drivers/staging/rt3070/common/cmm_sanity.c

   1 /*
   2  *************************************************************************
   3  * Ralink Tech Inc.
   4  * 5F., No.36, Taiyuan St., Jhubei City,
   5  * Hsinchu County 302,
   6  * Taiwan, R.O.C.
   7  *
   8  * (c) Copyright 2002-2007, Ralink Technology, Inc.
   9  *
  10  * This program is free software; you can redistribute it and/or modify  *
  11  * it under the terms of the GNU General Public License as published by  *
  12  * the Free Software Foundation; either version 2 of the License, or     *
  13  * (at your option) any later version.                                   *
  14  *                                                                       *
  15  * This program is distributed in the hope that it will be useful,       *
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  18  * GNU General Public License for more details.                          *
  19  *                                                                       *
  20  * You should have received a copy of the GNU General Public License     *
  21  * along with this program; if not, write to the                         *
  22  * Free Software Foundation, Inc.,                                       *
  23  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  24  *                                                                       *
  25  *************************************************************************
  26
  27         Module Name:
  28         sanity.c
  29
  30         Abstract:
  31
  32         Revision History:
  33         Who                     When                    What
  34         --------        ----------              ----------------------------------------------
  35         John Chang  2004-09-01      add WMM support
  36 */
  37 #include "../rt_config.h"
  38
  39
  40 extern UCHAR    CISCO_OUI[];
  41
  42 extern UCHAR    WPA_OUI[];
  43 extern UCHAR    RSN_OUI[];
  44 extern UCHAR    WME_INFO_ELEM[];
  45 extern UCHAR    WME_PARM_ELEM[];
  46 extern UCHAR    Ccx2QosInfo[];
  47 extern UCHAR    RALINK_OUI[];
  48 extern UCHAR    BROADCOM_OUI[];
  49 extern UCHAR    WPS_OUI[];
  50
  51 /*
  52     ==========================================================================
  53     Description:
  54         MLME message sanity check
  55     Return:
  56         TRUE if all parameters are OK, FALSE otherwise
  57
  58         IRQL = DISPATCH_LEVEL
  59
  60     ==========================================================================
  61  */
  62 BOOLEAN MlmeAddBAReqSanity(
  63     IN PRTMP_ADAPTER pAd,
  64     IN VOID *Msg,
  65     IN ULONG MsgLen,
  66     OUT PUCHAR pAddr2)
  67 {
  68     PMLME_ADDBA_REQ_STRUCT   pInfo;
  69
  70     pInfo = (MLME_ADDBA_REQ_STRUCT *)Msg;
  71
  72     if ((MsgLen != sizeof(MLME_ADDBA_REQ_STRUCT)))
  73     {
  74         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
  75         return FALSE;
  76     }
  77
  78     if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
  79     {
  80         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
  81         return FALSE;
  82     }
  83
  84         /*
  85     if ((pInfo->BaBufSize > MAX_RX_REORDERBUF) || (pInfo->BaBufSize < 2))
  86     {
  87         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - Rx Reordering buffer too big or too small\n"));
  88         return FALSE;
  89     }
  90         */
  91
  92     if ((pInfo->pAddr[0]&0x01) == 0x01)
  93     {
  94         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
  95         return FALSE;
  96     }
  97
  98     return TRUE;
  99 }
 100
 101 /*
 102     ==========================================================================
 103     Description:
 104         MLME message sanity check
 105     Return:
 106         TRUE if all parameters are OK, FALSE otherwise
 107
 108         IRQL = DISPATCH_LEVEL
 109
 110     ==========================================================================
 111  */
 112 BOOLEAN MlmeDelBAReqSanity(
 113     IN PRTMP_ADAPTER pAd,
 114     IN VOID *Msg,
 115     IN ULONG MsgLen)
 116 {
 117         MLME_DELBA_REQ_STRUCT *pInfo;
 118         pInfo = (MLME_DELBA_REQ_STRUCT *)Msg;
 119
 120     if ((MsgLen != sizeof(MLME_DELBA_REQ_STRUCT)))
 121     {
 122         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
 123         return FALSE;
 124     }
 125
 126     if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
 127     {
 128         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
 129         return FALSE;
 130     }
 131
 132     if ((pInfo->TID & 0xf0))
 133     {
 134         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
 135         return FALSE;
 136     }
 137
 138         if (NdisEqualMemory(pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr, MAC_ADDR_LEN) == 0)
 139     {
 140         DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
 141         return FALSE;
 142     }
 143
 144     return TRUE;
 145 }
 146
 147 BOOLEAN PeerAddBAReqActionSanity(
 148     IN PRTMP_ADAPTER pAd,
 149     IN VOID *pMsg,
 150     IN ULONG MsgLen,
 151         OUT PUCHAR pAddr2)
 152 {
 153         PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 154         PFRAME_ADDBA_REQ pAddFrame;
 155         pAddFrame = (PFRAME_ADDBA_REQ)(pMsg);
 156         if (MsgLen < (sizeof(FRAME_ADDBA_REQ)))
 157         {
 158                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n", MsgLen));
 159                 return FALSE;
 160         }
 161         // we support immediate BA.
 162         *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
 163         pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 164         pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
 165
 166         if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
 167         {
 168                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
 169                 DBGPRINT(RT_DEBUG_ERROR,("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n", pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize, pAddFrame->BaParm.AMSDUSupported));
 170                 return FALSE;
 171         }
 172
 173         // we support immediate BA.
 174         if (pAddFrame->BaParm.TID &0xfff0)
 175         {
 176                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n", pAddFrame->BaParm.TID));
 177                 return FALSE;
 178         }
 179         COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 180         return TRUE;
 181 }
 182
 183 BOOLEAN PeerAddBARspActionSanity(
 184     IN PRTMP_ADAPTER pAd,
 185     IN VOID *pMsg,
 186     IN ULONG MsgLen)
 187 {
 188         //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 189         PFRAME_ADDBA_RSP pAddFrame;
 190
 191         pAddFrame = (PFRAME_ADDBA_RSP)(pMsg);
 192         if (MsgLen < (sizeof(FRAME_ADDBA_RSP)))
 193         {
 194                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n", MsgLen));
 195                 return FALSE;
 196         }
 197         // we support immediate BA.
 198         *(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
 199         pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
 200         pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 201
 202         if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
 203         {
 204                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
 205                 return FALSE;
 206         }
 207
 208         // we support immediate BA.
