drivers/staging/rt3090/common/cmm_sanity.c

   1 /*
   2  *************************************************************************
   3  * Ralink Tech Inc.
   4  * 5F., No.36, Taiyuan St., Jhubei City,
   5  * Hsinchu County 302,
   6  * Taiwan, R.O.C.
   7  *
   8  * (c) Copyright 2002-2007, Ralink Technology, Inc.
   9  *
  10  * This program is free software; you can redistribute it and/or modify  *
  11  * it under the terms of the GNU General Public License as published by  *
  12  * the Free Software Foundation; either version 2 of the License, or     *
  13  * (at your option) any later version.                                   *
  14  *                                                                       *
  15  * This program is distributed in the hope that it will be useful,       *
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  18  * GNU General Public License for more details.                          *
  19  *                                                                       *
  20  * You should have received a copy of the GNU General Public License     *
  21  * along with this program; if not, write to the                         *
  22  * Free Software Foundation, Inc.,                                       *
  23  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  24  *                                                                       *
  25  *************************************************************************
  26
  27         Module Name:
  28         sanity.c
  29
  30         Abstract:
  31
  32         Revision History:
  33         Who                     When                    What
  34         --------        ----------              ----------------------------------------------
  35         John Chang  2004-09-01      add WMM support
  36 */
  37
  38 #include "../rt_config.h"
  39
  40
  41 extern UCHAR    CISCO_OUI[];
  42
  43 extern UCHAR    WPA_OUI[];
  44 extern UCHAR    RSN_OUI[];
  45 extern UCHAR    WME_INFO_ELEM[];
  46 extern UCHAR    WME_PARM_ELEM[];
  47 extern UCHAR    Ccx2QosInfo[];
  48 extern UCHAR    RALINK_OUI[];
  49 extern UCHAR    BROADCOM_OUI[];
  50 extern UCHAR    WPS_OUI[];
  51
  52 /*
  53     ==========================================================================
  54     Description:
  55         MLME message sanity check
  56     Return:
  57         TRUE if all parameters are OK, FALSE otherwise
  58
  59         IRQL = DISPATCH_LEVEL
  60
  61     ==========================================================================
  62  */
  63 BOOLEAN MlmeAddBAReqSanity(
  64     IN PRTMP_ADAPTER pAd,
  65     IN VOID *Msg,
  66     IN ULONG MsgLen,
  67     OUT PUCHAR pAddr2)
  68 {
  69     PMLME_ADDBA_REQ_STRUCT   pInfo;
  70
  71     pInfo = (MLME_ADDBA_REQ_STRUCT *)Msg;
  72
  73     if ((MsgLen != sizeof(MLME_ADDBA_REQ_STRUCT)))
  74     {
  75         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
  76         return FALSE;
  77     }
  78
  79     if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
  80     {
  81         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
  82         return FALSE;
  83     }
  84
  85         /*
  86     if ((pInfo->BaBufSize > MAX_RX_REORDERBUF) || (pInfo->BaBufSize < 2))
  87     {
  88         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - Rx Reordering buffer too big or too small\n"));
  89         return FALSE;
  90     }
  91         */
  92
  93     if ((pInfo->pAddr[0]&0x01) == 0x01)
  94     {
  95         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
  96         return FALSE;
  97     }
  98
  99     return TRUE;
 100 }
 101
 102 /*
 103     ==========================================================================
 104     Description:
 105         MLME message sanity check
 106     Return:
 107         TRUE if all parameters are OK, FALSE otherwise
 108
 109         IRQL = DISPATCH_LEVEL
 110
 111     ==========================================================================
 112  */
 113 BOOLEAN MlmeDelBAReqSanity(
 114     IN PRTMP_ADAPTER pAd,
 115     IN VOID *Msg,
 116     IN ULONG MsgLen)
 117 {
 118         MLME_DELBA_REQ_STRUCT *pInfo;
 119         pInfo = (MLME_DELBA_REQ_STRUCT *)Msg;
 120
 121     if ((MsgLen != sizeof(MLME_DELBA_REQ_STRUCT)))
 122     {
 123         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
 124         return FALSE;
 125     }
 126
 127     if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
 128     {
 129         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
 130         return FALSE;
 131     }
 132
 133     if ((pInfo->TID & 0xf0))
 134     {
 135         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
 136         return FALSE;
 137     }
 138
 139         if (NdisEqualMemory(pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr, MAC_ADDR_LEN) == 0)
 140     {
 141         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
 142         return FALSE;
 143     }
 144
 145     return TRUE;
 146 }
 147
 148 BOOLEAN PeerAddBAReqActionSanity(
 149     IN PRTMP_ADAPTER pAd,
 150     IN VOID *pMsg,
 151     IN ULONG MsgLen,
 152         OUT PUCHAR pAddr2)
 153 {
 154         PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 155         PFRAME_ADDBA_REQ pAddFrame;
 156         pAddFrame = (PFRAME_ADDBA_REQ)(pMsg);
 157         if (MsgLen < (sizeof(FRAME_ADDBA_REQ)))
 158         {
 159                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n", MsgLen));
 160                 return FALSE;
 161         }
 162         // we support immediate BA.
 163 #ifdef UNALIGNMENT_SUPPORT
 164         {
 165                 BA_PARM         tmpBaParm;
 166
 167                 NdisMoveMemory((PUCHAR)(&tmpBaParm), (PUCHAR)(&pAddFrame->BaParm), sizeof(BA_PARM));
 168                 *(USHORT *)(&tmpBaParm) = cpu2le16(*(USHORT *)(&tmpBaParm));
 169                 NdisMoveMemory((PUCHAR)(&pAddFrame->BaParm), (PUCHAR)(&tmpBaParm), sizeof(BA_PARM));
 170         }
 171 #else
 172         *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
 173 #endif
 174         pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 175         pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
 176
 177         if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
 178         {
 179                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
 180                 DBGPRINT(RT_DEBUG_ERROR,("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n", pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize, pAddFrame->BaParm.AMSDUSupported));
 181                 return FALSE;
 182         }
 183
 184         // we support immediate BA.
 185         if (pAddFrame->BaParm.TID &0xfff0)
 186         {
 187                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n", pAddFrame->BaParm.TID));
 188                 return FALSE;
 189         }
 190         COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 191         return TRUE;
 192 }
 193
 194 BOOLEAN PeerAddBARspActionSanity(
 195     IN PRTMP_ADAPTER pAd,
 196     IN VOID *pMsg,
 197     IN ULONG MsgLen)
 198 {
 199         //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 200         PFRAME_ADDBA_RSP pAddFrame;
 201
 202         pAddFrame = (PFRAME_ADDBA_RSP)(pMsg);
 203         if (MsgLen < (sizeof(FRAME_ADDBA_RSP)))
 204         {
 205                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n", MsgLen));
 206                 return FALSE;
 207         }
 208         // we support immediate BA.
 209 #ifdef UNALIGNMENT_SUPPORT
 210         {
 211                 BA_PARM         tmpBaParm;
 212
 213                 NdisMoveMemory((PUCHAR)(&tmpBaParm), (PUCHAR)(&pAddFrame->BaParm), sizeof(BA_PARM));
 214                 *(USHORT *)(&tmpBaParm) = cpu2le16(*(USHORT *)(&tmpBaParm));
 215                 NdisMoveMemory((PUCHAR)(&pAddFrame->BaParm), (PUCHAR)(&tmpBaParm), sizeof(BA_PARM));
 216         }
 217 #else
 218         *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
 219 #endif
 220         pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
 221         pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 222
 223         if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
 224         {
 225                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
 226                 return FALSE;
 227         }
 228
 229         // we support immediate BA.
