49 extern UCHAR WPS_OUI[];
50
51 /*
52 ==========================================================================
53 Description:
54 MLME message sanity check
55 Return:
56 TRUE if all parameters are OK, FALSE otherwise
57
58 IRQL = DISPATCH_LEVEL
59
60 ==========================================================================
61 */
MlmeAddBAReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pAddr2)62 BOOLEAN MlmeAddBAReqSanity(
63 IN PRTMP_ADAPTER pAd,
64 IN VOID *Msg,
65 IN ULONG MsgLen,
66 OUT PUCHAR pAddr2)
67 {
68 PMLME_ADDBA_REQ_STRUCT pInfo;
69
70 pInfo = (MLME_ADDBA_REQ_STRUCT *)Msg;
71
72 if ((MsgLen != sizeof(MLME_ADDBA_REQ_STRUCT)))
73 {
74 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
75 return FALSE;
76 }
77
78 if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
79 {
80 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
81 return FALSE;
82 }
83
84 if ((pInfo->pAddr[0]&0x01) == 0x01)
85 {
86 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
87 return FALSE;
88 }
89
90 return TRUE;
91 }
92
93 /*
94 ==========================================================================
95 Description:
96 MLME message sanity check
97 Return:
98 TRUE if all parameters are OK, FALSE otherwise
99
100 IRQL = DISPATCH_LEVEL
101
102 ==========================================================================
103 */
MlmeDelBAReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen)104 BOOLEAN MlmeDelBAReqSanity(
105 IN PRTMP_ADAPTER pAd,
106 IN VOID *Msg,
107 IN ULONG MsgLen)
108 {
109 MLME_DELBA_REQ_STRUCT *pInfo;
110 pInfo = (MLME_DELBA_REQ_STRUCT *)Msg;
111
112 if ((MsgLen != sizeof(MLME_DELBA_REQ_STRUCT)))
113 {
114 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
115 return FALSE;
116 }
117
118 if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
119 {
120 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
121 return FALSE;
122 }
123
124 if ((pInfo->TID & 0xf0))
125 {
126 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
127 return FALSE;
128 }
129
130 if (NdisEqualMemory(pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr, MAC_ADDR_LEN) == 0)
131 {
132 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
133 return FALSE;
134 }
135
136 return TRUE;
137 }
138
PeerAddBAReqActionSanity(IN PRTMP_ADAPTER pAd,IN VOID * pMsg,IN ULONG MsgLen,OUT PUCHAR pAddr2)139 BOOLEAN PeerAddBAReqActionSanity(
140 IN PRTMP_ADAPTER pAd,
141 IN VOID *pMsg,
142 IN ULONG MsgLen,
143 OUT PUCHAR pAddr2)
144 {
145 PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
146 PFRAME_ADDBA_REQ pAddFrame;
147 pAddFrame = (PFRAME_ADDBA_REQ)(pMsg);
148 if (MsgLen < (sizeof(FRAME_ADDBA_REQ)))
149 {
150 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n", MsgLen));
151 return FALSE;
152 }
153 // we support immediate BA.
154 *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
155 pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
156 pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
157
158 if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
159 {
160 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
161 DBGPRINT(RT_DEBUG_ERROR,("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n", pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize, pAddFrame->BaParm.AMSDUSupported));
162 return FALSE;
163 }
164
165 // we support immediate BA.
166 if (pAddFrame->BaParm.TID &0xfff0)
167 {
168 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n", pAddFrame->BaParm.TID));
169 return FALSE;
170 }
171 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
172 return TRUE;
173 }
174
PeerAddBARspActionSanity(IN PRTMP_ADAPTER pAd,IN VOID * pMsg,IN ULONG MsgLen)175 BOOLEAN PeerAddBARspActionSanity(
176 IN PRTMP_ADAPTER pAd,
177 IN VOID *pMsg,
178 IN ULONG MsgLen)
179 {
180 PFRAME_ADDBA_RSP pAddFrame;
181
182 pAddFrame = (PFRAME_ADDBA_RSP)(pMsg);
183 if (MsgLen < (sizeof(FRAME_ADDBA_RSP)))
184 {
185 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n", MsgLen));
186 return FALSE;
187 }
188 // we support immediate BA.
189 *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
190 pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
191 pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
192
193 if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
194 {
195 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
196 return FALSE;
197 }
198
199 // we support immediate BA.
200 if (pAddFrame->BaParm.TID &0xfff0)
201 {
202 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n", pAddFrame->BaParm.TID));
203 return FALSE;
204 }
205 return TRUE;
206
207 }
208
PeerDelBAActionSanity(IN PRTMP_ADAPTER pAd,IN UCHAR Wcid,IN VOID * pMsg,IN ULONG MsgLen)209 BOOLEAN PeerDelBAActionSanity(
210 IN PRTMP_ADAPTER pAd,
211 IN UCHAR Wcid,
212 IN VOID *pMsg,
213 IN ULONG MsgLen )
214 {
215 //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
216 PFRAME_DELBA_REQ pDelFrame;
217 if (MsgLen != (sizeof(FRAME_DELBA_REQ)))
218 return FALSE;
219
220 if (Wcid >= MAX_LEN_OF_MAC_TABLE)
221 return FALSE;
222
223 pDelFrame = (PFRAME_DELBA_REQ)(pMsg);
224
225 *(USHORT *)(&pDelFrame->DelbaParm) = cpu2le16(*(USHORT *)(&pDelFrame->DelbaParm));
226 pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
227
228 if (pDelFrame->DelbaParm.TID &0xfff0)
229 return FALSE;
230
231 return TRUE;
232 }
233
234 /*
235 ==========================================================================
236 Description:
237 MLME message sanity check
238 Return:
239 TRUE if all parameters are OK, FALSE otherwise
240
241 IRQL = DISPATCH_LEVEL
242
243 ==========================================================================
244 */
PeerBeaconAndProbeRspSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,IN UCHAR MsgChannel,OUT PUCHAR pAddr2,OUT PUCHAR pBssid,OUT CHAR Ssid[],OUT UCHAR * pSsidLen,OUT UCHAR * pBssType,OUT USHORT * pBeaconPeriod,OUT UCHAR * pChannel,OUT UCHAR * pNewChannel,OUT LARGE_INTEGER * pTimestamp,OUT CF_PARM * pCfParm,OUT USHORT * pAtimWin,OUT USHORT * pCapabilityInfo,OUT UCHAR * pErp,OUT UCHAR * pDtimCount,OUT UCHAR * pDtimPeriod,OUT UCHAR * pBcastFlag,OUT UCHAR * pMessageToMe,OUT UCHAR SupRate[],OUT UCHAR * pSupRateLen,OUT UCHAR ExtRate[],OUT UCHAR * pExtRateLen,OUT UCHAR * pCkipFlag,OUT UCHAR * pAironetCellPowerLimit,OUT PEDCA_PARM pEdcaParm,OUT PQBSS_LOAD_PARM pQbssLoad,OUT PQOS_CAPABILITY_PARM pQosCapability,OUT ULONG * pRalinkIe,OUT UCHAR * pHtCapabilityLen,OUT UCHAR * pPreNHtCapabilityLen,OUT HT_CAPABILITY_IE * pHtCapability,OUT UCHAR * AddHtInfoLen,OUT ADD_HT_INFO_IE * AddHtInfo,OUT UCHAR * NewExtChannelOffset,OUT USHORT * LengthVIE,OUT PNDIS_802_11_VARIABLE_IEs pVIE)245 BOOLEAN PeerBeaconAndProbeRspSanity(
246 IN PRTMP_ADAPTER pAd,
247 IN VOID *Msg,
248 IN ULONG MsgLen,
249 IN UCHAR MsgChannel,
250 OUT PUCHAR pAddr2,
251 OUT PUCHAR pBssid,
252 OUT CHAR Ssid[],
253 OUT UCHAR *pSsidLen,
254 OUT UCHAR *pBssType,
255 OUT USHORT *pBeaconPeriod,
256 OUT UCHAR *pChannel,
257 OUT UCHAR *pNewChannel,
258 OUT LARGE_INTEGER *pTimestamp,
259 OUT CF_PARM *pCfParm,
260 OUT USHORT *pAtimWin,
261 OUT USHORT *pCapabilityInfo,
262 OUT UCHAR *pErp,
263 OUT UCHAR *pDtimCount,
264 OUT UCHAR *pDtimPeriod,
265 OUT UCHAR *pBcastFlag,
266 OUT UCHAR *pMessageToMe,
267 OUT UCHAR SupRate[],
268 OUT UCHAR *pSupRateLen,
269 OUT UCHAR ExtRate[],
270 OUT UCHAR *pExtRateLen,
271 OUT UCHAR *pCkipFlag,
272 OUT UCHAR *pAironetCellPowerLimit,
273 OUT PEDCA_PARM pEdcaParm,
274 OUT PQBSS_LOAD_PARM pQbssLoad,
275 OUT PQOS_CAPABILITY_PARM pQosCapability,
276 OUT ULONG *pRalinkIe,
277 OUT UCHAR *pHtCapabilityLen,
278 #ifdef CONFIG_STA_SUPPORT
279 OUT UCHAR *pPreNHtCapabilityLen,
280 #endif // CONFIG_STA_SUPPORT //
281 OUT HT_CAPABILITY_IE *pHtCapability,
282 OUT UCHAR *AddHtInfoLen,
283 OUT ADD_HT_INFO_IE *AddHtInfo,
284 OUT UCHAR *NewExtChannelOffset, // Ht extension channel offset(above or below)
285 OUT USHORT *LengthVIE,
286 OUT PNDIS_802_11_VARIABLE_IEs pVIE)
287 {
288 CHAR *Ptr;
289 #ifdef CONFIG_STA_SUPPORT
290 CHAR TimLen;
291 #endif // CONFIG_STA_SUPPORT //
292 PFRAME_802_11 pFrame;
293 PEID_STRUCT pEid;
294 UCHAR SubType;
295 UCHAR Sanity;
296 //UCHAR ECWMin, ECWMax;
297 //MAC_CSR9_STRUC Csr9;
298 ULONG Length = 0;
299
300 // For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel
301 // 1. If the AP is 11n enabled, then check the control channel.
302 // 2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!!)
303 UCHAR CtrlChannel = 0;
304
305 // Add for 3 necessary EID field check
306 Sanity = 0;
307
308 *pAtimWin = 0;
309 *pErp = 0;
310 *pDtimCount = 0;
311 *pDtimPeriod = 0;
312 *pBcastFlag = 0;
313 *pMessageToMe = 0;
314 *pExtRateLen = 0;
315 *pCkipFlag = 0; // Default of CkipFlag is 0
316 *pAironetCellPowerLimit = 0xFF; // Default of AironetCellPowerLimit is 0xFF
317 *LengthVIE = 0; // Set the length of VIE to init value 0
318 *pHtCapabilityLen = 0; // Set the length of VIE to init value 0
319 #ifdef CONFIG_STA_SUPPORT
320 if (pAd->OpMode == OPMODE_STA)
321 *pPreNHtCapabilityLen = 0; // Set the length of VIE to init value 0
322 #endif // CONFIG_STA_SUPPORT //
323 *AddHtInfoLen = 0; // Set the length of VIE to init value 0
324 *pRalinkIe = 0;
325 *pNewChannel = 0;
326 *NewExtChannelOffset = 0xff; //Default 0xff means no such IE
327 pCfParm->bValid = FALSE; // default: no IE_CF found
328 pQbssLoad->bValid = FALSE; // default: no IE_QBSS_LOAD found
329 pEdcaParm->bValid = FALSE; // default: no IE_EDCA_PARAMETER found
330 pQosCapability->bValid = FALSE; // default: no IE_QOS_CAPABILITY found
331
332 pFrame = (PFRAME_802_11)Msg;
333
334 // get subtype from header
335 SubType = (UCHAR)pFrame->Hdr.FC.SubType;
336
337 // get Addr2 and BSSID from header
338 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
339 COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
340
341 Ptr = pFrame->Octet;
342 Length += LENGTH_802_11;
343
344 // get timestamp from payload and advance the pointer
345 NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
346
347 pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
348 pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
349
350 Ptr += TIMESTAMP_LEN;
351 Length += TIMESTAMP_LEN;
352
353 // get beacon interval from payload and advance the pointer
354 NdisMoveMemory(pBeaconPeriod, Ptr, 2);
355 Ptr += 2;
356 Length += 2;
357
358 // get capability info from payload and advance the pointer
359 NdisMoveMemory(pCapabilityInfo, Ptr, 2);
360 Ptr += 2;
361 Length += 2;
362
363 if (CAP_IS_ESS_ON(*pCapabilityInfo))
364 *pBssType = BSS_INFRA;
365 else
366 *pBssType = BSS_ADHOC;
367
368 pEid = (PEID_STRUCT) Ptr;
369
370 // get variable fields from payload and advance the pointer
371 while ((Length + 2 + pEid->Len) <= MsgLen)
372 {
373 //
374 // Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow.
375 //
376 if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN)
377 {
378 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
379 (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
380 break;
381 }
382
383 switch(pEid->Eid)
384 {
385 case IE_SSID:
386 // Already has one SSID EID in this beacon, ignore the second one
387 if (Sanity & 0x1)
388 break;
389 if(pEid->Len <= MAX_LEN_OF_SSID)
390 {
391 NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
392 *pSsidLen = pEid->Len;
393 Sanity |= 0x1;
394 }
395 else
396 {
397 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
398 return FALSE;
399 }
400 break;
401
402 case IE_SUPP_RATES:
403 if(pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
404 {
405 Sanity |= 0x2;
406 NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
407 *pSupRateLen = pEid->Len;
408
409 // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
410 // from ScanTab. We should report as is. And filter out unsupported
411 // rates in MlmeAux.
412 // Check against the supported rates
413 // RTMPCheckRates(pAd, SupRate, pSupRateLen);
414 }
415 else
416 {
417 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",pEid->Len));
418 return FALSE;
419 }
420 break;
421
422 case IE_HT_CAP:
423 if (pEid->Len >= SIZE_HT_CAP_IE) //Note: allow extension.!!