 209         if (pAddFrame->BaParm.TID &0xfff0)
 210         {
 211                 DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n", pAddFrame->BaParm.TID));
 212                 return FALSE;
 213         }
 214         return TRUE;
 215
 216 }
 217
 218 BOOLEAN PeerDelBAActionSanity(
 219     IN PRTMP_ADAPTER pAd,
 220     IN UCHAR Wcid,
 221     IN VOID *pMsg,
 222     IN ULONG MsgLen )
 223 {
 224         //PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
 225         PFRAME_DELBA_REQ  pDelFrame;
 226         if (MsgLen != (sizeof(FRAME_DELBA_REQ)))
 227                 return FALSE;
 228
 229         if (Wcid >= MAX_LEN_OF_MAC_TABLE)
 230                 return FALSE;
 231
 232         pDelFrame = (PFRAME_DELBA_REQ)(pMsg);
 233
 234         *(USHORT *)(&pDelFrame->DelbaParm) = cpu2le16(*(USHORT *)(&pDelFrame->DelbaParm));
 235         pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
 236
 237         if (pDelFrame->DelbaParm.TID &0xfff0)
 238                 return FALSE;
 239
 240         return TRUE;
 241 }
 242
 243 /*
 244     ==========================================================================
 245     Description:
 246         MLME message sanity check
 247     Return:
 248         TRUE if all parameters are OK, FALSE otherwise
 249
 250         IRQL = DISPATCH_LEVEL
 251
 252     ==========================================================================
 253  */
 254 BOOLEAN PeerBeaconAndProbeRspSanity(
 255     IN PRTMP_ADAPTER pAd,
 256     IN VOID *Msg,
 257     IN ULONG MsgLen,
 258     IN UCHAR  MsgChannel,
 259     OUT PUCHAR pAddr2,
 260     OUT PUCHAR pBssid,
 261     OUT CHAR Ssid[],
 262     OUT UCHAR *pSsidLen,
 263     OUT UCHAR *pBssType,
 264     OUT USHORT *pBeaconPeriod,
 265     OUT UCHAR *pChannel,
 266     OUT UCHAR *pNewChannel,
 267     OUT LARGE_INTEGER *pTimestamp,
 268     OUT CF_PARM *pCfParm,
 269     OUT USHORT *pAtimWin,
 270     OUT USHORT *pCapabilityInfo,
 271     OUT UCHAR *pErp,
 272     OUT UCHAR *pDtimCount,
 273     OUT UCHAR *pDtimPeriod,
 274     OUT UCHAR *pBcastFlag,
 275     OUT UCHAR *pMessageToMe,
 276     OUT UCHAR SupRate[],
 277     OUT UCHAR *pSupRateLen,
 278     OUT UCHAR ExtRate[],
 279     OUT UCHAR *pExtRateLen,
 280     OUT UCHAR *pCkipFlag,
 281     OUT UCHAR *pAironetCellPowerLimit,
 282     OUT PEDCA_PARM       pEdcaParm,
 283     OUT PQBSS_LOAD_PARM  pQbssLoad,
 284     OUT PQOS_CAPABILITY_PARM pQosCapability,
 285     OUT ULONG *pRalinkIe,
 286     OUT UCHAR            *pHtCapabilityLen,
 287 #ifdef CONFIG_STA_SUPPORT
 288     OUT UCHAR            *pPreNHtCapabilityLen,
 289 #endif // CONFIG_STA_SUPPORT //
 290     OUT HT_CAPABILITY_IE *pHtCapability,
 291         OUT UCHAR                *AddHtInfoLen,
 292         OUT ADD_HT_INFO_IE *AddHtInfo,
 293         OUT UCHAR *NewExtChannelOffset,         // Ht extension channel offset(above or below)
 294     OUT USHORT *LengthVIE,
 295     OUT PNDIS_802_11_VARIABLE_IEs pVIE)
 296 {
 297     CHAR                                *Ptr;
 298 #ifdef CONFIG_STA_SUPPORT
 299         CHAR                            TimLen;
 300 #endif // CONFIG_STA_SUPPORT //
 301     PFRAME_802_11               pFrame;
 302     PEID_STRUCT         pEid;
 303     UCHAR                               SubType;
 304     UCHAR                               Sanity;
 305     //UCHAR                             ECWMin, ECWMax;
 306     //MAC_CSR9_STRUC            Csr9;
 307     ULONG                               Length = 0;
 308
 309         // For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel
 310         //      1. If the AP is 11n enabled, then check the control channel.
 311         //      2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!!)
 312         UCHAR                   CtrlChannel = 0;
 313
 314     // Add for 3 necessary EID field check
 315     Sanity = 0;
 316
 317     *pAtimWin = 0;
 318     *pErp = 0;
 319     *pDtimCount = 0;
 320     *pDtimPeriod = 0;
 321     *pBcastFlag = 0;
 322     *pMessageToMe = 0;
 323     *pExtRateLen = 0;
 324     *pCkipFlag = 0;                             // Default of CkipFlag is 0
 325     *pAironetCellPowerLimit = 0xFF;  // Default of AironetCellPowerLimit is 0xFF
 326     *LengthVIE = 0;                                     // Set the length of VIE to init value 0
 327     *pHtCapabilityLen = 0;                                      // Set the length of VIE to init value 0
 328 #ifdef CONFIG_STA_SUPPORT
 329         if (pAd->OpMode == OPMODE_STA)
 330                 *pPreNHtCapabilityLen = 0;                                      // Set the length of VIE to init value 0
 331 #endif // CONFIG_STA_SUPPORT //
 332     *AddHtInfoLen = 0;                                  // Set the length of VIE to init value 0
 333     *pRalinkIe = 0;
 334     *pNewChannel = 0;
 335     *NewExtChannelOffset = 0xff;        //Default 0xff means no such IE
 336     pCfParm->bValid = FALSE;        // default: no IE_CF found
 337     pQbssLoad->bValid = FALSE;      // default: no IE_QBSS_LOAD found
 338     pEdcaParm->bValid = FALSE;      // default: no IE_EDCA_PARAMETER found
 339     pQosCapability->bValid = FALSE; // default: no IE_QOS_CAPABILITY found
 340
 341     pFrame = (PFRAME_802_11)Msg;
 342
 343     // get subtype from header
 344     SubType = (UCHAR)pFrame->Hdr.FC.SubType;
 345
 346     // get Addr2 and BSSID from header
 347     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 348     COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
 349
 350 //      hex_dump("Beacon", Msg, MsgLen);
 351
 352     Ptr = pFrame->Octet;
 353     Length += LENGTH_802_11;
 354
 355     // get timestamp from payload and advance the pointer
 356     NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
 357
 358         pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
 359         pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
 360
 361     Ptr += TIMESTAMP_LEN;
 362     Length += TIMESTAMP_LEN;
 363
 364     // get beacon interval from payload and advance the pointer
 365     NdisMoveMemory(pBeaconPeriod, Ptr, 2);
 366     Ptr += 2;
 367     Length += 2;
 368
 369     // get capability info from payload and advance the pointer
 370     NdisMoveMemory(pCapabilityInfo, Ptr, 2);
 371     Ptr += 2;
 372     Length += 2;
 373
 374     if (CAP_IS_ESS_ON(*pCapabilityInfo))
 375         *pBssType = BSS_INFRA;
 376     else
 377         *pBssType = BSS_ADHOC;
 378
 379     pEid = (PEID_STRUCT) Ptr;
 380
 381     // get variable fields from payload and advance the pointer
 382     while ((Length + 2 + pEid->Len) <= MsgLen)
 383     {
 384         //
 385         // Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow.
 386         //
 387         if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN)
 388         {
 389             DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
 390                     (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
 391             break;
 392         }
 393
 394         switch(pEid->Eid)
 395         {
 396             case IE_SSID:
 397                 // Already has one SSID EID in this beacon, ignore the second one
 398                 if (Sanity & 0x1)
 399                     break;
 400                 if(pEid->Len <= MAX_LEN_OF_SSID)
 401                 {
 402                     NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
 403                     *pSsidLen = pEid->Len;
 404                     Sanity |= 0x1;
 405                 }
 406                 else
 407                 {
 408                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
 409                     return FALSE;
 410                 }
 411                 break;
 412
 413             case IE_SUPP_RATES:
 414                 if(pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
 415                 {
 416                     Sanity |= 0x2;
 417                     NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
 418                     *pSupRateLen = pEid->Len;
 419
 420                     // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
 421                     // from ScanTab. We should report as is. And filter out unsupported
 422                     // rates in MlmeAux.
