git.oblomov.eu Git - linux-2.6/blob - drivers/staging/rt2860/common/cmm_sanity.c

   1 /*
   2  *************************************************************************
   3  * Ralink Tech Inc.
   4  * 5F., No.36, Taiyuan St., Jhubei City,
   5  * Hsinchu County 302,
   6  * Taiwan, R.O.C.
   7  *
   8  * (c) Copyright 2002-2007, Ralink Technology, Inc.
   9  *
  10  * This program is free software; you can redistribute it and/or modify  *
  11  * it under the terms of the GNU General Public License as published by  *
  12  * the Free Software Foundation; either version 2 of the License, or     *
  13  * (at your option) any later version.                                   *
  14  *                                                                       *
  15  * This program is distributed in the hope that it will be useful,       *
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  18  * GNU General Public License for more details.                          *
  19  *                                                                       *
  20  * You should have received a copy of the GNU General Public License     *
  21  * along with this program; if not, write to the                         *
  22  * Free Software Foundation, Inc.,                                       *
  23  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  24  *                                                                       *
  25  *************************************************************************
  26
  27         Module Name:
  28         sanity.c
  29
  30         Abstract:
  31
  32         Revision History:
  33         Who                     When                    What
  34         --------        ----------              ----------------------------------------------
  35         John Chang  2004-09-01      add WMM support
  36 */
  37 #include "../rt_config.h"
  38
  39
  40 extern UCHAR    CISCO_OUI[];
  41
  42 extern UCHAR    WPA_OUI[];
  43 extern UCHAR    RSN_OUI[];
  44 extern UCHAR    WME_INFO_ELEM[];
  45 extern UCHAR    WME_PARM_ELEM[];
  46 extern UCHAR    Ccx2QosInfo[];
  47 extern UCHAR    RALINK_OUI[];
  48 extern UCHAR    BROADCOM_OUI[];
  49 extern UCHAR    WPS_OUI[];
  50
  51 /*
  52     ==========================================================================
  53     Description:
  54         MLME message sanity check
  55     Return:
  56         TRUE if all parameters are OK, FALSE otherwise
  57
  58         IRQL = DISPATCH_LEVEL
  59
  60     ==========================================================================
  61  */
  62 BOOLEAN MlmeAddBAReqSanity(
  63     IN PRTMP_ADAPTER pAd,
  64     IN VOID *Msg,
  65     IN ULONG MsgLen,
  66     OUT PUCHAR pAddr2)
  67 {
  68     PMLME_ADDBA_REQ_STRUCT   pInfo;
  69
  70     pInfo = (MLME_ADDBA_REQ_STRUCT *)Msg;
  71
  72     if ((MsgLen != sizeof(MLME_ADDBA_REQ_STRUCT)))
  73     {
  74         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
  75         return FALSE;
  76     }
  77
  78     if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
  79     {
  80         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
  81         return FALSE;
  82     }
  83
  84     if ((pInfo->pAddr[0]&0x01) == 0x01)
  85     {
  86         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
  87         return FALSE;
  88     }
  89
  90     return TRUE;
  91 }
  92
  93 /*
  94     ==========================================================================
  95     Description:
  96         MLME message sanity check
  97     Return:
  98         TRUE if all parameters are OK, FALSE otherwise
  99
 100         IRQL = DISPATCH_LEVEL
 101
 102     ==========================================================================
 103  */
 104 BOOLEAN MlmeDelBAReqSanity(
 105     IN PRTMP_ADAPTER pAd,
 106     IN VOID *Msg,
 107     IN ULONG MsgLen)
 108 {
 109         MLME_DELBA_REQ_STRUCT *pInfo;
 110         pInfo = (MLME_DELBA_REQ_STRUCT *)Msg;
 111
 112     if ((MsgLen != sizeof(MLME_DELBA_REQ_STRUCT)))
 113     {
 114         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
 115         return FALSE;
 116     }
 117
 118     if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
 119     {
 120         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
 121         return FALSE;
 122     }
 123
 124     if ((pInfo->TID & 0xf0))
 125     {
 126         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
 127         return FALSE;
 128     }
 129
 130         if (NdisEqualMemory(pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr, MAC_ADDR_LEN) == 0)
 131     {
 132         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
 133         return FALSE;
 134     }
 135
 136     return TRUE;
 137 }
 138
 139 BOOLEAN PeerAddBAReqActionSanity(
 140     IN PRTMP_ADAPTER pAd,
 141     IN VOID *pMsg,
 142     IN ULONG MsgLen,
 143         OUT PUCHAR pAddr2)
 144 {
 145         PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 146         PFRAME_ADDBA_REQ pAddFrame;
 147         pAddFrame = (PFRAME_ADDBA_REQ)(pMsg);
 148         if (MsgLen < (sizeof(FRAME_ADDBA_REQ)))
 149         {
 150                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n", MsgLen));
 151                 return FALSE;
 152         }
 153         // we support immediate BA.
 154         *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
 155         pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 156         pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
 157
 158         if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
 159         {
 160                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
 161                 DBGPRINT(RT_DEBUG_ERROR,("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n", pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize, pAddFrame->BaParm.AMSDUSupported));
 162                 return FALSE;
 163         }
 164
 165         // we support immediate BA.
 166         if (pAddFrame->BaParm.TID &0xfff0)
 167         {
 168                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n", pAddFrame->BaParm.TID));
 169                 return FALSE;
 170         }
 171         COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 172         return TRUE;
 173 }
 174
 175 BOOLEAN PeerAddBARspActionSanity(
 176     IN PRTMP_ADAPTER pAd,
 177     IN VOID *pMsg,
 178     IN ULONG MsgLen)
 179 {
 180         PFRAME_ADDBA_RSP pAddFrame;
 181
 182         pAddFrame = (PFRAME_ADDBA_RSP)(pMsg);
 183         if (MsgLen < (sizeof(FRAME_ADDBA_RSP)))
 184         {
 185                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n", MsgLen));
 186                 return FALSE;
 187         }
 188         // we support immediate BA.
