git.oblomov.eu Git - linux-2.6/blob - drivers/staging/rt3070/common/cmm_sanity.c

   1 /*
   2  *************************************************************************
   3  * Ralink Tech Inc.
   4  * 5F., No.36, Taiyuan St., Jhubei City,
   5  * Hsinchu County 302,
   6  * Taiwan, R.O.C.
   7  *
   8  * (c) Copyright 2002-2007, Ralink Technology, Inc.
   9  *
  10  * This program is free software; you can redistribute it and/or modify  *
  11  * it under the terms of the GNU General Public License as published by  *
  12  * the Free Software Foundation; either version 2 of the License, or     *
  13  * (at your option) any later version.                                   *
  14  *                                                                       *
  15  * This program is distributed in the hope that it will be useful,       *
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  18  * GNU General Public License for more details.                          *
  19  *                                                                       *
  20  * You should have received a copy of the GNU General Public License     *
  21  * along with this program; if not, write to the                         *
  22  * Free Software Foundation, Inc.,                                       *
  23  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  24  *                                                                       *
  25  *************************************************************************
  26
  27         Module Name:
  28         sanity.c
  29
  30         Abstract:
  31
  32         Revision History:
  33         Who                     When                    What
  34         --------        ----------              ----------------------------------------------
  35         John Chang  2004-09-01      add WMM support
  36 */
  37 #include "../rt_config.h"
  38
  39
  40 extern UCHAR    CISCO_OUI[];
  41
  42 extern UCHAR    WPA_OUI[];
  43 extern UCHAR    RSN_OUI[];
  44 extern UCHAR    WME_INFO_ELEM[];
  45 extern UCHAR    WME_PARM_ELEM[];
  46 extern UCHAR    Ccx2QosInfo[];
  47 extern UCHAR    RALINK_OUI[];
  48 extern UCHAR    BROADCOM_OUI[];
  49 extern UCHAR    WPS_OUI[];
  50
  51 /*
  52     ==========================================================================
  53     Description:
  54         MLME message sanity check
  55     Return:
  56         TRUE if all parameters are OK, FALSE otherwise
  57
  58         IRQL = DISPATCH_LEVEL
  59
  60     ==========================================================================
  61  */
  62 BOOLEAN MlmeAddBAReqSanity(
  63     IN PRTMP_ADAPTER pAd,
  64     IN VOID *Msg,
  65     IN ULONG MsgLen,
  66     OUT PUCHAR pAddr2)
  67 {
  68     PMLME_ADDBA_REQ_STRUCT   pInfo;
  69
  70     pInfo = (MLME_ADDBA_REQ_STRUCT *)Msg;
  71
  72     if ((MsgLen != sizeof(MLME_ADDBA_REQ_STRUCT)))
  73     {
  74         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
  75         return FALSE;
  76     }
  77
  78     if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
  79     {
  80         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
  81         return FALSE;
  82     }
  83
  84         /*
  85     if ((pInfo->BaBufSize > MAX_RX_REORDERBUF) || (pInfo->BaBufSize < 2))
  86     {
  87         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - Rx Reordering buffer too big or too small\n"));
  88         return FALSE;
  89     }
  90         */
  91
  92     if ((pInfo->pAddr[0]&0x01) == 0x01)
  93     {
  94         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
  95         return FALSE;
  96     }
  97
  98     return TRUE;
  99 }
 100
 101 /*
 102     ==========================================================================
 103     Description:
 104         MLME message sanity check
 105     Return:
 106         TRUE if all parameters are OK, FALSE otherwise
 107
 108         IRQL = DISPATCH_LEVEL
 109
 110     ==========================================================================
 111  */
 112 BOOLEAN MlmeDelBAReqSanity(
 113     IN PRTMP_ADAPTER pAd,
 114     IN VOID *Msg,
 115     IN ULONG MsgLen)
 116 {
 117         MLME_DELBA_REQ_STRUCT *pInfo;
 118         pInfo = (MLME_DELBA_REQ_STRUCT *)Msg;
 119
 120     if ((MsgLen != sizeof(MLME_DELBA_REQ_STRUCT)))
 121     {
 122         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
 123         return FALSE;
 124     }
 125
 126     if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
 127     {
 128         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
 129         return FALSE;
 130     }
 131
 132     if ((pInfo->TID & 0xf0))
 133     {
 134         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
 135         return FALSE;
 136     }
 137
 138         if (NdisEqualMemory(pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr, MAC_ADDR_LEN) == 0)
 139     {
 140         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
 141         return FALSE;
 142     }
 143
 144     return TRUE;
 145 }
 146
 147 BOOLEAN PeerAddBAReqActionSanity(
 148     IN PRTMP_ADAPTER pAd,
 149     IN VOID *pMsg,
 150     IN ULONG MsgLen,
 151         OUT PUCHAR pAddr2)
 152 {
 153         PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 154         PFRAME_ADDBA_REQ pAddFrame;
 155         pAddFrame = (PFRAME_ADDBA_REQ)(pMsg);
 156         if (MsgLen < (sizeof(FRAME_ADDBA_REQ)))
 157         {
 158                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n", MsgLen));
 159                 return FALSE;
 160         }
 161         // we support immediate BA.
 162         *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
 163         pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 164         pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
 165
 166         if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
 167         {
 168                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
 169                 DBGPRINT(RT_DEBUG_ERROR,("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n", pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize, pAddFrame->BaParm.AMSDUSupported));
 170                 return FALSE;
 171         }
 172
 173         // we support immediate BA.