 423                     // Check against the supported rates
 424                     // RTMPCheckRates(pAd, SupRate, pSupRateLen);
 425                 }
 426                 else
 427                 {
 428                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",pEid->Len));
 429                     return FALSE;
 430                 }
 431                 break;
 432
 433             case IE_HT_CAP:
 434                         if (pEid->Len >= SIZE_HT_CAP_IE)  //Note: allow extension.!!
 435                         {
 436                                 NdisMoveMemory(pHtCapability, pEid->Octet, sizeof(HT_CAPABILITY_IE));
 437                                 *pHtCapabilityLen = SIZE_HT_CAP_IE;     // Nnow we only support 26 bytes.
 438
 439                                 *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
 440                                 *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
 441
 442 #ifdef CONFIG_STA_SUPPORT
 443                                 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 444                                 {
 445                                         *pPreNHtCapabilityLen = 0;      // Nnow we only support 26 bytes.
 446
 447                                         Ptr = (PUCHAR) pVIE;
 448                                         NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 449                                         *LengthVIE += (pEid->Len + 2);
 450                                 }
 451 #endif // CONFIG_STA_SUPPORT //
 452                         }
 453                         else
 454                         {
 455                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n", pEid->Len));
 456                         }
 457
 458                 break;
 459             case IE_ADD_HT:
 460                         if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
 461                         {
 462                                 // This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
 463                                 // copy first sizeof(ADD_HT_INFO_IE)
 464                                 NdisMoveMemory(AddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
 465                                 *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 466
 467                                 CtrlChannel = AddHtInfo->ControlChan;
 468
 469                                 *(USHORT *)(&AddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo2));
 470                                 *(USHORT *)(&AddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo3));
 471
 472 #ifdef CONFIG_STA_SUPPORT
 473                                 IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 474                                 {
 475                                         Ptr = (PUCHAR) pVIE;
 476                                         NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 477                                         *LengthVIE += (pEid->Len + 2);
 478                                 }
 479 #endif // CONFIG_STA_SUPPORT //
 480                         }
 481                         else
 482                         {
 483                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
 484                         }
 485
 486                 break;
 487             case IE_SECONDARY_CH_OFFSET:
 488                         if (pEid->Len == 1)
 489                         {
 490                                 *NewExtChannelOffset = pEid->Octet[0];
 491                         }
 492                         else
 493                         {
 494                                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
 495                         }
 496
 497                 break;
 498             case IE_FH_PARM:
 499                 DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
 500                 break;
 501
 502             case IE_DS_PARM:
 503                 if(pEid->Len == 1)
 504                 {
 505                     *pChannel = *pEid->Octet;
 506 #ifdef CONFIG_STA_SUPPORT
 507                                         IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 508                                         {
 509                                                 if (ChannelSanity(pAd, *pChannel) == 0)
 510                                                 {
 511
 512                                                         return FALSE;
 513                                                 }
 514                                         }
 515 #endif // CONFIG_STA_SUPPORT //
 516                     Sanity |= 0x4;
 517                 }
 518                 else
 519                 {
 520                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",pEid->Len));
 521                     return FALSE;
 522                 }
 523                 break;
 524
 525             case IE_CF_PARM:
 526                 if(pEid->Len == 6)
 527                 {
 528                     pCfParm->bValid = TRUE;
 529                     pCfParm->CfpCount = pEid->Octet[0];
 530                     pCfParm->CfpPeriod = pEid->Octet[1];
 531                     pCfParm->CfpMaxDuration = pEid->Octet[2] + 256 * pEid->Octet[3];
 532                     pCfParm->CfpDurRemaining = pEid->Octet[4] + 256 * pEid->Octet[5];
 533                 }
 534                 else
 535                 {
 536                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
 537                     return FALSE;
 538                 }
 539                 break;
 540
 541             case IE_IBSS_PARM:
 542                 if(pEid->Len == 2)
 543                 {
 544                     NdisMoveMemory(pAtimWin, pEid->Octet, pEid->Len);
 545                 }
 546                 else
 547                 {
 548                     DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
 549                     return FALSE;
 550                 }
 551                 break;
 552
 553 #ifdef CONFIG_STA_SUPPORT
 554             case IE_TIM:
 555                 if(INFRA_ON(pAd) && SubType == SUBTYPE_BEACON)
 556                 {
 557                     GetTimBit((PUCHAR)pEid, pAd->StaActive.Aid, &TimLen, pBcastFlag, pDtimCount, pDtimPeriod, pMessageToMe);
 558                 }
 559                 break;
 560 #endif // CONFIG_STA_SUPPORT //
 561             case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
 562                 if(pEid->Len == 3)
 563                 {
 564                         *pNewChannel = pEid->Octet[1];  //extract new channel number
 565                 }
 566                 break;
 567
 568             // New for WPA
 569             // CCX v2 has the same IE, we need to parse that too
 570             // Wifi WMM use the same IE vale, need to parse that too
 571             // case IE_WPA:
 572             case IE_VENDOR_SPECIFIC:
 573                 // Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE.
 574                 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
 575                 /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
 576                 {
 577                         if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
 578                         {
 579                                 {
 580                                         NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
 581                                         *pHtCapabilityLen = SIZE_HT_CAP_IE;     // Nnow we only support 26 bytes.
 582                                 }
 583                         }
 584                         if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
 585                         {
 586                                 {
 587                                         NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
 588                                         *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;    // Nnow we only support 26 bytes.
 589                                 }
 590                         }
 591                 }
 592                                 */
 593                 // Check the OUI version, filter out non-standard usage
 594                 if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3) && (pEid->Len == 7))
 595                 {
 596                     //*pRalinkIe = pEid->Octet[3];
 597                     if (pEid->Octet[3] != 0)
 598                                         *pRalinkIe = pEid->Octet[3];
 599                                 else
 600                                         *pRalinkIe = 0xf0000000; // Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag.
 601                 }
 602 #ifdef CONFIG_STA_SUPPORT
 603 #ifdef DOT11_N_SUPPORT
 604                 // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
 605
 606                 // Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP,
 607                 // Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE
 608                 else if ((*pHtCapabilityLen == 0) && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI, 3) && (pEid->Len >= 4) && (pAd->OpMode == OPMODE_STA))
 609                 {
 610                     if ((pEid->Octet[3] == OUI_PREN_HT_CAP) && (pEid->Len >= 30) && (*pHtCapabilityLen == 0))
 611                     {
 612                         NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
 613                         *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
 614                     }
 615
 616                     if ((pEid->Octet[3] == OUI_PREN_ADD_HT) && (pEid->Len >= 26))
 617                     {
 618                         NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
 619                         *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 620                     }
 621                 }
 622 #endif // DOT11_N_SUPPORT //
 623 #endif // CONFIG_STA_SUPPORT //
 624                 else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
 625                 {
 626                     // Copy to pVIE which will report to microsoft bssid list.
