1 /*
2 *************************************************************************
3 * Ralink Tech Inc.
4 * 5F., No.36, Taiyuan St., Jhubei City,
5 * Hsinchu County 302,
6 * Taiwan, R.O.C.
7 *
8 * (c) Copyright 2002-2007, Ralink Technology, Inc.
9 *
10 * This program is free software; you can redistribute it and/or modify *
11 * it under the terms of the GNU General Public License as published by *
12 * the Free Software Foundation; either version 2 of the License, or *
13 * (at your option) any later version. *
14 * *
15 * This program is distributed in the hope that it will be useful, *
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
18 * GNU General Public License for more details. *
19 * *
20 * You should have received a copy of the GNU General Public License *
21 * along with this program; if not, write to the *
22 * Free Software Foundation, Inc., *
23 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
24 * *
25 *************************************************************************
26
27 Module Name:
28 sanity.c
29
30 Abstract:
31
32 Revision History:
33 Who When What
34 -------- ---------- ----------------------------------------------
35 John Chang 2004-09-01 add WMM support
36 */
37 #include "../rt_config.h"
38
39
40 extern UCHAR CISCO_OUI[];
41
42 extern UCHAR WPA_OUI[];
43 extern UCHAR RSN_OUI[];
44 extern UCHAR WME_INFO_ELEM[];
45 extern UCHAR WME_PARM_ELEM[];
46 extern UCHAR Ccx2QosInfo[];
47 extern UCHAR RALINK_OUI[];
48 extern UCHAR BROADCOM_OUI[];
49 extern UCHAR WPS_OUI[];
50
51 /*
52 ==========================================================================
53 Description:
54 MLME message sanity check
55 Return:
56 TRUE if all parameters are OK, FALSE otherwise
57
58 IRQL = DISPATCH_LEVEL
59
60 ==========================================================================
61 */
MlmeAddBAReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pAddr2)62 BOOLEAN MlmeAddBAReqSanity(
63 IN PRTMP_ADAPTER pAd,
64 IN VOID *Msg,
65 IN ULONG MsgLen,
66 OUT PUCHAR pAddr2)
67 {
68 PMLME_ADDBA_REQ_STRUCT pInfo;
69
70 pInfo = (MLME_ADDBA_REQ_STRUCT *)Msg;
71
72 if ((MsgLen != sizeof(MLME_ADDBA_REQ_STRUCT)))
73 {
74 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
75 return FALSE;
76 }
77
78 if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
79 {
80 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
81 return FALSE;
82 }
83
84 /*
85 if ((pInfo->BaBufSize > MAX_RX_REORDERBUF) || (pInfo->BaBufSize < 2))
86 {
87 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - Rx Reordering buffer too big or too small\n"));
88 return FALSE;
89 }
90 */
91
92 if ((pInfo->pAddr[0]&0x01) == 0x01)
93 {
94 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
95 return FALSE;
96 }
97
98 return TRUE;
99 }
100
101 /*
102 ==========================================================================
103 Description:
104 MLME message sanity check
105 Return:
106 TRUE if all parameters are OK, FALSE otherwise
107
108 IRQL = DISPATCH_LEVEL
109
110 ==========================================================================
111 */
MlmeDelBAReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen)112 BOOLEAN MlmeDelBAReqSanity(
113 IN PRTMP_ADAPTER pAd,
114 IN VOID *Msg,
115 IN ULONG MsgLen)
116 {
117 MLME_DELBA_REQ_STRUCT *pInfo;
118 pInfo = (MLME_DELBA_REQ_STRUCT *)Msg;
119
120 if ((MsgLen != sizeof(MLME_DELBA_REQ_STRUCT)))
121 {
122 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
123 return FALSE;
124 }
125
126 if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
127 {
128 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
129 return FALSE;
130 }
131
132 if ((pInfo->TID & 0xf0))
133 {
134 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
135 return FALSE;
136 }
137
138 if (NdisEqualMemory(pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr, MAC_ADDR_LEN) == 0)
139 {
140 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
141 return FALSE;
142 }
143
144 return TRUE;
145 }
146
PeerAddBAReqActionSanity(IN PRTMP_ADAPTER pAd,IN VOID * pMsg,IN ULONG MsgLen,OUT PUCHAR pAddr2)147 BOOLEAN PeerAddBAReqActionSanity(
148 IN PRTMP_ADAPTER pAd,
149 IN VOID *pMsg,
150 IN ULONG MsgLen,
151 OUT PUCHAR pAddr2)
152 {
153 PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
154 PFRAME_ADDBA_REQ pAddFrame;
155 pAddFrame = (PFRAME_ADDBA_REQ)(pMsg);
156 if (MsgLen < (sizeof(FRAME_ADDBA_REQ)))
157 {
158 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n", MsgLen));
159 return FALSE;
160 }
161 // we support immediate BA.
162 *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
163 pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
164 pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
165
166 if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
167 {
168 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
169 DBGPRINT(RT_DEBUG_ERROR,("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n", pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize, pAddFrame->BaParm.AMSDUSupported));
170 return FALSE;
171 }
172
173 // we support immediate BA.
174 if (pAddFrame->BaParm.TID &0xfff0)
175 {
176 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n", pAddFrame->BaParm.TID));
177 return FALSE;
178 }
179 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
180 return TRUE;
181 }
182
PeerAddBARspActionSanity(IN PRTMP_ADAPTER pAd,IN VOID * pMsg,IN ULONG MsgLen)183 BOOLEAN PeerAddBARspActionSanity(
184 IN PRTMP_ADAPTER pAd,
185 IN VOID *pMsg,
186 IN ULONG MsgLen)
187 {
188 //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
189 PFRAME_ADDBA_RSP pAddFrame;
190
191 pAddFrame = (PFRAME_ADDBA_RSP)(pMsg);
192 if (MsgLen < (sizeof(FRAME_ADDBA_RSP)))
193 {
194 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n", MsgLen));
195 return FALSE;
196 }
197 // we support immediate BA.
198 *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
199 pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
200 pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
201
202 if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
203 {
204 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
205 return FALSE;
206 }
207
208 // we support immediate BA.