 189         *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
 190         pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
 191         pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 192
 193         if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
 194         {
 195                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
 196                 return FALSE;
 197         }
 198
 199         // we support immediate BA.
 200         if (pAddFrame->BaParm.TID &0xfff0)
 201         {
 202                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n", pAddFrame->BaParm.TID));
 203                 return FALSE;
 204         }
 205         return TRUE;
 206
 207 }
 208
 209 BOOLEAN PeerDelBAActionSanity(
 210     IN PRTMP_ADAPTER pAd,
 211     IN UCHAR Wcid,
 212     IN VOID *pMsg,
 213     IN ULONG MsgLen )
 214 {
 215         //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 216         PFRAME_DELBA_REQ  pDelFrame;
 217         if (MsgLen != (sizeof(FRAME_DELBA_REQ)))
 218                 return FALSE;
 219
 220         if (Wcid >= MAX_LEN_OF_MAC_TABLE)
 221                 return FALSE;
 222
 223         pDelFrame = (PFRAME_DELBA_REQ)(pMsg);
 224
 225         *(USHORT *)(&pDelFrame->DelbaParm) = cpu2le16(*(USHORT *)(&pDelFrame->DelbaParm));
 226         pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
 227
 228         if (pDelFrame->DelbaParm.TID &0xfff0)
 229                 return FALSE;
 230
 231         return TRUE;
 232 }
 233
 234 /*
 235     ==========================================================================
 236     Description:
 237         MLME message sanity check
 238     Return:
 239         TRUE if all parameters are OK, FALSE otherwise
 240
 241         IRQL = DISPATCH_LEVEL
 242
 243     ==========================================================================
 244  */
 245 BOOLEAN PeerBeaconAndProbeRspSanity(
 246     IN PRTMP_ADAPTER pAd,
 247     IN VOID *Msg,
 248     IN ULONG MsgLen,
 249     IN UCHAR  MsgChannel,
 250     OUT PUCHAR pAddr2,
 251     OUT PUCHAR pBssid,
 252     OUT CHAR Ssid[],
 253     OUT UCHAR *pSsidLen,
 254     OUT UCHAR *pBssType,
 255     OUT USHORT *pBeaconPeriod,
 256     OUT UCHAR *pChannel,
 257     OUT UCHAR *pNewChannel,
 258     OUT LARGE_INTEGER *pTimestamp,
 259     OUT CF_PARM *pCfParm,
 260     OUT USHORT *pAtimWin,
 261     OUT USHORT *pCapabilityInfo,
 262     OUT UCHAR *pErp,
 263     OUT UCHAR *pDtimCount,
 264     OUT UCHAR *pDtimPeriod,
 265     OUT UCHAR *pBcastFlag,
 266     OUT UCHAR *pMessageToMe,
 267     OUT UCHAR SupRate[],
 268     OUT UCHAR *pSupRateLen,
 269     OUT UCHAR ExtRate[],
 270     OUT UCHAR *pExtRateLen,
 271     OUT UCHAR *pCkipFlag,
 272     OUT UCHAR *pAironetCellPowerLimit,
 273     OUT PEDCA_PARM       pEdcaParm,
 274     OUT PQBSS_LOAD_PARM  pQbssLoad,
 275     OUT PQOS_CAPABILITY_PARM pQosCapability,
 276     OUT ULONG *pRalinkIe,
 277     OUT UCHAR            *pHtCapabilityLen,
 278 #ifdef CONFIG_STA_SUPPORT
 279     OUT UCHAR            *pPreNHtCapabilityLen,
 280 #endif // CONFIG_STA_SUPPORT //
 281     OUT HT_CAPABILITY_IE *pHtCapability,
 282         OUT UCHAR                *AddHtInfoLen,
 283         OUT ADD_HT_INFO_IE *AddHtInfo,
 284         OUT UCHAR *NewExtChannelOffset,         // Ht extension channel offset(above or below)
 285     OUT USHORT *LengthVIE,
 286     OUT PNDIS_802_11_VARIABLE_IEs pVIE)
 287 {
 288     CHAR                                *Ptr;
 289 #ifdef CONFIG_STA_SUPPORT
 290         CHAR                            TimLen;
 291 #endif // CONFIG_STA_SUPPORT //
 292     PFRAME_802_11               pFrame;
 293     PEID_STRUCT         pEid;
 294     UCHAR                               SubType;
 295     UCHAR                               Sanity;
 296     //UCHAR                             ECWMin, ECWMax;
 297     //MAC_CSR9_STRUC            Csr9;
 298     ULONG                               Length = 0;
 299
 300         // For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel
 301         //      1. If the AP is 11n enabled, then check the control channel.
 302         //      2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!!)