 627                     Ptr = (PUCHAR) pVIE;
 628                     NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 629                     *LengthVIE += (pEid->Len + 2);
 630                 }
 631                 else if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
 632                 {
 633                     PUCHAR ptr;
 634                     int i;
 635
 636                     // parsing EDCA parameters
 637                     pEdcaParm->bValid          = TRUE;
 638                     pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
 639                     pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
 640                     pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
 641                     pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
 642                     pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
 643                     ptr = &pEid->Octet[8];
 644                     for (i=0; i<4; i++)
 645                     {
 646                         UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
 647                         pEdcaParm->bACM[aci]  = (((*ptr) & 0x10) == 0x10);   // b5 is ACM
 648                         pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;               // b0~3 is AIFSN
 649                         pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f;             // b0~4 is Cwmin
 650                         pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4;               // b5~8 is Cwmax
 651                         pEdcaParm->Txop[aci]  = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
 652                         ptr += 4; // point to next AC
 653                     }
 654                 }
 655                 else if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6) && (pEid->Len == 7))
 656                 {
 657                     // parsing EDCA parameters
 658                     pEdcaParm->bValid          = TRUE;
 659                     pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
 660                     pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
 661                     pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
 662                     pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
 663                     pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
 664
 665                     // use default EDCA parameter
 666                     pEdcaParm->bACM[QID_AC_BE]  = 0;
 667                     pEdcaParm->Aifsn[QID_AC_BE] = 3;
 668                     pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
 669                     pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
 670                     pEdcaParm->Txop[QID_AC_BE]  = 0;
 671
 672                     pEdcaParm->bACM[QID_AC_BK]  = 0;
 673                     pEdcaParm->Aifsn[QID_AC_BK] = 7;
 674                     pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
 675                     pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
 676                     pEdcaParm->Txop[QID_AC_BK]  = 0;
 677
 678                     pEdcaParm->bACM[QID_AC_VI]  = 0;
 679                     pEdcaParm->Aifsn[QID_AC_VI] = 2;
 680                     pEdcaParm->Cwmin[QID_AC_VI] = CW_MIN_IN_BITS-1;
 681                     pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
 682                     pEdcaParm->Txop[QID_AC_VI]  = 96;   // AC_VI: 96*32us ~= 3ms
 683
 684                     pEdcaParm->bACM[QID_AC_VO]  = 0;
 685                     pEdcaParm->Aifsn[QID_AC_VO] = 2;
 686                     pEdcaParm->Cwmin[QID_AC_VO] = CW_MIN_IN_BITS-2;
 687                     pEdcaParm->Cwmax[QID_AC_VO] = CW_MAX_IN_BITS-1;
 688                     pEdcaParm->Txop[QID_AC_VO]  = 48;   // AC_VO: 48*32us ~= 1.5ms
 689                 }
 690 #ifdef CONFIG_STA_SUPPORT
 691 #endif // CONFIG_STA_SUPPORT //
 692                 else
 693                 {
 694                 }
 695
 696                 break;
 697
 698             case IE_EXT_SUPP_RATES:
 699                 if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
 700                 {
 701                     NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
 702                     *pExtRateLen = pEid->Len;
 703
 704                     // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
 705                     // from ScanTab. We should report as is. And filter out unsupported
 706                     // rates in MlmeAux.
 707                     // Check against the supported rates
 708                     // RTMPCheckRates(pAd, ExtRate, pExtRateLen);
 709                 }
 710                 break;
 711
 712             case IE_ERP:
 713                 if (pEid->Len == 1)
 714                 {
 715                     *pErp = (UCHAR)pEid->Octet[0];
 716                 }
 717                 break;
 718
 719             case IE_AIRONET_CKIP:
 720                 // 0. Check Aironet IE length, it must be larger or equal to 28
 721                 // Cisco AP350 used length as 28
 722                 // Cisco AP12XX used length as 30
 723                 if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
 724                     break;
 725
 726                 // 1. Copy CKIP flag byte to buffer for process
 727                 *pCkipFlag = *(pEid->Octet + 8);
 728                 break;
 729
 730             case IE_AP_TX_POWER:
 731                 // AP Control of Client Transmit Power
 732                 //0. Check Aironet IE length, it must be 6
 733                 if (pEid->Len != 0x06)
 734                     break;
 735
 736                 // Get cell power limit in dBm
 737                 if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
 738                     *pAironetCellPowerLimit = *(pEid->Octet + 4);
 739                 break;
 740
 741             // WPA2 & 802.11i RSN
 742             case IE_RSN:
 743                 // There is no OUI for version anymore, check the group cipher OUI before copying
 744                 if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
 745                 {
 746                     // Copy to pVIE which will report to microsoft bssid list.
 747                     Ptr = (PUCHAR) pVIE;
 748                     NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 749                     *LengthVIE += (pEid->Len + 2);
 750                 }
 751                 break;
 752 #ifdef CONFIG_STA_SUPPORT
 753 #ifdef EXT_BUILD_CHANNEL_LIST
 754                         case IE_COUNTRY:
 755                                 Ptr = (PUCHAR) pVIE;
 756                 NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
 757                 *LengthVIE += (pEid->Len + 2);
 758                                 break;
 759 #endif // EXT_BUILD_CHANNEL_LIST //
 760 #endif // CONFIG_STA_SUPPORT //
 761             default:
 762                 break;
 763         }
 764
 765         Length = Length + 2 + pEid->Len;  // Eid[1] + Len[1]+ content[Len]
 766         pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
 767     }
 768
 769     // For some 11a AP. it did not have the channel EID, patch here
 770 #ifdef CONFIG_STA_SUPPORT
 771         IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
 772         {
 773                 UCHAR LatchRfChannel = MsgChannel;
 774                 if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0))
 775                 {
 776                         if (CtrlChannel != 0)
 777                                 *pChannel = CtrlChannel;
 778                         else
 779                                 *pChannel = LatchRfChannel;
 780                         Sanity |= 0x4;
 781                 }
 782         }
 783 #endif // CONFIG_STA_SUPPORT //
 784
 785         if (Sanity != 0x7)
 786         {
 787                 DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n", Sanity));
 788                 return FALSE;
 789         }
 790         else
 791         {
 792                 return TRUE;
 793         }
 794
 795 }
 796
 797 #ifdef DOT11N_DRAFT3
 798 /*
 799         ==========================================================================
