2 *************************************************************************
4 * 5F., No.36, Taiyuan St., Jhubei City,
8 * (c) Copyright 2002-2007, Ralink Technology, Inc.
10 * This program is free software; you can redistribute it and/or modify *
11 * it under the terms of the GNU General Public License as published by *
12 * the Free Software Foundation; either version 2 of the License, or *
13 * (at your option) any later version. *
15 * This program is distributed in the hope that it will be useful, *
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
18 * GNU General Public License for more details. *
20 * You should have received a copy of the GNU General Public License *
21 * along with this program; if not, write to the *
22 * Free Software Foundation, Inc., *
23 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 *************************************************************************
34 -------- ---------- ----------------------------------------------
35 John Chang 2004-09-01 add WMM support
37 #include "../rt_config.h"
39 extern u8 CISCO_OUI
[];
43 extern u8 WME_INFO_ELEM
[];
44 extern u8 WME_PARM_ELEM
[];
45 extern u8 Ccx2QosInfo
[];
46 extern u8 RALINK_OUI
[];
47 extern u8 BROADCOM_OUI
[];
51 ==========================================================================
53 MLME message sanity check
55 TRUE if all parameters are OK, FALSE otherwise
59 ==========================================================================
61 BOOLEAN
MlmeAddBAReqSanity(struct rt_rtmp_adapter
*pAd
,
62 void * Msg
, unsigned long MsgLen
, u8
*pAddr2
)
64 struct rt_mlme_addba_req
*pInfo
;
66 pInfo
= (struct rt_mlme_addba_req
*)Msg
;
68 if ((MsgLen
!= sizeof(struct rt_mlme_addba_req
))) {
69 DBGPRINT(RT_DEBUG_TRACE
,
70 ("MlmeAddBAReqSanity fail - message length not correct.\n"));
74 if ((pInfo
->Wcid
>= MAX_LEN_OF_MAC_TABLE
)) {
75 DBGPRINT(RT_DEBUG_TRACE
,
76 ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
80 if ((pInfo
->pAddr
[0] & 0x01) == 0x01) {
81 DBGPRINT(RT_DEBUG_TRACE
,
82 ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
90 ==========================================================================
92 MLME message sanity check
94 TRUE if all parameters are OK, FALSE otherwise
98 ==========================================================================
100 BOOLEAN
MlmeDelBAReqSanity(struct rt_rtmp_adapter
*pAd
, void * Msg
, unsigned long MsgLen
)
102 struct rt_mlme_delba_req
*pInfo
;
103 pInfo
= (struct rt_mlme_delba_req
*)Msg
;
105 if ((MsgLen
!= sizeof(struct rt_mlme_delba_req
))) {
106 DBGPRINT(RT_DEBUG_ERROR
,
107 ("MlmeDelBAReqSanity fail - message length not correct.\n"));
111 if ((pInfo
->Wcid
>= MAX_LEN_OF_MAC_TABLE
)) {
112 DBGPRINT(RT_DEBUG_ERROR
,
113 ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
117 if ((pInfo
->TID
& 0xf0)) {
118 DBGPRINT(RT_DEBUG_ERROR
,
119 ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
124 (pAd
->MacTab
.Content
[pInfo
->Wcid
].Addr
, pInfo
->Addr
,
125 MAC_ADDR_LEN
) == 0) {
126 DBGPRINT(RT_DEBUG_ERROR
,
127 ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
134 BOOLEAN
PeerAddBAReqActionSanity(struct rt_rtmp_adapter
*pAd
,
136 unsigned long MsgLen
, u8
*pAddr2
)
138 struct rt_frame_802_11
* pFrame
= (struct rt_frame_802_11
*) pMsg
;
139 struct rt_frame_addba_req
* pAddFrame
;
140 pAddFrame
= (struct rt_frame_addba_req
*) (pMsg
);
141 if (MsgLen
< (sizeof(struct rt_frame_addba_req
))) {
142 DBGPRINT(RT_DEBUG_ERROR
,
143 ("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n",
147 /* we support immediate BA. */
148 *(u16
*) (&pAddFrame
->BaParm
) =
149 cpu2le16(*(u16
*) (&pAddFrame
->BaParm
));
150 pAddFrame
->TimeOutValue
= cpu2le16(pAddFrame
->TimeOutValue
);
151 pAddFrame
->BaStartSeq
.word
= cpu2le16(pAddFrame
->BaStartSeq
.word
);
153 if (pAddFrame
->BaParm
.BAPolicy
!= IMMED_BA
) {
154 DBGPRINT(RT_DEBUG_ERROR
,
155 ("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n",
156 pAddFrame
->BaParm
.BAPolicy
));
157 DBGPRINT(RT_DEBUG_ERROR
,
158 ("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n",
159 pAddFrame
->BaParm
.TID
, pAddFrame
->BaParm
.BufSize
,
160 pAddFrame
->BaParm
.AMSDUSupported
));
163 /* we support immediate BA. */
164 if (pAddFrame
->BaParm
.TID
& 0xfff0) {
165 DBGPRINT(RT_DEBUG_ERROR
,
166 ("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n",
167 pAddFrame
->BaParm
.TID
));
170 COPY_MAC_ADDR(pAddr2
, pFrame
->Hdr
.Addr2
);
174 BOOLEAN
PeerAddBARspActionSanity(struct rt_rtmp_adapter
*pAd
,
175 void * pMsg
, unsigned long MsgLen
)
177 struct rt_frame_addba_rsp
* pAddFrame
;
179 pAddFrame
= (struct rt_frame_addba_rsp
