1/*
2 * WPA Supplicant - Windows/NDIS driver interface
3 * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9#ifdef __CYGWIN__
10/* Avoid some header file conflicts by not including standard headers for
11 * cygwin builds when Packet32.h is included. */
12#include "build_config.h"
13int close(int fd);
14#else /* __CYGWIN__ */
15#include "includes.h"
16#endif /* __CYGWIN__ */
17#ifdef CONFIG_USE_NDISUIO
18#include <winsock2.h>
19#else /* CONFIG_USE_NDISUIO */
20#include <Packet32.h>
21#endif /* CONFIG_USE_NDISUIO */
22#ifdef __MINGW32_VERSION
23#include <ddk/ntddndis.h>
24#else /* __MINGW32_VERSION */
25#include <ntddndis.h>
26#endif /* __MINGW32_VERSION */
27
28#ifdef _WIN32_WCE
29#include <winioctl.h>
30#include <nuiouser.h>
31#include <devload.h>
32#endif /* _WIN32_WCE */
33
34#include "common.h"
35#include "driver.h"
36#include "eloop.h"
37#include "common/ieee802_11_defs.h"
38#include "driver_ndis.h"
39
40int wpa_driver_register_event_cb(struct wpa_driver_ndis_data *drv);
41#ifdef CONFIG_NDIS_EVENTS_INTEGRATED
42void wpa_driver_ndis_event_pipe_cb(void *eloop_data, void *user_data);
43#endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
44
45static void wpa_driver_ndis_deinit(void *priv);
46static void wpa_driver_ndis_poll(void *drv);
47static void wpa_driver_ndis_poll_timeout(void *eloop_ctx, void *timeout_ctx);
48static int wpa_driver_ndis_adapter_init(struct wpa_driver_ndis_data *drv);
49static int wpa_driver_ndis_adapter_open(struct wpa_driver_ndis_data *drv);
50static void wpa_driver_ndis_adapter_close(struct wpa_driver_ndis_data *drv);
51
52
53static const u8 pae_group_addr[ETH_ALEN] =
54{ 0x01, 0x80, 0xc2, 0x00, 0x00, 0x03 };
55
56
57/* FIX: to be removed once this can be compiled with the complete NDIS
58 * header files */
59#ifndef OID_802_11_BSSID
60#define OID_802_11_BSSID 			0x0d010101
61#define OID_802_11_SSID 			0x0d010102
62#define OID_802_11_INFRASTRUCTURE_MODE		0x0d010108
63#define OID_802_11_ADD_WEP			0x0D010113
64#define OID_802_11_REMOVE_WEP			0x0D010114
65#define OID_802_11_DISASSOCIATE			0x0D010115
66#define OID_802_11_BSSID_LIST 			0x0d010217
67#define OID_802_11_AUTHENTICATION_MODE		0x0d010118
68#define OID_802_11_PRIVACY_FILTER		0x0d010119
69#define OID_802_11_BSSID_LIST_SCAN 		0x0d01011A
70#define OID_802_11_WEP_STATUS	 		0x0d01011B
71#define OID_802_11_ENCRYPTION_STATUS OID_802_11_WEP_STATUS
72#define OID_802_11_ADD_KEY 			0x0d01011D
73#define OID_802_11_REMOVE_KEY 			0x0d01011E
74#define OID_802_11_ASSOCIATION_INFORMATION	0x0d01011F
75#define OID_802_11_TEST 			0x0d010120
76#define OID_802_11_CAPABILITY 			0x0d010122
77#define OID_802_11_PMKID 			0x0d010123
78
79#define NDIS_802_11_LENGTH_SSID 32
80#define NDIS_802_11_LENGTH_RATES 8
81#define NDIS_802_11_LENGTH_RATES_EX 16
82
83typedef UCHAR NDIS_802_11_MAC_ADDRESS[6];
84
85typedef struct NDIS_802_11_SSID {
86	ULONG SsidLength;
87	UCHAR Ssid[NDIS_802_11_LENGTH_SSID];
88} NDIS_802_11_SSID;
89
90typedef LONG NDIS_802_11_RSSI;
91
92typedef enum NDIS_802_11_NETWORK_TYPE {
93	Ndis802_11FH,
94	Ndis802_11DS,
95	Ndis802_11OFDM5,
96	Ndis802_11OFDM24,
97	Ndis802_11NetworkTypeMax
98} NDIS_802_11_NETWORK_TYPE;
99
100typedef struct NDIS_802_11_CONFIGURATION_FH {
101	ULONG Length;
102	ULONG HopPattern;
103	ULONG HopSet;
104	ULONG DwellTime;
105} NDIS_802_11_CONFIGURATION_FH;
106
107typedef struct NDIS_802_11_CONFIGURATION {
108	ULONG Length;
109	ULONG BeaconPeriod;
110	ULONG ATIMWindow;
111	ULONG DSConfig;
112	NDIS_802_11_CONFIGURATION_FH FHConfig;
113} NDIS_802_11_CONFIGURATION;
114
115typedef enum NDIS_802_11_NETWORK_INFRASTRUCTURE {
116	Ndis802_11IBSS,
117	Ndis802_11Infrastructure,
118	Ndis802_11AutoUnknown,
119	Ndis802_11InfrastructureMax
120} NDIS_802_11_NETWORK_INFRASTRUCTURE;
121
122typedef enum NDIS_802_11_AUTHENTICATION_MODE {
123	Ndis802_11AuthModeOpen,
124	Ndis802_11AuthModeShared,
125	Ndis802_11AuthModeAutoSwitch,
126	Ndis802_11AuthModeWPA,
127	Ndis802_11AuthModeWPAPSK,
128	Ndis802_11AuthModeWPANone,
129	Ndis802_11AuthModeWPA2,
130	Ndis802_11AuthModeWPA2PSK,
131	Ndis802_11AuthModeMax
132} NDIS_802_11_AUTHENTICATION_MODE;
133
134typedef enum NDIS_802_11_WEP_STATUS {
135	Ndis802_11WEPEnabled,
136	Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
137	Ndis802_11WEPDisabled,
138	Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
139	Ndis802_11WEPKeyAbsent,
140	Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
141	Ndis802_11WEPNotSupported,
142	Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
143	Ndis802_11Encryption2Enabled,
144	Ndis802_11Encryption2KeyAbsent,
145	Ndis802_11Encryption3Enabled,
146	Ndis802_11Encryption3KeyAbsent
147} NDIS_802_11_WEP_STATUS, NDIS_802_11_ENCRYPTION_STATUS;
148
149typedef enum NDIS_802_11_PRIVACY_FILTER {
150	Ndis802_11PrivFilterAcceptAll,
151	Ndis802_11PrivFilter8021xWEP
152} NDIS_802_11_PRIVACY_FILTER;
153
154typedef UCHAR NDIS_802_11_RATES[NDIS_802_11_LENGTH_RATES];
155typedef UCHAR NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];
156
157typedef struct NDIS_WLAN_BSSID_EX {
158	ULONG Length;
159	NDIS_802_11_MAC_ADDRESS MacAddress; /* BSSID */
160	UCHAR Reserved[2];
161	NDIS_802_11_SSID Ssid;
162	ULONG Privacy;
163	NDIS_802_11_RSSI Rssi;
164	NDIS_802_11_NETWORK_TYPE NetworkTypeInUse;
165	NDIS_802_11_CONFIGURATION Configuration;
166	NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode;
167	NDIS_802_11_RATES_EX SupportedRates;
168	ULONG IELength;
169	UCHAR IEs[1];
170} NDIS_WLAN_BSSID_EX;
171
172typedef struct NDIS_802_11_BSSID_LIST_EX {
173	ULONG NumberOfItems;
174	NDIS_WLAN_BSSID_EX Bssid[1];
175} NDIS_802_11_BSSID_LIST_EX;
176
177typedef struct NDIS_802_11_FIXED_IEs {
178	UCHAR Timestamp[8];
179	USHORT BeaconInterval;
180	USHORT Capabilities;
181} NDIS_802_11_FIXED_IEs;
182
183typedef struct NDIS_802_11_WEP {
184	ULONG Length;
185	ULONG KeyIndex;
186	ULONG KeyLength;
187	UCHAR KeyMaterial[1];
188} NDIS_802_11_WEP;
189
190typedef ULONG NDIS_802_11_KEY_INDEX;
191typedef ULONGLONG NDIS_802_11_KEY_RSC;
192
193typedef struct NDIS_802_11_KEY {
194	ULONG Length;
195	ULONG KeyIndex;
196	ULONG KeyLength;
197	NDIS_802_11_MAC_ADDRESS BSSID;
198	NDIS_802_11_KEY_RSC KeyRSC;
199	UCHAR KeyMaterial[1];
200} NDIS_802_11_KEY;
201
202typedef struct NDIS_802_11_REMOVE_KEY {
203	ULONG Length;
204	ULONG KeyIndex;
205	NDIS_802_11_MAC_ADDRESS BSSID;
206} NDIS_802_11_REMOVE_KEY;
207
208typedef struct NDIS_802_11_AI_REQFI {
209	USHORT Capabilities;
210	USHORT ListenInterval;
211	NDIS_802_11_MAC_ADDRESS CurrentAPAddress;
212} NDIS_802_11_AI_REQFI;
213
214typedef struct NDIS_802_11_AI_RESFI {
215	USHORT Capabilities;
216	USHORT StatusCode;
217	USHORT AssociationId;
218} NDIS_802_11_AI_RESFI;
219
220typedef struct NDIS_802_11_ASSOCIATION_INFORMATION {
221	ULONG Length;
222	USHORT AvailableRequestFixedIEs;
223	NDIS_802_11_AI_REQFI RequestFixedIEs;
224	ULONG RequestIELength;
225	ULONG OffsetRequestIEs;
226	USHORT AvailableResponseFixedIEs;
227	NDIS_802_11_AI_RESFI ResponseFixedIEs;
228	ULONG ResponseIELength;
229	ULONG OffsetResponseIEs;
230} NDIS_802_11_ASSOCIATION_INFORMATION;
231
232typedef struct NDIS_802_11_AUTHENTICATION_ENCRYPTION {
233	NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
234	NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
235} NDIS_802_11_AUTHENTICATION_ENCRYPTION;
236
237typedef struct NDIS_802_11_CAPABILITY {
238	ULONG Length;
239	ULONG Version;
240	ULONG NoOfPMKIDs;
241	ULONG NoOfAuthEncryptPairsSupported;
242	NDIS_802_11_AUTHENTICATION_ENCRYPTION
243		AuthenticationEncryptionSupported[1];
244} NDIS_802_11_CAPABILITY;
245
246typedef UCHAR NDIS_802_11_PMKID_VALUE[16];
247
248typedef struct BSSID_INFO {
249	NDIS_802_11_MAC_ADDRESS BSSID;
250	NDIS_802_11_PMKID_VALUE PMKID;
251} BSSID_INFO;
252
253typedef struct NDIS_802_11_PMKID {
254	ULONG Length;
255	ULONG BSSIDInfoCount;
256	BSSID_INFO BSSIDInfo[1];
257} NDIS_802_11_PMKID;
258
259typedef enum NDIS_802_11_STATUS_TYPE {
260	Ndis802_11StatusType_Authentication,
261	Ndis802_11StatusType_PMKID_CandidateList = 2,
262	Ndis802_11StatusTypeMax
263} NDIS_802_11_STATUS_TYPE;
264
265typedef struct NDIS_802_11_STATUS_INDICATION {
266	NDIS_802_11_STATUS_TYPE StatusType;
267} NDIS_802_11_STATUS_INDICATION;
268
269typedef struct PMKID_CANDIDATE {
270	NDIS_802_11_MAC_ADDRESS BSSID;
271	ULONG Flags;
272} PMKID_CANDIDATE;
273
274#define NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED 0x01
275
276typedef struct NDIS_802_11_PMKID_CANDIDATE_LIST {
277	ULONG Version;
278	ULONG NumCandidates;
279	PMKID_CANDIDATE CandidateList[1];
280} NDIS_802_11_PMKID_CANDIDATE_LIST;
281
282typedef struct NDIS_802_11_AUTHENTICATION_REQUEST {
283	ULONG Length;
284	NDIS_802_11_MAC_ADDRESS Bssid;
285	ULONG Flags;
286} NDIS_802_11_AUTHENTICATION_REQUEST;
287
288#define NDIS_802_11_AUTH_REQUEST_REAUTH			0x01
289#define NDIS_802_11_AUTH_REQUEST_KEYUPDATE		0x02
290#define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR		0x06
291#define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR		0x0E
292
293#endif /* OID_802_11_BSSID */
294
295
296#ifndef OID_802_11_PMKID
297/* Platform SDK for XP did not include WPA2, so add needed definitions */
298
299#define OID_802_11_CAPABILITY 			0x0d010122
300#define OID_802_11_PMKID 			0x0d010123
301
302#define Ndis802_11AuthModeWPA2 6
303#define Ndis802_11AuthModeWPA2PSK 7
304
305#define Ndis802_11StatusType_PMKID_CandidateList 2
306
307typedef struct NDIS_802_11_AUTHENTICATION_ENCRYPTION {
308	NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
309	NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
310} NDIS_802_11_AUTHENTICATION_ENCRYPTION;
311
312typedef struct NDIS_802_11_CAPABILITY {
313	ULONG Length;
314	ULONG Version;
315	ULONG NoOfPMKIDs;
316	ULONG NoOfAuthEncryptPairsSupported;
317	NDIS_802_11_AUTHENTICATION_ENCRYPTION
318		AuthenticationEncryptionSupported[1];
319} NDIS_802_11_CAPABILITY;
320
321typedef UCHAR NDIS_802_11_PMKID_VALUE[16];
322
323typedef struct BSSID_INFO {
324	NDIS_802_11_MAC_ADDRESS BSSID;
325	NDIS_802_11_PMKID_VALUE PMKID;
326} BSSID_INFO;
327
328typedef struct NDIS_802_11_PMKID {
329	ULONG Length;
330	ULONG BSSIDInfoCount;
331	BSSID_INFO BSSIDInfo[1];
332} NDIS_802_11_PMKID;
333
334typedef struct PMKID_CANDIDATE {
335	NDIS_802_11_MAC_ADDRESS BSSID;
336	ULONG Flags;
337} PMKID_CANDIDATE;
338
339#define NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED 0x01
