1 // SPDX-License-Identifier: GPL-2.0
2 /******************************************************************************
3  * ieee80211.c
4  *
5  * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
6  * Linux device driver for RTL8192SU
7  *
8  * Modifications for inclusion into the Linux staging tree are
9  * Copyright(c) 2010 Larry Finger. All rights reserved.
10  *
11  * Contact information:
12  * WLAN FAE <wlanfae@realtek.com>.
13  * Larry Finger <Larry.Finger@lwfinger.net>
14  *
15  ******************************************************************************/
16 
17 #define _IEEE80211_C
18 
19 #include "drv_types.h"
20 #include "ieee80211.h"
21 #include "wifi.h"
22 #include "osdep_service.h"
23 #include "wlan_bssdef.h"
24 
25 static const u8 WPA_OUI_TYPE[] = {0x00, 0x50, 0xf2, 1};
26 static const u8 WPA_CIPHER_SUITE_NONE[] = {0x00, 0x50, 0xf2, 0};
27 static const u8 WPA_CIPHER_SUITE_WEP40[] = {0x00, 0x50, 0xf2, 1};
28 static const u8 WPA_CIPHER_SUITE_TKIP[] = {0x00, 0x50, 0xf2, 2};
29 static const u8 WPA_CIPHER_SUITE_CCMP[] = {0x00, 0x50, 0xf2, 4};
30 static const u8 WPA_CIPHER_SUITE_WEP104[] = {0x00, 0x50, 0xf2, 5};
31 
32 static const u8 RSN_CIPHER_SUITE_NONE[] = {0x00, 0x0f, 0xac, 0};
33 static const u8 RSN_CIPHER_SUITE_WEP40[] = {0x00, 0x0f, 0xac, 1};
34 static const u8 RSN_CIPHER_SUITE_TKIP[] = {0x00, 0x0f, 0xac, 2};
35 static const u8 RSN_CIPHER_SUITE_CCMP[] = {0x00, 0x0f, 0xac, 4};
36 static const u8 RSN_CIPHER_SUITE_WEP104[] = {0x00, 0x0f, 0xac, 5};
37 
38 /*-----------------------------------------------------------
39  * for adhoc-master to generate ie and provide supported-rate to fw
40  *-----------------------------------------------------------
41  */
42 
43 static u8 WIFI_CCKRATES[] =  {
44 	(IEEE80211_CCK_RATE_1MB | IEEE80211_BASIC_RATE_MASK),
45 	(IEEE80211_CCK_RATE_2MB | IEEE80211_BASIC_RATE_MASK),
46 	(IEEE80211_CCK_RATE_5MB | IEEE80211_BASIC_RATE_MASK),
47 	(IEEE80211_CCK_RATE_11MB | IEEE80211_BASIC_RATE_MASK)
48 };
49 
50 static u8 WIFI_OFDMRATES[] = {
51 	(IEEE80211_OFDM_RATE_6MB),
52 	(IEEE80211_OFDM_RATE_9MB),
53 	(IEEE80211_OFDM_RATE_12MB),
54 	(IEEE80211_OFDM_RATE_18MB),
55 	(IEEE80211_OFDM_RATE_24MB),
56 	(IEEE80211_OFDM_RATE_36MB),
57 	(IEEE80211_OFDM_RATE_48MB),
58 	(IEEE80211_OFDM_RATE_54MB)
59 };
60 
r8712_is_cckrates_included(u8 * rate)61 uint r8712_is_cckrates_included(u8 *rate)
62 {
63 	u32 i = 0;
64 
65 	while (rate[i] != 0) {
66 		if ((((rate[i]) & 0x7f) == 2) || (((rate[i]) & 0x7f) == 4) ||
67 		    (((rate[i]) & 0x7f) == 11) || (((rate[i]) & 0x7f) == 22))
68 			return true;
69 		i++;
70 	}
71 	return false;
72 }
73 
r8712_is_cckratesonly_included(u8 * rate)74 uint r8712_is_cckratesonly_included(u8 *rate)
75 {
76 	u32 i = 0;
77 
78 	while (rate[i] != 0) {
79 		if ((((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
80 		    (((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22))
81 			return false;
82 		i++;
83 	}
84 	return true;
85 }
86 
87 /* r8712_set_ie will update frame length */
r8712_set_ie(u8 * pbuf,sint index,uint len,u8 * source,uint * frlen)88 u8 *r8712_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen)
89 {
90 	*pbuf = (u8)index;
91 	*(pbuf + 1) = (u8)len;
92 	if (len > 0)
93 		memcpy((void *)(pbuf + 2), (void *)source, len);
94 	*frlen = *frlen + (len + 2);
95 	return pbuf + len + 2;
96 }
97 