 230         if (pAddFrame->BaParm.TID &0xfff0)
 231         {
 232                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n", pAddFrame->BaParm.TID));
 233                 return FALSE;
 234         }
 235         return TRUE;
 236
 237 }
 238
 239 BOOLEAN PeerDelBAActionSanity(
 240     IN PRTMP_ADAPTER pAd,
 241     IN UCHAR Wcid,
 242     IN VOID *pMsg,
 243     IN ULONG MsgLen )
 244 {
 245         //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 246         PFRAME_DELBA_REQ  pDelFrame;
 247         if (MsgLen != (sizeof(FRAME_DELBA_REQ)))
 248                 return FALSE;
 249
 250         if (Wcid >= MAX_LEN_OF_MAC_TABLE)
 251                 return FALSE;
 252
 253         pDelFrame = (PFRAME_DELBA_REQ)(pMsg);
 254
 255         *(USHORT *)(&pDelFrame->DelbaParm) = cpu2le16(*(USHORT *)(&pDelFrame->DelbaParm));
 256         pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
 257
 258         if (pDelFrame->DelbaParm.TID &0xfff0)
 259                 return FALSE;
 260
 261         return TRUE;
 262 }
 263
 264 /*
 265     ==========================================================================
 266     Description:
 267         MLME message sanity check
 268     Return:
 269         TRUE if all parameters are OK, FALSE otherwise
 270
 271         IRQL = DISPATCH_LEVEL
 272
 273     ==========================================================================
 274  */
 275 BOOLEAN PeerBeaconAndProbeRspSanity(
 276     IN PRTMP_ADAPTER pAd,
 277     IN VOID *Msg,
 278     IN ULONG MsgLen,
 279     IN UCHAR  MsgChannel,
 280     OUT PUCHAR pAddr2,
 281     OUT PUCHAR pBssid,
 282     OUT CHAR Ssid[],
 283     OUT UCHAR *pSsidLen,
 284     OUT UCHAR *pBssType,
 285     OUT USHORT *pBeaconPeriod,
 286     OUT UCHAR *pChannel,
 287     OUT UCHAR *pNewChannel,
 288     OUT LARGE_INTEGER *pTimestamp,
 289     OUT CF_PARM *pCfParm,
 290     OUT USHORT *pAtimWin,
 291     OUT USHORT *pCapabilityInfo,
 292     OUT UCHAR *pErp,
 293     OUT UCHAR *pDtimCount,
 294     OUT UCHAR *pDtimPeriod,
 295     OUT UCHAR *pBcastFlag,
 296     OUT UCHAR *pMessageToMe,
 297     OUT UCHAR SupRate[],
 298     OUT UCHAR *pSupRateLen,
 299     OUT UCHAR ExtRate[],
 300     OUT UCHAR *pExtRateLen,
 301     OUT UCHAR *pCkipFlag,
 302     OUT UCHAR *pAironetCellPowerLimit,
 303     OUT PEDCA_PARM       pEdcaParm,
 304     OUT PQBSS_LOAD_PARM  pQbssLoad,
 305     OUT PQOS_CAPABILITY_PARM pQosCapability,
 306     OUT ULONG *pRalinkIe,
 307     OUT UCHAR            *pHtCapabilityLen,
 308 #ifdef CONFIG_STA_SUPPORT
 309     OUT UCHAR            *pPreNHtCapabilityLen,
 310 #endif // CONFIG_STA_SUPPORT //
 311     OUT HT_CAPABILITY_IE *pHtCapability,
 312         OUT UCHAR                *AddHtInfoLen,
 313         OUT ADD_HT_INFO_IE *AddHtInfo,
 314         OUT UCHAR *NewExtChannelOffset,         // Ht extension channel offset(above or below)
 315     OUT USHORT *LengthVIE,
 316     OUT PNDIS_802_11_VARIABLE_IEs pVIE)
 317 {
 318     UCHAR                               *Ptr;
 319 #ifdef CONFIG_STA_SUPPORT
 320         UCHAR                           TimLen;
 321 #endif // CONFIG_STA_SUPPORT //
 322     PFRAME_802_11               pFrame;
 323     PEID_STRUCT         pEid;
 324     UCHAR                               SubType;
 325     UCHAR                               Sanity;
 326     //UCHAR                             ECWMin, ECWMax;
 327     //MAC_CSR9_STRUC            Csr9;
 328     ULONG                               Length = 0;
 329
 330         // For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel
 331         //      1. If the AP is 11n enabled, then check the control channel.
 332         //      2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!!)
 333         UCHAR                   CtrlChannel = 0;
 334
 335     // Add for 3 necessary EID field check
 336     Sanity = 0;
 337
 338     *pAtimWin = 0;
 339     *pErp = 0;
 340     *pDtimCount = 0;
 341     *pDtimPeriod = 0;
 342     *pBcastFlag = 0;
 343     *pMessageToMe = 0;
 344     *pExtRateLen = 0;
 345     *pCkipFlag = 0;                             // Default of CkipFlag is 0
 346     *pAironetCellPowerLimit = 0xFF;  // Default of AironetCellPowerLimit is 0xFF
 347     *LengthVIE = 0;                                     // Set the length of VIE to init value 0
 348     *pHtCapabilityLen = 0;                                      // Set the length of VIE to init value 0
 349 #ifdef CONFIG_STA_SUPPORT
 350         if (pAd->OpMode == OPMODE_STA)
 351                 *pPreNHtCapabilityLen = 0;                                      // Set the length of VIE to init value 0
 352 #endif // CONFIG_STA_SUPPORT //
 353     *AddHtInfoLen = 0;                                  // Set the length of VIE to init value 0
 354     *pRalinkIe = 0;
 355     *pNewChannel = 0;
 356     *NewExtChannelOffset = 0xff;        //Default 0xff means no such IE
 357     pCfParm->bValid = FALSE;        // default: no IE_CF found
 358     pQbssLoad->bValid = FALSE;      // default: no IE_QBSS_LOAD found
 359     pEdcaParm->bValid = FALSE;      // default: no IE_EDCA_PARAMETER found
 360     pQosCapability->bValid = FALSE; // default: no IE_QOS_CAPABILITY found
 361
 362     pFrame = (PFRAME_802_11)Msg;
 363
 364     // get subtype from header
 365     SubType = (UCHAR)pFrame->Hdr.FC.SubType;
 366
 367     // get Addr2 and BSSID from header
 368     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 369     COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
 370
 371 //      hex_dump("Beacon", Msg, MsgLen);
 372
 373     Ptr = pFrame->Octet;
 374     Length += LENGTH_802_11;
 375
 376     // get timestamp from payload and advance the pointer
 377     NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
 378
 379         pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
 380         pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
 381
 382     Ptr += TIMESTAMP_LEN;
 383     Length += TIMESTAMP_LEN;
 384
 385     // get beacon interval from payload and advance the pointer
 386     NdisMoveMemory(pBeaconPeriod, Ptr, 2);
 387     Ptr += 2;
 388     Length += 2;
 389
 390     // get capability info from payload and advance the pointer
 391     NdisMoveMemory(pCapabilityInfo, Ptr, 2);
 392     Ptr += 2;
 393     Length += 2;
 394
 395     if (CAP_IS_ESS_ON(*pCapabilityInfo))
 396         *pBssType = BSS_INFRA;
 397     else
 398         *pBssType = BSS_ADHOC;
 399
 400     pEid = (PEID_STRUCT) Ptr;
 401
 402     // get variable fields from payload and advance the pointer
 403     while ((Length + 2 + pEid->Len) <= MsgLen)
 404     {
 405         //
 406         // Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow.