424 {
425 NdisMoveMemory(pHtCapability, pEid->Octet, sizeof(HT_CAPABILITY_IE));
426 *pHtCapabilityLen = SIZE_HT_CAP_IE; // Nnow we only support 26 bytes.
427
428 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
429 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
430
431 #ifdef CONFIG_STA_SUPPORT
432 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
433 {
434 *pPreNHtCapabilityLen = 0; // Nnow we only support 26 bytes.
435
436 Ptr = (PUCHAR) pVIE;
437 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
438 *LengthVIE += (pEid->Len + 2);
439 }
440 #endif // CONFIG_STA_SUPPORT //
441 }
442 else
443 {
444 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n", pEid->Len));
445 }
446
447 break;
448 case IE_ADD_HT:
449 if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
450 {
451 // This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
452 // copy first sizeof(ADD_HT_INFO_IE)
453 NdisMoveMemory(AddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
454 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
455
456 CtrlChannel = AddHtInfo->ControlChan;
457
458 *(USHORT *)(&AddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo2));
459 *(USHORT *)(&AddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo3));
460
461 #ifdef CONFIG_STA_SUPPORT
462 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
463 {
464 Ptr = (PUCHAR) pVIE;
465 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
466 *LengthVIE += (pEid->Len + 2);
467 }
468 #endif // CONFIG_STA_SUPPORT //
469 }
470 else
471 {
472 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
473 }
474
475 break;
476 case IE_SECONDARY_CH_OFFSET:
477 if (pEid->Len == 1)
478 {
479 *NewExtChannelOffset = pEid->Octet[0];
480 }
481 else
482 {
483 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
484 }
485
486 break;
487 case IE_FH_PARM:
488 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
489 break;
490
491 case IE_DS_PARM:
492 if(pEid->Len == 1)
493 {
494 *pChannel = *pEid->Octet;
495 #ifdef CONFIG_STA_SUPPORT
496 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
497 {
498 if (ChannelSanity(pAd, *pChannel) == 0)
499 {
500
501 return FALSE;
502 }
503 }
504 #endif // CONFIG_STA_SUPPORT //
505 Sanity |= 0x4;
506 }
507 else
508 {
509 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",pEid->Len));
510 return FALSE;
511 }
512 break;
513
514 case IE_CF_PARM:
515 if(pEid->Len == 6)
516 {
517 pCfParm->bValid = TRUE;
518 pCfParm->CfpCount = pEid->Octet[0];
519 pCfParm->CfpPeriod = pEid->Octet[1];
520 pCfParm->CfpMaxDuration = pEid->Octet[2] + 256 * pEid->Octet[3];
521 pCfParm->CfpDurRemaining = pEid->Octet[4] + 256 * pEid->Octet[5];
522 }
523 else
524 {
525 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
526 return FALSE;
527 }
528 break;
529
530 case IE_IBSS_PARM:
531 if(pEid->Len == 2)
532 {
533 NdisMoveMemory(pAtimWin, pEid->Octet, pEid->Len);
534 }
535 else
536 {
537 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
538 return FALSE;
539 }
540 break;
541
542 #ifdef CONFIG_STA_SUPPORT
543 case IE_TIM:
544 if(INFRA_ON(pAd) && SubType == SUBTYPE_BEACON)
545 {
546 GetTimBit((PUCHAR)pEid, pAd->StaActive.Aid, &TimLen, pBcastFlag, pDtimCount, pDtimPeriod, pMessageToMe);
547 }
548 break;
549 #endif // CONFIG_STA_SUPPORT //
550 case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
551 if(pEid->Len == 3)
552 {
553 *pNewChannel = pEid->Octet[1]; //extract new channel number
554 }
555 break;
556
557 // New for WPA
558 // CCX v2 has the same IE, we need to parse that too
559 // Wifi WMM use the same IE vale, need to parse that too
560 // case IE_WPA:
561 case IE_VENDOR_SPECIFIC:
562 // Check the OUI version, filter out non-standard usage
563 if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3) && (pEid->Len == 7))
564 {
565 //*pRalinkIe = pEid->Octet[3];
566 if (pEid->Octet[3] != 0)
567 *pRalinkIe = pEid->Octet[3];
568 else
569 *pRalinkIe = 0xf0000000; // Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag.
570 }
571 #ifdef CONFIG_STA_SUPPORT
572 #ifdef DOT11_N_SUPPORT
573 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
574
575 // Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP,
576 // Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE
577 else if ((*pHtCapabilityLen == 0) && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI, 3) && (pEid->Len >= 4) && (pAd->OpMode == OPMODE_STA))
578 {
579 if ((pEid->Octet[3] == OUI_PREN_HT_CAP) && (pEid->Len >= 30) && (*pHtCapabilityLen == 0))
580 {
581 NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
582 *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
583 }
584
585 if ((pEid->Octet[3] == OUI_PREN_ADD_HT) && (pEid->Len >= 26))
586 {
587 NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
588 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
589 }
590 }
591 #endif // DOT11_N_SUPPORT //
592 #endif // CONFIG_STA_SUPPORT //
593 else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
594 {
595 // Copy to pVIE which will report to microsoft bssid list.
596 Ptr = (PUCHAR) pVIE;
597 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
598 *LengthVIE += (pEid->Len + 2);
599 }
600 else if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
601 {
602 PUCHAR ptr;
603 int i;
604
605 // parsing EDCA parameters
606 pEdcaParm->bValid = TRUE;
607 pEdcaParm->bQAck = FALSE; // pEid->Octet[0] & 0x10;
608 pEdcaParm->bQueueRequest = FALSE; // pEid->Octet[0] & 0x20;
609 pEdcaParm->bTxopRequest = FALSE; // pEid->Octet[0] & 0x40;
610 pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
611 pEdcaParm->bAPSDCapable = (pEid->Octet[6] & 0x80) ? 1 : 0;
612 ptr = &pEid->Octet[8];
613 for (i=0; i<4; i++)
614 {
615 UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
616 pEdcaParm->bACM[aci] = (((*ptr) & 0x10) == 0x10); // b5 is ACM
617 pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f; // b0~3 is AIFSN
618 pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f; // b0~4 is Cwmin
619 pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4; // b5~8 is Cwmax
620 pEdcaParm->Txop[aci] = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
621 ptr += 4; // point to next AC
622 }
623 }
624 else if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6) && (pEid->Len == 7))
625 {
626 // parsing EDCA parameters
627 pEdcaParm->bValid = TRUE;
628 pEdcaParm->bQAck = FALSE; // pEid->Octet[0] & 0x10;
629 pEdcaParm->bQueueRequest = FALSE; // pEid->Octet[0] & 0x20;
630 pEdcaParm->bTxopRequest = FALSE; // pEid->Octet[0] & 0x40;
631 pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
632 pEdcaParm->bAPSDCapable = (pEid->Octet[6] & 0x80) ? 1 : 0;
633
634 // use default EDCA parameter
635 pEdcaParm->bACM[QID_AC_BE] = 0;
636 pEdcaParm->Aifsn[QID_AC_BE] = 3;
637 pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
638 pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
639 pEdcaParm->Txop[QID_AC_BE] = 0;
640
641 pEdcaParm->bACM[QID_AC_BK] = 0;
642 pEdcaParm->Aifsn[QID_AC_BK] = 7;
643 pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
644 pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
645 pEdcaParm->Txop[QID_AC_BK] = 0;
646
647 pEdcaParm->bACM[QID_AC_VI] = 0;
648 pEdcaParm->Aifsn[QID_AC_VI] = 2;
649 pEdcaParm->Cwmin[QID_AC_VI] = CW_MIN_IN_BITS-1;
650 pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
651 pEdcaParm->Txop[QID_AC_VI] = 96; // AC_VI: 96*32us ~= 3ms
652
653 pEdcaParm->bACM[QID_AC_VO] = 0;
654 pEdcaParm->Aifsn[QID_AC_VO] = 2;
655 pEdcaParm->Cwmin[QID_AC_VO] = CW_MIN_IN_BITS-2;
656 pEdcaParm->Cwmax[QID_AC_VO] = CW_MAX_IN_BITS-1;
657 pEdcaParm->Txop[QID_AC_VO] = 48; // AC_VO: 48*32us ~= 1.5ms
658 }
659 break;
660
661 case IE_EXT_SUPP_RATES:
662 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
663 {
664 NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
665 *pExtRateLen = pEid->Len;
666
667 // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
668 // from ScanTab. We should report as is. And filter out unsupported
669 // rates in MlmeAux.
