drivers/staging/rt2860/common/cmm_sanity.c

   1 /*
   2  *************************************************************************
   3  * Ralink Tech Inc.
   4  * 5F., No.36, Taiyuan St., Jhubei City,
   5  * Hsinchu County 302,
   6  * Taiwan, R.O.C.
   7  *
   8  * (c) Copyright 2002-2007, Ralink Technology, Inc.
   9  *
  10  * This program is free software; you can redistribute it and/or modify  *
  11  * it under the terms of the GNU General Public License as published by  *
  12  * the Free Software Foundation; either version 2 of the License, or     *
  13  * (at your option) any later version.                                   *
  14  *                                                                       *
  15  * This program is distributed in the hope that it will be useful,       *
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  18  * GNU General Public License for more details.                          *
  19  *                                                                       *
  20  * You should have received a copy of the GNU General Public License     *
  21  * along with this program; if not, write to the                         *
  22  * Free Software Foundation, Inc.,                                       *
  23  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  24  *                                                                       *
  25  *************************************************************************
  26
  27         Module Name:
  28         sanity.c
  29
  30         Abstract:
  31
  32         Revision History:
  33         Who                     When                    What
  34         --------        ----------              ----------------------------------------------
  35         John Chang  2004-09-01      add WMM support
  36 */
  37 #include "../rt_config.h"
  38
  39 extern u8 CISCO_OUI[];
  40
  41 extern u8 WPA_OUI[];
  42 extern u8 RSN_OUI[];
  43 extern u8 WME_INFO_ELEM[];
  44 extern u8 WME_PARM_ELEM[];
  45 extern u8 Ccx2QosInfo[];
  46 extern u8 RALINK_OUI[];
  47 extern u8 BROADCOM_OUI[];
  48 extern u8 WPS_OUI[];
  49
  50 /*
  51     ==========================================================================
  52     Description:
  53         MLME message sanity check
  54     Return:
  55         TRUE if all parameters are OK, FALSE otherwise
  56
  57         IRQL = DISPATCH_LEVEL
  58
  59     ==========================================================================
  60  */
  61 BOOLEAN MlmeAddBAReqSanity(struct rt_rtmp_adapter *pAd,
  62                            void * Msg, unsigned long MsgLen, u8 *pAddr2)
  63 {
  64         struct rt_mlme_addba_req *pInfo;
  65
  66         pInfo = (struct rt_mlme_addba_req *)Msg;
  67
  68         if ((MsgLen != sizeof(struct rt_mlme_addba_req))) {
  69                 DBGPRINT(RT_DEBUG_TRACE,
  70                          ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
  71                 return FALSE;
  72         }
  73
  74         if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE)) {
  75                 DBGPRINT(RT_DEBUG_TRACE,
  76                          ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
  77                 return FALSE;
  78         }
  79
  80         if ((pInfo->pAddr[0] & 0x01) == 0x01) {
  81                 DBGPRINT(RT_DEBUG_TRACE,
  82                          ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
  83                 return FALSE;
  84         }
  85
  86         return TRUE;
  87 }
  88
  89 /*
  90     ==========================================================================
  91     Description:
  92         MLME message sanity check
  93     Return:
  94         TRUE if all parameters are OK, FALSE otherwise
  95
  96         IRQL = DISPATCH_LEVEL
  97
  98     ==========================================================================
  99  */
 100 BOOLEAN MlmeDelBAReqSanity(struct rt_rtmp_adapter *pAd, void * Msg, unsigned long MsgLen)
 101 {
 102         struct rt_mlme_delba_req *pInfo;
 103         pInfo = (struct rt_mlme_delba_req *)Msg;
 104
 105         if ((MsgLen != sizeof(struct rt_mlme_delba_req))) {
 106                 DBGPRINT(RT_DEBUG_ERROR,
 107                          ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
 108                 return FALSE;
 109         }
 110
 111         if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE)) {
 112                 DBGPRINT(RT_DEBUG_ERROR,
 113                          ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
 114                 return FALSE;
 115         }
 116
 117         if ((pInfo->TID & 0xf0)) {
 118                 DBGPRINT(RT_DEBUG_ERROR,
 119                          ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
 120                 return FALSE;
 121         }
 122
 123         if (NdisEqualMemory
 124             (pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr,
 125              MAC_ADDR_LEN) == 0) {
 126                 DBGPRINT(RT_DEBUG_ERROR,
 127                          ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
 128                 return FALSE;
 129         }
 130
 131         return TRUE;
 132 }
 133
 134 BOOLEAN PeerAddBAReqActionSanity(struct rt_rtmp_adapter *pAd,
 135                                  void * pMsg,
 136                                  unsigned long MsgLen, u8 *pAddr2)
 137 {
 138         struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) pMsg;
 139         struct rt_frame_addba_req * pAddFrame;
 140         pAddFrame = (struct rt_frame_addba_req *) (pMsg);
 141         if (MsgLen < (sizeof(struct rt_frame_addba_req))) {
 142                 DBGPRINT(RT_DEBUG_ERROR,
 143                          ("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n",
 144                           MsgLen));
 145                 return FALSE;
 146         }
 147         /* we support immediate BA. */
 148         *(u16 *) (&pAddFrame->BaParm) =
 149             cpu2le16(*(u16 *) (&pAddFrame->BaParm));
 150         pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 151         pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
 152
 153         if (pAddFrame->BaParm.BAPolicy != IMMED_BA) {
 154                 DBGPRINT(RT_DEBUG_ERROR,
 155                          ("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n",
 156                           pAddFrame->BaParm.BAPolicy));
 157                 DBGPRINT(RT_DEBUG_ERROR,
 158                          ("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n",
 159                           pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize,
 160                           pAddFrame->BaParm.AMSDUSupported));
 161                 return FALSE;
 162         }
 163         /* we support immediate BA. */
 164         if (pAddFrame->BaParm.TID & 0xfff0) {
 165                 DBGPRINT(RT_DEBUG_ERROR,
 166                          ("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n",
 167                           pAddFrame->BaParm.TID));
 168                 return FALSE;
 169         }
 170         COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 171         return TRUE;
 172 }
 173
 174 BOOLEAN PeerAddBARspActionSanity(struct rt_rtmp_adapter *pAd,
 175                                  void * pMsg, unsigned long MsgLen)
 176 {
 177         struct rt_frame_addba_rsp * pAddFrame;
 178
 179         pAddFrame = (struct rt_frame_addba_rsp *) (pMsg);
 180         if (MsgLen < (sizeof(struct rt_frame_addba_rsp))) {
 181                 DBGPRINT(RT_DEBUG_ERROR,
