]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - drivers/staging/rt2860/common/cmm_sanity.c
projects / mirror_ubuntu-artful-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Fix common misspellings
[mirror_ubuntu-artful-kernel.git] / drivers / staging / rt2860 / common / cmm_sanity.c
1 /*
2 *************************************************************************
3 * Ralink Tech Inc.
4 * 5F., No.36, Taiyuan St., Jhubei City,
5 * Hsinchu County 302,
6 * Taiwan, R.O.C.
7 *
8 * (c) Copyright 2002-2007, Ralink Technology, Inc.
9 *
10 * This program is free software; you can redistribute it and/or modify *
11 * it under the terms of the GNU General Public License as published by *
12 * the Free Software Foundation; either version 2 of the License, or *
13 * (at your option) any later version. *
14 * *
15 * This program is distributed in the hope that it will be useful, *
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
18 * GNU General Public License for more details. *
19 * *
20 * You should have received a copy of the GNU General Public License *
21 * along with this program; if not, write to the *
22 * Free Software Foundation, Inc., *
23 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
24 * *
25 *************************************************************************
26
27 Module Name:
28 sanity.c
29
30 Abstract:
31
32 Revision History:
33 Who When What
34 -------- ---------- ----------------------------------------------
35 John Chang 2004-09-01 add WMM support
36 */
37 #include "../rt_config.h"
38
39 extern u8 CISCO_OUI[];
40
41 extern u8 WPA_OUI[];
42 extern u8 RSN_OUI[];
43 extern u8 WME_INFO_ELEM[];
44 extern u8 WME_PARM_ELEM[];
45 extern u8 Ccx2QosInfo[];
46 extern u8 RALINK_OUI[];
47 extern u8 BROADCOM_OUI[];
48 extern u8 WPS_OUI[];
49
50 /*
51 ==========================================================================
52 Description:
53 MLME message sanity check
54 Return:
55 TRUE if all parameters are OK, FALSE otherwise
56
57 IRQL = DISPATCH_LEVEL
58
59 ==========================================================================
60 */
61 BOOLEAN MlmeAddBAReqSanity(struct rt_rtmp_adapter *pAd,
62 void * Msg, unsigned long MsgLen, u8 *pAddr2)
63 {
64 struct rt_mlme_addba_req *pInfo;
65
66 pInfo = (struct rt_mlme_addba_req *)Msg;
67
68 if ((MsgLen != sizeof(struct rt_mlme_addba_req))) {
69 DBGPRINT(RT_DEBUG_TRACE,
70 ("MlmeAddBAReqSanity fail - message length not correct.\n"));
71 return FALSE;
72 }
73
74 if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE)) {
75 DBGPRINT(RT_DEBUG_TRACE,
76 ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
77 return FALSE;
78 }
79
80 if ((pInfo->pAddr[0] & 0x01) == 0x01) {
81 DBGPRINT(RT_DEBUG_TRACE,
82 ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
83 return FALSE;
84 }
85
86 return TRUE;
87 }
88
89 /*
90 ==========================================================================
91 Description:
92 MLME message sanity check
93 Return:
94 TRUE if all parameters are OK, FALSE otherwise
95
96 IRQL = DISPATCH_LEVEL
97
98 ==========================================================================
99 */
100 BOOLEAN MlmeDelBAReqSanity(struct rt_rtmp_adapter *pAd, void * Msg, unsigned long MsgLen)
101 {
102 struct rt_mlme_delba_req *pInfo;
103 pInfo = (struct rt_mlme_delba_req *)Msg;
104
105 if ((MsgLen != sizeof(struct rt_mlme_delba_req))) {
106 DBGPRINT(RT_DEBUG_ERROR,
107 ("MlmeDelBAReqSanity fail - message length not correct.\n"));
108 return FALSE;
109 }
110
111 if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE)) {
112 DBGPRINT(RT_DEBUG_ERROR,
113 ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
114 return FALSE;
115 }
116
117 if ((pInfo->TID & 0xf0)) {
118 DBGPRINT(RT_DEBUG_ERROR,
119 ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
120 return FALSE;
121 }
122
123 if (NdisEqualMemory
124 (pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr,
125 MAC_ADDR_LEN) == 0) {
126 DBGPRINT(RT_DEBUG_ERROR,
127 ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
128 return FALSE;
129 }
130
131 return TRUE;
132 }
133
134 BOOLEAN PeerAddBAReqActionSanity(struct rt_rtmp_adapter *pAd,
135 void * pMsg,
136 unsigned long MsgLen, u8 *pAddr2)
137 {
138 struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) pMsg;
139 struct rt_frame_addba_req * pAddFrame;
140 pAddFrame = (struct rt_frame_addba_req *) (pMsg);
141 if (MsgLen < (sizeof(struct rt_frame_addba_req))) {
142 DBGPRINT(RT_DEBUG_ERROR,
143 ("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n",
144 MsgLen));
145 return FALSE;
146 }
147 /* we support immediate BA. */
148 *(u16 *) (&pAddFrame->BaParm) =
149 cpu2le16(*(u16 *) (&pAddFrame->BaParm));
150 pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
151 pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
152
153 if (pAddFrame->BaParm.BAPolicy != IMMED_BA) {
154 DBGPRINT(RT_DEBUG_ERROR,
155 ("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n",