340
341typedef struct NDIS_802_11_PMKID_CANDIDATE_LIST {
342	ULONG Version;
343	ULONG NumCandidates;
344	PMKID_CANDIDATE CandidateList[1];
345} NDIS_802_11_PMKID_CANDIDATE_LIST;
346
347#endif /* OID_802_11_CAPABILITY */
348
349
350#ifndef OID_DOT11_CURRENT_OPERATION_MODE
351/* Native 802.11 OIDs */
352#define OID_DOT11_NDIS_START 0x0D010300
353#define OID_DOT11_CURRENT_OPERATION_MODE (OID_DOT11_NDIS_START + 8)
354#define OID_DOT11_SCAN_REQUEST (OID_DOT11_NDIS_START + 11)
355
356typedef enum _DOT11_BSS_TYPE {
357	dot11_BSS_type_infrastructure = 1,
358	dot11_BSS_type_independent = 2,
359	dot11_BSS_type_any = 3
360} DOT11_BSS_TYPE, * PDOT11_BSS_TYPE;
361
362typedef UCHAR DOT11_MAC_ADDRESS[6];
363typedef DOT11_MAC_ADDRESS * PDOT11_MAC_ADDRESS;
364
365typedef enum _DOT11_SCAN_TYPE {
366	dot11_scan_type_active = 1,
367	dot11_scan_type_passive = 2,
368	dot11_scan_type_auto = 3,
369	dot11_scan_type_forced = 0x80000000
370} DOT11_SCAN_TYPE, * PDOT11_SCAN_TYPE;
371
372typedef struct _DOT11_SCAN_REQUEST_V2 {
373	DOT11_BSS_TYPE dot11BSSType;
374	DOT11_MAC_ADDRESS dot11BSSID;
375	DOT11_SCAN_TYPE dot11ScanType;
376	BOOLEAN bRestrictedScan;
377	ULONG udot11SSIDsOffset;
378	ULONG uNumOfdot11SSIDs;
379	BOOLEAN bUseRequestIE;
380	ULONG uRequestIDsOffset;
381	ULONG uNumOfRequestIDs;
382	ULONG uPhyTypeInfosOffset;
383	ULONG uNumOfPhyTypeInfos;
384	ULONG uIEsOffset;
385	ULONG uIEsLength;
386	UCHAR ucBuffer[1];
387} DOT11_SCAN_REQUEST_V2, * PDOT11_SCAN_REQUEST_V2;
388
389#endif /* OID_DOT11_CURRENT_OPERATION_MODE */
390
391#ifdef CONFIG_USE_NDISUIO
392#ifndef _WIN32_WCE
393#ifdef __MINGW32_VERSION
394typedef ULONG NDIS_OID;
395#endif /* __MINGW32_VERSION */
396/* from nuiouser.h */
397#define FSCTL_NDISUIO_BASE      FILE_DEVICE_NETWORK
398
399#define _NDISUIO_CTL_CODE(_Function, _Method, _Access) \
400	CTL_CODE(FSCTL_NDISUIO_BASE, _Function, _Method, _Access)
401
402#define IOCTL_NDISUIO_OPEN_DEVICE \
403	_NDISUIO_CTL_CODE(0x200, METHOD_BUFFERED, \
404			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
405
406#define IOCTL_NDISUIO_QUERY_OID_VALUE \
407	_NDISUIO_CTL_CODE(0x201, METHOD_BUFFERED, \
408			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
409
410#define IOCTL_NDISUIO_SET_OID_VALUE \
411	_NDISUIO_CTL_CODE(0x205, METHOD_BUFFERED, \
412			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
413
414#define IOCTL_NDISUIO_SET_ETHER_TYPE \
415	_NDISUIO_CTL_CODE(0x202, METHOD_BUFFERED, \
416			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
417
418#define IOCTL_NDISUIO_QUERY_BINDING \
419	_NDISUIO_CTL_CODE(0x203, METHOD_BUFFERED, \
420			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
421
422#define IOCTL_NDISUIO_BIND_WAIT \
423	_NDISUIO_CTL_CODE(0x204, METHOD_BUFFERED, \
424			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
425
426typedef struct _NDISUIO_QUERY_OID
427{
428    NDIS_OID Oid;
429    UCHAR Data[sizeof(ULONG)];
430} NDISUIO_QUERY_OID, *PNDISUIO_QUERY_OID;
431
432typedef struct _NDISUIO_SET_OID
433{
434    NDIS_OID Oid;
435    UCHAR Data[sizeof(ULONG)];
436} NDISUIO_SET_OID, *PNDISUIO_SET_OID;
437
438typedef struct _NDISUIO_QUERY_BINDING
439{
440	ULONG BindingIndex;
441	ULONG DeviceNameOffset;
442	ULONG DeviceNameLength;
443	ULONG DeviceDescrOffset;
444	ULONG DeviceDescrLength;
445} NDISUIO_QUERY_BINDING, *PNDISUIO_QUERY_BINDING;
446#endif /* _WIN32_WCE */
447#endif /* CONFIG_USE_NDISUIO */
448
449
450static int ndis_get_oid(struct wpa_driver_ndis_data *drv, unsigned int oid,
451			char *data, size_t len)
452{
453#ifdef CONFIG_USE_NDISUIO
454	NDISUIO_QUERY_OID *o;
455	size_t buflen = sizeof(*o) + len;
456	DWORD written;
457	int ret;
458	size_t hdrlen;
459
460	o = os_zalloc(buflen);
461	if (o == NULL)
462		return -1;
463	o->Oid = oid;
464#ifdef _WIN32_WCE
465	o->ptcDeviceName = drv->adapter_name;
466#endif /* _WIN32_WCE */
467	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_QUERY_OID_VALUE,
468			     o, sizeof(NDISUIO_QUERY_OID), o, buflen, &written,
469			     NULL)) {
470		wpa_printf(MSG_DEBUG, "NDIS: IOCTL_NDISUIO_QUERY_OID_VALUE "
471			   "failed (oid=%08x): %d", oid, (int) GetLastError());
472		os_free(o);
473		return -1;
474	}
475	hdrlen = sizeof(NDISUIO_QUERY_OID) - sizeof(o->Data);
476	if (written < hdrlen) {
477		wpa_printf(MSG_DEBUG, "NDIS: query oid=%08x written (%d); "
478			   "too short", oid, (unsigned int) written);
479		os_free(o);
480		return -1;
481	}
482	written -= hdrlen;
483	if (written > len) {
484		wpa_printf(MSG_DEBUG, "NDIS: query oid=%08x written (%d) > "
485			   "len (%d)",oid, (unsigned int) written, len);
486		os_free(o);
487		return -1;
488	}
489	os_memcpy(data, o->Data, written);
490	ret = written;
491	os_free(o);
492	return ret;
493#else /* CONFIG_USE_NDISUIO */
494	char *buf;
495	PACKET_OID_DATA *o;
496	int ret;
497
498	buf = os_zalloc(sizeof(*o) + len);
499	if (buf == NULL)
500		return -1;
501	o = (PACKET_OID_DATA *) buf;
502	o->Oid = oid;
503	o->Length = len;
504
505	if (!PacketRequest(drv->adapter, FALSE, o)) {
506		wpa_printf(MSG_DEBUG, "%s: oid=0x%x len (%d) failed",
507			   __func__, oid, len);
508		os_free(buf);
509		return -1;
510	}
511	if (o->Length > len) {
512		wpa_printf(MSG_DEBUG, "%s: oid=0x%x Length (%d) > len (%d)",
513			   __func__, oid, (unsigned int) o->Length, len);
514		os_free(buf);
515		return -1;
516	}
517	os_memcpy(data, o->Data, o->Length);
518	ret = o->Length;
519	os_free(buf);
520	return ret;
521#endif /* CONFIG_USE_NDISUIO */
522}
523
524
525static int ndis_set_oid(struct wpa_driver_ndis_data *drv, unsigned int oid,
526			const char *data, size_t len)
527{
528#ifdef CONFIG_USE_NDISUIO
529	NDISUIO_SET_OID *o;
530	size_t buflen, reallen;
531	DWORD written;
532	char txt[50];
533
534	os_snprintf(txt, sizeof(txt), "NDIS: Set OID %08x", oid);
535	wpa_hexdump_key(MSG_MSGDUMP, txt, (const u8 *) data, len);
536
537	buflen = sizeof(*o) + len;
538	reallen = buflen - sizeof(o->Data);
539	o = os_zalloc(buflen);
540	if (o == NULL)
541		return -1;
542	o->Oid = oid;
543#ifdef _WIN32_WCE
544	o->ptcDeviceName = drv->adapter_name;
545#endif /* _WIN32_WCE */
546	if (data)
547		os_memcpy(o->Data, data, len);
548	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_SET_OID_VALUE,
549			     o, reallen, NULL, 0, &written, NULL)) {
550		wpa_printf(MSG_DEBUG, "NDIS: IOCTL_NDISUIO_SET_OID_VALUE "
551			   "(oid=%08x) failed: %d", oid, (int) GetLastError());
552		os_free(o);
553		return -1;
554	}
555	os_free(o);
556	return 0;
557#else /* CONFIG_USE_NDISUIO */
558	char *buf;
559	PACKET_OID_DATA *o;
560	char txt[50];
561
562	os_snprintf(txt, sizeof(txt), "NDIS: Set OID %08x", oid);
563	wpa_hexdump_key(MSG_MSGDUMP, txt, (const u8 *) data, len);
564
565	buf = os_zalloc(sizeof(*o) + len);
566	if (buf == NULL)
567		return -1;
568	o = (PACKET_OID_DATA *) buf;
569	o->Oid = oid;
570	o->Length = len;
571	if (data)
572		os_memcpy(o->Data, data, len);
573
574	if (!PacketRequest(drv->adapter, TRUE, o)) {
575		wpa_printf(MSG_DEBUG, "%s: oid=0x%x len (%d) failed",
576			   __func__, oid, len);
577		os_free(buf);
578		return -1;
579	}
580	os_free(buf);
581	return 0;
582#endif /* CONFIG_USE_NDISUIO */
583}
584
585
586static int ndis_set_auth_mode(struct wpa_driver_ndis_data *drv, int mode)
587{
588	u32 auth_mode = mode;
589	if (ndis_set_oid(drv, OID_802_11_AUTHENTICATION_MODE,
590			 (char *) &auth_mode, sizeof(auth_mode)) < 0) {
591		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
592			   "OID_802_11_AUTHENTICATION_MODE (%d)",
593			   (int) auth_mode);
594		return -1;
595	}
596	return 0;
597}
598
599
600static int ndis_get_auth_mode(struct wpa_driver_ndis_data *drv)
601{
602	u32 auth_mode;
603	int res;
604	res = ndis_get_oid(drv, OID_802_11_AUTHENTICATION_MODE,
605			   (char *) &auth_mode, sizeof(auth_mode));
606	if (res != sizeof(auth_mode)) {
607		wpa_printf(MSG_DEBUG, "NDIS: Failed to get "
608			   "OID_802_11_AUTHENTICATION_MODE");
609		return -1;
610	}
611	return auth_mode;
612}
613
614
615static int ndis_set_encr_status(struct wpa_driver_ndis_data *drv, int encr)
616{
617	u32 encr_status = encr;
618	if (ndis_set_oid(drv, OID_802_11_ENCRYPTION_STATUS,
619			 (char *) &encr_status, sizeof(encr_status)) < 0) {
620		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
621			   "OID_802_11_ENCRYPTION_STATUS (%d)", encr);
622		return -1;
623	}
624	return 0;
625}
626
627
628static int ndis_get_encr_status(struct wpa_driver_ndis_data *drv)
629{
630	u32 encr;
631	int res;
632	res = ndis_get_oid(drv, OID_802_11_ENCRYPTION_STATUS,
633			   (char *) &encr, sizeof(encr));
634	if (res != sizeof(encr)) {
635		wpa_printf(MSG_DEBUG, "NDIS: Failed to get "
636			   "OID_802_11_ENCRYPTION_STATUS");
637		return -1;
638	}
639	return encr;
640}
641
642
643static int wpa_driver_ndis_get_bssid(void *priv, u8 *bssid)
644{
645	struct wpa_driver_ndis_data *drv = priv;
646
647	if (drv->wired) {
648		/*
649		 * Report PAE group address as the "BSSID" for wired
650		 * connection.
651		 */
652		os_memcpy(bssid, pae_group_addr, ETH_ALEN);
653		return 0;
654	}
655
656	return ndis_get_oid(drv, OID_802_11_BSSID, (char *) bssid, ETH_ALEN) <
657		0 ? -1 : 0;
658}
659
660
661static int wpa_driver_ndis_get_ssid(void *priv, u8 *ssid)
662{
663	struct wpa_driver_ndis_data *drv = priv;
664	NDIS_802_11_SSID buf;
665	int res;
666
667	res = ndis_get_oid(drv, OID_802_11_SSID, (char *) &buf, sizeof(buf));
668	if (res < 4) {
669		wpa_printf(MSG_DEBUG, "NDIS: Failed to get SSID");
670		if (drv->wired) {
671			wpa_printf(MSG_DEBUG, "NDIS: Allow get_ssid failure "
672				   "with a wired interface");
673			return 0;
674		}
675		return -1;
676	}
677	os_memcpy(ssid, buf.Ssid, buf.SsidLength);
678	return buf.SsidLength;
679}
680
681
682static int wpa_driver_ndis_set_ssid(struct wpa_driver_ndis_data *drv,
683				    const u8 *ssid, size_t ssid_len)
684{
685	NDIS_802_11_SSID buf;
686
687	os_memset(&buf, 0, sizeof(buf));
688	buf.SsidLength = ssid_len;
689	os_memcpy(buf.Ssid, ssid, ssid_len);
690	/*
691	 * Make sure radio is marked enabled here so that scan request will not
692	 * force SSID to be changed to a random one in order to enable radio at
693	 * that point.
694	 */
695	drv->radio_enabled = 1;
696	return ndis_set_oid(drv, OID_802_11_SSID, (char *) &buf, sizeof(buf));
697}
698
699
700/* Disconnect using OID_802_11_DISASSOCIATE. This will also turn the radio off.
