2 *************************************************************************
4 * 5F., No.36, Taiyuan St., Jhubei City,
8 * (c) Copyright 2002-2007, Ralink Technology, Inc.
10 * This program is free software; you can redistribute it and/or modify *
11 * it under the terms of the GNU General Public License as published by *
12 * the Free Software Foundation; either version 2 of the License, or *
13 * (at your option) any later version. *
15 * This program is distributed in the hope that it will be useful, *
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
18 * GNU General Public License for more details. *
20 * You should have received a copy of the GNU General Public License *
21 * along with this program; if not, write to the *
22 * Free Software Foundation, Inc., *
23 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 *************************************************************************
34 -------- ---------- ----------------------------------------------
35 John Chang 2004-09-01 add WMM support
37 #include "../rt_config.h"
39 extern UCHAR CISCO_OUI[];
41 extern UCHAR WPA_OUI[];
42 extern UCHAR RSN_OUI[];
43 extern UCHAR WME_INFO_ELEM[];
44 extern UCHAR WME_PARM_ELEM[];
45 extern UCHAR Ccx2QosInfo[];
46 extern UCHAR RALINK_OUI[];
47 extern UCHAR BROADCOM_OUI[];
48 extern UCHAR WPS_OUI[];
51 ==========================================================================
53 MLME message sanity check
55 TRUE if all parameters are OK, FALSE otherwise
59 ==========================================================================
61 BOOLEAN MlmeAddBAReqSanity(IN PRTMP_ADAPTER pAd,
62 IN VOID * Msg, IN ULONG MsgLen, OUT PUCHAR pAddr2)
64 PMLME_ADDBA_REQ_STRUCT pInfo;
66 pInfo = (MLME_ADDBA_REQ_STRUCT *) Msg;
68 if ((MsgLen != sizeof(MLME_ADDBA_REQ_STRUCT))) {
69 DBGPRINT(RT_DEBUG_TRACE,
70 ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
74 if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE)) {
75 DBGPRINT(RT_DEBUG_TRACE,
76 ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
80 if ((pInfo->pAddr[0] & 0x01) == 0x01) {
81 DBGPRINT(RT_DEBUG_TRACE,
82 ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
90 ==========================================================================
92 MLME message sanity check
94 TRUE if all parameters are OK, FALSE otherwise
98 ==========================================================================
100 BOOLEAN MlmeDelBAReqSanity(IN PRTMP_ADAPTER pAd, IN VOID * Msg, IN ULONG MsgLen)
102 MLME_DELBA_REQ_STRUCT *pInfo;
103 pInfo = (MLME_DELBA_REQ_STRUCT *) Msg;
105 if ((MsgLen != sizeof(MLME_DELBA_REQ_STRUCT))) {
106 DBGPRINT(RT_DEBUG_ERROR,
107 ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
111 if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE)) {
112 DBGPRINT(RT_DEBUG_ERROR,
113 ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
117 if ((pInfo->TID & 0xf0)) {
118 DBGPRINT(RT_DEBUG_ERROR,
119 ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
124 (pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr,
125 MAC_ADDR_LEN) == 0) {
126 DBGPRINT(RT_DEBUG_ERROR,
127 ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
134 BOOLEAN PeerAddBAReqActionSanity(IN PRTMP_ADAPTER pAd,
136 IN ULONG MsgLen, OUT PUCHAR pAddr2)
138 PFRAME_802_11 pFrame = (PFRAME_802_11) pMsg;
139 PFRAME_ADDBA_REQ pAddFrame;
140 pAddFrame = (PFRAME_ADDBA_REQ) (pMsg);
141 if (MsgLen < (sizeof(FRAME_ADDBA_REQ))) {
142 DBGPRINT(RT_DEBUG_ERROR,
143 ("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n",
147 // we support immediate BA.
148 *(USHORT *) (&pAddFrame->BaParm) =
149 cpu2le16(*(USHORT *) (&pAddFrame->BaParm));
150 pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
151 pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
153 if (pAddFrame->BaParm.BAPolicy != IMMED_BA) {
154 DBGPRINT(RT_DEBUG_ERROR,
155 ("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n",
156 pAddFrame->BaParm.BAPolicy));
157 DBGPRINT(RT_DEBUG_ERROR,
158 ("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n",
159 pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize,
160 pAddFrame->BaParm.AMSDUSupported));
163 // we support immediate BA.