 407         //
 408         if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN)
 409         {
 410             DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
 411                     (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
 412             break;
 413         }
 414
 415         switch(pEid->Eid)
 416         {
 417             case IE_SSID:
 418                 // Already has one SSID EID in this beacon, ignore the second one
 419                 if (Sanity & 0x1)
 420                     break;
 421                 if(pEid->Len <= MAX_LEN_OF_SSID)
 422                 {
 423                     NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
 424                     *pSsidLen = pEid->Len;
 425                     Sanity |= 0x1;
 426                 }
 427                 else
 428                 {
 429                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
 430                     return FALSE;
 431                 }
 432                 break;
 433
 434             case IE_SUPP_RATES:
 435                 if(pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
 436                 {
 437                     Sanity |= 0x2;
 438                     NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
 439                     *pSupRateLen = pEid->Len;
 440
 441                     // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
 442                     // from ScanTab. We should report as is. And filter out unsupported
 443                     // rates in MlmeAux.
 444                     // Check against the supported rates
 445                     // RTMPCheckRates(pAd, SupRate, pSupRateLen);
 446                 }
 447                 else
 448                 {
 449                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",pEid->Len));
 450                     return FALSE;
 451                 }
 452                 break;
 453
 454             case IE_HT_CAP:
 455                         if (pEid->Len >= SIZE_HT_CAP_IE)  //Note: allow extension.!!
 456                         {
 457                                 NdisMoveMemory(pHtCapability, pEid->Octet, sizeof(HT_CAPABILITY_IE));
 458                                 *pHtCapabilityLen = SIZE_HT_CAP_IE;     // Nnow we only support 26 bytes.
 459
 460                                 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
 461 #ifdef UNALIGNMENT_SUPPORT
 462                                 {
 463                                         EXT_HT_CAP_INFO extHtCapInfo;
 464                                         NdisMoveMemory((PUCHAR)(&extHtCapInfo), (PUCHAR)(&pHtCapability->ExtHtCapInfo), sizeof(EXT_HT_CAP_INFO));
 465                                         *(USHORT *)(&extHtCapInfo) = cpu2le16(*(USHORT *)(&extHtCapInfo));
 466                                         NdisMoveMemory((PUCHAR)(&pHtCapability->ExtHtCapInfo), (PUCHAR)(&extHtCapInfo), sizeof(EXT_HT_CAP_INFO));
 467                                 }
 468 #else
 469                                 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
 470 #endif // UNALIGNMENT_SUPPORT //
 471
 472 #ifdef CONFIG_STA_SUPPORT
 473                                 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 474                                 {
 475                                         *pPreNHtCapabilityLen = 0;      // Now we only support 26 bytes.
 476
 477                                         Ptr = (PUCHAR) pVIE;
 478                                         NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 479                                         *LengthVIE += (pEid->Len + 2);
 480                                 }
 481 #endif // CONFIG_STA_SUPPORT //
 482                         }
 483                         else
 484                         {
 485                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n", pEid->Len));
 486                         }
 487
 488                 break;
 489             case IE_ADD_HT:
 490                         if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
 491                         {
 492                                 // This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
 493                                 // copy first sizeof(ADD_HT_INFO_IE)
 494                                 NdisMoveMemory(AddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
 495                                 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 496
 497                                 CtrlChannel = AddHtInfo->ControlChan;
 498
 499                                 *(USHORT *)(&AddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo2));
 500                                 *(USHORT *)(&AddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo3));
 501
 502 #ifdef CONFIG_STA_SUPPORT
 503                                 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 504                                 {
 505                                         Ptr = (PUCHAR) pVIE;
 506                                         NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 507                                         *LengthVIE += (pEid->Len + 2);
 508                                 }
 509 #endif // CONFIG_STA_SUPPORT //
 510                         }
 511                         else
 512                         {
 513                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
 514                         }
 515
 516                 break;
 517             case IE_SECONDARY_CH_OFFSET:
 518                         if (pEid->Len == 1)
 519                         {
 520                                 *NewExtChannelOffset = pEid->Octet[0];
 521                         }
 522                         else
 523                         {
 524                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
 525                         }
 526
 527                 break;
 528             case IE_FH_PARM:
 529                 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
 530                 break;
 531
 532             case IE_DS_PARM:
 533                 if(pEid->Len == 1)
 534                 {
 535                     *pChannel = *pEid->Octet;
 536 #ifdef CONFIG_STA_SUPPORT
 537                                         IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 538                                         {
 539                                                 if (ChannelSanity(pAd, *pChannel) == 0)
 540                                                 {
 541
 542                                                         return FALSE;
 543                                                 }
 544                                         }
 545 #endif // CONFIG_STA_SUPPORT //
 546                     Sanity |= 0x4;
 547                 }
 548                 else
 549                 {
 550                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",pEid->Len));
 551                     return FALSE;
 552                 }
 553                 break;
 554
 555             case IE_CF_PARM:
 556                 if(pEid->Len == 6)
 557                 {
 558                     pCfParm->bValid = TRUE;
 559                     pCfParm->CfpCount = pEid->Octet[0];
 560                     pCfParm->CfpPeriod = pEid->Octet[1];
 561                     pCfParm->CfpMaxDuration = pEid->Octet[2] + 256 * pEid->Octet[3];
 562                     pCfParm->CfpDurRemaining = pEid->Octet[4] + 256 * pEid->Octet[5];
 563                 }
 564                 else
 565                 {
 566                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
 567                     return FALSE;
 568                 }
 569                 break;
 570
 571             case IE_IBSS_PARM:
 572                 if(pEid->Len == 2)
 573                 {
 574                     NdisMoveMemory(pAtimWin, pEid->Octet, pEid->Len);
 575                 }
 576                 else
 577                 {
 578                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
 579                     return FALSE;
 580                 }
 581                 break;
 582
 583 #ifdef CONFIG_STA_SUPPORT
 584             case IE_TIM:
 585                 if(INFRA_ON(pAd) && SubType == SUBTYPE_BEACON)
 586                 {
 587                     GetTimBit((PCHAR)pEid, pAd->StaActive.Aid, &TimLen, pBcastFlag, pDtimCount, pDtimPeriod, pMessageToMe);
 588                 }
 589                 break;
 590 #endif // CONFIG_STA_SUPPORT //
 591             case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
 592                 if(pEid->Len == 3)
 593                 {
 594                         *pNewChannel = pEid->Octet[1];  //extract new channel number
 595                 }
 596                 break;
 597
 598             // New for WPA
 599             // CCX v2 has the same IE, we need to parse that too
 600             // Wifi WMM use the same IE vale, need to parse that too
 601             // case IE_WPA:
 602             case IE_VENDOR_SPECIFIC:
 603                 // Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE.
 604                 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
 605                 /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
 606                 {
 607                         if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
 608                         {
 609                                 {
 610                                         NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
 611                                         *pHtCapabilityLen = SIZE_HT_CAP_IE;     // Nnow we only support 26 bytes.
 612                                 }
 613                         }
 614                         if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
 615                         {
 616                                 {
 617                                         NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
 618                                         *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;    // Nnow we only support 26 bytes.
 619                                 }
 620                         }
 621                 }
 622                                 */
 623                 // Check the OUI version, filter out non-standard usage
 624                 if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3) && (pEid->Len == 7))
 625                 {
 626                     //*pRalinkIe = pEid->Octet[3];
 627                     if (pEid->Octet[3] != 0)
 628                                         *pRalinkIe = pEid->Octet[3];
 629                                 else
 630                                         *pRalinkIe = 0xf0000000; // Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag.
