2 *************************************************************************
4 * 5F., No.36, Taiyuan St., Jhubei City,
8 * (c) Copyright 2002-2007, Ralink Technology, Inc.
10 * This program is free software; you can redistribute it and/or modify *
11 * it under the terms of the GNU General Public License as published by *
12 * the Free Software Foundation; either version 2 of the License, or *
13 * (at your option) any later version. *
15 * This program is distributed in the hope that it will be useful, *
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
18 * GNU General Public License for more details. *
20 * You should have received a copy of the GNU General Public License *
21 * along with this program; if not, write to the *
22 * Free Software Foundation, Inc., *
23 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 *************************************************************************
34 -------- ---------- ----------------------------------------------
35 John Chang 2004-09-01 add WMM support
37 #include "../rt_config.h"
40 extern UCHAR CISCO_OUI[];
42 extern UCHAR WPA_OUI[];
43 extern UCHAR RSN_OUI[];
44 extern UCHAR WME_INFO_ELEM[];
45 extern UCHAR WME_PARM_ELEM[];
46 extern UCHAR Ccx2QosInfo[];
47 extern UCHAR RALINK_OUI[];
48 extern UCHAR BROADCOM_OUI[];
49 extern UCHAR WPS_OUI[];
52 ==========================================================================
54 MLME message sanity check
56 TRUE if all parameters are OK, FALSE otherwise
60 ==========================================================================
62 BOOLEAN MlmeAddBAReqSanity(
68 PMLME_ADDBA_REQ_STRUCT pInfo;
70 pInfo = (MLME_ADDBA_REQ_STRUCT *)Msg;
72 if ((MsgLen != sizeof(MLME_ADDBA_REQ_STRUCT)))
74 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
78 if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
80 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
84 if ((pInfo->pAddr[0]&0x01) == 0x01)
86 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
94 ==========================================================================
96 MLME message sanity check
98 TRUE if all parameters are OK, FALSE otherwise
100 IRQL = DISPATCH_LEVEL
102 ==========================================================================
104 BOOLEAN MlmeDelBAReqSanity(
105 IN PRTMP_ADAPTER pAd,
109 MLME_DELBA_REQ_STRUCT *pInfo;
110 pInfo = (MLME_DELBA_REQ_STRUCT *)Msg;
112 if ((MsgLen != sizeof(MLME_DELBA_REQ_STRUCT)))
114 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
118 if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
120 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
124 if ((pInfo->TID & 0xf0))
126 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
130 if (NdisEqualMemory(pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr, MAC_ADDR_LEN) == 0)
132 DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
139 BOOLEAN PeerAddBAReqActionSanity(
140 IN PRTMP_ADAPTER pAd,
145 PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
146 PFRAME_ADDBA_REQ pAddFrame;
147 pAddFrame = (PFRAME_ADDBA_REQ)(pMsg);
148 if (MsgLen < (sizeof(FRAME_ADDBA_REQ)))
150 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n", MsgLen));
153 // we support immediate BA.
154 *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
155 pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
156 pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
158 if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
160 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
161 DBGPRINT(RT_DEBUG_ERROR,("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n", pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize, pAddFrame->BaParm.AMSDUSupported));
165 // we support immediate BA.
166 if (pAddFrame->BaParm.TID &0xfff0)
168 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n", pAddFrame->BaParm.TID));
171 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
175 BOOLEAN PeerAddBARspActionSanity(
176 IN PRTMP_ADAPTER pAd,
180 PFRAME_ADDBA_RSP pAddFrame;
182 pAddFrame = (PFRAME_ADDBA_RSP)(pMsg);
183 if (MsgLen < (sizeof(FRAME_ADDBA_RSP)))
185 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n", MsgLen));
188 // we support immediate BA.
189 *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
190 pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
191 pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
193 if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
195 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
199 // we support immediate BA.