209 if (pAddFrame->BaParm.TID &0xfff0)
210 {
211 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n", pAddFrame->BaParm.TID));
212 return FALSE;
213 }
214 return TRUE;
215
216 }
217
PeerDelBAActionSanity(IN PRTMP_ADAPTER pAd,IN UCHAR Wcid,IN VOID * pMsg,IN ULONG MsgLen)218 BOOLEAN PeerDelBAActionSanity(
219 IN PRTMP_ADAPTER pAd,
220 IN UCHAR Wcid,
221 IN VOID *pMsg,
222 IN ULONG MsgLen )
223 {
224 //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
225 PFRAME_DELBA_REQ pDelFrame;
226 if (MsgLen != (sizeof(FRAME_DELBA_REQ)))
227 return FALSE;
228
229 if (Wcid >= MAX_LEN_OF_MAC_TABLE)
230 return FALSE;
231
232 pDelFrame = (PFRAME_DELBA_REQ)(pMsg);
233
234 *(USHORT *)(&pDelFrame->DelbaParm) = cpu2le16(*(USHORT *)(&pDelFrame->DelbaParm));
235 pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
236
237 if (pDelFrame->DelbaParm.TID &0xfff0)
238 return FALSE;
239
240 return TRUE;
241 }
242
243 /*
244 ==========================================================================
245 Description:
246 MLME message sanity check
247 Return:
248 TRUE if all parameters are OK, FALSE otherwise
249
250 IRQL = DISPATCH_LEVEL
251
252 ==========================================================================
253 */
PeerBeaconAndProbeRspSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,IN UCHAR MsgChannel,OUT PUCHAR pAddr2,OUT PUCHAR pBssid,OUT CHAR Ssid[],OUT UCHAR * pSsidLen,OUT UCHAR * pBssType,OUT USHORT * pBeaconPeriod,OUT UCHAR * pChannel,OUT UCHAR * pNewChannel,OUT LARGE_INTEGER * pTimestamp,OUT CF_PARM * pCfParm,OUT USHORT * pAtimWin,OUT USHORT * pCapabilityInfo,OUT UCHAR * pErp,OUT UCHAR * pDtimCount,OUT UCHAR * pDtimPeriod,OUT UCHAR * pBcastFlag,OUT UCHAR * pMessageToMe,OUT UCHAR SupRate[],OUT UCHAR * pSupRateLen,OUT UCHAR ExtRate[],OUT UCHAR * pExtRateLen,OUT UCHAR * pCkipFlag,OUT UCHAR * pAironetCellPowerLimit,OUT PEDCA_PARM pEdcaParm,OUT PQBSS_LOAD_PARM pQbssLoad,OUT PQOS_CAPABILITY_PARM pQosCapability,OUT ULONG * pRalinkIe,OUT UCHAR * pHtCapabilityLen,OUT UCHAR * pPreNHtCapabilityLen,OUT HT_CAPABILITY_IE * pHtCapability,OUT UCHAR * AddHtInfoLen,OUT ADD_HT_INFO_IE * AddHtInfo,OUT UCHAR * NewExtChannelOffset,OUT USHORT * LengthVIE,OUT PNDIS_802_11_VARIABLE_IEs pVIE)254 BOOLEAN PeerBeaconAndProbeRspSanity(
255 IN PRTMP_ADAPTER pAd,
256 IN VOID *Msg,
257 IN ULONG MsgLen,
258 IN UCHAR MsgChannel,
259 OUT PUCHAR pAddr2,
260 OUT PUCHAR pBssid,
261 OUT CHAR Ssid[],
262 OUT UCHAR *pSsidLen,
263 OUT UCHAR *pBssType,
264 OUT USHORT *pBeaconPeriod,
265 OUT UCHAR *pChannel,
266 OUT UCHAR *pNewChannel,
267 OUT LARGE_INTEGER *pTimestamp,
268 OUT CF_PARM *pCfParm,
269 OUT USHORT *pAtimWin,
270 OUT USHORT *pCapabilityInfo,
271 OUT UCHAR *pErp,
272 OUT UCHAR *pDtimCount,
273 OUT UCHAR *pDtimPeriod,
274 OUT UCHAR *pBcastFlag,
275 OUT UCHAR *pMessageToMe,
276 OUT UCHAR SupRate[],
277 OUT UCHAR *pSupRateLen,
278 OUT UCHAR ExtRate[],
279 OUT UCHAR *pExtRateLen,
280 OUT UCHAR *pCkipFlag,
281 OUT UCHAR *pAironetCellPowerLimit,
282 OUT PEDCA_PARM pEdcaParm,
283 OUT PQBSS_LOAD_PARM pQbssLoad,
284 OUT PQOS_CAPABILITY_PARM pQosCapability,
285 OUT ULONG *pRalinkIe,
286 OUT UCHAR *pHtCapabilityLen,
287 #ifdef CONFIG_STA_SUPPORT
288 OUT UCHAR *pPreNHtCapabilityLen,
289 #endif // CONFIG_STA_SUPPORT //
290 OUT HT_CAPABILITY_IE *pHtCapability,
291 OUT UCHAR *AddHtInfoLen,
292 OUT ADD_HT_INFO_IE *AddHtInfo,
293 OUT UCHAR *NewExtChannelOffset, // Ht extension channel offset(above or below)
294 OUT USHORT *LengthVIE,
295 OUT PNDIS_802_11_VARIABLE_IEs pVIE)
296 {
297 CHAR *Ptr;
298 #ifdef CONFIG_STA_SUPPORT
299 CHAR TimLen;
300 #endif // CONFIG_STA_SUPPORT //
301 PFRAME_802_11 pFrame;
302 PEID_STRUCT pEid;
303 UCHAR SubType;
304 UCHAR Sanity;
305 //UCHAR ECWMin, ECWMax;
306 //MAC_CSR9_STRUC Csr9;
307 ULONG Length = 0;
308
309 // For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel
310 // 1. If the AP is 11n enabled, then check the control channel.
311 // 2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!!)
312 UCHAR CtrlChannel = 0;
313
314 // Add for 3 necessary EID field check
315 Sanity = 0;
316
317 *pAtimWin = 0;
318 *pErp = 0;
319 *pDtimCount = 0;
320 *pDtimPeriod = 0;
321 *pBcastFlag = 0;
322 *pMessageToMe = 0;
323 *pExtRateLen = 0;
324 *pCkipFlag = 0; // Default of CkipFlag is 0
325 *pAironetCellPowerLimit = 0xFF; // Default of AironetCellPowerLimit is 0xFF
326 *LengthVIE = 0; // Set the length of VIE to init value 0
327 *pHtCapabilityLen = 0; // Set the length of VIE to init value 0
328 #ifdef CONFIG_STA_SUPPORT
329 if (pAd->OpMode == OPMODE_STA)
330 *pPreNHtCapabilityLen = 0; // Set the length of VIE to init value 0
331 #endif // CONFIG_STA_SUPPORT //
332 *AddHtInfoLen = 0; // Set the length of VIE to init value 0
333 *pRalinkIe = 0;
334 *pNewChannel = 0;
335 *NewExtChannelOffset = 0xff; //Default 0xff means no such IE
336 pCfParm->bValid = FALSE; // default: no IE_CF found
337 pQbssLoad->bValid = FALSE; // default: no IE_QBSS_LOAD found
338 pEdcaParm->bValid = FALSE; // default: no IE_EDCA_PARAMETER found
339 pQosCapability->bValid = FALSE; // default: no IE_QOS_CAPABILITY found
340
341 pFrame = (PFRAME_802_11)Msg;
342
343 // get subtype from header
344 SubType = (UCHAR)pFrame->Hdr.FC.SubType;
345
346 // get Addr2 and BSSID from header
347 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
348 COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
349
350 // hex_dump("Beacon", Msg, MsgLen);
351
352 Ptr = pFrame->Octet;
353 Length += LENGTH_802_11;
354
355 // get timestamp from payload and advance the pointer
356 NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
357
358 pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
359 pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
360
361 Ptr += TIMESTAMP_LEN;
362 Length += TIMESTAMP_LEN;
363
364 // get beacon interval from payload and advance the pointer
365 NdisMoveMemory(pBeaconPeriod, Ptr, 2);
366 Ptr += 2;
367 Length += 2;
368
369 // get capability info from payload and advance the pointer
370 NdisMoveMemory(pCapabilityInfo, Ptr, 2);
371 Ptr += 2;
372 Length += 2;
373
374 if (CAP_IS_ESS_ON(*pCapabilityInfo))
375 *pBssType = BSS_INFRA;
376 else
377 *pBssType = BSS_ADHOC;
378
379 pEid = (PEID_STRUCT) Ptr;
380
381 // get variable fields from payload and advance the pointer
382 while ((Length + 2 + pEid->Len) <= MsgLen)
383 {
384 //
385 // Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow.
