2008-10-29 20:48:14 +01:00
|
|
|
/*
|
|
|
|
* IEEE 802.11 Common routines
|
2009-12-13 22:11:11 +01:00
|
|
|
* Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
|
2008-10-29 20:48:14 +01:00
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
|
|
* published by the Free Software Foundation.
|
|
|
|
*
|
|
|
|
* Alternatively, this software may be distributed under the terms of BSD
|
|
|
|
* license.
|
|
|
|
*
|
|
|
|
* See README and COPYING for more details.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include "includes.h"
|
|
|
|
|
|
|
|
#include "common.h"
|
|
|
|
#include "ieee802_11_defs.h"
|
|
|
|
#include "ieee802_11_common.h"
|
|
|
|
|
|
|
|
|
2009-12-13 22:11:11 +01:00
|
|
|
static int ieee802_11_parse_vendor_specific(const u8 *pos, size_t elen,
|
2008-10-29 20:48:14 +01:00
|
|
|
struct ieee802_11_elems *elems,
|
|
|
|
int show_errors)
|
|
|
|
{
|
|
|
|
unsigned int oui;
|
|
|
|
|
|
|
|
/* first 3 bytes in vendor specific information element are the IEEE
|
|
|
|
* OUI of the vendor. The following byte is used a vendor specific
|
|
|
|
* sub-type. */
|
|
|
|
if (elen < 4) {
|
|
|
|
if (show_errors) {
|
|
|
|
wpa_printf(MSG_MSGDUMP, "short vendor specific "
|
|
|
|
"information element ignored (len=%lu)",
|
|
|
|
(unsigned long) elen);
|
|
|
|
}
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
oui = WPA_GET_BE24(pos);
|
|
|
|
switch (oui) {
|
|
|
|
case OUI_MICROSOFT:
|
|
|
|
/* Microsoft/Wi-Fi information elements are further typed and
|
|
|
|
* subtyped */
|
|
|
|
switch (pos[3]) {
|
|
|
|
case 1:
|
|
|
|
/* Microsoft OUI (00:50:F2) with OUI Type 1:
|
|
|
|
* real WPA information element */
|
|
|
|
elems->wpa_ie = pos;
|
|
|
|
elems->wpa_ie_len = elen;
|
|
|
|
break;
|
2009-03-04 11:33:24 +01:00
|
|
|
case WMM_OUI_TYPE:
|
|
|
|
/* WMM information element */
|
2008-10-29 20:48:14 +01:00
|
|
|
if (elen < 5) {
|
2009-03-04 11:33:24 +01:00
|
|
|
wpa_printf(MSG_MSGDUMP, "short WMM "
|
2008-10-29 20:48:14 +01:00
|
|
|
"information element ignored "
|
|
|
|
"(len=%lu)",
|
|
|
|
(unsigned long) elen);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
switch (pos[4]) {
|
2009-03-04 11:33:24 +01:00
|
|
|
case WMM_OUI_SUBTYPE_INFORMATION_ELEMENT:
|
|
|
|
case WMM_OUI_SUBTYPE_PARAMETER_ELEMENT:
|
|
|
|
/*
|
|
|
|
* Share same pointer since only one of these
|
|
|
|
* is used and they start with same data.
|
|
|
|
* Length field can be used to distinguish the
|
|
|
|
* IEs.
|
|
|
|
*/
|
|
|
|
elems->wmm = pos;
|
|
|
|
elems->wmm_len = elen;
|
2008-10-29 20:48:14 +01:00
|
|
|
break;
|
2009-03-04 11:33:24 +01:00
|
|
|
case WMM_OUI_SUBTYPE_TSPEC_ELEMENT:
|
|
|
|
elems->wmm_tspec = pos;
|
|
|
|
elems->wmm_tspec_len = elen;
|
2008-10-29 20:48:14 +01:00
|
|
|
break;
|
|
|
|
default:
|
2010-07-05 21:21:48 +02:00
|
|
|
wpa_printf(MSG_EXCESSIVE, "unknown WMM "
|
2008-10-29 20:48:14 +01:00
|
|
|
"information element ignored "
|
|
|
|
"(subtype=%d len=%lu)",
|
|
|
|
pos[4], (unsigned long) elen);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
break;
|
2008-11-23 18:34:26 +01:00
|
|
|
case 4:
|
|
|
|
/* Wi-Fi Protected Setup (WPS) IE */
|
|
|
|
elems->wps_ie = pos;
|
|
|
|
elems->wps_ie_len = elen;
|
|
|
|
break;
|
2008-10-29 20:48:14 +01:00
|
|
|
default:
|
2010-07-05 21:21:48 +02:00
|
|
|
wpa_printf(MSG_EXCESSIVE, "Unknown Microsoft "
|
2008-10-29 20:48:14 +01:00
|
|
|
"information element ignored "
|
2010-07-05 21:21:48 +02:00
|
|
|
"(type=%d len=%lu)",
|
2008-10-29 20:48:14 +01:00
|
|
|
pos[3], (unsigned long) elen);
|
2008-12-04 12:42:33 +01:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
2010-07-18 23:30:24 +02:00