 182                          ("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n",
 183                           MsgLen));
 184                 return FALSE;
 185         }
 186         /* we support immediate BA. */
 187         *(u16 *) (&pAddFrame->BaParm) =
 188             cpu2le16(*(u16 *) (&pAddFrame->BaParm));
 189         pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
 190         pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 191
 192         if (pAddFrame->BaParm.BAPolicy != IMMED_BA) {
 193                 DBGPRINT(RT_DEBUG_ERROR,
 194                          ("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n",
 195                           pAddFrame->BaParm.BAPolicy));
 196                 return FALSE;
 197         }
 198         /* we support immediate BA. */
 199         if (pAddFrame->BaParm.TID & 0xfff0) {
 200                 DBGPRINT(RT_DEBUG_ERROR,
 201                          ("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n",
 202                           pAddFrame->BaParm.TID));
 203                 return FALSE;
 204         }
 205         return TRUE;
 206
 207 }
 208
 209 BOOLEAN PeerDelBAActionSanity(struct rt_rtmp_adapter *pAd,
 210                               u8 Wcid, void * pMsg, unsigned long MsgLen)
 211 {
 212         /*struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *)pMsg; */
 213         struct rt_frame_delba_req * pDelFrame;
 214         if (MsgLen != (sizeof(struct rt_frame_delba_req)))
 215                 return FALSE;
 216
 217         if (Wcid >= MAX_LEN_OF_MAC_TABLE)
 218                 return FALSE;
 219
 220         pDelFrame = (struct rt_frame_delba_req *) (pMsg);
 221
 222         *(u16 *) (&pDelFrame->DelbaParm) =
 223             cpu2le16(*(u16 *) (&pDelFrame->DelbaParm));
 224         pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
 225
 226         if (pDelFrame->DelbaParm.TID & 0xfff0)
 227                 return FALSE;
 228
 229         return TRUE;
 230 }
 231
 232 /*
 233     ==========================================================================
 234     Description:
 235         MLME message sanity check
 236     Return:
 237         TRUE if all parameters are OK, FALSE otherwise
 238
 239         IRQL = DISPATCH_LEVEL
 240
 241     ==========================================================================
 242  */
 243 BOOLEAN PeerBeaconAndProbeRspSanity(struct rt_rtmp_adapter *pAd, void * Msg, unsigned long MsgLen, u8 MsgChannel, u8 *pAddr2, u8 *pBssid, char Ssid[], u8 * pSsidLen, u8 * pBssType, u16 * pBeaconPeriod, u8 * pChannel, u8 * pNewChannel, OUT LARGE_INTEGER * pTimestamp, struct rt_cf_parm * pCfParm, u16 * pAtimWin, u16 * pCapabilityInfo, u8 * pErp, u8 * pDtimCount, u8 * pDtimPeriod, u8 * pBcastFlag, u8 * pMessageToMe, u8 SupRate[], u8 * pSupRateLen, u8 ExtRate[], u8 * pExtRateLen, u8 * pCkipFlag, u8 * pAironetCellPowerLimit, struct rt_edca_parm *pEdcaParm, struct rt_qbss_load_parm *pQbssLoad, struct rt_qos_capability_parm *pQosCapability, unsigned long * pRalinkIe, u8 * pHtCapabilityLen, u8 * pPreNHtCapabilityLen, struct rt_ht_capability_ie * pHtCapability, u8 * AddHtInfoLen, struct rt_add_ht_info_ie * AddHtInfo, u8 * NewExtChannelOffset,   /* Ht extension channel offset(above or below) */
 244                                     u16 * LengthVIE,
 245                                     struct rt_ndis_802_11_variable_ies *pVIE)
 246 {
 247         u8 *Ptr;
 248         u8 TimLen;
 249         struct rt_frame_802_11 * pFrame;
 250         struct rt_eid * pEid;
 251         u8 SubType;
 252         u8 Sanity;
 253         /*u8                             ECWMin, ECWMax; */
 254         /*MAC_CSR9_STRUC            Csr9; */
 255         unsigned long Length = 0;
 256
 257         /* For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel */
 258         /*      1. If the AP is 11n enabled, then check the control channel. */
 259         /*      2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!) */
 260         u8 CtrlChannel = 0;
 261
 262         /* Add for 3 necessary EID field check */
 263         Sanity = 0;
 264
 265         *pAtimWin = 0;
 266         *pErp = 0;
 267         *pDtimCount = 0;
 268         *pDtimPeriod = 0;
 269         *pBcastFlag = 0;
 270         *pMessageToMe = 0;
 271         *pExtRateLen = 0;
 272         *pCkipFlag = 0;         /* Default of CkipFlag is 0 */
 273         *pAironetCellPowerLimit = 0xFF; /* Default of AironetCellPowerLimit is 0xFF */
 274         *LengthVIE = 0;         /* Set the length of VIE to init value 0 */
 275         *pHtCapabilityLen = 0;  /* Set the length of VIE to init value 0 */
 276         if (pAd->OpMode == OPMODE_STA)
 277                 *pPreNHtCapabilityLen = 0;      /* Set the length of VIE to init value 0 */
 278         *AddHtInfoLen = 0;      /* Set the length of VIE to init value 0 */
 279         *pRalinkIe = 0;
 280         *pNewChannel = 0;
 281         *NewExtChannelOffset = 0xff;    /*Default 0xff means no such IE */
 282         pCfParm->bValid = FALSE;        /* default: no IE_CF found */
 283         pQbssLoad->bValid = FALSE;      /* default: no IE_QBSS_LOAD found */
 284         pEdcaParm->bValid = FALSE;      /* default: no IE_EDCA_PARAMETER found */
 285         pQosCapability->bValid = FALSE; /* default: no IE_QOS_CAPABILITY found */
 286
 287         pFrame = (struct rt_frame_802_11 *) Msg;
 288
 289         /* get subtype from header */
 290         SubType = (u8)pFrame->Hdr.FC.SubType;
 291
 292         /* get Addr2 and BSSID from header */
 293         COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 294         COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
 295
 296         Ptr = pFrame->Octet;
 297         Length += LENGTH_802_11;
 298
 299         /* get timestamp from payload and advance the pointer */
 300         NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
 301
 302         pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
 303         pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
 304
 305         Ptr += TIMESTAMP_LEN;
 306         Length += TIMESTAMP_LEN;
 307
 308         /* get beacon interval from payload and advance the pointer */
 309         NdisMoveMemory(pBeaconPeriod, Ptr, 2);
 310         Ptr += 2;
 311         Length += 2;
 312
 313         /* get capability info from payload and advance the pointer */
 314         NdisMoveMemory(pCapabilityInfo, Ptr, 2);
 315         Ptr += 2;
 316         Length += 2;
 317
 318         if (CAP_IS_ESS_ON(*pCapabilityInfo))
 319                 *pBssType = BSS_INFRA;
 320         else
 321                 *pBssType = BSS_ADHOC;
 322
 323         pEid = (struct rt_eid *) Ptr;
 324
 325         /* get variable fields from payload and advance the pointer */
 326         while ((Length + 2 + pEid->Len) <= MsgLen) {
 327                 /* */
 328                 /* Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow. */
 329                 /* */
 330                 if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN) {
 331                         DBGPRINT(RT_DEBUG_WARN,
 332                                  ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
 333                                   (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
 334                         break;
 335                 }
 336
 337                 switch (pEid->Eid) {
 338                 case IE_SSID:
 339                         /* Already has one SSID EID in this beacon, ignore the second one */
 340                         if (Sanity & 0x1)
 341                                 break;
 342                         if (pEid->Len <= MAX_LEN_OF_SSID) {