*) (pMsg
);
180 if (MsgLen
< (sizeof(struct rt_frame_addba_rsp
))) {
181 DBGPRINT(RT_DEBUG_ERROR
,
182 ("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n",
186 /* we support immediate BA. */
187 *(u16
*) (&pAddFrame
->BaParm
) =
188 cpu2le16(*(u16
*) (&pAddFrame
->BaParm
));
189 pAddFrame
->StatusCode
= cpu2le16(pAddFrame
->StatusCode
);
190 pAddFrame
->TimeOutValue
= cpu2le16(pAddFrame
->TimeOutValue
);
192 if (pAddFrame
->BaParm
.BAPolicy
!= IMMED_BA
) {
193 DBGPRINT(RT_DEBUG_ERROR
,
194 ("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n",
195 pAddFrame
->BaParm
.BAPolicy
));
198 /* we support immediate BA. */
199 if (pAddFrame
->BaParm
.TID
& 0xfff0) {
200 DBGPRINT(RT_DEBUG_ERROR
,
201 ("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n",
202 pAddFrame
->BaParm
.TID
));
209 BOOLEAN
PeerDelBAActionSanity(struct rt_rtmp_adapter
*pAd
,
210 u8 Wcid
, void * pMsg
, unsigned long MsgLen
)
212 /*struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *)pMsg; */
213 struct rt_frame_delba_req
* pDelFrame
;
214 if (MsgLen
!= (sizeof(struct rt_frame_delba_req
)))
217 if (Wcid
>= MAX_LEN_OF_MAC_TABLE
)
220 pDelFrame
= (struct rt_frame_delba_req
*) (pMsg
);
222 *(u16
*) (&pDelFrame
->DelbaParm
) =
223 cpu2le16(*(u16
*) (&pDelFrame
->DelbaParm
));
224 pDelFrame
->ReasonCode
= cpu2le16(pDelFrame
->ReasonCode
);
226 if (pDelFrame
->DelbaParm
.TID
& 0xfff0)
233 ==========================================================================
235 MLME message sanity check
237 TRUE if all parameters are OK, FALSE otherwise
239 IRQL = DISPATCH_LEVEL
241 ==========================================================================
243 BOOLEAN
PeerBeaconAndProbeRspSanity(struct rt_rtmp_adapter
*pAd
, void * Msg
, unsigned long MsgLen
, u8 MsgChannel
, u8
*pAddr2
, u8
*pBssid
, char Ssid
[], u8
* pSsidLen
, u8
* pBssType
, u16
* pBeaconPeriod
, u8
* pChannel
, u8
* pNewChannel
, OUT LARGE_INTEGER
* pTimestamp
, struct rt_cf_parm
* pCfParm
, u16
* pAtimWin
, u16
* pCapabilityInfo
, u8
* pErp
, u8
* pDtimCount
, u8
* pDtimPeriod
, u8
* pBcastFlag
, u8
* pMessageToMe
, u8 SupRate
[], u8
* pSupRateLen
, u8 ExtRate
[], u8
* pExtRateLen
, u8
* pCkipFlag
, u8
* pAironetCellPowerLimit
, struct rt_edca_parm
*pEdcaParm
, struct rt_qbss_load_parm
*pQbssLoad
, struct rt_qos_capability_parm
*pQosCapability
, unsigned long * pRalinkIe
, u8
* pHtCapabilityLen
, u8
* pPreNHtCapabilityLen
, struct rt_ht_capability_ie
* pHtCapability
, u8
* AddHtInfoLen
, struct rt_add_ht_info_ie
* AddHtInfo
, u8
* NewExtChannelOffset
, /* Ht extension channel offset(above or below) */
245 struct rt_ndis_802_11_variable_ies
*pVIE
)
249 struct rt_frame_802_11
* pFrame
;
250 struct rt_eid
* pEid
;
253 /*u8 ECWMin, ECWMax; */
254 /*MAC_CSR9_STRUC Csr9; */
255 unsigned long Length
= 0;
257 /* For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel */
258 /* 1. If the AP is 11n enabled, then check the control channel. */
259 /* 2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!) */
262 /* Add for 3 necessary EID field check */
272 *pCkipFlag
= 0; /* Default of CkipFlag is 0 */
273 *pAironetCellPowerLimit
= 0xFF; /* Default of AironetCellPowerLimit is 0xFF */
274 *LengthVIE
= 0; /* Set the length of VIE to init value 0 */
275 *pHtCapabilityLen
= 0; /* Set the length of VIE to init value 0 */
276 if (pAd
->OpMode
== OPMODE_STA
)
277 *pPreNHtCapabilityLen
= 0; /* Set the length of VIE to init value 0 */
278 *AddHtInfoLen
= 0; /* Set the length of VIE to init value 0 */
281 *NewExtChannelOffset
= 0xff; /*Default 0xff means no such IE */
282 pCfParm
->bValid
= FALSE
; /* default: no IE_CF found */
283 pQbssLoad
->bValid
= FALSE
; /* default: no IE_QBSS_LOAD found */
284 pEdcaParm
->bValid
= FALSE
; /* default: no IE_EDCA_PARAMETER found */
285 pQosCapability
->bValid
= FALSE
; /* default: no IE_QOS_CAPABILITY found */
287 pFrame
= (struct rt_frame_802_11
*) Msg
;
289 /* get subtype from header */
290 SubType
= (u8
)pFrame
->Hdr
.FC
.SubType
;
292 /* get Addr2 and BSSID from header */
293 COPY_MAC_ADDR(pAddr2
, pFrame
->Hdr
.Addr2
);
294 COPY_MAC_ADDR(pBssid
, pFrame
->Hdr
.Addr3
);
297 Length
+= LENGTH_802_11
;
299 /* get timestamp from payload and advance the pointer */
300 NdisMoveMemory(pTimestamp
, Ptr
, TIMESTAMP_LEN
);
302 pTimestamp
->u
.LowPart
= cpu2le32(pTimestamp
->u
.LowPart
);
303 pTimestamp
->u
.HighPart
= cpu2le32(pTimestamp
->u
.HighPart
);
305 Ptr
+= TIMESTAMP_LEN
;
306 Length
+= TIMESTAMP_LEN
;
308 /* get beacon interval from payload and advance the pointer */
309 NdisMoveMemory(pBeaconPeriod
, Ptr
, 2);
313 /* get capability info from payload and advance the pointer */