670 // Check against the supported rates
671 // RTMPCheckRates(pAd, ExtRate, pExtRateLen);
672 }
673 break;
674
675 case IE_ERP:
676 if (pEid->Len == 1)
677 {
678 *pErp = (UCHAR)pEid->Octet[0];
679 }
680 break;
681
682 case IE_AIRONET_CKIP:
683 // 0. Check Aironet IE length, it must be larger or equal to 28
684 // Cisco AP350 used length as 28
685 // Cisco AP12XX used length as 30
686 if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
687 break;
688
689 // 1. Copy CKIP flag byte to buffer for process
690 *pCkipFlag = *(pEid->Octet + 8);
691 break;
692
693 case IE_AP_TX_POWER:
694 // AP Control of Client Transmit Power
695 //0. Check Aironet IE length, it must be 6
696 if (pEid->Len != 0x06)
697 break;
698
699 // Get cell power limit in dBm
700 if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
701 *pAironetCellPowerLimit = *(pEid->Octet + 4);
702 break;
703
704 // WPA2 & 802.11i RSN
705 case IE_RSN:
706 // There is no OUI for version anymore, check the group cipher OUI before copying
707 if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
708 {
709 // Copy to pVIE which will report to microsoft bssid list.
710 Ptr = (PUCHAR) pVIE;
711 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
712 *LengthVIE += (pEid->Len + 2);
713 }
714 break;
715 #ifdef CONFIG_STA_SUPPORT
716 #ifdef EXT_BUILD_CHANNEL_LIST
717 case IE_COUNTRY:
718 Ptr = (PUCHAR) pVIE;
719 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
720 *LengthVIE += (pEid->Len + 2);
721 break;
722 #endif // EXT_BUILD_CHANNEL_LIST //
723 #endif // CONFIG_STA_SUPPORT //
724
725 default:
726 break;
727 }
728
729 Length = Length + 2 + pEid->Len; // Eid[1] + Len[1]+ content[Len]
730 pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
731 }
732
733 // For some 11a AP. it did not have the channel EID, patch here
734 #ifdef CONFIG_STA_SUPPORT
735 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
736 {
737 UCHAR LatchRfChannel = MsgChannel;
738 if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0))
739 {
740 if (CtrlChannel != 0)
741 *pChannel = CtrlChannel;
742 else
743 *pChannel = LatchRfChannel;
744 Sanity |= 0x4;
745 }
746 }
747 #endif // CONFIG_STA_SUPPORT //
748
749 if (Sanity != 0x7)
750 {
751 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n", Sanity));
752 return FALSE;
753 }
754 else
755 {
756 return TRUE;
757 }
758
759 }
760
761 #ifdef DOT11N_DRAFT3
762 /*
763 ==========================================================================
764 Description:
765 MLME message sanity check for some IE addressed in 802.11n d3.03.
766 Return:
767 TRUE if all parameters are OK, FALSE otherwise
768
769 IRQL = DISPATCH_LEVEL
770
771 ==========================================================================
772 */
PeerBeaconAndProbeRspSanity2(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT UCHAR * RegClass)773 BOOLEAN PeerBeaconAndProbeRspSanity2(
774 IN PRTMP_ADAPTER pAd,
775 IN VOID *Msg,
776 IN ULONG MsgLen,
777 OUT UCHAR *RegClass)
778 {
779 CHAR *Ptr;
780 PFRAME_802_11 pFrame;
781 PEID_STRUCT pEid;
782 ULONG Length = 0;
783
784 pFrame = (PFRAME_802_11)Msg;
785
786 *RegClass = 0;
787 Ptr = pFrame->Octet;
788 Length += LENGTH_802_11;
789
790 // get timestamp from payload and advance the pointer
791 Ptr += TIMESTAMP_LEN;
792 Length += TIMESTAMP_LEN;
793
794 // get beacon interval from payload and advance the pointer
795 Ptr += 2;
796 Length += 2;
797
798 // get capability info from payload and advance the pointer
799 Ptr += 2;
800 Length += 2;
801
802 pEid = (PEID_STRUCT) Ptr;
803
804 // get variable fields from payload and advance the pointer
805 while ((Length + 2 + pEid->Len) <= MsgLen)
806 {
807 switch(pEid->Eid)
808 {
809 case IE_SUPP_REG_CLASS:
810 if(pEid->Len > 0)
811 {
812 *RegClass = *pEid->Octet;
813 }
814 else
815 {
816 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
817 return FALSE;
818 }
819 break;
820 }
821
822 Length = Length + 2 + pEid->Len; // Eid[1] + Len[1]+ content[Len]
823 pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
824 }
825
826 return TRUE;
827
828 }
829 #endif // DOT11N_DRAFT3 //
830
831 /*
832 ==========================================================================
833 Description:
834 MLME message sanity check
835 Return:
836 TRUE if all parameters are OK, FALSE otherwise
837 ==========================================================================
838 */
MlmeScanReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT UCHAR * pBssType,OUT CHAR Ssid[],OUT UCHAR * pSsidLen,OUT UCHAR * pScanType)839 BOOLEAN MlmeScanReqSanity(
840 IN PRTMP_ADAPTER pAd,
841 IN VOID *Msg,
842 IN ULONG MsgLen,
843 OUT UCHAR *pBssType,
844 OUT CHAR Ssid[],
845 OUT UCHAR *pSsidLen,
846 OUT UCHAR *pScanType)
847 {
848 MLME_SCAN_REQ_STRUCT *Info;
849
850 Info = (MLME_SCAN_REQ_STRUCT *)(Msg);
851 *pBssType = Info->BssType;
852 *pSsidLen = Info->SsidLen;
853 NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
854 *pScanType = Info->ScanType;
855
856 if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC || *pBssType == BSS_ANY)
857 && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE
858 #ifdef CONFIG_STA_SUPPORT
859 || *pScanType == SCAN_CISCO_PASSIVE || *pScanType == SCAN_CISCO_ACTIVE
860 || *pScanType == SCAN_CISCO_CHANNEL_LOAD || *pScanType == SCAN_CISCO_NOISE
861 #endif // CONFIG_STA_SUPPORT //
862 ))
863 {
864 return TRUE;
865 }
866 else
867 {
868 DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
869 return FALSE;
870 }
871 }
872
873 // IRQL = DISPATCH_LEVEL
ChannelSanity(IN PRTMP_ADAPTER pAd,IN UCHAR channel)874 UCHAR ChannelSanity(
875 IN PRTMP_ADAPTER pAd,
876 IN UCHAR channel)
877 {
878 int i;
879
880 for (i = 0; i < pAd->ChannelListNum; i ++)
881 {
882 if (channel == pAd->ChannelList[i].Channel)