164 if (pAddFrame->BaParm.TID & 0xfff0) {
165 DBGPRINT(RT_DEBUG_ERROR,
166 ("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n",
167 pAddFrame->BaParm.TID));
170 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
174 BOOLEAN PeerAddBARspActionSanity(IN PRTMP_ADAPTER pAd,
175 IN VOID * pMsg, IN ULONG MsgLen)
177 PFRAME_ADDBA_RSP pAddFrame;
179 pAddFrame = (PFRAME_ADDBA_RSP) (pMsg);
180 if (MsgLen < (sizeof(FRAME_ADDBA_RSP))) {
181 DBGPRINT(RT_DEBUG_ERROR,
182 ("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n",
186 // we support immediate BA.
187 *(USHORT *) (&pAddFrame->BaParm) =
188 cpu2le16(*(USHORT *) (&pAddFrame->BaParm));
189 pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
190 pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
192 if (pAddFrame->BaParm.BAPolicy != IMMED_BA) {
193 DBGPRINT(RT_DEBUG_ERROR,
194 ("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n",
195 pAddFrame->BaParm.BAPolicy));
198 // we support immediate BA.
199 if (pAddFrame->BaParm.TID & 0xfff0) {
200 DBGPRINT(RT_DEBUG_ERROR,
201 ("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n",
202 pAddFrame->BaParm.TID));
209 BOOLEAN PeerDelBAActionSanity(IN PRTMP_ADAPTER pAd,
210 IN UCHAR Wcid, IN VOID * pMsg, IN ULONG MsgLen)
212 //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
213 PFRAME_DELBA_REQ pDelFrame;
214 if (MsgLen != (sizeof(FRAME_DELBA_REQ)))
217 if (Wcid >= MAX_LEN_OF_MAC_TABLE)
220 pDelFrame = (PFRAME_DELBA_REQ) (pMsg);
222 *(USHORT *) (&pDelFrame->DelbaParm) =
223 cpu2le16(*(USHORT *) (&pDelFrame->DelbaParm));
224 pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
226 if (pDelFrame->DelbaParm.TID & 0xfff0)
233 ==========================================================================
235 MLME message sanity check
237 TRUE if all parameters are OK, FALSE otherwise
239 IRQL = DISPATCH_LEVEL
241 ==========================================================================
243 BOOLEAN PeerBeaconAndProbeRspSanity(IN PRTMP_ADAPTER pAd, IN VOID * Msg, IN ULONG MsgLen, IN UCHAR MsgChannel, OUT PUCHAR pAddr2, OUT PUCHAR pBssid, OUT CHAR Ssid[], OUT UCHAR * pSsidLen, OUT UCHAR * pBssType, OUT USHORT * pBeaconPeriod, OUT UCHAR * pChannel, OUT UCHAR * pNewChannel, OUT LARGE_INTEGER * pTimestamp, OUT CF_PARM * pCfParm, OUT USHORT * pAtimWin, OUT USHORT * pCapabilityInfo, OUT UCHAR * pErp, OUT UCHAR * pDtimCount, OUT UCHAR * pDtimPeriod, OUT UCHAR * pBcastFlag, OUT UCHAR * pMessageToMe, OUT UCHAR SupRate[], OUT UCHAR * pSupRateLen, OUT UCHAR ExtRate[], OUT UCHAR * pExtRateLen, OUT UCHAR * pCkipFlag, OUT UCHAR * pAironetCellPowerLimit, OUT PEDCA_PARM pEdcaParm, OUT PQBSS_LOAD_PARM pQbssLoad, OUT PQOS_CAPABILITY_PARM pQosCapability, OUT ULONG * pRalinkIe, OUT UCHAR * pHtCapabilityLen, OUT UCHAR * pPreNHtCapabilityLen, OUT HT_CAPABILITY_IE * pHtCapability, OUT UCHAR * AddHtInfoLen, OUT ADD_HT_INFO_IE * AddHtInfo, OUT UCHAR * NewExtChannelOffset, // Ht extension channel offset(above or below)
244 OUT USHORT * LengthVIE,
245 OUT PNDIS_802_11_VARIABLE_IEs pVIE)
249 PFRAME_802_11 pFrame;
253 //UCHAR ECWMin, ECWMax;
254 //MAC_CSR9_STRUC Csr9;
257 // For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel
258 // 1. If the AP is 11n enabled, then check the control channel.
259 // 2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!!)