701 */
702static int wpa_driver_ndis_radio_off(struct wpa_driver_ndis_data *drv)
703{
704	drv->radio_enabled = 0;
705	return ndis_set_oid(drv, OID_802_11_DISASSOCIATE, "    ", 4);
706}
707
708
709/* Disconnect by setting SSID to random (i.e., likely not used). */
710static int wpa_driver_ndis_disconnect(struct wpa_driver_ndis_data *drv)
711{
712	char ssid[32];
713	int i;
714	for (i = 0; i < 32; i++)
715		ssid[i] = rand() & 0xff;
716	return wpa_driver_ndis_set_ssid(drv, (u8 *) ssid, 32);
717}
718
719
720static int wpa_driver_ndis_deauthenticate(void *priv, const u8 *addr,
721					  int reason_code)
722{
723	struct wpa_driver_ndis_data *drv = priv;
724	return wpa_driver_ndis_disconnect(drv);
725}
726
727
728static void wpa_driver_ndis_scan_timeout(void *eloop_ctx, void *timeout_ctx)
729{
730	wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
731	wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
732}
733
734
735static int wpa_driver_ndis_scan_native80211(
736	struct wpa_driver_ndis_data *drv,
737	struct wpa_driver_scan_params *params)
738{
739	DOT11_SCAN_REQUEST_V2 req;
740	int res;
741
742	os_memset(&req, 0, sizeof(req));
743	req.dot11BSSType = dot11_BSS_type_any;
744	os_memset(req.dot11BSSID, 0xff, ETH_ALEN);
745	req.dot11ScanType = dot11_scan_type_auto;
746	res = ndis_set_oid(drv, OID_DOT11_SCAN_REQUEST, (char *) &req,
747			   sizeof(req));
748	eloop_cancel_timeout(wpa_driver_ndis_scan_timeout, drv, drv->ctx);
749	eloop_register_timeout(7, 0, wpa_driver_ndis_scan_timeout, drv,
750			       drv->ctx);
751	return res;
752}
753
754
755static int wpa_driver_ndis_scan(void *priv,
756				struct wpa_driver_scan_params *params)
757{
758	struct wpa_driver_ndis_data *drv = priv;
759	int res;
760
761	if (drv->native80211)
762		return wpa_driver_ndis_scan_native80211(drv, params);
763
764	if (!drv->radio_enabled) {
765		wpa_printf(MSG_DEBUG, "NDIS: turning radio on before the first"
766			   " scan");
767		if (wpa_driver_ndis_disconnect(drv) < 0) {
768			wpa_printf(MSG_DEBUG, "NDIS: failed to enable radio");
769		}
770		drv->radio_enabled = 1;
771	}
772
773	res = ndis_set_oid(drv, OID_802_11_BSSID_LIST_SCAN, "    ", 4);
774	eloop_cancel_timeout(wpa_driver_ndis_scan_timeout, drv, drv->ctx);
775	eloop_register_timeout(7, 0, wpa_driver_ndis_scan_timeout, drv,
776			       drv->ctx);
777	return res;
778}
779
780
781static const u8 * wpa_scan_get_ie(const struct wpa_scan_res *res, u8 ie)
782{
783	const u8 *end, *pos;
784
785	pos = (const u8 *) (res + 1);
786	end = pos + res->ie_len;
787
788	while (pos + 1 < end) {
789		if (pos + 2 + pos[1] > end)
790			break;
791		if (pos[0] == ie)
792			return pos;
793		pos += 2 + pos[1];
794	}
795
796	return NULL;
797}
798
799
800static struct wpa_scan_res * wpa_driver_ndis_add_scan_ssid(
801	struct wpa_scan_res *r, NDIS_802_11_SSID *ssid)
802{
803	struct wpa_scan_res *nr;
804	u8 *pos;
805
806	if (wpa_scan_get_ie(r, WLAN_EID_SSID))
807		return r; /* SSID IE already present */
808
809	if (ssid->SsidLength == 0 || ssid->SsidLength > 32)
810		return r; /* No valid SSID inside scan data */
811
812	nr = os_realloc(r, sizeof(*r) + r->ie_len + 2 + ssid->SsidLength);
813	if (nr == NULL)
814		return r;
815
816	pos = ((u8 *) (nr + 1)) + nr->ie_len;
817	*pos++ = WLAN_EID_SSID;
818	*pos++ = ssid->SsidLength;
819	os_memcpy(pos, ssid->Ssid, ssid->SsidLength);
820	nr->ie_len += 2 + ssid->SsidLength;
821
822	return nr;
823}
824
825
826static struct wpa_scan_results * wpa_driver_ndis_get_scan_results(void *priv)
827{
828	struct wpa_driver_ndis_data *drv = priv;
829	NDIS_802_11_BSSID_LIST_EX *b;
830	size_t blen, count, i;
831	int len;
832	char *pos;
833	struct wpa_scan_results *results;
834	struct wpa_scan_res *r;
835
836	blen = 65535;
837	b = os_zalloc(blen);
838	if (b == NULL)
839		return NULL;
840	len = ndis_get_oid(drv, OID_802_11_BSSID_LIST, (char *) b, blen);
841	if (len < 0) {
842		wpa_printf(MSG_DEBUG, "NDIS: failed to get scan results");
843		os_free(b);
844		return NULL;
845	}
846	count = b->NumberOfItems;
847
848	results = os_zalloc(sizeof(*results));
849	if (results == NULL) {
850		os_free(b);
851		return NULL;
852	}
853	results->res = os_calloc(count, sizeof(struct wpa_scan_res *));
854	if (results->res == NULL) {
855		os_free(results);
856		os_free(b);
857		return NULL;
858	}
859
860	pos = (char *) &b->Bssid[0];
861	for (i = 0; i < count; i++) {
862		NDIS_WLAN_BSSID_EX *bss = (NDIS_WLAN_BSSID_EX *) pos;
863		NDIS_802_11_FIXED_IEs *fixed;
864
865		if (bss->IELength < sizeof(NDIS_802_11_FIXED_IEs)) {
866			wpa_printf(MSG_DEBUG, "NDIS: too small IELength=%d",
867				   (int) bss->IELength);
868			break;
869		}
870		if (((char *) bss->IEs) + bss->IELength  > (char *) b + blen) {
871			/*
872			 * Some NDIS drivers have been reported to include an
873			 * entry with an invalid IELength in scan results and
874			 * this has crashed wpa_supplicant, so validate the
875			 * returned value before using it.
876			 */
877			wpa_printf(MSG_DEBUG, "NDIS: skipped invalid scan "
878				   "result IE (BSSID=" MACSTR ") IELength=%d",
879				   MAC2STR(bss->MacAddress),
880				   (int) bss->IELength);
881			break;
882		}
883
884		r = os_zalloc(sizeof(*r) + bss->IELength -
885			      sizeof(NDIS_802_11_FIXED_IEs));
886		if (r == NULL)
887			break;
888
889		os_memcpy(r->bssid, bss->MacAddress, ETH_ALEN);
890		r->level = (int) bss->Rssi;
891		r->freq = bss->Configuration.DSConfig / 1000;
892		fixed = (NDIS_802_11_FIXED_IEs *) bss->IEs;
893		r->beacon_int = WPA_GET_LE16((u8 *) &fixed->BeaconInterval);
894		r->caps = WPA_GET_LE16((u8 *) &fixed->Capabilities);
895		r->tsf = WPA_GET_LE64(fixed->Timestamp);
896		os_memcpy(r + 1, bss->IEs + sizeof(NDIS_802_11_FIXED_IEs),
897			  bss->IELength - sizeof(NDIS_802_11_FIXED_IEs));
898		r->ie_len = bss->IELength - sizeof(NDIS_802_11_FIXED_IEs);
899		r = wpa_driver_ndis_add_scan_ssid(r, &bss->Ssid);
900
901		results->res[results->num++] = r;
902
903		pos += bss->Length;
904		if (pos > (char *) b + blen)
905			break;
906	}
907
908	os_free(b);
909
910	return results;
911}
912
913
914static int wpa_driver_ndis_remove_key(struct wpa_driver_ndis_data *drv,
915				      int key_idx, const u8 *addr,
916				      const u8 *bssid, int pairwise)
917{
918	NDIS_802_11_REMOVE_KEY rkey;
919	NDIS_802_11_KEY_INDEX index;
920	int res, res2;
921
922	os_memset(&rkey, 0, sizeof(rkey));
923
924	rkey.Length = sizeof(rkey);
925	rkey.KeyIndex = key_idx;
926	if (pairwise)
927		rkey.KeyIndex |= 1 << 30;
928	os_memcpy(rkey.BSSID, bssid, ETH_ALEN);
929
930	res = ndis_set_oid(drv, OID_802_11_REMOVE_KEY, (char *) &rkey,
931			   sizeof(rkey));
932	if (!pairwise) {
933		index = key_idx;
934		res2 = ndis_set_oid(drv, OID_802_11_REMOVE_WEP,
935				    (char *) &index, sizeof(index));
936	} else
937		res2 = 0;
938
939	if (res < 0 && res2 < 0)
940		return -1;
941	return 0;
942}
943
944
945static int wpa_driver_ndis_add_wep(struct wpa_driver_ndis_data *drv,
946				   int pairwise, int key_idx, int set_tx,
947				   const u8 *key, size_t key_len)
948{
949	NDIS_802_11_WEP *wep;
950	size_t len;
951	int res;
952
953	len = 12 + key_len;
954	wep = os_zalloc(len);
955	if (wep == NULL)
956		return -1;
957	wep->Length = len;
958	wep->KeyIndex = key_idx;
959	if (set_tx)
960		wep->KeyIndex |= 1 << 31;
961#if 0 /* Setting bit30 does not seem to work with some NDIS drivers */
962	if (pairwise)
963		wep->KeyIndex |= 1 << 30;
964#endif
965	wep->KeyLength = key_len;
966	os_memcpy(wep->KeyMaterial, key, key_len);
967
968	wpa_hexdump_key(MSG_MSGDUMP, "NDIS: OID_802_11_ADD_WEP",
969			(u8 *) wep, len);
970	res = ndis_set_oid(drv, OID_802_11_ADD_WEP, (char *) wep, len);
971
972	os_free(wep);
973
974	return res;
975}
976
977
978static int wpa_driver_ndis_set_key(const char *ifname, void *priv,
979				   enum wpa_alg alg, const u8 *addr,
980				   int key_idx, int set_tx,
981				   const u8 *seq, size_t seq_len,
982				   const u8 *key, size_t key_len)
983{
984	struct wpa_driver_ndis_data *drv = priv;
985	size_t len, i;
986	NDIS_802_11_KEY *nkey;
987	int res, pairwise;
988	u8 bssid[ETH_ALEN];
989
990	if (addr == NULL || is_broadcast_ether_addr(addr)) {
991		/* Group Key */
992		pairwise = 0;
993		if (wpa_driver_ndis_get_bssid(drv, bssid) < 0)
994			os_memset(bssid, 0xff, ETH_ALEN);
995	} else {
996		/* Pairwise Key */
997		pairwise = 1;
998		os_memcpy(bssid, addr, ETH_ALEN);
999	}
1000
1001	if (alg == WPA_ALG_NONE || key_len == 0) {
1002		return wpa_driver_ndis_remove_key(drv, key_idx, addr, bssid,
1003						  pairwise);
1004	}
1005
1006	if (alg == WPA_ALG_WEP) {
1007		return wpa_driver_ndis_add_wep(drv, pairwise, key_idx, set_tx,
1008					       key, key_len);
1009	}
1010
1011	len = 12 + 6 + 6 + 8 + key_len;
1012
1013	nkey = os_zalloc(len);
1014	if (nkey == NULL)
1015		return -1;
1016
1017	nkey->Length = len;
1018	nkey->KeyIndex = key_idx;
1019	if (set_tx)
1020		nkey->KeyIndex |= 1 << 31;
1021	if (pairwise)
1022		nkey->KeyIndex |= 1 << 30;
1023	if (seq && seq_len)
1024		nkey->KeyIndex |= 1 << 29;
1025	nkey->KeyLength = key_len;
1026	os_memcpy(nkey->BSSID, bssid, ETH_ALEN);
1027	if (seq && seq_len) {
1028		for (i = 0; i < seq_len; i++)
1029			nkey->KeyRSC |= (ULONGLONG) seq[i] << (i * 8);
1030	}
1031	if (alg == WPA_ALG_TKIP && key_len == 32) {
1032		os_memcpy(nkey->KeyMaterial, key, 16);
1033		os_memcpy(nkey->KeyMaterial + 16, key + 24, 8);
1034		os_memcpy(nkey->KeyMaterial + 24, key + 16, 8);
1035	} else {
1036		os_memcpy(nkey->KeyMaterial, key, key_len);
1037	}
1038
1039	wpa_hexdump_key(MSG_MSGDUMP, "NDIS: OID_802_11_ADD_KEY",
1040			(u8 *) nkey, len);
1041	res = ndis_set_oid(drv, OID_802_11_ADD_KEY, (char *) nkey, len);
1042	os_free(nkey);
1043
1044	return res;
1045}
1046
1047
1048static int
1049wpa_driver_ndis_associate(void *priv,
1050			  struct wpa_driver_associate_params *params)
1051{
1052	struct wpa_driver_ndis_data *drv = priv;
1053	u32 auth_mode, encr, priv_mode, mode;
1054	u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
1055
1056	drv->mode = params->mode;
1057
1058	/* Note: Setting OID_802_11_INFRASTRUCTURE_MODE clears current keys,
1059	 * so static WEP keys needs to be set again after this. */
1060	if (params->mode == IEEE80211_MODE_IBSS) {
1061		mode = Ndis802_11IBSS;
1062		/* Need to make sure that BSSID polling is enabled for
1063		 * IBSS mode. */
1064		eloop_cancel_timeout(wpa_driver_ndis_poll_timeout, drv, NULL);
1065		eloop_register_timeout(1, 0, wpa_driver_ndis_poll_timeout,
1066				       drv, NULL);
1067	} else
1068		mode = Ndis802_11Infrastructure;
1069	if (ndis_set_oid(drv, OID_802_11_INFRASTRUCTURE_MODE,
1070			 (char *) &mode, sizeof(mode)) < 0) {
1071		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
1072			   "OID_802_11_INFRASTRUCTURE_MODE (%d)",
1073			   (int) mode);
1074		/* Try to continue anyway */
1075	}
1076
1077	if (params->key_mgmt_suite == KEY_MGMT_NONE ||
1078	    params->key_mgmt_suite == KEY_MGMT_802_1X_NO_WPA) {
1079		/* Re-set WEP keys if static WEP configuration is used. */
1080		int i;
1081		for (i = 0; i < 4; i++) {
1082			if (!params->wep_key[i])
1083				continue;
1084			wpa_printf(MSG_DEBUG, "NDIS: Re-setting static WEP "
1085				   "key %d", i);
1086			wpa_driver_ndis_set_key(drv->ifname, drv, WPA_ALG_WEP,
1087						bcast, i,
1088						i == params->wep_tx_keyidx,
1089						NULL, 0, params->wep_key[i],
1090						params->wep_key_len[i]);
1091		}
1092	}
1093
1094	if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
1095		if (params->auth_alg & WPA_AUTH_ALG_SHARED) {
1096			if (params->auth_alg & WPA_AUTH_ALG_OPEN)
1097				auth_mode = Ndis802_11AuthModeAutoSwitch;
1098			else
1099				auth_mode = Ndis802_11AuthModeShared;
1100		} else
1101			auth_mode = Ndis802_11AuthModeOpen;
1102		priv_mode = Ndis802_11PrivFilterAcceptAll;
1103	} else if (params->wpa_ie[0] == WLAN_EID_RSN) {
1104		priv_mode = Ndis802_11PrivFilter8021xWEP;
1105		if (params->key_mgmt_suite == KEY_MGMT_PSK)
1106			auth_mode = Ndis802_11AuthModeWPA2PSK;
1107		else
1108			auth_mode = Ndis802_11AuthModeWPA2;
1109#ifdef CONFIG_WPS
1110	} else if (params->key_mgmt_suite == KEY_MGMT_WPS) {
1111		auth_mode = Ndis802_11AuthModeOpen;
1112		priv_mode = Ndis802_11PrivFilterAcceptAll;
1113		if (params->wps == WPS_MODE_PRIVACY) {
1114			u8 dummy_key[5] = { 0x11, 0x22, 0x33, 0x44, 0x55 };
1115			/*
1116			 * Some NDIS drivers refuse to associate in open mode
1117			 * configuration due to Privacy field mismatch, so use
1118			 * a workaround to make the configuration look like
1119			 * matching one for WPS provisioning.
