diff options
Diffstat (limited to 'drivers/staging/rt2860/common/cmm_sanity.c')
| -rw-r--r-- | drivers/staging/rt2860/common/cmm_sanity.c | 1205 |
1 files changed, 0 insertions, 1205 deletions
diff --git a/drivers/staging/rt2860/common/cmm_sanity.c b/drivers/staging/rt2860/common/cmm_sanity.c deleted file mode 100644 index 3bfb4ad00c1a..000000000000 --- a/drivers/staging/rt2860/common/cmm_sanity.c +++ /dev/null @@ -1,1205 +0,0 @@ -/* - ************************************************************************* - * Ralink Tech Inc. - * 5F., No.36, Taiyuan St., Jhubei City, - * Hsinchu County 302, - * Taiwan, R.O.C. - * - * (c) Copyright 2002-2007, Ralink Technology, Inc. - * - * This program is free software; you can redistribute it and/or modify * - * it under the terms of the GNU General Public License as published by * - * the Free Software Foundation; either version 2 of the License, or * - * (at your option) any later version. * - * * - * This program is distributed in the hope that it will be useful, * - * but WITHOUT ANY WARRANTY; without even the implied warranty of * - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * - * GNU General Public License for more details. * - * * - * You should have received a copy of the GNU General Public License * - * along with this program; if not, write to the * - * Free Software Foundation, Inc., * - * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. * - * * - ************************************************************************* - - Module Name: - sanity.c - - Abstract: - - Revision History: - Who When What - -------- ---------- ---------------------------------------------- - John Chang 2004-09-01 add WMM support -*/ -#include "../rt_config.h" - -extern u8 CISCO_OUI[]; - -extern u8 WPA_OUI[]; -extern u8 RSN_OUI[]; -extern u8 WME_INFO_ELEM[]; -extern u8 WME_PARM_ELEM[]; -extern u8 Ccx2QosInfo[]; -extern u8 RALINK_OUI[]; -extern u8 BROADCOM_OUI[]; -extern u8 WPS_OUI[]; - -/* - ========================================================================== - Description: - MLME message sanity check - Return: - TRUE if all parameters are OK, FALSE otherwise - - IRQL = DISPATCH_LEVEL - - ========================================================================== - */ -BOOLEAN MlmeAddBAReqSanity(struct rt_rtmp_adapter *pAd, - void * Msg, unsigned long MsgLen, u8 *pAddr2) -{ - struct rt_mlme_addba_req *pInfo; - - pInfo = (struct rt_mlme_addba_req *)Msg; - - if ((MsgLen != sizeof(struct rt_mlme_addba_req))) { - DBGPRINT(RT_DEBUG_TRACE, - ("MlmeAddBAReqSanity fail - message length not correct.\n")); - return FALSE; - } - - if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE)) { - DBGPRINT(RT_DEBUG_TRACE, - ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n")); - return FALSE; - } - - if ((pInfo->pAddr[0] & 0x01) == 0x01) { - DBGPRINT(RT_DEBUG_TRACE, - ("MlmeAddBAReqSanity fail - broadcast address not support BA\n")); - return FALSE; - } - - return TRUE; -} - -/* - ========================================================================== - Description: - MLME message sanity check - Return: - TRUE if all parameters are OK, FALSE otherwise - - IRQL = DISPATCH_LEVEL - - ========================================================================== - */ -BOOLEAN MlmeDelBAReqSanity(struct rt_rtmp_adapter *pAd, void * Msg, unsigned long MsgLen) -{ - struct rt_mlme_delba_req *pInfo; - pInfo = (struct rt_mlme_delba_req *)Msg; - - if ((MsgLen != sizeof(struct rt_mlme_delba_req))) { - DBGPRINT(RT_DEBUG_ERROR, - ("MlmeDelBAReqSanity fail - message length not correct.\n")); - return FALSE; - } - - if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE)) { - DBGPRINT(RT_DEBUG_ERROR, - ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n")); - return FALSE; - } - - if ((pInfo->TID & 0xf0)) { - DBGPRINT(RT_DEBUG_ERROR, - ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n")); - return FALSE; - } - - if (NdisEqualMemory - (pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr, - MAC_ADDR_LEN) == 0) { - DBGPRINT(RT_DEBUG_ERROR, - ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n")); - return FALSE; - } - - return TRUE; -} - -BOOLEAN PeerAddBAReqActionSanity(struct rt_rtmp_adapter *pAd, - void * pMsg, - unsigned long MsgLen, u8 *pAddr2) -{ - struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) pMsg; - struct rt_frame_addba_req * pAddFrame; - pAddFrame = (struct rt_frame_addba_req *) (pMsg); - if (MsgLen < (sizeof(struct