314 NdisMoveMemory(pCapabilityInfo
, Ptr
, 2);
318 if (CAP_IS_ESS_ON(*pCapabilityInfo
))
319 *pBssType
= BSS_INFRA
;
321 *pBssType
= BSS_ADHOC
;
323 pEid
= (struct rt_eid
*) Ptr
;
325 /* get variable fields from payload and advance the pointer */
326 while ((Length
+ 2 + pEid
->Len
) <= MsgLen
) {
328 /* Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow. */
330 if ((*LengthVIE
+ pEid
->Len
+ 2) >= MAX_VIE_LEN
) {
331 DBGPRINT(RT_DEBUG_WARN
,
332 ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
333 (*LengthVIE
+ pEid
->Len
+ 2), MAX_VIE_LEN
));
339 /* Already has one SSID EID in this beacon, ignore the second one */
342 if (pEid
->Len
<= MAX_LEN_OF_SSID
) {
343 NdisMoveMemory(Ssid
, pEid
->Octet
, pEid
->Len
);
344 *pSsidLen
= pEid
->Len
;
347 DBGPRINT(RT_DEBUG_TRACE
,
348 ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",
355 if (pEid
->Len
<= MAX_LEN_OF_SUPPORTED_RATES
) {
357 NdisMoveMemory(SupRate
, pEid
->Octet
, pEid
->Len
);
358 *pSupRateLen
= pEid
->Len
;
360 /* TODO: 2004-09-14 not a good design here, cause it exclude extra rates */
361 /* from ScanTab. We should report as is. And filter out unsupported */
362 /* rates in MlmeAux. */
363 /* Check against the supported rates */
364 /* RTMPCheckRates(pAd, SupRate, pSupRateLen); */
366 DBGPRINT(RT_DEBUG_TRACE
,
367 ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",
374 if (pEid
->Len
>= SIZE_HT_CAP_IE
) /*Note: allow extension! */
376 NdisMoveMemory(pHtCapability
, pEid
->Octet
,
377 sizeof(struct rt_ht_capability_ie
));
378 *pHtCapabilityLen
= SIZE_HT_CAP_IE
; /* Nnow we only support 26 bytes. */
380 *(u16
*) (&pHtCapability
->HtCapInfo
) =
382 (&pHtCapability
->HtCapInfo
));
383 *(u16
*) (&pHtCapability
->ExtHtCapInfo
) =
385 (&pHtCapability
->ExtHtCapInfo
));
388 *pPreNHtCapabilityLen
= 0; /* Nnow we only support 26 bytes. */
391 NdisMoveMemory(Ptr
+ *LengthVIE
,
394 *LengthVIE
+= (pEid
->Len
+ 2);
397 DBGPRINT(RT_DEBUG_WARN
,
398 ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n",
404 if (pEid
->Len
>= sizeof(struct rt_add_ht_info_ie
)) {
405 /* This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only */
406 /* copy first sizeof(struct rt_add_ht_info_ie) */
407 NdisMoveMemory(AddHtInfo
, pEid
->Octet
,
408 sizeof(struct rt_add_ht_info_ie
));
409 *AddHtInfoLen
= SIZE_ADD_HT_INFO_IE
;
411 CtrlChannel
= AddHtInfo
->ControlChan
;
413 *(u16
*) (&AddHtInfo
->AddHtInfo2
) =
415 (&AddHtInfo
->AddHtInfo2
));
416 *(u16
*) (&AddHtInfo
->AddHtInfo3
) =
418 (&AddHtInfo
->AddHtInfo3
));
422 NdisMoveMemory(Ptr
+ *LengthVIE
,
425 *LengthVIE
+= (pEid
->Len
+ 2);
428 DBGPRINT(RT_DEBUG_WARN
,
429 ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
433 case IE_SECONDARY_CH_OFFSET
:
434 if (pEid
->Len
== 1) {
435 *NewExtChannelOffset
= pEid
->Octet
[0];
437 DBGPRINT(RT_DEBUG_WARN
,
438 ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
443 DBGPRINT(RT_DEBUG_TRACE
,
444 ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
448 if (pEid
->Len
== 1) {
449 *pChannel
= *pEid
->Octet
;
452 if (ChannelSanity(pAd
, *pChannel
) == 0) {
460 DBGPRINT(RT_DEBUG_TRACE
,
461 ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",
468 if (pEid
->Len
== 6) {
469 pCfParm
->bValid
= TRUE
;
470 pCfParm
->CfpCount
= pEid
->Octet
[0];
471 pCfParm
->CfpPeriod
= pEid
->Octet
[1];
472 pCfParm
->CfpMaxDuration
=
473 pEid
->Octet
[2] + 256 * pEid
->Octet
[3];
474 pCfParm
->CfpDurRemaining
=
475 pEid
->Octet
[4] + 256 * pEid
->Octet
[5];
477 DBGPRINT(RT_DEBUG_TRACE
,
478 ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
484 if (pEid
->Len
== 2) {
485 NdisMoveMemory(pAtimWin
, pEid
->Octet
,
488 DBGPRINT(RT_DEBUG_TRACE
,
489 ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
495 if (INFRA_ON(pAd
) && SubType
== SUBTYPE_BEACON
) {
496 GetTimBit((char *)pEid
, pAd
->StaActive
.Aid
,
497 &TimLen
, pBcastFlag
, pDtimCount
,
498 pDtimPeriod
, pMessageToMe
);
501 case IE_CHANNEL_SWITCH_ANNOUNCEMENT
:
502 if (pEid
->Len
== 3) {
503 *pNewChannel
= pEid
->Octet
[1]; /*extract new channel number */
508 /* CCX v2 has the same IE, we need to parse that too */
509 /* Wifi WMM use the same IE vale, need to parse that too */
511 case IE_VENDOR_SPECIFIC
:
512 /* Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE. */
513 /* This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan. */
514 /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
516 if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
519 NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(struct rt_ht_capability_ie));
520 *pHtCapabilityLen = SIZE_HT_CAP_IE; // Nnow we only support 26 bytes.