200 if (pAddFrame->BaParm.TID &0xfff0)
202 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n", pAddFrame->BaParm.TID));
209 BOOLEAN PeerDelBAActionSanity(
210 IN PRTMP_ADAPTER pAd,
215 //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
216 PFRAME_DELBA_REQ pDelFrame;
217 if (MsgLen != (sizeof(FRAME_DELBA_REQ)))
220 if (Wcid >= MAX_LEN_OF_MAC_TABLE)
223 pDelFrame = (PFRAME_DELBA_REQ)(pMsg);
225 *(USHORT *)(&pDelFrame->DelbaParm) = cpu2le16(*(USHORT *)(&pDelFrame->DelbaParm));
226 pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
228 if (pDelFrame->DelbaParm.TID &0xfff0)
235 ==========================================================================
237 MLME message sanity check
239 TRUE if all parameters are OK, FALSE otherwise
241 IRQL = DISPATCH_LEVEL
243 ==========================================================================
245 BOOLEAN PeerBeaconAndProbeRspSanity(
246 IN PRTMP_ADAPTER pAd,
255 OUT USHORT *pBeaconPeriod,
257 OUT UCHAR *pNewChannel,
258 OUT LARGE_INTEGER *pTimestamp,
259 OUT CF_PARM *pCfParm,
260 OUT USHORT *pAtimWin,
261 OUT USHORT *pCapabilityInfo,
263 OUT UCHAR *pDtimCount,
264 OUT UCHAR *pDtimPeriod,
265 OUT UCHAR *pBcastFlag,
266 OUT UCHAR *pMessageToMe,
268 OUT UCHAR *pSupRateLen,
270 OUT UCHAR *pExtRateLen,
271 OUT UCHAR *pCkipFlag,
272 OUT UCHAR *pAironetCellPowerLimit,
273 OUT PEDCA_PARM pEdcaParm,
274 OUT PQBSS_LOAD_PARM pQbssLoad,
275 OUT PQOS_CAPABILITY_PARM pQosCapability,
276 OUT ULONG *pRalinkIe,
277 OUT UCHAR *pHtCapabilityLen,
278 OUT UCHAR *pPreNHtCapabilityLen,
279 OUT HT_CAPABILITY_IE *pHtCapability,
280 OUT UCHAR *AddHtInfoLen,
281 OUT ADD_HT_INFO_IE *AddHtInfo,
282 OUT UCHAR *NewExtChannelOffset, // Ht extension channel offset(above or below)
283 OUT USHORT *LengthVIE,
284 OUT PNDIS_802_11_VARIABLE_IEs pVIE)
288 PFRAME_802_11 pFrame;
292 //UCHAR ECWMin, ECWMax;
293 //MAC_CSR9_STRUC Csr9;
296 // For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel
297 // 1. If the AP is 11n enabled, then check the control channel.
298 // 2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!!)
299 UCHAR CtrlChannel = 0;
301 // Add for 3 necessary EID field check
311 *pCkipFlag = 0; // Default of CkipFlag is 0
312 *pAironetCellPowerLimit = 0xFF; // Default of AironetCellPowerLimit is 0xFF
313 *LengthVIE = 0; // Set the length of VIE to init value 0
314 *pHtCapabilityLen = 0; // Set the length of VIE to init value 0
315 if (pAd->OpMode == OPMODE_STA)
316 *pPreNHtCapabilityLen = 0; // Set the length of VIE to init value 0
317 *AddHtInfoLen = 0; // Set the length of VIE to init value 0
320 *NewExtChannelOffset = 0xff; //Default 0xff means no such IE
321 pCfParm->bValid = FALSE; // default: no IE_CF found
322 pQbssLoad->bValid = FALSE; // default: no IE_QBSS_LOAD found
323 pEdcaParm->bValid = FALSE; // default: no IE_EDCA_PARAMETER found
324 pQosCapability->bValid = FALSE; // default: no IE_QOS_CAPABILITY found
326 pFrame = (PFRAME_802_11)Msg;
328 // get subtype from header
329 SubType = (UCHAR)pFrame->Hdr.FC.SubType;
331 // get Addr2 and BSSID from header
332 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
333 COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
336 Length += LENGTH_802_11;
338 // get timestamp from payload and advance the pointer
339 NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
341 pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
342 pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
344 Ptr += TIMESTAMP_LEN;
345 Length += TIMESTAMP_LEN;
347 // get beacon interval from payload and advance the pointer
348 NdisMoveMemory(pBeaconPeriod, Ptr, 2);
352 // get capability info from payload and advance the pointer
353 NdisMoveMemory(pCapabilityInfo, Ptr, 2);
357 if (CAP_IS_ESS_ON(*pCapabilityInfo))
358 *pBssType = BSS_INFRA;
360 *pBssType = BSS_ADHOC;
362 pEid = (PEID_STRUCT) Ptr;
364 // get variable fields from payload and advance the pointer
365 while ((Length + 2 + pEid->Len) <= MsgLen)
368 // Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow.