rt_frame_addba_req))) { - DBGPRINT(RT_DEBUG_ERROR, - ("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n", - MsgLen)); - return FALSE; - } - /* we support immediate BA. */ - *(u16 *) (&pAddFrame->BaParm) = - cpu2le16(*(u16 *) (&pAddFrame->BaParm)); - pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue); - pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word); - - if (pAddFrame->BaParm.BAPolicy != IMMED_BA) { - DBGPRINT(RT_DEBUG_ERROR, - ("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n", - pAddFrame->BaParm.BAPolicy)); - DBGPRINT(RT_DEBUG_ERROR, - ("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n", - pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize, - pAddFrame->BaParm.AMSDUSupported)); - return FALSE; - } - /* we support immediate BA. */ - if (pAddFrame->BaParm.TID & 0xfff0) { - DBGPRINT(RT_DEBUG_ERROR, - ("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n", - pAddFrame->BaParm.TID)); - return FALSE; - } - COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2); - return TRUE; -} - -BOOLEAN PeerAddBARspActionSanity(struct rt_rtmp_adapter *pAd, - void * pMsg, unsigned long MsgLen) -{ - struct rt_frame_addba_rsp * pAddFrame; - - pAddFrame = (struct rt_frame_addba_rsp *) (pMsg); - if (MsgLen < (sizeof(struct rt_frame_addba_rsp))) { - DBGPRINT(RT_DEBUG_ERROR, - ("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n", - MsgLen)); - return FALSE; - } - /* we support immediate BA. */ - *(u16 *) (&pAddFrame->BaParm) = - cpu2le16(*(u16 *) (&pAddFrame->BaParm)); - pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode); - pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue); - - if (pAddFrame->BaParm.BAPolicy != IMMED_BA) { - DBGPRINT(RT_DEBUG_ERROR, - ("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n", - pAddFrame->BaParm.BAPolicy)); - return FALSE; - } - /* we support immediate BA. */ - if (pAddFrame->BaParm.TID & 0xfff0) { - DBGPRINT(RT_DEBUG_ERROR, - ("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n", - pAddFrame->BaParm.TID)); - return FALSE; - } - return TRUE; - -} - -BOOLEAN PeerDelBAActionSanity(struct rt_rtmp_adapter *pAd, - u8 Wcid, void * pMsg, unsigned long MsgLen) -{ - /*struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *)pMsg; */ - struct rt_frame_delba_req * pDelFrame; - if (MsgLen != (sizeof(struct rt_frame_delba_req))) - return FALSE; - - if (Wcid >= MAX_LEN_OF_MAC_TABLE) - return FALSE; - - pDelFrame = (struct rt_frame_delba_req *) (pMsg); - - *(u16 *) (&pDelFrame->DelbaParm) = - cpu2le16(*(u16 *) (&pDelFrame->DelbaParm)); - pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode); - - if (pDelFrame->DelbaParm.TID & 0xfff0) - return FALSE; - - return TRUE; -} - -/* - ========================================================================== - Description: - MLME message sanity check - Return: - TRUE if all parameters are OK, FALSE otherwise - - IRQL = DISPATCH_LEVEL - - ========================================================================== - */ -BOOLEAN PeerBeaconAndProbeRspSanity(struct rt_rtmp_adapter *pAd, void * Msg, unsigned long MsgLen, u8 MsgChannel, u8 *pAddr2, u8 *pBssid, char Ssid[], u8 * pSsidLen, u8 * pBssType, u16 * pBeaconPeriod, u8 * pChannel, u8 * pNewChannel, OUT LARGE_INTEGER * pTimestamp, struct rt_cf_parm * pCfParm, u16 * pAtimWin, u16 * pCapabilityInfo, u8 * pErp, u8 * pDtimCount, u8 * pDtimPeriod, u8 * pBcastFlag, u8 * pMessageToMe, u8 SupRate[], u8 * pSupRateLen, u8 ExtRate[], u8 * pExtRateLen, u8 * pCkipFlag, u8 * pAironetCellPowerLimit, struct rt_edca_parm *pEdcaParm, struct rt_qbss_load_parm *pQbssLoad, struct rt_qos_capability_parm *pQosCapability, unsigned long * pRalinkIe, u8 * pHtCapabilityLen, u8 * pPreNHtCapabilityLen, struct rt_ht_capability_ie * pHtCapability, u8 * AddHtInfoLen, struct rt_add_ht_info_ie * AddHtInfo, u8 * NewExtChannelOffset, /* Ht extension channel offset(above or below) */ - u16 * LengthVIE, - struct rt_ndis_802_11_variable_ies *pVIE) -{ - u8 *Ptr; - u8 TimLen; - struct rt_frame_802_11 * pFrame; - struct rt_eid * pEid; - u8 SubType; - u8 Sanity; - /*u8 ECWMin, ECWMax; */ - /*MAC_CSR9_STRUC Csr9; */ - unsigned long Length = 0; - - /* For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel */ - /* 1. If the AP is 11n enabled, then check the control channel. */ - /* 2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!) */ - u8 CtrlChannel = 0; - - /* Add for 3 necessary EID field check */ - Sanity = 0; - - *pAtimWin = 0; - *pErp = 