98 /* ---------------------------------------------------------------------------
99  * index: the information element id index, limit is the limit for search
100  * ---------------------------------------------------------------------------
101  */
r8712_get_ie(u8 * pbuf,sint index,uint * len,sint limit)102 u8 *r8712_get_ie(u8 *pbuf, sint index, uint *len, sint limit)
103 {
104 	sint tmp, i;
105 	u8 *p;
106 
107 	if (limit < 1)
108 		return NULL;
109 	p = pbuf;
110 	i = 0;
111 	*len = 0;
112 	while (1) {
113 		if (*p == index) {
114 			*len = *(p + 1);
115 			return p;
116 		}
117 		tmp = *(p + 1);
118 		p += (tmp + 2);
119 		i += (tmp + 2);
120 		if (i >= limit)
121 			break;
122 	}
123 	return NULL;
124 }
125 
set_supported_rate(u8 * rates,uint mode)126 static void set_supported_rate(u8 *rates, uint mode)
127 {
128 	memset(rates, 0, NDIS_802_11_LENGTH_RATES_EX);
129 	switch (mode) {
130 	case WIRELESS_11B:
131 		memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
132 		break;
133 	case WIRELESS_11G:
134 	case WIRELESS_11A:
135 		memcpy(rates, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN);
136 		break;
137 	case WIRELESS_11BG:
138 		memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
139 		memcpy(rates + IEEE80211_CCK_RATE_LEN, WIFI_OFDMRATES,
140 		       IEEE80211_NUM_OFDM_RATESLEN);
141 		break;
142 	}
143 }
144 
r8712_get_rateset_len(u8 * rateset)145 static uint r8712_get_rateset_len(u8 *rateset)
146 {
147 	uint i = 0;
148 
149 	while (1) {
150 		if ((rateset[i]) == 0)
151 			break;
152 		if (i > 12)
153 			break;
154 		i++;
155 	}
156 	return i;
157 }
158 
r8712_generate_ie(struct registry_priv * registrypriv)159 int r8712_generate_ie(struct registry_priv *registrypriv)
160 {
161 	int rate_len;
162 	uint sz = 0;
163 	struct wlan_bssid_ex *dev_network = &registrypriv->dev_network;
164 	u8 *ie = dev_network->IEs;
165 	u16 beacon_period = (u16)dev_network->Configuration.BeaconPeriod;
166 
167 	/*timestamp will be inserted by hardware*/
168 	sz += 8;
169 	ie += sz;
170 	/*beacon interval : 2bytes*/
171 	*(__le16 *)ie = cpu_to_le16(beacon_period);
172 	sz += 2;
173 	ie += 2;
174 	/*capability info*/
175 	*(u16 *)ie = 0;
176 	*(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_IBSS);
177 	if (registrypriv->preamble == PREAMBLE_SHORT)
178 		*(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
179 	if (dev_network->Privacy)
180 		*(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
181 	sz += 2;
182 	ie += 2;
183 	/*SSID*/
184 	ie = r8712_set_ie(ie, WLAN_EID_SSID, dev_network->Ssid.SsidLength,
185 			  dev_network->Ssid.Ssid, &sz);
186 	/*supported rates*/
187 	set_supported_rate(dev_network->rates, registrypriv->wireless_mode);
188 	rate_len = r8712_get_rateset_len(dev_network->rates);
189 	if (rate_len > 8) {
190 		ie = r8712_set_ie(ie, WLAN_EID_SUPP_RATES, 8,
191 				  dev_network->rates, &sz);
192 		ie = r8712_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8),
193 				  (dev_network->rates + 8), &sz);
194 	} else {
195 		ie = r8712_set_ie(ie, WLAN_EID_SUPP_RATES,
196 				  rate_len, dev_network->rates, &sz);
197 	}
198 	/*DS parameter set*/
199 	ie = r8712_set_ie(ie, WLAN_EID_DS_PARAMS, 1,
200 			  (u8 *)&dev_network->Configuration.DSConfig, &sz);
201 	/*IBSS Parameter Set*/
202 	ie = r8712_set_ie(ie, WLAN_EID_IBSS_PARAMS, 2,
203 			  (u8 *)&dev_network->Configuration.ATIMWindow, &sz);