156 pAddFrame->BaParm.BAPolicy));
157 DBGPRINT(RT_DEBUG_ERROR,
158 ("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n",
159 pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize,
160 pAddFrame->BaParm.AMSDUSupported));
161 return FALSE;
162 }
163 /* we support immediate BA. */
164 if (pAddFrame->BaParm.TID & 0xfff0) {
165 DBGPRINT(RT_DEBUG_ERROR,
166 ("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n",
167 pAddFrame->BaParm.TID));
168 return FALSE;
169 }
170 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
171 return TRUE;
172 }
173
174 BOOLEAN PeerAddBARspActionSanity(struct rt_rtmp_adapter *pAd,
175 void * pMsg, unsigned long MsgLen)
176 {
177 struct rt_frame_addba_rsp * pAddFrame;
178
179 pAddFrame = (struct rt_frame_addba_rsp *) (pMsg);
180 if (MsgLen < (sizeof(struct rt_frame_addba_rsp))) {
181 DBGPRINT(RT_DEBUG_ERROR,
182 ("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n",
183 MsgLen));
184 return FALSE;
185 }
186 /* we support immediate BA. */
187 *(u16 *) (&pAddFrame->BaParm) =
188 cpu2le16(*(u16 *) (&pAddFrame->BaParm));
189 pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
190 pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
191
192 if (pAddFrame->BaParm.BAPolicy != IMMED_BA) {
193 DBGPRINT(RT_DEBUG_ERROR,
194 ("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n",
195 pAddFrame->BaParm.BAPolicy));
196 return FALSE;
197 }
198 /* we support immediate BA. */
199 if (pAddFrame->BaParm.TID & 0xfff0) {
200 DBGPRINT(RT_DEBUG_ERROR,
201 ("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n",
202 pAddFrame->BaParm.TID));
203 return FALSE;
204 }
205 return TRUE;
206
207 }
208
209 BOOLEAN PeerDelBAActionSanity(struct rt_rtmp_adapter *pAd,
210 u8 Wcid, void * pMsg, unsigned long MsgLen)
211 {
212 /*struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *)pMsg; */
213 struct rt_frame_delba_req * pDelFrame;
214 if (MsgLen != (sizeof(struct rt_frame_delba_req)))
215 return FALSE;
216
217 if (Wcid >= MAX_LEN_OF_MAC_TABLE)
218 return FALSE;
219
220 pDelFrame = (struct rt_frame_delba_req *) (pMsg);
221
222 *(u16 *) (&pDelFrame->DelbaParm) =
223 cpu2le16(*(u16 *) (&pDelFrame->DelbaParm));
224 pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
225
226 if (pDelFrame->DelbaParm.TID & 0xfff0)
227 return FALSE;
228
229 return TRUE;
230 }
231
232 /*
233 ==========================================================================
234 Description:
235 MLME message sanity check
236 Return:
237 TRUE if all parameters are OK, FALSE otherwise
238
239 IRQL = DISPATCH_LEVEL
240
241 ==========================================================================
242 */
243 BOOLEAN PeerBeaconAndProbeRspSanity(struct rt_rtmp_adapter *pAd, void * Msg, unsigned long MsgLen, u8 MsgChannel, u8 *pAddr2, u8 *pBssid, char Ssid[], u8 * pSsidLen, u8 * pBssType, u16 * pBeaconPeriod, u8 * pChannel, u8 * pNewChannel, OUT LARGE_INTEGER * pTimestamp, struct rt_cf_parm * pCfParm, u16 * pAtimWin, u16 * pCapabilityInfo, u8 * pErp, u8 * pDtimCount, u8 * pDtimPeriod, u8 * pBcastFlag, u8 * pMessageToMe, u8 SupRate[], u8 * pSupRateLen, u8 ExtRate[], u8 * pExtRateLen, u8 * pCkipFlag, u8 * pAironetCellPowerLimit, struct rt_edca_parm *pEdcaParm, struct rt_qbss_load_parm *pQbssLoad, struct rt_qos_capability_parm *pQosCapability, unsigned long * pRalinkIe, u8 * pHtCapabilityLen, u8 * pPreNHtCapabilityLen, struct rt_ht_capability_ie * pHtCapability, u8 * AddHtInfoLen, struct rt_add_ht_info_ie * AddHtInfo, u8 * NewExtChannelOffset, /* Ht extension channel offset(above or below) */
244 u16 * LengthVIE,
245 struct rt_ndis_802_11_variable_ies *pVIE)
246 {
247 u8 *Ptr;
248 u8 TimLen;
249 struct rt_frame_802_11 * pFrame;
250 struct rt_eid * pEid;
251 u8 SubType;
252 u8 Sanity;
253 /*u8 ECWMin, ECWMax; */
254 /*MAC_CSR9_STRUC Csr9; */
255 unsigned long Length = 0;
256
257 /* For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel */
258 /* 1. If the AP is 11n enabled, then check the control channel. */
259 /* 2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!) */
260 u8 CtrlChannel = 0;
261
262 /* Add for 3 necessary EID field check */
263 Sanity = 0;
264
265 *pAtimWin = 0;
266 *pErp = 0;
267 *pDtimCount = 0;
268 *pDtimPeriod = 0;
269 *pBcastFlag = 0;
270 *pMessageToMe = 0;
271 *pExtRateLen = 0;
272 *pCkipFlag = 0; /* Default of CkipFlag is 0 */
273 *pAironetCellPowerLimit = 0xFF; /* Default of AironetCellPowerLimit is 0xFF */
274 *LengthVIE = 0; /* Set the length of VIE to init value 0 */
275 *pHtCapabilityLen = 0; /* Set the length of VIE to init value 0 */
276 if (pAd->OpMode == OPMODE_STA)
277 *pPreNHtCapabilityLen = 0; /* Set the length of VIE to init value 0 */
278 *AddHtInfoLen = 0; /* Set the length of VIE to init value 0 */
279 *pRalinkIe = 0;
280 *pNewChannel = 0;
281 *NewExtChannelOffset = 0xff; /*Default 0xff means no such IE */
282 pCfParm->bValid = FALSE; /* default: no IE_CF found */