370 if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN)
372 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
373 (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
380 // Already has one SSID EID in this beacon, ignore the second one
383 if(pEid->Len <= MAX_LEN_OF_SSID)
385 NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
386 *pSsidLen = pEid->Len;
391 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
397 if(pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
400 NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
401 *pSupRateLen = pEid->Len;
403 // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
404 // from ScanTab. We should report as is. And filter out unsupported
406 // Check against the supported rates
407 // RTMPCheckRates(pAd, SupRate, pSupRateLen);
411 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",pEid->Len));
417 if (pEid->Len >= SIZE_HT_CAP_IE) //Note: allow extension.!!
419 NdisMoveMemory(pHtCapability, pEid->Octet, sizeof(HT_CAPABILITY_IE));
420 *pHtCapabilityLen = SIZE_HT_CAP_IE; // Nnow we only support 26 bytes.
422 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
423 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
426 *pPreNHtCapabilityLen = 0; // Nnow we only support 26 bytes.
429 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
430 *LengthVIE += (pEid->Len + 2);
435 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n", pEid->Len));
440 if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
442 // This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
443 // copy first sizeof(ADD_HT_INFO_IE)
444 NdisMoveMemory(AddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
445 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
447 CtrlChannel = AddHtInfo->ControlChan;
449 *(USHORT *)(&AddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo2));
450 *(USHORT *)(&AddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo3));
454 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
455 *LengthVIE += (pEid->Len + 2);
460 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
464 case IE_SECONDARY_CH_OFFSET:
467 *NewExtChannelOffset = pEid->Octet[0];
471 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
476 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
482 *pChannel = *pEid->Octet;
485 if (ChannelSanity(pAd, *pChannel) == 0)
496 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",pEid->Len));
504 pCfParm->bValid = TRUE;
505 pCfParm->CfpCount = pEid->Octet[0];
506 pCfParm->CfpPeriod = pEid->Octet[1];
507 pCfParm->CfpMaxDuration = pEid->Octet[2] + 256 * pEid->Octet[3];
508 pCfParm->CfpDurRemaining = pEid->Octet[4] + 256 * pEid->Octet[5];
512 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
520 NdisMoveMemory(pAtimWin, pEid->Octet, pEid->Len);
524 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
530 if(INFRA_ON(pAd) && SubType == SUBTYPE_BEACON)
532 GetTimBit((PCHAR)pEid, pAd->StaActive.Aid, &TimLen, pBcastFlag, pDtimCount, pDtimPeriod, pMessageToMe);
535 case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
538 *pNewChannel = pEid->Octet[1]; //extract new channel number
543 // CCX v2 has the same IE, we need to parse that too
544 // Wifi WMM use the same IE vale, need to parse that too
546 case IE_VENDOR_SPECIFIC:
547 // Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE.
548 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
549 /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
551 if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
554 NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
555 *pHtCapabilityLen = SIZE_HT_CAP_IE; // Nnow we only support 26 bytes.
558 if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
561 NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
562 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE; // Nnow we only support 26 bytes.
567 // Check the OUI version, filter out non-standard usage
568 if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3) && (pEid->Len == 7))
570 //*pRalinkIe = pEid->Octet[3];
571 if (pEid->Octet[3] != 0)
572 *pRalinkIe = pEid->Octet[3];
574 *pRalinkIe = 0xf0000000; // Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag.