 174         if (pAddFrame->BaParm.TID &0xfff0)
 175         {
 176                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n", pAddFrame->BaParm.TID));
 177                 return FALSE;
 178         }
 179         COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 180         return TRUE;
 181 }
 182
 183 BOOLEAN PeerAddBARspActionSanity(
 184     IN PRTMP_ADAPTER pAd,
 185     IN VOID *pMsg,
 186     IN ULONG MsgLen)
 187 {
 188         //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 189         PFRAME_ADDBA_RSP pAddFrame;
 190
 191         pAddFrame = (PFRAME_ADDBA_RSP)(pMsg);
 192         if (MsgLen < (sizeof(FRAME_ADDBA_RSP)))
 193         {
 194                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n", MsgLen));
 195                 return FALSE;
 196         }
 197         // we support immediate BA.
 198         *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
 199         pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
 200         pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 201
 202         if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
 203         {
 204                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
 205                 return FALSE;
 206         }
 207
 208         // we support immediate BA.
 209         if (pAddFrame->BaParm.TID &0xfff0)
 210         {
 211                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n", pAddFrame->BaParm.TID));
 212                 return FALSE;
 213         }
 214         return TRUE;
 215
 216 }
 217
 218 BOOLEAN PeerDelBAActionSanity(
 219     IN PRTMP_ADAPTER pAd,
 220     IN UCHAR Wcid,
 221     IN VOID *pMsg,
 222     IN ULONG MsgLen )
 223 {
 224         //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 225         PFRAME_DELBA_REQ  pDelFrame;
 226         if (MsgLen != (sizeof(FRAME_DELBA_REQ)))
 227                 return FALSE;
 228
 229         if (Wcid >= MAX_LEN_OF_MAC_TABLE)
 230                 return FALSE;
 231
 232         pDelFrame = (PFRAME_DELBA_REQ)(pMsg);
 233
 234         *(USHORT *)(&pDelFrame->DelbaParm) = cpu2le16(*(USHORT *)(&pDelFrame->DelbaParm));
 235         pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
 236
 237         if (pDelFrame->DelbaParm.TID &0xfff0)
 238                 return FALSE;
 239
 240         return TRUE;
 241 }
 242
 243 /*
 244     ==========================================================================
 245     Description:
 246         MLME message sanity check
 247     Return:
 248         TRUE if all parameters are OK, FALSE otherwise
 249
 250         IRQL = DISPATCH_LEVEL
 251
 252     ==========================================================================
 253  */
 254 BOOLEAN PeerBeaconAndProbeRspSanity(
 255     IN PRTMP_ADAPTER pAd,
 256     IN VOID *Msg,
 257     IN ULONG MsgLen,
 258     IN UCHAR  MsgChannel,
 259     OUT PUCHAR pAddr2,
 260     OUT PUCHAR pBssid,
 261     OUT CHAR Ssid[],
 262     OUT UCHAR *pSsidLen,
 263     OUT UCHAR *pBssType,
 264     OUT USHORT *pBeaconPeriod,
 265     OUT UCHAR *pChannel,
 266     OUT UCHAR *pNewChannel,
 267     OUT LARGE_INTEGER *pTimestamp,
 268     OUT CF_PARM *pCfParm,
 269     OUT USHORT *pAtimWin,
 270     OUT USHORT *pCapabilityInfo,
 271     OUT UCHAR *pErp,
 272     OUT UCHAR *pDtimCount,
 273     OUT UCHAR *pDtimPeriod,
 274     OUT UCHAR *pBcastFlag,
 275     OUT UCHAR *pMessageToMe,
 276     OUT UCHAR SupRate[],
 277     OUT UCHAR *pSupRateLen,
 278     OUT UCHAR ExtRate[],
 279     OUT UCHAR *pExtRateLen,
 280     OUT UCHAR *pCkipFlag,
 281     OUT UCHAR *pAironetCellPowerLimit,
 282     OUT PEDCA_PARM       pEdcaParm,
 283     OUT PQBSS_LOAD_PARM  pQbssLoad,
 284     OUT PQOS_CAPABILITY_PARM pQosCapability,
 285     OUT ULONG *pRalinkIe,
 286     OUT UCHAR            *pHtCapabilityLen,
 287     OUT UCHAR            *pPreNHtCapabilityLen,
 288     OUT HT_CAPABILITY_IE *pHtCapability,
 289         OUT UCHAR                *AddHtInfoLen,
 290         OUT ADD_HT_INFO_IE *AddHtInfo,
 291         OUT UCHAR *NewExtChannelOffset,         // Ht extension channel offset(above or below)
 292     OUT USHORT *LengthVIE,
 293     OUT PNDIS_802_11_VARIABLE_IEs pVIE)
 294 {
 295     CHAR                                *Ptr;
 296         CHAR                            TimLen;
 297     PFRAME_802_11               pFrame;
 298     PEID_STRUCT         pEid;
 299     UCHAR                               SubType;
 300     UCHAR                               Sanity;
 301     //UCHAR                             ECWMin, ECWMax;
 302     //MAC_CSR9_STRUC            Csr9;
 303     ULONG                               Length = 0;
 304
 305         // For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel
 306         //      1. If the AP is 11n enabled, then check the control channel.
 307         //      2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!!)