260 UCHAR CtrlChannel = 0;
262 // Add for 3 necessary EID field check
272 *pCkipFlag = 0; // Default of CkipFlag is 0
273 *pAironetCellPowerLimit = 0xFF; // Default of AironetCellPowerLimit is 0xFF
274 *LengthVIE = 0; // Set the length of VIE to init value 0
275 *pHtCapabilityLen = 0; // Set the length of VIE to init value 0
276 if (pAd->OpMode == OPMODE_STA)
277 *pPreNHtCapabilityLen = 0; // Set the length of VIE to init value 0
278 *AddHtInfoLen = 0; // Set the length of VIE to init value 0
281 *NewExtChannelOffset = 0xff; //Default 0xff means no such IE
282 pCfParm->bValid = FALSE; // default: no IE_CF found
283 pQbssLoad->bValid = FALSE; // default: no IE_QBSS_LOAD found
284 pEdcaParm->bValid = FALSE; // default: no IE_EDCA_PARAMETER found
285 pQosCapability->bValid = FALSE; // default: no IE_QOS_CAPABILITY found
287 pFrame = (PFRAME_802_11) Msg;
289 // get subtype from header
290 SubType = (UCHAR) pFrame->Hdr.FC.SubType;
292 // get Addr2 and BSSID from header
293 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
294 COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
297 Length += LENGTH_802_11;
299 // get timestamp from payload and advance the pointer
300 NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
302 pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
303 pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
305 Ptr += TIMESTAMP_LEN;
306 Length += TIMESTAMP_LEN;
308 // get beacon interval from payload and advance the pointer
309 NdisMoveMemory(pBeaconPeriod, Ptr, 2);
313 // get capability info from payload and advance the pointer
314 NdisMoveMemory(pCapabilityInfo, Ptr, 2);
318 if (CAP_IS_ESS_ON(*pCapabilityInfo))
319 *pBssType = BSS_INFRA;
321 *pBssType = BSS_ADHOC;
323 pEid = (PEID_STRUCT) Ptr;
325 // get variable fields from payload and advance the pointer
326 while ((Length + 2 + pEid->Len) <= MsgLen) {
328 // Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow.
330 if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN) {
331 DBGPRINT(RT_DEBUG_WARN,
332 ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
333 (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
339 // Already has one SSID EID in this beacon, ignore the second one
342 if (pEid->Len <= MAX_LEN_OF_SSID) {
343 NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
344 *pSsidLen = pEid->Len;
347 DBGPRINT(RT_DEBUG_TRACE,
348 ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",
355 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) {
357 NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
358 *pSupRateLen = pEid->Len;
360 // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
361 // from ScanTab. We should report as is. And filter out unsupported
363 // Check against the supported rates
364 // RTMPCheckRates(pAd, SupRate, pSupRateLen);
366 DBGPRINT(RT_DEBUG_TRACE,
367 ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",
374 if (pEid->Len >= SIZE_HT_CAP_IE) //Note: allow extension.!!
376 NdisMoveMemory(pHtCapability, pEid->Octet,
377 sizeof(HT_CAPABILITY_IE));
378 *pHtCapabilityLen = SIZE_HT_CAP_IE; // Nnow we only support 26 bytes.
380 *(USHORT *) (&pHtCapability->HtCapInfo) =
382 (&pHtCapability->HtCapInfo));
383 *(USHORT *) (&pHtCapability->ExtHtCapInfo) =
385 (&pHtCapability->ExtHtCapInfo));
388 *pPreNHtCapabilityLen = 0; // Nnow we only support 26 bytes.