576 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
578 // Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP,
579 // Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE
580 else if ((*pHtCapabilityLen == 0) && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI, 3) && (pEid->Len >= 4) && (pAd->OpMode == OPMODE_STA))
582 if ((pEid->Octet[3] == OUI_PREN_HT_CAP) && (pEid->Len >= 30) && (*pHtCapabilityLen == 0))
584 NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
585 *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
588 if ((pEid->Octet[3] == OUI_PREN_ADD_HT) && (pEid->Len >= 26))
590 NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
591 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
594 else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
596 // Copy to pVIE which will report to microsoft bssid list.
598 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
599 *LengthVIE += (pEid->Len + 2);
601 else if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
606 // parsing EDCA parameters
607 pEdcaParm->bValid = TRUE;
608 pEdcaParm->bQAck = FALSE; // pEid->Octet[0] & 0x10;
609 pEdcaParm->bQueueRequest = FALSE; // pEid->Octet[0] & 0x20;
610 pEdcaParm->bTxopRequest = FALSE; // pEid->Octet[0] & 0x40;
611 pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
612 pEdcaParm->bAPSDCapable = (pEid->Octet[6] & 0x80) ? 1 : 0;
613 ptr = &pEid->Octet[8];
616 UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
617 pEdcaParm->bACM[aci] = (((*ptr) & 0x10) == 0x10); // b5 is ACM
618 pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f; // b0~3 is AIFSN
619 pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f; // b0~4 is Cwmin
620 pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4; // b5~8 is Cwmax
621 pEdcaParm->Txop[aci] = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
622 ptr += 4; // point to next AC
625 else if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6) && (pEid->Len == 7))
627 // parsing EDCA parameters
628 pEdcaParm->bValid = TRUE;
629 pEdcaParm->bQAck = FALSE; // pEid->Octet[0] & 0x10;
630 pEdcaParm->bQueueRequest = FALSE; // pEid->Octet[0] & 0x20;
631 pEdcaParm->bTxopRequest = FALSE; // pEid->Octet[0] & 0x40;
632 pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
633 pEdcaParm->bAPSDCapable = (pEid->Octet[6] & 0x80) ? 1 : 0;
635 // use default EDCA parameter
636 pEdcaParm->bACM[QID_AC_BE] = 0;
637 pEdcaParm->Aifsn[QID_AC_BE] = 3;
638 pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
639 pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
640 pEdcaParm->Txop[QID_AC_BE] = 0;
642 pEdcaParm->bACM[QID_AC_BK] = 0;
643 pEdcaParm->Aifsn[QID_AC_BK] = 7;
644 pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
645 pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
646 pEdcaParm->Txop[QID_AC_BK] = 0;
648 pEdcaParm->bACM[QID_AC_VI] = 0;
649 pEdcaParm->Aifsn[QID_AC_VI] = 2;
650 pEdcaParm->Cwmin[QID_AC_VI] = CW_MIN_IN_BITS-1;
651 pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
652 pEdcaParm->Txop[QID_AC_VI] = 96; // AC_VI: 96*32us ~= 3ms
654 pEdcaParm->bACM[QID_AC_VO] = 0;
655 pEdcaParm->Aifsn[QID_AC_VO] = 2;
656 pEdcaParm->Cwmin[QID_AC_VO] = CW_MIN_IN_BITS-2;
657 pEdcaParm->Cwmax[QID_AC_VO] = CW_MAX_IN_BITS-1;
658 pEdcaParm->Txop[QID_AC_VO] = 48; // AC_VO: 48*32us ~= 1.5ms
664 case IE_EXT_SUPP_RATES:
665 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
667 NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
668 *pExtRateLen = pEid->Len;
670 // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
671 // from ScanTab. We should report as is. And filter out unsupported
673 // Check against the supported rates
674 // RTMPCheckRates(pAd, ExtRate, pExtRateLen);
681 *pErp = (UCHAR)pEid->Octet[0];
685 case IE_AIRONET_CKIP:
686 // 0. Check Aironet IE length, it must be larger or equal to 28
687 // Cisco AP350 used length as 28
688 // Cisco AP12XX used length as 30
689 if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
692 // 1. Copy CKIP flag byte to buffer for process
693 *pCkipFlag = *(pEid->Octet + 8);
697 // AP Control of Client Transmit Power
698 //0. Check Aironet IE length, it must be 6
699 if (pEid->Len != 0x06)
702 // Get cell power limit in dBm
703 if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
704 *pAironetCellPowerLimit = *(pEid->Octet + 4);
707 // WPA2 & 802.11i RSN
709 // There is no OUI for version anymore, check the group cipher OUI before copying
710 if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
712 // Copy to pVIE which will report to microsoft bssid list.