 308         UCHAR                   CtrlChannel = 0;
 309
 310     // Add for 3 necessary EID field check
 311     Sanity = 0;
 312
 313     *pAtimWin = 0;
 314     *pErp = 0;
 315     *pDtimCount = 0;
 316     *pDtimPeriod = 0;
 317     *pBcastFlag = 0;
 318     *pMessageToMe = 0;
 319     *pExtRateLen = 0;
 320     *pCkipFlag = 0;                             // Default of CkipFlag is 0
 321     *pAironetCellPowerLimit = 0xFF;  // Default of AironetCellPowerLimit is 0xFF
 322     *LengthVIE = 0;                                     // Set the length of VIE to init value 0
 323     *pHtCapabilityLen = 0;                                      // Set the length of VIE to init value 0
 324         if (pAd->OpMode == OPMODE_STA)
 325                 *pPreNHtCapabilityLen = 0;                                      // Set the length of VIE to init value 0
 326     *AddHtInfoLen = 0;                                  // Set the length of VIE to init value 0
 327     *pRalinkIe = 0;
 328     *pNewChannel = 0;
 329     *NewExtChannelOffset = 0xff;        //Default 0xff means no such IE
 330     pCfParm->bValid = FALSE;        // default: no IE_CF found
 331     pQbssLoad->bValid = FALSE;      // default: no IE_QBSS_LOAD found
 332     pEdcaParm->bValid = FALSE;      // default: no IE_EDCA_PARAMETER found
 333     pQosCapability->bValid = FALSE; // default: no IE_QOS_CAPABILITY found
 334
 335     pFrame = (PFRAME_802_11)Msg;
 336
 337     // get subtype from header
 338     SubType = (UCHAR)pFrame->Hdr.FC.SubType;
 339
 340     // get Addr2 and BSSID from header
 341     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 342     COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
 343
 344 //      hex_dump("Beacon", Msg, MsgLen);
 345
 346     Ptr = pFrame->Octet;
 347     Length += LENGTH_802_11;
 348
 349     // get timestamp from payload and advance the pointer
 350     NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
 351
 352         pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
 353         pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
 354
 355     Ptr += TIMESTAMP_LEN;
 356     Length += TIMESTAMP_LEN;
 357
 358     // get beacon interval from payload and advance the pointer
 359     NdisMoveMemory(pBeaconPeriod, Ptr, 2);
 360     Ptr += 2;
 361     Length += 2;
 362
 363     // get capability info from payload and advance the pointer
 364     NdisMoveMemory(pCapabilityInfo, Ptr, 2);
 365     Ptr += 2;
 366     Length += 2;
 367
 368     if (CAP_IS_ESS_ON(*pCapabilityInfo))
 369         *pBssType = BSS_INFRA;
 370     else
 371         *pBssType = BSS_ADHOC;
 372
 373     pEid = (PEID_STRUCT) Ptr;
 374
 375     // get variable fields from payload and advance the pointer
 376     while ((Length + 2 + pEid->Len) <= MsgLen)
 377     {
 378         //
 379         // Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow.
 380         //
 381         if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN)
 382         {
 383             DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
 384                     (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
 385             break;
 386         }
 387
 388         switch(pEid->Eid)
 389         {
 390             case IE_SSID:
 391                 // Already has one SSID EID in this beacon, ignore the second one
 392                 if (Sanity & 0x1)
 393                     break;
 394                 if(pEid->Len <= MAX_LEN_OF_SSID)
 395                 {
 396                     NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
 397                     *pSsidLen = pEid->Len;
 398                     Sanity |= 0x1;
 399                 }
 400                 else
 401                 {
 402                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
 403                     return FALSE;
 404                 }
 405                 break;
 406
 407             case IE_SUPP_RATES:
 408                 if(pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
 409                 {
 410                     Sanity |= 0x2;
 411                     NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
 412                     *pSupRateLen = pEid->Len;
 413
 414                     // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
 415                     // from ScanTab. We should report as is. And filter out unsupported
 416                     // rates in MlmeAux.
 417                     // Check against the supported rates
 418                     // RTMPCheckRates(pAd, SupRate, pSupRateLen);
 419                 }
 420                 else
 421                 {
 422                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",pEid->Len));
 423                     return FALSE;
 424                 }
 425                 break;
 426
 427             case IE_HT_CAP:
 428                         if (pEid->Len >= SIZE_HT_CAP_IE)  //Note: allow extension.!!
 429                         {
 430                                 NdisMoveMemory(pHtCapability, pEid->Octet, sizeof(HT_CAPABILITY_IE));
 431                                 *pHtCapabilityLen = SIZE_HT_CAP_IE;     // Nnow we only support 26 bytes.
 432
 433                                 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
 434                                 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
 435
 436                                 {
 437                                         *pPreNHtCapabilityLen = 0;      // Nnow we only support 26 bytes.