283 pQbssLoad->bValid = FALSE; /* default: no IE_QBSS_LOAD found */
284 pEdcaParm->bValid = FALSE; /* default: no IE_EDCA_PARAMETER found */
285 pQosCapability->bValid = FALSE; /* default: no IE_QOS_CAPABILITY found */
286
287 pFrame = (struct rt_frame_802_11 *) Msg;
288
289 /* get subtype from header */
290 SubType = (u8)pFrame->Hdr.FC.SubType;
291
292 /* get Addr2 and BSSID from header */
293 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
294 COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
295
296 Ptr = pFrame->Octet;
297 Length += LENGTH_802_11;
298
299 /* get timestamp from payload and advance the pointer */
300 NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
301
302 pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
303 pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
304
305 Ptr += TIMESTAMP_LEN;
306 Length += TIMESTAMP_LEN;
307
308 /* get beacon interval from payload and advance the pointer */
309 NdisMoveMemory(pBeaconPeriod, Ptr, 2);
310 Ptr += 2;
311 Length += 2;
312
313 /* get capability info from payload and advance the pointer */
314 NdisMoveMemory(pCapabilityInfo, Ptr, 2);
315 Ptr += 2;
316 Length += 2;
317
318 if (CAP_IS_ESS_ON(*pCapabilityInfo))
319 *pBssType = BSS_INFRA;
320 else
321 *pBssType = BSS_ADHOC;
322
323 pEid = (struct rt_eid *) Ptr;
324
325 /* get variable fields from payload and advance the pointer */
326 while ((Length + 2 + pEid->Len) <= MsgLen) {
327 /* */
328 /* Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow. */
329 /* */
330 if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN) {
331 DBGPRINT(RT_DEBUG_WARN,
332 ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
333 (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
334 break;
335 }
336
337 switch (pEid->Eid) {
338 case IE_SSID:
339 /* Already has one SSID EID in this beacon, ignore the second one */
340 if (Sanity & 0x1)
341 break;
342 if (pEid->Len <= MAX_LEN_OF_SSID) {
343 NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
344 *pSsidLen = pEid->Len;
345 Sanity |= 0x1;
346 } else {
347 DBGPRINT(RT_DEBUG_TRACE,
348 ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",
349 pEid->Len));
350 return FALSE;
351 }
352 break;
353
354 case IE_SUPP_RATES:
355 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) {
356 Sanity |= 0x2;
357 NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
358 *pSupRateLen = pEid->Len;
359
360 /* TODO: 2004-09-14 not a good design here, cause it exclude extra rates */
361 /* from ScanTab. We should report as is. And filter out unsupported */
362 /* rates in MlmeAux. */
363 /* Check against the supported rates */
364 /* RTMPCheckRates(pAd, SupRate, pSupRateLen); */
365 } else {
366 DBGPRINT(RT_DEBUG_TRACE,
367 ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",
368 pEid->Len));
369 return FALSE;
370 }
371 break;
372
373 case IE_HT_CAP:
374 if (pEid->Len >= SIZE_HT_CAP_IE) /*Note: allow extension! */
375 {
376 NdisMoveMemory(pHtCapability, pEid->Octet,
377 sizeof(struct rt_ht_capability_ie));
378 *pHtCapabilityLen = SIZE_HT_CAP_IE; /* Nnow we only support 26 bytes. */
379
380 *(u16 *) (&pHtCapability->HtCapInfo) =
381 cpu2le16(*(u16 *)
382 (&pHtCapability->HtCapInfo));
383 *(u16 *) (&pHtCapability->ExtHtCapInfo) =
384 cpu2le16(*(u16 *)
385 (&pHtCapability->ExtHtCapInfo));
386
387 {
388 *pPreNHtCapabilityLen = 0; /* Nnow we only support 26 bytes. */
389
390 Ptr = (u8 *)pVIE;
391 NdisMoveMemory(Ptr + *LengthVIE,
392 &pEid->Eid,
393 pEid->Len + 2);
394 *LengthVIE += (pEid->Len + 2);
395 }
396 } else {
397 DBGPRINT(RT_DEBUG_WARN,
398 ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n",
399 pEid->Len));
400 }
401
402 break;
403 case IE_ADD_HT:
404 if (pEid->Len >= sizeof(struct rt_add_ht_info_ie)) {
405 /* This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only */
406 /* copy first sizeof(struct rt_add_ht_info_ie) */
407 NdisMoveMemory(AddHtInfo, pEid->Octet,
408 sizeof(struct rt_add_ht_info_ie));
409 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
410
411 CtrlChannel = AddHtInfo->ControlChan;
412
413 *(u16 *) (&AddHtInfo->AddHtInfo2) =
414 cpu2le16(*(u16 *)
415 (&AddHtInfo->AddHtInfo2));
416 *(u16 *) (&AddHtInfo->AddHtInfo3) =
417 cpu2le16(*(u16 *)
418 (&AddHtInfo->AddHtInfo3));
419
420 {
421 Ptr = (u8 *)pVIE;
422 NdisMoveMemory(Ptr + *LengthVIE,
423 &pEid->Eid,
424 pEid->Len + 2);
425 *LengthVIE += (pEid->Len + 2);
426 }
427 } else {
428 DBGPRINT(RT_DEBUG_WARN,
429 ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
430 }
431
432 break;
433 case IE_SECONDARY_CH_OFFSET:
434 if (pEid->Len == 1) {
435 *NewExtChannelOffset = pEid->Octet[0];
436 } else {
437 DBGPRINT(RT_DEBUG_WARN,
438 ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
439 }
440
441 break;
442 case IE_FH_PARM:
443 DBGPRINT(RT_DEBUG_TRACE,
444 ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
445 break;
446
447 case IE_DS_PARM:
448 if (pEid->Len == 1) {