386 //
387 if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN)
388 {
389 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
390 (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
391 break;
392 }
393
394 switch(pEid->Eid)
395 {
396 case IE_SSID:
397 // Already has one SSID EID in this beacon, ignore the second one
398 if (Sanity & 0x1)
399 break;
400 if(pEid->Len <= MAX_LEN_OF_SSID)
401 {
402 NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
403 *pSsidLen = pEid->Len;
404 Sanity |= 0x1;
405 }
406 else
407 {
408 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
409 return FALSE;
410 }
411 break;
412
413 case IE_SUPP_RATES:
414 if(pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
415 {
416 Sanity |= 0x2;
417 NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
418 *pSupRateLen = pEid->Len;
419
420 // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
421 // from ScanTab. We should report as is. And filter out unsupported
422 // rates in MlmeAux.
423 // Check against the supported rates
424 // RTMPCheckRates(pAd, SupRate, pSupRateLen);
425 }
426 else
427 {
428 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",pEid->Len));
429 return FALSE;
430 }
431 break;
432
433 case IE_HT_CAP:
434 if (pEid->Len >= SIZE_HT_CAP_IE) //Note: allow extension.!!
435 {
436 NdisMoveMemory(pHtCapability, pEid->Octet, sizeof(HT_CAPABILITY_IE));
437 *pHtCapabilityLen = SIZE_HT_CAP_IE; // Nnow we only support 26 bytes.
438
439 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
440 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
441
442 #ifdef CONFIG_STA_SUPPORT
443 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
444 {
445 *pPreNHtCapabilityLen = 0; // Nnow we only support 26 bytes.
446
447 Ptr = (PUCHAR) pVIE;
448 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
449 *LengthVIE += (pEid->Len + 2);
450 }
451 #endif // CONFIG_STA_SUPPORT //
452 }
453 else
454 {
455 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n", pEid->Len));
456 }
457
458 break;
459 case IE_ADD_HT:
460 if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
461 {
462 // This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
463 // copy first sizeof(ADD_HT_INFO_IE)
464 NdisMoveMemory(AddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
465 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
466
467 CtrlChannel = AddHtInfo->ControlChan;
468
469 *(USHORT *)(&AddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo2));
470 *(USHORT *)(&AddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo3));
471
472 #ifdef CONFIG_STA_SUPPORT
473 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
474 {
475 Ptr = (PUCHAR) pVIE;
476 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
477 *LengthVIE += (pEid->Len + 2);
478 }
479 #endif // CONFIG_STA_SUPPORT //
480 }
481 else
482 {
483 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
484 }
485
486 break;
487 case IE_SECONDARY_CH_OFFSET:
488 if (pEid->Len == 1)
489 {
490 *NewExtChannelOffset = pEid->Octet[0];
491 }
492 else
493 {
494 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
495 }
496
497 break;
498 case IE_FH_PARM:
499 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
500 break;
501
502 case IE_DS_PARM:
503 if(pEid->Len == 1)
504 {
505 *pChannel = *pEid->Octet;
506 #ifdef CONFIG_STA_SUPPORT
507 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
508 {
509 if (ChannelSanity(pAd, *pChannel) == 0)
510 {
511
512 return FALSE;
513 }
514 }
515 #endif // CONFIG_STA_SUPPORT //
516 Sanity |= 0x4;
517 }
518 else
519 {
520 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",pEid->Len));
521 return FALSE;
522 }
523 break;
524
525 case IE_CF_PARM:
526 if(pEid->Len == 6)
527 {
528 pCfParm->bValid = TRUE;
529 pCfParm->CfpCount = pEid->Octet[0];
530 pCfParm->CfpPeriod = pEid->Octet[1];
531 pCfParm->CfpMaxDuration = pEid->Octet[2] + 256 * pEid->Octet[3];
532 pCfParm->CfpDurRemaining = pEid->Octet[4] + 256 * pEid->Octet[5];
533 }
534 else
535 {
536 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
537 return FALSE;
538 }
539 break;
540
541 case IE_IBSS_PARM:
542 if(pEid->Len == 2)
543 {
544 NdisMoveMemory(pAtimWin, pEid->Octet, pEid->Len);
545 }
546 else
547 {
548 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
549 return FALSE;
550 }
551 break;
552
553 #ifdef CONFIG_STA_SUPPORT
554 case IE_TIM:
555 if(INFRA_ON(pAd) && SubType == SUBTYPE_BEACON)
556 {
557 GetTimBit((PUCHAR)pEid, pAd->StaActive.Aid, &TimLen, pBcastFlag, pDtimCount, pDtimPeriod, pMessageToMe);
558 }
559 break;
560 #endif // CONFIG_STA_SUPPORT //
561 case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
562 if(pEid->Len == 3)
563 {
564 *pNewChannel = pEid->Octet[1]; //extract new channel number
565 }
566 break;
567
568 // New for WPA
569 // CCX v2 has the same IE, we need to parse that too
570 // Wifi WMM use the same IE vale, need to parse that too
571 // case IE_WPA:
572 case IE_VENDOR_SPECIFIC:
573 // Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE.
574 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
575 /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
576 {
577 if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
578 {
579 {
580 NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
581 *pHtCapabilityLen = SIZE_HT_CAP_IE; // Nnow we only support 26 bytes.
582 }
583 }
584 if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
585 {
586 {
587 NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
588 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE; // Nnow we only support 26 bytes.
589 }
590 }
591 }
592 */
593 // Check the OUI version, filter out non-standard usage
594 if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3) && (pEid->Len == 7))
595 {
596 //*pRalinkIe = pEid->Octet[3];
597 if (pEid->Octet[3] != 0)
598 *pRalinkIe = pEid->Octet[3];
599 else
600 *pRalinkIe = 0xf0000000; // Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag.
601 }
602 #ifdef CONFIG_STA_SUPPORT
603 #ifdef DOT11_N_SUPPORT
604 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
605
606 // Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP,
607 // Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE
608 else if ((*pHtCapabilityLen == 0) && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI, 3) && (pEid->Len >= 4) && (pAd->OpMode == OPMODE_STA))
609 {
610 if ((pEid->Octet[3] == OUI_PREN_HT_CAP) && (pEid->Len >= 30) && (*pHtCapabilityLen == 0))
611 {
612 NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
613 *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
614 }
615
616 if ((pEid->Octet[3] == OUI_PREN_ADD_HT) && (pEid->Len >= 26))
617 {
618 NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
619 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
620 }
621 }
622 #endif // DOT11_N_SUPPORT //
623 #endif // CONFIG_STA_SUPPORT //
624 else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
625 {
626 // Copy to pVIE which will report to microsoft bssid list.