 438
 439                                         Ptr = (PUCHAR) pVIE;
 440                                         NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 441                                         *LengthVIE += (pEid->Len + 2);
 442                                 }
 443                         }
 444                         else
 445                         {
 446                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n", pEid->Len));
 447                         }
 448
 449                 break;
 450             case IE_ADD_HT:
 451                         if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
 452                         {
 453                                 // This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
 454                                 // copy first sizeof(ADD_HT_INFO_IE)
 455                                 NdisMoveMemory(AddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
 456                                 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 457
 458                                 CtrlChannel = AddHtInfo->ControlChan;
 459
 460                                 *(USHORT *)(&AddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo2));
 461                                 *(USHORT *)(&AddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo3));
 462
 463                                 {
 464                                         Ptr = (PUCHAR) pVIE;
 465                                         NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 466                                         *LengthVIE += (pEid->Len + 2);
 467                                 }
 468                         }
 469                         else
 470                         {
 471                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
 472                         }
 473
 474                 break;
 475             case IE_SECONDARY_CH_OFFSET:
 476                         if (pEid->Len == 1)
 477                         {
 478                                 *NewExtChannelOffset = pEid->Octet[0];
 479                         }
 480                         else
 481                         {
 482                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
 483                         }
 484
 485                 break;
 486             case IE_FH_PARM:
 487                 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
 488                 break;
 489
 490             case IE_DS_PARM:
 491                 if(pEid->Len == 1)
 492                 {
 493                     *pChannel = *pEid->Octet;
 494
 495                                         {
 496                                                 if (ChannelSanity(pAd, *pChannel) == 0)
 497                                                 {
 498
 499                                                         return FALSE;
 500                                                 }
 501                                         }
 502
 503                     Sanity |= 0x4;
 504                 }
 505                 else
 506                 {
 507                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",pEid->Len));
 508                     return FALSE;
 509                 }
 510                 break;
 511
 512             case IE_CF_PARM:
 513                 if(pEid->Len == 6)
 514                 {
 515                     pCfParm->bValid = TRUE;
 516                     pCfParm->CfpCount = pEid->Octet[0];
 517                     pCfParm->CfpPeriod = pEid->Octet[1];
 518                     pCfParm->CfpMaxDuration = pEid->Octet[2] + 256 * pEid->Octet[3];
 519                     pCfParm->CfpDurRemaining = pEid->Octet[4] + 256 * pEid->Octet[5];
 520                 }
 521                 else
 522                 {
 523                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
 524                     return FALSE;
 525                 }
 526                 break;
 527
 528             case IE_IBSS_PARM:
 529                 if(pEid->Len == 2)
 530                 {
 531                     NdisMoveMemory(pAtimWin, pEid->Octet, pEid->Len);
 532                 }
 533                 else
 534                 {
 535                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
 536                     return FALSE;
 537                 }
 538                 break;
 539
 540             case IE_TIM:
 541                 if(INFRA_ON(pAd) && SubType == SUBTYPE_BEACON)
 542                 {
 543                     GetTimBit((PUCHAR)pEid, pAd->StaActive.Aid, &TimLen, pBcastFlag, pDtimCount, pDtimPeriod, pMessageToMe);
 544                 }
 545                 break;
 546
 547             case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
 548                 if(pEid->Len == 3)
 549                 {
 550                         *pNewChannel = pEid->Octet[1];  //extract new channel number
 551                 }
 552                 break;
 553
 554             // New for WPA
 555             // CCX v2 has the same IE, we need to parse that too
 556             // Wifi WMM use the same IE vale, need to parse that too
 557             // case IE_WPA:
 558             case IE_VENDOR_SPECIFIC:
 559                 // Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE.
 560                 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
 561                 /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
 562                 {
 563                         if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
 564                         {
 565                                 {
 566                                         NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
 567                                         *pHtCapabilityLen = SIZE_HT_CAP_IE;     // Nnow we only support 26 bytes.
 568                                 }
 569                         }
 570                         if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
 571                         {
 572                                 {
 573                                         NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
 574                                         *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;    // Nnow we only support 26 bytes.
 575                                 }
 576                         }
 577                 }
 578                                 */
 579                 // Check the OUI version, filter out non-standard usage
 580                 if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3) && (pEid->Len == 7))
 581                 {
 582                     //*pRalinkIe = pEid->Octet[3];
 583                     if (pEid->Octet[3] != 0)
 584                                         *pRalinkIe = pEid->Octet[3];
 585                                 else
 586                                         *pRalinkIe = 0xf0000000; // Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag.
 587                 }
 588                 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
 589
 590                 // Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP,
 591                 // Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE
 592                 else if ((*pHtCapabilityLen == 0) && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI, 3) && (pEid->Len >= 4) && (pAd->OpMode == OPMODE_STA))
 593                 {
 594                     if ((pEid->Octet[3] == OUI_PREN_HT_CAP) && (pEid->Len >= 30) && (*pHtCapabilityLen == 0))
 595                     {
 596                         NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
 597                         *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
 598                     }
 599
 600                     if ((pEid->Octet[3] == OUI_PREN_ADD_HT) && (pEid->Len >= 26))
 601                     {
 602                         NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
 603                         *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 604                     }
 605                 }
 606                 else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
 607                 {
 608                     // Copy to pVIE which will report to microsoft bssid list.