449 *pChannel = *pEid->Octet;
450
451 {
452 if (ChannelSanity(pAd, *pChannel) == 0) {
453
454 return FALSE;
455 }
456 }
457
458 Sanity |= 0x4;
459 } else {
460 DBGPRINT(RT_DEBUG_TRACE,
461 ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",
462 pEid->Len));
463 return FALSE;
464 }
465 break;
466
467 case IE_CF_PARM:
468 if (pEid->Len == 6) {
469 pCfParm->bValid = TRUE;
470 pCfParm->CfpCount = pEid->Octet[0];
471 pCfParm->CfpPeriod = pEid->Octet[1];
472 pCfParm->CfpMaxDuration =
473 pEid->Octet[2] + 256 * pEid->Octet[3];
474 pCfParm->CfpDurRemaining =
475 pEid->Octet[4] + 256 * pEid->Octet[5];
476 } else {
477 DBGPRINT(RT_DEBUG_TRACE,
478 ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
479 return FALSE;
480 }
481 break;
482
483 case IE_IBSS_PARM:
484 if (pEid->Len == 2) {
485 NdisMoveMemory(pAtimWin, pEid->Octet,
486 pEid->Len);
487 } else {
488 DBGPRINT(RT_DEBUG_TRACE,
489 ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
490 return FALSE;
491 }
492 break;
493
494 case IE_TIM:
495 if (INFRA_ON(pAd) && SubType == SUBTYPE_BEACON) {
496 GetTimBit((char *)pEid, pAd->StaActive.Aid,
497 &TimLen, pBcastFlag, pDtimCount,
498 pDtimPeriod, pMessageToMe);
499 }
500 break;
501 case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
502 if (pEid->Len == 3) {
503 *pNewChannel = pEid->Octet[1]; /*extract new channel number */
504 }
505 break;
506
507 /* New for WPA */
508 /* CCX v2 has the same IE, we need to parse that too */
509 /* Wifi WMM use the same IE vale, need to parse that too */
510 /* case IE_WPA: */
511 case IE_VENDOR_SPECIFIC:
512 /* Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE. */
513 /* This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan. */
514 /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
515 {
516 if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
517 {
518 {
519 NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(struct rt_ht_capability_ie));
520 *pHtCapabilityLen = SIZE_HT_CAP_IE; // Nnow we only support 26 bytes.
521 }
522 }
523 if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
524 {
525 {
526 NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(struct rt_add_ht_info_ie));
527 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE; // Nnow we only support 26 bytes.
528 }
529 }
530 }
531 */
532 /* Check the OUI version, filter out non-standard usage */
533 if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3)
534 && (pEid->Len == 7)) {
535 /**pRalinkIe = pEid->Octet[3]; */
536 if (pEid->Octet[3] != 0)
537 *pRalinkIe = pEid->Octet[3];
538 else
539 *pRalinkIe = 0xf0000000; /* Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag. */
540 }
541 /* This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan. */
542
543 /* Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP, */
544 /* Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE */
545 else if ((*pHtCapabilityLen == 0)
546 && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI,
547 3) && (pEid->Len >= 4)
548 && (pAd->OpMode == OPMODE_STA)) {
549 if ((pEid->Octet[3] == OUI_PREN_HT_CAP)
550 && (pEid->Len >= 30)
551 && (*pHtCapabilityLen == 0)) {
552 NdisMoveMemory(pHtCapability,
553 &pEid->Octet[4],
554 sizeof
555 (struct rt_ht_capability_ie));
556 *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
557 }
558
559 if ((pEid->Octet[3] == OUI_PREN_ADD_HT)
560 && (pEid->Len >= 26)) {
561 NdisMoveMemory(AddHtInfo,
562 &pEid->Octet[4],
563 sizeof(struct rt_add_ht_info_ie));
564 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
565 }
566 } else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4)) {
567 /* Copy to pVIE which will report to microsoft bssid list. */
568 Ptr = (u8 *)pVIE;
569 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid,
570 pEid->Len + 2);
571 *LengthVIE += (pEid->Len + 2);
572 } else
573 if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6)
574 && (pEid->Len == 24)) {
575 u8 *ptr;
576 int i;
577
578 /* parsing EDCA parameters */
579 pEdcaParm->bValid = TRUE;
580 pEdcaParm->bQAck = FALSE; /* pEid->Octet[0] & 0x10; */
581 pEdcaParm->bQueueRequest = FALSE; /* pEid->Octet[0] & 0x20; */
582 pEdcaParm->bTxopRequest = FALSE; /* pEid->Octet[0] & 0x40; */
583 pEdcaParm->EdcaUpdateCount =
584 pEid->Octet[6] & 0x0f;
585 pEdcaParm->bAPSDCapable =
586 (pEid->Octet[6] & 0x80) ? 1 : 0;
587 ptr = &pEid->Octet[8];
588 for (i = 0; i < 4; i++) {
589 u8 aci = (*ptr & 0x60) >> 5; /* b5~6 is AC INDEX */
590 pEdcaParm->bACM[aci] = (((*ptr) & 0x10) == 0x10); /* b5 is ACM */
591 pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f; /* b0~3 is AIFSN */
592 pEdcaParm->Cwmin[aci] = *(ptr + 1) & 0x0f; /* b0~4 is Cwmin */
593 pEdcaParm->Cwmax[aci] = *(ptr + 1) >> 4; /* b5~8 is Cwmax */
594 pEdcaParm->Txop[aci] = *(ptr + 2) + 256 * (*(ptr + 3)); /* in unit of 32-us */
595 ptr += 4; /* point to next AC */
596 }
597 } else
598 if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6)