 343                                 NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
 344                                 *pSsidLen = pEid->Len;
 345                                 Sanity |= 0x1;
 346                         } else {
 347                                 DBGPRINT(RT_DEBUG_TRACE,
 348                                          ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",
 349                                           pEid->Len));
 350                                 return FALSE;
 351                         }
 352                         break;
 353
 354                 case IE_SUPP_RATES:
 355                         if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) {
 356                                 Sanity |= 0x2;
 357                                 NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
 358                                 *pSupRateLen = pEid->Len;
 359
 360                                 /* TODO: 2004-09-14 not a good design here, cause it exclude extra rates */
 361                                 /* from ScanTab. We should report as is. And filter out unsupported */
 362                                 /* rates in MlmeAux. */
 363                                 /* Check against the supported rates */
 364                                 /* RTMPCheckRates(pAd, SupRate, pSupRateLen); */
 365                         } else {
 366                                 DBGPRINT(RT_DEBUG_TRACE,
 367                                          ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",
 368                                           pEid->Len));
 369                                 return FALSE;
 370                         }
 371                         break;
 372
 373                 case IE_HT_CAP:
 374                         if (pEid->Len >= SIZE_HT_CAP_IE)        /*Note: allow extension! */
 375                         {
 376                                 NdisMoveMemory(pHtCapability, pEid->Octet,
 377                                                sizeof(struct rt_ht_capability_ie));
 378                                 *pHtCapabilityLen = SIZE_HT_CAP_IE;     /* Nnow we only support 26 bytes. */
 379
 380                                 *(u16 *) (&pHtCapability->HtCapInfo) =
 381                                     cpu2le16(*(u16 *)
 382                                              (&pHtCapability->HtCapInfo));
 383                                 *(u16 *) (&pHtCapability->ExtHtCapInfo) =
 384                                     cpu2le16(*(u16 *)
 385                                              (&pHtCapability->ExtHtCapInfo));
 386
 387                                 {
 388                                         *pPreNHtCapabilityLen = 0;      /* Nnow we only support 26 bytes. */
 389
 390                                         Ptr = (u8 *)pVIE;
 391                                         NdisMoveMemory(Ptr + *LengthVIE,
 392                                                        &pEid->Eid,
 393                                                        pEid->Len + 2);
 394                                         *LengthVIE += (pEid->Len + 2);
 395                                 }
 396                         } else {
 397                                 DBGPRINT(RT_DEBUG_WARN,
 398                                          ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n",
 399                                           pEid->Len));
 400                         }
 401
 402                         break;
 403                 case IE_ADD_HT:
 404                         if (pEid->Len >= sizeof(struct rt_add_ht_info_ie)) {
 405                                 /* This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only */
 406                                 /* copy first sizeof(struct rt_add_ht_info_ie) */
 407                                 NdisMoveMemory(AddHtInfo, pEid->Octet,
 408                                                sizeof(struct rt_add_ht_info_ie));
 409                                 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 410
 411                                 CtrlChannel = AddHtInfo->ControlChan;
 412
 413                                 *(u16 *) (&AddHtInfo->AddHtInfo2) =
 414                                     cpu2le16(*(u16 *)
 415                                              (&AddHtInfo->AddHtInfo2));
 416                                 *(u16 *) (&AddHtInfo->AddHtInfo3) =
 417                                     cpu2le16(*(u16 *)
 418                                              (&AddHtInfo->AddHtInfo3));
 419
 420                                 {
 421                                         Ptr = (u8 *)pVIE;
 422                                         NdisMoveMemory(Ptr + *LengthVIE,
 423                                                        &pEid->Eid,
 424                                                        pEid->Len + 2);
 425                                         *LengthVIE += (pEid->Len + 2);
 426                                 }
 427                         } else {
 428                                 DBGPRINT(RT_DEBUG_WARN,
 429                                          ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
 430                         }
 431
 432                         break;
 433                 case IE_SECONDARY_CH_OFFSET:
 434                         if (pEid->Len == 1) {
 435                                 *NewExtChannelOffset = pEid->Octet[0];
 436                         } else {
 437                                 DBGPRINT(RT_DEBUG_WARN,
 438                                          ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
 439                         }
 440
 441                         break;
 442                 case IE_FH_PARM:
 443                         DBGPRINT(RT_DEBUG_TRACE,
 444                                  ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
 445                         break;
 446
 447                 case IE_DS_PARM:
 448                         if (pEid->Len == 1) {
 449                                 *pChannel = *pEid->Octet;
 450
 451                                 {
 452                                         if (ChannelSanity(pAd, *pChannel) == 0) {
 453
 454                                                 return FALSE;
 455                                         }
 456                                 }
 457
 458                                 Sanity |= 0x4;
 459                         } else {
 460                                 DBGPRINT(RT_DEBUG_TRACE,
 461                                          ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",
 462                                           pEid->Len));
 463                                 return FALSE;
 464                         }
 465                         break;
 466
 467                 case IE_CF_PARM:
 468                         if (pEid->Len == 6) {
 469                                 pCfParm->bValid = TRUE;
 470                                 pCfParm->CfpCount = pEid->Octet[0];
 471                                 pCfParm->CfpPeriod = pEid->Octet[1];
 472                                 pCfParm->CfpMaxDuration =
 473                                     pEid->Octet[2] + 256 * pEid->Octet[3];
 474                                 pCfParm->CfpDurRemaining =
 475                                     pEid->Octet[4] + 256 * pEid->Octet[5];
 476                         } else {
 477                                 DBGPRINT(RT_DEBUG_TRACE,