|
|
|
case OUI_WFA:
|
|
|
|
switch (pos[3]) {
|
|
|
|
case P2P_OUI_TYPE:
|
|
|
|
/* Wi-Fi Alliance - P2P IE */
|
|
|
|
elems->p2p = pos;
|
|
|
|
elems->p2p_len = elen;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
wpa_printf(MSG_MSGDUMP, "Unknown WFA "
|
|
|
|
"information element ignored "
|
|
|
|
"(type=%d len=%lu)\n",
|
|
|
|
pos[3], (unsigned long) elen);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
2008-12-04 12:42:33 +01:00
|
|
|
case OUI_BROADCOM:
|
|
|
|
switch (pos[3]) {
|
|
|
|
case VENDOR_HT_CAPAB_OUI_TYPE:
|
|
|
|
elems->vendor_ht_cap = pos;
|
|
|
|
elems->vendor_ht_cap_len = elen;
|
|
|
|
break;
|
|
|
|
default:
|
2010-07-05 21:21:48 +02:00
|
|
|
wpa_printf(MSG_EXCESSIVE, "Unknown Broadcom "
|
2008-12-04 12:42:33 +01:00
|
|
|
"information element ignored "
|
2010-07-05 21:21:48 +02:00
|
|
|
"(type=%d len=%lu)",
|
2008-12-04 12:42:33 +01:00
|
|
|
pos[3], (unsigned long) elen);
|
2008-10-29 20:48:14 +01:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
2010-07-05 21:21:48 +02:00
|
|
|
wpa_printf(MSG_EXCESSIVE, "unknown vendor specific "
|
|
|
|
"information element ignored (vendor OUI "
|
|
|
|
"%02x:%02x:%02x len=%lu)",
|
2008-10-29 20:48:14 +01:00
|
|
|
pos[0], pos[1], pos[2], (unsigned long) elen);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-01-08 15:33:00 +01:00
|
|
|
/**
|
|
|
|
* ieee802_11_parse_elems - Parse information elements in management frames
|
|
|
|
* @start: Pointer to the start of IEs
|
|
|
|
* @len: Length of IE buffer in octets
|
|
|
|
* @elems: Data structure for parsed elements
|
|
|
|
* @show_errors: Whether to show parsing errors in debug log
|
|
|
|
* Returns: Parsing result
|
|
|
|
*/
|
2009-12-13 22:11:11 +01:00
|
|
|
ParseRes ieee802_11_parse_elems(const u8 *start, size_t len,
|
2008-10-29 20:48:14 +01:00
|
|
|
struct ieee802_11_elems *elems,
|
|
|
|
int show_errors)
|
|
|
|
{
|
|
|
|
size_t left = len;
|
2009-12-13 22:11:11 +01:00
|
|
|
const u8 *pos = start;
|
2008-10-29 20:48:14 +01:00
|
|
|
int unknown = 0;
|
|
|
|
|
|
|
|
os_memset(elems, 0, sizeof(*elems));
|
|
|
|
|
|
|
|
while (left >= 2) {
|
|
|
|
u8 id, elen;
|
|
|
|
|
|
|
|
id = *pos++;
|
|
|
|
elen = *pos++;
|
|
|
|
left -= 2;
|
|
|
|
|
|
|
|
if (elen > left) {
|
|
|
|
if (show_errors) {
|
|
|
|
wpa_printf(MSG_DEBUG, "IEEE 802.11 element "
|
|
|
|
"parse failed (id=%d elen=%d "
|
|
|
|
"left=%lu)",
|
|
|
|
id, elen, (unsigned long) left);
|
|
|
|
wpa_hexdump(MSG_MSGDUMP, "IEs", start, len);
|
|
|
|
}
|
|
|
|
return ParseFailed;
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (id) {
|
|
|
|
case WLAN_EID_SSID:
|
|
|
|
elems->ssid = pos;
|
|
|
|
elems->ssid_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_SUPP_RATES:
|
|
|
|
elems->supp_rates = pos;
|
|
|
|
elems->supp_rates_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_FH_PARAMS:
|
|
|
|
elems->fh_params = pos;
|
|
|
|
elems->fh_params_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_DS_PARAMS:
|
|
|
|
elems->ds_params = pos;
|
|
|
|
elems->ds_params_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_CF_PARAMS:
|
|
|
|
elems->cf_params = pos;
|
|
|
|
elems->cf_params_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_TIM:
|
|
|
|
elems->tim = pos;
|
|
|
|
elems->tim_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_IBSS_PARAMS:
|
|
|
|
elems->ibss_params = pos;
|
|
|
|
elems->ibss_params_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_CHALLENGE:
|
|
|
|
elems->challenge = pos;
|
|
|
|
elems->challenge_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_ERP_INFO:
|
|
|
|
elems->erp_info = pos;
|
|
|
|