599 && (pEid->Len == 7)) {
600 /* parsing EDCA parameters */
601 pEdcaParm->bValid = TRUE;
602 pEdcaParm->bQAck = FALSE; /* pEid->Octet[0] & 0x10; */
603 pEdcaParm->bQueueRequest = FALSE; /* pEid->Octet[0] & 0x20; */
604 pEdcaParm->bTxopRequest = FALSE; /* pEid->Octet[0] & 0x40; */
605 pEdcaParm->EdcaUpdateCount =
606 pEid->Octet[6] & 0x0f;
607 pEdcaParm->bAPSDCapable =
608 (pEid->Octet[6] & 0x80) ? 1 : 0;
609
610 /* use default EDCA parameter */
611 pEdcaParm->bACM[QID_AC_BE] = 0;
612 pEdcaParm->Aifsn[QID_AC_BE] = 3;
613 pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
614 pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
615 pEdcaParm->Txop[QID_AC_BE] = 0;
616
617 pEdcaParm->bACM[QID_AC_BK] = 0;
618 pEdcaParm->Aifsn[QID_AC_BK] = 7;
619 pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
620 pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
621 pEdcaParm->Txop[QID_AC_BK] = 0;
622
623 pEdcaParm->bACM[QID_AC_VI] = 0;
624 pEdcaParm->Aifsn[QID_AC_VI] = 2;
625 pEdcaParm->Cwmin[QID_AC_VI] =
626 CW_MIN_IN_BITS - 1;
627 pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
628 pEdcaParm->Txop[QID_AC_VI] = 96; /* AC_VI: 96*32us ~= 3ms */
629
630 pEdcaParm->bACM[QID_AC_VO] = 0;
631 pEdcaParm->Aifsn[QID_AC_VO] = 2;
632 pEdcaParm->Cwmin[QID_AC_VO] =
633 CW_MIN_IN_BITS - 2;
634 pEdcaParm->Cwmax[QID_AC_VO] =
635 CW_MAX_IN_BITS - 1;
636 pEdcaParm->Txop[QID_AC_VO] = 48; /* AC_VO: 48*32us ~= 1.5ms */
637 }
638
639 break;
640
641 case IE_EXT_SUPP_RATES:
642 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) {
643 NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
644 *pExtRateLen = pEid->Len;
645
646 /* TODO: 2004-09-14 not a good design here, cause it exclude extra rates */
647 /* from ScanTab. We should report as is. And filter out unsupported */
648 /* rates in MlmeAux. */
649 /* Check against the supported rates */
650 /* RTMPCheckRates(pAd, ExtRate, pExtRateLen); */
651 }
652 break;
653
654 case IE_ERP:
655 if (pEid->Len == 1) {
656 *pErp = (u8)pEid->Octet[0];
657 }
658 break;
659
660 case IE_AIRONET_CKIP:
661 /* 0. Check Aironet IE length, it must be larger or equal to 28 */
662 /* Cisco AP350 used length as 28 */
663 /* Cisco AP12XX used length as 30 */
664 if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
665 break;
666
667 /* 1. Copy CKIP flag byte to buffer for process */
668 *pCkipFlag = *(pEid->Octet + 8);
669 break;
670
671 case IE_AP_TX_POWER:
672 /* AP Control of Client Transmit Power */
673 /*0. Check Aironet IE length, it must be 6 */
674 if (pEid->Len != 0x06)
675 break;
676
677 /* Get cell power limit in dBm */
678 if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
679 *pAironetCellPowerLimit = *(pEid->Octet + 4);
680 break;
681
682 /* WPA2 & 802.11i RSN */
683 case IE_RSN:
684 /* There is no OUI for version anymore, check the group cipher OUI before copying */
685 if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3)) {
686 /* Copy to pVIE which will report to microsoft bssid list. */
687 Ptr = (u8 *)pVIE;
688 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid,
689 pEid->Len + 2);
690 *LengthVIE += (pEid->Len + 2);
691 }
692 break;
693
694 default:
695 break;
696 }
697
698 Length = Length + 2 + pEid->Len; /* Eid[1] + Len[1]+ content[Len] */
699 pEid = (struct rt_eid *) ((u8 *) pEid + 2 + pEid->Len);
700 }
701
702 /* For some 11a AP. it did not have the channel EID, patch here */
703 {
704 u8 LatchRfChannel = MsgChannel;
705 if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0)) {
706 if (CtrlChannel != 0)
707 *pChannel = CtrlChannel;
708 else
709 *pChannel = LatchRfChannel;
710 Sanity |= 0x4;
711 }
712 }
713
714 if (Sanity != 0x7) {
715 DBGPRINT(RT_DEBUG_LOUD,
716 ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n",
717 Sanity));
718 return FALSE;
719 } else {
720 return TRUE;
721 }
722
723 }
724
725 /*
726 ==========================================================================
727 Description:
728 MLME message sanity check
729 Return:
730 TRUE if all parameters are OK, FALSE otherwise
731 ==========================================================================
732 */
733 BOOLEAN MlmeScanReqSanity(struct rt_rtmp_adapter *pAd,
734 void * Msg,
735 unsigned long MsgLen,
736 u8 * pBssType,
737 char Ssid[],
738 u8 * pSsidLen, u8 * pScanType)
739 {
740 struct rt_mlme_scan_req *Info;
741
742 Info = (struct rt_mlme_scan_req *)(Msg);
743 *pBssType = Info->BssType;
744 *pSsidLen = Info->SsidLen;
745 NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
746 *pScanType = Info->ScanType;
747
748 if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC
749 || *pBssType == BSS_ANY)
750 && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE)) {
751 return TRUE;
752 } else {
753 DBGPRINT(RT_DEBUG_TRACE,
754 ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
755 return FALSE;
756 }
757 }
758
759 /* IRQL = DISPATCH_LEVEL */