 609                     Ptr = (PUCHAR) pVIE;
 610                     NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 611                     *LengthVIE += (pEid->Len + 2);
 612                 }
 613                 else if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
 614                 {
 615                     PUCHAR ptr;
 616                     int i;
 617
 618                     // parsing EDCA parameters
 619                     pEdcaParm->bValid          = TRUE;
 620                     pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
 621                     pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
 622                     pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
 623                     pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
 624                     pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
 625                     ptr = &pEid->Octet[8];
 626                     for (i=0; i<4; i++)
 627                     {
 628                         UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
 629                         pEdcaParm->bACM[aci]  = (((*ptr) & 0x10) == 0x10);   // b5 is ACM
 630                         pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;               // b0~3 is AIFSN
 631                         pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f;             // b0~4 is Cwmin
 632                         pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4;               // b5~8 is Cwmax
 633                         pEdcaParm->Txop[aci]  = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
 634                         ptr += 4; // point to next AC
 635                     }
 636                 }
 637                 else if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6) && (pEid->Len == 7))
 638                 {
 639                     // parsing EDCA parameters
 640                     pEdcaParm->bValid          = TRUE;
 641                     pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
 642                     pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
 643                     pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
 644                     pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
 645                     pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
 646
 647                     // use default EDCA parameter
 648                     pEdcaParm->bACM[QID_AC_BE]  = 0;
 649                     pEdcaParm->Aifsn[QID_AC_BE] = 3;
 650                     pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
 651                     pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
 652                     pEdcaParm->Txop[QID_AC_BE]  = 0;
 653
 654                     pEdcaParm->bACM[QID_AC_BK]  = 0;
 655                     pEdcaParm->Aifsn[QID_AC_BK] = 7;
 656                     pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
 657                     pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
 658                     pEdcaParm->Txop[QID_AC_BK]  = 0;
 659
 660                     pEdcaParm->bACM[QID_AC_VI]  = 0;
 661                     pEdcaParm->Aifsn[QID_AC_VI] = 2;
 662                     pEdcaParm->Cwmin[QID_AC_VI] = CW_MIN_IN_BITS-1;
 663                     pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
 664                     pEdcaParm->Txop[QID_AC_VI]  = 96;   // AC_VI: 96*32us ~= 3ms
 665
 666                     pEdcaParm->bACM[QID_AC_VO]  = 0;
 667                     pEdcaParm->Aifsn[QID_AC_VO] = 2;
 668                     pEdcaParm->Cwmin[QID_AC_VO] = CW_MIN_IN_BITS-2;
 669                     pEdcaParm->Cwmax[QID_AC_VO] = CW_MAX_IN_BITS-1;
 670                     pEdcaParm->Txop[QID_AC_VO]  = 48;   // AC_VO: 48*32us ~= 1.5ms
 671                 }
 672                 else
 673                 {
 674                 }
 675
 676                 break;
 677
 678             case IE_EXT_SUPP_RATES:
 679                 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
 680                 {
 681                     NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
 682                     *pExtRateLen = pEid->Len;
 683
 684                     // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
 685                     // from ScanTab. We should report as is. And filter out unsupported
 686                     // rates in MlmeAux.
 687                     // Check against the supported rates
 688                     // RTMPCheckRates(pAd, ExtRate, pExtRateLen);
 689                 }
 690                 break;
 691
 692             case IE_ERP:
 693                 if (pEid->Len == 1)
 694                 {
 695                     *pErp = (UCHAR)pEid->Octet[0];
 696                 }
 697                 break;
 698
 699             case IE_AIRONET_CKIP:
 700                 // 0. Check Aironet IE length, it must be larger or equal to 28
 701                 // Cisco AP350 used length as 28
 702                 // Cisco AP12XX used length as 30
 703                 if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
 704                     break;
 705
 706                 // 1. Copy CKIP flag byte to buffer for process
 707                 *pCkipFlag = *(pEid->Octet + 8);
 708                 break;
 709
 710             case IE_AP_TX_POWER:
 711                 // AP Control of Client Transmit Power
 712                 //0. Check Aironet IE length, it must be 6
 713                 if (pEid->Len != 0x06)
 714                     break;
 715
 716                 // Get cell power limit in dBm
 717                 if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
 718                     *pAironetCellPowerLimit = *(pEid->Octet + 4);
 719                 break;
 720
 721             // WPA2 & 802.11i RSN
 722             case IE_RSN:
 723                 // There is no OUI for version anymore, check the group cipher OUI before copying
 724                 if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
 725                 {
 726                     // Copy to pVIE which will report to microsoft bssid list.