1120			 */
1121			wpa_printf(MSG_DEBUG, "NDIS: Set dummy WEP key as a "
1122				   "workaround to allow driver to associate "
1123				   "for WPS");
1124			wpa_driver_ndis_set_key(drv->ifname, drv, WPA_ALG_WEP,
1125						bcast, 0, 1,
1126						NULL, 0, dummy_key,
1127						sizeof(dummy_key));
1128		}
1129#endif /* CONFIG_WPS */
1130	} else {
1131		priv_mode = Ndis802_11PrivFilter8021xWEP;
1132		if (params->key_mgmt_suite == KEY_MGMT_WPA_NONE)
1133			auth_mode = Ndis802_11AuthModeWPANone;
1134		else if (params->key_mgmt_suite == KEY_MGMT_PSK)
1135			auth_mode = Ndis802_11AuthModeWPAPSK;
1136		else
1137			auth_mode = Ndis802_11AuthModeWPA;
1138	}
1139
1140	switch (params->pairwise_suite) {
1141	case CIPHER_CCMP:
1142		encr = Ndis802_11Encryption3Enabled;
1143		break;
1144	case CIPHER_TKIP:
1145		encr = Ndis802_11Encryption2Enabled;
1146		break;
1147	case CIPHER_WEP40:
1148	case CIPHER_WEP104:
1149		encr = Ndis802_11Encryption1Enabled;
1150		break;
1151	case CIPHER_NONE:
1152#ifdef CONFIG_WPS
1153		if (params->wps == WPS_MODE_PRIVACY) {
1154			encr = Ndis802_11Encryption1Enabled;
1155			break;
1156		}
1157#endif /* CONFIG_WPS */
1158		if (params->group_suite == CIPHER_CCMP)
1159			encr = Ndis802_11Encryption3Enabled;
1160		else if (params->group_suite == CIPHER_TKIP)
1161			encr = Ndis802_11Encryption2Enabled;
1162		else
1163			encr = Ndis802_11EncryptionDisabled;
1164		break;
1165	default:
1166#ifdef CONFIG_WPS
1167		if (params->wps == WPS_MODE_PRIVACY) {
1168			encr = Ndis802_11Encryption1Enabled;
1169			break;
1170		}
1171#endif /* CONFIG_WPS */
1172		encr = Ndis802_11EncryptionDisabled;
1173		break;
1174	};
1175
1176	if (ndis_set_oid(drv, OID_802_11_PRIVACY_FILTER,
1177			 (char *) &priv_mode, sizeof(priv_mode)) < 0) {
1178		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
1179			   "OID_802_11_PRIVACY_FILTER (%d)",
1180			   (int) priv_mode);
1181		/* Try to continue anyway */
1182	}
1183
1184	ndis_set_auth_mode(drv, auth_mode);
1185	ndis_set_encr_status(drv, encr);
1186
1187	if (params->bssid) {
1188		ndis_set_oid(drv, OID_802_11_BSSID, (char *) params->bssid,
1189			     ETH_ALEN);
1190		drv->oid_bssid_set = 1;
1191	} else if (drv->oid_bssid_set) {
1192		ndis_set_oid(drv, OID_802_11_BSSID, "\xff\xff\xff\xff\xff\xff",
1193			     ETH_ALEN);
1194		drv->oid_bssid_set = 0;
1195	}
1196
1197	return wpa_driver_ndis_set_ssid(drv, params->ssid, params->ssid_len);
1198}
1199
1200
1201static int wpa_driver_ndis_set_pmkid(struct wpa_driver_ndis_data *drv)
1202{
1203	int len, count, i, ret;
1204	struct ndis_pmkid_entry *entry;
1205	NDIS_802_11_PMKID *p;
1206
1207	count = 0;
1208	entry = drv->pmkid;
1209	while (entry) {
1210		count++;
1211		if (count >= drv->no_of_pmkid)
1212			break;
1213		entry = entry->next;
1214	}
1215	len = 8 + count * sizeof(BSSID_INFO);
1216	p = os_zalloc(len);
1217	if (p == NULL)
1218		return -1;
1219
1220	p->Length = len;
1221	p->BSSIDInfoCount = count;
1222	entry = drv->pmkid;
1223	for (i = 0; i < count; i++) {
1224		os_memcpy(&p->BSSIDInfo[i].BSSID, entry->bssid, ETH_ALEN);
1225		os_memcpy(&p->BSSIDInfo[i].PMKID, entry->pmkid, 16);
1226		entry = entry->next;
1227	}
1228	wpa_hexdump(MSG_MSGDUMP, "NDIS: OID_802_11_PMKID", (u8 *) p, len);
1229	ret = ndis_set_oid(drv, OID_802_11_PMKID, (char *) p, len);
1230	os_free(p);
1231	return ret;
1232}
1233
1234
1235static int wpa_driver_ndis_add_pmkid(void *priv, const u8 *bssid,
1236				     const u8 *pmkid)
1237{
1238	struct wpa_driver_ndis_data *drv = priv;
1239	struct ndis_pmkid_entry *entry, *prev;
1240
1241	if (drv->no_of_pmkid == 0)
1242		return 0;
1243
1244	prev = NULL;
1245	entry = drv->pmkid;
1246	while (entry) {
1247		if (os_memcmp(entry->bssid, bssid, ETH_ALEN) == 0)
1248			break;
1249		prev = entry;
1250		entry = entry->next;
1251	}
1252
1253	if (entry) {
1254		/* Replace existing entry for this BSSID and move it into the
1255		 * beginning of the list. */
1256		os_memcpy(entry->pmkid, pmkid, 16);
1257		if (prev) {
1258			prev->next = entry->next;
1259			entry->next = drv->pmkid;
1260			drv->pmkid = entry;
1261		}
1262	} else {
1263		entry = os_malloc(sizeof(*entry));
1264		if (entry) {
1265			os_memcpy(entry->bssid, bssid, ETH_ALEN);
1266			os_memcpy(entry->pmkid, pmkid, 16);
1267			entry->next = drv->pmkid;
1268			drv->pmkid = entry;
1269		}
1270	}
1271
1272	return wpa_driver_ndis_set_pmkid(drv);
1273}
1274
1275
1276static int wpa_driver_ndis_remove_pmkid(void *priv, const u8 *bssid,
1277		 			const u8 *pmkid)
1278{
1279	struct wpa_driver_ndis_data *drv = priv;
1280	struct ndis_pmkid_entry *entry, *prev;
1281
1282	if (drv->no_of_pmkid == 0)
1283		return 0;
1284
1285	entry = drv->pmkid;
1286	prev = NULL;
1287	while (entry) {
1288		if (os_memcmp(entry->bssid, bssid, ETH_ALEN) == 0 &&
1289		    os_memcmp(entry->pmkid, pmkid, 16) == 0) {
1290			if (prev)
1291				prev->next = entry->next;
1292			else
1293				drv->pmkid = entry->next;
1294			os_free(entry);
1295			break;
1296		}
1297		prev = entry;
1298		entry = entry->next;
1299	}
1300	return wpa_driver_ndis_set_pmkid(drv);
1301}
1302
1303
1304static int wpa_driver_ndis_flush_pmkid(void *priv)
1305{
1306	struct wpa_driver_ndis_data *drv = priv;
1307	NDIS_802_11_PMKID p;
1308	struct ndis_pmkid_entry *pmkid, *prev;
1309	int prev_authmode, ret;
1310
1311	if (drv->no_of_pmkid == 0)
1312		return 0;
1313
1314	pmkid = drv->pmkid;
1315	drv->pmkid = NULL;
1316	while (pmkid) {
1317		prev = pmkid;
1318		pmkid = pmkid->next;
1319		os_free(prev);
1320	}
1321
1322	/*
1323	 * Some drivers may refuse OID_802_11_PMKID if authMode is not set to
1324	 * WPA2, so change authMode temporarily, if needed.
1325	 */
1326	prev_authmode = ndis_get_auth_mode(drv);
1327	if (prev_authmode != Ndis802_11AuthModeWPA2)
1328		ndis_set_auth_mode(drv, Ndis802_11AuthModeWPA2);
1329
1330	os_memset(&p, 0, sizeof(p));
1331	p.Length = 8;
1332	p.BSSIDInfoCount = 0;
1333	wpa_hexdump(MSG_MSGDUMP, "NDIS: OID_802_11_PMKID (flush)",
1334		    (u8 *) &p, 8);
1335	ret = ndis_set_oid(drv, OID_802_11_PMKID, (char *) &p, 8);
1336
1337	if (prev_authmode != Ndis802_11AuthModeWPA2)
1338		ndis_set_auth_mode(drv, prev_authmode);
1339
1340	return ret;
1341}
1342
1343
1344static int wpa_driver_ndis_get_associnfo(struct wpa_driver_ndis_data *drv)
1345{
1346	char buf[512], *pos;
1347	NDIS_802_11_ASSOCIATION_INFORMATION *ai;
1348	int len;
1349	union wpa_event_data data;
1350	NDIS_802_11_BSSID_LIST_EX *b;
1351	size_t blen, i;
1352
1353	len = ndis_get_oid(drv, OID_802_11_ASSOCIATION_INFORMATION, buf,
1354			   sizeof(buf));
1355	if (len < 0) {
1356		wpa_printf(MSG_DEBUG, "NDIS: failed to get association "
1357			   "information");
1358		return -1;
1359	}
1360	if (len > sizeof(buf)) {
1361		/* Some drivers seem to be producing incorrect length for this
1362		 * data. Limit the length to the current buffer size to avoid
1363		 * crashing in hexdump. The data seems to be otherwise valid,
1364		 * so better try to use it. */
1365		wpa_printf(MSG_DEBUG, "NDIS: ignored bogus association "
1366			   "information length %d", len);
1367		len = ndis_get_oid(drv, OID_802_11_ASSOCIATION_INFORMATION,
1368				   buf, sizeof(buf));
1369		if (len < -1) {
1370			wpa_printf(MSG_DEBUG, "NDIS: re-reading association "
1371				   "information failed");
1372			return -1;
1373		}
1374		if (len > sizeof(buf)) {
1375			wpa_printf(MSG_DEBUG, "NDIS: ignored bogus association"
1376				   " information length %d (re-read)", len);
1377			len = sizeof(buf);
1378		}
1379	}
1380	wpa_hexdump(MSG_MSGDUMP, "NDIS: association information",
1381		    (u8 *) buf, len);
1382	if (len < sizeof(*ai)) {
1383		wpa_printf(MSG_DEBUG, "NDIS: too short association "
1384			   "information");
1385		return -1;
1386	}
1387	ai = (NDIS_802_11_ASSOCIATION_INFORMATION *) buf;
1388	wpa_printf(MSG_DEBUG, "NDIS: ReqFixed=0x%x RespFixed=0x%x off_req=%d "
1389		   "off_resp=%d len_req=%d len_resp=%d",
1390		   ai->AvailableRequestFixedIEs, ai->AvailableResponseFixedIEs,
1391		   (int) ai->OffsetRequestIEs, (int) ai->OffsetResponseIEs,
1392		   (int) ai->RequestIELength, (int) ai->ResponseIELength);
1393
1394	if (ai->OffsetRequestIEs + ai->RequestIELength > (unsigned) len ||
1395	    ai->OffsetResponseIEs + ai->ResponseIELength > (unsigned) len) {
1396		wpa_printf(MSG_DEBUG, "NDIS: association information - "
1397			   "IE overflow");
1398		return -1;
1399	}
1400
1401	wpa_hexdump(MSG_MSGDUMP, "NDIS: Request IEs",
1402		    (u8 *) buf + ai->OffsetRequestIEs, ai->RequestIELength);
1403	wpa_hexdump(MSG_MSGDUMP, "NDIS: Response IEs",
1404		    (u8 *) buf + ai->OffsetResponseIEs, ai->ResponseIELength);
1405
1406	os_memset(&data, 0, sizeof(data));
1407	data.assoc_info.req_ies = (u8 *) buf + ai->OffsetRequestIEs;
1408	data.assoc_info.req_ies_len = ai->RequestIELength;
1409	data.assoc_info.resp_ies = (u8 *) buf + ai->OffsetResponseIEs;
1410	data.assoc_info.resp_ies_len = ai->ResponseIELength;
1411
1412	blen = 65535;
1413	b = os_zalloc(blen);
1414	if (b == NULL)
1415		goto skip_scan_results;
1416	len = ndis_get_oid(drv, OID_802_11_BSSID_LIST, (char *) b, blen);
1417	if (len < 0) {
1418		wpa_printf(MSG_DEBUG, "NDIS: failed to get scan results");
1419		os_free(b);
1420		b = NULL;
1421		goto skip_scan_results;
1422	}
1423	wpa_printf(MSG_DEBUG, "NDIS: %d BSSID items to process for AssocInfo",
1424		   (unsigned int) b->NumberOfItems);
1425
1426	pos = (char *) &b->Bssid[0];
1427	for (i = 0; i < b->NumberOfItems; i++) {
1428		NDIS_WLAN_BSSID_EX *bss = (NDIS_WLAN_BSSID_EX *) pos;
1429		if (os_memcmp(drv->bssid, bss->MacAddress, ETH_ALEN) == 0 &&
1430		    bss->IELength > sizeof(NDIS_802_11_FIXED_IEs)) {
1431			data.assoc_info.beacon_ies =
1432				((u8 *) bss->IEs) +
1433				sizeof(NDIS_802_11_FIXED_IEs);
1434			data.assoc_info.beacon_ies_len =
1435				bss->IELength - sizeof(NDIS_802_11_FIXED_IEs);
1436			wpa_hexdump(MSG_MSGDUMP, "NDIS: Beacon IEs",
1437				    data.assoc_info.beacon_ies,
1438				    data.assoc_info.beacon_ies_len);
1439			break;
1440		}
1441		pos += bss->Length;
1442		if (pos > (char *) b + blen)
1443			break;
1444	}
1445
1446skip_scan_results:
1447	wpa_supplicant_event(drv->ctx, EVENT_ASSOCINFO, &data);
1448
1449	os_free(b);
1450
1451	return 0;
1452}
1453
1454
1455static void wpa_driver_ndis_poll_timeout(void *eloop_ctx, void *timeout_ctx)
1456{
1457	struct wpa_driver_ndis_data *drv = eloop_ctx;
1458	u8 bssid[ETH_ALEN];
1459	int poll;
1460
1461	if (drv->wired)
1462		return;
1463
1464	if (wpa_driver_ndis_get_bssid(drv, bssid)) {
1465		/* Disconnected */
1466		if (!is_zero_ether_addr(drv->bssid)) {
1467			os_memset(drv->bssid, 0, ETH_ALEN);
1468			wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
1469		}
1470	} else {
1471		/* Connected */
1472		if (os_memcmp(drv->bssid, bssid, ETH_ALEN) != 0) {
1473			os_memcpy(drv->bssid, bssid, ETH_ALEN);
1474			wpa_driver_ndis_get_associnfo(drv);
1475			wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
1476		}
1477	}
1478
1479	/* When using integrated NDIS event receiver, we can skip BSSID
1480	 * polling when using infrastructure network. However, when using
1481	 * IBSS mode, many driver do not seem to generate connection event,
1482	 * so we need to enable BSSID polling to figure out when IBSS network
1483	 * has been formed.