760 u8 ChannelSanity(struct rt_rtmp_adapter *pAd, u8 channel)
761 {
762 int i;
763
764 for (i = 0; i < pAd->ChannelListNum; i++) {
765 if (channel == pAd->ChannelList[i].Channel)
766 return 1;
767 }
768 return 0;
769 }
770
771 /*
772 ==========================================================================
773 Description:
774 MLME message sanity check
775 Return:
776 TRUE if all parameters are OK, FALSE otherwise
777
778 IRQL = DISPATCH_LEVEL
779
780 ==========================================================================
781 */
782 BOOLEAN PeerDeauthSanity(struct rt_rtmp_adapter *pAd,
783 void * Msg,
784 unsigned long MsgLen,
785 u8 *pAddr2, u16 * pReason)
786 {
787 struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
788
789 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
790 NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
791
792 return TRUE;
793 }
794
795 /*
796 ==========================================================================
797 Description:
798 MLME message sanity check
799 Return:
800 TRUE if all parameters are OK, FALSE otherwise
801
802 IRQL = DISPATCH_LEVEL
803
804 ==========================================================================
805 */
806 BOOLEAN PeerAuthSanity(struct rt_rtmp_adapter *pAd,
807 void * Msg,
808 unsigned long MsgLen,
809 u8 *pAddr,
810 u16 * pAlg,
811 u16 * pSeq,
812 u16 * pStatus, char * pChlgText)
813 {
814 struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
815
816 COPY_MAC_ADDR(pAddr, pFrame->Hdr.Addr2);
817 NdisMoveMemory(pAlg, &pFrame->Octet[0], 2);
818 NdisMoveMemory(pSeq, &pFrame->Octet[2], 2);
819 NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
820
821 if (*pAlg == AUTH_MODE_OPEN) {
822 if (*pSeq == 1 || *pSeq == 2) {
823 return TRUE;
824 } else {
825 DBGPRINT(RT_DEBUG_TRACE,
826 ("PeerAuthSanity fail - wrong Seg#\n"));
827 return FALSE;
828 }
829 } else if (*pAlg == AUTH_MODE_KEY) {
830 if (*pSeq == 1 || *pSeq == 4) {
831 return TRUE;
832 } else if (*pSeq == 2 || *pSeq == 3) {
833 NdisMoveMemory(pChlgText, &pFrame->Octet[8],
834 CIPHER_TEXT_LEN);
835 return TRUE;
836 } else {
837 DBGPRINT(RT_DEBUG_TRACE,
838 ("PeerAuthSanity fail - wrong Seg#\n"));
839 return FALSE;
840 }
841 } else {
842 DBGPRINT(RT_DEBUG_TRACE,
843 ("PeerAuthSanity fail - wrong algorithm\n"));
844 return FALSE;
845 }
846 }
847
848 /*
849 ==========================================================================
850 Description:
851 MLME message sanity check
852 Return:
853 TRUE if all parameters are OK, FALSE otherwise
854 ==========================================================================
855 */
856 BOOLEAN MlmeAuthReqSanity(struct rt_rtmp_adapter *pAd,
857 void * Msg,
858 unsigned long MsgLen,
859 u8 *pAddr,
860 unsigned long * pTimeout, u16 * pAlg)
861 {
862 struct rt_mlme_auth_req *pInfo;
863
864 pInfo = (struct rt_mlme_auth_req *)Msg;
865 COPY_MAC_ADDR(pAddr, pInfo->Addr);
866 *pTimeout = pInfo->Timeout;
867 *pAlg = pInfo->Alg;
868
869 if (((*pAlg == AUTH_MODE_KEY) || (*pAlg == AUTH_MODE_OPEN)
870 ) && ((*pAddr & 0x01) == 0)) {
871 return TRUE;
872 } else {
873 DBGPRINT(RT_DEBUG_TRACE,
874 ("MlmeAuthReqSanity fail - wrong algorithm\n"));
875 return FALSE;
876 }
877 }
878
879 /*
880 ==========================================================================
881 Description:
882 MLME message sanity check
883 Return:
884 TRUE if all parameters are OK, FALSE otherwise
885
886 IRQL = DISPATCH_LEVEL
887
888 ==========================================================================
889 */
890 BOOLEAN MlmeAssocReqSanity(struct rt_rtmp_adapter *pAd,
891 void * Msg,
892 unsigned long MsgLen,
893 u8 *pApAddr,
894 u16 * pCapabilityInfo,
895 unsigned long * pTimeout, u16 * pListenIntv)
896 {
897 struct rt_mlme_assoc_req *pInfo;
898
899 pInfo = (struct rt_mlme_assoc_req *)Msg;
900 *pTimeout = pInfo->Timeout; /* timeout */
901 COPY_MAC_ADDR(pApAddr, pInfo->Addr); /* AP address */
902 *pCapabilityInfo = pInfo->CapabilityInfo; /* capability info */
903 *pListenIntv = pInfo->ListenIntv;
904
905 return TRUE;
906 }
907
908 /*
909 ==========================================================================
910 Description:
911 MLME message sanity check
912 Return:
913 TRUE if all parameters are OK, FALSE otherwise
914
915 IRQL = DISPATCH_LEVEL
916
917 ==========================================================================
918 */
919 BOOLEAN PeerDisassocSanity(struct rt_rtmp_adapter *pAd,
920 void * Msg,
921 unsigned long MsgLen,
922 u8 *pAddr2, u16 * pReason)
923 {
924 struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
925
926 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
927 NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
928
929 return TRUE;
930 }
931
932 /*
933 ========================================================================
934 Routine Description:
935 Sanity check NetworkType (11b, 11g or 11a)
936
937 Arguments:
938 pBss - Pointer to BSS table.