714 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
715 *LengthVIE += (pEid->Len + 2);
723 Length = Length + 2 + pEid->Len; // Eid[1] + Len[1]+ content[Len]
724 pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
727 // For some 11a AP. it did not have the channel EID, patch here
729 UCHAR LatchRfChannel = MsgChannel;
730 if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0))
732 if (CtrlChannel != 0)
733 *pChannel = CtrlChannel;
735 *pChannel = LatchRfChannel;
742 DBGPRINT(RT_DEBUG_LOUD, ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n", Sanity));
753 ==========================================================================
755 MLME message sanity check
757 TRUE if all parameters are OK, FALSE otherwise
758 ==========================================================================
760 BOOLEAN MlmeScanReqSanity(
761 IN PRTMP_ADAPTER pAd,
767 OUT UCHAR *pScanType)
769 MLME_SCAN_REQ_STRUCT *Info;
771 Info = (MLME_SCAN_REQ_STRUCT *)(Msg);
772 *pBssType = Info->BssType;
773 *pSsidLen = Info->SsidLen;
774 NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
775 *pScanType = Info->ScanType;
777 if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC || *pBssType == BSS_ANY)
778 && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE
785 DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
790 // IRQL = DISPATCH_LEVEL
792 IN PRTMP_ADAPTER pAd,
797 for (i = 0; i < pAd->ChannelListNum; i ++)
799 if (channel == pAd->ChannelList[i].Channel)
806 ==========================================================================
808 MLME message sanity check
810 TRUE if all parameters are OK, FALSE otherwise
812 IRQL = DISPATCH_LEVEL
814 ==========================================================================
816 BOOLEAN PeerDeauthSanity(
817 IN PRTMP_ADAPTER pAd,
823 PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
825 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
826 NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
832 ==========================================================================
834 MLME message sanity check
836 TRUE if all parameters are OK, FALSE otherwise
838 IRQL = DISPATCH_LEVEL
840 ==========================================================================
842 BOOLEAN PeerAuthSanity(
843 IN PRTMP_ADAPTER pAd,
852 PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
854 COPY_MAC_ADDR(pAddr, pFrame->Hdr.Addr2);
855 NdisMoveMemory(pAlg, &pFrame->Octet[0], 2);
856 NdisMoveMemory(pSeq, &pFrame->Octet[2], 2);
857 NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
859 if (*pAlg == AUTH_MODE_OPEN)
861 if (*pSeq == 1 || *pSeq == 2)
867 DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
871 else if (*pAlg == AUTH_MODE_KEY)
873 if (*pSeq == 1 || *pSeq == 4)
877 else if (*pSeq == 2 || *pSeq == 3)
879 NdisMoveMemory(pChlgText, &pFrame->Octet[8], CIPHER_TEXT_LEN);
884 DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
890 DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong algorithm\n"));
896 ==========================================================================
898 MLME message sanity check
900 TRUE if all parameters are OK, FALSE otherwise
901 ==========================================================================
903 BOOLEAN MlmeAuthReqSanity(
904 IN PRTMP_ADAPTER pAd,
911 MLME_AUTH_REQ_STRUCT *pInfo;
913 pInfo = (MLME_AUTH_REQ_STRUCT *)Msg;
914 COPY_MAC_ADDR(pAddr, pInfo->Addr);
915 *pTimeout = pInfo->Timeout;
918 if (((*pAlg == AUTH_MODE_KEY) ||(*pAlg == AUTH_MODE_OPEN)
920 ((*pAddr & 0x01) == 0))
926 DBGPRINT(RT_DEBUG_TRACE, ("MlmeAuthReqSanity fail - wrong algorithm\n"));
932 ==========================================================================
934 MLME message sanity check