391 NdisMoveMemory(Ptr + *LengthVIE,
394 *LengthVIE += (pEid->Len + 2);
397 DBGPRINT(RT_DEBUG_WARN,
398 ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n",
404 if (pEid->Len >= sizeof(ADD_HT_INFO_IE)) {
405 // This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
406 // copy first sizeof(ADD_HT_INFO_IE)
407 NdisMoveMemory(AddHtInfo, pEid->Octet,
408 sizeof(ADD_HT_INFO_IE));
409 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
411 CtrlChannel = AddHtInfo->ControlChan;
413 *(USHORT *) (&AddHtInfo->AddHtInfo2) =
415 (&AddHtInfo->AddHtInfo2));
416 *(USHORT *) (&AddHtInfo->AddHtInfo3) =
418 (&AddHtInfo->AddHtInfo3));
422 NdisMoveMemory(Ptr + *LengthVIE,
425 *LengthVIE += (pEid->Len + 2);
428 DBGPRINT(RT_DEBUG_WARN,
429 ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
433 case IE_SECONDARY_CH_OFFSET:
434 if (pEid->Len == 1) {
435 *NewExtChannelOffset = pEid->Octet[0];
437 DBGPRINT(RT_DEBUG_WARN,
438 ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
443 DBGPRINT(RT_DEBUG_TRACE,
444 ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
448 if (pEid->Len == 1) {
449 *pChannel = *pEid->Octet;
452 if (ChannelSanity(pAd, *pChannel) == 0) {
460 DBGPRINT(RT_DEBUG_TRACE,
461 ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",
468 if (pEid->Len == 6) {
469 pCfParm->bValid = TRUE;
470 pCfParm->CfpCount = pEid->Octet[0];
471 pCfParm->CfpPeriod = pEid->Octet[1];
472 pCfParm->CfpMaxDuration =
473 pEid->Octet[2] + 256 * pEid->Octet[3];
474 pCfParm->CfpDurRemaining =
475 pEid->Octet[4] + 256 * pEid->Octet[5];
477 DBGPRINT(RT_DEBUG_TRACE,
478 ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
484 if (pEid->Len == 2) {
485 NdisMoveMemory(pAtimWin, pEid->Octet,
488 DBGPRINT(RT_DEBUG_TRACE,
489 ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
495 if (INFRA_ON(pAd) && SubType == SUBTYPE_BEACON) {
496 GetTimBit((PCHAR) pEid, pAd->StaActive.Aid,
497 &TimLen, pBcastFlag, pDtimCount,
498 pDtimPeriod, pMessageToMe);
501 case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
502 if (pEid->Len == 3) {
503 *pNewChannel = pEid->Octet[1]; //extract new channel number
508 // CCX v2 has the same IE, we need to parse that too
509 // Wifi WMM use the same IE vale, need to parse that too
511 case IE_VENDOR_SPECIFIC:
512 // Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE.
513 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
514 /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
516 if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
519 NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
520 *pHtCapabilityLen = SIZE_HT_CAP_IE; // Nnow we only support 26 bytes.
523 if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
526 NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
527 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE; // Nnow we only support 26 bytes.
532 // Check the OUI version, filter out non-standard usage
533 if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3)
534 && (pEid->Len == 7)) {
535 //*pRalinkIe = pEid->Octet[3];
536 if (pEid->Octet[3] != 0)
537 *pRalinkIe = pEid->Octet[3];
539 *pRalinkIe = 0xf0000000; // Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag.
541 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
543 // Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP,
544 // Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE
545 else if ((*pHtCapabilityLen == 0)
546 && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI,
547 3) && (pEid->Len >= 4)
548 && (pAd->OpMode == OPMODE_STA)) {
549 if ((pEid->Octet[3] == OUI_PREN_HT_CAP)
551 && (*pHtCapabilityLen == 0)) {
552 NdisMoveMemory(pHtCapability,
556 *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
559 if ((pEid->Octet[3] == OUI_PREN_ADD_HT)
560 && (pEid->Len >= 26)) {
561 NdisMoveMemory(AddHtInfo,
563 sizeof(ADD_HT_INFO_IE));
564 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
566 } else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4)) {
567 // Copy to pVIE which will report to microsoft bssid list.