0; - *pDtimCount = 0; - *pDtimPeriod = 0; - *pBcastFlag = 0; - *pMessageToMe = 0; - *pExtRateLen = 0; - *pCkipFlag = 0; /* Default of CkipFlag is 0 */ - *pAironetCellPowerLimit = 0xFF; /* Default of AironetCellPowerLimit is 0xFF */ - *LengthVIE = 0; /* Set the length of VIE to init value 0 */ - *pHtCapabilityLen = 0; /* Set the length of VIE to init value 0 */ - if (pAd->OpMode == OPMODE_STA) - *pPreNHtCapabilityLen = 0; /* Set the length of VIE to init value 0 */ - *AddHtInfoLen = 0; /* Set the length of VIE to init value 0 */ - *pRalinkIe = 0; - *pNewChannel = 0; - *NewExtChannelOffset = 0xff; /*Default 0xff means no such IE */ - pCfParm->bValid = FALSE; /* default: no IE_CF found */ - pQbssLoad->bValid = FALSE; /* default: no IE_QBSS_LOAD found */ - pEdcaParm->bValid = FALSE; /* default: no IE_EDCA_PARAMETER found */ - pQosCapability->bValid = FALSE; /* default: no IE_QOS_CAPABILITY found */ - - pFrame = (struct rt_frame_802_11 *) Msg; - - /* get subtype from header */ - SubType = (u8)pFrame->Hdr.FC.SubType; - - /* get Addr2 and BSSID from header */ - COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2); - COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3); - - Ptr = pFrame->Octet; - Length += LENGTH_802_11; - - /* get timestamp from payload and advance the pointer */ - NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN); - - pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart); - pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart); - - Ptr += TIMESTAMP_LEN; - Length += TIMESTAMP_LEN; - - /* get beacon interval from payload and advance the pointer */ - NdisMoveMemory(pBeaconPeriod, Ptr, 2); - Ptr += 2; - Length += 2; - - /* get capability info from payload and advance the pointer */ - NdisMoveMemory(pCapabilityInfo, Ptr, 2); - Ptr += 2; - Length += 2; - - if (CAP_IS_ESS_ON(*pCapabilityInfo)) - *pBssType = BSS_INFRA; - else - *pBssType = BSS_ADHOC; - - pEid = (struct rt_eid *) Ptr; - - /* get variable fields from payload and advance the pointer */ - while ((Length + 2 + pEid->Len) <= MsgLen) { - /* */ - /* Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow. */ - /* */ - if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN) { - DBGPRINT(RT_DEBUG_WARN, - ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n", - (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN)); - break; - } - - switch (pEid->Eid) { - case IE_SSID: - /* Already has one SSID EID in this beacon, ignore the second one */ - if (Sanity & 0x1) - break; - if (pEid->Len <= MAX_LEN_OF_SSID) { - NdisMoveMemory(Ssid, pEid->Octet, pEid->Len); - *pSsidLen = pEid->Len; - Sanity |= 0x1; - } else { - DBGPRINT(RT_DEBUG_TRACE, - ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n", - pEid->Len)); - return FALSE; - } - break; - - case IE_SUPP_RATES: - if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) { - Sanity |= 0x2; - NdisMoveMemory(SupRate, pEid->Octet, pEid->Len); - *pSupRateLen = pEid->Len; - - /* TODO: 2004-09-14 not a good design here, cause it exclude extra rates */ - /* from ScanTab. We should report as is. And filter out unsupported */ - /* rates in MlmeAux. */ - /* Check against the supported rates */ - /* RTMPCheckRates(pAd, SupRate, pSupRateLen); */ - } else { - DBGPRINT(RT_DEBUG_TRACE, - ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n", - pEid->Len)); - return FALSE; - } - break; - - case IE_HT_CAP: - if (pEid->Len >= SIZE_HT_CAP_IE) /*Note: allow extension! */ - { - NdisMoveMemory(pHtCapability, pEid->Octet, - sizeof(struct rt_ht_capability_ie)); - *pHtCapabilityLen = SIZE_HT_CAP_IE; /* Nnow we only support 26 bytes. */ - - *(u16 *) (&pHtCapability->HtCapInfo) = - cpu2le16(*(u16 *) - (&pHtCapability->HtCapInfo)); - *(u16 *) (&pHtCapability->ExtHtCapInfo) = - cpu2le16(*(u16 *) - (&pHtCapability->ExtHtCapInfo)); - - { - *pPreNHtCapabilityLen = 0; /* Nnow we only support 26 bytes. */ - - Ptr = (u8 *)pVIE; - NdisMoveMemory(Ptr + *LengthVIE, - &pEid->Eid, - pEid->Len + 2); - *LengthVIE += (pEid->Len + 2); - } - } else { - DBGPRINT(RT_DEBUG_WARN, - ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n", - pEid->Len)); - } - - break; - case IE_ADD_HT: - if (pEid->Len >= sizeof(struct rt_add_ht_info_ie)) { - /* This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only */ - /* copy first sizeof(struct rt_add_ht_info_ie) */ - NdisMoveMemory(AddHtInfo, pEid->Octet, - sizeof(struct rt_add_ht_info_ie)); - *AddHtInfoLen = SIZE_ADD_HT_INFO_IE; - - CtrlChannel = AddHtInfo->ControlChan; - - *(u16 *) (&AddHtInfo->AddHtInfo2) = - cpu2le16(*(u16 *) - (&AddHtInfo->AddHtInfo2)); - *(u16 *) (&AddHtInfo->AddHtInfo3) = - cpu2le16(*(u16 *) - (&AddHtInfo->AddHtInfo3)); - - { - Ptr = (u8 *)pVIE; - NdisMoveMemory(Ptr + *LengthVIE, - &pEid->Eid, - pEid->Len + 2); - *LengthVIE += (pEid->Len + 2); - } - } else { - DBGPRINT(RT_DEBUG_WARN, - ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n")); - } - - break; - case IE_SECONDARY_CH_OFFSET: - if (pEid->Len == 1) { - *NewExtChannelOffset = pEid->Octet[0]; - } else { - DBGPRINT(RT_DEBUG_WARN, - ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n")); - } - - break; - case IE_FH_PARM: - DBGPRINT(RT_DEBUG_TRACE, - ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n")); - break; - - case IE_DS_PARM: - if (pEid->Len == 1) { - *pChannel = *pEid->Octet; - - { - if (ChannelSanity(pAd, *pChannel) == 0) { - - return FALSE; - } - } - - Sanity |= 0x4; - } else { - DBGPRINT(RT_DEBUG_TRACE, - ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n", - pEid->Len)); - return FALSE; - } - break; - - case IE_CF_PARM: - if (pEid->Len == 6) { - pCfParm->bValid = TRUE; - pCfParm->CfpCount = pEid->Octet[0]; - pCfParm->CfpPeriod = pEid->Octet[1]; - pCfParm->CfpMaxDuration = - pEid->Octet[2] + 256 * pEid->Octet[3]; - pCfParm->CfpDurRemaining = - pEid->Octet[4] + 256 * pEid->Octet[5]; - } else { - DBGPRINT(RT_DEBUG_TRACE, - ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n")); - return FALSE; - } - break; - - case IE_IBSS_PARM: - if (pEid->Len == 2) { - NdisMoveMemory(pAtimWin, pEid->Octet, - pEid->Len); - } else { - DBGPRINT(RT_DEBUG_TRACE, - ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n")); - return FALSE; - } - break; - - case IE_TIM: - if (INFRA_ON(pAd) && SubType == SUBTYPE_BEACON) { - GetTimBit((char *)pEid, pAd->StaActive.Aid, - &TimLen, pBcastFlag, pDtimCount, - pDtimPeriod, pMessageToMe); - } - break; - case IE_CHANNEL_SWITCH_ANNOUNCEMENT: - if (pEid->Len == 3) { - *pNewChannel = pEid->Octet[1]; /*extract new channel number */ - } - break; - - /* New for WPA */ - /* CCX v2 has the same IE, we need to parse that too */ - /* Wifi WMM use the same IE vale, need to parse that too */ - /* case IE_WPA: */ - case IE_VENDOR_SPECIFIC: - /* Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE. */ - /* This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan. */ - /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4)) - { - if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30)) - { - { - NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(struct rt_ht_capability_ie)); - *pHtCapabilityLen = SIZE_HT_CAP_IE; // Nnow we only support 26 bytes. - } - } - if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26)) - { - { - NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(struct rt_add_ht_info_ie)); - *AddHtInfoLen = SIZE_ADD_HT_INFO_IE; // Nnow we only support 26 bytes. - } - } - } - */ - /* Check the OUI version, filter out non-standard usage */ - if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3) - && (pEid->Len == 7)) { - /**pRalinkIe = pEid->Octet[3]; */ - if (pEid->Octet[3] != 0) - *pRalinkIe = pEid->Octet[3]; - else - *pRalinkIe = 0xf0000000; /* Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag. */ - } - /* This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan. */ - - /* Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP, */ - /* Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE */ - else if ((*pHtCapabilityLen == 0) - && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI, - 3) && (pEid->Len >= 4) - && (pAd->OpMode == OPMODE_STA)) { - if ((pEid->Octet[3] == OUI_PREN_HT_CAP) - && (pEid->Len >= 30) - && (*pHtCapabilityLen == 0)) { - NdisMoveMemory(pHtCapability, - &pEid->Octet[4], - sizeof - (struct rt_ht_capability_ie)); - *pPreNHtCapabilityLen = SIZE_HT_CAP_IE; - } - - if ((pEid->Octet[3] == OUI_PREN_ADD_HT) - && (pEid->Len >= 26)) { - NdisMoveMemory(AddHtInfo, - &pEid->Octet[4], - sizeof(struct rt_add_ht_info_ie)); - *AddHtInfoLen = SIZE_ADD_HT_INFO_IE; - } - } else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4)) { - /* Copy to pVIE which will report to microsoft bssid list. */ - Ptr = (u8 *)pVIE; - NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, - pEid->Len + 2); - *LengthVIE += (pEid->Len + 2); - } else - if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) - && (pEid->Len == 24)) { - u8 *ptr; - int i; - - /* parsing EDCA parameters */ - pEdcaParm->bValid = TRUE; - pEdcaParm->bQAck = FALSE; /* pEid->Octet[0] & 0x10; */ - pEdcaParm->bQueueRequest = FALSE; /* pEid->Octet[0] & 0x20; */ - pEdcaParm->bTxopRequest = FALSE; /* pEid->Octet[0] & 0x40; */ - pEdcaParm->EdcaUpdateCount = - pEid->Octet[6] & 0x0f; - pEdcaParm->bAPSDCapable = - (pEid->Octet[6] & 0x80) ? 