 631                 }
 632 #ifdef CONFIG_STA_SUPPORT
 633 #ifdef DOT11_N_SUPPORT
 634                 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
 635
 636                 // Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP,
 637                 // Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE
 638                 else if ((*pHtCapabilityLen == 0) && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI, 3) && (pEid->Len >= 4) && (pAd->OpMode == OPMODE_STA))
 639                 {
 640                     if ((pEid->Octet[3] == OUI_PREN_HT_CAP) && (pEid->Len >= 30) && (*pHtCapabilityLen == 0))
 641                     {
 642                         NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
 643                         *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
 644                     }
 645
 646                     if ((pEid->Octet[3] == OUI_PREN_ADD_HT) && (pEid->Len >= 26))
 647                     {
 648                         NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
 649                         *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 650                     }
 651                 }
 652 #endif // DOT11_N_SUPPORT //
 653 #endif // CONFIG_STA_SUPPORT //
 654                 else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
 655                 {
 656                     // Copy to pVIE which will report to microsoft bssid list.
 657                     Ptr = (PUCHAR) pVIE;
 658                     NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 659                     *LengthVIE += (pEid->Len + 2);
 660                 }
 661                 else if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
 662                 {
 663                     PUCHAR ptr;
 664                     int i;
 665
 666                     // parsing EDCA parameters
 667                     pEdcaParm->bValid          = TRUE;
 668                     pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
 669                     pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
 670                     pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
 671                     pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
 672                     pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
 673                     ptr = &pEid->Octet[8];
 674                     for (i=0; i<4; i++)
 675                     {
 676                         UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
 677                         pEdcaParm->bACM[aci]  = (((*ptr) & 0x10) == 0x10);   // b5 is ACM
 678                         pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;               // b0~3 is AIFSN
 679                         pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f;             // b0~4 is Cwmin
 680                         pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4;               // b5~8 is Cwmax
 681                         pEdcaParm->Txop[aci]  = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
 682                         ptr += 4; // point to next AC
 683                     }
 684                 }
 685                 else if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6) && (pEid->Len == 7))
 686                 {
 687                     // parsing EDCA parameters
 688                     pEdcaParm->bValid          = TRUE;
 689                     pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
 690                     pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
 691                     pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
 692                     pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
 693                     pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
 694
 695                     // use default EDCA parameter
 696                     pEdcaParm->bACM[QID_AC_BE]  = 0;
 697                     pEdcaParm->Aifsn[QID_AC_BE] = 3;
 698                     pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
 699                     pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
 700                     pEdcaParm->Txop[QID_AC_BE]  = 0;
 701
 702                     pEdcaParm->bACM[QID_AC_BK]  = 0;
 703                     pEdcaParm->Aifsn[QID_AC_BK] = 7;
 704                     pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
 705                     pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
 706                     pEdcaParm->Txop[QID_AC_BK]  = 0;
 707
 708                     pEdcaParm->bACM[QID_AC_VI]  = 0;
 709                     pEdcaParm->Aifsn[QID_AC_VI] = 2;
 710                     pEdcaParm->Cwmin[QID_AC_VI] = CW_MIN_IN_BITS-1;
 711                     pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
 712                     pEdcaParm->Txop[QID_AC_VI]  = 96;   // AC_VI: 96*32us ~= 3ms
 713
 714                     pEdcaParm->bACM[QID_AC_VO]  = 0;
 715                     pEdcaParm->Aifsn[QID_AC_VO] = 2;
 716                     pEdcaParm->Cwmin[QID_AC_VO] = CW_MIN_IN_BITS-2;
 717                     pEdcaParm->Cwmax[QID_AC_VO] = CW_MAX_IN_BITS-1;
 718                     pEdcaParm->Txop[QID_AC_VO]  = 48;   // AC_VO: 48*32us ~= 1.5ms
 719                 }
 720 #ifdef CONFIG_STA_SUPPORT
 721 #endif // CONFIG_STA_SUPPORT //
 722
 723
 724                 break;
 725
 726             case IE_EXT_SUPP_RATES:
 727                 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
 728                 {
 729                     NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
 730                     *pExtRateLen = pEid->Len;
 731
 732                     // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
 733                     // from ScanTab. We should report as is. And filter out unsupported
 734                     // rates in MlmeAux.
 735                     // Check against the supported rates
 736                     // RTMPCheckRates(pAd, ExtRate, pExtRateLen);
 737                 }
 738                 break;
 739
 740             case IE_ERP:
 741                 if (pEid->Len == 1)
 742                 {
 743                     *pErp = (UCHAR)pEid->Octet[0];
 744                 }
 745                 break;
 746
 747             case IE_AIRONET_CKIP:
 748                 // 0. Check Aironet IE length, it must be larger or equal to 28
 749                 // Cisco AP350 used length as 28
 750                 // Cisco AP12XX used length as 30
 751                 if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
 752                     break;
 753
 754                 // 1. Copy CKIP flag byte to buffer for process
 755                 *pCkipFlag = *(pEid->Octet + 8);
 756                 break;
 757
 758             case IE_AP_TX_POWER:
 759                 // AP Control of Client Transmit Power
 760                 //0. Check Aironet IE length, it must be 6
 761                 if (pEid->Len != 0x06)
 762                     break;
 763
 764                 // Get cell power limit in dBm
 765                 if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
 766                     *pAironetCellPowerLimit = *(pEid->Octet + 4);
 767                 break;
 768
 769             // WPA2 & 802.11i RSN
 770             case IE_RSN:
 771                 // There is no OUI for version anymore, check the group cipher OUI before copying
 772                 if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
 773                 {
 774                     // Copy to pVIE which will report to microsoft bssid list.
 775                     Ptr = (PUCHAR) pVIE;
 776                     NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 777                     *LengthVIE += (pEid->Len + 2);
 778                 }
 779                 break;
 780 #ifdef CONFIG_STA_SUPPORT
 781 #ifdef EXT_BUILD_CHANNEL_LIST
 782                         case IE_COUNTRY:
 783                                 Ptr = (PUCHAR) pVIE;
 784                 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 785                 *LengthVIE += (pEid->Len + 2);
 786                                 break;
 787 #endif // EXT_BUILD_CHANNEL_LIST //
 788 #endif // CONFIG_STA_SUPPORT //
 789
 790
 791             default:
 792                 break;
 793         }
 794
 795         Length = Length + 2 + pEid->Len;  // Eid[1] + Len[1]+ content[Len]
 796         pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
 797     }
 798
 799     // For some 11a AP. it did not have the channel EID, patch here
 800 #ifdef CONFIG_STA_SUPPORT
 801         IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 802         {
 803                 UCHAR LatchRfChannel = MsgChannel;
 804                 if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0))
 805                 {
 806                         if (CtrlChannel != 0)
 807                                 *pChannel = CtrlChannel;
 808                         else
 809                                 *pChannel = LatchRfChannel;
 810                         Sanity |= 0x4;
 811                 }
 812         }
 813 #endif // CONFIG_STA_SUPPORT //
 814
 815         if (Sanity != 0x7)
 816         {
 817                 DBGPRINT(RT_DEBUG_LOUD, ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n", Sanity));
 818                 return FALSE;
 819         }
 820         else
 821         {
 822                 return TRUE;
 823         }
 824
 825 }
 826
 827 #ifdef DOT11N_DRAFT3
 828 /*
 829         ==========================================================================