627 Ptr = (PUCHAR) pVIE;
628 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
629 *LengthVIE += (pEid->Len + 2);
630 }
631 else if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
632 {
633 PUCHAR ptr;
634 int i;
635
636 // parsing EDCA parameters
637 pEdcaParm->bValid = TRUE;
638 pEdcaParm->bQAck = FALSE; // pEid->Octet[0] & 0x10;
639 pEdcaParm->bQueueRequest = FALSE; // pEid->Octet[0] & 0x20;
640 pEdcaParm->bTxopRequest = FALSE; // pEid->Octet[0] & 0x40;
641 pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
642 pEdcaParm->bAPSDCapable = (pEid->Octet[6] & 0x80) ? 1 : 0;
643 ptr = &pEid->Octet[8];
644 for (i=0; i<4; i++)
645 {
646 UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
647 pEdcaParm->bACM[aci] = (((*ptr) & 0x10) == 0x10); // b5 is ACM
648 pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f; // b0~3 is AIFSN
649 pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f; // b0~4 is Cwmin
650 pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4; // b5~8 is Cwmax
651 pEdcaParm->Txop[aci] = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
652 ptr += 4; // point to next AC
653 }
654 }
655 else if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6) && (pEid->Len == 7))
656 {
657 // parsing EDCA parameters
658 pEdcaParm->bValid = TRUE;
659 pEdcaParm->bQAck = FALSE; // pEid->Octet[0] & 0x10;
660 pEdcaParm->bQueueRequest = FALSE; // pEid->Octet[0] & 0x20;
661 pEdcaParm->bTxopRequest = FALSE; // pEid->Octet[0] & 0x40;
662 pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
663 pEdcaParm->bAPSDCapable = (pEid->Octet[6] & 0x80) ? 1 : 0;
664
665 // use default EDCA parameter
666 pEdcaParm->bACM[QID_AC_BE] = 0;
667 pEdcaParm->Aifsn[QID_AC_BE] = 3;
668 pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
669 pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
670 pEdcaParm->Txop[QID_AC_BE] = 0;
671
672 pEdcaParm->bACM[QID_AC_BK] = 0;
673 pEdcaParm->Aifsn[QID_AC_BK] = 7;
674 pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
675 pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
676 pEdcaParm->Txop[QID_AC_BK] = 0;
677
678 pEdcaParm->bACM[QID_AC_VI] = 0;
679 pEdcaParm->Aifsn[QID_AC_VI] = 2;
680 pEdcaParm->Cwmin[QID_AC_VI] = CW_MIN_IN_BITS-1;
681 pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
682 pEdcaParm->Txop[QID_AC_VI] = 96; // AC_VI: 96*32us ~= 3ms
683
684 pEdcaParm->bACM[QID_AC_VO] = 0;
685 pEdcaParm->Aifsn[QID_AC_VO] = 2;
686 pEdcaParm->Cwmin[QID_AC_VO] = CW_MIN_IN_BITS-2;
687 pEdcaParm->Cwmax[QID_AC_VO] = CW_MAX_IN_BITS-1;
688 pEdcaParm->Txop[QID_AC_VO] = 48; // AC_VO: 48*32us ~= 1.5ms
689 }
690 break;
691
692 case IE_EXT_SUPP_RATES:
693 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
694 {
695 NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
696 *pExtRateLen = pEid->Len;
697
698 // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
699 // from ScanTab. We should report as is. And filter out unsupported
700 // rates in MlmeAux.
701 // Check against the supported rates
702 // RTMPCheckRates(pAd, ExtRate, pExtRateLen);
703 }
704 break;
705
706 case IE_ERP:
707 if (pEid->Len == 1)
708 {
709 *pErp = (UCHAR)pEid->Octet[0];
710 }
711 break;
712
713 case IE_AIRONET_CKIP:
714 // 0. Check Aironet IE length, it must be larger or equal to 28
715 // Cisco AP350 used length as 28
716 // Cisco AP12XX used length as 30
717 if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
718 break;
719
720 // 1. Copy CKIP flag byte to buffer for process
721 *pCkipFlag = *(pEid->Octet + 8);
722 break;
723
724 case IE_AP_TX_POWER:
725 // AP Control of Client Transmit Power
726 //0. Check Aironet IE length, it must be 6
727 if (pEid->Len != 0x06)
728 break;
729
730 // Get cell power limit in dBm
731 if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
732 *pAironetCellPowerLimit = *(pEid->Octet + 4);
733 break;
734
735 // WPA2 & 802.11i RSN
736 case IE_RSN:
737 // There is no OUI for version anymore, check the group cipher OUI before copying
738 if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
739 {
740 // Copy to pVIE which will report to microsoft bssid list.
741 Ptr = (PUCHAR) pVIE;
742 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
743 *LengthVIE += (pEid->Len + 2);
744 }
745 break;
746 #ifdef CONFIG_STA_SUPPORT
747 #ifdef EXT_BUILD_CHANNEL_LIST
748 case IE_COUNTRY:
749 Ptr = (PUCHAR) pVIE;
750 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
751 *LengthVIE += (pEid->Len + 2);
752 break;
753 #endif // EXT_BUILD_CHANNEL_LIST //
754 #endif // CONFIG_STA_SUPPORT //
755 default:
756 break;
757 }
758
759 Length = Length + 2 + pEid->Len; // Eid[1] + Len[1]+ content[Len]
760 pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
761 }
762
763 // For some 11a AP. it did not have the channel EID, patch here
764 #ifdef CONFIG_STA_SUPPORT
765 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
766 {
767 UCHAR LatchRfChannel = MsgChannel;
768 if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0))
769 {
770 if (CtrlChannel != 0)
771 *pChannel = CtrlChannel;
772 else
773 *pChannel = LatchRfChannel;
774 Sanity |= 0x4;
775 }
776 }
777 #endif // CONFIG_STA_SUPPORT //
778
779 if (Sanity != 0x7)
780 {
781 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n", Sanity));
782 return FALSE;
783 }
784 else
785 {
786 return TRUE;