523 if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
526 NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(struct rt_add_ht_info_ie));
527 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE; // Nnow we only support 26 bytes.
532 /* Check the OUI version, filter out non-standard usage */
533 if (NdisEqualMemory(pEid
->Octet
, RALINK_OUI
, 3)
534 && (pEid
->Len
== 7)) {
535 /**pRalinkIe = pEid->Octet[3]; */
536 if (pEid
->Octet
[3] != 0)
537 *pRalinkIe
= pEid
->Octet
[3];
539 *pRalinkIe
= 0xf0000000; /* Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag. */
541 /* This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan. */
543 /* Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP, */
544 /* Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE */
545 else if ((*pHtCapabilityLen
== 0)
546 && NdisEqualMemory(pEid
->Octet
, PRE_N_HT_OUI
,
547 3) && (pEid
->Len
>= 4)
548 && (pAd
->OpMode
== OPMODE_STA
)) {
549 if ((pEid
->Octet
[3] == OUI_PREN_HT_CAP
)
551 && (*pHtCapabilityLen
== 0)) {
552 NdisMoveMemory(pHtCapability
,
555 (struct rt_ht_capability_ie
));
556 *pPreNHtCapabilityLen
= SIZE_HT_CAP_IE
;
559 if ((pEid
->Octet
[3] == OUI_PREN_ADD_HT
)
560 && (pEid
->Len
>= 26)) {
561 NdisMoveMemory(AddHtInfo
,
563 sizeof(struct rt_add_ht_info_ie
));
564 *AddHtInfoLen
= SIZE_ADD_HT_INFO_IE
;
566 } else if (NdisEqualMemory(pEid
->Octet
, WPA_OUI
, 4)) {
567 /* Copy to pVIE which will report to microsoft bssid list. */
569 NdisMoveMemory(Ptr
+ *LengthVIE
, &pEid
->Eid
,
571 *LengthVIE
+= (pEid
->Len
+ 2);
573 if (NdisEqualMemory(pEid
->Octet
, WME_PARM_ELEM
, 6)
574 && (pEid
->Len
== 24)) {
578 /* parsing EDCA parameters */
579 pEdcaParm
->bValid
= TRUE
;
580 pEdcaParm
->bQAck
= FALSE
; /* pEid->Octet[0] & 0x10; */
581 pEdcaParm
->bQueueRequest
= FALSE
; /* pEid->Octet[0] & 0x20; */
582 pEdcaParm
->bTxopRequest
= FALSE
; /* pEid->Octet[0] & 0x40; */
583 pEdcaParm
->EdcaUpdateCount
=
584 pEid
->Octet
[6] & 0x0f;
585 pEdcaParm
->bAPSDCapable
=
586 (pEid
->Octet
[6] & 0x80) ? 1 : 0;
587 ptr
= &pEid
->Octet
[8];
588 for (i
= 0; i
< 4; i
++) {
589 u8 aci
= (*ptr
& 0x60) >> 5; /* b5~6 is AC INDEX */
590 pEdcaParm
->bACM
[aci
] = (((*ptr
) & 0x10) == 0x10); /* b5 is ACM */
591 pEdcaParm
->Aifsn
[aci
] = (*ptr
) & 0x0f; /* b0~3 is AIFSN */
592 pEdcaParm
->Cwmin
[aci
] = *(ptr
+ 1) & 0x0f; /* b0~4 is Cwmin */
593 pEdcaParm
->Cwmax
[aci
] = *(ptr
+ 1) >> 4; /* b5~8 is Cwmax */
594 pEdcaParm
->Txop
[aci
] = *(ptr
+ 2) + 256 * (*(ptr
+ 3)); /* in unit of 32-us */
595 ptr
+= 4; /* point to next AC */
598 if (NdisEqualMemory(pEid
->Octet
, WME_INFO_ELEM
, 6)
599 && (pEid
->Len
== 7)) {
600 /* parsing EDCA parameters */
601 pEdcaParm
->bValid
= TRUE
;
602 pEdcaParm
->bQAck
= FALSE
; /* pEid->Octet[0] & 0x10; */
603 pEdcaParm
->bQueueRequest
= FALSE
; /* pEid->Octet[0] & 0x20; */
604 pEdcaParm
->bTxopRequest
= FALSE
; /* pEid->Octet[0] & 0x40; */
605 pEdcaParm
->EdcaUpdateCount
=
606 pEid
->Octet
[6] & 0x0f;
607 pEdcaParm
->bAPSDCapable
=
608 (pEid
->Octet
[6] & 0x80) ? 1 : 0;
610 /* use default EDCA parameter */
611 pEdcaParm
->bACM
[QID_AC_BE
] = 0;
612 pEdcaParm
->Aifsn
[QID_AC_BE
] = 3;
613 pEdcaParm
->Cwmin
[QID_AC_BE
] = CW_MIN_IN_BITS
;
614 pEdcaParm
->Cwmax
[QID_AC_BE
] = CW_MAX_IN_BITS
;
615 pEdcaParm
->Txop
[QID_AC_BE
] = 0;
617 pEdcaParm
->bACM
[QID_AC_BK
] = 0;
618 pEdcaParm
->Aifsn
[QID_AC_BK
] = 7;
619 pEdcaParm
->Cwmin
[QID_AC_BK
] = CW_MIN_IN_BITS
;
620 pEdcaParm
->Cwmax
[QID_AC_BK
] = CW_MAX_IN_BITS
;
621 pEdcaParm
->Txop
[QID_AC_BK
] = 0;
623 pEdcaParm
->bACM
[QID_AC_VI
] = 0;
624 pEdcaParm
->Aifsn
[QID_AC_VI
] = 2;
625 pEdcaParm