 830         Description:
 831                 MLME message sanity check for some IE addressed  in 802.11n d3.03.
 832         Return:
 833                 TRUE if all parameters are OK, FALSE otherwise
 834
 835         IRQL = DISPATCH_LEVEL
 836
 837         ==========================================================================
 838  */
 839 BOOLEAN PeerBeaconAndProbeRspSanity2(
 840         IN PRTMP_ADAPTER pAd,
 841         IN VOID *Msg,
 842         IN ULONG MsgLen,
 843         OUT UCHAR       *RegClass)
 844 {
 845         CHAR                            *Ptr;
 846         PFRAME_802_11           pFrame;
 847         PEID_STRUCT                     pEid;
 848         ULONG                           Length = 0;
 849
 850         pFrame = (PFRAME_802_11)Msg;
 851
 852         *RegClass = 0;
 853         Ptr = (PCHAR) pFrame->Octet;
 854         Length += LENGTH_802_11;
 855
 856         // get timestamp from payload and advance the pointer
 857         Ptr += TIMESTAMP_LEN;
 858         Length += TIMESTAMP_LEN;
 859
 860         // get beacon interval from payload and advance the pointer
 861         Ptr += 2;
 862         Length += 2;
 863
 864         // get capability info from payload and advance the pointer
 865         Ptr += 2;
 866         Length += 2;
 867
 868         pEid = (PEID_STRUCT) Ptr;
 869
 870         // get variable fields from payload and advance the pointer
 871         while ((Length + 2 + pEid->Len) <= MsgLen)
 872         {
 873                 switch(pEid->Eid)
 874                 {
 875                         case IE_SUPP_REG_CLASS:
 876                                 if(pEid->Len > 0)
 877                                 {
 878                                         *RegClass = *pEid->Octet;
 879                                 }
 880                                 else
 881                                 {
 882                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
 883                                         return FALSE;
 884                                 }
 885                                 break;
 886                 }
 887
 888                 Length = Length + 2 + pEid->Len;  // Eid[1] + Len[1]+ content[Len]
 889                 pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
 890         }
 891
 892         return TRUE;
 893
 894 }
 895 #endif // DOT11N_DRAFT3 //
 896
 897 /*
 898     ==========================================================================
 899     Description:
 900         MLME message sanity check
 901     Return:
 902         TRUE if all parameters are OK, FALSE otherwise
 903     ==========================================================================
 904  */
 905 BOOLEAN MlmeScanReqSanity(
 906         IN PRTMP_ADAPTER pAd,
 907         IN VOID *Msg,
 908         IN ULONG MsgLen,
 909         OUT UCHAR *pBssType,
 910         OUT CHAR Ssid[],
 911         OUT UCHAR *pSsidLen,
 912         OUT UCHAR *pScanType)
 913 {
 914         MLME_SCAN_REQ_STRUCT *Info;
 915
 916         Info = (MLME_SCAN_REQ_STRUCT *)(Msg);
 917         *pBssType = Info->BssType;
 918         *pSsidLen = Info->SsidLen;
 919         NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
 920         *pScanType = Info->ScanType;
 921
 922         if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC || *pBssType == BSS_ANY)
 923                 && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE
 924 #ifdef CONFIG_STA_SUPPORT
 925 #endif // CONFIG_STA_SUPPORT //
 926                 ))
 927         {
 928                 return TRUE;
 929         }
 930         else
 931         {
 932                 DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
 933                 return FALSE;
 934         }
 935 }
 936
 937 // IRQL = DISPATCH_LEVEL
 938 UCHAR ChannelSanity(
 939     IN PRTMP_ADAPTER pAd,
 940     IN UCHAR channel)
 941 {
 942     int i;
 943
 944     for (i = 0; i < pAd->ChannelListNum; i ++)
 945     {
 946         if (channel == pAd->ChannelList[i].Channel)
 947             return 1;
 948     }
 949     return 0;
 950 }
 951
 952 /*
 953     ==========================================================================
 954     Description:
 955         MLME message sanity check
 956     Return:
 957         TRUE if all parameters are OK, FALSE otherwise
 958
 959         IRQL = DISPATCH_LEVEL
 960
 961     ==========================================================================
 962  */
 963 BOOLEAN PeerDeauthSanity(
 964     IN PRTMP_ADAPTER pAd,
 965     IN VOID *Msg,
 966     IN ULONG MsgLen,
 967     OUT PUCHAR pAddr2,
 968     OUT USHORT *pReason)
 969 {
 970     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
 971
 972     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 973     NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
 974
 975     return TRUE;
 976 }
 977
 978 /*
 979     ==========================================================================
 980     Description:
 981         MLME message sanity check
 982     Return:
 983         TRUE if all parameters are OK, FALSE otherwise
 984
 985         IRQL = DISPATCH_LEVEL
 986
 987     ==========================================================================
 988  */
 989 BOOLEAN PeerAuthSanity(
 990     IN PRTMP_ADAPTER pAd,
 991     IN VOID *Msg,
 992     IN ULONG MsgLen,
 993     OUT PUCHAR pAddr,
 994     OUT USHORT *pAlg,
 995     OUT USHORT *pSeq,
 996     OUT USHORT *pStatus,
 997     CHAR *pChlgText)
 998 {
 999     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
1000
1001     COPY_MAC_ADDR(pAddr,   pFrame->Hdr.Addr2);
1002     NdisMoveMemory(pAlg,    &pFrame->Octet[0], 2);
1003     NdisMoveMemory(pSeq,    &pFrame->Octet[2], 2);
1004     NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
1005
1006     if (*pAlg == AUTH_MODE_OPEN)
1007     {
1008         if (*pSeq == 1 || *pSeq == 2)
1009         {
1010             return TRUE;
1011         }
1012         else
1013         {
1014             DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
1015             return FALSE;
1016         }
1017     }
1018     else if (*pAlg == AUTH_MODE_KEY)
1019     {
1020         if (*pSeq == 1 || *pSeq == 4)
1021         {
1022             return TRUE;
1023         }
1024         else if (*pSeq == 2 || *pSeq == 3)
1025         {
1026             NdisMoveMemory(pChlgText, &pFrame->Octet[8], CIPHER_TEXT_LEN);
1027             return TRUE;
1028         }
1029         else
1030         {
1031             DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
1032             return FALSE;
1033         }
1034     }
1035     else
1036     {
1037         DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong algorithm\n"));
1038         return FALSE;
1039     }
1040 }
1041
1042 /*
1043     ==========================================================================
1044     Description:
1045         MLME message sanity check
1046     Return:
1047         TRUE if all parameters are OK, FALSE otherwise
1048     ==========================================================================
1049  */
1050 BOOLEAN MlmeAuthReqSanity(
1051     IN PRTMP_ADAPTER pAd,
1052     IN VOID *Msg,
1053     IN ULONG MsgLen,
1054     OUT PUCHAR pAddr,
1055     OUT ULONG *pTimeout,
1056     OUT USHORT *pAlg)
1057 {
1058     MLME_AUTH_REQ_STRUCT *pInfo;
1059
1060     pInfo  = (MLME_AUTH_REQ_STRUCT *)Msg;
1061     COPY_MAC_ADDR(pAddr, pInfo->Addr);
1062     *pTimeout = pInfo->Timeout;
1063     *pAlg = pInfo->Alg;
1064
1065     if (((*pAlg == AUTH_MODE_KEY) ||(*pAlg == AUTH_MODE_OPEN)
1066         ) &&
1067         ((*pAddr & 0x01) == 0))
1068     {
1069         return TRUE;
1070     }
1071     else
1072     {
1073         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAuthReqSanity fail - wrong algorithm\n"));
1074         return FALSE;
1075     }
1076 }
1077
1078 /*
1079     ==========================================================================
1080     Description:
1081         MLME message sanity check
1082     Return:
1083         TRUE if all parameters are OK, FALSE otherwise
1084
1085         IRQL = DISPATCH_LEVEL
1086
1087     ==========================================================================
1088  */
1089 BOOLEAN MlmeAssocReqSanity(
1090     IN PRTMP_ADAPTER pAd,
1091     IN VOID *Msg,
1092     IN ULONG MsgLen,
1093     OUT PUCHAR pApAddr,
1094     OUT USHORT *pCapabilityInfo,
1095     OUT ULONG *pTimeout,
1096     OUT USHORT *pListenIntv)
1097 {
1098     MLME_ASSOC_REQ_STRUCT *pInfo;
1099
1100     pInfo = (MLME_ASSOC_REQ_STRUCT *)Msg;
1101     *pTimeout = pInfo->Timeout;                             // timeout
1102     COPY_MAC_ADDR(pApAddr, pInfo->Addr);                   // AP address
1103     *pCapabilityInfo = pInfo->CapabilityInfo;               // capability info
1104     *pListenIntv = pInfo->ListenIntv;
1105
1106     return TRUE;
1107 }
1108
1109 /*
1110     ==========================================================================
1111     Description:
1112         MLME message sanity check
1113     Return:
1114         TRUE if all parameters are OK, FALSE otherwise
1115
1116         IRQL = DISPATCH_LEVEL
1117
1118     ==========================================================================
1119  */
1120 BOOLEAN PeerDisassocSanity(
1121     IN PRTMP_ADAPTER pAd,
1122     IN VOID *Msg,
1123     IN ULONG MsgLen,
1124     OUT PUCHAR pAddr2,
1125     OUT USHORT *pReason)
1126 {
1127     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
1128
1129     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
1130     NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
1131
1132     return TRUE;
1133 }
1134
1135 /*
1136         ========================================================================
1137         Routine Description:
1138                 Sanity check NetworkType (11b, 11g or 11a)
1139
1140         Arguments:
1141                 pBss - Pointer to BSS table.