883 return 1;
884 }
885 return 0;
886 }
887
888 /*
889 ==========================================================================
890 Description:
891 MLME message sanity check
892 Return:
893 TRUE if all parameters are OK, FALSE otherwise
894
895 IRQL = DISPATCH_LEVEL
896
897 ==========================================================================
898 */
PeerDeauthSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pAddr2,OUT USHORT * pReason)899 BOOLEAN PeerDeauthSanity(
900 IN PRTMP_ADAPTER pAd,
901 IN VOID *Msg,
902 IN ULONG MsgLen,
903 OUT PUCHAR pAddr2,
904 OUT USHORT *pReason)
905 {
906 PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
907
908 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
909 NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
910
911 return TRUE;
912 }
913
914 /*
915 ==========================================================================
916 Description:
917 MLME message sanity check
918 Return:
919 TRUE if all parameters are OK, FALSE otherwise
920
921 IRQL = DISPATCH_LEVEL
922
923 ==========================================================================
924 */
PeerAuthSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pAddr,OUT USHORT * pAlg,OUT USHORT * pSeq,OUT USHORT * pStatus,CHAR * pChlgText)925 BOOLEAN PeerAuthSanity(
926 IN PRTMP_ADAPTER pAd,
927 IN VOID *Msg,
928 IN ULONG MsgLen,
929 OUT PUCHAR pAddr,
930 OUT USHORT *pAlg,
931 OUT USHORT *pSeq,
932 OUT USHORT *pStatus,
933 CHAR *pChlgText)
934 {
935 PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
936
937 COPY_MAC_ADDR(pAddr, pFrame->Hdr.Addr2);
938 NdisMoveMemory(pAlg, &pFrame->Octet[0], 2);
939 NdisMoveMemory(pSeq, &pFrame->Octet[2], 2);
940 NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
941
942 if ((*pAlg == Ndis802_11AuthModeOpen)
943 #ifdef LEAP_SUPPORT
944 || (*pAlg == CISCO_AuthModeLEAP)
945 #endif // LEAP_SUPPORT //
946 )
947 {
948 if (*pSeq == 1 || *pSeq == 2)
949 {
950 return TRUE;
951 }
952 else
953 {
954 DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
955 return FALSE;
956 }
957 }
958 else if (*pAlg == Ndis802_11AuthModeShared)
959 {
960 if (*pSeq == 1 || *pSeq == 4)
961 {
962 return TRUE;
963 }
964 else if (*pSeq == 2 || *pSeq == 3)
965 {
966 NdisMoveMemory(pChlgText, &pFrame->Octet[8], CIPHER_TEXT_LEN);
967 return TRUE;
968 }
969 else
970 {
971 DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
972 return FALSE;
973 }
974 }
975 else
976 {
977 DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong algorithm\n"));
978 return FALSE;
979 }
980 }
981
982 /*
983 ==========================================================================
984 Description:
985 MLME message sanity check
986 Return:
987 TRUE if all parameters are OK, FALSE otherwise
988 ==========================================================================
989 */
MlmeAuthReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pAddr,OUT ULONG * pTimeout,OUT USHORT * pAlg)990 BOOLEAN MlmeAuthReqSanity(
991 IN PRTMP_ADAPTER pAd,
992 IN VOID *Msg,
993 IN ULONG MsgLen,
994 OUT PUCHAR pAddr,
995 OUT ULONG *pTimeout,
996 OUT USHORT *pAlg)
997 {
998 MLME_AUTH_REQ_STRUCT *pInfo;
999
1000 pInfo = (MLME_AUTH_REQ_STRUCT *)Msg;
1001 COPY_MAC_ADDR(pAddr, pInfo->Addr);
1002 *pTimeout = pInfo->Timeout;
1003 *pAlg = pInfo->Alg;
1004
1005 if (((*pAlg == Ndis802_11AuthModeShared) ||(*pAlg == Ndis802_11AuthModeOpen)
1006 #ifdef LEAP_SUPPORT
1007 || (*pAlg == CISCO_AuthModeLEAP)
1008 #endif // LEAP_SUPPORT //
1009 ) &&
1010 ((*pAddr & 0x01) == 0))
1011 {
1012 return TRUE;
1013 }
1014 else
1015 {
1016 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAuthReqSanity fail - wrong algorithm\n"));
1017 return FALSE;
1018 }
1019 }
1020
1021 /*
1022 ==========================================================================
1023 Description:
1024 MLME message sanity check
1025 Return:
1026 TRUE if all parameters are OK, FALSE otherwise
1027
1028 IRQL = DISPATCH_LEVEL
1029
1030 ==========================================================================
1031 */
MlmeAssocReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pApAddr,OUT USHORT * pCapabilityInfo,OUT ULONG * pTimeout,OUT USHORT * pListenIntv)1032 BOOLEAN MlmeAssocReqSanity(
1033 IN PRTMP_ADAPTER pAd,
1034 IN VOID *Msg,
1035 IN ULONG MsgLen,
1036 OUT PUCHAR pApAddr,
1037 OUT USHORT *pCapabilityInfo,
1038 OUT ULONG *pTimeout,
1039 OUT USHORT *pListenIntv)
1040 {
1041 MLME_ASSOC_REQ_STRUCT *pInfo;
1042
1043 pInfo = (MLME_ASSOC_REQ_STRUCT *)Msg;
1044 *pTimeout = pInfo->Timeout; // timeout
1045 COPY_MAC_ADDR(pApAddr, pInfo->Addr); // AP address
1046 *pCapabilityInfo = pInfo->CapabilityInfo; // capability info
1047 *pListenIntv = pInfo->ListenIntv;
1048
1049 return TRUE;
1050 }
1051
1052 /*
1053 ==========================================================================
1054 Description:
1055 MLME message sanity check
1056 Return:
1057 TRUE if all parameters are OK, FALSE otherwise
1058
1059 IRQL = DISPATCH_LEVEL
1060
1061 ==========================================================================
1062 */
PeerDisassocSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pAddr2,OUT USHORT * pReason)1063 BOOLEAN PeerDisassocSanity(
1064 IN PRTMP_ADAPTER pAd,
1065 IN VOID *Msg,
1066 IN ULONG MsgLen,
1067 OUT PUCHAR pAddr2,
1068 OUT USHORT *pReason)
1069 {
1070 PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
1071
1072 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
1073 NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
1074
1075 return TRUE;
1076 }
1077
1078 /*
1079 ========================================================================
1080 Routine Description:
1081 Sanity check NetworkType (11b, 11g or 11a)
1082
1083 Arguments:
1084 pBss - Pointer to BSS table.