787 }
788
789 }
790
791 #ifdef DOT11N_DRAFT3
792 /*
793 ==========================================================================
794 Description:
795 MLME message sanity check for some IE addressed in 802.11n d3.03.
796 Return:
797 TRUE if all parameters are OK, FALSE otherwise
798
799 IRQL = DISPATCH_LEVEL
800
801 ==========================================================================
802 */
PeerBeaconAndProbeRspSanity2(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT UCHAR * RegClass)803 BOOLEAN PeerBeaconAndProbeRspSanity2(
804 IN PRTMP_ADAPTER pAd,
805 IN VOID *Msg,
806 IN ULONG MsgLen,
807 OUT UCHAR *RegClass)
808 {
809 CHAR *Ptr;
810 PFRAME_802_11 pFrame;
811 PEID_STRUCT pEid;
812 ULONG Length = 0;
813
814 pFrame = (PFRAME_802_11)Msg;
815
816 *RegClass = 0;
817 Ptr = pFrame->Octet;
818 Length += LENGTH_802_11;
819
820 // get timestamp from payload and advance the pointer
821 Ptr += TIMESTAMP_LEN;
822 Length += TIMESTAMP_LEN;
823
824 // get beacon interval from payload and advance the pointer
825 Ptr += 2;
826 Length += 2;
827
828 // get capability info from payload and advance the pointer
829 Ptr += 2;
830 Length += 2;
831
832 pEid = (PEID_STRUCT) Ptr;
833
834 // get variable fields from payload and advance the pointer
835 while ((Length + 2 + pEid->Len) <= MsgLen)
836 {
837 switch(pEid->Eid)
838 {
839 case IE_SUPP_REG_CLASS:
840 if(pEid->Len > 0)
841 {
842 *RegClass = *pEid->Octet;
843 }
844 else
845 {
846 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
847 return FALSE;
848 }
849 break;
850 }
851
852 Length = Length + 2 + pEid->Len; // Eid[1] + Len[1]+ content[Len]
853 pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
854 }
855
856 return TRUE;
857
858 }
859 #endif // DOT11N_DRAFT3 //
860
861 /*
862 ==========================================================================
863 Description:
864 MLME message sanity check
865 Return:
866 TRUE if all parameters are OK, FALSE otherwise
867 ==========================================================================
868 */
MlmeScanReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT UCHAR * pBssType,OUT CHAR Ssid[],OUT UCHAR * pSsidLen,OUT UCHAR * pScanType)869 BOOLEAN MlmeScanReqSanity(
870 IN PRTMP_ADAPTER pAd,
871 IN VOID *Msg,
872 IN ULONG MsgLen,
873 OUT UCHAR *pBssType,
874 OUT CHAR Ssid[],
875 OUT UCHAR *pSsidLen,
876 OUT UCHAR *pScanType)
877 {
878 MLME_SCAN_REQ_STRUCT *Info;
879
880 Info = (MLME_SCAN_REQ_STRUCT *)(Msg);
881 *pBssType = Info->BssType;
882 *pSsidLen = Info->SsidLen;
883 NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
884 *pScanType = Info->ScanType;
885
886 if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC || *pBssType == BSS_ANY)
887 && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE
888 #ifdef CONFIG_STA_SUPPORT
889 || *pScanType == SCAN_CISCO_PASSIVE || *pScanType == SCAN_CISCO_ACTIVE
890 || *pScanType == SCAN_CISCO_CHANNEL_LOAD || *pScanType == SCAN_CISCO_NOISE
891 #endif // CONFIG_STA_SUPPORT //
892 ))
893 {
894 return TRUE;
895 }
896 else
897 {
898 DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
899 return FALSE;
900 }
901 }
902
903 // IRQL = DISPATCH_LEVEL
ChannelSanity(IN PRTMP_ADAPTER pAd,IN UCHAR channel)904 UCHAR ChannelSanity(
905 IN PRTMP_ADAPTER pAd,
906 IN UCHAR channel)
907 {
908 int i;
909
910 for (i = 0; i < pAd->ChannelListNum; i ++)
911 {
912 if (channel == pAd->ChannelList[i].Channel)
913 return 1;
914 }
915 return 0;
916 }
917
918 /*
919 ==========================================================================
920 Description:
921 MLME message sanity check
922 Return:
923 TRUE if all parameters are OK, FALSE otherwise
924
925 IRQL = DISPATCH_LEVEL
926
927 ==========================================================================
928 */
PeerDeauthSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pAddr2,OUT USHORT * pReason)929 BOOLEAN PeerDeauthSanity(
930 IN PRTMP_ADAPTER pAd,
931 IN VOID *Msg,
932 IN ULONG MsgLen,
933 OUT PUCHAR pAddr2,
934 OUT USHORT *pReason)
935 {
936 PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
937
938 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
939 NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
940
941 return TRUE;
942 }
943
944 /*
945 ==========================================================================
946 Description:
947 MLME message sanity check
948 Return:
949 TRUE if all parameters are OK, FALSE otherwise
950
951 IRQL = DISPATCH_LEVEL
952
953 ==========================================================================
954 */
PeerAuthSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pAddr,OUT USHORT * pAlg,OUT USHORT * pSeq,OUT USHORT * pStatus,CHAR * pChlgText)955 BOOLEAN PeerAuthSanity(
956 IN PRTMP_ADAPTER pAd,
957 IN VOID *Msg,
958 IN ULONG MsgLen,
959 OUT PUCHAR pAddr,
960 OUT USHORT *pAlg,
961 OUT USHORT *pSeq,
962 OUT USHORT *pStatus,
963 CHAR *pChlgText)
964 {
965 PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
966
967 COPY_MAC_ADDR(pAddr, pFrame->Hdr.Addr2);
968 NdisMoveMemory(pAlg, &pFrame->Octet[0], 2);
969 NdisMoveMemory(pSeq, &pFrame->Octet[2], 2);
970 NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
971
972 if ((*pAlg == Ndis802_11AuthModeOpen)
973 #ifdef LEAP_SUPPORT
974 || (*pAlg == CISCO_AuthModeLEAP)
975 #endif // LEAP_SUPPORT //
976 )
977 {
978 if (*pSeq == 1 || *pSeq == 2)
979 {
980 return TRUE;
981 }
982 else
983 {
984 DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
985 return FALSE;
986 }
987 }
988 else if (*pAlg == Ndis802_11AuthModeShared)
989 {
990 if (*pSeq == 1 || *pSeq == 4)
991 {
992 return TRUE;
993 }
994 else if (*pSeq == 2 || *pSeq == 3)
995 {
996 NdisMoveMemory(pChlgText, &pFrame->Octet[8], CIPHER_TEXT_LEN);
997 return TRUE;
998 }
999 else
1000 {
1001 DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
1002 return FALSE;
1003 }
1004 }
1005 else
1006 {
1007 DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong algorithm\n"));
1008 return FALSE;
1009 }
1010 }
1011
1012 /*
1013 ==========================================================================
1014 Description:
1015 MLME message sanity check
1016 Return:
1017 TRUE if all parameters are OK, FALSE otherwise
1018 ==========================================================================
1019 */
MlmeAuthReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pAddr,OUT ULONG * pTimeout,OUT USHORT * pAlg)1020 BOOLEAN MlmeAuthReqSanity(
1021 IN PRTMP_ADAPTER pAd,
1022 IN VOID *Msg,
1023 IN ULONG MsgLen,
1024 OUT PUCHAR pAddr,
1025 OUT ULONG *pTimeout,
1026 OUT USHORT *pAlg)
1027 {
1028 MLME_AUTH_REQ_STRUCT *pInfo;
1029
1030 pInfo = (MLME_AUTH_REQ_STRUCT *)Msg;
1031 COPY_MAC_ADDR(pAddr, pInfo->Addr);
1032 *pTimeout = pInfo->Timeout;
1033 *pAlg = pInfo->Alg;
1034
1035 if (((*pAlg == Ndis802_11AuthModeShared) ||(*pAlg == Ndis802_11AuthModeOpen)
1036 #ifdef LEAP_SUPPORT
1037 || (*pAlg == CISCO_AuthModeLEAP)
1038 #endif // LEAP_SUPPORT //
1039 ) &&
1040 ((*pAddr & 0x01) == 0))
1041 {
1042 return TRUE;
1043 }
1044 else
1045 {
1046 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAuthReqSanity fail - wrong algorithm\n"));
1047 return FALSE;
1048 }
1049 }
1050
1051 /*
1052 ==========================================================================
1053 Description:
1054 MLME message sanity check
1055 Return:
1056 TRUE if all parameters are OK, FALSE otherwise
1057
1058 IRQL = DISPATCH_LEVEL
1059
1060 ==========================================================================
1061 */
MlmeAssocReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pApAddr,OUT USHORT * pCapabilityInfo,OUT ULONG * pTimeout,OUT USHORT * pListenIntv)1062 BOOLEAN MlmeAssocReqSanity(
1063 IN PRTMP_ADAPTER pAd,
1064 IN VOID *Msg,
1065 IN ULONG MsgLen,
1066 OUT PUCHAR pApAddr,
1067 OUT USHORT *pCapabilityInfo,
1068 OUT ULONG *pTimeout,
1069 OUT USHORT *pListenIntv)
1070 {
1071 MLME_ASSOC_REQ_STRUCT *pInfo;
1072
1073 pInfo = (MLME_ASSOC_REQ_STRUCT *)Msg;
1074 *pTimeout = pInfo->Timeout; // timeout
1075 COPY_MAC_ADDR(pApAddr, pInfo->Addr); // AP address
1076 *pCapabilityInfo = pInfo->CapabilityInfo; // capability info
1077 *pListenIntv = pInfo->ListenIntv;
1078
1079 return TRUE;
1080 }
1081
1082 /*
1083 ==========================================================================
1084 Description:
1085 MLME message sanity check
1086 Return:
1087 TRUE if all parameters are OK, FALSE otherwise
1088
1089 IRQL = DISPATCH_LEVEL
1090
1091 ==========================================================================
1092 */
PeerDisassocSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pAddr2,OUT USHORT * pReason)1093 BOOLEAN PeerDisassocSanity(
1094 IN PRTMP_ADAPTER pAd,
1095 IN VOID *Msg,
1096 IN ULONG MsgLen,
1097 OUT PUCHAR pAddr2,
1098 OUT USHORT *pReason)
1099 {
1100 PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
1101
1102 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
1103 NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
1104
1105 return TRUE;
1106 }
1107
1108 /*
1109 ========================================================================
1110 Routine Description:
1111 Sanity check NetworkType (11b, 11g or 11a)
1112
1113 Arguments:
1114 pBss - Pointer to BSS table.