1142
1143         Return Value:
1144         Ndis802_11DS .......(11b)
1145         Ndis802_11OFDM24....(11g)
1146         Ndis802_11OFDM5.....(11a)
1147
1148         IRQL = DISPATCH_LEVEL
1149
1150         ========================================================================
1151 */
1152 NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
1153     IN PBSS_ENTRY pBss)
1154 {
1155         NDIS_802_11_NETWORK_TYPE        NetWorkType;
1156         UCHAR                                           rate, i;
1157
1158         NetWorkType = Ndis802_11DS;
1159
1160         if (pBss->Channel <= 14)
1161         {
1162                 //
1163                 // First check support Rate.
1164                 //
1165                 for (i = 0; i < pBss->SupRateLen; i++)
1166                 {
1167                         rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1168                         if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1169                         {
1170                                 continue;
1171                         }
1172                         else
1173                         {
1174                                 //
1175                                 // Otherwise (even rate > 108) means Ndis802_11OFDM24
1176                                 //
1177                                 NetWorkType = Ndis802_11OFDM24;
1178                                 break;
1179                         }
1180                 }
1181
1182                 //
1183                 // Second check Extend Rate.
1184                 //
1185                 if (NetWorkType != Ndis802_11OFDM24)
1186                 {
1187                         for (i = 0; i < pBss->ExtRateLen; i++)
1188                         {
1189                                 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1190                                 if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1191                                 {
1192                                         continue;
1193                                 }
1194                                 else
1195                                 {
1196                                         //
1197                                         // Otherwise (even rate > 108) means Ndis802_11OFDM24
1198                                         //
1199                                         NetWorkType = Ndis802_11OFDM24;
1200                                         break;
1201                                 }
1202                         }
1203                 }
1204         }
1205         else
1206         {
1207                 NetWorkType = Ndis802_11OFDM5;
1208         }
1209
1210     if (pBss->HtCapabilityLen != 0)
1211     {
1212         if (NetWorkType == Ndis802_11OFDM5)
1213             NetWorkType = Ndis802_11OFDM5_N;
1214         else
1215             NetWorkType = Ndis802_11OFDM24_N;
1216     }
1217
1218         return NetWorkType;
1219 }
1220
1221 /*
1222     ==========================================================================
1223     Description:
1224         Check the validity of the received EAPoL frame
1225     Return:
1226         TRUE if all parameters are OK,
1227         FALSE otherwise
1228     ==========================================================================
1229  */
1230 BOOLEAN PeerWpaMessageSanity(
1231     IN  PRTMP_ADAPTER           pAd,
1232     IN  PEAPOL_PACKET           pMsg,
1233     IN  ULONG                           MsgLen,
1234     IN  UCHAR                           MsgType,
1235     IN  MAC_TABLE_ENTRY         *pEntry)
1236 {
1237         UCHAR                   mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
1238         BOOLEAN                 bReplayDiff = FALSE;
1239         BOOLEAN                 bWPA2 = FALSE;
1240         KEY_INFO                EapolKeyInfo;
1241         UCHAR                   GroupKeyIndex = 0;
1242
1243
1244         NdisZeroMemory(mic, sizeof(mic));
1245         NdisZeroMemory(digest, sizeof(digest));
1246         NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
1247         NdisZeroMemory((PUCHAR)&EapolKeyInfo, sizeof(EapolKeyInfo));
1248
1249         NdisMoveMemory((PUCHAR)&EapolKeyInfo, (PUCHAR)&pMsg->KeyDesc.KeyInfo, sizeof(KEY_INFO));
1250
1251         *((USHORT *)&EapolKeyInfo) = cpu2le16(*((USHORT *)&EapolKeyInfo));
1252
1253         // Choose WPA2 or not
1254         if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
1255                 bWPA2 = TRUE;
1256
1257         // 0. Check MsgType
1258         if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1))
1259         {
1260                 DBGPRINT(RT_DEBUG_ERROR, ("The message type is invalid(%d)! \n", MsgType));
1261                 return FALSE;
1262         }
1263
1264         // 1. Replay counter check
1265         if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) // For supplicant
1266     {
1267         // First validate replay counter, only accept message with larger replay counter.
1268                 // Let equal pass, some AP start with all zero replay counter
1269                 UCHAR   ZeroReplay[LEN_KEY_DESC_REPLAY];
1270
1271         NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
1272                 if ((RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY) != 1) &&
1273                         (RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, ZeroReplay, LEN_KEY_DESC_REPLAY) != 0))
1274         {
1275                         bReplayDiff = TRUE;
1276         }
1277         }
1278         else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2)    // For authenticator
1279         {
1280                 // check Replay Counter coresponds to MSG from authenticator, otherwise discard
1281         if (!NdisEqualMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY))
1282         {
1283                         bReplayDiff = TRUE;
1284         }
1285         }
1286
1287         // Replay Counter different condition
1288         if (bReplayDiff)
1289         {
1290                 // send wireless event - for replay counter different
1291                 if (pAd->CommonCfg.bWirelessEvent)
1292                         RTMPSendWirelessEvent(pAd, IW_REPLAY_COUNTER_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1293
1294                 if (MsgType < EAPOL_GROUP_MSG_1)
1295                 {
1296                 DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1297                 }
1298                 else
1299                 {
1300                         DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1301                 }
1302
1303                 hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
1304                 hex_dump("Current replay counter ", pEntry->R_Counter, LEN_KEY_DESC_REPLAY);
1305         return FALSE;
1306         }
1307
1308         // 2. Verify MIC except Pairwise Msg1
1309         if (MsgType != EAPOL_PAIR_MSG_1)
1310         {
1311                 UCHAR                   rcvd_mic[LEN_KEY_DESC_MIC];
1312
1313                 // Record the received MIC for check later
1314                 NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1315                 NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1316
1317         if (EapolKeyInfo.KeyDescVer == DESC_TYPE_TKIP)  // TKIP
1318         {
1319             HMAC_MD5(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, mic, MD5_DIGEST_SIZE);
1320         }
1321         else if (EapolKeyInfo.KeyDescVer == DESC_TYPE_AES)      // AES
1322         {
1323             HMAC_SHA1(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, digest, SHA1_DIGEST_SIZE);
1324             NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
1325         }
1326
1327         if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC))
1328         {
1329                         // send wireless event - for MIC different
1330                         if (pAd->CommonCfg.bWirelessEvent)
1331                                 RTMPSendWirelessEvent(pAd, IW_MIC_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1332
1333                         if (MsgType < EAPOL_GROUP_MSG_1)
1334                         {
1335                 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1336                         }
1337                         else
1338                         {
1339                                 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1340                         }
1341
1342                         hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
1343                         hex_dump("Desired  MIC", mic, LEN_KEY_DESC_MIC);
1344
1345                         return FALSE;
1346         }
1347         }
1348
1349         // 1. Decrypt the Key Data field if GTK is included.