->Cwmin
[QID_AC_VI
] =
627 pEdcaParm
->Cwmax
[QID_AC_VI
] = CW_MAX_IN_BITS
;
628 pEdcaParm
->Txop
[QID_AC_VI
] = 96; /* AC_VI: 96*32us ~= 3ms */
630 pEdcaParm
->bACM
[QID_AC_VO
] = 0;
631 pEdcaParm
->Aifsn
[QID_AC_VO
] = 2;
632 pEdcaParm
->Cwmin
[QID_AC_VO
] =
634 pEdcaParm
->Cwmax
[QID_AC_VO
] =
636 pEdcaParm
->Txop
[QID_AC_VO
] = 48; /* AC_VO: 48*32us ~= 1.5ms */
641 case IE_EXT_SUPP_RATES
:
642 if (pEid
->Len
<= MAX_LEN_OF_SUPPORTED_RATES
) {
643 NdisMoveMemory(ExtRate
, pEid
->Octet
, pEid
->Len
);
644 *pExtRateLen
= pEid
->Len
;
646 /* TODO: 2004-09-14 not a good design here, cause it exclude extra rates */
647 /* from ScanTab. We should report as is. And filter out unsupported */
648 /* rates in MlmeAux. */
649 /* Check against the supported rates */
650 /* RTMPCheckRates(pAd, ExtRate, pExtRateLen); */
655 if (pEid
->Len
== 1) {
656 *pErp
= (u8
)pEid
->Octet
[0];
660 case IE_AIRONET_CKIP
:
661 /* 0. Check Aironet IE length, it must be larger or equal to 28 */
662 /* Cisco AP350 used length as 28 */
663 /* Cisco AP12XX used length as 30 */
664 if (pEid
->Len
< (CKIP_NEGOTIATION_LENGTH
- 2))
667 /* 1. Copy CKIP flag byte to buffer for process */
668 *pCkipFlag
= *(pEid
->Octet
+ 8);
672 /* AP Control of Client Transmit Power */
673 /*0. Check Aironet IE length, it must be 6 */
674 if (pEid
->Len
!= 0x06)
677 /* Get cell power limit in dBm */
678 if (NdisEqualMemory(pEid
->Octet
, CISCO_OUI
, 3) == 1)
679 *pAironetCellPowerLimit
= *(pEid
->Octet
+ 4);
682 /* WPA2 & 802.11i RSN */
684 /* There is no OUI for version anymore, check the group cipher OUI before copying */
685 if (RTMPEqualMemory(pEid
->Octet
+ 2, RSN_OUI
, 3)) {
686 /* Copy to pVIE which will report to microsoft bssid list. */
688 NdisMoveMemory(Ptr
+ *LengthVIE
, &pEid
->Eid
,
690 *LengthVIE
+= (pEid
->Len
+ 2);
698 Length
= Length
+ 2 + pEid
->Len
; /* Eid[1] + Len[1]+ content[Len] */
699 pEid
= (struct rt_eid
*) ((u8
*) pEid
+ 2 + pEid
->Len
);
702 /* For some 11a AP. it did not have the channel EID, patch here */
704 u8 LatchRfChannel
= MsgChannel
;
705 if ((pAd
->LatchRfRegs
.Channel
> 14) && ((Sanity
& 0x4) == 0)) {
706 if (CtrlChannel
!= 0)
707 *pChannel
= CtrlChannel
;
709 *pChannel
= LatchRfChannel
;
715 DBGPRINT(RT_DEBUG_LOUD
,
716 ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n",
726 ==========================================================================
728 MLME message sanity check
730 TRUE if all parameters are OK, FALSE otherwise
731 ==========================================================================
733 BOOLEAN
MlmeScanReqSanity(struct rt_rtmp_adapter
*pAd
,
735 unsigned long MsgLen
,
738 u8
* pSsidLen
, u8
* pScanType
)
740 struct rt_mlme_scan_req
*Info
;
742 Info
= (struct rt_mlme_scan_req
*)(Msg
);
743 *pBssType
= Info
->BssType
;
744 *pSsidLen
= Info
->SsidLen
;
745 NdisMoveMemory(Ssid
, Info
->Ssid
, *pSsidLen
);
746 *pScanType
= Info
->ScanType
;
748 if ((*pBssType
== BSS_INFRA
|| *pBssType
== BSS_ADHOC
749 || *pBssType
== BSS_ANY
)
750 && (*pScanType
== SCAN_ACTIVE
|| *pScanType
== SCAN_PASSIVE
)) {
753 DBGPRINT(RT_DEBUG_TRACE
,
754 ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
759 /* IRQL = DISPATCH_LEVEL */
760 u8
ChannelSanity(struct rt_rtmp_adapter
*pAd
, u8 channel
)
764 for (i
= 0; i
< pAd
->ChannelListNum
; i
++) {
765 if (channel
== pAd
->ChannelList
[i
].Channel
)
772 ==========================================================================
774 MLME message sanity check
776 TRUE if all parameters are OK, FALSE otherwise
778 IRQL = DISPATCH_LEVEL
780 ==========================================================================