 478                                          ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
 479                                 return FALSE;
 480                         }
 481                         break;
 482
 483                 case IE_IBSS_PARM:
 484                         if (pEid->Len == 2) {
 485                                 NdisMoveMemory(pAtimWin, pEid->Octet,
 486                                                pEid->Len);
 487                         } else {
 488                                 DBGPRINT(RT_DEBUG_TRACE,
 489                                          ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
 490                                 return FALSE;
 491                         }
 492                         break;
 493
 494                 case IE_TIM:
 495                         if (INFRA_ON(pAd) && SubType == SUBTYPE_BEACON) {
 496                                 GetTimBit((char *)pEid, pAd->StaActive.Aid,
 497                                           &TimLen, pBcastFlag, pDtimCount,
 498                                           pDtimPeriod, pMessageToMe);
 499                         }
 500                         break;
 501                 case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
 502                         if (pEid->Len == 3) {
 503                                 *pNewChannel = pEid->Octet[1];  /*extract new channel number */
 504                         }
 505                         break;
 506
 507                         /* New for WPA */
 508                         /* CCX v2 has the same IE, we need to parse that too */
 509                         /* Wifi WMM use the same IE vale, need to parse that too */
 510                         /* case IE_WPA: */
 511                 case IE_VENDOR_SPECIFIC:
 512                         /* Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE. */
 513                         /* This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan. */
 514                         /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
 515                            {
 516                            if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
 517                            {
 518                            {
 519                            NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(struct rt_ht_capability_ie));
 520                            *pHtCapabilityLen = SIZE_HT_CAP_IE;  // Nnow we only support 26 bytes.
 521                            }
 522                            }
 523                            if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
 524                            {
 525                            {
 526                            NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(struct rt_add_ht_info_ie));
 527                            *AddHtInfoLen = SIZE_ADD_HT_INFO_IE; // Nnow we only support 26 bytes.
 528                            }
 529                            }
 530                            }
 531                          */
 532                         /* Check the OUI version, filter out non-standard usage */
 533                         if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3)
 534                             && (pEid->Len == 7)) {
 535                                 /**pRalinkIe = pEid->Octet[3]; */
 536                                 if (pEid->Octet[3] != 0)
 537                                         *pRalinkIe = pEid->Octet[3];
 538                                 else
 539                                         *pRalinkIe = 0xf0000000;        /* Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag. */
 540                         }
 541                         /* This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan. */
 542
 543                         /* Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP, */
 544                         /* Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE */
 545                         else if ((*pHtCapabilityLen == 0)
 546                                  && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI,
 547                                                     3) && (pEid->Len >= 4)
 548                                  && (pAd->OpMode == OPMODE_STA)) {
 549                                 if ((pEid->Octet[3] == OUI_PREN_HT_CAP)
 550                                     && (pEid->Len >= 30)
 551                                     && (*pHtCapabilityLen == 0)) {
 552                                         NdisMoveMemory(pHtCapability,
 553                                                        &pEid->Octet[4],
 554                                                        sizeof
 555                                                        (struct rt_ht_capability_ie));
 556                                         *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
 557                                 }
 558
 559                                 if ((pEid->Octet[3] == OUI_PREN_ADD_HT)
 560                                     && (pEid->Len >= 26)) {
 561                                         NdisMoveMemory(AddHtInfo,
 562                                                        &pEid->Octet[4],
 563                                                        sizeof(struct rt_add_ht_info_ie));
 564                                         *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 565                                 }
 566                         } else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4)) {
 567                                 /* Copy to pVIE which will report to microsoft bssid list. */
 568                                 Ptr = (u8 *)pVIE;
 569                                 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid,
 570                                                pEid->Len + 2);
 571                                 *LengthVIE += (pEid->Len + 2);
 572                         } else
 573                             if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6)
 574                                 && (pEid->Len == 24)) {
 575                                 u8 *ptr;
 576                                 int i;
 577
 578                                 /* parsing EDCA parameters */
 579                                 pEdcaParm->bValid = TRUE;
 580                                 pEdcaParm->bQAck = FALSE;       /* pEid->Octet[0] & 0x10; */
 581                                 pEdcaParm->bQueueRequest = FALSE;       /* pEid->Octet[0] & 0x20; */
 582                                 pEdcaParm->bTxopRequest = FALSE;        /* pEid->Octet[0] & 0x40; */
 583                                 pEdcaParm->EdcaUpdateCount =
 584                                     pEid->Octet[6] & 0x0f;
 585                                 pEdcaParm->bAPSDCapable =
 586                                     (pEid->Octet[6] & 0x80) ? 1 : 0;
 587                                 ptr = &pEid->Octet[8];
 588                                 for (i = 0; i < 4; i++) {
 589                                         u8 aci = (*ptr & 0x60) >> 5;    /* b5~6 is AC INDEX */
 590                                         pEdcaParm->bACM[aci] = (((*ptr) & 0x10) == 0x10);       /* b5 is ACM */
 591                                         pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;  /* b0~3 is AIFSN */
 592                                         pEdcaParm->Cwmin[aci] = *(ptr + 1) & 0x0f;      /* b0~4 is Cwmin */
 593                                         pEdcaParm->Cwmax[aci] = *(ptr + 1) >> 4;        /* b5~8 is Cwmax */