1350         // 2. Extract the context of the Key Data field if it exist.
1351         // The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is clear.
1352         // The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted.
1353         if (CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen) > 0)
1354         {
1355                 // Decrypt this field
1356                 if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2) || (MsgType == EAPOL_GROUP_MSG_1))
1357                 {
1358                         if(
1359                                 (EapolKeyInfo.KeyDescVer == DESC_TYPE_AES))
1360                         {
1361                                 // AES
1362                                 AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA,
1363                                                                         CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen),
1364                                                                         pMsg->KeyDesc.KeyData);
1365                         }
1366                         else
1367                         {
1368                                 INT     i;
1369                                 UCHAR   Key[32];
1370                                 // Decrypt TKIP GTK
1371                                 // Construct 32 bytes RC4 Key
1372                                 NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
1373                                 NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
1374                                 ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, 32);
1375                                 //discard first 256 bytes
1376                                 for(i = 0; i < 256; i++)
1377                                         ARCFOUR_BYTE(&pAd->PrivateInfo.WEPCONTEXT);
1378                                 // Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
1379                                 ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, KEYDATA,
1380                                                                 pMsg->KeyDesc.KeyData,
1381                                                                 CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen));
1382                         }
1383
1384                         if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
1385                                 GroupKeyIndex = EapolKeyInfo.KeyIndex;
1386
1387                 }
1388                 else if ((MsgType == EAPOL_PAIR_MSG_2) || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2))
1389                 {
1390                         NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData, CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen));
1391                 }
1392                 else
1393                 {
1394
1395                         return TRUE;
1396                 }
1397
1398                 // Parse Key Data field to
1399                 // 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2)
1400                 // 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2
1401                 // 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2)
1402                 if (!RTMPParseEapolKeyData(pAd, KEYDATA,
1403                                                                   CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen),
1404                                                                   GroupKeyIndex, MsgType, bWPA2, pEntry))
1405                 {
1406                         return FALSE;
1407                 }
1408         }
1409
1410         return TRUE;
1411
1412 }
1413
1414 #ifdef CONFIG_STA_SUPPORT
1415 #ifdef QOS_DLS_SUPPORT
1416 BOOLEAN MlmeDlsReqSanity(
1417         IN PRTMP_ADAPTER pAd,
1418     IN VOID *Msg,
1419     IN ULONG MsgLen,
1420     OUT PRT_802_11_DLS *pDLS,
1421     OUT PUSHORT pReason)
1422 {
1423         MLME_DLS_REQ_STRUCT *pInfo;
1424
1425     pInfo = (MLME_DLS_REQ_STRUCT *)Msg;
1426
1427         *pDLS = pInfo->pDLS;
1428         *pReason = pInfo->Reason;
1429
1430         return TRUE;
1431 }
1432 #endif // QOS_DLS_SUPPORT //
1433 #endif // CONFIG_STA_SUPPORT //
1434
1435 #ifdef QOS_DLS_SUPPORT
1436 BOOLEAN PeerDlsReqSanity(
1437     IN PRTMP_ADAPTER pAd,
1438     IN VOID *Msg,
1439     IN ULONG MsgLen,
1440     OUT PUCHAR pDA,
1441     OUT PUCHAR pSA,
1442     OUT USHORT *pCapabilityInfo,
1443     OUT USHORT *pDlsTimeout,
1444     OUT UCHAR *pRatesLen,
1445     OUT UCHAR Rates[],
1446         OUT UCHAR *pHtCapabilityLen,
1447     OUT HT_CAPABILITY_IE *pHtCapability)
1448 {
1449         CHAR            *Ptr;
1450     PFRAME_802_11       Fr = (PFRAME_802_11)Msg;
1451         PEID_STRUCT  eid_ptr;
1452
1453     // to prevent caller from using garbage output value
1454     *pCapabilityInfo    = 0;
1455     *pDlsTimeout        = 0;
1456         *pHtCapabilityLen = 0;
1457
1458     Ptr = (PCHAR)Fr->Octet;
1459
1460         // offset to destination MAC address (Category and Action field)
1461     Ptr += 2;
1462
1463     // get DA from payload and advance the pointer
1464     NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1465     Ptr += MAC_ADDR_LEN;
1466
1467     // get SA from payload and advance the pointer
1468     NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1469     Ptr += MAC_ADDR_LEN;
1470
1471     // get capability info from payload and advance the pointer
1472     NdisMoveMemory(pCapabilityInfo, Ptr, 2);
1473     Ptr += 2;
1474
1475     // get capability info from payload and advance the pointer
1476     NdisMoveMemory(pDlsTimeout, Ptr, 2);
1477     Ptr += 2;
1478
1479         // Category and Action field + DA + SA + capability + Timeout
1480         eid_ptr = (PEID_STRUCT) &Fr->Octet[18];
1481
1482         while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)Fr + MsgLen))
1483         {
1484                 switch(eid_ptr->Eid)
1485                 {
1486                         case IE_SUPP_RATES:
1487                 if ((eid_ptr->Len <= MAX_LEN_OF_SUPPORTED_RATES) && (eid_ptr->Len > 0))
1488                 {
1489                     NdisMoveMemory(Rates, eid_ptr->Octet, eid_ptr->Len);
1490                     DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - IE_SUPP_RATES., Len=%d. Rates[0]=%x\n",eid_ptr->Len, Rates[0]));
1491                     DBGPRINT(RT_DEBUG_TRACE, ("Rates[1]=%x %x %x %x %x %x %x\n", Rates[1], Rates[2], Rates[3], Rates[4], Rates[5], Rates[6], Rates[7]));
1492                     *pRatesLen = eid_ptr->Len;
1493                 }
1494                 else
1495                 {
1496                     *pRatesLen = 8;
1497                                         Rates[0] = 0x82;
1498                                         Rates[1] = 0x84;
1499                                         Rates[2] = 0x8b;
1500                                         Rates[3] = 0x96;
1501                                         Rates[4] = 0x12;
1502                                         Rates[5] = 0x24;
1503                                         Rates[6] = 0x48;
1504                                         Rates[7] = 0x6c;
1505                     DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - wrong IE_SUPP_RATES., Len=%d\n",eid_ptr->Len));
1506                 }
1507                                 break;
1508
1509                         case IE_EXT_SUPP_RATES:
1510                 if (eid_ptr->Len + *pRatesLen <= MAX_LEN_OF_SUPPORTED_RATES)
1511                 {
1512                     NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, eid_ptr->Len);
1513                     *pRatesLen = (*pRatesLen) + eid_ptr->Len;
1514                 }
1515                 else
1516                 {
1517                     NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, MAX_LEN_OF_SUPPORTED_RATES - (*pRatesLen));
1518                     *pRatesLen = MAX_LEN_OF_SUPPORTED_RATES;
1519                 }
1520                                 break;
1521
1522                         case IE_HT_CAP:
1523                                 if (eid_ptr->Len >= sizeof(HT_CAPABILITY_IE))
1524                                 {
1525                                         NdisMoveMemory(pHtCapability, eid_ptr->Octet, sizeof(HT_CAPABILITY_IE));
1526
1527                                         *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