 800         Description:
 801                 MLME message sanity check for some IE addressed  in 802.11n d3.03.
 802         Return:
 803                 TRUE if all parameters are OK, FALSE otherwise
 804
 805         IRQL = DISPATCH_LEVEL
 806
 807         ==========================================================================
 808  */
 809 BOOLEAN PeerBeaconAndProbeRspSanity2(
 810         IN PRTMP_ADAPTER pAd,
 811         IN VOID *Msg,
 812         IN ULONG MsgLen,
 813         OUT UCHAR       *RegClass)
 814 {
 815         CHAR                            *Ptr;
 816         PFRAME_802_11           pFrame;
 817         PEID_STRUCT                     pEid;
 818         ULONG                           Length = 0;
 819
 820         pFrame = (PFRAME_802_11)Msg;
 821
 822         *RegClass = 0;
 823         Ptr = pFrame->Octet;
 824         Length += LENGTH_802_11;
 825
 826         // get timestamp from payload and advance the pointer
 827         Ptr += TIMESTAMP_LEN;
 828         Length += TIMESTAMP_LEN;
 829
 830         // get beacon interval from payload and advance the pointer
 831         Ptr += 2;
 832         Length += 2;
 833
 834         // get capability info from payload and advance the pointer
 835         Ptr += 2;
 836         Length += 2;
 837
 838         pEid = (PEID_STRUCT) Ptr;
 839
 840         // get variable fields from payload and advance the pointer
 841         while ((Length + 2 + pEid->Len) <= MsgLen)
 842         {
 843                 switch(pEid->Eid)
 844                 {
 845                         case IE_SUPP_REG_CLASS:
 846                                 if(pEid->Len > 0)
 847                                 {
 848                                         *RegClass = *pEid->Octet;
 849                                 }
 850                                 else
 851                                 {
 852                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
 853                                         return FALSE;
 854                                 }
 855                                 break;
 856                 }
 857
 858                 Length = Length + 2 + pEid->Len;  // Eid[1] + Len[1]+ content[Len]
 859                 pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
 860         }
 861
 862         return TRUE;
 863
 864 }
 865 #endif // DOT11N_DRAFT3 //
 866
 867 /*
 868     ==========================================================================
 869     Description:
 870         MLME message sanity check
 871     Return:
 872         TRUE if all parameters are OK, FALSE otherwise
 873     ==========================================================================
 874  */
 875 BOOLEAN MlmeScanReqSanity(
 876         IN PRTMP_ADAPTER pAd,
 877         IN VOID *Msg,
 878         IN ULONG MsgLen,
 879         OUT UCHAR *pBssType,
 880         OUT CHAR Ssid[],
 881         OUT UCHAR *pSsidLen,
 882         OUT UCHAR *pScanType)
 883 {
 884         MLME_SCAN_REQ_STRUCT *Info;
 885
 886         Info = (MLME_SCAN_REQ_STRUCT *)(Msg);
 887         *pBssType = Info->BssType;
 888         *pSsidLen = Info->SsidLen;
 889         NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
 890         *pScanType = Info->ScanType;
 891
 892         if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC || *pBssType == BSS_ANY)
 893                 && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE
 894 #ifdef CONFIG_STA_SUPPORT
 895                 || *pScanType == SCAN_CISCO_PASSIVE || *pScanType == SCAN_CISCO_ACTIVE
 896                 || *pScanType == SCAN_CISCO_CHANNEL_LOAD || *pScanType == SCAN_CISCO_NOISE
 897 #endif // CONFIG_STA_SUPPORT //
 898                 ))
 899         {
 900                 return TRUE;
 901         }
 902         else
 903         {
 904                 DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
 905                 return FALSE;
 906         }
 907 }
 908
 909 // IRQL = DISPATCH_LEVEL
 910 UCHAR ChannelSanity(
 911     IN PRTMP_ADAPTER pAd,
 912     IN UCHAR channel)
 913 {
 914     int i;
 915
 916     for (i = 0; i < pAd->ChannelListNum; i ++)
 917     {
 918         if (channel == pAd->ChannelList[i].Channel)
 919             return 1;
 920     }
 921     return 0;
 922 }
 923
 924 /*
 925     ==========================================================================
 926     Description:
 927         MLME message sanity check
 928     Return:
 929         TRUE if all parameters are OK, FALSE otherwise
 930
 931         IRQL = DISPATCH_LEVEL
 932
 933     ==========================================================================
 934  */
 935 BOOLEAN PeerDeauthSanity(
 936     IN PRTMP_ADAPTER pAd,
 937     IN VOID *Msg,
 938     IN ULONG MsgLen,
 939     OUT PUCHAR pAddr2,
 940     OUT USHORT *pReason)
 941 {
 942     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
 943
 944     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 945     NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
 946
 947     return TRUE;
 948 }
 949
 950 /*
 951     ==========================================================================
 952     Description:
 953         MLME message sanity check
 954     Return:
 955         TRUE if all parameters are OK, FALSE otherwise
 956
 957         IRQL = DISPATCH_LEVEL
 958
 959     ==========================================================================
 960  */
 961 BOOLEAN PeerAuthSanity(
 962     IN PRTMP_ADAPTER pAd,
 963     IN VOID *Msg,
 964     IN ULONG MsgLen,
 965     OUT PUCHAR pAddr,
 966     OUT USHORT *pAlg,
 967     OUT USHORT *pSeq,
 968     OUT USHORT *pStatus,
 969     CHAR *pChlgText)
 970 {
 971     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
 972
 973     COPY_MAC_ADDR(pAddr,   pFrame->Hdr.Addr2);
 974     NdisMoveMemory(pAlg,    &pFrame->Octet[0], 2);
 975     NdisMoveMemory(pSeq,    &pFrame->Octet[2], 2);
 976     NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
 977
 978     if ((*pAlg == Ndis802_11AuthModeOpen)
 979 #ifdef LEAP_SUPPORT
 980       || (*pAlg == CISCO_AuthModeLEAP)
 981 #endif // LEAP_SUPPORT //
 982       )
 983     {
 984         if (*pSeq == 1 || *pSeq == 2)
 985         {
 986             return TRUE;
 987         }
 988         else
 989         {
 990             DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
 991             return FALSE;
 992         }
 993     }
 994     else if (*pAlg == Ndis802_11AuthModeShared)
 995     {
 996         if (*pSeq == 1 || *pSeq == 4)
 997         {
 998             return TRUE;
 999         }
1000         else if (*pSeq == 2 || *pSeq == 3)
1001         {
1002             NdisMoveMemory(pChlgText, &pFrame->Octet[8], CIPHER_TEXT_LEN);
1003             return TRUE;
1004         }
1005         else
1006         {
1007             DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
1008             return FALSE;
1009         }
1010     }
1011     else
1012     {
1013         DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong algorithm\n"));
1014         return FALSE;
1015     }
1016 }
1017
1018 /*
1019     ==========================================================================
1020     Description:
1021         MLME message sanity check
1022     Return:
1023         TRUE if all parameters are OK, FALSE otherwise
1024     ==========================================================================
1025  */
1026 BOOLEAN MlmeAuthReqSanity(
1027     IN PRTMP_ADAPTER pAd,
1028     IN VOID *Msg,
1029     IN ULONG MsgLen,
1030     OUT PUCHAR pAddr,
1031     OUT ULONG *pTimeout,
1032     OUT USHORT *pAlg)
1033 {
1034     MLME_AUTH_REQ_STRUCT *pInfo;
1035
1036     pInfo  = (MLME_AUTH_REQ_STRUCT *)Msg;
1037     COPY_MAC_ADDR(pAddr, pInfo->Addr);
1038     *pTimeout = pInfo->Timeout;
1039     *pAlg = pInfo->Alg;
1040
1041     if (((*pAlg == Ndis802_11AuthModeShared) ||(*pAlg == Ndis802_11AuthModeOpen)
1042 #ifdef LEAP_SUPPORT
1043      || (*pAlg == CISCO_AuthModeLEAP)
1044 #endif // LEAP_SUPPORT //
1045         ) &&
1046         ((*pAddr & 0x01) == 0))
1047     {
1048         return TRUE;
1049     }
1050     else
1051     {
1052         DBGPRINT(RT_DEBUG_TRACE, ("MlmeAuthReqSanity fail - wrong algorithm\n"));
1053         return FALSE;
1054     }
1055 }
1056
1057 /*
1058     ==========================================================================
1059     Description:
1060         MLME message sanity check
1061     Return:
1062         TRUE if all parameters are OK, FALSE otherwise
1063
1064         IRQL = DISPATCH_LEVEL
1065
1066     ==========================================================================
1067  */
1068 BOOLEAN MlmeAssocReqSanity(
1069     IN PRTMP_ADAPTER pAd,
1070     IN VOID *Msg,
1071     IN ULONG MsgLen,
1072     OUT PUCHAR pApAddr,
1073     OUT USHORT *pCapabilityInfo,
1074     OUT ULONG *pTimeout,
1075     OUT USHORT *pListenIntv)
1076 {
1077     MLME_ASSOC_REQ_STRUCT *pInfo;
1078
1079     pInfo = (MLME_ASSOC_REQ_STRUCT *)Msg;
1080     *pTimeout = pInfo->Timeout;                             // timeout
1081     COPY_MAC_ADDR(pApAddr, pInfo->Addr);                   // AP address
1082     *pCapabilityInfo = pInfo->CapabilityInfo;               // capability info
1083     *pListenIntv = pInfo->ListenIntv;
1084
1085     return TRUE;
1086 }
1087
1088 /*
1089     ==========================================================================
1090     Description:
1091         MLME message sanity check
1092     Return:
1093         TRUE if all parameters are OK, FALSE otherwise
1094
1095         IRQL = DISPATCH_LEVEL
1096
1097     ==========================================================================
1098  */
1099 BOOLEAN PeerDisassocSanity(
1100     IN PRTMP_ADAPTER pAd,
1101     IN VOID *Msg,
1102     IN ULONG MsgLen,
1103     OUT PUCHAR pAddr2,
1104     OUT USHORT *pReason)
1105 {
1106     PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
1107
1108     COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
1109     NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
1110
1111     return TRUE;
1112 }
1113
1114 /*
1115         ========================================================================
1116         Routine Description:
1117                 Sanity check NetworkType (11b, 11g or 11a)
1118
1119         Arguments:
1120                 pBss - Pointer to BSS table.