782 BOOLEAN
PeerDeauthSanity(struct rt_rtmp_adapter
*pAd
,
784 unsigned long MsgLen
,
785 u8
*pAddr2
, u16
* pReason
)
787 struct rt_frame_802_11
* pFrame
= (struct rt_frame_802_11
*) Msg
;
789 COPY_MAC_ADDR(pAddr2
, pFrame
->Hdr
.Addr2
);
790 NdisMoveMemory(pReason
, &pFrame
->Octet
[0], 2);
796 ==========================================================================
798 MLME message sanity check
800 TRUE if all parameters are OK, FALSE otherwise
802 IRQL = DISPATCH_LEVEL
804 ==========================================================================
806 BOOLEAN
PeerAuthSanity(struct rt_rtmp_adapter
*pAd
,
808 unsigned long MsgLen
,
812 u16
* pStatus
, char * pChlgText
)
814 struct rt_frame_802_11
* pFrame
= (struct rt_frame_802_11
*) Msg
;
816 COPY_MAC_ADDR(pAddr
, pFrame
->Hdr
.Addr2
);
817 NdisMoveMemory(pAlg
, &pFrame
->Octet
[0], 2);
818 NdisMoveMemory(pSeq
, &pFrame
->Octet
[2], 2);
819 NdisMoveMemory(pStatus
, &pFrame
->Octet
[4], 2);
821 if (*pAlg
== AUTH_MODE_OPEN
) {
822 if (*pSeq
== 1 || *pSeq
== 2) {
825 DBGPRINT(RT_DEBUG_TRACE
,
826 ("PeerAuthSanity fail - wrong Seg#\n"));
829 } else if (*pAlg
== AUTH_MODE_KEY
) {
830 if (*pSeq
== 1 || *pSeq
== 4) {
832 } else if (*pSeq
== 2 || *pSeq
== 3) {
833 NdisMoveMemory(pChlgText
, &pFrame
->Octet
[8],
837 DBGPRINT(RT_DEBUG_TRACE
,
838 ("PeerAuthSanity fail - wrong Seg#\n"));
842 DBGPRINT(RT_DEBUG_TRACE
,
843 ("PeerAuthSanity fail - wrong algorithm\n"));
849 ==========================================================================
851 MLME message sanity check
853 TRUE if all parameters are OK, FALSE otherwise
854 ==========================================================================
856 BOOLEAN
MlmeAuthReqSanity(struct rt_rtmp_adapter
*pAd
,
858 unsigned long MsgLen
,
860 unsigned long * pTimeout
, u16
* pAlg
)
862 struct rt_mlme_auth_req
*pInfo
;
864 pInfo
= (struct rt_mlme_auth_req
*)Msg
;
865 COPY_MAC_ADDR(pAddr
, pInfo
->Addr
);
866 *pTimeout
= pInfo
->Timeout
;
869 if (((*pAlg
== AUTH_MODE_KEY
) || (*pAlg
== AUTH_MODE_OPEN
)
870 ) && ((*pAddr
& 0x01) == 0)) {
873 DBGPRINT(RT_DEBUG_TRACE
,
874 ("MlmeAuthReqSanity fail - wrong algorithm\n"));
880 ==========================================================================
882 MLME message sanity check
884 TRUE if all parameters are OK, FALSE otherwise
886 IRQL = DISPATCH_LEVEL
888 ==========================================================================
890 BOOLEAN
MlmeAssocReqSanity(struct rt_rtmp_adapter
*pAd
,
892 unsigned long MsgLen
,
894 u16
* pCapabilityInfo
,
895 unsigned long * pTimeout
, u16
* pListenIntv
)
897 struct rt_mlme_assoc_req
*pInfo
;
899 pInfo
= (struct rt_mlme_assoc_req
*)Msg
;
900 *pTimeout
= pInfo
->Timeout
; /* timeout */
901 COPY_MAC_ADDR(pApAddr
, pInfo
->Addr
); /* AP address */
902 *pCapabilityInfo
= pInfo
->CapabilityInfo
; /* capability info */
903 *pListenIntv
= pInfo
->ListenIntv
;
909 ==========================================================================
911 MLME message sanity check
913 TRUE if all parameters are OK, FALSE otherwise
915 IRQL = DISPATCH_LEVEL
917 ==========================================================================
919 BOOLEAN
PeerDisassocSanity(struct rt_rtmp_adapter
*pAd
,
921 unsigned long MsgLen
,
922 u8
*pAddr2
, u16
* pReason
)
924 struct rt_frame_802_11
* pFrame
= (struct rt_frame_802_11
*) Msg
;
926 COPY_MAC_ADDR(pAddr2
, pFrame
->Hdr
.Addr2
);
927 NdisMoveMemory(pReason
, &pFrame
->Octet
[0], 2);
933 ========================================================================
935 Sanity check NetworkType (11b, 11g or 11a)
938 pBss - Pointer to BSS table.