1484	 */
1485	poll = drv->mode == IEEE80211_MODE_IBSS;
1486#ifndef CONFIG_NDIS_EVENTS_INTEGRATED
1487#ifndef _WIN32_WCE
1488	poll = 1;
1489#endif /* _WIN32_WCE */
1490#endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
1491
1492	if (poll) {
1493		eloop_register_timeout(1, 0, wpa_driver_ndis_poll_timeout,
1494					drv, NULL);
1495	}
1496}
1497
1498
1499static void wpa_driver_ndis_poll(void *priv)
1500{
1501	struct wpa_driver_ndis_data *drv = priv;
1502	eloop_cancel_timeout(wpa_driver_ndis_poll_timeout, drv, NULL);
1503	wpa_driver_ndis_poll_timeout(drv, NULL);
1504}
1505
1506
1507/* Called when driver generates Media Connect Event by calling
1508 * NdisMIndicateStatus() with NDIS_STATUS_MEDIA_CONNECT */
1509void wpa_driver_ndis_event_connect(struct wpa_driver_ndis_data *drv)
1510{
1511	wpa_printf(MSG_DEBUG, "NDIS: Media Connect Event");
1512	if (wpa_driver_ndis_get_bssid(drv, drv->bssid) == 0) {
1513		wpa_driver_ndis_get_associnfo(drv);
1514		wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
1515	}
1516}
1517
1518
1519/* Called when driver generates Media Disconnect Event by calling
1520 * NdisMIndicateStatus() with NDIS_STATUS_MEDIA_DISCONNECT */
1521void wpa_driver_ndis_event_disconnect(struct wpa_driver_ndis_data *drv)
1522{
1523	wpa_printf(MSG_DEBUG, "NDIS: Media Disconnect Event");
1524	os_memset(drv->bssid, 0, ETH_ALEN);
1525	wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
1526}
1527
1528
1529static void wpa_driver_ndis_event_auth(struct wpa_driver_ndis_data *drv,
1530				       const u8 *data, size_t data_len)
1531{
1532	NDIS_802_11_AUTHENTICATION_REQUEST *req;
1533	int pairwise = 0, group = 0;
1534	union wpa_event_data event;
1535
1536	if (data_len < sizeof(*req)) {
1537		wpa_printf(MSG_DEBUG, "NDIS: Too short Authentication Request "
1538			   "Event (len=%d)", data_len);
1539		return;
1540	}
1541	req = (NDIS_802_11_AUTHENTICATION_REQUEST *) data;
1542
1543	wpa_printf(MSG_DEBUG, "NDIS: Authentication Request Event: "
1544		   "Bssid " MACSTR " Flags 0x%x",
1545		   MAC2STR(req->Bssid), (int) req->Flags);
1546
1547	if ((req->Flags & NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR) ==
1548	    NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR)
1549		pairwise = 1;
1550	else if ((req->Flags & NDIS_802_11_AUTH_REQUEST_GROUP_ERROR) ==
1551	    NDIS_802_11_AUTH_REQUEST_GROUP_ERROR)
1552		group = 1;
1553
1554	if (pairwise || group) {
1555		os_memset(&event, 0, sizeof(event));
1556		event.michael_mic_failure.unicast = pairwise;
1557		wpa_supplicant_event(drv->ctx, EVENT_MICHAEL_MIC_FAILURE,
1558				     &event);
1559	}
1560}
1561
1562
1563static void wpa_driver_ndis_event_pmkid(struct wpa_driver_ndis_data *drv,
1564					const u8 *data, size_t data_len)
1565{
1566	NDIS_802_11_PMKID_CANDIDATE_LIST *pmkid;
1567	size_t i;
1568	union wpa_event_data event;
1569
1570	if (data_len < 8) {
1571		wpa_printf(MSG_DEBUG, "NDIS: Too short PMKID Candidate List "
1572			   "Event (len=%d)", data_len);
1573		return;
1574	}
1575	pmkid = (NDIS_802_11_PMKID_CANDIDATE_LIST *) data;
1576	wpa_printf(MSG_DEBUG, "NDIS: PMKID Candidate List Event - Version %d "
1577		   "NumCandidates %d",
1578		   (int) pmkid->Version, (int) pmkid->NumCandidates);
1579
1580	if (pmkid->Version != 1) {
1581		wpa_printf(MSG_DEBUG, "NDIS: Unsupported PMKID Candidate List "
1582			   "Version %d", (int) pmkid->Version);
1583		return;
1584	}
1585
1586	if (data_len < 8 + pmkid->NumCandidates * sizeof(PMKID_CANDIDATE)) {
1587		wpa_printf(MSG_DEBUG, "NDIS: PMKID Candidate List underflow");
1588		return;
1589	}
1590
1591	os_memset(&event, 0, sizeof(event));
1592	for (i = 0; i < pmkid->NumCandidates; i++) {
1593		PMKID_CANDIDATE *p = &pmkid->CandidateList[i];
1594		wpa_printf(MSG_DEBUG, "NDIS: %d: " MACSTR " Flags 0x%x",
1595			   i, MAC2STR(p->BSSID), (int) p->Flags);
1596		os_memcpy(event.pmkid_candidate.bssid, p->BSSID, ETH_ALEN);
1597		event.pmkid_candidate.index = i;
1598		event.pmkid_candidate.preauth =
1599			p->Flags & NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
1600		wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE,
1601				     &event);
1602	}
1603}
1604
1605
1606/* Called when driver calls NdisMIndicateStatus() with
1607 * NDIS_STATUS_MEDIA_SPECIFIC_INDICATION */
1608void wpa_driver_ndis_event_media_specific(struct wpa_driver_ndis_data *drv,
1609					  const u8 *data, size_t data_len)
1610{
1611	NDIS_802_11_STATUS_INDICATION *status;
1612
1613	if (data == NULL || data_len < sizeof(*status))
1614		return;
1615
1616	wpa_hexdump(MSG_DEBUG, "NDIS: Media Specific Indication",
1617		    data, data_len);
1618
1619	status = (NDIS_802_11_STATUS_INDICATION *) data;
1620	data += sizeof(status);
1621	data_len -= sizeof(status);
1622
1623	switch (status->StatusType) {
1624	case Ndis802_11StatusType_Authentication:
1625		wpa_driver_ndis_event_auth(drv, data, data_len);
1626		break;
1627	case Ndis802_11StatusType_PMKID_CandidateList:
1628		wpa_driver_ndis_event_pmkid(drv, data, data_len);
1629		break;
1630	default:
1631		wpa_printf(MSG_DEBUG, "NDIS: Unknown StatusType %d",
1632			   (int) status->StatusType);
1633		break;
1634	}
1635}
1636
1637
1638/* Called when an adapter is added */
1639void wpa_driver_ndis_event_adapter_arrival(struct wpa_driver_ndis_data *drv)
1640{
1641	union wpa_event_data event;
1642	int i;
1643
1644	wpa_printf(MSG_DEBUG, "NDIS: Notify Adapter Arrival");
1645
1646	for (i = 0; i < 30; i++) {
1647		/* Re-open Packet32/NDISUIO connection */
1648		wpa_driver_ndis_adapter_close(drv);
1649		if (wpa_driver_ndis_adapter_init(drv) < 0 ||
1650		    wpa_driver_ndis_adapter_open(drv) < 0) {
1651			wpa_printf(MSG_DEBUG, "NDIS: Driver re-initialization "
1652				   "(%d) failed", i);
1653			os_sleep(1, 0);
1654		} else {
1655			wpa_printf(MSG_DEBUG, "NDIS: Driver re-initialized");
1656			break;
1657		}
1658	}
1659
1660	os_memset(&event, 0, sizeof(event));
1661	os_strlcpy(event.interface_status.ifname, drv->ifname,
1662		   sizeof(event.interface_status.ifname));
1663	event.interface_status.ievent = EVENT_INTERFACE_ADDED;
1664	wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
1665}
1666
1667
1668/* Called when an adapter is removed */
1669void wpa_driver_ndis_event_adapter_removal(struct wpa_driver_ndis_data *drv)
1670{
1671	union wpa_event_data event;
1672
1673	wpa_printf(MSG_DEBUG, "NDIS: Notify Adapter Removal");
1674	os_memset(&event, 0, sizeof(event));
1675	os_strlcpy(event.interface_status.ifname, drv->ifname,
1676		   sizeof(event.interface_status.ifname));
1677	event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
1678	wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
1679}
1680
1681
1682static void
1683wpa_driver_ndis_get_wpa_capability(struct wpa_driver_ndis_data *drv)
1684{
1685	wpa_printf(MSG_DEBUG, "NDIS: verifying driver WPA capability");
1686
1687	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeWPA) == 0 &&
1688	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeWPA) {
1689		wpa_printf(MSG_DEBUG, "NDIS: WPA key management supported");
1690		drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA;
1691	}
1692
1693	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeWPAPSK) == 0 &&
1694	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeWPAPSK) {
1695		wpa_printf(MSG_DEBUG, "NDIS: WPA-PSK key management "
1696			   "supported");
1697		drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
1698	}
1699
1700	if (ndis_set_encr_status(drv, Ndis802_11Encryption3Enabled) == 0 &&
1701	    ndis_get_encr_status(drv) == Ndis802_11Encryption3KeyAbsent) {
1702		wpa_printf(MSG_DEBUG, "NDIS: CCMP encryption supported");
1703		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
1704	}
1705
1706	if (ndis_set_encr_status(drv, Ndis802_11Encryption2Enabled) == 0 &&
1707	    ndis_get_encr_status(drv) == Ndis802_11Encryption2KeyAbsent) {
1708		wpa_printf(MSG_DEBUG, "NDIS: TKIP encryption supported");
1709		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
1710	}
1711
1712	if (ndis_set_encr_status(drv, Ndis802_11Encryption1Enabled) == 0 &&
1713	    ndis_get_encr_status(drv) == Ndis802_11Encryption1KeyAbsent) {
1714		wpa_printf(MSG_DEBUG, "NDIS: WEP encryption supported");
1715		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40 |
1716			WPA_DRIVER_CAPA_ENC_WEP104;
1717	}
1718
1719	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeShared) == 0 &&
1720	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeShared) {
1721		drv->capa.auth |= WPA_DRIVER_AUTH_SHARED;
1722	}
1723
1724	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeOpen) == 0 &&
1725	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeOpen) {
1726		drv->capa.auth |= WPA_DRIVER_AUTH_OPEN;
1727	}
1728
1729	ndis_set_encr_status(drv, Ndis802_11EncryptionDisabled);
1730
1731	/* Could also verify OID_802_11_ADD_KEY error reporting and
1732	 * support for OID_802_11_ASSOCIATION_INFORMATION. */
1733
1734	if (drv->capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA &&
1735	    drv->capa.enc & (WPA_DRIVER_CAPA_ENC_TKIP |
1736			     WPA_DRIVER_CAPA_ENC_CCMP)) {
1737		wpa_printf(MSG_DEBUG, "NDIS: driver supports WPA");
1738		drv->has_capability = 1;
1739	} else {
1740		wpa_printf(MSG_DEBUG, "NDIS: no WPA support found");
1741	}
1742
1743	wpa_printf(MSG_DEBUG, "NDIS: driver capabilities: key_mgmt 0x%x "
1744		   "enc 0x%x auth 0x%x",
1745		   drv->capa.key_mgmt, drv->capa.enc, drv->capa.auth);
1746}
1747
1748
1749static void wpa_driver_ndis_get_capability(struct wpa_driver_ndis_data *drv)
1750{
1751	char buf[512];
1752	int len;
1753	size_t i;
1754	NDIS_802_11_CAPABILITY *c;
1755
1756	drv->capa.flags = WPA_DRIVER_FLAGS_DRIVER_IE;
1757
1758	len = ndis_get_oid(drv, OID_802_11_CAPABILITY, buf, sizeof(buf));
1759	if (len < 0) {
1760		wpa_driver_ndis_get_wpa_capability(drv);
1761		return;
1762	}
1763
1764	wpa_hexdump(MSG_MSGDUMP, "OID_802_11_CAPABILITY", (u8 *) buf, len);
1765	c = (NDIS_802_11_CAPABILITY *) buf;
1766	if (len < sizeof(*c) || c->Version != 2) {
1767		wpa_printf(MSG_DEBUG, "NDIS: unsupported "
1768			   "OID_802_11_CAPABILITY data");
1769		return;
1770	}
1771	wpa_printf(MSG_DEBUG, "NDIS: Driver supports OID_802_11_CAPABILITY - "
1772		   "NoOfPMKIDs %d NoOfAuthEncrPairs %d",
1773		   (int) c->NoOfPMKIDs,
1774		   (int) c->NoOfAuthEncryptPairsSupported);
1775	drv->has_capability = 1;
1776	drv->no_of_pmkid = c->NoOfPMKIDs;
1777	for (i = 0; i < c->NoOfAuthEncryptPairsSupported; i++) {
1778		NDIS_802_11_AUTHENTICATION_ENCRYPTION *ae;
1779		ae = &c->AuthenticationEncryptionSupported[i];
1780		if ((char *) (ae + 1) > buf + len) {
1781			wpa_printf(MSG_DEBUG, "NDIS: auth/encr pair list "
1782				   "overflow");
1783			break;
1784		}
1785		wpa_printf(MSG_MSGDUMP, "NDIS: %d - auth %d encr %d",
1786			   i, (int) ae->AuthModeSupported,
1787			   (int) ae->EncryptStatusSupported);
1788		switch (ae->AuthModeSupported) {
1789		case Ndis802_11AuthModeOpen:
1790			drv->capa.auth |= WPA_DRIVER_AUTH_OPEN;
1791			break;
1792		case Ndis802_11AuthModeShared:
1793			drv->capa.auth |= WPA_DRIVER_AUTH_SHARED;
1794			break;
1795		case Ndis802_11AuthModeWPA:
1796			drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA;
1797			break;
1798		case Ndis802_11AuthModeWPAPSK:
1799			drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
1800			break;
1801		case Ndis802_11AuthModeWPA2:
1802			drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA2;
1803			break;
1804		case Ndis802_11AuthModeWPA2PSK:
1805			drv->capa.key_mgmt |=
1806				WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
1807			break;
1808		case Ndis802_11AuthModeWPANone:
1809			drv->capa.key_mgmt |=
1810				WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE;
1811			break;
1812		default:
1813			break;
1814		}
1815		switch (ae->EncryptStatusSupported) {
1816		case Ndis802_11Encryption1Enabled:
1817			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40;
1818			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP104;
1819			break;
1820		case Ndis802_11Encryption2Enabled:
1821			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
1822			break;
1823		case Ndis802_11Encryption3Enabled:
1824			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
1825			break;
1826		default:
1827			break;
1828		}
1829	}
1830
1831	wpa_printf(MSG_DEBUG, "NDIS: driver capabilities: key_mgmt 0x%x "
1832		   "enc 0x%x auth 0x%x",
1833		   drv->capa.key_mgmt, drv->capa.enc, drv->capa.auth);
1834}
1835
1836
1837static int wpa_driver_ndis_get_capa(void *priv, struct wpa_driver_capa *capa)
1838{
1839	struct wpa_driver_ndis_data *drv = priv;
1840	if (!drv->has_capability)
1841		return -1;
1842	os_memcpy(capa, &drv->capa, sizeof(*capa));
1843	return 0;
1844}
1845
1846
1847static const char * wpa_driver_ndis_get_ifname(void *priv)
1848{
1849	struct wpa_driver_ndis_data *drv = priv;
1850	return drv->ifname;
1851}
1852
1853
1854static const u8 * wpa_driver_ndis_get_mac_addr(void *priv)
1855{
1856	struct wpa_driver_ndis_data *drv = priv;
1857	return drv->own_addr;
1858}
1859
1860
1861#ifdef _WIN32_WCE
1862
1863#define NDISUIO_MSG_SIZE (sizeof(NDISUIO_DEVICE_NOTIFICATION) + 512)
1864
1865static void ndisuio_notification_receive(void *eloop_data, void *user_ctx)
1866{
1867	struct wpa_driver_ndis_data *drv = eloop_data;
1868	NDISUIO_DEVICE_NOTIFICATION *hdr;
1869	u8 buf[NDISUIO_MSG_SIZE];
1870	DWORD len, flags;
1871
1872	if (!ReadMsgQueue(drv->event_queue, buf, NDISUIO_MSG_SIZE, &len, 0,
1873			  &flags)) {
1874		wpa_printf(MSG_DEBUG, "ndisuio_notification_receive: "
1875			   "ReadMsgQueue failed: %d", (int) GetLastError());
1876		return;
1877	}
1878
1879	if (len < sizeof(NDISUIO_DEVICE_NOTIFICATION)) {
1880		wpa_printf(MSG_DEBUG, "ndisuio_notification_receive: "
1881			   "Too short message (len=%d)", (int) len);
1882		return;
1883	}
1884
1885	hdr = (NDISUIO_DEVICE_NOTIFICATION *) buf;
1886	wpa_printf(MSG_DEBUG, "NDIS: Notification received: len=%d type=0x%x",
1887		   (int) len, hdr->dwNotificationType);
1888
1889	switch (hdr->dwNotificationType) {
1890#ifdef NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL
1891	case NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL:
1892		wpa_printf(MSG_DEBUG, "NDIS: ADAPTER_ARRIVAL");
1893		wpa_driver_ndis_event_adapter_arrival(drv);
1894		break;
1895#endif
1896#ifdef NDISUIO_NOTIFICATION_ADAPTER_REMOVAL
1897	case NDISUIO_NOTIFICATION_ADAPTER_REMOVAL:
1898		wpa_printf(MSG_DEBUG, "NDIS: ADAPTER_REMOVAL");
1899		wpa_driver_ndis_event_adapter_removal(drv);
1900		break;
1901#endif
1902	case NDISUIO_NOTIFICATION_MEDIA_CONNECT:
1903		wpa_printf(MSG_DEBUG, "NDIS: MEDIA_CONNECT");
1904		SetEvent(drv->connected_event);
1905		wpa_driver_ndis_event_connect(drv);
1906		break;
1907	case NDISUIO_NOTIFICATION_MEDIA_DISCONNECT:
1908		ResetEvent(drv->connected_event);
1909		wpa_printf(MSG_DEBUG, "NDIS: MEDIA_DISCONNECT");
1910		wpa_driver_ndis_event_disconnect(drv);
1911		break;
1912	case NDISUIO_NOTIFICATION_MEDIA_SPECIFIC_NOTIFICATION:
1913		wpa_printf(MSG_DEBUG, "NDIS: MEDIA_SPECIFIC_NOTIFICATION");
1914#if _WIN32_WCE == 420 || _WIN32_WCE == 0x420
1915		wpa_driver_ndis_event_media_specific(
1916			drv, hdr->pvStatusBuffer, hdr->uiStatusBufferSize);
1917#else
1918		wpa_driver_ndis_event_media_specific(
1919			drv, ((const u8 *) hdr) + hdr->uiOffsetToStatusBuffer,
1920			(size_t) hdr->uiStatusBufferSize);
1921#endif
1922		break;
1923	default:
1924		wpa_printf(MSG_DEBUG, "NDIS: Unknown notification type 0x%x",
1925			   hdr->dwNotificationType);
1926		break;
1927	}
1928}
1929
1930
1931static void ndisuio_notification_deinit(struct wpa_driver_ndis_data *drv)
1932{
1933	NDISUIO_REQUEST_NOTIFICATION req;
1934
1935	memset(&req, 0, sizeof(req));
1936	req.hMsgQueue = drv->event_queue;
1937	req.dwNotificationTypes = 0;
1938
1939	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_REQUEST_NOTIFICATION,
1940			     &req, sizeof(req), NULL, 0, NULL, NULL)) {
1941		wpa_printf(MSG_INFO, "ndisuio_notification_deinit: "
1942			   "IOCTL_NDISUIO_REQUEST_NOTIFICATION failed: %d",
1943			   (int) GetLastError());
1944	}
1945
1946	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_CANCEL_NOTIFICATION,
1947			     NULL, 0, NULL, 0, NULL, NULL)) {
1948		wpa_printf(MSG_INFO, "ndisuio_notification_deinit: "
1949			   "IOCTL_NDISUIO_CANCEL_NOTIFICATION failed: %d",
1950			   (int) GetLastError());
1951	}
1952
1953	if (drv->event_queue) {
1954		eloop_unregister_event(drv->event_queue,
1955				       sizeof(drv->event_queue));
1956		CloseHandle(drv->event_queue);
1957		drv->event_queue = NULL;
1958	}
1959
1960	if (drv->connected_event) {
1961		CloseHandle(drv->connected_event);
1962		drv->connected_event = NULL;
1963	}
1964}
1965
1966
1967static int ndisuio_notification_init(struct wpa_driver_ndis_data *drv)
1968{
1969	MSGQUEUEOPTIONS opt;
1970	NDISUIO_REQUEST_NOTIFICATION req;
1971
1972	drv->connected_event =
1973		CreateEvent(NULL, TRUE, FALSE, TEXT("WpaSupplicantConnected"));
1974	if (drv->connected_event == NULL) {
1975		wpa_printf(MSG_INFO, "ndisuio_notification_init: "
1976			   "CreateEvent failed: %d",
1977			   (int) GetLastError());
1978		return -1;
1979	}
1980
1981	memset(&opt, 0, sizeof(opt));
1982	opt.dwSize = sizeof(opt);
1983	opt.dwMaxMessages = 5;
1984	opt.cbMaxMessage = NDISUIO_MSG_SIZE;
1985	opt.bReadAccess = TRUE;
1986
1987	drv->event_queue = CreateMsgQueue(NULL, &opt);
1988	if (drv->event_queue == NULL) {
1989		wpa_printf(MSG_INFO, "ndisuio_notification_init: "
1990			   "CreateMsgQueue failed: %d",
1991			   (int) GetLastError());
1992		ndisuio_notification_deinit(drv);
1993		return -1;
1994	}
1995
1996	memset(&req, 0, sizeof(req));
1997	req.hMsgQueue = drv->event_queue;
1998	req.dwNotificationTypes =
1999#ifdef NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL
2000		NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL |
2001#endif
2002#ifdef NDISUIO_NOTIFICATION_ADAPTER_REMOVAL
2003		NDISUIO_NOTIFICATION_ADAPTER_REMOVAL |
2004#endif
2005		NDISUIO_NOTIFICATION_MEDIA_CONNECT |
2006		NDISUIO_NOTIFICATION_MEDIA_DISCONNECT |
2007		NDISUIO_NOTIFICATION_MEDIA_SPECIFIC_NOTIFICATION;
2008
2009	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_REQUEST_NOTIFICATION,
2010			     &req, sizeof(req), NULL, 0, NULL, NULL)) {
2011		wpa_printf(MSG_INFO, "ndisuio_notification_init: "
2012			   "IOCTL_NDISUIO_REQUEST_NOTIFICATION failed: %d",
2013			   (int) GetLastError());
2014		ndisuio_notification_deinit(drv);
2015		return -1;
2016	}
2017
2018	eloop_register_event(drv->event_queue, sizeof(drv->event_queue),
2019			     ndisuio_notification_receive, drv, NULL);
2020
2021	return 0;
2022}
2023#endif /* _WIN32_WCE */
2024
2025
2026static int wpa_driver_ndis_get_names(struct wpa_driver_ndis_data *drv)
2027{
2028#ifdef CONFIG_USE_NDISUIO
2029	NDISUIO_QUERY_BINDING *b;
2030	size_t blen = sizeof(*b) + 1024;
2031	int i, error, found = 0;
2032	DWORD written;
2033	char name[256], desc[256], *dpos;
2034	WCHAR *pos;
2035	size_t j, len, dlen;
2036
2037	b = os_malloc(blen);
2038	if (b == NULL)
2039		return -1;
2040
2041	for (i = 0; ; i++) {
2042		os_memset(b, 0, blen);
2043		b->BindingIndex = i;
2044		if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_QUERY_BINDING,
2045				     b, sizeof(NDISUIO_QUERY_BINDING), b, blen,
2046				     &written, NULL)) {
2047			error = (int) GetLastError();
2048			if (error == ERROR_NO_MORE_ITEMS)
2049				break;
2050			wpa_printf(MSG_DEBUG, "IOCTL_NDISUIO_QUERY_BINDING "
2051				   "failed: %d", error);
2052			break;
2053		}
2054
2055		pos = (WCHAR *) ((char *) b + b->DeviceNameOffset);
2056		len = b->DeviceNameLength;
2057		if (len >= sizeof(name))
2058			len = sizeof(name) - 1;
2059		for (j = 0; j < len; j++)
2060			name[j] = (char) pos[j];
2061		name[len] = '\0';
2062
2063		pos = (WCHAR *) ((char *) b + b->DeviceDescrOffset);
2064		len = b->DeviceDescrLength;
2065		if (len >= sizeof(desc))
2066			len = sizeof(desc) - 1;
2067		for (j = 0; j < len; j++)
2068			desc[j] = (char) pos[j];
2069		desc[len] = '\0';
2070
2071		wpa_printf(MSG_DEBUG, "NDIS: %d - %s - %s", i, name, desc);
2072
2073		if (os_strstr(name, drv->ifname)) {
2074			wpa_printf(MSG_DEBUG, "NDIS: Interface name match");
2075			found = 1;
2076			break;
2077		}
2078
2079		if (os_strncmp(desc, drv->ifname, os_strlen(drv->ifname)) == 0)
2080		{
2081			wpa_printf(MSG_DEBUG, "NDIS: Interface description "
2082				   "match");
2083			found = 1;
2084			break;
2085		}
2086	}
2087
2088	if (!found) {
2089		wpa_printf(MSG_DEBUG, "NDIS: Could not find interface '%s'",
2090			   drv->ifname);
2091		os_free(b);
2092		return -1;
2093	}
2094
2095	os_strlcpy(drv->ifname,
2096		   os_strncmp(name, "\\DEVICE\\", 8) == 0 ? name + 8 : name,
2097		   sizeof(drv->ifname));
2098#ifdef _WIN32_WCE
2099	drv->adapter_name = wpa_strdup_tchar(drv->ifname);
2100	if (drv->adapter_name == NULL) {
2101		wpa_printf(MSG_ERROR, "NDIS: Failed to allocate memory for "
2102			   "adapter name");
2103		os_free(b);
2104		return -1;
2105	}
2106#endif /* _WIN32_WCE */
2107
2108	dpos = os_strstr(desc, " - ");
2109	if (dpos)
2110		dlen = dpos - desc;
2111	else
2112		dlen = os_strlen(desc);
2113	drv->adapter_desc = os_malloc(dlen + 1);
2114	if (drv->adapter_desc) {
2115		os_memcpy(drv->adapter_desc, desc, dlen);
2116		drv->adapter_desc[dlen] = '\0';
2117	}
2118
2119	os_free(b);
2120
2121	if (drv->adapter_desc == NULL)
2122		return -1;
2123
2124	wpa_printf(MSG_DEBUG, "NDIS: Adapter description prefix '%s'",
2125		   drv->adapter_desc);
2126
2127	return 0;
2128#else /* CONFIG_USE_NDISUIO */
2129	PTSTR _names;
2130	char *names, *pos, *pos2;
2131	ULONG len;
2132	BOOLEAN res;
2133#define MAX_ADAPTERS 32
2134	char *name[MAX_ADAPTERS];
2135	char *desc[MAX_ADAPTERS];
2136	int num_name, num_desc, i, found_name, found_desc;
2137	size_t dlen;
2138
2139	wpa_printf(MSG_DEBUG, "NDIS: Packet.dll version: %s",
2140		   PacketGetVersion());
2141
2142	len = 8192;
2143	_names = os_zalloc(len);
2144	if (_names == NULL)
2145		return -1;
2146
2147	res = PacketGetAdapterNames(_names, &len);
2148	if (!res && len > 8192) {
2149		os_free(_names);
2150		_names = os_zalloc(len);
2151		if (_names == NULL)
2152			return -1;
2153		res = PacketGetAdapterNames(_names, &len);
2154	}
2155
2156	if (!res) {
2157		wpa_printf(MSG_ERROR, "NDIS: Failed to get adapter list "
2158			   "(PacketGetAdapterNames)");
2159		os_free(_names);
2160		return -1;
2161	}
2162
2163	names = (char *) _names;
2164	if (names[0] && names[1] == '\0' && names[2] && names[3] == '\0') {
2165		wpa_printf(MSG_DEBUG, "NDIS: Looks like adapter names are in "
2166			   "UNICODE");
2167		/* Convert to ASCII */
2168		pos2 = pos = names;
2169		while (pos2 < names + len) {
2170			if (pos2[0] == '\0' && pos2[1] == '\0' &&
2171			    pos2[2] == '\0' && pos2[3] == '\0') {
2172				pos2 += 4;
2173				break;
2174			}
2175			*pos++ = pos2[0];
2176			pos2 += 2;
2177		}
2178		os_memcpy(pos + 2, names, pos - names);
2179		pos += 2;
2180	} else
2181		pos = names;
2182
2183	num_name = 0;
2184	while (pos < names + len) {
2185		name[num_name] = pos;
2186		while (*pos && pos < names + len)
2187			pos++;
2188		if (pos + 1 >= names + len) {
2189			os_free(names);
2190			return -1;
2191		}
2192		pos++;
2193		num_name++;
2194		if (num_name >= MAX_ADAPTERS) {
2195			wpa_printf(MSG_DEBUG, "NDIS: Too many adapters");
2196			os_free(names);
2197			return -1;
2198		}
2199		if (*pos == '\0') {
2200			wpa_printf(MSG_DEBUG, "NDIS: %d adapter names found",
2201				   num_name);
2202			pos++;
2203			break;
2204		}
2205	}
2206
2207	num_desc = 0;
2208	while (pos < names + len) {
2209		desc[num_desc] = pos;
2210		while (*pos && pos < names + len)
2211			pos++;
2212		if (pos + 1 >= names + len) {
2213			os_free(names);
2214			return -1;
2215		}
2216		pos++;
2217		num_desc++;
2218		if (num_desc >= MAX_ADAPTERS) {
2219			wpa_printf(MSG_DEBUG, "NDIS: Too many adapter "
2220				   "descriptions");
2221			os_free(names);
2222			return -1;
2223		}
2224		if (*pos == '\0') {
2225			wpa_printf(MSG_DEBUG, "NDIS: %d adapter descriptions "
2226				   "found", num_name);
2227			pos++;
2228			break;
2229		}
2230	}
2231
2232	/*
2233	 * Windows 98 with Packet.dll 3.0 alpha3 does not include adapter
2234	 * descriptions. Fill in dummy descriptors to work around this.