1121
1122         Return Value:
1123         Ndis802_11DS .......(11b)
1124         Ndis802_11OFDM24....(11g)
1125         Ndis802_11OFDM5.....(11a)
1126
1127         IRQL = DISPATCH_LEVEL
1128
1129         ========================================================================
1130 */
1131 NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
1132     IN PBSS_ENTRY pBss)
1133 {
1134         NDIS_802_11_NETWORK_TYPE        NetWorkType;
1135         UCHAR                                           rate, i;
1136
1137         NetWorkType = Ndis802_11DS;
1138
1139         if (pBss->Channel <= 14)
1140         {
1141                 //
1142                 // First check support Rate.
1143                 //
1144                 for (i = 0; i < pBss->SupRateLen; i++)
1145                 {
1146                         rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1147                         if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1148                         {
1149                                 continue;
1150                         }
1151                         else
1152                         {
1153                                 //
1154                                 // Otherwise (even rate > 108) means Ndis802_11OFDM24
1155                                 //
1156                                 NetWorkType = Ndis802_11OFDM24;
1157                                 break;
1158                         }
1159                 }
1160
1161                 //
1162                 // Second check Extend Rate.
1163                 //
1164                 if (NetWorkType != Ndis802_11OFDM24)
1165                 {
1166                         for (i = 0; i < pBss->ExtRateLen; i++)
1167                         {
1168                                 rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
1169                                 if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
1170                                 {
1171                                         continue;
1172                                 }
1173                                 else
1174                                 {
1175                                         //
1176                                         // Otherwise (even rate > 108) means Ndis802_11OFDM24
1177                                         //
1178                                         NetWorkType = Ndis802_11OFDM24;
1179                                         break;
1180                                 }
1181                         }
1182                 }
1183         }
1184         else
1185         {
1186                 NetWorkType = Ndis802_11OFDM5;
1187         }
1188
1189     if (pBss->HtCapabilityLen != 0)
1190     {
1191         if (NetWorkType == Ndis802_11OFDM5)
1192             NetWorkType = Ndis802_11OFDM5_N;
1193         else
1194             NetWorkType = Ndis802_11OFDM24_N;
1195     }
1196
1197         return NetWorkType;
1198 }
1199
1200 /*
1201     ==========================================================================
1202     Description:
1203         WPA message sanity check
1204     Return:
1205         TRUE if all parameters are OK, FALSE otherwise
1206     ==========================================================================
1207  */
1208 BOOLEAN PeerWpaMessageSanity(
1209     IN  PRTMP_ADAPTER           pAd,
1210     IN  PEAPOL_PACKET           pMsg,
1211     IN  ULONG                           MsgLen,
1212     IN  UCHAR                           MsgType,
1213     IN  MAC_TABLE_ENTRY         *pEntry)
1214 {
1215         UCHAR                   mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
1216         BOOLEAN                 bReplayDiff = FALSE;
1217         BOOLEAN                 bWPA2 = FALSE;
1218         KEY_INFO                EapolKeyInfo;
1219         UCHAR                   GroupKeyIndex = 0;
1220
1221
1222         NdisZeroMemory(mic, sizeof(mic));
1223         NdisZeroMemory(digest, sizeof(digest));
1224         NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
1225         NdisZeroMemory((PUCHAR)&EapolKeyInfo, sizeof(EapolKeyInfo));
1226
1227         NdisMoveMemory((PUCHAR)&EapolKeyInfo, (PUCHAR)&pMsg->KeyDesc.KeyInfo, sizeof(KEY_INFO));
1228
1229         *((USHORT *)&EapolKeyInfo) = cpu2le16(*((USHORT *)&EapolKeyInfo));
1230
1231         // Choose WPA2 or not
1232         if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
1233                 bWPA2 = TRUE;
1234
1235         // 0. Check MsgType
1236         if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1))
1237         {
1238                 DBGPRINT(RT_DEBUG_ERROR, ("The message type is invalid(%d)! \n", MsgType));
1239                 return FALSE;
1240         }
1241
1242         // 1. Replay counter check
1243         if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1) // For supplicant
1244     {
1245         // First validate replay counter, only accept message with larger replay counter.
1246                 // Let equal pass, some AP start with all zero replay counter
1247                 UCHAR   ZeroReplay[LEN_KEY_DESC_REPLAY];
1248
1249         NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
1250                 if ((RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY) != 1) &&
1251                         (RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, ZeroReplay, LEN_KEY_DESC_REPLAY) != 0))
1252         {
1253                         bReplayDiff = TRUE;
1254         }
1255         }
1256         else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2)    // For authenticator
1257         {
1258                 // check Replay Counter coresponds to MSG from authenticator, otherwise discard
1259         if (!NdisEqualMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY))
1260         {
1261                         bReplayDiff = TRUE;
1262         }
1263         }
1264
1265         // Replay Counter different condition
1266         if (bReplayDiff)
1267         {
1268                 // send wireless event - for replay counter different
1269                 if (pAd->CommonCfg.bWirelessEvent)
1270                         RTMPSendWirelessEvent(pAd, IW_REPLAY_COUNTER_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1271
1272                 if (MsgType < EAPOL_GROUP_MSG_1)
1273                 {
1274                 DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1275                 }
1276                 else
1277                 {
1278                         DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1279                 }
1280
1281                 hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
1282                 hex_dump("Current replay counter ", pEntry->R_Counter, LEN_KEY_DESC_REPLAY);
1283         return FALSE;
1284         }
1285
1286         // 2. Verify MIC except Pairwise Msg1
1287         if (MsgType != EAPOL_PAIR_MSG_1)
1288         {
1289                 UCHAR                   rcvd_mic[LEN_KEY_DESC_MIC];
1290
1291                 // Record the received MIC for check later
1292                 NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1293                 NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
1294
1295         if (pEntry->WepStatus == Ndis802_11Encryption2Enabled)  // TKIP
1296         {
1297             hmac_md5(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, mic);
1298         }
1299         else if (pEntry->WepStatus == Ndis802_11Encryption3Enabled)     // AES
1300         {
1301             HMAC_SHA1((PUCHAR)pMsg, MsgLen, pEntry->PTK, LEN_EAP_MICK, digest);
1302             NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
1303         }
1304
1305         if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC))
1306         {
1307                         // send wireless event - for MIC different
1308                         if (pAd->CommonCfg.bWirelessEvent)
1309                                 RTMPSendWirelessEvent(pAd, IW_MIC_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
1310
1311                         if (MsgType < EAPOL_GROUP_MSG_1)
1312                         {
1313                 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in pairwise msg %d of 4-way handshake!\n", MsgType));
1314                         }
1315                         else
1316                         {
1317                                 DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
1318                         }
1319
1320                         hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
1321                         hex_dump("Desired  MIC", mic, LEN_KEY_DESC_MIC);
1322
1323                         return FALSE;
1324         }
1325         }
1326
1327         // Extract the context of the Key Data field if it exist
1328         // The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is un-encrypted.