936 TRUE if all parameters are OK, FALSE otherwise
938 IRQL = DISPATCH_LEVEL
940 ==========================================================================
942 BOOLEAN MlmeAssocReqSanity(
943 IN PRTMP_ADAPTER pAd,
947 OUT USHORT *pCapabilityInfo,
949 OUT USHORT *pListenIntv)
951 MLME_ASSOC_REQ_STRUCT *pInfo;
953 pInfo = (MLME_ASSOC_REQ_STRUCT *)Msg;
954 *pTimeout = pInfo->Timeout; // timeout
955 COPY_MAC_ADDR(pApAddr, pInfo->Addr); // AP address
956 *pCapabilityInfo = pInfo->CapabilityInfo; // capability info
957 *pListenIntv = pInfo->ListenIntv;
963 ==========================================================================
965 MLME message sanity check
967 TRUE if all parameters are OK, FALSE otherwise
969 IRQL = DISPATCH_LEVEL
971 ==========================================================================
973 BOOLEAN PeerDisassocSanity(
974 IN PRTMP_ADAPTER pAd,
980 PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
982 COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
983 NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
989 ========================================================================
991 Sanity check NetworkType (11b, 11g or 11a)
994 pBss - Pointer to BSS table.
997 Ndis802_11DS .......(11b)
998 Ndis802_11OFDM24....(11g)
999 Ndis802_11OFDM5.....(11a)
1001 IRQL = DISPATCH_LEVEL
1003 ========================================================================
1005 NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
1008 NDIS_802_11_NETWORK_TYPE NetWorkType;
1011 NetWorkType = Ndis802_11DS;
1013 if (pBss->Channel <= 14)
1016 // First check support Rate.
1018 for (i = 0; i < pBss->SupRateLen; i++)
1020 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1021 if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1028 // Otherwise (even rate > 108) means Ndis802_11OFDM24
1030 NetWorkType = Ndis802_11OFDM24;
1036 // Second check Extend Rate.
1038 if (NetWorkType != Ndis802_11OFDM24)
1040 for (i = 0; i < pBss->ExtRateLen; i++)
1042 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1043 if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1050 // Otherwise (even rate > 108) means Ndis802_11OFDM24
1052 NetWorkType = Ndis802_11OFDM24;
1060 NetWorkType = Ndis802_11OFDM5;
1063 if (pBss->HtCapabilityLen != 0)
1065 if (NetWorkType == Ndis802_11OFDM5)
1066 NetWorkType = Ndis802_11OFDM5_N;
1068 NetWorkType = Ndis802_11OFDM24_N;
1075 ==========================================================================
1077 Check the validity of the received EAPoL frame
1079 TRUE if all parameters are OK,
1081 ==========================================================================
1083 BOOLEAN PeerWpaMessageSanity(
1084 IN PRTMP_ADAPTER pAd,
1085 IN PEAPOL_PACKET pMsg,
1088 IN MAC_TABLE_ENTRY *pEntry)
1090 UCHAR mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
1091 BOOLEAN bReplayDiff = FALSE;
1092 BOOLEAN bWPA2 = FALSE;
1093 KEY_INFO EapolKeyInfo;
1094 UCHAR GroupKeyIndex = 0;
1097 NdisZeroMemory(mic, sizeof(mic));
1098 NdisZeroMemory(digest, sizeof(digest));
1099 NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
1100 NdisZeroMemory((PUCHAR)&EapolKeyInfo, sizeof(EapolKeyInfo));
1102 NdisMoveMemory((PUCHAR)&EapolKeyInfo, (PUCHAR)&pMsg->KeyDesc.KeyInfo, sizeof(KEY_INFO));
1104 *((USHORT *)&EapolKeyInfo) = cpu2le16(*((USHORT *)&EapolKeyInfo));
1106 // Choose WPA2 or not
1107 if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
1111 if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1))
1113 DBGPRINT(RT_DEBUG_ERROR, ("The message type is invalid(%d)! \n", MsgType));
1117 // 1. Replay counter check
1118 if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) // For supplicant
1120 // First validate replay counter, only accept message with larger replay counter.