 594                                         pEdcaParm->Txop[aci] = *(ptr + 2) + 256 * (*(ptr + 3)); /* in unit of 32-us */
 595                                         ptr += 4;       /* point to next AC */
 596                                 }
 597                         } else
 598                             if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6)
 599                                 && (pEid->Len == 7)) {
 600                                 /* parsing EDCA parameters */
 601                                 pEdcaParm->bValid = TRUE;
 602                                 pEdcaParm->bQAck = FALSE;       /* pEid->Octet[0] & 0x10; */
 603                                 pEdcaParm->bQueueRequest = FALSE;       /* pEid->Octet[0] & 0x20; */
 604                                 pEdcaParm->bTxopRequest = FALSE;        /* pEid->Octet[0] & 0x40; */
 605                                 pEdcaParm->EdcaUpdateCount =
 606                                     pEid->Octet[6] & 0x0f;
 607                                 pEdcaParm->bAPSDCapable =
 608                                     (pEid->Octet[6] & 0x80) ? 1 : 0;
 609
 610                                 /* use default EDCA parameter */
 611                                 pEdcaParm->bACM[QID_AC_BE] = 0;
 612                                 pEdcaParm->Aifsn[QID_AC_BE] = 3;
 613                                 pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
 614                                 pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
 615                                 pEdcaParm->Txop[QID_AC_BE] = 0;
 616
 617                                 pEdcaParm->bACM[QID_AC_BK] = 0;
 618                                 pEdcaParm->Aifsn[QID_AC_BK] = 7;
 619                                 pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
 620                                 pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
 621                                 pEdcaParm->Txop[QID_AC_BK] = 0;
 622
 623                                 pEdcaParm->bACM[QID_AC_VI] = 0;
 624                                 pEdcaParm->Aifsn[QID_AC_VI] = 2;
 625                                 pEdcaParm->Cwmin[QID_AC_VI] =
 626                                     CW_MIN_IN_BITS - 1;
 627                                 pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
 628                                 pEdcaParm->Txop[QID_AC_VI] = 96;        /* AC_VI: 96*32us ~= 3ms */
 629
 630                                 pEdcaParm->bACM[QID_AC_VO] = 0;
 631                                 pEdcaParm->Aifsn[QID_AC_VO] = 2;
 632                                 pEdcaParm->Cwmin[QID_AC_VO] =
 633                                     CW_MIN_IN_BITS - 2;
 634                                 pEdcaParm->Cwmax[QID_AC_VO] =
 635                                     CW_MAX_IN_BITS - 1;
 636                                 pEdcaParm->Txop[QID_AC_VO] = 48;        /* AC_VO: 48*32us ~= 1.5ms */
 637                         }
 638
 639                         break;
 640
 641                 case IE_EXT_SUPP_RATES:
 642                         if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) {
 643                                 NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
 644                                 *pExtRateLen = pEid->Len;
 645
 646                                 /* TODO: 2004-09-14 not a good design here, cause it exclude extra rates */
 647                                 /* from ScanTab. We should report as is. And filter out unsupported */
 648                                 /* rates in MlmeAux. */
 649                                 /* Check against the supported rates */
 650                                 /* RTMPCheckRates(pAd, ExtRate, pExtRateLen); */
 651                         }
 652                         break;
 653
 654                 case IE_ERP:
 655                         if (pEid->Len == 1) {
 656                                 *pErp = (u8)pEid->Octet[0];
 657                         }
 658                         break;
 659
 660                 case IE_AIRONET_CKIP:
 661                         /* 0. Check Aironet IE length, it must be larger or equal to 28 */
 662                         /* Cisco AP350 used length as 28 */
 663                         /* Cisco AP12XX used length as 30 */
 664                         if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
 665                                 break;
 666
 667                         /* 1. Copy CKIP flag byte to buffer for process */
 668                         *pCkipFlag = *(pEid->Octet + 8);
 669                         break;
 670
 671                 case IE_AP_TX_POWER:
 672                         /* AP Control of Client Transmit Power */
 673                         /*0. Check Aironet IE length, it must be 6 */
 674                         if (pEid->Len != 0x06)
 675                                 break;
 676
 677                         /* Get cell power limit in dBm */
 678                         if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
 679                                 *pAironetCellPowerLimit = *(pEid->Octet + 4);
 680                         break;
 681
 682                         /* WPA2 & 802.11i RSN */
 683                 case IE_RSN:
 684                         /* There is no OUI for version anymore, check the group cipher OUI before copying */
 685                         if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3)) {
 686                                 /* Copy to pVIE which will report to microsoft bssid list. */
 687                                 Ptr = (u8 *)pVIE;
 688                                 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid,
 689                                                pEid->Len + 2);
 690                                 *LengthVIE += (pEid->Len + 2);
 691                         }
 692                         break;
 693
 694                 default:
 695                         break;
 696                 }
 697
 698                 Length = Length + 2 + pEid->Len;        /* Eid[1] + Len[1]+ content[Len] */
 699                 pEid = (struct rt_eid *) ((u8 *) pEid + 2 + pEid->Len);
 700         }
 701
 702         /* For some 11a AP. it did not have the channel EID, patch here */
 703         {
 704                 u8 LatchRfChannel = MsgChannel;
 705                 if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0)) {
 706                         if (CtrlChannel != 0)
 707                                 *pChannel = CtrlChannel;
 708                         else
 709                                 *pChannel = LatchRfChannel;
 710                         Sanity |= 0x4;
 711                 }
 712         }
 713
 714         if (Sanity != 0x7) {
 715                 DBGPRINT(RT_DEBUG_LOUD,
 716                          ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n",
 717                           Sanity));
 718                 return FALSE;
 719         } else {
 720                 return TRUE;
 721         }
 722
 723 }
 724
 725 /*
 726     ==========================================================================
 727     Description:
 728         MLME message sanity check
 729     Return:
 730         TRUE if all parameters are OK, FALSE otherwise
 731     ==========================================================================
 732  */
 733 BOOLEAN MlmeScanReqSanity(struct rt_rtmp_adapter *pAd,
 734                           void * Msg,
 735                           unsigned long MsgLen,
 736                           u8 * pBssType,
