ieee802_11_common.c

Go to the documentation of this file.

#include "includes.h"

#include "common.h"
#include "ieee802_11_defs.h"
#include "ieee802_11_common.h"


static int ieee802_11_parse_vendor_specific(u8 *pos, size_t elen,
                                            struct ieee802_11_elems *elems,
                                            int show_errors)
{
        unsigned int oui;

        /* first 3 bytes in vendor specific information element are the IEEE
         * OUI of the vendor. The following byte is used a vendor specific
         * sub-type. */
        if (elen < 4) {
                if (show_errors) {
                        wpa_printf(MSG_MSGDUMP, "short vendor specific "
                                   "information element ignored (len=%lu)",
                                   (unsigned long) elen);
                }
                return -1;
        }

        oui = WPA_GET_BE24(pos);
        switch (oui) {
        case OUI_MICROSOFT:
                /* Microsoft/Wi-Fi information elements are further typed and
                 * subtyped */
                switch (pos[3]) {
                case 1:
                        /* Microsoft OUI (00:50:F2) with OUI Type 1:
                         * real WPA information element */
                        elems->wpa_ie = pos;
                        elems->wpa_ie_len = elen;
                        break;
                case WMM_OUI_TYPE:
                        /* WMM information element */
                        if (elen < 5) {
                                wpa_printf(MSG_MSGDUMP, "short WMM "
                                           "information element ignored "
                                           "(len=%lu)",
                                           (unsigned long) elen);
                                return -1;
                        }
                        switch (pos[4]) {
                        case WMM_OUI_SUBTYPE_INFORMATION_ELEMENT:
                        case WMM_OUI_SUBTYPE_PARAMETER_ELEMENT:
                                /*
                                 * Share same pointer since only one of these
                                 * is used and they start with same data.
                                 * Length field can be used to distinguish the
                                 * IEs.
                                 */
                                elems->wmm = pos;
                                elems->wmm_len = elen;
                                break;
                        case WMM_OUI_SUBTYPE_TSPEC_ELEMENT:
                                elems->wmm_tspec = pos;
                                elems->wmm_tspec_len = elen;
                                break;
                        default:
                                wpa_printf(MSG_MSGDUMP, "unknown WMM "
                                           "information element ignored "
                                           "(subtype=%d len=%lu)",
                                           pos[4], (unsigned long) elen);
                                return -1;
                        }
                        break;
                case 4:
                        /* Wi-Fi Protected Setup (WPS) IE */
                        elems->wps_ie = pos;
                        elems->wps_ie_len = elen;
                        break;
                default:
                        wpa_printf(MSG_MSGDUMP, "Unknown Microsoft "
                                   "information element ignored "
                                   "(type=%d len=%lu)\n",
                                   pos[3], (unsigned long) elen);
                        return -1;
                }
                break;

        case OUI_BROADCOM:
                switch (pos[3]) {
                case VENDOR_HT_CAPAB_OUI_TYPE:
                        elems->vendor_ht_cap = pos;
                        elems->vendor_ht_cap_len = elen;
                        break;
                default:
                        wpa_printf(MSG_MSGDUMP, "Unknown Broadcom "
                                   "information element ignored "
                                   "(type=%d len=%lu)\n",
                                   pos[3], (unsigned long) elen);
                        return -1;
                }
                break;

        default:
                wpa_printf(MSG_MSGDUMP, "unknown vendor specific information "
                           "element ignored (vendor OUI %02x:%02x:%02x "
                           "len=%lu)",
                           pos[0], pos[1], pos[2], (unsigned long) elen);
                return -1;
        }

        return 0;
}


ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
                                struct ieee802_11_elems *elems,
                                int show_errors)
{
        size_t left = len;
        u8 *pos = start;
        int unknown = 0;

        os_memset(elems, 0, sizeof(*elems));

        while (left >= 2) {
                u8 id, elen;

                id = *pos++;
                elen = *pos++;
                left -= 2;

                if (elen > left) {
                        if (show_errors) {
                                wpa_printf(MSG_DEBUG, "IEEE 802.11 element "
                                           "parse failed (id=%d elen=%d "
                                           "left=%lu)",
                                           id, elen, (unsigned long) left);
                                wpa_hexdump(MSG_MSGDUMP, "IEs", start, len);
                        }
                        return ParseFailed;
                }