941 Ndis802_11DS .......(11b)
942 Ndis802_11OFDM24....(11g)
943 Ndis802_11OFDM5.....(11a)
945 IRQL = DISPATCH_LEVEL
947 ========================================================================
949 NDIS_802_11_NETWORK_TYPE
NetworkTypeInUseSanity(struct rt_bss_entry
*pBss
)
951 NDIS_802_11_NETWORK_TYPE NetWorkType
;
954 NetWorkType
= Ndis802_11DS
;
956 if (pBss
->Channel
<= 14) {
958 /* First check support Rate. */
960 for (i
= 0; i
< pBss
->SupRateLen
; i
++) {
961 rate
= pBss
->SupRate
[i
] & 0x7f; /* Mask out basic rate set bit */
962 if ((rate
== 2) || (rate
== 4) || (rate
== 11)
967 /* Otherwise (even rate > 108) means Ndis802_11OFDM24 */
969 NetWorkType
= Ndis802_11OFDM24
;
975 /* Second check Extend Rate. */
977 if (NetWorkType
!= Ndis802_11OFDM24
) {
978 for (i
= 0; i
< pBss
->ExtRateLen
; i
++) {
979 rate
= pBss
->SupRate
[i
] & 0x7f; /* Mask out basic rate set bit */
980 if ((rate
== 2) || (rate
== 4) || (rate
== 11)
985 /* Otherwise (even rate > 108) means Ndis802_11OFDM24 */
987 NetWorkType
= Ndis802_11OFDM24
;
993 NetWorkType
= Ndis802_11OFDM5
;
996 if (pBss
->HtCapabilityLen
!= 0) {
997 if (NetWorkType
== Ndis802_11OFDM5
)
998 NetWorkType
= Ndis802_11OFDM5_N
;
1000 NetWorkType
= Ndis802_11OFDM24_N
;
1007 ==========================================================================
1009 Check the validity of the received EAPoL frame
1011 TRUE if all parameters are OK,
1013 ==========================================================================
1015 BOOLEAN
PeerWpaMessageSanity(struct rt_rtmp_adapter
*pAd
,
1016 struct rt_eapol_packet
* pMsg
,
1017 unsigned long MsgLen
,
1018 u8 MsgType
, struct rt_mac_table_entry
*pEntry
)
1020 u8 mic
[LEN_KEY_DESC_MIC
], digest
[80], KEYDATA
[MAX_LEN_OF_RSNIE
];
1021 BOOLEAN bReplayDiff
= FALSE
;
1022 BOOLEAN bWPA2
= FALSE
;
1023 struct rt_key_info EapolKeyInfo
;
1024 u8 GroupKeyIndex
= 0;
1026 NdisZeroMemory(mic
, sizeof(mic
));
1027 NdisZeroMemory(digest
, sizeof(digest
));
1028 NdisZeroMemory(KEYDATA
, sizeof(KEYDATA
));
1029 NdisZeroMemory((u8
*)& EapolKeyInfo
, sizeof(EapolKeyInfo
));
1031 NdisMoveMemory((u8
*)& EapolKeyInfo
,
1032 (u8
*)& pMsg
->KeyDesc
.KeyInfo
, sizeof(struct rt_key_info
));
1034 *((u16
*) & EapolKeyInfo
) = cpu2le16(*((u16
*) & EapolKeyInfo
));
1036 /* Choose WPA2 or not */
1037 if ((pEntry
->AuthMode
== Ndis802_11AuthModeWPA2
)
1038 || (pEntry
->AuthMode
== Ndis802_11AuthModeWPA2PSK
))
1041 /* 0. Check MsgType */
1042 if ((MsgType
> EAPOL_GROUP_MSG_2
) || (MsgType
< EAPOL_PAIR_MSG_1
)) {
1043 DBGPRINT(RT_DEBUG_ERROR
,
1044 ("The message type is invalid(%d)! \n", MsgType
));
1047 /* 1. Replay counter check */
1048 if (MsgType
== EAPOL_PAIR_MSG_1
|| MsgType
== EAPOL_PAIR_MSG_3
|| MsgType
== EAPOL_GROUP_MSG_1
) /* For supplicant */
1050 /* First validate replay counter, only accept message with larger replay counter. */
1051 /* Let equal pass, some AP start with all zero replay counter */
1052 u8 ZeroReplay
[LEN_KEY_DESC_REPLAY
];
1054 NdisZeroMemory(ZeroReplay
, LEN_KEY_DESC_REPLAY
);
1055 if ((RTMPCompareMemory
1056 (pMsg
->KeyDesc
.ReplayCounter
, pEntry
->R_Counter
,
1057 LEN_KEY_DESC_REPLAY
) != 1)
1060 (pMsg
->KeyDesc
.ReplayCounter
, ZeroReplay
,
1061 LEN_KEY_DESC_REPLAY
) != 0)) {
1064 } else if (MsgType
== EAPOL_PAIR_MSG_2
|| MsgType
== EAPOL_PAIR_MSG_4
|| MsgType
== EAPOL_GROUP_MSG_2
) /* For authenticator */
1066 /* check Replay Counter coresponds to MSG from authenticator, otherwise discard */
1067 if (!NdisEqualMemory
1068 (pMsg
->KeyDesc
.ReplayCounter
, pEntry
->R_Counter
,
1069 LEN_KEY_DESC_REPLAY
)) {
1073 /* Replay Counter different condition */
1075 /* send wireless event - for replay counter different */
1076 if (pAd
->CommonCfg
.bWirelessEvent
)