 737                           char Ssid[],
 738                           u8 * pSsidLen, u8 * pScanType)
 739 {
 740         struct rt_mlme_scan_req *Info;
 741
 742         Info = (struct rt_mlme_scan_req *)(Msg);
 743         *pBssType = Info->BssType;
 744         *pSsidLen = Info->SsidLen;
 745         NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
 746         *pScanType = Info->ScanType;
 747
 748         if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC
 749              || *pBssType == BSS_ANY)
 750             && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE)) {
 751                 return TRUE;
 752         } else {
 753                 DBGPRINT(RT_DEBUG_TRACE,
 754                          ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
 755                 return FALSE;
 756         }
 757 }
 758
 759 /* IRQL = DISPATCH_LEVEL */
 760 u8 ChannelSanity(struct rt_rtmp_adapter *pAd, u8 channel)
 761 {
 762         int i;
 763
 764         for (i = 0; i < pAd->ChannelListNum; i++) {
 765                 if (channel == pAd->ChannelList[i].Channel)
 766                         return 1;
 767         }
 768         return 0;
 769 }
 770
 771 /*
 772     ==========================================================================
 773     Description:
 774         MLME message sanity check
 775     Return:
 776         TRUE if all parameters are OK, FALSE otherwise
 777
 778         IRQL = DISPATCH_LEVEL
 779
 780     ==========================================================================
 781  */
 782 BOOLEAN PeerDeauthSanity(struct rt_rtmp_adapter *pAd,
 783                          void * Msg,
 784                          unsigned long MsgLen,
 785                          u8 *pAddr2, u16 * pReason)
 786 {
 787         struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
 788
 789         COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 790         NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
 791
 792         return TRUE;
 793 }
 794
 795 /*
 796     ==========================================================================
 797     Description:
 798         MLME message sanity check
 799     Return:
 800         TRUE if all parameters are OK, FALSE otherwise
 801
 802         IRQL = DISPATCH_LEVEL
 803
 804     ==========================================================================
 805  */
 806 BOOLEAN PeerAuthSanity(struct rt_rtmp_adapter *pAd,
 807                        void * Msg,
 808                        unsigned long MsgLen,
 809                        u8 *pAddr,
 810                        u16 * pAlg,
 811                        u16 * pSeq,
 812                        u16 * pStatus, char * pChlgText)
 813 {
 814         struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
 815
 816         COPY_MAC_ADDR(pAddr, pFrame->Hdr.Addr2);
 817         NdisMoveMemory(pAlg, &pFrame->Octet[0], 2);
 818         NdisMoveMemory(pSeq, &pFrame->Octet[2], 2);
 819         NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
 820
 821         if (*pAlg == AUTH_MODE_OPEN) {
 822                 if (*pSeq == 1 || *pSeq == 2) {
 823                         return TRUE;
 824                 } else {
 825                         DBGPRINT(RT_DEBUG_TRACE,
 826                                  ("PeerAuthSanity fail - wrong Seg#\n"));
 827                         return FALSE;
 828                 }
 829         } else if (*pAlg == AUTH_MODE_KEY) {
 830                 if (*pSeq == 1 || *pSeq == 4) {
 831                         return TRUE;
 832                 } else if (*pSeq == 2 || *pSeq == 3) {
 833                         NdisMoveMemory(pChlgText, &pFrame->Octet[8],
 834                                        CIPHER_TEXT_LEN);
 835                         return TRUE;
 836                 } else {
 837                         DBGPRINT(RT_DEBUG_TRACE,
 838                                  ("PeerAuthSanity fail - wrong Seg#\n"));
 839                         return FALSE;
 840                 }
 841         } else {
 842                 DBGPRINT(RT_DEBUG_TRACE,
 843                          ("PeerAuthSanity fail - wrong algorithm\n"));
 844                 return FALSE;
 845         }
 846 }
 847
 848 /*
 849     ==========================================================================
 850     Description:
 851         MLME message sanity check
 852     Return:
 853         TRUE if all parameters are OK, FALSE otherwise
 854     ==========================================================================
 855  */
 856 BOOLEAN MlmeAuthReqSanity(struct rt_rtmp_adapter *pAd,
 857                           void * Msg,
 858                           unsigned long MsgLen,
 859                           u8 *pAddr,
 860                           unsigned long * pTimeout, u16 * pAlg)
 861 {
 862         struct rt_mlme_auth_req *pInfo;
 863
 864         pInfo = (struct rt_mlme_auth_req *)Msg;
 865         COPY_MAC_ADDR(pAddr, pInfo->Addr);
 866         *pTimeout = pInfo->Timeout;
 867         *pAlg = pInfo->Alg;
 868
 869         if (((*pAlg == AUTH_MODE_KEY) || (*pAlg == AUTH_MODE_OPEN)
 870             ) && ((*pAddr & 0x01) == 0)) {
 871                 return TRUE;
 872         } else {
 873                 DBGPRINT(RT_DEBUG_TRACE,
 874                          ("MlmeAuthReqSanity fail - wrong algorithm\n"));
 875                 return FALSE;
 876         }
 877 }
 878
 879 /*
 880     ==========================================================================
 881     Description:
 882         MLME message sanity check
 883     Return:
 884         TRUE if all parameters are OK, FALSE otherwise
 885
 886         IRQL = DISPATCH_LEVEL
 887
 888     ==========================================================================
 889  */
 890 BOOLEAN MlmeAssocReqSanity(struct rt_rtmp_adapter *pAd,
 891                            void * Msg,
 892                            unsigned long MsgLen,
 893                            u8 *pApAddr,
 894                            u16 * pCapabilityInfo,
 895                            unsigned long * pTimeout, u16 * pListenIntv)
 896 {
 897         struct rt_mlme_assoc_req *pInfo;
 898
 899         pInfo = (struct rt_mlme_assoc_req *)Msg;
 900         *pTimeout = pInfo->Timeout;     /* timeout */
 901         COPY_MAC_ADDR(pApAddr, pInfo->Addr);    /* AP address */
 902         *pCapabilityInfo = pInfo->CapabilityInfo;       /* capability info */
 903         *pListenIntv = pInfo->ListenIntv;
 904
 905         return TRUE;
 906 }
 907
 908 /*
 909     ==========================================================================
 910     Description:
 911         MLME message sanity check
 912     Return:
 913         TRUE if all parameters are OK, FALSE otherwise
 914
 915         IRQL = DISPATCH_LEVEL
 916
 917     ==========================================================================
 918  */
 919 BOOLEAN PeerDisassocSanity(struct rt_rtmp_adapter *pAd,
 920                            void * Msg,
 921                            unsigned long MsgLen,
 922                            u8 *pAddr2, u16 * pReason)
 923 {
 924         struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
 925
 926         COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 927         NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
 928
 929         return TRUE;
 930 }
 931
 932 /*
 933         ========================================================================
 934         Routine Description:
 935                 Sanity check NetworkType (11b, 11g or 11a)
 936
 937         Arguments:
 938                 pBss - Pointer to BSS table.