 727                     Ptr = (PUCHAR) pVIE;
 728                     NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 729                     *LengthVIE += (pEid->Len + 2);
 730                 }
 731                 break;
 732
 733             default:
 734                 break;
 735         }
 736
 737         Length = Length + 2 + pEid->Len;  // Eid[1] + Len[1]+ content[Len]
 738         pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
 739     }
 740
 741     // For some 11a AP. it did not have the channel EID, patch here
 742         {
 743                 UCHAR LatchRfChannel = MsgChannel;
 744                 if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0))
 745                 {
 746                         if (CtrlChannel != 0)
 747                                 *pChannel = CtrlChannel;
 748                         else
 749                                 *pChannel = LatchRfChannel;
 750                         Sanity |= 0x4;
 751                 }
 752         }
 753
 754         if (Sanity != 0x7)
 755         {
 756                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n", Sanity));
 757                 return FALSE;
 758         }
 759         else
 760         {
 761                 return TRUE;
 762         }
 763
 764 }
 765
 766 /*
 767     ==========================================================================
 768     Description:
 769         MLME message sanity check
 770     Return:
 771         TRUE if all parameters are OK, FALSE otherwise
 772     ==========================================================================
 773  */
 774 BOOLEAN MlmeScanReqSanity(
 775         IN PRTMP_ADAPTER pAd,
 776         IN VOID *Msg,
 777         IN ULONG MsgLen,
 778         OUT UCHAR *pBssType,
 779         OUT CHAR Ssid[],
 780         OUT UCHAR *pSsidLen,
 781         OUT UCHAR *pScanType)
 782 {
 783         MLME_SCAN_REQ_STRUCT *Info;
 784
 785         Info = (MLME_SCAN_REQ_STRUCT *)(Msg);
 786         *pBssType = Info->BssType;
 787         *pSsidLen = Info->SsidLen;
 788         NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
 789         *pScanType = Info->ScanType;
 790
 791         if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC || *pBssType == BSS_ANY)
 792                 && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE
 793                 || *pScanType == SCAN_CISCO_PASSIVE || *pScanType == SCAN_CISCO_ACTIVE
 794                 || *pScanType == SCAN_CISCO_CHANNEL_LOAD || *pScanType == SCAN_CISCO_NOISE
 795                 ))
 796         {
 797                 return TRUE;
 798         }
 799         else
 800         {
 801                 DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
 802                 return FALSE;
 803         }
 804 }
 805
 806 // IRQL = DISPATCH_LEVEL
 807 UCHAR ChannelSanity(
 808     IN PRTMP_ADAPTER pAd,
 809     IN UCHAR channel)
 810 {
 811     int i;
 812
 813     for (i = 0; i < pAd->ChannelListNum; i ++)
 814     {
 815         if (channel == pAd->ChannelList[i].Channel)
 816             return 1;
 817     }
 818     return 0;
 819 }
 820
 821 /*
 822     ==========================================================================
 823     Description:
 824         MLME message sanity check
 825     Return:
 826         TRUE if all parameters are OK, FALSE otherwise
 827
 828         IRQL = DISPATCH_LEVEL
 829
 830     ==========================================================================
 831  */
 832 BOOLEAN PeerDeauthSanity(
 833     IN PRTMP_ADAPTER pAd,
 834     IN VOID *Msg,
 835     IN ULONG MsgLen,
 836     OUT PUCHAR pAddr2,
 837     OUT USHORT *pReason)
 838 {
 839     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
 840
 841     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 842     NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
 843
 844     return TRUE;
 845 }
 846
 847 /*
 848     ==========================================================================
 849     Description:
 850         MLME message sanity check
 851     Return:
 852         TRUE if all parameters are OK, FALSE otherwise
 853
 854         IRQL = DISPATCH_LEVEL
 855
 856     ==========================================================================
 857  */
 858 BOOLEAN PeerAuthSanity(
 859     IN PRTMP_ADAPTER pAd,
 860     IN VOID *Msg,
 861     IN ULONG MsgLen,
 862     OUT PUCHAR pAddr,
 863     OUT USHORT *pAlg,
 864     OUT USHORT *pSeq,
 865     OUT USHORT *pStatus,
 866     CHAR *pChlgText)
 867 {
 868     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
 869
 870     COPY_MAC_ADDR(pAddr,   pFrame->Hdr.Addr2);
 871     NdisMoveMemory(pAlg,    &pFrame->Octet[0], 2);
 872     NdisMoveMemory(pSeq,    &pFrame->Octet[2], 2);
 873     NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
 874
 875     if ((*pAlg == Ndis802_11AuthModeOpen)
 876       )
 877     {
 878         if (*pSeq == 1 || *pSeq == 2)
 879         {
 880             return TRUE;
 881         }
 882         else
 883         {
 884             DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
 885             return FALSE;
 886         }
 887     }
 888     else if (*pAlg == Ndis802_11AuthModeShared)
 889     {
 890         if (*pSeq == 1 || *pSeq == 4)
 891         {
 892             return TRUE;
 893         }
 894         else if (*pSeq == 2 || *pSeq == 3)
 895         {
 896             NdisMoveMemory(pChlgText, &pFrame->Octet[8], CIPHER_TEXT_LEN);
 897             return TRUE;
 898         }
 899         else
 900         {
 901             DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
 902             return FALSE;
 903         }
 904     }
 905     else
 906     {
 907         DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong algorithm\n"));
 908         return FALSE;
 909     }
 910 }
 911
 912 /*
 913     ==========================================================================
 914     Description:
 915         MLME message sanity check
 916     Return:
 917         TRUE if all parameters are OK, FALSE otherwise
 918     ==========================================================================
 919  */
 920 BOOLEAN MlmeAuthReqSanity(
 921     IN PRTMP_ADAPTER pAd,
 922     IN VOID *Msg,
 923     IN ULONG MsgLen,
 924     OUT PUCHAR pAddr,
 925     OUT ULONG *pTimeout,
 926     OUT USHORT *pAlg)
 927 {
 928     MLME_AUTH_REQ_STRUCT *pInfo;
 929
 930     pInfo  = (MLME_AUTH_REQ_STRUCT *)Msg;
 931     COPY_MAC_ADDR(pAddr, pInfo->Addr);
 932     *pTimeout = pInfo->Timeout;
 933     *pAlg = pInfo->Alg;
 934
 935     if (((*pAlg == Ndis802_11AuthModeShared) ||(*pAlg == Ndis802_11AuthModeOpen)
 936         ) &&
 937         ((*pAddr & 0x01) == 0))
 938     {
 939         return TRUE;
 940     }
 941     else
 942     {
 943         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAuthReqSanity fail - wrong algorithm\n"));
 944         return FALSE;
 945     }
 946 }
 947
 948 /*
 949     ==========================================================================