1115
1116 Return Value:
1117 Ndis802_11DS .......(11b)
1118 Ndis802_11OFDM24....(11g)
1119 Ndis802_11OFDM5.....(11a)
1120
1121 IRQL = DISPATCH_LEVEL
1122
1123 ========================================================================
1124 */
NetworkTypeInUseSanity(IN PBSS_ENTRY pBss)1125 NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
1126 IN PBSS_ENTRY pBss)
1127 {
1128 NDIS_802_11_NETWORK_TYPE NetWorkType;
1129 UCHAR rate, i;
1130
1131 NetWorkType = Ndis802_11DS;
1132
1133 if (pBss->Channel <= 14)
1134 {
1135 //
1136 // First check support Rate.
1137 //
1138 for (i = 0; i < pBss->SupRateLen; i++)
1139 {
1140 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1141 if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1142 {
1143 continue;
1144 }
1145 else
1146 {
1147 //
1148 // Otherwise (even rate > 108) means Ndis802_11OFDM24
1149 //
1150 NetWorkType = Ndis802_11OFDM24;
1151 break;
1152 }
1153 }
1154
1155 //
1156 // Second check Extend Rate.
1157 //
1158 if (NetWorkType != Ndis802_11OFDM24)
1159 {
1160 for (i = 0; i < pBss->ExtRateLen; i++)
1161 {
1162 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1163 if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1164 {
1165 continue;
1166 }
1167 else
1168 {
1169 //
1170 // Otherwise (even rate > 108) means Ndis802_11OFDM24
1171 //
1172 NetWorkType = Ndis802_11OFDM24;
1173 break;
1174 }
1175 }
1176 }
1177 }
1178 else
1179 {
1180 NetWorkType = Ndis802_11OFDM5;
1181 }
1182
1183 if (pBss->HtCapabilityLen != 0)
1184 {
1185 if (NetWorkType == Ndis802_11OFDM5)
1186 NetWorkType = Ndis802_11OFDM5_N;
1187 else
1188 NetWorkType = Ndis802_11OFDM24_N;
1189 }
1190
1191 return NetWorkType;
1192 }
1193
1194 /*
1195 ==========================================================================
1196 Description:
1197 WPA message sanity check
1198 Return:
1199 TRUE if all parameters are OK, FALSE otherwise
1200 ==========================================================================
1201 */
PeerWpaMessageSanity(IN PRTMP_ADAPTER pAd,IN PEAPOL_PACKET pMsg,IN ULONG MsgLen,IN UCHAR MsgType,IN MAC_TABLE_ENTRY * pEntry)1202 BOOLEAN PeerWpaMessageSanity(
1203 IN PRTMP_ADAPTER pAd,
1204 IN PEAPOL_PACKET pMsg,
1205 IN ULONG MsgLen,
1206 IN UCHAR MsgType,
1207 IN MAC_TABLE_ENTRY *pEntry)
1208 {
1209 UCHAR mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
1210 BOOLEAN bReplayDiff = FALSE;
1211 BOOLEAN bWPA2 = FALSE;
1212 KEY_INFO EapolKeyInfo;
1213 UCHAR GroupKeyIndex = 0;
1214
1215
1216 NdisZeroMemory(mic, sizeof(mic));
1217 NdisZeroMemory(digest, sizeof(digest));
1218 NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
1219 NdisZeroMemory((PUCHAR)&EapolKeyInfo, sizeof(EapolKeyInfo));
1220
1221 NdisMoveMemory((PUCHAR)&EapolKeyInfo, (PUCHAR)&pMsg->KeyDesc.KeyInfo, sizeof(KEY_INFO));
1222
1223 *((USHORT *)&EapolKeyInfo) = cpu2le16(*((USHORT *)&EapolKeyInfo));
1224
1225 // Choose WPA2 or not
1226 if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
1227 bWPA2 = TRUE;
1228
1229 // 0. Check MsgType
1230 if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1))
1231 {
1232 DBGPRINT(RT_DEBUG_ERROR, ("The message type is invalid(%d)! \n", MsgType));
1233 return FALSE;
1234 }
1235
1236 // 1. Replay counter check
1237 if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) // For supplicant
1238 {
1239 // First validate replay counter, only accept message with larger replay counter.
1240 // Let equal pass, some AP start with all zero replay counter
1241 UCHAR ZeroReplay[LEN_KEY_DESC_REPLAY];
1242
1243 NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
1244 if ((RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY) != 1) &&
1245 (RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, ZeroReplay, LEN_KEY_DESC_REPLAY) != 0))
1246 {
1247 bReplayDiff = TRUE;
1248 }
1249 }
1250 else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2) // For authenticator
1251 {
1252 // check Replay Counter coresponds to MSG from authenticator, otherwise discard
1253 if (!NdisEqualMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY))
1254 {
1255 bReplayDiff = TRUE;
1256 }
1257 }
1258
1259 // Replay Counter different condition
1260 if (bReplayDiff)
1261 {
1262 // send wireless event - for replay counter different
1263 if (pAd->CommonCfg.bWirelessEvent)
1264 RTMPSendWirelessEvent(pAd, IW_REPLAY_COUNTER_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1265
1266 if (MsgType < EAPOL_GROUP_MSG_1)
1267 {
1268 DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1269 }
1270 else
1271 {
1272 DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1273 }
1274
1275 hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
1276 hex_dump("Current replay counter ", pEntry->R_Counter, LEN_KEY_DESC_REPLAY);
1277 return FALSE;
1278 }
1279
1280 // 2. Verify MIC except Pairwise Msg1
1281 if (MsgType != EAPOL_PAIR_MSG_1)
1282 {
1283 UCHAR rcvd_mic[LEN_KEY_DESC_MIC];
1284
1285 // Record the received MIC for check later
1286 NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1287 NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1288
1289 if (pEntry->WepStatus == Ndis802_11Encryption2Enabled) // TKIP
1290 {
1291 hmac_md5(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, mic);
1292 }
1293 else if (pEntry->WepStatus == Ndis802_11Encryption3Enabled) // AES
1294 {
1295 HMAC_SHA1((PUCHAR)pMsg, MsgLen, pEntry->PTK, LEN_EAP_MICK, digest);
1296 NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
1297 }
1298
1299 if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC))
1300 {
1301 // send wireless event - for MIC different
1302 if (pAd->CommonCfg.bWirelessEvent)
1303 RTMPSendWirelessEvent(pAd, IW_MIC_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1304
1305 if (MsgType < EAPOL_GROUP_MSG_1)
1306 {
1307 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1308 }
1309 else
1310 {
1311 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1312 }
1313
1314 hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
1315 hex_dump("Desired MIC", mic, LEN_KEY_DESC_MIC);
1316
1317 return FALSE;
1318 }
1319 }
1320
1321 // Extract the context of the Key Data field if it exist
1322 // The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is un-encrypted.