 303         UCHAR                   CtrlChannel = 0;
 304
 305     // Add for 3 necessary EID field check
 306     Sanity = 0;
 307
 308     *pAtimWin = 0;
 309     *pErp = 0;
 310     *pDtimCount = 0;
 311     *pDtimPeriod = 0;
 312     *pBcastFlag = 0;
 313     *pMessageToMe = 0;
 314     *pExtRateLen = 0;
 315     *pCkipFlag = 0;                             // Default of CkipFlag is 0
 316     *pAironetCellPowerLimit = 0xFF;  // Default of AironetCellPowerLimit is 0xFF
 317     *LengthVIE = 0;                                     // Set the length of VIE to init value 0
 318     *pHtCapabilityLen = 0;                                      // Set the length of VIE to init value 0
 319 #ifdef CONFIG_STA_SUPPORT
 320         if (pAd->OpMode == OPMODE_STA)
 321                 *pPreNHtCapabilityLen = 0;                                      // Set the length of VIE to init value 0
 322 #endif // CONFIG_STA_SUPPORT //
 323     *AddHtInfoLen = 0;                                  // Set the length of VIE to init value 0
 324     *pRalinkIe = 0;
 325     *pNewChannel = 0;
 326     *NewExtChannelOffset = 0xff;        //Default 0xff means no such IE
 327     pCfParm->bValid = FALSE;        // default: no IE_CF found
 328     pQbssLoad->bValid = FALSE;      // default: no IE_QBSS_LOAD found
 329     pEdcaParm->bValid = FALSE;      // default: no IE_EDCA_PARAMETER found
 330     pQosCapability->bValid = FALSE; // default: no IE_QOS_CAPABILITY found
 331
 332     pFrame = (PFRAME_802_11)Msg;
 333
 334     // get subtype from header
 335     SubType = (UCHAR)pFrame->Hdr.FC.SubType;
 336
 337     // get Addr2 and BSSID from header
 338     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 339     COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
 340
 341     Ptr = pFrame->Octet;
 342     Length += LENGTH_802_11;
 343
 344     // get timestamp from payload and advance the pointer
 345     NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
 346
 347         pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
 348         pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
 349
 350     Ptr += TIMESTAMP_LEN;
 351     Length += TIMESTAMP_LEN;
 352
 353     // get beacon interval from payload and advance the pointer
 354     NdisMoveMemory(pBeaconPeriod, Ptr, 2);
 355     Ptr += 2;
 356     Length += 2;
 357
 358     // get capability info from payload and advance the pointer
 359     NdisMoveMemory(pCapabilityInfo, Ptr, 2);
 360     Ptr += 2;
 361     Length += 2;
 362
 363     if (CAP_IS_ESS_ON(*pCapabilityInfo))
 364         *pBssType = BSS_INFRA;
 365     else
 366         *pBssType = BSS_ADHOC;
 367
 368     pEid = (PEID_STRUCT) Ptr;
 369
 370     // get variable fields from payload and advance the pointer
 371     while ((Length + 2 + pEid->Len) <= MsgLen)
 372     {
 373         //
 374         // Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow.
 375         //
 376         if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN)
 377         {
 378             DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
 379                     (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
 380             break;
 381         }
 382
 383         switch(pEid->Eid)
 384         {
 385             case IE_SSID:
 386                 // Already has one SSID EID in this beacon, ignore the second one
 387                 if (Sanity & 0x1)
 388                     break;
 389                 if(pEid->Len <= MAX_LEN_OF_SSID)
 390                 {
 391                     NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
 392                     *pSsidLen = pEid->Len;
 393                     Sanity |= 0x1;
 394                 }
 395                 else
 396                 {
 397                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
 398                     return FALSE;
 399                 }
 400                 break;
 401
 402             case IE_SUPP_RATES:
 403                 if(pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
 404                 {
 405                     Sanity |= 0x2;
 406                     NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
 407                     *pSupRateLen = pEid->Len;
 408
 409                     // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
 410                     // from ScanTab. We should report as is. And filter out unsupported
 411                     // rates in MlmeAux.
 412                     // Check against the supported rates
 413                     // RTMPCheckRates(pAd, SupRate, pSupRateLen);
 414                 }
 415                 else
 416                 {
 417                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",pEid->Len));
 418                     return FALSE;
 419                 }
 420                 break;
 421
 422             case IE_HT_CAP:
 423                         if (pEid->Len >= SIZE_HT_CAP_IE)  //Note: allow extension.!!
 424                         {
 425                                 NdisMoveMemory(pHtCapability, pEid->Octet, sizeof(HT_CAPABILITY_IE));
 426                                 *pHtCapabilityLen = SIZE_HT_CAP_IE;     // Nnow we only support 26 bytes.
 427
 428                                 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
 429                                 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
 430
 431 #ifdef CONFIG_STA_SUPPORT
 432                                 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 433                                 {
 434                                         *pPreNHtCapabilityLen = 0;      // Nnow we only support 26 bytes.
 435
 436                                         Ptr = (PUCHAR) pVIE;
 437                                         NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 438                                         *LengthVIE += (pEid->Len + 2);
 439                                 }
 440 #endif // CONFIG_STA_SUPPORT //
 441                         }
 442                         else
 443                         {
 444                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n", pEid->Len));
 445                         }
 446
 447                 break;
 448             case IE_ADD_HT:
 449                         if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
 450                         {
 451                                 // This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
 452                                 // copy first sizeof(ADD_HT_INFO_IE)
 453                                 NdisMoveMemory(AddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
 454                                 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 455
 456                                 CtrlChannel = AddHtInfo->ControlChan;
 457
 458                                 *(USHORT *)(&AddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo2));
 459                                 *(USHORT *)(&AddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo3));
 460
 461 #ifdef CONFIG_STA_SUPPORT
 462                                 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 463                                 {
 464                                         Ptr = (PUCHAR) pVIE;
 465                                         NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 466                                         *LengthVIE += (pEid->Len + 2);
 467                                 }
 468 #endif // CONFIG_STA_SUPPORT //
 469                         }
 470                         else
 471                         {
 472                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
 473                         }
 474
 475                 break;
 476             case IE_SECONDARY_CH_OFFSET:
 477                         if (pEid->Len == 1)
 478                         {
 479                                 *NewExtChannelOffset = pEid->Octet[0];
 480                         }
 481                         else
 482                         {
 483                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
 484                         }
 485
 486                 break;
 487             case IE_FH_PARM:
 488                 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
 489                 break;
 490
 491             case IE_DS_PARM:
 492                 if(pEid->Len == 1)
 493                 {
 494                     *pChannel = *pEid->Octet;
 495 #ifdef CONFIG_STA_SUPPORT
 496                                         IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 497                                         {
 498                                                 if (ChannelSanity(pAd, *pChannel) == 0)
 499                                                 {
 500