elems->erp_info_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_EXT_SUPP_RATES:
|
|
|
|
elems->ext_supp_rates = pos;
|
|
|
|
elems->ext_supp_rates_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_VENDOR_SPECIFIC:
|
|
|
|
if (ieee802_11_parse_vendor_specific(pos, elen,
|
|
|
|
elems,
|
|
|
|
show_errors))
|
|
|
|
unknown++;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_RSN:
|
|
|
|
elems->rsn_ie = pos;
|
|
|
|
elems->rsn_ie_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_PWR_CAPABILITY:
|
|
|
|
elems->power_cap = pos;
|
|
|
|
elems->power_cap_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_SUPPORTED_CHANNELS:
|
|
|
|
elems->supp_channels = pos;
|
|
|
|
elems->supp_channels_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_MOBILITY_DOMAIN:
|
|
|
|
elems->mdie = pos;
|
|
|
|
elems->mdie_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_FAST_BSS_TRANSITION:
|
|
|
|
elems->ftie = pos;
|
|
|
|
elems->ftie_len = elen;
|
|
|
|
break;
|
2009-01-19 17:42:10 +01:00
|
|
|
case WLAN_EID_TIMEOUT_INTERVAL:
|
|
|
|
elems->timeout_int = pos;
|
|
|
|
elems->timeout_int_len = elen;
|
|
|
|
break;
|
2008-10-29 20:48:14 +01:00
|
|
|
case WLAN_EID_HT_CAP:
|
|
|
|
elems->ht_capabilities = pos;
|
|
|
|
elems->ht_capabilities_len = elen;
|
|
|
|
break;
|
|
|
|
case WLAN_EID_HT_OPERATION:
|
|
|
|
elems->ht_operation = pos;
|
|
|
|
elems->ht_operation_len = elen;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
unknown++;
|
|
|
|
if (!show_errors)
|
|
|
|
break;
|
|
|
|
wpa_printf(MSG_MSGDUMP, "IEEE 802.11 element parse "
|
|
|
|
"ignored unknown element (id=%d elen=%d)",
|
|
|
|
id, elen);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
left -= elen;
|
|
|
|
pos += elen;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (left)
|
|
|
|
return ParseFailed;
|
|
|
|
|
|
|
|
return unknown ? ParseUnknown : ParseOK;
|
|
|
|
}
|
2009-03-09 19:45:17 +01:00
|
|
|
|
|
|
|
|
|
|
|
int ieee802_11_ie_count(const u8 *ies, size_t ies_len)
|
|
|
|
{
|
|
|
|
int count = 0;
|
|
|
|
const u8 *pos, *end;
|
|
|
|
|
|
|
|
if (ies == NULL)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
pos = ies;
|
|
|
|
end = ies + ies_len;
|
|
|
|
|
|
|
|
while (pos + 2 <= end) {
|
|
|
|
if (pos + 2 + pos[1] > end)
|
|
|
|
break;
|
|
|
|
count++;
|
|
|
|
pos += 2 + pos[1];
|
|
|
|
}
|
|
|
|
|
|
|
|
return count;
|
|
|
|
}
|
2009-09-11 15:36:59 +02:00
|
|
|
|
|
|
|
|
|
|
|
struct wpabuf * ieee802_11_vendor_ie_concat(const u8 *ies, size_t ies_len,
|
|
|
|
u32 oui_type)
|
|
|
|
{
|
|
|
|
struct wpabuf *buf;
|
|
|
|
const u8 *end, *pos, *ie;
|
|
|
|
|
|
|
|
pos = ies;
|
|
|
|
end = ies + ies_len;
|
|
|
|
ie = NULL;
|
|
|
|
|
|
|
|
while (pos + 1 < end) {
|
|
|
|
if (pos + 2 + pos[1] > end)
|
|
|
|
return NULL;
|
|
|
|
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
|
|
|
|
WPA_GET_BE32(&pos[2]) == oui_type) {
|
|
|
|
ie = pos;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
pos += 2 + pos[1];
|
|
|
|
}
|
|
|
|
|
|
|
|
if (ie == NULL)
|
|
|
|
return NULL; /* No specified vendor IE found */
|
|
|
|
|
|
|
|
buf = wpabuf_alloc(ies_len);
|
|
|
|
if (buf == NULL)
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* There may be multiple vendor IEs in the message, so need to
|
|
|
|
* concatenate their data fields.
|
|
|
|
*/
|
|
|
|
while (pos + 1 < end) {
|
|
|
|
if (pos + 2 + pos[1] > end)
|
|
|
|
break;
|
|
|
|
if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
|
|
|
|
WPA_GET_BE32(&pos[2]) == oui_type)
|
|
|
|
wpabuf_put_data(buf, pos + 6, pos[1] - 4);
|
|
|
|
pos += 2 + pos[1];
|
|
|
|
}
|
|
|
|
|
|
|
|
return buf;
|
|
|
|
}
|