204 	return sz;
205 }
206 
r8712_get_wpa_ie(unsigned char * ie,uint * wpa_ie_len,int limit)207 unsigned char *r8712_get_wpa_ie(unsigned char *ie, uint *wpa_ie_len, int limit)
208 {
209 	u32 len;
210 	u16 val16;
211 	unsigned char wpa_oui_type[] = {0x00, 0x50, 0xf2, 0x01};
212 	u8 *buf = ie;
213 
214 	while (1) {
215 		buf = r8712_get_ie(buf, _WPA_IE_ID_, &len, limit);
216 		if (buf) {
217 			/*check if oui matches...*/
218 			if (memcmp((buf + 2), wpa_oui_type,
219 				   sizeof(wpa_oui_type)))
220 				goto check_next_ie;
221 			/*check version...*/
222 			memcpy((u8 *)&val16, (buf + 6), sizeof(val16));
223 			le16_to_cpus(&val16);
224 			if (val16 != 0x0001)
225 				goto check_next_ie;
226 			*wpa_ie_len = *(buf + 1);
227 			return buf;
228 		}
229 		*wpa_ie_len = 0;
230 		return NULL;
231 check_next_ie:
232 		limit = limit - (buf - ie) - 2 - len;
233 		if (limit <= 0)
234 			break;
235 		buf += (2 + len);
236 	}
237 	*wpa_ie_len = 0;
238 	return NULL;
239 }
240 
r8712_get_wpa2_ie(unsigned char * pie,uint * rsn_ie_len,int limit)241 unsigned char *r8712_get_wpa2_ie(unsigned char *pie, uint *rsn_ie_len,
242 				 int limit)
243 {
244 	return r8712_get_ie(pie, _WPA2_IE_ID_, rsn_ie_len, limit);
245 }
246 
r8712_get_wpa_cipher_suite(u8 * s)247 static int r8712_get_wpa_cipher_suite(u8 *s)
248 {
249 	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN))
250 		return WPA_CIPHER_NONE;
251 	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN))
252 		return WPA_CIPHER_WEP40;
253 	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN))
254 		return WPA_CIPHER_TKIP;
255 	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN))
256 		return WPA_CIPHER_CCMP;
257 	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN))
258 		return WPA_CIPHER_WEP104;
259 	return 0;
260 }
261 
r8712_get_wpa2_cipher_suite(u8 * s)262 static int r8712_get_wpa2_cipher_suite(u8 *s)
263 {
264 	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN))
265 		return WPA_CIPHER_NONE;
266 	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN))
267 		return WPA_CIPHER_WEP40;
268 	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN))
269 		return WPA_CIPHER_TKIP;
270 	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN))
271 		return WPA_CIPHER_CCMP;
272 	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN))
273 		return WPA_CIPHER_WEP104;
274 	return 0;
275 }
276 
r8712_parse_wpa_ie(u8 * wpa_ie,int wpa_ie_len,int * group_cipher,int * pairwise_cipher)277 int r8712_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
278 		       int *pairwise_cipher)
279 {
280 	int i;
281 	int left, count;
282 	u8 *pos;
283 
284 	if (wpa_ie_len <= 0) {
285 		/* No WPA IE - fail silently */
286 		return -EINVAL;
287 	}
288 	if ((*wpa_ie != _WPA_IE_ID_) ||
289 	    (*(wpa_ie + 1) != (u8)(wpa_ie_len - 2)) ||
290 	    (memcmp(wpa_ie + 2, (void *)WPA_OUI_TYPE, WPA_SELECTOR_LEN)))
291 		return -EINVAL;
292 	pos = wpa_ie;
293 	pos += 8;
294 	left = wpa_ie_len - 8;
295 	/*group_cipher*/
296 	if (left >= WPA_SELECTOR_LEN) {
297 		*group_cipher = r8712_get_wpa_cipher_suite(pos);
298 		pos += WPA_SELECTOR_LEN;
299 		left -= WPA_SELECTOR_LEN;
300 	} else if (left > 0) {
301 		return -EINVAL;
302 	}
303 	/*pairwise_cipher*/
304 	if (left >= 2) {
305 		count = le16_to_cpu(*(__le16 *)pos);
306 		pos += 2;
307 		left -= 2;