 501                                                         return FALSE;
 502                                                 }
 503                                         }
 504 #endif // CONFIG_STA_SUPPORT //
 505                     Sanity |= 0x4;
 506                 }
 507                 else
 508                 {
 509                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",pEid->Len));
 510                     return FALSE;
 511                 }
 512                 break;
 513
 514             case IE_CF_PARM:
 515                 if(pEid->Len == 6)
 516                 {
 517                     pCfParm->bValid = TRUE;
 518                     pCfParm->CfpCount = pEid->Octet[0];
 519                     pCfParm->CfpPeriod = pEid->Octet[1];
 520                     pCfParm->CfpMaxDuration = pEid->Octet[2] + 256 * pEid->Octet[3];
 521                     pCfParm->CfpDurRemaining = pEid->Octet[4] + 256 * pEid->Octet[5];
 522                 }
 523                 else
 524                 {
 525                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
 526                     return FALSE;
 527                 }
 528                 break;
 529
 530             case IE_IBSS_PARM:
 531                 if(pEid->Len == 2)
 532                 {
 533                     NdisMoveMemory(pAtimWin, pEid->Octet, pEid->Len);
 534                 }
 535                 else
 536                 {
 537                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
 538                     return FALSE;
 539                 }
 540                 break;
 541
 542 #ifdef CONFIG_STA_SUPPORT
 543             case IE_TIM:
 544                 if(INFRA_ON(pAd) && SubType == SUBTYPE_BEACON)
 545                 {
 546                     GetTimBit((PUCHAR)pEid, pAd->StaActive.Aid, &TimLen, pBcastFlag, pDtimCount, pDtimPeriod, pMessageToMe);
 547                 }
 548                 break;
 549 #endif // CONFIG_STA_SUPPORT //
 550             case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
 551                 if(pEid->Len == 3)
 552                 {
 553                         *pNewChannel = pEid->Octet[1];  //extract new channel number
 554                 }
 555                 break;
 556
 557             // New for WPA
 558             // CCX v2 has the same IE, we need to parse that too
 559             // Wifi WMM use the same IE vale, need to parse that too
 560             // case IE_WPA:
 561             case IE_VENDOR_SPECIFIC:
 562                 // Check the OUI version, filter out non-standard usage
 563                 if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3) && (pEid->Len == 7))
 564                 {
 565                     //*pRalinkIe = pEid->Octet[3];
 566                     if (pEid->Octet[3] != 0)
 567                                         *pRalinkIe = pEid->Octet[3];
 568                                 else
 569                                         *pRalinkIe = 0xf0000000; // Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag.
 570                 }
 571 #ifdef CONFIG_STA_SUPPORT
 572 #ifdef DOT11_N_SUPPORT
 573                 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
 574
 575                 // Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP,
 576                 // Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE
 577                 else if ((*pHtCapabilityLen == 0) && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI, 3) && (pEid->Len >= 4) && (pAd->OpMode == OPMODE_STA))
 578                 {
 579                     if ((pEid->Octet[3] == OUI_PREN_HT_CAP) && (pEid->Len >= 30) && (*pHtCapabilityLen == 0))
 580                     {
 581                         NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
 582                         *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
 583                     }
 584
 585                     if ((pEid->Octet[3] == OUI_PREN_ADD_HT) && (pEid->Len >= 26))
 586                     {
 587                         NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
 588                         *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 589                     }
 590                 }
 591 #endif // DOT11_N_SUPPORT //
 592 #endif // CONFIG_STA_SUPPORT //
 593                 else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
 594                 {
 595                     // Copy to pVIE which will report to microsoft bssid list.
 596                     Ptr = (PUCHAR) pVIE;
 597                     NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 598                     *LengthVIE += (pEid->Len + 2);
 599                 }
 600                 else if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
 601                 {
 602                     PUCHAR ptr;
 603                     int i;
 604
 605                     // parsing EDCA parameters
 606                     pEdcaParm->bValid          = TRUE;
 607                     pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
 608                     pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
 609                     pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
 610                     pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
 611                     pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
 612                     ptr = &pEid->Octet[8];
 613                     for (i=0; i<4; i++)
 614                     {
 615                         UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
 616                         pEdcaParm->bACM[aci]  = (((*ptr) & 0x10) == 0x10);   // b5 is ACM
 617                         pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;               // b0~3 is AIFSN
 618                         pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f;             // b0~4 is Cwmin
 619                         pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4;               // b5~8 is Cwmax
 620                         pEdcaParm->Txop[aci]  = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
 621                         ptr += 4; // point to next AC
 622                     }
 623                 }
 624                 else if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6) && (pEid->Len == 7))
 625                 {
 626                     // parsing EDCA parameters
 627                     pEdcaParm->bValid          = TRUE;
 628                     pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
 629                     pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
 630                     pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
 631                     pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
 632                     pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
 633
 634                     // use default EDCA parameter
 635                     pEdcaParm->bACM[QID_AC_BE]  = 0;
 636                     pEdcaParm->Aifsn[QID_AC_BE] = 3;
 637                     pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
 638                     pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
 639                     pEdcaParm->Txop[QID_AC_BE]  = 0;
 640
 641                     pEdcaParm->bACM[QID_AC_BK]  = 0;
 642                     pEdcaParm->Aifsn[QID_AC_BK] = 7;
 643                     pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
 644                     pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
 645                     pEdcaParm->Txop[QID_AC_BK]  = 0;
 646
 647                     pEdcaParm->bACM[QID_AC_VI]  = 0;
 648                     pEdcaParm->Aifsn[QID_AC_VI] = 2;
 649                     pEdcaParm->Cwmin[QID_AC_VI] = CW_MIN_IN_BITS-1;
 650                     pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
 651                     pEdcaParm->Txop[QID_AC_VI]  = 96;   // AC_VI: 96*32us ~= 3ms
 652
 653                     pEdcaParm->bACM[QID_AC_VO]  = 0;
 654                     pEdcaParm->Aifsn[QID_AC_VO] = 2;
 655                     pEdcaParm->Cwmin[QID_AC_VO] = CW_MIN_IN_BITS-2;
 656                     pEdcaParm->Cwmax[QID_AC_VO] = CW_MAX_IN_BITS-1;
 657                     pEdcaParm->Txop[QID_AC_VO]  = 48;   // AC_VO: 48*32us ~= 1.5ms
 658                 }
 659                 break;
 660
 661             case IE_EXT_SUPP_RATES:
 662                 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
 663                 {
 664                     NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
 665                     *pExtRateLen = pEid->Len;
 666
 667                     // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
 668                     // from ScanTab. We should report as is. And filter out unsupported
 669                     // rates in MlmeAux.