1 : 0; - ptr = &pEid->Octet[8]; - for (i = 0; i < 4; i++) { - u8 aci = (*ptr & 0x60) >> 5; /* b5~6 is AC INDEX */ - pEdcaParm->bACM[aci] = (((*ptr) & 0x10) == 0x10); /* b5 is ACM */ - pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f; /* b0~3 is AIFSN */ - pEdcaParm->Cwmin[aci] = *(ptr + 1) & 0x0f; /* b0~4 is Cwmin */ - pEdcaParm->Cwmax[aci] = *(ptr + 1) >> 4; /* b5~8 is Cwmax */ - pEdcaParm->Txop[aci] = *(ptr + 2) + 256 * (*(ptr + 3)); /* in unit of 32-us */ - ptr += 4; /* point to next AC */ - } - } else - if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6) - && (pEid->Len == 7)) { - /* parsing EDCA parameters */ - pEdcaParm->bValid = TRUE; - pEdcaParm->bQAck = FALSE; /* pEid->Octet[0] & 0x10; */ - pEdcaParm->bQueueRequest = FALSE; /* pEid->Octet[0] & 0x20; */ - pEdcaParm->bTxopRequest = FALSE; /* pEid->Octet[0] & 0x40; */ - pEdcaParm->EdcaUpdateCount = - pEid->Octet[6] & 0x0f; - pEdcaParm->bAPSDCapable = - (pEid->Octet[6] & 0x80) ? 1 : 0; - - /* use default EDCA parameter */ - pEdcaParm->bACM[QID_AC_BE] = 0; - pEdcaParm->Aifsn[QID_AC_BE] = 3; - pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS; - pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS; - pEdcaParm->Txop[QID_AC_BE] = 0; - - pEdcaParm->bACM[QID_AC_BK] = 0; - pEdcaParm->Aifsn[QID_AC_BK] = 7; - pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS; - pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS; - pEdcaParm->Txop[QID_AC_BK] = 0; - - pEdcaParm->bACM[QID_AC_VI] = 0; - pEdcaParm->Aifsn[QID_AC_VI] = 2; - pEdcaParm->Cwmin[QID_AC_VI] = - CW_MIN_IN_BITS - 1; - pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS; - pEdcaParm->Txop[QID_AC_VI] = 96; /* AC_VI: 96*32us ~= 3ms */ - - pEdcaParm->bACM[QID_AC_VO] = 0; - pEdcaParm->Aifsn[QID_AC_VO] = 2; - pEdcaParm->Cwmin[QID_AC_VO] = - CW_MIN_IN_BITS - 2; - pEdcaParm->Cwmax[QID_AC_VO] = - CW_MAX_IN_BITS - 1; - pEdcaParm->Txop[QID_AC_VO] = 48; /* AC_VO: 48*32us ~= 1.5ms */ - } - - break; - - case IE_EXT_SUPP_RATES: - if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) { - NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len); - *pExtRateLen = pEid->Len; - - /* TODO: 2004-09-14 not a good design here, cause it exclude extra rates */ - /* from ScanTab. We should report as is. And filter out unsupported */ - /* rates in MlmeAux. */ - /* Check against the supported rates */ - /* RTMPCheckRates(pAd, ExtRate, pExtRateLen); */ - } - break; - - case IE_ERP: - if (pEid->Len == 1) { - *pErp = (u8)pEid->Octet[0]; - } - break; - - case IE_AIRONET_CKIP: - /* 0. Check Aironet IE length, it must be larger or equal to 28 */ - /* Cisco AP350 used length as 28 */ - /* Cisco AP12XX used length as 30 */ - if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2)) - break; - - /* 1. Copy CKIP flag byte to buffer for process */ - *pCkipFlag = *(pEid->Octet + 8); - break; - - case IE_AP_TX_POWER: - /* AP Control of Client Transmit Power */ - /*0. Check Aironet IE length, it must be 6 */ - if (pEid->Len != 0x06) - break; - - /* Get cell power limit in dBm */ - if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1) - *pAironetCellPowerLimit = *(pEid->Octet + 4); - break; - - /* WPA2 & 802.11i RSN */ - case IE_RSN: - /* There is no OUI for version anymore, check the group cipher OUI before copying */ - if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3)) { - /* Copy to pVIE which will report to microsoft bssid list. */ - Ptr = (u8 *)pVIE; - NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, - pEid->Len + 2); - *LengthVIE += (pEid->Len + 2); - } - break; - - default: - break; - } - - Length = Length + 2 + pEid->Len; /* Eid[1] + Len[1]+ content[Len] */ - pEid = (struct rt_eid *) ((u8 *) pEid + 2 + pEid->Len); - } - - /* For some 11a AP. it did not have the channel EID, patch here */ - { - u8 LatchRfChannel = MsgChannel; - if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0)) { - if (CtrlChannel != 0) - *pChannel = CtrlChannel; - else - *pChannel = LatchRfChannel; - Sanity |= 0x4; - } - } - - if (Sanity != 0x7) { - DBGPRINT(RT_DEBUG_LOUD, - ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n", - Sanity)); - return FALSE; - } else { - return TRUE; - } - -} - -/* - ========================================================================== - Description: - MLME message sanity check - Return: - TRUE if all parameters are OK, FALSE otherwise - ========================================================================== - */ -BOOLEAN MlmeScanReqSanity(struct rt_rtmp_adapter *pAd, - void * Msg, - unsigned long MsgLen, - u8 * pBssType, - char Ssid[], - u8 * pSsidLen, u8 * pScanType) -{ - struct rt_mlme_scan_req *Info; - - Info = (struct rt_mlme_scan_req *)(Msg); - *pBssType = Info->BssType; - *pSsidLen = Info->SsidLen; - NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen); - *pScanType = Info->ScanType; - - if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC - || *pBssType == BSS_ANY) - && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE)) { - return TRUE; - } else { - DBGPRINT(RT_DEBUG_TRACE, - ("MlmeScanReqSanity fail - wrong BssType or ScanType\n")); - return FALSE; - } -} - -/* IRQL = DISPATCH_LEVEL */ -u8 ChannelSanity(struct rt_rtmp_adapter *pAd, u8 channel) -{ - int i; - - for (i = 0; i < pAd->ChannelListNum; i++) { - if (channel == pAd->ChannelList[i].Channel) - return 1; - } - return 0; -} - -/* - ========================================================================== - Description: - MLME message sanity check - Return: - TRUE if all parameters are OK, FALSE otherwise - - IRQL = DISPATCH_LEVEL - - ========================================================================== - */ -BOOLEAN PeerDeauthSanity(struct rt_rtmp_adapter *pAd, - void * Msg, - unsigned long MsgLen, - u8 *pAddr2, u16 * pReason) -{ - struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg; - - COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2); - NdisMoveMemory(pReason, &pFrame->Octet[0], 2); - - return TRUE; -} - -/* - ========================================================================== - Description: - MLME message sanity check - Return: - TRUE if all parameters are OK, FALSE otherwise - - IRQL = DISPATCH_LEVEL - - ========================================================================== - */ -BOOLEAN PeerAuthSanity(struct rt_rtmp_adapter *pAd, - void * Msg, - unsigned long MsgLen, - u8 *pAddr, - u16 * pAlg, - u16 * pSeq, - u16 * pStatus, char * pChlgText) -{ - struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg; - - COPY_MAC_ADDR(pAddr, pFrame->Hdr.Addr2); - NdisMoveMemory(pAlg, &pFrame->Octet[0], 2); - NdisMoveMemory(pSeq, &pFrame->Octet[2], 2); - NdisMoveMemory(pStatus, &pFrame->Octet[4], 2); - - if (*pAlg == AUTH_MODE_OPEN) { - if (*pSeq == 1 || *pSeq == 2) { - return TRUE; - } else { - DBGPRINT(RT_DEBUG_TRACE, - ("PeerAuthSanity fail - wrong Seg#\n")); - return FALSE; - } - } else if (*pAlg == AUTH_MODE_KEY) { - if (*pSeq == 1 || *pSeq == 4) { - return TRUE; - } else if (*pSeq == 2 || *pSeq == 3) { - NdisMoveMemory(pChlgText, &pFrame->Octet[8], - CIPHER_TEXT_LEN); - return TRUE; - } else { - DBGPRINT(RT_DEBUG_TRACE, - ("PeerAuthSanity fail - wrong Seg#\n")); - return FALSE; - } - } else { - DBGPRINT(RT_DEBUG_TRACE, - ("PeerAuthSanity fail - wrong algorithm\n")); - return FALSE; - } -} - -/* - ========================================================================== - Description: - MLME message sanity check - Return: - TRUE if all parameters are OK, FALSE otherwise - ========================================================================== - */ -BOOLEAN MlmeAuthReqSanity(struct rt_rtmp_adapter *pAd, - void * Msg, - unsigned long MsgLen, - u8 *pAddr, - unsigned long * pTimeout, u16 * pAlg) -{ - struct rt_mlme_auth_req *pInfo; - - pInfo = (struct rt_mlme_auth_req *)Msg; - COPY_MAC_ADDR(pAddr, pInfo->Addr); - *pTimeout = pInfo->Timeout; - *pAlg = pInfo->Alg; - - if (((*pAlg == AUTH_MODE_KEY) || (*pAlg == AUTH_MODE_OPEN) - ) && ((*pAddr & 0x01) == 0)) { - return TRUE; - } else { - DBGPRINT(RT_DEBUG_TRACE, - ("MlmeAuthReqSanity fail - wrong algorithm\n")); - return FALSE; - } -} - -/* - ========================================================================== - Description: - MLME message sanity check - Return: - TRUE if all parameters are OK, FALSE otherwise - - IRQL = DISPATCH_LEVEL - - ========================================================================== - */ -BOOLEAN MlmeAssocReqSanity(struct rt_rtmp_adapter *pAd, - void * Msg, - unsigned long MsgLen, - u8 *pApAddr, - u16 * pCapabilityInfo, - unsigned long * pTimeout, u16 * pListenIntv) -{ - struct rt_mlme_assoc_req *pInfo; - - pInfo = (struct rt_mlme_assoc_req *)Msg; - *pTimeout = pInfo->Timeout; /* timeout */ - COPY_MAC_ADDR(pApAddr, pInfo->Addr); /* AP address */ - *pCapabilityInfo = pInfo->CapabilityInfo; /* capability info */ - *pListenIntv = pInfo->ListenIntv; - - return TRUE; -} - -/* - ========================================================================== - Description: - MLME message sanity check - Return: - TRUE if all parameters are OK, FALSE otherwise - - IRQL = DISPATCH_LEVEL - - ========================================================================== - */ -BOOLEAN PeerDisassocSanity(struct rt_rtmp_adapter *pAd, - void * Msg, - unsigned long MsgLen, - u8 *pAddr2, u16 * pReason) -{ - struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg; - - COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2); - NdisMoveMemory(pReason, &pFrame->Octet[0], 2); - - return TRUE; -} - -/* - ======================================================================== - Routine Description: - Sanity check NetworkType (11b, 11g or 11a) - - Arguments: - pBss - Pointer to BSS table. - - Return Value: - Ndis802_11DS .......(11b) - Ndis802_11OFDM24....(11g) - Ndis802_11OFDM5.....(11a) - - IRQL = DISPATCH_LEVEL - - ======================================================================== -*/ -NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(struct rt_bss_entry *pBss) -{ - NDIS_802_11_NETWORK_TYPE NetWorkType; - u8 rate, i; - - NetWorkType = Ndis802_11DS; - - if (pBss->Channel <= 14) { - /* */ - /* First check support Rate. */ - /* */ - for (i = 0; i < pBss->SupRateLen; i++) { - rate = pBss->SupRate[i] & 0x7f; /* Mask out basic rate set bit */ - if ((rate == 2) || (rate == 4) || (rate == 11) - || (rate == 22)) { - continue; - } else { - /* */ - /* Otherwise (even rate > 108) means Ndis802_11OFDM24 */ - /* */ - NetWorkType = Ndis802_11OFDM24; - break; - } - } - - /* */ - /* Second check Extend Rate. */ - /* */ - if (NetWorkType != Ndis802_11OFDM24) { - for (i = 0; i < pBss->ExtRateLen; i++) { - rate = pBss->SupRate[i] & 0x7f; /* Mask out basic rate set bit */ - if ((rate == 2) || (rate == 4) || (rate == 11) - || (rate == 22)) { - continue; - } else { - /* */ - /* Otherwise (even rate > 108) means Ndis802_11OFDM24 */ - /* */ - NetWorkType = Ndis802_11OFDM24; - break; - } - } - } - } else { - NetWorkType = Ndis802_11OFDM5; - } - - if (pBss->HtCapabilityLen != 0) { - if (NetWorkType == Ndis802_11OFDM5) - NetWorkType = Ndis802_11OFDM5_N; - else - NetWorkType = Ndis802_11OFDM24_N; - } - - return NetWorkType; -} - -/* - ========================================================================== - Description: - Check the validity of the received EAPoL frame - Return: - TRUE if all parameters are OK, - FALSE otherwise - ========================================================================== - */ -BOOLEAN PeerWpaMessageSanity(struct rt_rtmp_adapter *pAd, - struct rt_eapol_packet * pMsg, - unsigned long MsgLen, - u8 MsgType, struct rt_mac_table_entry *pEntry) -{ - u8 mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE]; - BOOLEAN bReplayDiff = FALSE; - BOOLEAN bWPA2 = FALSE; - struct rt_key_info EapolKeyInfo; - u8 GroupKeyIndex = 0; - - NdisZeroMemory(mic, sizeof(mic)); - NdisZeroMemory(digest, sizeof(digest)); - NdisZeroMemory(KEYDATA, sizeof(KEYDATA)); - NdisZeroMemory((u8 *)& EapolKeyInfo, sizeof(EapolKeyInfo)); - - NdisMoveMemory((u8 *)& EapolKeyInfo, - (u8 *)& pMsg->KeyDesc.KeyInfo, sizeof(struct rt_key_info)); - - *((u16 *) & EapolKeyInfo) = cpu2le16(*((u16 *) & EapolKeyInfo)); - - /* Choose WPA2 or not */ - if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) - || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK)) - bWPA2 = TRUE; - - /* 0. Check MsgType */ - if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1)) { - DBGPRINT(RT_DEBUG_ERROR, - ("The message type is invalid(%d)! \n", MsgType)); - return FALSE; - } - /* 1. Replay counter check */ - if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) /* For supplicant */ - { - /* First validate replay counter, only accept message with larger replay counter. */ - /* Let equal pass, some AP start with all zero replay counter */ - u8 ZeroReplay[LEN_KEY_DESC_REPLAY]; - - NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY); - if ((RTMPCompareMemory - (pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, - LEN_KEY_DESC_REPLAY) != 1) - && - (RTMPCompareMemory - (pMsg->KeyDesc.ReplayCounter, ZeroReplay, - LEN_KEY_DESC_REPLAY) != 