                switch (id) {
                case WLAN_EID_SSID:
                        elems->ssid = pos;
                        elems->ssid_len = elen;
                        break;
                case WLAN_EID_SUPP_RATES:
                        elems->supp_rates = pos;
                        elems->supp_rates_len = elen;
                        break;
                case WLAN_EID_FH_PARAMS:
                        elems->fh_params = pos;
                        elems->fh_params_len = elen;
                        break;
                case WLAN_EID_DS_PARAMS:
                        elems->ds_params = pos;
                        elems->ds_params_len = elen;
                        break;
                case WLAN_EID_CF_PARAMS:
                        elems->cf_params = pos;
                        elems->cf_params_len = elen;
                        break;
                case WLAN_EID_TIM:
                        elems->tim = pos;
                        elems->tim_len = elen;
                        break;
                case WLAN_EID_IBSS_PARAMS:
                        elems->ibss_params = pos;
                        elems->ibss_params_len = elen;
                        break;
                case WLAN_EID_CHALLENGE:
                        elems->challenge = pos;
                        elems->challenge_len = elen;
                        break;
                case WLAN_EID_ERP_INFO:
                        elems->erp_info = pos;
                        elems->erp_info_len = elen;
                        break;
                case WLAN_EID_EXT_SUPP_RATES:
                        elems->ext_supp_rates = pos;
                        elems->ext_supp_rates_len = elen;
                        break;
                case WLAN_EID_VENDOR_SPECIFIC:
                        if (ieee802_11_parse_vendor_specific(pos, elen,
                                                             elems,
                                                             show_errors))
                                unknown++;
                        break;
                case WLAN_EID_RSN:
                        elems->rsn_ie = pos;
                        elems->rsn_ie_len = elen;
                        break;
                case WLAN_EID_PWR_CAPABILITY:
                        elems->power_cap = pos;
                        elems->power_cap_len = elen;
                        break;
                case WLAN_EID_SUPPORTED_CHANNELS:
                        elems->supp_channels = pos;
                        elems->supp_channels_len = elen;
                        break;
                case WLAN_EID_MOBILITY_DOMAIN:
                        elems->mdie = pos;
                        elems->mdie_len = elen;
                        break;
                case WLAN_EID_FAST_BSS_TRANSITION:
                        elems->ftie = pos;
                        elems->ftie_len = elen;
                        break;
                case WLAN_EID_TIMEOUT_INTERVAL:
                        elems->timeout_int = pos;
                        elems->timeout_int_len = elen;
                        break;
                case WLAN_EID_HT_CAP:
                        elems->ht_capabilities = pos;
                        elems->ht_capabilities_len = elen;
                        break;
                case WLAN_EID_HT_OPERATION:
                        elems->ht_operation = pos;
                        elems->ht_operation_len = elen;
                        break;
                default:
                        unknown++;
                        if (!show_errors)
                                break;
                        wpa_printf(MSG_MSGDUMP, "IEEE 802.11 element parse "
                                   "ignored unknown element (id=%d elen=%d)",
                                   id, elen);
                        break;
                }

                left -= elen;
                pos += elen;
        }

        if (left)
                return ParseFailed;

        return unknown ? ParseUnknown : ParseOK;
}


int ieee802_11_ie_count(const u8 *ies, size_t ies_len)
{
        int count = 0;
        const u8 *pos, *end;

        if (ies == NULL)
                return 0;

        pos = ies;
        end = ies + ies_len;

        while (pos + 2 <= end) {
                if (pos + 2 + pos[1] > end)
                        break;
                count++;
                pos += 2 + pos[1];
        }

        return count;
}


struct wpabuf * ieee802_11_vendor_ie_concat(const u8 *ies, size_t ies_len,
                                            u32 oui_type)
{
        struct wpabuf *buf;
        const u8 *end, *pos, *ie;

        pos = ies;
        end = ies + ies_len;
        ie = NULL;

        while (pos + 1 < end) {
                if (pos + 2 + pos[1] > end)
                        return NULL;
                if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
                    WPA_GET_BE32(&pos[2]) == oui_type) {
                        ie = pos;
                        break;
                }
                pos += 2 + pos[1];
        }

        if (ie == NULL)
                return NULL; /* No specified vendor IE found */

        buf = wpabuf_alloc(ies_len);
        if (buf == NULL)
                return NULL;

        /*
         * There may be multiple vendor IEs in the message, so need to
         * concatenate their data fields.
         */
        while (pos + 1 < end) {
                if (pos + 2 + pos[1] > end)
                        break;
                if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
                    WPA_GET_BE32(&pos[2]) == oui_type)
                        wpabuf_put_data(buf, pos + 6, pos[1] - 4);
                pos += 2 + pos[1];
        }

        return buf;
}