 670                     // Check against the supported rates
 671                     // RTMPCheckRates(pAd, ExtRate, pExtRateLen);
 672                 }
 673                 break;
 674
 675             case IE_ERP:
 676                 if (pEid->Len == 1)
 677                 {
 678                     *pErp = (UCHAR)pEid->Octet[0];
 679                 }
 680                 break;
 681
 682             case IE_AIRONET_CKIP:
 683                 // 0. Check Aironet IE length, it must be larger or equal to 28
 684                 // Cisco AP350 used length as 28
 685                 // Cisco AP12XX used length as 30
 686                 if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
 687                     break;
 688
 689                 // 1. Copy CKIP flag byte to buffer for process
 690                 *pCkipFlag = *(pEid->Octet + 8);
 691                 break;
 692
 693             case IE_AP_TX_POWER:
 694                 // AP Control of Client Transmit Power
 695                 //0. Check Aironet IE length, it must be 6
 696                 if (pEid->Len != 0x06)
 697                     break;
 698
 699                 // Get cell power limit in dBm
 700                 if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
 701                     *pAironetCellPowerLimit = *(pEid->Octet + 4);
 702                 break;
 703
 704             // WPA2 & 802.11i RSN
 705             case IE_RSN:
 706                 // There is no OUI for version anymore, check the group cipher OUI before copying
 707                 if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
 708                 {
 709                     // Copy to pVIE which will report to microsoft bssid list.
 710                     Ptr = (PUCHAR) pVIE;
 711                     NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 712                     *LengthVIE += (pEid->Len + 2);
 713                 }
 714                 break;
 715 #ifdef CONFIG_STA_SUPPORT
 716 #ifdef EXT_BUILD_CHANNEL_LIST
 717                         case IE_COUNTRY:
 718                                 Ptr = (PUCHAR) pVIE;
 719                 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 720                 *LengthVIE += (pEid->Len + 2);
 721                                 break;
 722 #endif // EXT_BUILD_CHANNEL_LIST //
 723 #endif // CONFIG_STA_SUPPORT //
 724
 725             default:
 726                 break;
 727         }
 728
 729         Length = Length + 2 + pEid->Len;  // Eid[1] + Len[1]+ content[Len]
 730         pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
 731     }
 732
 733     // For some 11a AP. it did not have the channel EID, patch here
 734 #ifdef CONFIG_STA_SUPPORT
 735         IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 736         {
 737                 UCHAR LatchRfChannel = MsgChannel;
 738                 if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0))
 739                 {
 740                         if (CtrlChannel != 0)
 741                                 *pChannel = CtrlChannel;
 742                         else
 743                                 *pChannel = LatchRfChannel;
 744                         Sanity |= 0x4;
 745                 }
 746         }
 747 #endif // CONFIG_STA_SUPPORT //
 748
 749         if (Sanity != 0x7)
 750         {
 751                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n", Sanity));
 752                 return FALSE;
 753         }
 754         else
 755         {
 756                 return TRUE;
 757         }
 758
 759 }
 760
 761 #ifdef DOT11N_DRAFT3
 762 /*
 763         ==========================================================================
 764         Description:
 765                 MLME message sanity check for some IE addressed  in 802.11n d3.03.
 766         Return:
 767                 TRUE if all parameters are OK, FALSE otherwise
 768
 769         IRQL = DISPATCH_LEVEL
 770
 771         ==========================================================================
 772  */
 773 BOOLEAN PeerBeaconAndProbeRspSanity2(
 774         IN PRTMP_ADAPTER pAd,
 775         IN VOID *Msg,
 776         IN ULONG MsgLen,
 777         OUT UCHAR       *RegClass)
 778 {
 779         CHAR                            *Ptr;
 780         PFRAME_802_11           pFrame;
 781         PEID_STRUCT                     pEid;
 782         ULONG                           Length = 0;
 783
 784         pFrame = (PFRAME_802_11)Msg;
 785
 786         *RegClass = 0;
 787         Ptr = pFrame->Octet;
 788         Length += LENGTH_802_11;
 789
 790         // get timestamp from payload and advance the pointer
 791         Ptr += TIMESTAMP_LEN;
 792         Length += TIMESTAMP_LEN;
 793
 794         // get beacon interval from payload and advance the pointer
 795         Ptr += 2;
 796         Length += 2;
 797
 798         // get capability info from payload and advance the pointer
 799         Ptr += 2;
 800         Length += 2;
 801
 802         pEid = (PEID_STRUCT) Ptr;
 803
 804         // get variable fields from payload and advance the pointer
 805         while ((Length + 2 + pEid->Len) <= MsgLen)
 806         {
 807                 switch(pEid->Eid)
 808                 {
 809                         case IE_SUPP_REG_CLASS:
 810                                 if(pEid->Len > 0)
 811                                 {
 812                                         *RegClass = *pEid->Octet;
 813                                 }
 814                                 else
 815                                 {
 816                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
 817                                         return FALSE;
 818                                 }
 819                                 break;
 820                 }
 821
 822                 Length = Length + 2 + pEid->Len;  // Eid[1] + Len[1]+ content[Len]
 823                 pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
 824         }
 825
 826         return TRUE;
 827
 828 }
 829 #endif // DOT11N_DRAFT3 //
 830
 831 /*
 832     ==========================================================================
 833     Description:
 834         MLME message sanity check
 835     Return:
 836         TRUE if all parameters are OK, FALSE otherwise