1121 // Let equal pass, some AP start with all zero replay counter
1122 UCHAR ZeroReplay[LEN_KEY_DESC_REPLAY];
1124 NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
1125 if ((RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY) != 1) &&
1126 (RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, ZeroReplay, LEN_KEY_DESC_REPLAY) != 0))
1131 else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2) // For authenticator
1133 // check Replay Counter coresponds to MSG from authenticator, otherwise discard
1134 if (!NdisEqualMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY))
1140 // Replay Counter different condition
1143 // send wireless event - for replay counter different
1144 if (pAd->CommonCfg.bWirelessEvent)
1145 RTMPSendWirelessEvent(pAd, IW_REPLAY_COUNTER_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1147 if (MsgType < EAPOL_GROUP_MSG_1)
1149 DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1153 DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1156 hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
1157 hex_dump("Current replay counter ", pEntry->R_Counter, LEN_KEY_DESC_REPLAY);
1161 // 2. Verify MIC except Pairwise Msg1
1162 if (MsgType != EAPOL_PAIR_MSG_1)
1164 UCHAR rcvd_mic[LEN_KEY_DESC_MIC];
1166 // Record the received MIC for check later
1167 NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1168 NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1170 if (EapolKeyInfo.KeyDescVer == DESC_TYPE_TKIP) // TKIP
1172 HMAC_MD5(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, mic, MD5_DIGEST_SIZE);
1174 else if (EapolKeyInfo.KeyDescVer == DESC_TYPE_AES) // AES
1176 HMAC_SHA1(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, digest, SHA1_DIGEST_SIZE);
1177 NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
1180 if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC))
1182 // send wireless event - for MIC different
1183 if (pAd->CommonCfg.bWirelessEvent)
1184 RTMPSendWirelessEvent(pAd, IW_MIC_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1186 if (MsgType < EAPOL_GROUP_MSG_1)
1188 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1192 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1195 hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
1196 hex_dump("Desired MIC", mic, LEN_KEY_DESC_MIC);
1202 // 1. Decrypt the Key Data field if GTK is included.
1203 // 2. Extract the context of the Key Data field if it exist.
1204 // The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is clear.
1205 // The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted.
1206 if (CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen) > 0)
1208 // Decrypt this field
1209 if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2) || (MsgType == EAPOL_GROUP_MSG_1))
1212 (EapolKeyInfo.KeyDescVer == DESC_TYPE_AES))
1215 AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA,
1216 CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen),
1217 pMsg->KeyDesc.KeyData);
1224 // Construct 32 bytes RC4 Key
1225 NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
1226 NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
1227 ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, 32);
1228 //discard first 256 bytes
1229 for(i = 0; i < 256; i++)
1230 ARCFOUR_BYTE(&pAd->PrivateInfo.WEPCONTEXT);
1231 // Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
1232 ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, KEYDATA,
1233 pMsg->KeyDesc.KeyData,
1234 CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen));
1237 if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
1238 GroupKeyIndex = EapolKeyInfo.KeyIndex;
1241 else if ((MsgType == EAPOL_PAIR_MSG_2) || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2))
1243 NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData, CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen));
1251 // Parse Key Data field to
1252 // 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2)
1253 // 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2
1254 // 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2)
1255 if (!RTMPParseEapolKeyData(pAd, KEYDATA,
1256 CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen),
1257 GroupKeyIndex, MsgType, bWPA2, pEntry))