1077 RTMPSendWirelessEvent(pAd
,
1078 IW_REPLAY_COUNTER_DIFF_EVENT_FLAG
,
1079 pEntry
->Addr
, pEntry
->apidx
, 0);
1081 if (MsgType
< EAPOL_GROUP_MSG_1
) {
1082 DBGPRINT(RT_DEBUG_ERROR
,
1083 ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n",
1086 DBGPRINT(RT_DEBUG_ERROR
,
1087 ("Replay Counter Different in group msg %d of 2-way handshake!\n",
1088 (MsgType
- EAPOL_PAIR_MSG_4
)));
1091 hex_dump("Receive replay counter ", pMsg
->KeyDesc
.ReplayCounter
,
1092 LEN_KEY_DESC_REPLAY
);
1093 hex_dump("Current replay counter ", pEntry
->R_Counter
,
1094 LEN_KEY_DESC_REPLAY
);
1097 /* 2. Verify MIC except Pairwise Msg1 */
1098 if (MsgType
!= EAPOL_PAIR_MSG_1
) {
1099 u8 rcvd_mic
[LEN_KEY_DESC_MIC
];
1101 /* Record the received MIC for check later */
1102 NdisMoveMemory(rcvd_mic
, pMsg
->KeyDesc
.KeyMic
,
1104 NdisZeroMemory(pMsg
->KeyDesc
.KeyMic
, LEN_KEY_DESC_MIC
);
1106 if (EapolKeyInfo
.KeyDescVer
== DESC_TYPE_TKIP
) /* TKIP */
1108 HMAC_MD5(pEntry
->PTK
, LEN_EAP_MICK
, (u8
*)pMsg
,
1109 MsgLen
, mic
, MD5_DIGEST_SIZE
);
1110 } else if (EapolKeyInfo
.KeyDescVer
== DESC_TYPE_AES
) /* AES */
1112 HMAC_SHA1(pEntry
->PTK
, LEN_EAP_MICK
, (u8
*)pMsg
,
1113 MsgLen
, digest
, SHA1_DIGEST_SIZE
);
1114 NdisMoveMemory(mic
, digest
, LEN_KEY_DESC_MIC
);
1117 if (!NdisEqualMemory(rcvd_mic
, mic
, LEN_KEY_DESC_MIC
)) {
1118 /* send wireless event - for MIC different */
1119 if (pAd
->CommonCfg
.bWirelessEvent
)
1120 RTMPSendWirelessEvent(pAd
,
1121 IW_MIC_DIFF_EVENT_FLAG
,
1125 if (MsgType
< EAPOL_GROUP_MSG_1
) {
1126 DBGPRINT(RT_DEBUG_ERROR
,
1127 ("MIC Different in pairwise msg %d of 4-way handshake!\n",
1130 DBGPRINT(RT_DEBUG_ERROR
,
1131 ("MIC Different in group msg %d of 2-way handshake!\n",
1132 (MsgType
- EAPOL_PAIR_MSG_4
)));
1135 hex_dump("Received MIC", rcvd_mic
, LEN_KEY_DESC_MIC
);
1136 hex_dump("Desired MIC", mic
, LEN_KEY_DESC_MIC
);
1141 /* 1. Decrypt the Key Data field if GTK is included. */
1142 /* 2. Extract the context of the Key Data field if it exist. */
1143 /* The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is clear. */
1144 /* The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted. */
1145 if (CONV_ARRARY_TO_u16(pMsg
->KeyDesc
.KeyDataLen
) > 0) {
1146 /* Decrypt this field */
1147 if ((MsgType
== EAPOL_PAIR_MSG_3
&& bWPA2
)
1148 || (MsgType
== EAPOL_GROUP_MSG_1
)) {
1149 if ((EapolKeyInfo
.KeyDescVer
== DESC_TYPE_AES
)) {
1151 AES_GTK_KEY_UNWRAP(&pEntry
->PTK
[16], KEYDATA
,
1152 CONV_ARRARY_TO_u16(pMsg
->
1155 pMsg
->KeyDesc
.KeyData
);
1159 /* Decrypt TKIP GTK */
1160 /* Construct 32 bytes RC4 Key */
1161 NdisMoveMemory(Key
, pMsg
->KeyDesc
.KeyIv
, 16);
1162 NdisMoveMemory(&Key
[16], &pEntry
->PTK
[16], 16);
1163 ARCFOUR_INIT(&pAd
->PrivateInfo
.WEPCONTEXT
, Key
,
1165 /*discard first 256 bytes */
1166 for (i
= 0; i
< 256; i
++)
1167 ARCFOUR_BYTE(&pAd
->PrivateInfo
.
1169 /* Decrypt GTK. Becareful, there is no ICV to check the result is correct or not */
1170 ARCFOUR_DECRYPT(&pAd
->PrivateInfo
.WEPCONTEXT
,
1171 KEYDATA
, pMsg
->KeyDesc
.KeyData
,
1172 CONV_ARRARY_TO_u16(pMsg
->
1177 if (!bWPA2
&& (MsgType
== EAPOL_GROUP_MSG_1
))
1178 GroupKeyIndex
= EapolKeyInfo
.KeyIndex
;
1180 } else if ((MsgType
== EAPOL_PAIR_MSG_2
)
1181 || (MsgType
== EAPOL_PAIR_MSG_3
&& !bWPA2
)) {
1182 NdisMoveMemory(KEYDATA
, pMsg
->KeyDesc
.KeyData
,
1183 CONV_ARRARY_TO_u16(pMsg
->KeyDesc
.
1190 /* Parse Key Data field to */
1191 /* 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2) */
1192 /* 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2 */
1193 /* 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2) */
1194 if (!RTMPParseEapolKeyData(pAd
, KEYDATA
,
1195 CONV_ARRARY_TO_u16(pMsg
->KeyDesc
.
1197 GroupKeyIndex
, MsgType
, bWPA2
,