569 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid,
571 *LengthVIE += (pEid->Len + 2);
573 if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6)
574 && (pEid->Len == 24)) {
578 // parsing EDCA parameters
579 pEdcaParm->bValid = TRUE;
580 pEdcaParm->bQAck = FALSE; // pEid->Octet[0] & 0x10;
581 pEdcaParm->bQueueRequest = FALSE; // pEid->Octet[0] & 0x20;
582 pEdcaParm->bTxopRequest = FALSE; // pEid->Octet[0] & 0x40;
583 pEdcaParm->EdcaUpdateCount =
584 pEid->Octet[6] & 0x0f;
585 pEdcaParm->bAPSDCapable =
586 (pEid->Octet[6] & 0x80) ? 1 : 0;
587 ptr = &pEid->Octet[8];
588 for (i = 0; i < 4; i++) {
589 UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
590 pEdcaParm->bACM[aci] = (((*ptr) & 0x10) == 0x10); // b5 is ACM
591 pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f; // b0~3 is AIFSN
592 pEdcaParm->Cwmin[aci] = *(ptr + 1) & 0x0f; // b0~4 is Cwmin
593 pEdcaParm->Cwmax[aci] = *(ptr + 1) >> 4; // b5~8 is Cwmax
594 pEdcaParm->Txop[aci] = *(ptr + 2) + 256 * (*(ptr + 3)); // in unit of 32-us
595 ptr += 4; // point to next AC
598 if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6)
599 && (pEid->Len == 7)) {
600 // parsing EDCA parameters
601 pEdcaParm->bValid = TRUE;
602 pEdcaParm->bQAck = FALSE; // pEid->Octet[0] & 0x10;
603 pEdcaParm->bQueueRequest = FALSE; // pEid->Octet[0] & 0x20;
604 pEdcaParm->bTxopRequest = FALSE; // pEid->Octet[0] & 0x40;
605 pEdcaParm->EdcaUpdateCount =
606 pEid->Octet[6] & 0x0f;
607 pEdcaParm->bAPSDCapable =
608 (pEid->Octet[6] & 0x80) ? 1 : 0;
610 // use default EDCA parameter
611 pEdcaParm->bACM[QID_AC_BE] = 0;
612 pEdcaParm->Aifsn[QID_AC_BE] = 3;
613 pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
614 pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
615 pEdcaParm->Txop[QID_AC_BE] = 0;
617 pEdcaParm->bACM[QID_AC_BK] = 0;
618 pEdcaParm->Aifsn[QID_AC_BK] = 7;
619 pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
620 pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
621 pEdcaParm->Txop[QID_AC_BK] = 0;
623 pEdcaParm->bACM[QID_AC_VI] = 0;
624 pEdcaParm->Aifsn[QID_AC_VI] = 2;
625 pEdcaParm->Cwmin[QID_AC_VI] =
627 pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
628 pEdcaParm->Txop[QID_AC_VI] = 96; // AC_VI: 96*32us ~= 3ms
630 pEdcaParm->bACM[QID_AC_VO] = 0;
631 pEdcaParm->Aifsn[QID_AC_VO] = 2;
632 pEdcaParm->Cwmin[QID_AC_VO] =
634 pEdcaParm->Cwmax[QID_AC_VO] =
636 pEdcaParm->Txop[QID_AC_VO] = 48; // AC_VO: 48*32us ~= 1.5ms
641 case IE_EXT_SUPP_RATES:
642 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) {
643 NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
644 *pExtRateLen = pEid->Len;
646 // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
647 // from ScanTab. We should report as is. And filter out unsupported
649 // Check against the supported rates
650 // RTMPCheckRates(pAd, ExtRate, pExtRateLen);
655 if (pEid->Len == 1) {
656 *pErp = (UCHAR) pEid->Octet[0];
660 case IE_AIRONET_CKIP:
661 // 0. Check Aironet IE length, it must be larger or equal to 28
662 // Cisco AP350 used length as 28
663 // Cisco AP12XX used length as 30
664 if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
667 // 1. Copy CKIP flag byte to buffer for process
668 *pCkipFlag = *(pEid->Octet + 8);
672 // AP Control of Client Transmit Power
673 //0. Check Aironet IE length, it must be 6
674 if (pEid->Len != 0x06)
677 // Get cell power limit in dBm
678 if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
679 *pAironetCellPowerLimit = *(pEid->Octet + 4);
682 // WPA2 & 802.11i RSN
684 // There is no OUI for version anymore, check the group cipher OUI before copying
685 if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3)) {
686 // Copy to pVIE which will report to microsoft bssid list.