1323 // The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted.
1324 if (pMsg->KeyDesc.KeyDataLen[1] > 0)
1325 {
1326 // Decrypt this field
1327 if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2) || (MsgType == EAPOL_GROUP_MSG_1))
1328 {
1329 if(pEntry->WepStatus == Ndis802_11Encryption3Enabled)
1330 {
1331 // AES
1332 AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA, pMsg->KeyDesc.KeyDataLen[1],pMsg->KeyDesc.KeyData);
1333 }
1334 else
1335 {
1336 INT i;
1337 UCHAR Key[32];
1338 // Decrypt TKIP GTK
1339 // Construct 32 bytes RC4 Key
1340 NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
1341 NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
1342 ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, 32);
1343 //discard first 256 bytes
1344 for(i = 0; i < 256; i++)
1345 ARCFOUR_BYTE(&pAd->PrivateInfo.WEPCONTEXT);
1346 // Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
1347 ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, KEYDATA, pMsg->KeyDesc.KeyData, pMsg->KeyDesc.KeyDataLen[1]);
1348 }
1349
1350 if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
1351 GroupKeyIndex = EapolKeyInfo.KeyIndex;
1352
1353 }
1354 else if ((MsgType == EAPOL_PAIR_MSG_2) || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2))
1355 {
1356 NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData, pMsg->KeyDesc.KeyDataLen[1]);
1357 }
1358 else
1359 {
1360
1361 return TRUE;
1362 }
1363
1364 // Parse Key Data field to
1365 // 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2)
1366 // 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2
1367 // 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2)
1368 if (!RTMPParseEapolKeyData(pAd, KEYDATA, pMsg->KeyDesc.KeyDataLen[1], GroupKeyIndex, MsgType, bWPA2, pEntry))
1369 {
1370 return FALSE;
1371 }
1372 }
1373
1374 return TRUE;
1375
1376 }
1377
1378 #ifdef CONFIG_STA_SUPPORT
1379 #ifdef QOS_DLS_SUPPORT
MlmeDlsReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PRT_802_11_DLS * pDLS,OUT PUSHORT pReason)1380 BOOLEAN MlmeDlsReqSanity(
1381 IN PRTMP_ADAPTER pAd,
1382 IN VOID *Msg,
1383 IN ULONG MsgLen,
1384 OUT PRT_802_11_DLS *pDLS,
1385 OUT PUSHORT pReason)
1386 {
1387 MLME_DLS_REQ_STRUCT *pInfo;
1388
1389 pInfo = (MLME_DLS_REQ_STRUCT *)Msg;
1390
1391 *pDLS = pInfo->pDLS;
1392 *pReason = pInfo->Reason;
1393
1394 return TRUE;
1395 }
1396 #endif // QOS_DLS_SUPPORT //
1397 #endif // CONFIG_STA_SUPPORT //
1398
1399 #ifdef QOS_DLS_SUPPORT
PeerDlsReqSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pDA,OUT PUCHAR pSA,OUT USHORT * pCapabilityInfo,OUT USHORT * pDlsTimeout,OUT UCHAR * pRatesLen,OUT UCHAR Rates[],OUT UCHAR * pHtCapabilityLen,OUT HT_CAPABILITY_IE * pHtCapability)1400 BOOLEAN PeerDlsReqSanity(
1401 IN PRTMP_ADAPTER pAd,
1402 IN VOID *Msg,
1403 IN ULONG MsgLen,
1404 OUT PUCHAR pDA,
1405 OUT PUCHAR pSA,
1406 OUT USHORT *pCapabilityInfo,
1407 OUT USHORT *pDlsTimeout,
1408 OUT UCHAR *pRatesLen,
1409 OUT UCHAR Rates[],
1410 OUT UCHAR *pHtCapabilityLen,
1411 OUT HT_CAPABILITY_IE *pHtCapability)
1412 {
1413 CHAR *Ptr;
1414 PFRAME_802_11 Fr = (PFRAME_802_11)Msg;
1415 PEID_STRUCT eid_ptr;
1416
1417 // to prevent caller from using garbage output value
1418 *pCapabilityInfo = 0;
1419 *pDlsTimeout = 0;
1420 *pHtCapabilityLen = 0;
1421
1422 Ptr = Fr->Octet;
1423
1424 // offset to destination MAC address (Category and Action field)
1425 Ptr += 2;
1426
1427 // get DA from payload and advance the pointer
1428 NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1429 Ptr += MAC_ADDR_LEN;
1430
1431 // get SA from payload and advance the pointer
1432 NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1433 Ptr += MAC_ADDR_LEN;
1434
1435 // get capability info from payload and advance the pointer
1436 NdisMoveMemory(pCapabilityInfo, Ptr, 2);
1437 Ptr += 2;
1438
1439 // get capability info from payload and advance the pointer
1440 NdisMoveMemory(pDlsTimeout, Ptr, 2);
1441 Ptr += 2;
1442
1443 // Category and Action field + DA + SA + capability + Timeout
1444 eid_ptr = (PEID_STRUCT) &Fr->Octet[18];
1445
1446 while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)Fr + MsgLen))
1447 {
1448 switch(eid_ptr->Eid)
1449 {
1450 case IE_SUPP_RATES:
1451 if ((eid_ptr->Len <= MAX_LEN_OF_SUPPORTED_RATES) && (eid_ptr->Len > 0))
1452 {
1453 NdisMoveMemory(Rates, eid_ptr->Octet, eid_ptr->Len);
1454 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - IE_SUPP_RATES., Len=%d. Rates[0]=%x\n",eid_ptr->Len, Rates[0]));
1455 DBGPRINT(RT_DEBUG_TRACE, ("Rates[1]=%x %x %x %x %x %x %x\n", Rates[1], Rates[2], Rates[3], Rates[4], Rates[5], Rates[6], Rates[7]));
1456 *pRatesLen = eid_ptr->Len;
1457 }
1458 else
1459 {
1460 *pRatesLen = 8;
1461 Rates[0] = 0x82;
1462 Rates[1] = 0x84;
1463 Rates[2] = 0x8b;
1464 Rates[3] = 0x96;
1465 Rates[4] = 0x12;
1466 Rates[5] = 0x24;
1467 Rates[6] = 0x48;
1468 Rates[7] = 0x6c;
1469 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - wrong IE_SUPP_RATES., Len=%d\n",eid_ptr->Len));
1470 }
1471 break;
1472
1473 case IE_EXT_SUPP_RATES:
1474 if (eid_ptr->Len + *pRatesLen <= MAX_LEN_OF_SUPPORTED_RATES)
1475 {
1476 NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, eid_ptr->Len);
1477 *pRatesLen = (*pRatesLen) + eid_ptr->Len;
1478 }
1479 else
1480 {
1481 NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, MAX_LEN_OF_SUPPORTED_RATES - (*pRatesLen));
1482 *pRatesLen = MAX_LEN_OF_SUPPORTED_RATES;
1483 }
1484 break;
1485
1486 case IE_HT_CAP:
1487 if (eid_ptr->Len >= sizeof(HT_CAPABILITY_IE))
1488 {
1489 NdisMoveMemory(pHtCapability, eid_ptr->Octet, sizeof(HT_CAPABILITY_IE));
1490
1491 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
1492 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
1493 *pHtCapabilityLen = sizeof(HT_CAPABILITY_IE);
1494
1495 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - IE_HT_CAP\n"));
1496 }
1497 else
1498 {
1499 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - wrong IE_HT_CAP.eid_ptr->Len = %d\n", eid_ptr->Len));
1500 }
1501 break;
1502
1503 default:
1504 break;
1505 }
1506
1507 eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
1508 }
1509
1510 return TRUE;
1511 }
1512
PeerDlsRspSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pDA,OUT PUCHAR pSA,OUT USHORT * pCapabilityInfo,OUT USHORT * pStatus,OUT UCHAR * pRatesLen,OUT UCHAR Rates[],OUT UCHAR * pHtCapabilityLen,OUT HT_CAPABILITY_IE * pHtCapability)1513 BOOLEAN PeerDlsRspSanity(
1514 IN PRTMP_ADAPTER pAd,
1515 IN VOID *Msg,
1516 IN ULONG MsgLen,
1517 OUT PUCHAR pDA,
1518 OUT PUCHAR pSA,
1519 OUT USHORT *pCapabilityInfo,
1520 OUT USHORT *pStatus,
1521 OUT UCHAR *pRatesLen,
1522 OUT UCHAR Rates[],
1523 OUT UCHAR *pHtCapabilityLen,
1524 OUT HT_CAPABILITY_IE *pHtCapability)
1525 {
1526 CHAR *Ptr;
1527 PFRAME_802_11 Fr = (PFRAME_802_11)Msg;
1528 PEID_STRUCT eid_ptr;
1529
1530 // to prevent caller from using garbage output value
1531 *pStatus = 0;
1532 *pCapabilityInfo = 0;
1533 *pHtCapabilityLen = 0;
1534
1535 Ptr = Fr->Octet;
1536
1537 // offset to destination MAC address (Category and Action field)
1538 Ptr += 2;
1539
1540 // get status code from payload and advance the pointer
1541 NdisMoveMemory(pStatus, Ptr, 2);
1542 Ptr += 2;
1543
1544 // get DA from payload and advance the pointer
1545 NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1546 Ptr += MAC_ADDR_LEN;
1547
1548 // get SA from payload and advance the pointer
1549 NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1550 Ptr += MAC_ADDR_LEN;
1551
1552 if (pStatus == 0)
1553 {
1554 // get capability info from payload and advance the pointer
1555 NdisMoveMemory(pCapabilityInfo, Ptr, 2);
1556 Ptr += 2;
1557 }
1558
1559 // Category and Action field + status code + DA + SA + capability
1560 eid_ptr = (PEID_STRUCT) &Fr->Octet[18];
1561
1562 while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)Fr + MsgLen))
1563 {
1564 switch(eid_ptr->Eid)
1565 {
1566 case IE_SUPP_RATES:
1567 if ((eid_ptr->Len <= MAX_LEN_OF_SUPPORTED_RATES) && (eid_ptr->Len > 0))
1568 {
1569 NdisMoveMemory(Rates, eid_ptr->Octet, eid_ptr->Len);
1570 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - IE_SUPP_RATES., Len=%d. Rates[0]=%x\n",eid_ptr->Len, Rates[0]));
1571 DBGPRINT(RT_DEBUG_TRACE, ("Rates[1]=%x %x %x %x %x %x %x\n", Rates[1], Rates[2], Rates[3], Rates[4], Rates[5], Rates[6], Rates[7]));
1572 *pRatesLen = eid_ptr->Len;
1573 }
1574 else
1575 {
1576 *pRatesLen = 8;
1577 Rates[0] = 0x82;
1578 Rates[1] = 0x84;
1579 Rates[2] = 0x8b;
1580 Rates[3] = 0x96;
1581 Rates[4] = 0x12;
1582 Rates[5] = 0x24;
1583 Rates[6] = 0x48;
1584 Rates[7] = 0x6c;
1585 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - wrong IE_SUPP_RATES., Len=%d\n",eid_ptr->Len));
1586 }
1587 break;
1588
1589 case IE_EXT_SUPP_RATES:
1590 if (eid_ptr->Len + *pRatesLen <= MAX_LEN_OF_SUPPORTED_RATES)
1591 {
1592 NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, eid_ptr->Len);
1593 *pRatesLen = (*pRatesLen) + eid_ptr->Len;
1594 }
1595 else
1596 {
1597 NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, MAX_LEN_OF_SUPPORTED_RATES - (*pRatesLen));
1598 *pRatesLen = MAX_LEN_OF_SUPPORTED_RATES;
1599 }
1600 break;
1601
1602 case IE_HT_CAP:
1603 if (eid_ptr->Len >= sizeof(HT_CAPABILITY_IE))
1604 {
1605 NdisMoveMemory(pHtCapability, eid_ptr->Octet, sizeof(HT_CAPABILITY_IE));
1606
1607 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
1608 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
1609 *pHtCapabilityLen = sizeof(HT_CAPABILITY_IE);
1610
1611 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - IE_HT_CAP\n"));
1612 }
1613 else
1614 {
1615 DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - wrong IE_HT_CAP.eid_ptr->Len = %d\n", eid_ptr->Len));
1616 }
1617 break;
1618
1619 default:
1620 break;
1621 }
1622
1623 eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
1624 }
1625
1626 return TRUE;
1627 }
1628
PeerDlsTearDownSanity(IN PRTMP_ADAPTER pAd,IN VOID * Msg,IN ULONG MsgLen,OUT PUCHAR pDA,OUT PUCHAR pSA,OUT USHORT * pReason)1629 BOOLEAN PeerDlsTearDownSanity(
1630 IN PRTMP_ADAPTER pAd,
1631 IN VOID *Msg,
1632 IN ULONG MsgLen,
1633 OUT PUCHAR pDA,
1634 OUT PUCHAR pSA,
1635 OUT USHORT *pReason)
1636 {
1637 CHAR *Ptr;
1638 PFRAME_802_11 Fr = (PFRAME_802_11)Msg;
1639
1640 // to prevent caller from using garbage output value
1641 *pReason = 0;
1642
1643 Ptr = Fr->Octet;
1644
1645 // offset to destination MAC address (Category and Action field)
1646 Ptr += 2;
1647
1648 // get DA from payload and advance the pointer
1649 NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1650 Ptr += MAC_ADDR_LEN;
1651
1652 // get SA from payload and advance the pointer
1653 NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1654 Ptr += MAC_ADDR_LEN;
1655
1656 // get reason code from payload and advance the pointer
1657 NdisMoveMemory(pReason, Ptr, 2);
1658 Ptr += 2;
1659
1660 return TRUE;
1661 }
1662 #endif // QOS_DLS_SUPPORT //
1663
1664