939
940 Return Value:
941 Ndis802_11DS .......(11b)
942 Ndis802_11OFDM24....(11g)
943 Ndis802_11OFDM5.....(11a)
944
945 IRQL = DISPATCH_LEVEL
946
947 ========================================================================
948 */
949 NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(struct rt_bss_entry *pBss)
950 {
951 NDIS_802_11_NETWORK_TYPE NetWorkType;
952 u8 rate, i;
953
954 NetWorkType = Ndis802_11DS;
955
956 if (pBss->Channel <= 14) {
957 /* */
958 /* First check support Rate. */
959 /* */
960 for (i = 0; i < pBss->SupRateLen; i++) {
961 rate = pBss->SupRate[i] & 0x7f; /* Mask out basic rate set bit */
962 if ((rate == 2) || (rate == 4) || (rate == 11)
963 || (rate == 22)) {
964 continue;
965 } else {
966 /* */
967 /* Otherwise (even rate > 108) means Ndis802_11OFDM24 */
968 /* */
969 NetWorkType = Ndis802_11OFDM24;
970 break;
971 }
972 }
973
974 /* */
975 /* Second check Extend Rate. */
976 /* */
977 if (NetWorkType != Ndis802_11OFDM24) {
978 for (i = 0; i < pBss->ExtRateLen; i++) {
979 rate = pBss->SupRate[i] & 0x7f; /* Mask out basic rate set bit */
980 if ((rate == 2) || (rate == 4) || (rate == 11)
981 || (rate == 22)) {
982 continue;
983 } else {
984 /* */
985 /* Otherwise (even rate > 108) means Ndis802_11OFDM24 */
986 /* */
987 NetWorkType = Ndis802_11OFDM24;
988 break;
989 }
990 }
991 }
992 } else {
993 NetWorkType = Ndis802_11OFDM5;
994 }
995
996 if (pBss->HtCapabilityLen != 0) {
997 if (NetWorkType == Ndis802_11OFDM5)
998 NetWorkType = Ndis802_11OFDM5_N;
999 else
1000 NetWorkType = Ndis802_11OFDM24_N;
1001 }
1002
1003 return NetWorkType;
1004 }
1005
1006 /*
1007 ==========================================================================
1008 Description:
1009 Check the validity of the received EAPoL frame
1010 Return:
1011 TRUE if all parameters are OK,
1012 FALSE otherwise
1013 ==========================================================================
1014 */
1015 BOOLEAN PeerWpaMessageSanity(struct rt_rtmp_adapter *pAd,
1016 struct rt_eapol_packet * pMsg,
1017 unsigned long MsgLen,
1018 u8 MsgType, struct rt_mac_table_entry *pEntry)
1019 {
1020 u8 mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
1021 BOOLEAN bReplayDiff = FALSE;
1022 BOOLEAN bWPA2 = FALSE;
1023 struct rt_key_info EapolKeyInfo;
1024 u8 GroupKeyIndex = 0;
1025
1026 NdisZeroMemory(mic, sizeof(mic));
1027 NdisZeroMemory(digest, sizeof(digest));
1028 NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
1029 NdisZeroMemory((u8 *)& EapolKeyInfo, sizeof(EapolKeyInfo));
1030
1031 NdisMoveMemory((u8 *)& EapolKeyInfo,
1032 (u8 *)& pMsg->KeyDesc.KeyInfo, sizeof(struct rt_key_info));
1033
1034 *((u16 *) & EapolKeyInfo) = cpu2le16(*((u16 *) & EapolKeyInfo));
1035
1036 /* Choose WPA2 or not */
1037 if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2)
1038 || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
1039 bWPA2 = TRUE;
1040
1041 /* 0. Check MsgType */
1042 if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1)) {
1043 DBGPRINT(RT_DEBUG_ERROR,
1044 ("The message type is invalid(%d)! \n", MsgType));
1045 return FALSE;
1046 }
1047 /* 1. Replay counter check */
1048 if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) /* For supplicant */
1049 {
1050 /* First validate replay counter, only accept message with larger replay counter. */
1051 /* Let equal pass, some AP start with all zero replay counter */
1052 u8 ZeroReplay[LEN_KEY_DESC_REPLAY];
1053
1054 NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
1055 if ((RTMPCompareMemory
1056 (pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter,
1057 LEN_KEY_DESC_REPLAY) != 1)
1058 &&
1059 (RTMPCompareMemory
1060 (pMsg->KeyDesc.ReplayCounter, ZeroReplay,
1061 LEN_KEY_DESC_REPLAY) != 0)) {
1062 bReplayDiff = TRUE;
1063 }
1064 } else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2) /* For authenticator */
1065 {
1066 /* check Replay Counter coresponds to MSG from authenticator, otherwise discard */
1067 if (!NdisEqualMemory
1068 (pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter,
1069 LEN_KEY_DESC_REPLAY)) {
1070 bReplayDiff = TRUE;
1071 }
1072 }
1073 /* Replay Counter different condition */
1074 if (bReplayDiff) {
1075 /* send wireless event - for replay counter different */
1076 if (pAd->CommonCfg.bWirelessEvent)
1077 RTMPSendWirelessEvent(pAd,