 939
 940         Return Value:
 941         Ndis802_11DS .......(11b)
 942         Ndis802_11OFDM24....(11g)
 943         Ndis802_11OFDM5.....(11a)
 944
 945         IRQL = DISPATCH_LEVEL
 946
 947         ========================================================================
 948 */
 949 NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(struct rt_bss_entry *pBss)
 950 {
 951         NDIS_802_11_NETWORK_TYPE NetWorkType;
 952         u8 rate, i;
 953
 954         NetWorkType = Ndis802_11DS;
 955
 956         if (pBss->Channel <= 14) {
 957                 /* */
 958                 /* First check support Rate. */
 959                 /* */
 960                 for (i = 0; i < pBss->SupRateLen; i++) {
 961                         rate = pBss->SupRate[i] & 0x7f; /* Mask out basic rate set bit */
 962                         if ((rate == 2) || (rate == 4) || (rate == 11)
 963                             || (rate == 22)) {
 964                                 continue;
 965                         } else {
 966                                 /* */
 967                                 /* Otherwise (even rate > 108) means Ndis802_11OFDM24 */
 968                                 /* */
 969                                 NetWorkType = Ndis802_11OFDM24;
 970                                 break;
 971                         }
 972                 }
 973
 974                 /* */
 975                 /* Second check Extend Rate. */
 976                 /* */
 977                 if (NetWorkType != Ndis802_11OFDM24) {
 978                         for (i = 0; i < pBss->ExtRateLen; i++) {
 979                                 rate = pBss->SupRate[i] & 0x7f; /* Mask out basic rate set bit */
 980                                 if ((rate == 2) || (rate == 4) || (rate == 11)
 981                                     || (rate == 22)) {
 982                                         continue;
 983                                 } else {
 984                                         /* */
 985                                         /* Otherwise (even rate > 108) means Ndis802_11OFDM24 */
 986                                         /* */
 987                                         NetWorkType = Ndis802_11OFDM24;
 988                                         break;
 989                                 }
 990                         }
 991                 }
 992         } else {
 993                 NetWorkType = Ndis802_11OFDM5;
 994         }
 995
 996         if (pBss->HtCapabilityLen != 0) {
 997                 if (NetWorkType == Ndis802_11OFDM5)
 998                         NetWorkType = Ndis802_11OFDM5_N;
 999                 else
1000                         NetWorkType = Ndis802_11OFDM24_N;
1001         }
1002
1003         return NetWorkType;
1004 }
1005
1006 /*
1007     ==========================================================================
1008     Description:
1009         Check the validity of the received EAPoL frame
1010     Return:
1011         TRUE if all parameters are OK,
1012         FALSE otherwise
1013     ==========================================================================
1014  */
1015 BOOLEAN PeerWpaMessageSanity(struct rt_rtmp_adapter *pAd,
1016                              struct rt_eapol_packet * pMsg,
1017                              unsigned long MsgLen,
1018                              u8 MsgType, struct rt_mac_table_entry *pEntry)
1019 {
1020         u8 mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
1021         BOOLEAN bReplayDiff = FALSE;
1022         BOOLEAN bWPA2 = FALSE;
1023         struct rt_key_info EapolKeyInfo;
1024         u8 GroupKeyIndex = 0;
1025
1026         NdisZeroMemory(mic, sizeof(mic));
1027         NdisZeroMemory(digest, sizeof(digest));
1028         NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
1029         NdisZeroMemory((u8 *)& EapolKeyInfo, sizeof(EapolKeyInfo));
1030
1031         NdisMoveMemory((u8 *)& EapolKeyInfo,
1032                        (u8 *)& pMsg->KeyDesc.KeyInfo, sizeof(struct rt_key_info));
1033
1034         *((u16 *) & EapolKeyInfo) = cpu2le16(*((u16 *) & EapolKeyInfo));
1035
1036         /* Choose WPA2 or not */
1037         if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2)
1038             || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
1039                 bWPA2 = TRUE;
1040
1041         /* 0. Check MsgType */
1042         if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1)) {
1043                 DBGPRINT(RT_DEBUG_ERROR,
1044                          ("The message type is invalid(%d)! \n", MsgType));
1045                 return FALSE;
1046         }
1047         /* 1. Replay counter check */
1048         if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) /* For supplicant */
1049         {
1050                 /* First validate replay counter, only accept message with larger replay counter. */
1051                 /* Let equal pass, some AP start with all zero replay counter */
1052                 u8 ZeroReplay[LEN_KEY_DESC_REPLAY];
1053
1054                 NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
1055                 if ((RTMPCompareMemory
1056                      (pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter,
1057                       LEN_KEY_DESC_REPLAY) != 1)
1058                     &&
1059                     (RTMPCompareMemory
1060                      (pMsg->KeyDesc.ReplayCounter, ZeroReplay,
1061                       LEN_KEY_DESC_REPLAY) != 0)) {
1062                         bReplayDiff = TRUE;
1063                 }
1064         } else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2)  /* For authenticator */
1065         {
1066                 /* check Replay Counter coresponds to MSG from authenticator, otherwise discard */
1067                 if (!NdisEqualMemory
1068                     (pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter,
1069                      LEN_KEY_DESC_REPLAY)) {
1070                         bReplayDiff = TRUE;
1071                 }
1072         }
1073         /* Replay Counter different condition */
1074         if (bReplayDiff) {
1075                 /* send wireless event - for replay counter different */
1076                 if (pAd->CommonCfg.bWirelessEvent)
1077                         RTMPSendWirelessEvent(pAd,
1078                                               IW_REPLAY_COUNTER_DIFF_EVENT_FLAG,
1079                                               pEntry->Addr, pEntry->apidx, 0);
1080
1081                 if (MsgType < EAPOL_GROUP_MSG_1) {
1082                         DBGPRINT(RT_DEBUG_ERROR,
1083                                  ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n",
1084                                   MsgType));
1085                 } else {
1086                         DBGPRINT(RT_DEBUG_ERROR,
1087                                  ("Replay Counter Different in group msg %d of 2-way handshake!\n",