 837     ==========================================================================
 838  */
 839 BOOLEAN MlmeScanReqSanity(
 840         IN PRTMP_ADAPTER pAd,
 841         IN VOID *Msg,
 842         IN ULONG MsgLen,
 843         OUT UCHAR *pBssType,
 844         OUT CHAR Ssid[],
 845         OUT UCHAR *pSsidLen,
 846         OUT UCHAR *pScanType)
 847 {
 848         MLME_SCAN_REQ_STRUCT *Info;
 849
 850         Info = (MLME_SCAN_REQ_STRUCT *)(Msg);
 851         *pBssType = Info->BssType;
 852         *pSsidLen = Info->SsidLen;
 853         NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
 854         *pScanType = Info->ScanType;
 855
 856         if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC || *pBssType == BSS_ANY)
 857                 && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE
 858 #ifdef CONFIG_STA_SUPPORT
 859                 || *pScanType == SCAN_CISCO_PASSIVE || *pScanType == SCAN_CISCO_ACTIVE
 860                 || *pScanType == SCAN_CISCO_CHANNEL_LOAD || *pScanType == SCAN_CISCO_NOISE
 861 #endif // CONFIG_STA_SUPPORT //
 862                 ))
 863         {
 864                 return TRUE;
 865         }
 866         else
 867         {
 868                 DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
 869                 return FALSE;
 870         }
 871 }
 872
 873 // IRQL = DISPATCH_LEVEL
 874 UCHAR ChannelSanity(
 875     IN PRTMP_ADAPTER pAd,
 876     IN UCHAR channel)
 877 {
 878     int i;
 879
 880     for (i = 0; i < pAd->ChannelListNum; i ++)
 881     {
 882         if (channel == pAd->ChannelList[i].Channel)
 883             return 1;
 884     }
 885     return 0;
 886 }
 887
 888 /*
 889     ==========================================================================
 890     Description:
 891         MLME message sanity check
 892     Return:
 893         TRUE if all parameters are OK, FALSE otherwise
 894
 895         IRQL = DISPATCH_LEVEL
 896
 897     ==========================================================================
 898  */
 899 BOOLEAN PeerDeauthSanity(
 900     IN PRTMP_ADAPTER pAd,
 901     IN VOID *Msg,
 902     IN ULONG MsgLen,
 903     OUT PUCHAR pAddr2,
 904     OUT USHORT *pReason)
 905 {
 906     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
 907
 908     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 909     NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
 910
 911     return TRUE;
 912 }
 913
 914 /*
 915     ==========================================================================
 916     Description:
 917         MLME message sanity check
 918     Return:
 919         TRUE if all parameters are OK, FALSE otherwise
 920
 921         IRQL = DISPATCH_LEVEL
 922
 923     ==========================================================================
 924  */
 925 BOOLEAN PeerAuthSanity(
 926     IN PRTMP_ADAPTER pAd,
 927     IN VOID *Msg,
 928     IN ULONG MsgLen,
 929     OUT PUCHAR pAddr,
 930     OUT USHORT *pAlg,
 931     OUT USHORT *pSeq,
 932     OUT USHORT *pStatus,
 933     CHAR *pChlgText)
 934 {
 935     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
 936
 937     COPY_MAC_ADDR(pAddr,   pFrame->Hdr.Addr2);
 938     NdisMoveMemory(pAlg,    &pFrame->Octet[0], 2);
 939     NdisMoveMemory(pSeq,    &pFrame->Octet[2], 2);
 940     NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
 941
 942     if ((*pAlg == Ndis802_11AuthModeOpen)
 943 #ifdef LEAP_SUPPORT
 944       || (*pAlg == CISCO_AuthModeLEAP)
 945 #endif // LEAP_SUPPORT //
 946       )
 947     {
 948         if (*pSeq == 1 || *pSeq == 2)
 949         {
 950             return TRUE;
 951         }
 952         else
 953         {
 954             DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
 955             return FALSE;
 956         }
 957     }
 958     else if (*pAlg == Ndis802_11AuthModeShared)
 959     {
 960         if (*pSeq == 1 || *pSeq == 4)
 961         {
 962             return TRUE;
 963         }
 964         else if (*pSeq == 2 || *pSeq == 3)
 965         {
 966             NdisMoveMemory(pChlgText, &pFrame->Octet[8], CIPHER_TEXT_LEN);
 967             return TRUE;
 968         }
 969         else
 970         {
 971             DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
 972             return FALSE;
 973         }
 974     }
 975     else
 976     {
 977         DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong algorithm\n"));
 978         return FALSE;
 979     }
 980 }
 981
 982 /*
 983     ==========================================================================
 984     Description:
 985         MLME message sanity check
 986     Return:
 987         TRUE if all parameters are OK, FALSE otherwise
 988     ==========================================================================
 989  */
 990 BOOLEAN MlmeAuthReqSanity(
 991     IN PRTMP_ADAPTER pAd,
 992     IN VOID *Msg,
 993     IN ULONG MsgLen,
 994     OUT PUCHAR pAddr,
 995     OUT ULONG *pTimeout,
 996     OUT USHORT *pAlg)
 997 {
 998     MLME_AUTH_REQ_STRUCT *pInfo;
 999
1000     pInfo  = (MLME_AUTH_REQ_STRUCT *)Msg;
1001     COPY_MAC_ADDR(pAddr, pInfo->Addr);
1002     *pTimeout = pInfo->Timeout;
1003     *pAlg = pInfo->Alg;
1004
1005     if (((*pAlg == Ndis802_11AuthModeShared) ||(*pAlg == Ndis802_11AuthModeOpen)
1006 #ifdef LEAP_SUPPORT
1007      || (*pAlg == CISCO_AuthModeLEAP)
1008 #endif // LEAP_SUPPORT //
1009         ) &&
1010         ((*pAddr & 0x01) == 0))
1011     {
1012         return TRUE;
1013     }
1014     else
1015     {
1016         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAuthReqSanity fail - wrong algorithm\n"));
1017         return FALSE;
1018     }
1019 }
1020
1021 /*
1022     ==========================================================================
1023     Description:
1024         MLME message sanity check
1025     Return:
1026         TRUE if all parameters are OK, FALSE otherwise
1027
1028         IRQL = DISPATCH_LEVEL
1029
1030     ==========================================================================
1031  */
1032 BOOLEAN MlmeAssocReqSanity(
1033     IN PRTMP_ADAPTER pAd,
1034     IN VOID *Msg,
1035     IN ULONG MsgLen,
1036     OUT PUCHAR pApAddr,
1037     OUT USHORT *pCapabilityInfo,
1038     OUT ULONG *pTimeout,
1039     OUT USHORT *pListenIntv)
1040 {
1041     MLME_ASSOC_REQ_STRUCT *pInfo;
1042
1043     pInfo = (MLME_ASSOC_REQ_STRUCT *)Msg;