1329         // The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted.
1330         if (pMsg->KeyDesc.KeyDataLen[1] > 0)
1331         {
1332                 // Decrypt this field
1333                 if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2) || (MsgType == EAPOL_GROUP_MSG_1))
1334                 {
1335                         if(pEntry->WepStatus == Ndis802_11Encryption3Enabled)
1336                         {
1337                                 // AES
1338                                 AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA, pMsg->KeyDesc.KeyDataLen[1],pMsg->KeyDesc.KeyData);
1339                         }
1340                         else
1341                         {
1342                                 INT     i;
1343                                 UCHAR   Key[32];
1344                                 // Decrypt TKIP GTK
1345                                 // Construct 32 bytes RC4 Key
1346                                 NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
1347                                 NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
1348                                 ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, 32);
1349                                 //discard first 256 bytes
1350                                 for(i = 0; i < 256; i++)
1351                                         ARCFOUR_BYTE(&pAd->PrivateInfo.WEPCONTEXT);
1352                                 // Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
1353                                 ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, KEYDATA, pMsg->KeyDesc.KeyData, pMsg->KeyDesc.KeyDataLen[1]);
1354                         }
1355
1356                         if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
1357                                 GroupKeyIndex = EapolKeyInfo.KeyIndex;
1358
1359                 }
1360                 else if ((MsgType == EAPOL_PAIR_MSG_2) || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2))
1361                 {
1362                         NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData, pMsg->KeyDesc.KeyDataLen[1]);
1363                 }
1364                 else
1365                 {
1366
1367                         return TRUE;
1368                 }
1369
1370                 // Parse Key Data field to
1371                 // 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2)
1372                 // 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2
1373                 // 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2)
1374                 if (!RTMPParseEapolKeyData(pAd, KEYDATA, pMsg->KeyDesc.KeyDataLen[1], GroupKeyIndex, MsgType, bWPA2, pEntry))
1375                 {
1376                         return FALSE;
1377                 }
1378         }
1379
1380         return TRUE;
1381
1382 }
1383
1384 #ifdef CONFIG_STA_SUPPORT
1385 #ifdef QOS_DLS_SUPPORT
1386 BOOLEAN MlmeDlsReqSanity(
1387         IN PRTMP_ADAPTER pAd,
1388     IN VOID *Msg,
1389     IN ULONG MsgLen,
1390     OUT PRT_802_11_DLS *pDLS,
1391     OUT PUSHORT pReason)
1392 {
1393         MLME_DLS_REQ_STRUCT *pInfo;
1394
1395     pInfo = (MLME_DLS_REQ_STRUCT *)Msg;
1396
1397         *pDLS = pInfo->pDLS;
1398         *pReason = pInfo->Reason;
1399
1400         return TRUE;
1401 }
1402 #endif // QOS_DLS_SUPPORT //
1403 #endif // CONFIG_STA_SUPPORT //
1404
1405 #ifdef QOS_DLS_SUPPORT
1406 BOOLEAN PeerDlsReqSanity(
1407     IN PRTMP_ADAPTER pAd,
1408     IN VOID *Msg,
1409     IN ULONG MsgLen,
1410     OUT PUCHAR pDA,
1411     OUT PUCHAR pSA,
1412     OUT USHORT *pCapabilityInfo,
1413     OUT USHORT *pDlsTimeout,
1414     OUT UCHAR *pRatesLen,
1415     OUT UCHAR Rates[],
1416         OUT UCHAR *pHtCapabilityLen,
1417     OUT HT_CAPABILITY_IE *pHtCapability)
1418 {
1419         CHAR            *Ptr;
1420     PFRAME_802_11       Fr = (PFRAME_802_11)Msg;
1421         PEID_STRUCT  eid_ptr;
1422
1423     // to prevent caller from using garbage output value
1424     *pCapabilityInfo    = 0;
1425     *pDlsTimeout        = 0;
1426         *pHtCapabilityLen = 0;
1427
1428     Ptr = Fr->Octet;
1429
1430         // offset to destination MAC address (Category and Action field)
1431     Ptr += 2;
1432
1433     // get DA from payload and advance the pointer
1434     NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1435     Ptr += MAC_ADDR_LEN;
1436
1437     // get SA from payload and advance the pointer
1438     NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1439     Ptr += MAC_ADDR_LEN;
1440
1441     // get capability info from payload and advance the pointer
1442     NdisMoveMemory(pCapabilityInfo, Ptr, 2);
1443     Ptr += 2;
1444
1445     // get capability info from payload and advance the pointer
1446     NdisMoveMemory(pDlsTimeout, Ptr, 2);
1447     Ptr += 2;
1448
1449         // Category and Action field + DA + SA + capability + Timeout
1450         eid_ptr = (PEID_STRUCT) &Fr->Octet[18];
1451
1452         while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)Fr + MsgLen))
1453         {
1454                 switch(eid_ptr->Eid)
1455                 {
1456                         case IE_SUPP_RATES:
1457                 if ((eid_ptr->Len <= MAX_LEN_OF_SUPPORTED_RATES) && (eid_ptr->Len > 0))
1458                 {
1459                     NdisMoveMemory(Rates, eid_ptr->Octet, eid_ptr->Len);
1460                     DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - IE_SUPP_RATES., Len=%d. Rates[0]=%x\n",eid_ptr->Len, Rates[0]));
1461                     DBGPRINT(RT_DEBUG_TRACE, ("Rates[1]=%x %x %x %x %x %x %x\n", Rates[1], Rates[2], Rates[3], Rates[4], Rates[5], Rates[6], Rates[7]));
1462                     *pRatesLen = eid_ptr->Len;
1463                 }
1464                 else
1465                 {
1466                     *pRatesLen = 8;
1467                                         Rates[0] = 0x82;
1468                                         Rates[1] = 0x84;
1469                                         Rates[2] = 0x8b;
1470                                         Rates[3] = 0x96;
1471                                         Rates[4] = 0x12;
1472                                         Rates[5] = 0x24;
1473                                         Rates[6] = 0x48;
1474                                         Rates[7] = 0x6c;
1475                     DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - wrong IE_SUPP_RATES., Len=%d\n",eid_ptr->Len));
1476                 }
1477                                 break;
1478
1479                         case IE_EXT_SUPP_RATES:
1480                 if (eid_ptr->Len + *pRatesLen <= MAX_LEN_OF_SUPPORTED_RATES)
1481                 {
1482                     NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, eid_ptr->Len);
1483                     *pRatesLen = (*pRatesLen) + eid_ptr->Len;
1484                 }
1485                 else
1486                 {
1487                     NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, MAX_LEN_OF_SUPPORTED_RATES - (*pRatesLen));
1488                     *pRatesLen = MAX_LEN_OF_SUPPORTED_RATES;
1489                 }
1490                                 break;
1491
1492                         case IE_HT_CAP:
1493                                 if (eid_ptr->Len >= sizeof(HT_CAPABILITY_IE))