1088                                   (MsgType - EAPOL_PAIR_MSG_4)));
1089                 }
1090
1091                 hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter,
1092                          LEN_KEY_DESC_REPLAY);
1093                 hex_dump("Current replay counter ", pEntry->R_Counter,
1094                          LEN_KEY_DESC_REPLAY);
1095                 return FALSE;
1096         }
1097         /* 2. Verify MIC except Pairwise Msg1 */
1098         if (MsgType != EAPOL_PAIR_MSG_1) {
1099                 u8 rcvd_mic[LEN_KEY_DESC_MIC];
1100
1101                 /* Record the received MIC for check later */
1102                 NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic,
1103                                LEN_KEY_DESC_MIC);
1104                 NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1105
1106                 if (EapolKeyInfo.KeyDescVer == DESC_TYPE_TKIP)  /* TKIP */
1107                 {
1108                         HMAC_MD5(pEntry->PTK, LEN_EAP_MICK, (u8 *)pMsg,
1109                                  MsgLen, mic, MD5_DIGEST_SIZE);
1110                 } else if (EapolKeyInfo.KeyDescVer == DESC_TYPE_AES)    /* AES */
1111                 {
1112                         HMAC_SHA1(pEntry->PTK, LEN_EAP_MICK, (u8 *)pMsg,
1113                                   MsgLen, digest, SHA1_DIGEST_SIZE);
1114                         NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
1115                 }
1116
1117                 if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC)) {
1118                         /* send wireless event - for MIC different */
1119                         if (pAd->CommonCfg.bWirelessEvent)
1120                                 RTMPSendWirelessEvent(pAd,
1121                                                       IW_MIC_DIFF_EVENT_FLAG,
1122                                                       pEntry->Addr,
1123                                                       pEntry->apidx, 0);
1124
1125                         if (MsgType < EAPOL_GROUP_MSG_1) {
1126                                 DBGPRINT(RT_DEBUG_ERROR,
1127                                          ("MIC Different in pairwise msg %d of 4-way handshake!\n",
1128                                           MsgType));
1129                         } else {
1130                                 DBGPRINT(RT_DEBUG_ERROR,
1131                                          ("MIC Different in group msg %d of 2-way handshake!\n",
1132                                           (MsgType - EAPOL_PAIR_MSG_4)));
1133                         }
1134
1135                         hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
1136                         hex_dump("Desired  MIC", mic, LEN_KEY_DESC_MIC);
1137
1138                         return FALSE;
1139                 }
1140         }
1141         /* 1. Decrypt the Key Data field if GTK is included. */
1142         /* 2. Extract the context of the Key Data field if it exist. */
1143         /* The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is clear. */
1144         /* The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted. */
1145         if (CONV_ARRARY_TO_u16(pMsg->KeyDesc.KeyDataLen) > 0) {
1146                 /* Decrypt this field */
1147                 if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2)
1148                     || (MsgType == EAPOL_GROUP_MSG_1)) {
1149                         if ((EapolKeyInfo.KeyDescVer == DESC_TYPE_AES)) {
1150                                 /* AES */
1151                                 AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA,
1152                                                    CONV_ARRARY_TO_u16(pMsg->
1153                                                                          KeyDesc.
1154                                                                          KeyDataLen),
1155                                                    pMsg->KeyDesc.KeyData);
1156                         } else {
1157                                 int i;
1158                                 u8 Key[32];
1159                                 /* Decrypt TKIP GTK */
1160                                 /* Construct 32 bytes RC4 Key */
1161                                 NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
1162                                 NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
1163                                 ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key,
1164                                              32);
1165                                 /*discard first 256 bytes */
1166                                 for (i = 0; i < 256; i++)
1167                                         ARCFOUR_BYTE(&pAd->PrivateInfo.
1168                                                      WEPCONTEXT);
1169                                 /* Decrypt GTK. Becareful, there is no ICV to check the result is correct or not */
1170                                 ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT,
1171                                                 KEYDATA, pMsg->KeyDesc.KeyData,
1172                                                 CONV_ARRARY_TO_u16(pMsg->
1173                                                                       KeyDesc.
1174                                                                       KeyDataLen));
1175                         }
1176
1177                         if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
1178                                 GroupKeyIndex = EapolKeyInfo.KeyIndex;
1179
1180                 } else if ((MsgType == EAPOL_PAIR_MSG_2)
1181                            || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2)) {
1182                         NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData,
1183                                        CONV_ARRARY_TO_u16(pMsg->KeyDesc.
1184                                                              KeyDataLen));
1185                 } else {
1186
1187                         return TRUE;
1188                 }
1189
1190                 /* Parse Key Data field to */
1191                 /* 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2) */
1192                 /* 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2 */
1193                 /* 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2) */
1194                 if (!RTMPParseEapolKeyData(pAd, KEYDATA,
1195                                            CONV_ARRARY_TO_u16(pMsg->KeyDesc.
1196                                                                  KeyDataLen),
1197                                            GroupKeyIndex, MsgType, bWPA2,
1198                                            pEntry)) {
1199                         return FALSE;
1200                 }
1201         }
1202
1203         return TRUE;
1204
1205 }