1044     *pTimeout = pInfo->Timeout;                             // timeout
1045     COPY_MAC_ADDR(pApAddr, pInfo->Addr);                   // AP address
1046     *pCapabilityInfo = pInfo->CapabilityInfo;               // capability info
1047     *pListenIntv = pInfo->ListenIntv;
1048
1049     return TRUE;
1050 }
1051
1052 /*
1053     ==========================================================================
1054     Description:
1055         MLME message sanity check
1056     Return:
1057         TRUE if all parameters are OK, FALSE otherwise
1058
1059         IRQL = DISPATCH_LEVEL
1060
1061     ==========================================================================
1062  */
1063 BOOLEAN PeerDisassocSanity(
1064     IN PRTMP_ADAPTER pAd,
1065     IN VOID *Msg,
1066     IN ULONG MsgLen,
1067     OUT PUCHAR pAddr2,
1068     OUT USHORT *pReason)
1069 {
1070     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
1071
1072     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
1073     NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
1074
1075     return TRUE;
1076 }
1077
1078 /*
1079         ========================================================================
1080         Routine Description:
1081                 Sanity check NetworkType (11b, 11g or 11a)
1082
1083         Arguments:
1084                 pBss - Pointer to BSS table.
1085
1086         Return Value:
1087         Ndis802_11DS .......(11b)
1088         Ndis802_11OFDM24....(11g)
1089         Ndis802_11OFDM5.....(11a)
1090
1091         IRQL = DISPATCH_LEVEL
1092
1093         ========================================================================
1094 */
1095 NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
1096     IN PBSS_ENTRY pBss)
1097 {
1098         NDIS_802_11_NETWORK_TYPE        NetWorkType;
1099         UCHAR                                           rate, i;
1100
1101         NetWorkType = Ndis802_11DS;
1102
1103         if (pBss->Channel <= 14)
1104         {
1105                 //
1106                 // First check support Rate.
1107                 //
1108                 for (i = 0; i < pBss->SupRateLen; i++)
1109                 {
1110                         rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1111                         if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1112                         {
1113                                 continue;
1114                         }
1115                         else
1116                         {
1117                                 //
1118                                 // Otherwise (even rate > 108) means Ndis802_11OFDM24
1119                                 //
1120                                 NetWorkType = Ndis802_11OFDM24;
1121                                 break;
1122                         }
1123                 }
1124
1125                 //
1126                 // Second check Extend Rate.
1127                 //
1128                 if (NetWorkType != Ndis802_11OFDM24)
1129                 {
1130                         for (i = 0; i < pBss->ExtRateLen; i++)
1131                         {
1132                                 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1133                                 if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1134                                 {
1135                                         continue;
1136                                 }
1137                                 else
1138                                 {
1139                                         //
1140                                         // Otherwise (even rate > 108) means Ndis802_11OFDM24
1141                                         //
1142                                         NetWorkType = Ndis802_11OFDM24;
1143                                         break;
1144                                 }
1145                         }
1146                 }
1147         }
1148         else
1149         {
1150                 NetWorkType = Ndis802_11OFDM5;
1151         }
1152
1153     if (pBss->HtCapabilityLen != 0)
1154     {
1155         if (NetWorkType == Ndis802_11OFDM5)
1156             NetWorkType = Ndis802_11OFDM5_N;
1157         else
1158             NetWorkType = Ndis802_11OFDM24_N;
1159     }
1160
1161         return NetWorkType;
1162 }
1163
1164 /*
1165     ==========================================================================
1166     Description:
1167         WPA message sanity check
1168     Return:
1169         TRUE if all parameters are OK, FALSE otherwise
1170     ==========================================================================
1171  */
1172 BOOLEAN PeerWpaMessageSanity(
1173     IN  PRTMP_ADAPTER           pAd,
1174     IN  PEAPOL_PACKET           pMsg,
1175     IN  ULONG                           MsgLen,
1176     IN  UCHAR                           MsgType,
1177     IN  MAC_TABLE_ENTRY         *pEntry)
1178 {
1179         UCHAR                   mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
1180         BOOLEAN                 bReplayDiff = FALSE;
1181         BOOLEAN                 bWPA2 = FALSE;
1182         KEY_INFO                EapolKeyInfo;
1183         UCHAR                   GroupKeyIndex = 0;
1184
1185
1186         NdisZeroMemory(mic, sizeof(mic));
1187         NdisZeroMemory(digest, sizeof(digest));
1188         NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
1189         NdisZeroMemory((PUCHAR)&EapolKeyInfo, sizeof(EapolKeyInfo));
1190
1191         NdisMoveMemory((PUCHAR)&EapolKeyInfo, (PUCHAR)&pMsg->KeyDesc.KeyInfo, sizeof(KEY_INFO));
1192
1193         *((USHORT *)&EapolKeyInfo) = cpu2le16(*((USHORT *)&EapolKeyInfo));
1194
1195         // Choose WPA2 or not
1196         if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
1197                 bWPA2 = TRUE;
1198
1199         // 0. Check MsgType
1200         if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1))
1201         {
1202                 DBGPRINT(RT_DEBUG_ERROR, ("The message type is invalid(%d)! \n", MsgType));
1203                 return FALSE;
1204         }
1205
1206         // 1. Replay counter check
1207         if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) // For supplicant
1208     {
1209         // First validate replay counter, only accept message with larger replay counter.