308 		if (count == 0 || left < count * WPA_SELECTOR_LEN)
309 			return -EINVAL;
310 		for (i = 0; i < count; i++) {
311 			*pairwise_cipher |= r8712_get_wpa_cipher_suite(pos);
312 			pos += WPA_SELECTOR_LEN;
313 			left -= WPA_SELECTOR_LEN;
314 		}
315 	} else if (left == 1) {
316 		return -EINVAL;
317 	}
318 	return 0;
319 }
320 
r8712_parse_wpa2_ie(u8 * rsn_ie,int rsn_ie_len,int * group_cipher,int * pairwise_cipher)321 int r8712_parse_wpa2_ie(u8 *rsn_ie, int rsn_ie_len, int *group_cipher,
322 			int *pairwise_cipher)
323 {
324 	int i;
325 	int left, count;
326 	u8 *pos;
327 
328 	if (rsn_ie_len <= 0) {
329 		/* No RSN IE - fail silently */
330 		return -EINVAL;
331 	}
332 	if ((*rsn_ie != _WPA2_IE_ID_) ||
333 	    (*(rsn_ie + 1) != (u8)(rsn_ie_len - 2)))
334 		return -EINVAL;
335 	pos = rsn_ie;
336 	pos += 4;
337 	left = rsn_ie_len - 4;
338 	/*group_cipher*/
339 	if (left >= RSN_SELECTOR_LEN) {
340 		*group_cipher = r8712_get_wpa2_cipher_suite(pos);
341 		pos += RSN_SELECTOR_LEN;
342 		left -= RSN_SELECTOR_LEN;
343 	} else if (left > 0) {
344 		return -EINVAL;
345 	}
346 	/*pairwise_cipher*/
347 	if (left >= 2) {
348 		count = le16_to_cpu(*(__le16 *)pos);
349 		pos += 2;
350 		left -= 2;
351 		if (count == 0 || left < count * RSN_SELECTOR_LEN)
352 			return -EINVAL;
353 		for (i = 0; i < count; i++) {
354 			*pairwise_cipher |= r8712_get_wpa2_cipher_suite(pos);
355 			pos += RSN_SELECTOR_LEN;
356 			left -= RSN_SELECTOR_LEN;
357 		}
358 	} else if (left == 1) {
359 		return -EINVAL;
360 	}
361 	return 0;
362 }
363 
r8712_get_sec_ie(u8 * in_ie,uint in_len,u8 * rsn_ie,u16 * rsn_len,u8 * wpa_ie,u16 * wpa_len)364 int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len,
365 		     u8 *wpa_ie, u16 *wpa_len)
366 {
367 	u8 authmode;
368 	u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
369 	uint cnt;
370 
371 	/*Search required WPA or WPA2 IE and copy to sec_ie[ ]*/
372 	cnt = _TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_;
373 	while (cnt < in_len) {
374 		authmode = in_ie[cnt];
375 		if ((authmode == _WPA_IE_ID_) &&
376 		    (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) {
377 			memcpy(wpa_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
378 			*wpa_len = in_ie[cnt + 1] + 2;
379 			cnt += in_ie[cnt + 1] + 2;  /*get next */
380 		} else {
381 			if (authmode == _WPA2_IE_ID_) {
382 				memcpy(rsn_ie, &in_ie[cnt],
383 				       in_ie[cnt + 1] + 2);
384 				*rsn_len = in_ie[cnt + 1] + 2;
385 				cnt += in_ie[cnt + 1] + 2;  /*get next*/
386 			} else {
387 				cnt += in_ie[cnt + 1] + 2;   /*get next*/
388 			}
389 		}
390 	}
391 	return *rsn_len + *wpa_len;
392 }
393 
r8712_get_wps_ie(u8 * in_ie,uint in_len,u8 * wps_ie,uint * wps_ielen)394 int r8712_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
395 {
396 	int match;
397 	uint cnt;
398 	u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
399 
400 	cnt = 12;
401 	match = false;
402 	while (cnt < in_len) {
403 		eid = in_ie[cnt];
404 		if ((eid == _WPA_IE_ID_) &&
405 		    (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
406 			memcpy(wps_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
407 			*wps_ielen = in_ie[cnt + 1] + 2;
408 			cnt += in_ie[cnt + 1] + 2;
409 			match = true;
410 			break;
411 		}
412 		cnt += in_ie[cnt + 1] + 2; /* goto next */
413 	}
414 	return match;
415 }
416