1528 #ifdef UNALIGNMENT_SUPPORT
1529                                         {
1530                                                 EXT_HT_CAP_INFO extHtCapInfo;
1531
1532                                                 NdisMoveMemory((PUCHAR)(&extHtCapInfo), (PUCHAR)(&pHtCapability->ExtHtCapInfo), sizeof(EXT_HT_CAP_INFO));
1533                                                 *(USHORT *)(&extHtCapInfo) = cpu2le16(*(USHORT *)(&extHtCapInfo));
1534                                                 NdisMoveMemory((PUCHAR)(&pHtCapability->ExtHtCapInfo), (PUCHAR)(&extHtCapInfo), sizeof(EXT_HT_CAP_INFO));
1535                                         }
1536 #else
1537                                         *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
1538 #endif // UNALIGNMENT_SUPPORT //
1539                                         *pHtCapabilityLen = sizeof(HT_CAPABILITY_IE);
1540
1541                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - IE_HT_CAP\n"));
1542                                 }
1543                                 else
1544                                 {
1545                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - wrong IE_HT_CAP.eid_ptr->Len = %d\n", eid_ptr->Len));
1546                                 }
1547                                 break;
1548
1549                         default:
1550                                 break;
1551                 }
1552
1553                 eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
1554         }
1555
1556     return TRUE;
1557 }
1558
1559 BOOLEAN PeerDlsRspSanity(
1560     IN PRTMP_ADAPTER pAd,
1561     IN VOID *Msg,
1562     IN ULONG MsgLen,
1563     OUT PUCHAR pDA,
1564     OUT PUCHAR pSA,
1565     OUT USHORT *pCapabilityInfo,
1566     OUT USHORT *pStatus,
1567     OUT UCHAR *pRatesLen,
1568     OUT UCHAR Rates[],
1569     OUT UCHAR *pHtCapabilityLen,
1570     OUT HT_CAPABILITY_IE *pHtCapability)
1571 {
1572     CHAR            *Ptr;
1573     PFRAME_802_11       Fr = (PFRAME_802_11)Msg;
1574         PEID_STRUCT  eid_ptr;
1575
1576     // to prevent caller from using garbage output value
1577     *pStatus            = 0;
1578     *pCapabilityInfo    = 0;
1579         *pHtCapabilityLen = 0;
1580
1581     Ptr = (PCHAR)Fr->Octet;
1582
1583         // offset to destination MAC address (Category and Action field)
1584     Ptr += 2;
1585
1586         // get status code from payload and advance the pointer
1587     NdisMoveMemory(pStatus, Ptr, 2);
1588     Ptr += 2;
1589
1590     // get DA from payload and advance the pointer
1591     NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1592     Ptr += MAC_ADDR_LEN;
1593
1594     // get SA from payload and advance the pointer
1595     NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1596     Ptr += MAC_ADDR_LEN;
1597
1598         if (pStatus == 0)
1599         {
1600             // get capability info from payload and advance the pointer
1601             NdisMoveMemory(pCapabilityInfo, Ptr, 2);
1602             Ptr += 2;
1603         }
1604
1605         // Category and Action field + status code + DA + SA + capability
1606         eid_ptr = (PEID_STRUCT) &Fr->Octet[18];
1607
1608         while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)Fr + MsgLen))
1609         {
1610                 switch(eid_ptr->Eid)
1611                 {
1612                         case IE_SUPP_RATES:
1613                 if ((eid_ptr->Len <= MAX_LEN_OF_SUPPORTED_RATES) && (eid_ptr->Len > 0))
1614                 {
1615                     NdisMoveMemory(Rates, eid_ptr->Octet, eid_ptr->Len);
1616                     DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - IE_SUPP_RATES., Len=%d. Rates[0]=%x\n",eid_ptr->Len, Rates[0]));
1617                     DBGPRINT(RT_DEBUG_TRACE, ("Rates[1]=%x %x %x %x %x %x %x\n", Rates[1], Rates[2], Rates[3], Rates[4], Rates[5], Rates[6], Rates[7]));
1618                     *pRatesLen = eid_ptr->Len;
1619                 }
1620                 else
1621                 {
1622                     *pRatesLen = 8;
1623                                         Rates[0] = 0x82;
1624                                         Rates[1] = 0x84;
1625                                         Rates[2] = 0x8b;
1626                                         Rates[3] = 0x96;
1627                                         Rates[4] = 0x12;
1628                                         Rates[5] = 0x24;
1629                                         Rates[6] = 0x48;
1630                                         Rates[7] = 0x6c;
1631                     DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - wrong IE_SUPP_RATES., Len=%d\n",eid_ptr->Len));
1632                 }
1633                                 break;
1634
1635                         case IE_EXT_SUPP_RATES:
1636                 if (eid_ptr->Len + *pRatesLen <= MAX_LEN_OF_SUPPORTED_RATES)
1637                 {
1638                     NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, eid_ptr->Len);
1639                     *pRatesLen = (*pRatesLen) + eid_ptr->Len;
1640                 }
1641                 else
1642                 {
1643                     NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, MAX_LEN_OF_SUPPORTED_RATES - (*pRatesLen));
1644                     *pRatesLen = MAX_LEN_OF_SUPPORTED_RATES;
1645                 }
1646                                 break;
1647
1648                         case IE_HT_CAP:
1649                                 if (eid_ptr->Len >= sizeof(HT_CAPABILITY_IE))
1650                                 {
1651                                         NdisMoveMemory(pHtCapability, eid_ptr->Octet, sizeof(HT_CAPABILITY_IE));
1652
1653                                         *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
1654 #ifdef UNALIGNMENT_SUPPORT
1655                                         {
1656                                                 EXT_HT_CAP_INFO extHtCapInfo;
1657
1658                                                 NdisMoveMemory((PUCHAR)(&extHtCapInfo), (PUCHAR)(&pHtCapability->ExtHtCapInfo), sizeof(EXT_HT_CAP_INFO));
1659                                                 *(USHORT *)(&extHtCapInfo) = cpu2le16(*(USHORT *)(&extHtCapInfo));
1660                                                 NdisMoveMemory((PUCHAR)(&pHtCapability->ExtHtCapInfo), (PUCHAR)(&extHtCapInfo), sizeof(EXT_HT_CAP_INFO));
1661                                         }
1662 #else
1663                                         *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
1664 #endif // UNALIGNMENT_SUPPORT //
1665                                         *pHtCapabilityLen = sizeof(HT_CAPABILITY_IE);
1666
1667                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - IE_HT_CAP\n"));
1668                                 }
1669                                 else
1670                                 {
1671                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - wrong IE_HT_CAP.eid_ptr->Len = %d\n", eid_ptr->Len));
1672                                 }
1673                                 break;
1674
1675                         default:
1676                                 break;
1677                 }
1678
1679                 eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
1680         }
1681
1682     return TRUE;
1683 }
1684
1685 BOOLEAN PeerDlsTearDownSanity(
1686     IN PRTMP_ADAPTER pAd,
1687     IN VOID *Msg,
1688     IN ULONG MsgLen,
1689     OUT PUCHAR pDA,
1690     OUT PUCHAR pSA,
1691     OUT USHORT *pReason)
1692 {
1693     CHAR            *Ptr;
1694     PFRAME_802_11       Fr = (PFRAME_802_11)Msg;
1695
1696     // to prevent caller from using garbage output value
1697     *pReason    = 0;
1698
1699     Ptr = (PCHAR)Fr->Octet;
1700
1701         // offset to destination MAC address (Category and Action field)
1702     Ptr += 2;
1703
1704     // get DA from payload and advance the pointer
1705     NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1706     Ptr += MAC_ADDR_LEN;
1707
1708     // get SA from payload and advance the pointer
1709     NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1710     Ptr += MAC_ADDR_LEN;
1711
1712         // get reason code from payload and advance the pointer
1713     NdisMoveMemory(pReason, Ptr, 2);
1714     Ptr += 2;
1715
1716     return TRUE;
1717 }
1718 #endif // QOS_DLS_SUPPORT //