1085
1086 Return Value:
1087 Ndis802_11DS .......(11b)
1088 Ndis802_11OFDM24....(11g)
1089 Ndis802_11OFDM5.....(11a)
1090
1091 IRQL = DISPATCH_LEVEL
1092
1093 ========================================================================
1094 */
NetworkTypeInUseSanity(IN PBSS_ENTRY pBss)1095 NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
1096 IN PBSS_ENTRY pBss)
1097 {
1098 NDIS_802_11_NETWORK_TYPE NetWorkType;
1099 UCHAR rate, i;
1100
1101 NetWorkType = Ndis802_11DS;
1102
1103 if (pBss->Channel <= 14)
1104 {
1105 //
1106 // First check support Rate.
1107 //
1108 for (i = 0; i < pBss->SupRateLen; i++)
1109 {
1110 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1111 if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1112 {
1113 continue;
1114 }
1115 else
1116 {
1117 //
1118 // Otherwise (even rate > 108) means Ndis802_11OFDM24
1119 //
1120 NetWorkType = Ndis802_11OFDM24;
1121 break;
1122 }
1123 }
1124
1125 //
1126 // Second check Extend Rate.
1127 //
1128 if (NetWorkType != Ndis802_11OFDM24)
1129 {
1130 for (i = 0; i < pBss->ExtRateLen; i++)
1131 {
1132 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1133 if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1134 {
1135 continue;
1136 }
1137 else
1138 {
1139 //
1140 // Otherwise (even rate > 108) means Ndis802_11OFDM24
1141 //
1142 NetWorkType = Ndis802_11OFDM24;
1143 break;
1144 }
1145 }
1146 }
1147 }
1148 else
1149 {
1150 NetWorkType = Ndis802_11OFDM5;
1151 }
1152
1153 if (pBss->HtCapabilityLen != 0)
1154 {
1155 if (NetWorkType == Ndis802_11OFDM5)
1156 NetWorkType = Ndis802_11OFDM5_N;
1157 else
1158 NetWorkType = Ndis802_11OFDM24_N;
1159 }
1160
1161 return NetWorkType;
1162 }
1163
1164 /*
1165 ==========================================================================
1166 Description:
1167 WPA message sanity check
1168 Return:
1169 TRUE if all parameters are OK, FALSE otherwise
1170 ==========================================================================
1171 */
PeerWpaMessageSanity(IN PRTMP_ADAPTER pAd,IN PEAPOL_PACKET pMsg,IN ULONG MsgLen,IN UCHAR MsgType,IN MAC_TABLE_ENTRY * pEntry)1172 BOOLEAN PeerWpaMessageSanity(
1173 IN PRTMP_ADAPTER pAd,
1174 IN PEAPOL_PACKET pMsg,
1175 IN ULONG MsgLen,
1176 IN UCHAR MsgType,
1177 IN MAC_TABLE_ENTRY *pEntry)
1178 {
1179 UCHAR mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
1180 BOOLEAN bReplayDiff = FALSE;
1181 BOOLEAN bWPA2 = FALSE;
1182 KEY_INFO EapolKeyInfo;
1183 UCHAR GroupKeyIndex = 0;
1184
1185
1186 NdisZeroMemory(mic, sizeof(mic));
1187 NdisZeroMemory(digest, sizeof(digest));
1188 NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
1189 NdisZeroMemory((PUCHAR)&EapolKeyInfo, sizeof(EapolKeyInfo));
1190
1191 NdisMoveMemory((PUCHAR)&EapolKeyInfo, (PUCHAR)&pMsg->KeyDesc.KeyInfo, sizeof(KEY_INFO));
1192
1193 *((USHORT *)&EapolKeyInfo) = cpu2le16(*((USHORT *)&EapolKeyInfo));
1194
1195 // Choose WPA2 or not
1196 if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
1197 bWPA2 = TRUE;
1198
1199 // 0. Check MsgType
1200 if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1))
1201 {
1202 DBGPRINT(RT_DEBUG_ERROR, ("The message type is invalid(%d)! \n", MsgType));
1203 return FALSE;
1204 }
1205
1206 // 1. Replay counter check
1207 if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) // For supplicant
1208 {
1209 // First validate replay counter, only accept message with larger replay counter.
1210 // Let equal pass, some AP start with all zero replay counter
1211 UCHAR ZeroReplay[LEN_KEY_DESC_REPLAY];
1212
1213 NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
1214 if ((RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY) != 1) &&
1215 (RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, ZeroReplay, LEN_KEY_DESC_REPLAY) != 0))
1216 {
1217 bReplayDiff = TRUE;
1218 }
1219 }
1220 else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2) // For authenticator
1221 {
1222 // check Replay Counter coresponds to MSG from authenticator, otherwise discard
1223 if (!NdisEqualMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY))
1224 {
1225 bReplayDiff = TRUE;
1226 }
1227 }
1228
1229 // Replay Counter different condition
1230 if (bReplayDiff)
1231 {
1232 // send wireless event - for replay counter different
1233 if (pAd->CommonCfg.bWirelessEvent)
1234 RTMPSendWirelessEvent(pAd, IW_REPLAY_COUNTER_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1235
1236 if (MsgType < EAPOL_GROUP_MSG_1)
1237 {
1238 DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1239 }
1240 else
1241 {
1242 DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1243 }
1244
1245 hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
1246 hex_dump("Current replay counter ", pEntry->R_Counter, LEN_KEY_DESC_REPLAY);
1247 return FALSE;
1248 }
1249
1250 // 2. Verify MIC except Pairwise Msg1
1251 if (MsgType != EAPOL_PAIR_MSG_1)
1252 {
1253 UCHAR rcvd_mic[LEN_KEY_DESC_MIC];
1254
1255 // Record the received MIC for check later
1256 NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1257 NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1258
1259 if (pEntry->WepStatus == Ndis802_11Encryption2Enabled) // TKIP
1260 {
1261 hmac_md5(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, mic);
1262 }
1263 else if (pEntry->WepStatus == Ndis802_11Encryption3Enabled) // AES
1264 {
1265 HMAC_SHA1((PUCHAR)pMsg, MsgLen, pEntry->PTK, LEN_EAP_MICK, digest);
1266 NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
1267 }
1268
1269 if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC))
1270 {
1271 // send wireless event - for MIC different
1272 if (pAd->CommonCfg.bWirelessEvent)
1273 RTMPSendWirelessEvent(pAd, IW_MIC_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1274
1275 if (MsgType < EAPOL_GROUP_MSG_1)
1276 {
1277 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1278 }
1279 else
1280 {
1281 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1282 }
1283
1284 hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
1285 hex_dump("Desired MIC", mic, LEN_KEY_DESC_MIC);
1286
1287 return FALSE;
1288 }
1289 }
1290
1291 // Extract the context of the Key Data field if it exist
1292 // The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is un-encrypted.