2235	 */
2236	while (num_desc < num_name)
2237		desc[num_desc++] = "dummy description";
2238
2239	if (num_name != num_desc) {
2240		wpa_printf(MSG_DEBUG, "NDIS: mismatch in adapter name and "
2241			   "description counts (%d != %d)",
2242			   num_name, num_desc);
2243		os_free(names);
2244		return -1;
2245	}
2246
2247	found_name = found_desc = -1;
2248	for (i = 0; i < num_name; i++) {
2249		wpa_printf(MSG_DEBUG, "NDIS: %d - %s - %s",
2250			   i, name[i], desc[i]);
2251		if (found_name == -1 && os_strstr(name[i], drv->ifname))
2252			found_name = i;
2253		if (found_desc == -1 &&
2254		    os_strncmp(desc[i], drv->ifname, os_strlen(drv->ifname)) ==
2255		    0)
2256			found_desc = i;
2257	}
2258
2259	if (found_name < 0 && found_desc >= 0) {
2260		wpa_printf(MSG_DEBUG, "NDIS: Matched interface '%s' based on "
2261			   "description '%s'",
2262			   name[found_desc], desc[found_desc]);
2263		found_name = found_desc;
2264		os_strlcpy(drv->ifname,
2265			   os_strncmp(name[found_desc], "\\Device\\NPF_", 12)
2266			   == 0 ? name[found_desc] + 12 : name[found_desc],
2267			   sizeof(drv->ifname));
2268	}
2269
2270	if (found_name < 0) {
2271		wpa_printf(MSG_DEBUG, "NDIS: Could not find interface '%s'",
2272			   drv->ifname);
2273		os_free(names);
2274		return -1;
2275	}
2276
2277	i = found_name;
2278	pos = os_strrchr(desc[i], '(');
2279	if (pos) {
2280		dlen = pos - desc[i];
2281		pos--;
2282		if (pos > desc[i] && *pos == ' ')
2283			dlen--;
2284	} else {
2285		dlen = os_strlen(desc[i]);
2286	}
2287	drv->adapter_desc = os_malloc(dlen + 1);
2288	if (drv->adapter_desc) {
2289		os_memcpy(drv->adapter_desc, desc[i], dlen);
2290		drv->adapter_desc[dlen] = '\0';
2291	}
2292
2293	os_free(names);
2294
2295	if (drv->adapter_desc == NULL)
2296		return -1;
2297
2298	wpa_printf(MSG_DEBUG, "NDIS: Adapter description prefix '%s'",
2299		   drv->adapter_desc);
2300
2301	return 0;
2302#endif /* CONFIG_USE_NDISUIO */
2303}
2304
2305
2306#if defined(CONFIG_NATIVE_WINDOWS) || defined(__CYGWIN__)
2307#ifndef _WIN32_WCE
2308/*
2309 * These structures are undocumented for WinXP; only WinCE version is
2310 * documented. These would be included wzcsapi.h if it were available. Some
2311 * changes here have been needed to make the structures match with WinXP SP2.
2312 * It is unclear whether these work with any other version.
2313 */
2314
2315typedef struct {
2316	LPWSTR wszGuid;
2317} INTF_KEY_ENTRY, *PINTF_KEY_ENTRY;
2318
2319typedef struct {
2320	DWORD dwNumIntfs;
2321	PINTF_KEY_ENTRY pIntfs;
2322} INTFS_KEY_TABLE, *PINTFS_KEY_TABLE;
2323
2324typedef struct {
2325	DWORD dwDataLen;
2326	LPBYTE pData;
2327} RAW_DATA, *PRAW_DATA;
2328
2329typedef struct {
2330	LPWSTR wszGuid;
2331	LPWSTR wszDescr;
2332	ULONG ulMediaState;
2333	ULONG ulMediaType;
2334	ULONG ulPhysicalMediaType;
2335	INT nInfraMode;
2336	INT nAuthMode;
2337	INT nWepStatus;
2338#ifndef _WIN32_WCE
2339	u8 pad[2]; /* why is this needed? */
2340#endif /* _WIN32_WCE */
2341	DWORD dwCtlFlags;
2342	DWORD dwCapabilities; /* something added for WinXP SP2(?) */
2343	RAW_DATA rdSSID;
2344	RAW_DATA rdBSSID;
2345	RAW_DATA rdBSSIDList;
2346	RAW_DATA rdStSSIDList;
2347	RAW_DATA rdCtrlData;
2348#ifdef UNDER_CE
2349	BOOL bInitialized;
2350#endif
2351	DWORD nWPAMCastCipher;
2352	/* add some extra buffer for later additions since this interface is
2353	 * far from stable */
2354	u8 later_additions[100];
2355} INTF_ENTRY, *PINTF_ENTRY;
2356
2357#define INTF_ALL 0xffffffff
2358#define INTF_ALL_FLAGS 0x0000ffff
2359#define INTF_CTLFLAGS 0x00000010
2360#define INTFCTL_ENABLED 0x8000
2361#endif /* _WIN32_WCE */
2362
2363
2364#ifdef _WIN32_WCE
2365static int wpa_driver_ndis_rebind_adapter(struct wpa_driver_ndis_data *drv)
2366{
2367	HANDLE ndis;
2368	TCHAR multi[100];
2369	int len;
2370
2371	len = _tcslen(drv->adapter_name);
2372	if (len > 80)
2373		return -1;
2374
2375	ndis = CreateFile(DD_NDIS_DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
2376			  0, NULL, OPEN_EXISTING, 0, NULL);
2377	if (ndis == INVALID_HANDLE_VALUE) {
2378		wpa_printf(MSG_DEBUG, "NDIS: Failed to open file to NDIS "
2379			   "device: %d", (int) GetLastError());
2380		return -1;
2381	}
2382
2383	len++;
2384	memcpy(multi, drv->adapter_name, len * sizeof(TCHAR));
2385	memcpy(&multi[len], TEXT("NDISUIO\0"), 9 * sizeof(TCHAR));
2386	len += 9;
2387
2388	if (!DeviceIoControl(ndis, IOCTL_NDIS_REBIND_ADAPTER,
2389			     multi, len * sizeof(TCHAR), NULL, 0, NULL, NULL))
2390	{
2391		wpa_printf(MSG_DEBUG, "NDIS: IOCTL_NDIS_REBIND_ADAPTER "
2392			   "failed: 0x%x", (int) GetLastError());
2393		wpa_hexdump_ascii(MSG_DEBUG, "NDIS: rebind multi_sz",
2394				  (u8 *) multi, len * sizeof(TCHAR));
2395		CloseHandle(ndis);
2396		return -1;
2397	}
2398
2399	CloseHandle(ndis);
2400
2401	wpa_printf(MSG_DEBUG, "NDIS: Requested NDIS rebind of NDISUIO "
2402		   "protocol");
2403
2404	return 0;
2405}
2406#endif /* _WIN32_WCE */
2407
2408
2409static int wpa_driver_ndis_set_wzc(struct wpa_driver_ndis_data *drv,
2410				   int enable)
2411{
2412#ifdef _WIN32_WCE
2413	HKEY hk, hk2;
2414	LONG ret;
2415	DWORD i, hnd, len;
2416	TCHAR keyname[256], devname[256];
2417
2418#define WZC_DRIVER TEXT("Drivers\\BuiltIn\\ZeroConfig")
2419
2420	if (enable) {
2421		HANDLE h;
2422		h = ActivateDeviceEx(WZC_DRIVER, NULL, 0, NULL);
2423		if (h == INVALID_HANDLE_VALUE || h == 0) {
2424			wpa_printf(MSG_DEBUG, "NDIS: Failed to re-enable WZC "
2425				   "- ActivateDeviceEx failed: %d",
2426				   (int) GetLastError());
2427			return -1;
2428		}
2429
2430		wpa_printf(MSG_DEBUG, "NDIS: WZC re-enabled");
2431		return wpa_driver_ndis_rebind_adapter(drv);
2432	}
2433
2434	/*
2435	 * Unfortunately, just disabling the WZC for an interface is not enough
2436	 * to free NDISUIO for us, so need to disable and unload WZC completely
2437	 * for now when using WinCE with NDISUIO. In addition, must request
2438	 * NDISUIO protocol to be rebound to the adapter in order to free the
2439	 * NDISUIO binding that WZC hold before us.