0)) { - bReplayDiff = TRUE; - } - } else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2) /* For authenticator */ - { - /* check Replay Counter coresponds to MSG from authenticator, otherwise discard */ - if (!NdisEqualMemory - (pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, - LEN_KEY_DESC_REPLAY)) { - bReplayDiff = TRUE; - } - } - /* Replay Counter different condition */ - if (bReplayDiff) { - /* send wireless event - for replay counter different */ - if (pAd->CommonCfg.bWirelessEvent) - RTMPSendWirelessEvent(pAd, - IW_REPLAY_COUNTER_DIFF_EVENT_FLAG, - pEntry->Addr, pEntry->apidx, 0); - - if (MsgType < EAPOL_GROUP_MSG_1) { - DBGPRINT(RT_DEBUG_ERROR, - ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n", - MsgType)); - } else { - DBGPRINT(RT_DEBUG_ERROR, - ("Replay Counter Different in group msg %d of 2-way handshake!\n", - (MsgType - EAPOL_PAIR_MSG_4))); - } - - hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter, - LEN_KEY_DESC_REPLAY); - hex_dump("Current replay counter ", pEntry->R_Counter, - LEN_KEY_DESC_REPLAY); - return FALSE; - } - /* 2. Verify MIC except Pairwise Msg1 */ - if (MsgType != EAPOL_PAIR_MSG_1) { - u8 rcvd_mic[LEN_KEY_DESC_MIC]; - - /* Record the received MIC for check later */ - NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic, - LEN_KEY_DESC_MIC); - NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC); - - if (EapolKeyInfo.KeyDescVer == DESC_TYPE_TKIP) /* TKIP */ - { - HMAC_MD5(pEntry->PTK, LEN_EAP_MICK, (u8 *)pMsg, - MsgLen, mic, MD5_DIGEST_SIZE); - } else if (EapolKeyInfo.KeyDescVer == DESC_TYPE_AES) /* AES */ - { - HMAC_SHA1(pEntry->PTK, LEN_EAP_MICK, (u8 *)pMsg, - MsgLen, digest, SHA1_DIGEST_SIZE); - NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC); - } - - if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC)) { - /* send wireless event - for MIC different */ - if (pAd->CommonCfg.bWirelessEvent) - RTMPSendWirelessEvent(pAd, - IW_MIC_DIFF_EVENT_FLAG, - pEntry->Addr, - pEntry->apidx, 0); - - if (MsgType < EAPOL_GROUP_MSG_1) { - DBGPRINT(RT_DEBUG_ERROR, - ("MIC Different in pairwise msg %d of 4-way handshake!\n", - MsgType)); - } else { - DBGPRINT(RT_DEBUG_ERROR, - ("MIC Different in group msg %d of 2-way handshake!\n", - (MsgType - EAPOL_PAIR_MSG_4))); - } - - hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC); - hex_dump("Desired MIC", mic, LEN_KEY_DESC_MIC); - - return FALSE; - } - } - /* 1. Decrypt the Key Data field if GTK is included. */ - /* 2. Extract the context of the Key Data field if it exist. */ - /* The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is clear. */ - /* The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted. */ - if (CONV_ARRARY_TO_u16(pMsg->KeyDesc.KeyDataLen) > 0) { - /* Decrypt this field */ - if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2) - || (MsgType == EAPOL_GROUP_MSG_1)) { - if ((EapolKeyInfo.KeyDescVer == DESC_TYPE_AES)) { - /* AES */ - AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA, - CONV_ARRARY_TO_u16(pMsg-> - KeyDesc. - KeyDataLen), - pMsg->KeyDesc.KeyData); - } else { - int i; - u8 Key[32]; - /* Decrypt TKIP GTK */ - /* Construct 32 bytes RC4 Key */ - NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16); - NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16); - ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, - 32); - /*discard first 256 bytes */ - for (i = 0; i < 256; i++) - ARCFOUR_BYTE(&pAd->PrivateInfo. - WEPCONTEXT); - /* Decrypt GTK. Becareful, there is no ICV to check the result is correct or not */ - ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, - KEYDATA, pMsg->KeyDesc.KeyData, - CONV_ARRARY_TO_u16(pMsg-> - KeyDesc. - KeyDataLen)); - } - - if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1)) - GroupKeyIndex = EapolKeyInfo.KeyIndex; - - } else if ((MsgType == EAPOL_PAIR_MSG_2) - || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2)) { - NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData, - CONV_ARRARY_TO_u16(pMsg->KeyDesc. - KeyDataLen)); - } else { - - return TRUE; - } - - /* Parse Key Data field to */ - /* 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2) */ - /* 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2 */ - /* 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2) */ - if (!RTMPParseEapolKeyData(pAd, KEYDATA, - CONV_ARRARY_TO_u16(pMsg->KeyDesc. - KeyDataLen), - GroupKeyIndex, MsgType, bWPA2, - pEntry)) { - return FALSE; - } - } - - return TRUE; - -} |