1078 IW_REPLAY_COUNTER_DIFF_EVENT_FLAG,
1079 pEntry->Addr, pEntry->apidx, 0);
1080
1081 if (MsgType < EAPOL_GROUP_MSG_1) {
1082 DBGPRINT(RT_DEBUG_ERROR,
1083 ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n",
1084 MsgType));
1085 } else {
1086 DBGPRINT(RT_DEBUG_ERROR,
1087 ("Replay Counter Different in group msg %d of 2-way handshake!\n",
1088 (MsgType - EAPOL_PAIR_MSG_4)));
1089 }
1090
1091 hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter,
1092 LEN_KEY_DESC_REPLAY);
1093 hex_dump("Current replay counter ", pEntry->R_Counter,
1094 LEN_KEY_DESC_REPLAY);
1095 return FALSE;
1096 }
1097 /* 2. Verify MIC except Pairwise Msg1 */
1098 if (MsgType != EAPOL_PAIR_MSG_1) {
1099 u8 rcvd_mic[LEN_KEY_DESC_MIC];
1100
1101 /* Record the received MIC for check later */
1102 NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic,
1103 LEN_KEY_DESC_MIC);
1104 NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1105
1106 if (EapolKeyInfo.KeyDescVer == DESC_TYPE_TKIP) /* TKIP */
1107 {
1108 HMAC_MD5(pEntry->PTK, LEN_EAP_MICK, (u8 *)pMsg,
1109 MsgLen, mic, MD5_DIGEST_SIZE);
1110 } else if (EapolKeyInfo.KeyDescVer == DESC_TYPE_AES) /* AES */
1111 {
1112 HMAC_SHA1(pEntry->PTK, LEN_EAP_MICK, (u8 *)pMsg,
1113 MsgLen, digest, SHA1_DIGEST_SIZE);
1114 NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
1115 }
1116
1117 if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC)) {
1118 /* send wireless event - for MIC different */
1119 if (pAd->CommonCfg.bWirelessEvent)
1120 RTMPSendWirelessEvent(pAd,
1121 IW_MIC_DIFF_EVENT_FLAG,
1122 pEntry->Addr,
1123 pEntry->apidx, 0);
1124
1125 if (MsgType < EAPOL_GROUP_MSG_1) {
1126 DBGPRINT(RT_DEBUG_ERROR,
1127 ("MIC Different in pairwise msg %d of 4-way handshake!\n",
1128 MsgType));
1129 } else {
1130 DBGPRINT(RT_DEBUG_ERROR,
1131 ("MIC Different in group msg %d of 2-way handshake!\n",
1132 (MsgType - EAPOL_PAIR_MSG_4)));
1133 }
1134
1135 hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
1136 hex_dump("Desired MIC", mic, LEN_KEY_DESC_MIC);
1137
1138 return FALSE;
1139 }
1140 }
1141 /* 1. Decrypt the Key Data field if GTK is included. */
1142 /* 2. Extract the context of the Key Data field if it exist. */
1143 /* The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is clear. */
1144 /* The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted. */
1145 if (CONV_ARRARY_TO_u16(pMsg->KeyDesc.KeyDataLen) > 0) {
1146 /* Decrypt this field */
1147 if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2)
1148 || (MsgType == EAPOL_GROUP_MSG_1)) {
1149 if ((EapolKeyInfo.KeyDescVer == DESC_TYPE_AES)) {
1150 /* AES */
1151 AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA,
1152 CONV_ARRARY_TO_u16(pMsg->
1153 KeyDesc.
1154 KeyDataLen),
1155 pMsg->KeyDesc.KeyData);
1156 } else {
1157 int i;
1158 u8 Key[32];
1159 /* Decrypt TKIP GTK */
1160 /* Construct 32 bytes RC4 Key */
1161 NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
1162 NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
1163 ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key,
1164 32);
1165 /*discard first 256 bytes */
1166 for (i = 0; i < 256; i++)
1167 ARCFOUR_BYTE(&pAd->PrivateInfo.
1168 WEPCONTEXT);
1169 /* Decrypt GTK. Becareful, there is no ICV to check the result is correct or not */
1170 ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT,
1171 KEYDATA, pMsg->KeyDesc.KeyData,
1172 CONV_ARRARY_TO_u16(pMsg->
1173 KeyDesc.
1174 KeyDataLen));
1175 }
1176
1177 if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
1178 GroupKeyIndex = EapolKeyInfo.KeyIndex;
1179
1180 } else if ((MsgType == EAPOL_PAIR_MSG_2)
1181 || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2)) {
1182 NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData,
1183 CONV_ARRARY_TO_u16(pMsg->KeyDesc.
1184 KeyDataLen));
1185 } else {
1186
1187 return TRUE;
1188 }
1189
1190 /* Parse Key Data field to */
1191 /* 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2) */
1192 /* 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2 */
1193 /* 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2) */
1194 if (!RTMPParseEapolKeyData(pAd, KEYDATA,
1195 CONV_ARRARY_TO_u16(pMsg->KeyDesc.
1196 KeyDataLen),
1197 GroupKeyIndex, MsgType, bWPA2,
1198 pEntry)) {
1199 return FALSE;
1200 }
1201 }
1202
1203 return TRUE;
1204
1205 }
Ubuntu Artful kernel mirror