1494                                 {
1495                                         NdisMoveMemory(pHtCapability, eid_ptr->Octet, sizeof(HT_CAPABILITY_IE));
1496
1497                                         *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
1498                                         *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
1499                                         *pHtCapabilityLen = sizeof(HT_CAPABILITY_IE);
1500
1501                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - IE_HT_CAP\n"));
1502                                 }
1503                                 else
1504                                 {
1505                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - wrong IE_HT_CAP.eid_ptr->Len = %d\n", eid_ptr->Len));
1506                                 }
1507                                 break;
1508
1509                         default:
1510                                 break;
1511                 }
1512
1513                 eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
1514         }
1515
1516     return TRUE;
1517 }
1518
1519 BOOLEAN PeerDlsRspSanity(
1520     IN PRTMP_ADAPTER pAd,
1521     IN VOID *Msg,
1522     IN ULONG MsgLen,
1523     OUT PUCHAR pDA,
1524     OUT PUCHAR pSA,
1525     OUT USHORT *pCapabilityInfo,
1526     OUT USHORT *pStatus,
1527     OUT UCHAR *pRatesLen,
1528     OUT UCHAR Rates[],
1529     OUT UCHAR *pHtCapabilityLen,
1530     OUT HT_CAPABILITY_IE *pHtCapability)
1531 {
1532     CHAR            *Ptr;
1533     PFRAME_802_11       Fr = (PFRAME_802_11)Msg;
1534         PEID_STRUCT  eid_ptr;
1535
1536     // to prevent caller from using garbage output value
1537     *pStatus            = 0;
1538     *pCapabilityInfo    = 0;
1539         *pHtCapabilityLen = 0;
1540
1541     Ptr = Fr->Octet;
1542
1543         // offset to destination MAC address (Category and Action field)
1544     Ptr += 2;
1545
1546         // get status code from payload and advance the pointer
1547     NdisMoveMemory(pStatus, Ptr, 2);
1548     Ptr += 2;
1549
1550     // get DA from payload and advance the pointer
1551     NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1552     Ptr += MAC_ADDR_LEN;
1553
1554     // get SA from payload and advance the pointer
1555     NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1556     Ptr += MAC_ADDR_LEN;
1557
1558         if (pStatus == 0)
1559         {
1560             // get capability info from payload and advance the pointer
1561             NdisMoveMemory(pCapabilityInfo, Ptr, 2);
1562             Ptr += 2;
1563         }
1564
1565         // Category and Action field + status code + DA + SA + capability
1566         eid_ptr = (PEID_STRUCT) &Fr->Octet[18];
1567
1568         while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)Fr + MsgLen))
1569         {
1570                 switch(eid_ptr->Eid)
1571                 {
1572                         case IE_SUPP_RATES:
1573                 if ((eid_ptr->Len <= MAX_LEN_OF_SUPPORTED_RATES) && (eid_ptr->Len > 0))
1574                 {
1575                     NdisMoveMemory(Rates, eid_ptr->Octet, eid_ptr->Len);
1576                     DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - IE_SUPP_RATES., Len=%d. Rates[0]=%x\n",eid_ptr->Len, Rates[0]));
1577                     DBGPRINT(RT_DEBUG_TRACE, ("Rates[1]=%x %x %x %x %x %x %x\n", Rates[1], Rates[2], Rates[3], Rates[4], Rates[5], Rates[6], Rates[7]));
1578                     *pRatesLen = eid_ptr->Len;
1579                 }
1580                 else
1581                 {
1582                     *pRatesLen = 8;
1583                                         Rates[0] = 0x82;
1584                                         Rates[1] = 0x84;
1585                                         Rates[2] = 0x8b;
1586                                         Rates[3] = 0x96;
1587                                         Rates[4] = 0x12;
1588                                         Rates[5] = 0x24;
1589                                         Rates[6] = 0x48;
1590                                         Rates[7] = 0x6c;
1591                     DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - wrong IE_SUPP_RATES., Len=%d\n",eid_ptr->Len));
1592                 }
1593                                 break;
1594
1595                         case IE_EXT_SUPP_RATES:
1596                 if (eid_ptr->Len + *pRatesLen <= MAX_LEN_OF_SUPPORTED_RATES)
1597                 {
1598                     NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, eid_ptr->Len);
1599                     *pRatesLen = (*pRatesLen) + eid_ptr->Len;
1600                 }
1601                 else
1602                 {
1603                     NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, MAX_LEN_OF_SUPPORTED_RATES - (*pRatesLen));
1604                     *pRatesLen = MAX_LEN_OF_SUPPORTED_RATES;
1605                 }
1606                                 break;
1607
1608                         case IE_HT_CAP:
1609                                 if (eid_ptr->Len >= sizeof(HT_CAPABILITY_IE))
1610                                 {
1611                                         NdisMoveMemory(pHtCapability, eid_ptr->Octet, sizeof(HT_CAPABILITY_IE));
1612
1613                                         *(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
1614                                         *(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
1615                                         *pHtCapabilityLen = sizeof(HT_CAPABILITY_IE);
1616
1617                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - IE_HT_CAP\n"));
1618                                 }
1619                                 else
1620                                 {
1621                                         DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - wrong IE_HT_CAP.eid_ptr->Len = %d\n", eid_ptr->Len));
1622                                 }
1623                                 break;
1624
1625                         default:
1626                                 break;
1627                 }
1628
1629                 eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
1630         }
1631
1632     return TRUE;
1633 }
1634
1635 BOOLEAN PeerDlsTearDownSanity(
1636     IN PRTMP_ADAPTER pAd,
1637     IN VOID *Msg,
1638     IN ULONG MsgLen,
1639     OUT PUCHAR pDA,
1640     OUT PUCHAR pSA,
1641     OUT USHORT *pReason)
1642 {
1643     CHAR            *Ptr;
1644     PFRAME_802_11       Fr = (PFRAME_802_11)Msg;
1645
1646     // to prevent caller from using garbage output value
1647     *pReason    = 0;
1648
1649     Ptr = Fr->Octet;
1650
1651         // offset to destination MAC address (Category and Action field)
1652     Ptr += 2;
1653
1654     // get DA from payload and advance the pointer
1655     NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
1656     Ptr += MAC_ADDR_LEN;
1657
1658     // get SA from payload and advance the pointer
1659     NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
1660     Ptr += MAC_ADDR_LEN;
1661
1662         // get reason code from payload and advance the pointer
1663     NdisMoveMemory(pReason, Ptr, 2);
1664     Ptr += 2;
1665
1666     return TRUE;
1667 }
1668 #endif // QOS_DLS_SUPPORT //
1669