688 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid,
690 *LengthVIE += (pEid->Len + 2);
698 Length = Length + 2 + pEid->Len; // Eid[1] + Len[1]+ content[Len]
699 pEid = (PEID_STRUCT) ((UCHAR *) pEid + 2 + pEid->Len);
702 // For some 11a AP. it did not have the channel EID, patch here
704 UCHAR LatchRfChannel = MsgChannel;
705 if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0)) {
706 if (CtrlChannel != 0)
707 *pChannel = CtrlChannel;
709 *pChannel = LatchRfChannel;
715 DBGPRINT(RT_DEBUG_LOUD,
716 ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n",
726 ==========================================================================
728 MLME message sanity check
730 TRUE if all parameters are OK, FALSE otherwise
731 ==========================================================================
733 BOOLEAN MlmeScanReqSanity(IN PRTMP_ADAPTER pAd,
736 OUT UCHAR * pBssType,
738 OUT UCHAR * pSsidLen, OUT UCHAR * pScanType)
740 MLME_SCAN_REQ_STRUCT *Info;
742 Info = (MLME_SCAN_REQ_STRUCT *) (Msg);
743 *pBssType = Info->BssType;
744 *pSsidLen = Info->SsidLen;
745 NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
746 *pScanType = Info->ScanType;
748 if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC
749 || *pBssType == BSS_ANY)
750 && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE)) {
753 DBGPRINT(RT_DEBUG_TRACE,
754 ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
759 // IRQL = DISPATCH_LEVEL
760 UCHAR ChannelSanity(IN PRTMP_ADAPTER pAd, IN UCHAR channel)
764 for (i = 0; i < pAd->ChannelListNum; i++) {
765 if (channel == pAd->ChannelList[i].Channel)
772 ==========================================================================
774 MLME message sanity check
776 TRUE if all parameters are OK, FALSE otherwise
778 IRQL = DISPATCH_LEVEL
780 ==========================================================================
782 BOOLEAN PeerDeauthSanity(IN PRTMP_ADAPTER pAd,
785 OUT PUCHAR pAddr2, OUT USHORT * pReason)
787 PFRAME_802_11 pFrame = (PFRAME_802_11) Msg;
789 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
790 NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
796 ==========================================================================
798 MLME message sanity check
800 TRUE if all parameters are OK, FALSE otherwise
802 IRQL = DISPATCH_LEVEL
804 ==========================================================================
806 BOOLEAN PeerAuthSanity(IN PRTMP_ADAPTER pAd,
812 OUT USHORT * pStatus, CHAR * pChlgText)
814 PFRAME_802_11 pFrame = (PFRAME_802_11) Msg;
816 COPY_MAC_ADDR(pAddr, pFrame->Hdr.Addr2);
817 NdisMoveMemory(pAlg, &pFrame->Octet[0], 2);
818 NdisMoveMemory(pSeq, &pFrame->Octet[2], 2);
819 NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
821 if (*pAlg == AUTH_MODE_OPEN) {
822 if (*pSeq == 1 || *pSeq == 2) {
825 DBGPRINT(RT_DEBUG_TRACE,
826 ("PeerAuthSanity fail - wrong Seg#\n"));
829 } else if (*pAlg == AUTH_MODE_KEY) {
830 if (*pSeq == 1 || *pSeq == 4) {
832 } else if (*pSeq == 2 || *pSeq == 3) {
833 NdisMoveMemory(pChlgText, &pFrame->Octet[8],
837 DBGPRINT(RT_DEBUG_TRACE,
838 ("PeerAuthSanity fail - wrong Seg#\n"));
842 DBGPRINT(RT_DEBUG_TRACE,
843 ("PeerAuthSanity fail - wrong algorithm\n"));
849 ==========================================================================
851 MLME message sanity check
853 TRUE if all parameters are OK, FALSE otherwise
854 ==========================================================================
856 BOOLEAN MlmeAuthReqSanity(IN PRTMP_ADAPTER pAd,
860 OUT ULONG * pTimeout, OUT USHORT * pAlg)
862 MLME_AUTH_REQ_STRUCT *pInfo;
864 pInfo = (MLME_AUTH_REQ_STRUCT *) Msg;
865 COPY_MAC_ADDR(pAddr, pInfo->Addr);
866 *pTimeout = pInfo->Timeout;
869 if (((*pAlg == AUTH_MODE_KEY) || (*pAlg == AUTH_MODE_OPEN)
870 ) && ((*pAddr & 0x01) == 0)) {
873 DBGPRINT(RT_DEBUG_TRACE,
874 ("MlmeAuthReqSanity fail - wrong algorithm\n"));
880 ==========================================================================
882 MLME message sanity check
884 TRUE if all parameters are OK, FALSE otherwise
886 IRQL = DISPATCH_LEVEL
888 ==========================================================================
890 BOOLEAN MlmeAssocReqSanity(IN PRTMP_ADAPTER pAd,
894 OUT USHORT * pCapabilityInfo,
895 OUT ULONG * pTimeout, OUT USHORT * pListenIntv)
897 MLME_ASSOC_REQ_STRUCT *pInfo;
899 pInfo = (MLME_ASSOC_REQ_STRUCT *) Msg;
900 *pTimeout = pInfo->Timeout; // timeout
901 COPY_MAC_ADDR(pApAddr, pInfo->Addr); // AP address
902 *pCapabilityInfo = pInfo->CapabilityInfo; // capability info
903 *pListenIntv = pInfo->ListenIntv;
909 ==========================================================================
911 MLME message sanity check
913 TRUE if all parameters are OK, FALSE otherwise
915 IRQL = DISPATCH_LEVEL
917 ==========================================================================
919 BOOLEAN PeerDisassocSanity(IN PRTMP_ADAPTER pAd,
922 OUT PUCHAR pAddr2, OUT USHORT * pReason)
924 PFRAME_802_11 pFrame = (PFRAME_802_11) Msg;
926 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
927 NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
933 ========================================================================
935 Sanity check NetworkType (11b, 11g or 11a)
938 pBss - Pointer to BSS table.