 950     Description:
 951         MLME message sanity check
 952     Return:
 953         TRUE if all parameters are OK, FALSE otherwise
 954
 955         IRQL = DISPATCH_LEVEL
 956
 957     ==========================================================================
 958  */
 959 BOOLEAN MlmeAssocReqSanity(
 960     IN PRTMP_ADAPTER pAd,
 961     IN VOID *Msg,
 962     IN ULONG MsgLen,
 963     OUT PUCHAR pApAddr,
 964     OUT USHORT *pCapabilityInfo,
 965     OUT ULONG *pTimeout,
 966     OUT USHORT *pListenIntv)
 967 {
 968     MLME_ASSOC_REQ_STRUCT *pInfo;
 969
 970     pInfo = (MLME_ASSOC_REQ_STRUCT *)Msg;
 971     *pTimeout = pInfo->Timeout;                             // timeout
 972     COPY_MAC_ADDR(pApAddr, pInfo->Addr);                   // AP address
 973     *pCapabilityInfo = pInfo->CapabilityInfo;               // capability info
 974     *pListenIntv = pInfo->ListenIntv;
 975
 976     return TRUE;
 977 }
 978
 979 /*
 980     ==========================================================================
 981     Description:
 982         MLME message sanity check
 983     Return:
 984         TRUE if all parameters are OK, FALSE otherwise
 985
 986         IRQL = DISPATCH_LEVEL
 987
 988     ==========================================================================
 989  */
 990 BOOLEAN PeerDisassocSanity(
 991     IN PRTMP_ADAPTER pAd,
 992     IN VOID *Msg,
 993     IN ULONG MsgLen,
 994     OUT PUCHAR pAddr2,
 995     OUT USHORT *pReason)
 996 {
 997     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
 998
 999     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
1000     NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
1001
1002     return TRUE;
1003 }
1004
1005 /*
1006         ========================================================================
1007         Routine Description:
1008                 Sanity check NetworkType (11b, 11g or 11a)
1009
1010         Arguments:
1011                 pBss - Pointer to BSS table.
1012
1013         Return Value:
1014         Ndis802_11DS .......(11b)
1015         Ndis802_11OFDM24....(11g)
1016         Ndis802_11OFDM5.....(11a)
1017
1018         IRQL = DISPATCH_LEVEL
1019
1020         ========================================================================
1021 */
1022 NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
1023     IN PBSS_ENTRY pBss)
1024 {
1025         NDIS_802_11_NETWORK_TYPE        NetWorkType;
1026         UCHAR                                           rate, i;
1027
1028         NetWorkType = Ndis802_11DS;
1029
1030         if (pBss->Channel <= 14)
1031         {
1032                 //
1033                 // First check support Rate.
1034                 //
1035                 for (i = 0; i < pBss->SupRateLen; i++)
1036                 {
1037                         rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1038                         if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1039                         {
1040                                 continue;
1041                         }
1042                         else
1043                         {
1044                                 //
1045                                 // Otherwise (even rate > 108) means Ndis802_11OFDM24
1046                                 //
1047                                 NetWorkType = Ndis802_11OFDM24;
1048                                 break;
1049                         }
1050                 }
1051
1052                 //
1053                 // Second check Extend Rate.
1054                 //
1055                 if (NetWorkType != Ndis802_11OFDM24)
1056                 {
1057                         for (i = 0; i < pBss->ExtRateLen; i++)
1058                         {
1059                                 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1060                                 if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1061                                 {
1062                                         continue;
1063                                 }
1064                                 else
1065                                 {
1066                                         //
1067                                         // Otherwise (even rate > 108) means Ndis802_11OFDM24
1068                                         //
1069                                         NetWorkType = Ndis802_11OFDM24;
1070                                         break;
1071                                 }
1072                         }
1073                 }
1074         }
1075         else
1076         {
1077                 NetWorkType = Ndis802_11OFDM5;
1078         }
1079
1080     if (pBss->HtCapabilityLen != 0)
1081     {
1082         if (NetWorkType == Ndis802_11OFDM5)
1083             NetWorkType = Ndis802_11OFDM5_N;
1084         else
1085             NetWorkType = Ndis802_11OFDM24_N;
1086     }
1087
1088         return NetWorkType;
1089 }
1090
1091 /*
1092     ==========================================================================
1093     Description:
1094         WPA message sanity check
1095     Return:
1096         TRUE if all parameters are OK, FALSE otherwise
1097     ==========================================================================
1098  */
1099 BOOLEAN PeerWpaMessageSanity(
1100     IN  PRTMP_ADAPTER           pAd,
1101     IN  PEAPOL_PACKET           pMsg,
1102     IN  ULONG                           MsgLen,
1103     IN  UCHAR                           MsgType,
1104     IN  MAC_TABLE_ENTRY         *pEntry)
1105 {
1106         UCHAR                   mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
1107         BOOLEAN                 bReplayDiff = FALSE;
1108         BOOLEAN                 bWPA2 = FALSE;
1109         KEY_INFO                EapolKeyInfo;
1110         UCHAR                   GroupKeyIndex = 0;
1111
1112
1113         NdisZeroMemory(mic, sizeof(mic));
1114         NdisZeroMemory(digest, sizeof(digest));
1115         NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
1116         NdisZeroMemory((PUCHAR)&EapolKeyInfo, sizeof(EapolKeyInfo));
1117
1118         NdisMoveMemory((PUCHAR)&EapolKeyInfo, (PUCHAR)&pMsg->KeyDesc.KeyInfo, sizeof(KEY_INFO));
1119
1120         *((USHORT *)&EapolKeyInfo) = cpu2le16(*((USHORT *)&EapolKeyInfo));
1121
1122         // Choose WPA2 or not
1123         if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
1124                 bWPA2 = TRUE;
1125
1126         // 0. Check MsgType
1127         if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1))
1128         {
1129                 DBGPRINT(RT_DEBUG_ERROR, ("The message type is invalid(%d)! \n", MsgType));
1130                 return FALSE;
1131         }
1132
1133         // 1. Replay counter check
1134         if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) // For supplicant
1135     {
1136         // First validate replay counter, only accept message with larger replay counter.