1210                 // Let equal pass, some AP start with all zero replay counter
1211                 UCHAR   ZeroReplay[LEN_KEY_DESC_REPLAY];
1212
1213         NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
1214                 if ((RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY) != 1) &&
1215                         (RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, ZeroReplay, LEN_KEY_DESC_REPLAY) != 0))
1216         {
1217                         bReplayDiff = TRUE;
1218         }
1219         }
1220         else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2)    // For authenticator
1221         {
1222                 // check Replay Counter coresponds to MSG from authenticator, otherwise discard
1223         if (!NdisEqualMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY))
1224         {
1225                         bReplayDiff = TRUE;
1226         }
1227         }
1228
1229         // Replay Counter different condition
1230         if (bReplayDiff)
1231         {
1232                 // send wireless event - for replay counter different
1233                 if (pAd->CommonCfg.bWirelessEvent)
1234                         RTMPSendWirelessEvent(pAd, IW_REPLAY_COUNTER_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1235
1236                 if (MsgType < EAPOL_GROUP_MSG_1)
1237                 {
1238                 DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1239                 }
1240                 else
1241                 {
1242                         DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1243                 }
1244
1245                 hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
1246                 hex_dump("Current replay counter ", pEntry->R_Counter, LEN_KEY_DESC_REPLAY);
1247         return FALSE;
1248         }
1249
1250         // 2. Verify MIC except Pairwise Msg1
1251         if (MsgType != EAPOL_PAIR_MSG_1)
1252         {
1253                 UCHAR                   rcvd_mic[LEN_KEY_DESC_MIC];
1254
1255                 // Record the received MIC for check later
1256                 NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1257                 NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1258
1259         if (pEntry->WepStatus == Ndis802_11Encryption2Enabled)  // TKIP
1260         {
1261             hmac_md5(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, mic);
1262         }
1263         else if (pEntry->WepStatus == Ndis802_11Encryption3Enabled)     // AES
1264         {
1265             HMAC_SHA1((PUCHAR)pMsg, MsgLen, pEntry->PTK, LEN_EAP_MICK, digest);
1266             NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
1267         }
1268
1269         if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC))
1270         {
1271                         // send wireless event - for MIC different
1272                         if (pAd->CommonCfg.bWirelessEvent)
1273                                 RTMPSendWirelessEvent(pAd, IW_MIC_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1274
1275                         if (MsgType < EAPOL_GROUP_MSG_1)
1276                         {
1277                 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1278                         }
1279                         else
1280                         {
1281                                 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1282                         }
1283
1284                         hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
1285                         hex_dump("Desired  MIC", mic, LEN_KEY_DESC_MIC);
1286
1287                         return FALSE;
1288         }
1289         }
1290
1291         // Extract the context of the Key Data field if it exist
1292         // The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is un-encrypted.
1293         // The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted.
1294         if (pMsg->KeyDesc.KeyDataLen[1] > 0)
1295         {
1296                 // Decrypt this field
1297                 if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2) || (MsgType == EAPOL_GROUP_MSG_1))
1298                 {
1299                         if(pEntry->WepStatus == Ndis802_11Encryption3Enabled)
1300                         {
1301                                 // AES
1302                                 AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA, pMsg->KeyDesc.KeyDataLen[1],pMsg->KeyDesc.KeyData);
1303                         }
1304                         else
1305                         {
1306                                 INT     i;
1307                                 UCHAR   Key[32];
1308                                 // Decrypt TKIP GTK
1309                                 // Construct 32 bytes RC4 Key
1310                                 NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
1311                                 NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
1312                                 ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, 32);
1313                                 //discard first 256 bytes
1314                                 for(i = 0; i < 256; i++)
1315                                         ARCFOUR_BYTE(&pAd->PrivateInfo.WEPCONTEXT);
1316                                 // Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
1317                                 ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, KEYDATA, pMsg->KeyDesc.KeyData, pMsg->KeyDesc.KeyDataLen[1]);
1318                         }
1319
1320                         if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
1321                                 GroupKeyIndex = EapolKeyInfo.KeyIndex;
1322
1323                 }
1324                 else if ((MsgType == EAPOL_PAIR_MSG_2) || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2))
1325                 {
1326                         NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData, pMsg->KeyDesc.KeyDataLen[1]);
1327                 }
1328                 else
1329                 {
1330
1331                         return TRUE;
1332                 }
1333
1334                 // Parse Key Data field to
1335                 // 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2)
1336                 // 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2
1337                 // 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2)
1338                 if (!RTMPParseEapolKeyData(pAd, KEYDATA, pMsg->KeyDesc.KeyDataLen[1], GroupKeyIndex, MsgType, bWPA2, pEntry))
1339                 {
1340                         return FALSE;
1341                 }
1342         }
1343
1344         return TRUE;
1345
1346 }