941 Ndis802_11DS .......(11b)
942 Ndis802_11OFDM24....(11g)
943 Ndis802_11OFDM5.....(11a)
945 IRQL = DISPATCH_LEVEL
947 ========================================================================
949 NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(IN PBSS_ENTRY pBss)
951 NDIS_802_11_NETWORK_TYPE NetWorkType;
954 NetWorkType = Ndis802_11DS;
956 if (pBss->Channel <= 14) {
958 // First check support Rate.
960 for (i = 0; i < pBss->SupRateLen; i++) {
961 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
962 if ((rate == 2) || (rate == 4) || (rate == 11)
967 // Otherwise (even rate > 108) means Ndis802_11OFDM24
969 NetWorkType = Ndis802_11OFDM24;
975 // Second check Extend Rate.
977 if (NetWorkType != Ndis802_11OFDM24) {
978 for (i = 0; i < pBss->ExtRateLen; i++) {
979 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
980 if ((rate == 2) || (rate == 4) || (rate == 11)
985 // Otherwise (even rate > 108) means Ndis802_11OFDM24
987 NetWorkType = Ndis802_11OFDM24;
993 NetWorkType = Ndis802_11OFDM5;
996 if (pBss->HtCapabilityLen != 0) {
997 if (NetWorkType == Ndis802_11OFDM5)
998 NetWorkType = Ndis802_11OFDM5_N;
1000 NetWorkType = Ndis802_11OFDM24_N;
1007 ==========================================================================
1009 Check the validity of the received EAPoL frame
1011 TRUE if all parameters are OK,
1013 ==========================================================================
1015 BOOLEAN PeerWpaMessageSanity(IN PRTMP_ADAPTER pAd,
1016 IN PEAPOL_PACKET pMsg,
1018 IN UCHAR MsgType, IN MAC_TABLE_ENTRY * pEntry)
1020 UCHAR mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
1021 BOOLEAN bReplayDiff = FALSE;
1022 BOOLEAN bWPA2 = FALSE;
1023 KEY_INFO EapolKeyInfo;
1024 UCHAR GroupKeyIndex = 0;
1026 NdisZeroMemory(mic, sizeof(mic));
1027 NdisZeroMemory(digest, sizeof(digest));
1028 NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
1029 NdisZeroMemory((PUCHAR) & EapolKeyInfo, sizeof(EapolKeyInfo));
1031 NdisMoveMemory((PUCHAR) & EapolKeyInfo,
1032 (PUCHAR) & pMsg->KeyDesc.KeyInfo, sizeof(KEY_INFO));
1034 *((USHORT *) & EapolKeyInfo) = cpu2le16(*((USHORT *) & EapolKeyInfo));
1036 // Choose WPA2 or not
1037 if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2)
1038 || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
1042 if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1)) {
1043 DBGPRINT(RT_DEBUG_ERROR,
1044 ("The message type is invalid(%d)! \n", MsgType));
1047 // 1. Replay counter check
1048 if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) // For supplicant
1050 // First validate replay counter, only accept message with larger replay counter.