1137                 // Let equal pass, some AP start with all zero replay counter
1138                 UCHAR   ZeroReplay[LEN_KEY_DESC_REPLAY];
1139
1140         NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
1141                 if ((RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY) != 1) &&
1142                         (RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, ZeroReplay, LEN_KEY_DESC_REPLAY) != 0))
1143         {
1144                         bReplayDiff = TRUE;
1145         }
1146         }
1147         else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2)    // For authenticator
1148         {
1149                 // check Replay Counter coresponds to MSG from authenticator, otherwise discard
1150         if (!NdisEqualMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY))
1151         {
1152                         bReplayDiff = TRUE;
1153         }
1154         }
1155
1156         // Replay Counter different condition
1157         if (bReplayDiff)
1158         {
1159                 // send wireless event - for replay counter different
1160                 if (pAd->CommonCfg.bWirelessEvent)
1161                         RTMPSendWirelessEvent(pAd, IW_REPLAY_COUNTER_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1162
1163                 if (MsgType < EAPOL_GROUP_MSG_1)
1164                 {
1165                 DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1166                 }
1167                 else
1168                 {
1169                         DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1170                 }
1171
1172                 hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
1173                 hex_dump("Current replay counter ", pEntry->R_Counter, LEN_KEY_DESC_REPLAY);
1174         return FALSE;
1175         }
1176
1177         // 2. Verify MIC except Pairwise Msg1
1178         if (MsgType != EAPOL_PAIR_MSG_1)
1179         {
1180                 UCHAR                   rcvd_mic[LEN_KEY_DESC_MIC];
1181
1182                 // Record the received MIC for check later
1183                 NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1184                 NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1185
1186         if (pEntry->WepStatus == Ndis802_11Encryption2Enabled)  // TKIP
1187         {
1188             hmac_md5(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, mic);
1189         }
1190         else if (pEntry->WepStatus == Ndis802_11Encryption3Enabled)     // AES
1191         {
1192             HMAC_SHA1((PUCHAR)pMsg, MsgLen, pEntry->PTK, LEN_EAP_MICK, digest);
1193             NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
1194         }
1195
1196         if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC))
1197         {
1198                         // send wireless event - for MIC different
1199                         if (pAd->CommonCfg.bWirelessEvent)
1200                                 RTMPSendWirelessEvent(pAd, IW_MIC_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1201
1202                         if (MsgType < EAPOL_GROUP_MSG_1)
1203                         {
1204                 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1205                         }
1206                         else
1207                         {
1208                                 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1209                         }
1210
1211                         hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
1212                         hex_dump("Desired  MIC", mic, LEN_KEY_DESC_MIC);
1213
1214                         return FALSE;
1215         }
1216         }
1217
1218         // Extract the context of the Key Data field if it exist
1219         // The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is un-encrypted.
1220         // The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted.
1221         if (pMsg->KeyDesc.KeyDataLen[1] > 0)
1222         {
1223                 // Decrypt this field
1224                 if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2) || (MsgType == EAPOL_GROUP_MSG_1))
1225                 {
1226                         if(pEntry->WepStatus == Ndis802_11Encryption3Enabled)
1227                         {
1228                                 // AES
1229                                 AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA, pMsg->KeyDesc.KeyDataLen[1],pMsg->KeyDesc.KeyData);
1230                         }
1231                         else
1232                         {
1233                                 INT     i;
1234                                 UCHAR   Key[32];
1235                                 // Decrypt TKIP GTK
1236                                 // Construct 32 bytes RC4 Key
1237                                 NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
1238                                 NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
1239                                 ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, 32);
1240                                 //discard first 256 bytes
1241                                 for(i = 0; i < 256; i++)
1242                                         ARCFOUR_BYTE(&pAd->PrivateInfo.WEPCONTEXT);
1243                                 // Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
1244                                 ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, KEYDATA, pMsg->KeyDesc.KeyData, pMsg->KeyDesc.KeyDataLen[1]);
1245                         }
1246
1247                         if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
1248                                 GroupKeyIndex = EapolKeyInfo.KeyIndex;
1249
1250                 }
1251                 else if ((MsgType == EAPOL_PAIR_MSG_2) || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2))
1252                 {
1253                         NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData, pMsg->KeyDesc.KeyDataLen[1]);
1254                 }
1255                 else
1256                 {
1257
1258                         return TRUE;
1259                 }
1260
1261                 // Parse Key Data field to
1262                 // 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2)
1263                 // 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2
1264                 // 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2)
1265                 if (!RTMPParseEapolKeyData(pAd, KEYDATA, pMsg->KeyDesc.KeyDataLen[1], GroupKeyIndex, MsgType, bWPA2, pEntry))
1266                 {
1267                         return FALSE;
1268                 }
1269         }
1270
1271         return TRUE;
1272
1273 }