1293 // The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted.
1294 if (pMsg->KeyDesc.KeyDataLen[1] > 0)
1295 {
1296 // Decrypt this field
1297 if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2) || (MsgType == EAPOL_GROUP_MSG_1))
1298 {
1299 if(pEntry->WepStatus == Ndis802_11Encryption3Enabled)
1300 {
1301 // AES
1302 AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA, pMsg->KeyDesc.KeyDataLen[1],pMsg->KeyDesc.KeyData);
1303 }
1304 else
1305 {
1306 INT i;
1307 UCHAR Key[32];
1308 // Decrypt TKIP GTK
1309 // Construct 32 bytes RC4 Key
1310 NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
1311 NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
1312 ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, 32);
1313 //discard first 256 bytes
1314 for(i = 0; i < 256; i++)
1315 ARCFOUR_BYTE(&pAd->PrivateInfo.WEPCONTEXT);
1316 // Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
1317 ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, KEYDATA, pMsg->KeyDesc.KeyData, pMsg->KeyDesc.KeyDataLen[1]);
1318 }
1319
1320 if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
1321 GroupKeyIndex = EapolKeyInfo.KeyIndex;
1322
1323 }
1324 else if ((MsgType == EAPOL_PAIR_MSG_2) || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2))
1325 {
1326 NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData, pMsg->KeyDesc.KeyDataLen[1]);
1327 }
1328 else
1329 {
1330
1331 return TRUE;
1332 }
1333
1334 // Parse Key Data field to
1335 // 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2)
1336 // 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2
1337 // 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2)
1338 if (!RTMPParseEapolKeyData(pAd, KEYDATA, pMsg->KeyDesc.KeyDataLen[1], GroupKeyIndex, MsgType, bWPA2, pEntry))
1339 {
1340 return FALSE;
1341 }
1342 }
1343
1344 return TRUE;
1345
1346 }
1347
1348 #ifdef CONFIG_STA_SUPPORT
1349 #ifdef QOS_DLS_SUPPORT
MlmeDlsReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PRT_802_11_DLS * pDLS,OUT PUSHORT pReason)1350 BOOLEAN MlmeDlsReqSanity(
1351 IN PRTMP_ADAPTER pAd,
1352 IN VOID *Msg,
1353 IN ULONG MsgLen,
1354 OUT PRT_802_11_DLS *pDLS,
1355 OUT PUSHORT pReason)
1356 {
1357 MLME_DLS_REQ_STRUCT *pInfo;
1358
1359 pInfo = (MLME_DLS_REQ_STRUCT *)Msg;
1360
1361 *pDLS = pInfo->pDLS;
1362 *pReason = pInfo->Reason;
1363
1364 return TRUE;
1365 }
1366 #endif // QOS_DLS_SUPPORT //
1367 #endif // CONFIG_STA_SUPPORT //
1368
1369 #ifdef QOS_DLS_SUPPORT
PeerDlsReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pDA,OUT PUCHAR pSA,OUT USHORT * pCapabilityInfo,OUT USHORT * pDlsTimeout,OUT UCHAR * pRatesLen,OUT UCHAR Rates[],OUT UCHAR * pHtCapabilityLen,OUT HT_CAPABILITY_IE * pHtCapability)1370 BOOLEAN PeerDlsReqSanity(
1371 IN PRTMP_ADAPTER pAd,
1372 IN VOID *Msg,
1373 IN ULONG MsgLen,
1374 OUT PUCHAR pDA,
1375 OUT PUCHAR pSA,
1376 OUT USHORT *pCapabilityInfo,
1377 OUT USHORT *pDlsTimeout,
1378 OUT UCHAR *pRatesLen,
1379 OUT UCHAR Rates[],
1380 OUT UCHAR *pHtCapabilityLen,
1381 OUT HT_CAPABILITY_IE *pHtCapability)
1382 {
1383 CHAR *Ptr;
1384 PFRAME_802_11 Fr = (PFRAME_802_11)Msg;
1385 PEID_STRUCT eid_ptr;
1386
1387 // to prevent caller from using garbage output value
1388 *pCapabilityInfo = 0;
1389 *pDlsTimeout = 0;
1390 *pHtCapabilityLen = 0;
1391
1392 Ptr = Fr->Octet;
1393
1394 // offset to destination MAC address (Category and Action field)
1395 Ptr += 2;
1396
1397 // get DA from payload and advance the pointer
1398 NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1399 Ptr += MAC_ADDR_LEN;
1400
1401 // get SA from payload and advance the pointer
1402 NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1403 Ptr += MAC_ADDR_LEN;
1404
1405 // get capability info from payload and advance the pointer
1406 NdisMoveMemory(pCapabilityInfo, Ptr, 2);
1407 Ptr += 2;
1408
1409 // get capability info from payload and advance the pointer
1410 NdisMoveMemory(pDlsTimeout, Ptr, 2);
1411 Ptr += 2;
1412
1413 // Category and Action field + DA + SA + capability + Timeout
1414 eid_ptr = (PEID_STRUCT) &Fr->Octet[18];
1415
1416 while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)Fr + MsgLen))
1417 {
1418 switch(eid_ptr->Eid)
1419 {
1420 case IE_SUPP_RATES:
1421 if ((eid_ptr->Len <= MAX_LEN_OF_SUPPORTED_RATES) && (eid_ptr->Len > 0))
1422 {
1423 NdisMoveMemory(Rates, eid_ptr->Octet, eid_ptr->Len);
1424 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - IE_SUPP_RATES., Len=%d. Rates[0]=%x\n",eid_ptr->Len, Rates[0]));
1425 DBGPRINT(RT_DEBUG_TRACE, ("Rates[1]=%x %x %x %x %x %x %x\n", Rates[1], Rates[2], Rates[3], Rates[4], Rates[5], Rates[6], Rates[7]));
1426 *pRatesLen = eid_ptr->Len;
1427 }
1428 else
1429 {
1430 *pRatesLen = 8;
1431 Rates[0] = 0x82;
1432 Rates[1] = 0x84;
1433 Rates[2] = 0x8b;
1434 Rates[3] = 0x96;
1435 Rates[4] = 0x12;
1436 Rates[5] = 0x24;
1437 Rates[6] = 0x48;
1438 Rates[7] = 0x6c;
1439 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - wrong IE_SUPP_RATES., Len=%d\n",eid_ptr->Len));
1440 }
1441 break;
1442
1443 case IE_EXT_SUPP_RATES:
1444 if (eid_ptr->Len + *pRatesLen <= MAX_LEN_OF_SUPPORTED_RATES)
1445 {
1446 NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, eid_ptr->Len);
1447 *pRatesLen = (*pRatesLen) + eid_ptr->Len;
1448 }
1449 else
1450 {
1451 NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, MAX_LEN_OF_SUPPORTED_RATES - (*pRatesLen));
1452 *pRatesLen = MAX_LEN_OF_SUPPORTED_RATES;
1453 }
1454 break;
1455
1456 case IE_HT_CAP:
1457 if (eid_ptr->Len >= sizeof(HT_CAPABILITY_IE))
1458 {
1459 NdisMoveMemory(pHtCapability, eid_ptr->Octet, sizeof(HT_CAPABILITY_IE));
1460
1461 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
1462 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
1463 *pHtCapabilityLen = sizeof(HT_CAPABILITY_IE);
1464
1465 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - IE_HT_CAP\n"));
1466 }
1467 else
1468 {
1469 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - wrong IE_HT_CAP.eid_ptr->Len = %d\n", eid_ptr->Len));
1470 }
1471 break;
1472
1473 default:
1474 break;
1475 }
1476
1477 eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
1478 }
1479
1480 return TRUE;
1481 }
1482
PeerDlsRspSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pDA,OUT PUCHAR pSA,OUT USHORT * pCapabilityInfo,OUT USHORT * pStatus,OUT UCHAR * pRatesLen,OUT UCHAR Rates[],OUT UCHAR * pHtCapabilityLen,OUT HT_CAPABILITY_IE * pHtCapability)1483 BOOLEAN PeerDlsRspSanity(
1484 IN PRTMP_ADAPTER pAd,
1485 IN VOID *Msg,
1486 IN ULONG MsgLen,
1487 OUT PUCHAR pDA,
1488 OUT PUCHAR pSA,
1489 OUT USHORT *pCapabilityInfo,
1490 OUT USHORT *pStatus,
1491 OUT UCHAR *pRatesLen,
1492 OUT UCHAR Rates[],
1493 OUT UCHAR *pHtCapabilityLen,
1494 OUT HT_CAPABILITY_IE *pHtCapability)
1495 {
1496 CHAR *Ptr;
1497 PFRAME_802_11 Fr = (PFRAME_802_11)Msg;
1498 PEID_STRUCT eid_ptr;
1499
1500 // to prevent caller from using garbage output value
1501 *pStatus = 0;
1502 *pCapabilityInfo = 0;
1503 *pHtCapabilityLen = 0;
1504
1505 Ptr = Fr->Octet;
1506
1507 // offset to destination MAC address (Category and Action field)
1508 Ptr += 2;
1509
1510 // get status code from payload and advance the pointer
1511 NdisMoveMemory(pStatus, Ptr, 2);
1512 Ptr += 2;
1513
1514 // get DA from payload and advance the pointer
1515 NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1516 Ptr += MAC_ADDR_LEN;
1517
1518 // get SA from payload and advance the pointer
1519 NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1520 Ptr += MAC_ADDR_LEN;
1521
1522 if (pStatus == 0)
1523 {
1524 // get capability info from payload and advance the pointer
1525 NdisMoveMemory(pCapabilityInfo, Ptr, 2);
1526 Ptr += 2;
1527 }
1528
1529 // Category and Action field + status code + DA + SA + capability
1530 eid_ptr = (PEID_STRUCT) &Fr->Octet[18];
1531
1532 while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)Fr + MsgLen))
1533 {
1534 switch(eid_ptr->Eid)
1535 {
1536 case IE_SUPP_RATES:
1537 if ((eid_ptr->Len <= MAX_LEN_OF_SUPPORTED_RATES) && (eid_ptr->Len > 0))
1538 {
1539 NdisMoveMemory(Rates, eid_ptr->Octet, eid_ptr->Len);
1540 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - IE_SUPP_RATES., Len=%d. Rates[0]=%x\n",eid_ptr->Len, Rates[0]));
1541 DBGPRINT(RT_DEBUG_TRACE, ("Rates[1]=%x %x %x %x %x %x %x\n", Rates[1], Rates[2], Rates[3], Rates[4], Rates[5], Rates[6], Rates[7]));
1542 *pRatesLen = eid_ptr->Len;
1543 }
1544 else
1545 {
1546 *pRatesLen = 8;
1547 Rates[0] = 0x82;
1548 Rates[1] = 0x84;
1549 Rates[2] = 0x8b;
1550 Rates[3] = 0x96;
1551 Rates[4] = 0x12;
1552 Rates[5] = 0x24;
1553 Rates[6] = 0x48;
1554 Rates[7] = 0x6c;
1555 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - wrong IE_SUPP_RATES., Len=%d\n",eid_ptr->Len));
1556 }
1557 break;
1558
1559 case IE_EXT_SUPP_RATES:
1560 if (eid_ptr->Len + *pRatesLen <= MAX_LEN_OF_SUPPORTED_RATES)
1561 {
1562 NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, eid_ptr->Len);
1563 *pRatesLen = (*pRatesLen) + eid_ptr->Len;
1564 }
1565 else
1566 {
1567 NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, MAX_LEN_OF_SUPPORTED_RATES - (*pRatesLen));
1568 *pRatesLen = MAX_LEN_OF_SUPPORTED_RATES;
1569 }
1570 break;
1571
1572 case IE_HT_CAP:
1573 if (eid_ptr->Len >= sizeof(HT_CAPABILITY_IE))
1574 {
1575 NdisMoveMemory(pHtCapability, eid_ptr->Octet, sizeof(HT_CAPABILITY_IE));
1576
1577 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
1578 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
1579 *pHtCapabilityLen = sizeof(HT_CAPABILITY_IE);
1580
1581 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - IE_HT_CAP\n"));
1582 }
1583 else
1584 {
1585 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - wrong IE_HT_CAP.eid_ptr->Len = %d\n", eid_ptr->Len));
1586 }
1587 break;
1588
1589 default:
1590 break;
1591 }
1592
1593 eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
1594 }
1595
1596 return TRUE;
1597 }
1598
PeerDlsTearDownSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pDA,OUT PUCHAR pSA,OUT USHORT * pReason)1599 BOOLEAN PeerDlsTearDownSanity(
1600 IN PRTMP_ADAPTER pAd,
1601 IN VOID *Msg,
1602 IN ULONG MsgLen,
1603 OUT PUCHAR pDA,
1604 OUT PUCHAR pSA,
1605 OUT USHORT *pReason)
1606 {
1607 CHAR *Ptr;
1608 PFRAME_802_11 Fr = (PFRAME_802_11)Msg;
1609
1610 // to prevent caller from using garbage output value
1611 *pReason = 0;
1612
1613 Ptr = Fr->Octet;
1614
1615 // offset to destination MAC address (Category and Action field)
1616 Ptr += 2;
1617
1618 // get DA from payload and advance the pointer
1619 NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1620 Ptr += MAC_ADDR_LEN;
1621
1622 // get SA from payload and advance the pointer
1623 NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1624 Ptr += MAC_ADDR_LEN;
1625
1626 // get reason code from payload and advance the pointer
1627 NdisMoveMemory(pReason, Ptr, 2);
1628 Ptr += 2;
1629
1630 return TRUE;
1631 }
1632 #endif // QOS_DLS_SUPPORT //
1633
1634