1051 // Let equal pass, some AP start with all zero replay counter
1052 UCHAR ZeroReplay[LEN_KEY_DESC_REPLAY];
1054 NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
1055 if ((RTMPCompareMemory
1056 (pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter,
1057 LEN_KEY_DESC_REPLAY) != 1)
1060 (pMsg->KeyDesc.ReplayCounter, ZeroReplay,
1061 LEN_KEY_DESC_REPLAY) != 0)) {
1064 } else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2) // For authenticator
1066 // check Replay Counter coresponds to MSG from authenticator, otherwise discard
1067 if (!NdisEqualMemory
1068 (pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter,
1069 LEN_KEY_DESC_REPLAY)) {
1073 // Replay Counter different condition
1075 // send wireless event - for replay counter different
1076 if (pAd->CommonCfg.bWirelessEvent)
1077 RTMPSendWirelessEvent(pAd,
1078 IW_REPLAY_COUNTER_DIFF_EVENT_FLAG,
1079 pEntry->Addr, pEntry->apidx, 0);
1081 if (MsgType < EAPOL_GROUP_MSG_1) {
1082 DBGPRINT(RT_DEBUG_ERROR,
1083 ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n",
1086 DBGPRINT(RT_DEBUG_ERROR,
1087 ("Replay Counter Different in group msg %d of 2-way handshake!\n",
1088 (MsgType - EAPOL_PAIR_MSG_4)));
1091 hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter,
1092 LEN_KEY_DESC_REPLAY);
1093 hex_dump("Current replay counter ", pEntry->R_Counter,
1094 LEN_KEY_DESC_REPLAY);
1097 // 2. Verify MIC except Pairwise Msg1
1098 if (MsgType != EAPOL_PAIR_MSG_1) {
1099 UCHAR rcvd_mic[LEN_KEY_DESC_MIC];
1101 // Record the received MIC for check later
1102 NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic,
1104 NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1106 if (EapolKeyInfo.KeyDescVer == DESC_TYPE_TKIP) // TKIP
1108 HMAC_MD5(pEntry->PTK, LEN_EAP_MICK, (PUCHAR) pMsg,
1109 MsgLen, mic, MD5_DIGEST_SIZE);
1110 } else if (EapolKeyInfo.KeyDescVer == DESC_TYPE_AES) // AES
1112 HMAC_SHA1(pEntry->PTK, LEN_EAP_MICK, (PUCHAR) pMsg,
1113 MsgLen, digest, SHA1_DIGEST_SIZE);
1114 NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
1117 if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC)) {
1118 // send wireless event - for MIC different
1119 if (pAd->CommonCfg.bWirelessEvent)
1120 RTMPSendWirelessEvent(pAd,
1121 IW_MIC_DIFF_EVENT_FLAG,
1125 if (MsgType < EAPOL_GROUP_MSG_1) {
1126 DBGPRINT(RT_DEBUG_ERROR,
1127 ("MIC Different in pairwise msg %d of 4-way handshake!\n",
1130 DBGPRINT(RT_DEBUG_ERROR,
1131 ("MIC Different in group msg %d of 2-way handshake!\n",
1132 (MsgType - EAPOL_PAIR_MSG_4)));
1135 hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
1136 hex_dump("Desired MIC", mic, LEN_KEY_DESC_MIC);
1141 // 1. Decrypt the Key Data field if GTK is included.
1142 // 2. Extract the context of the Key Data field if it exist.
1143 // The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is clear.
1144 // The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted.
1145 if (CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen) > 0) {
1146 // Decrypt this field
1147 if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2)
1148 || (MsgType == EAPOL_GROUP_MSG_1)) {
1149 if ((EapolKeyInfo.KeyDescVer == DESC_TYPE_AES)) {
1151 AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA,
1152 CONV_ARRARY_TO_UINT16(pMsg->
1155 pMsg->KeyDesc.KeyData);
1160 // Construct 32 bytes RC4 Key
1161 NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
1162 NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
1163 ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key,
1165 //discard first 256 bytes
1166 for (i = 0; i < 256; i++)
1167 ARCFOUR_BYTE(&pAd->PrivateInfo.
1169 // Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
1170 ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT,
1171 KEYDATA, pMsg->KeyDesc.KeyData,
1172 CONV_ARRARY_TO_UINT16(pMsg->
1177 if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
1178 GroupKeyIndex = EapolKeyInfo.KeyIndex;
1180 } else if ((MsgType == EAPOL_PAIR_MSG_2)
1181 || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2)) {
1182 NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData,
1183 CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.
1190 // Parse Key Data field to
1191 // 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2)
1192 // 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2
1193 // 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2)
1194 if (!RTMPParseEapolKeyData(pAd, KEYDATA,
1195 CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.
1197 GroupKeyIndex, MsgType, bWPA2,