2440	 */
2441
2442	/* Enumerate HKLM\Drivers\Active\* to find a handle to WZC. */
2443	ret = RegOpenKeyEx(HKEY_LOCAL_MACHINE, DEVLOAD_ACTIVE_KEY, 0, 0, &hk);
2444	if (ret != ERROR_SUCCESS) {
2445		wpa_printf(MSG_DEBUG, "NDIS: RegOpenKeyEx(DEVLOAD_ACTIVE_KEY) "
2446			   "failed: %d %d", (int) ret, (int) GetLastError());
2447		return -1;
2448	}
2449
2450	for (i = 0; ; i++) {
2451		len = sizeof(keyname);
2452		ret = RegEnumKeyEx(hk, i, keyname, &len, NULL, NULL, NULL,
2453				   NULL);
2454		if (ret != ERROR_SUCCESS) {
2455			wpa_printf(MSG_DEBUG, "NDIS: Could not find active "
2456				   "WZC - assuming it is not running.");
2457			RegCloseKey(hk);
2458			return -1;
2459		}
2460
2461		ret = RegOpenKeyEx(hk, keyname, 0, 0, &hk2);
2462		if (ret != ERROR_SUCCESS) {
2463			wpa_printf(MSG_DEBUG, "NDIS: RegOpenKeyEx(active dev) "
2464				   "failed: %d %d",
2465				   (int) ret, (int) GetLastError());
2466			continue;
2467		}
2468
2469		len = sizeof(devname);
2470		ret = RegQueryValueEx(hk2, DEVLOAD_DEVKEY_VALNAME, NULL, NULL,
2471				      (LPBYTE) devname, &len);
2472		if (ret != ERROR_SUCCESS) {
2473			wpa_printf(MSG_DEBUG, "NDIS: RegQueryValueEx("
2474				   "DEVKEY_VALNAME) failed: %d %d",
2475				   (int) ret, (int) GetLastError());
2476			RegCloseKey(hk2);
2477			continue;
2478		}
2479
2480		if (_tcscmp(devname, WZC_DRIVER) == 0)
2481			break;
2482
2483		RegCloseKey(hk2);
2484	}
2485
2486	RegCloseKey(hk);
2487
2488	/* Found WZC - get handle to it. */
2489	len = sizeof(hnd);
2490	ret = RegQueryValueEx(hk2, DEVLOAD_HANDLE_VALNAME, NULL, NULL,
2491			      (PUCHAR) &hnd, &len);
2492	if (ret != ERROR_SUCCESS) {
2493		wpa_printf(MSG_DEBUG, "NDIS: RegQueryValueEx(HANDLE_VALNAME) "
2494			   "failed: %d %d", (int) ret, (int) GetLastError());
2495		RegCloseKey(hk2);
2496		return -1;
2497	}
2498
2499	RegCloseKey(hk2);
2500
2501	/* Deactivate WZC */
2502	if (!DeactivateDevice((HANDLE) hnd)) {
2503		wpa_printf(MSG_DEBUG, "NDIS: DeactivateDevice failed: %d",
2504			   (int) GetLastError());
2505		return -1;
2506	}
2507
2508	wpa_printf(MSG_DEBUG, "NDIS: Disabled WZC temporarily");
2509	drv->wzc_disabled = 1;
2510	return wpa_driver_ndis_rebind_adapter(drv);
2511
2512#else /* _WIN32_WCE */
2513
2514	HMODULE hm;
2515	DWORD (WINAPI *wzc_enum_interf)(LPWSTR pSrvAddr,
2516					PINTFS_KEY_TABLE pIntfs);
2517	DWORD (WINAPI *wzc_query_interf)(LPWSTR pSrvAddr, DWORD dwInFlags,
2518					 PINTF_ENTRY pIntf,
2519					 LPDWORD pdwOutFlags);
2520	DWORD (WINAPI *wzc_set_interf)(LPWSTR pSrvAddr, DWORD dwInFlags,
2521				       PINTF_ENTRY pIntf, LPDWORD pdwOutFlags);
2522	int ret = -1, j;
2523	DWORD res;
2524	INTFS_KEY_TABLE guids;
2525	INTF_ENTRY intf;
2526	char guid[128];
2527	WCHAR *pos;
2528	DWORD flags, i;
2529
2530	hm = LoadLibrary(TEXT("wzcsapi.dll"));
2531	if (hm == NULL) {
2532		wpa_printf(MSG_DEBUG, "NDIS: Failed to load wzcsapi.dll (%u) "
2533			   "- WZC probably not running",
2534			   (unsigned int) GetLastError());
2535		return -1;
2536	}
2537
2538#ifdef _WIN32_WCE
2539	wzc_enum_interf = (void *) GetProcAddressA(hm, "WZCEnumInterfaces");
2540	wzc_query_interf = (void *) GetProcAddressA(hm, "WZCQueryInterface");
2541	wzc_set_interf = (void *) GetProcAddressA(hm, "WZCSetInterface");
2542#else /* _WIN32_WCE */
2543	wzc_enum_interf = (void *) GetProcAddress(hm, "WZCEnumInterfaces");
2544	wzc_query_interf = (void *) GetProcAddress(hm, "WZCQueryInterface");
2545	wzc_set_interf = (void *) GetProcAddress(hm, "WZCSetInterface");
2546#endif /* _WIN32_WCE */
2547
2548	if (wzc_enum_interf == NULL || wzc_query_interf == NULL ||
2549	    wzc_set_interf == NULL) {
2550		wpa_printf(MSG_DEBUG, "NDIS: WZCEnumInterfaces, "
2551			   "WZCQueryInterface, or WZCSetInterface not found "
2552			   "in wzcsapi.dll");
2553		goto fail;
2554	}
2555
2556	os_memset(&guids, 0, sizeof(guids));
2557	res = wzc_enum_interf(NULL, &guids);
2558	if (res != 0) {
2559		wpa_printf(MSG_DEBUG, "NDIS: WZCEnumInterfaces failed: %d; "
2560			   "WZC service is apparently not running",
2561			   (int) res);
2562		goto fail;
2563	}
2564
2565	wpa_printf(MSG_DEBUG, "NDIS: WZCEnumInterfaces: %d interfaces",
2566		   (int) guids.dwNumIntfs);
2567
2568	for (i = 0; i < guids.dwNumIntfs; i++) {
2569		pos = guids.pIntfs[i].wszGuid;
2570		for (j = 0; j < sizeof(guid); j++) {
2571			guid[j] = (char) *pos;
2572			if (*pos == 0)
2573				break;
2574			pos++;
2575		}
2576		guid[sizeof(guid) - 1] = '\0';
2577		wpa_printf(MSG_DEBUG, "NDIS: intfs %d GUID '%s'",
2578			   (int) i, guid);
2579		if (os_strstr(drv->ifname, guid) == NULL)
2580			continue;
2581
2582		wpa_printf(MSG_DEBUG, "NDIS: Current interface found from "
2583			   "WZC");
2584		break;
2585	}
2586
2587	if (i >= guids.dwNumIntfs) {
2588		wpa_printf(MSG_DEBUG, "NDIS: Current interface not found from "
2589			   "WZC");
2590		goto fail;
2591	}
2592
2593	os_memset(&intf, 0, sizeof(intf));
2594	intf.wszGuid = guids.pIntfs[i].wszGuid;
2595	/* Set flags to verify that the structure has not changed. */
2596	intf.dwCtlFlags = -1;
2597	flags = 0;
2598	res = wzc_query_interf(NULL, INTFCTL_ENABLED, &intf, &flags);
2599	if (res != 0) {
2600		wpa_printf(MSG_DEBUG, "NDIS: Could not query flags for the "
2601			   "WZC interface: %d (0x%x)",
2602			   (int) res, (int) res);
2603		wpa_printf(MSG_DEBUG, "NDIS: GetLastError: %u",
2604			   (unsigned int) GetLastError());
2605		goto fail;
2606	}
2607
2608	wpa_printf(MSG_DEBUG, "NDIS: WZC interface flags 0x%x dwCtlFlags 0x%x",
2609		   (int) flags, (int) intf.dwCtlFlags);
2610
2611	if (intf.dwCtlFlags == -1) {
2612		wpa_printf(MSG_DEBUG, "NDIS: Looks like wzcsapi has changed "
2613			   "again - could not disable WZC");
2614		wpa_hexdump(MSG_MSGDUMP, "NDIS: intf",
2615			    (u8 *) &intf, sizeof(intf));
2616		goto fail;
2617	}
2618
2619	if (enable) {
2620		if (!(intf.dwCtlFlags & INTFCTL_ENABLED)) {
2621			wpa_printf(MSG_DEBUG, "NDIS: Enabling WZC for this "
2622				   "interface");
2623			intf.dwCtlFlags |= INTFCTL_ENABLED;
2624			res = wzc_set_interf(NULL, INTFCTL_ENABLED, &intf,
2625					     &flags);
2626			if (res != 0) {
2627				wpa_printf(MSG_DEBUG, "NDIS: Failed to enable "
2628					   "WZC: %d (0x%x)",
2629					   (int) res, (int) res);
2630				wpa_printf(MSG_DEBUG, "NDIS: GetLastError: %u",
2631					   (unsigned int) GetLastError());
2632				goto fail;
2633			}
2634			wpa_printf(MSG_DEBUG, "NDIS: Re-enabled WZC for this "
2635				   "interface");
2636			drv->wzc_disabled = 0;
2637		}
2638	} else {
2639		if (intf.dwCtlFlags & INTFCTL_ENABLED) {
2640			wpa_printf(MSG_DEBUG, "NDIS: Disabling WZC for this "
2641				   "interface");
2642			intf.dwCtlFlags &= ~INTFCTL_ENABLED;
2643			res = wzc_set_interf(NULL, INTFCTL_ENABLED, &intf,
2644					     &flags);
2645			if (res != 0) {
2646				wpa_printf(MSG_DEBUG, "NDIS: Failed to "
2647					   "disable WZC: %d (0x%x)",
2648					   (int) res, (int) res);
2649				wpa_printf(MSG_DEBUG, "NDIS: GetLastError: %u",
2650					   (unsigned int) GetLastError());
2651				goto fail;
2652			}
2653			wpa_printf(MSG_DEBUG, "NDIS: Disabled WZC temporarily "
2654				   "for this interface");
2655			drv->wzc_disabled = 1;
2656		} else {
2657			wpa_printf(MSG_DEBUG, "NDIS: WZC was not enabled for "
2658				   "this interface");
2659		}
2660	}
2661
2662	ret = 0;
2663
2664fail:
2665	FreeLibrary(hm);
2666
2667	return ret;
2668#endif /* _WIN32_WCE */
2669}
2670
2671#else /* CONFIG_NATIVE_WINDOWS || __CYGWIN__ */
2672
2673static int wpa_driver_ndis_set_wzc(struct wpa_driver_ndis_data *drv,
2674				   int enable)
2675{
2676	return 0;
2677}
2678
2679#endif /* CONFIG_NATIVE_WINDOWS || __CYGWIN__ */
2680
2681
2682#ifdef CONFIG_USE_NDISUIO
2683/*
2684 * l2_packet_ndis.c is sharing the same handle to NDISUIO, so we must be able
2685 * to export this handle. This is somewhat ugly, but there is no better
2686 * mechanism available to pass data from driver interface to l2_packet wrapper.
2687 */
2688static HANDLE driver_ndis_ndisuio_handle = INVALID_HANDLE_VALUE;
2689
2690HANDLE driver_ndis_get_ndisuio_handle(void)
2691{
2692	return driver_ndis_ndisuio_handle;
2693}
2694#endif /* CONFIG_USE_NDISUIO */
2695
2696
2697static int wpa_driver_ndis_adapter_init(struct wpa_driver_ndis_data *drv)
2698{
2699#ifdef CONFIG_USE_NDISUIO
2700#ifndef _WIN32_WCE
2701#define NDISUIO_DEVICE_NAME TEXT("\\\\.\\\\Ndisuio")
2702	DWORD written;
2703#endif /* _WIN32_WCE */
2704	drv->ndisuio = CreateFile(NDISUIO_DEVICE_NAME,
2705				  GENERIC_READ | GENERIC_WRITE, 0, NULL,
2706				  OPEN_EXISTING,
2707				  FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
2708				  INVALID_HANDLE_VALUE);
2709	if (drv->ndisuio == INVALID_HANDLE_VALUE) {
2710		wpa_printf(MSG_ERROR, "NDIS: Failed to open connection to "
2711			   "NDISUIO: %d", (int) GetLastError());
2712		return -1;
2713	}
2714	driver_ndis_ndisuio_handle = drv->ndisuio;
2715
2716#ifndef _WIN32_WCE
2717	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_BIND_WAIT, NULL, 0,
2718			     NULL, 0, &written, NULL)) {
2719		wpa_printf(MSG_ERROR, "NDIS: IOCTL_NDISUIO_BIND_WAIT failed: "
2720			   "%d", (int) GetLastError());
2721		CloseHandle(drv->ndisuio);
2722		drv->ndisuio = INVALID_HANDLE_VALUE;
2723		return -1;
2724	}
2725#endif /* _WIN32_WCE */
2726
2727	return 0;
2728#else /* CONFIG_USE_NDISUIO */
2729	return 0;
2730#endif /* CONFIG_USE_NDISUIO */
2731}
2732
2733
2734static int wpa_driver_ndis_adapter_open(struct wpa_driver_ndis_data *drv)
2735{
2736#ifdef CONFIG_USE_NDISUIO
2737	DWORD written;
2738#define MAX_NDIS_DEVICE_NAME_LEN 256
2739	WCHAR ifname[MAX_NDIS_DEVICE_NAME_LEN];
2740	size_t len, i, pos;
2741	const char *prefix = "\\DEVICE\\";
2742
2743#ifdef _WIN32_WCE
2744	pos = 0;
2745#else /* _WIN32_WCE */
2746	pos = 8;
2747#endif /* _WIN32_WCE */
2748	len = pos + os_strlen(drv->ifname);
2749	if (len >= MAX_NDIS_DEVICE_NAME_LEN)
2750		return -1;
2751	for (i = 0; i < pos; i++)
2752		ifname[i] = (WCHAR) prefix[i];
2753	for (i = pos; i < len; i++)
2754		ifname[i] = (WCHAR) drv->ifname[i - pos];
2755	ifname[i] = L'\0';
2756
2757	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_OPEN_DEVICE,
2758			     ifname, len * sizeof(WCHAR), NULL, 0, &written,
2759			     NULL)) {
2760		wpa_printf(MSG_ERROR, "NDIS: IOCTL_NDISUIO_OPEN_DEVICE "
2761			   "failed: %d", (int) GetLastError());
2762		wpa_hexdump_ascii(MSG_DEBUG, "NDIS: ifname",
2763				  (const u8 *) ifname, len * sizeof(WCHAR));
2764		CloseHandle(drv->ndisuio);
2765		drv->ndisuio = INVALID_HANDLE_VALUE;
2766		return -1;
2767	}
2768
2769	wpa_printf(MSG_DEBUG, "NDIS: Opened NDISUIO device successfully");
2770
2771	return 0;
2772#else /* CONFIG_USE_NDISUIO */
2773	char ifname[128];
2774	os_snprintf(ifname, sizeof(ifname), "\\Device\\NPF_%s", drv->ifname);
2775	drv->adapter = PacketOpenAdapter(ifname);
2776	if (drv->adapter == NULL) {
2777		wpa_printf(MSG_DEBUG, "NDIS: PacketOpenAdapter failed for "
2778			   "'%s'", ifname);
2779		return -1;
2780	}
2781	return 0;
2782#endif /* CONFIG_USE_NDISUIO */
2783}
2784
2785
2786static void wpa_driver_ndis_adapter_close(struct wpa_driver_ndis_data *drv)
2787{
2788#ifdef CONFIG_USE_NDISUIO
2789	driver_ndis_ndisuio_handle = INVALID_HANDLE_VALUE;
2790	if (drv->ndisuio != INVALID_HANDLE_VALUE)
2791		CloseHandle(drv->ndisuio);
2792#else /* CONFIG_USE_NDISUIO */
2793	if (drv->adapter)
2794		PacketCloseAdapter(drv->adapter);
2795#endif /* CONFIG_USE_NDISUIO */
2796}
2797
2798
2799static int ndis_add_multicast(struct wpa_driver_ndis_data *drv)
2800{
2801	if (ndis_set_oid(drv, OID_802_3_MULTICAST_LIST,
2802			 (const char *) pae_group_addr, ETH_ALEN) < 0) {
2803		wpa_printf(MSG_DEBUG, "NDIS: Failed to add PAE group address "
2804			   "to the multicast list");
2805		return -1;
2806	}
2807
2808	return 0;
2809}
2810
2811
2812static void * wpa_driver_ndis_init(void *ctx, const char *ifname)
2813{
2814	struct wpa_driver_ndis_data *drv;
2815	u32 mode;
2816
2817	drv = os_zalloc(sizeof(*drv));
2818	if (drv == NULL)
2819		return NULL;
2820	drv->ctx = ctx;
2821	/*
2822	 * Compatibility code to strip possible prefix from the GUID. Previous
2823	 * versions include \Device\NPF_ prefix for all names, but the internal
2824	 * interface name is now only the GUI. Both Packet32 and NDISUIO
2825	 * prefixes are supported.
2826	 */
2827	if (os_strncmp(ifname, "\\Device\\NPF_", 12) == 0)
2828		ifname += 12;
2829	else if (os_strncmp(ifname, "\\DEVICE\\", 8) == 0)
2830		ifname += 8;
2831	os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
2832
2833	if (wpa_driver_ndis_adapter_init(drv) < 0) {
2834		os_free(drv);
2835		return NULL;
2836	}
2837
2838	if (wpa_driver_ndis_get_names(drv) < 0) {
2839		wpa_driver_ndis_adapter_close(drv);
2840		os_free(drv);
2841		return NULL;
2842	}
2843
2844	wpa_driver_ndis_set_wzc(drv, 0);
2845
2846	if (wpa_driver_ndis_adapter_open(drv) < 0) {
2847		wpa_driver_ndis_adapter_close(drv);
2848		os_free(drv);
2849		return NULL;
2850	}
2851
2852	if (ndis_get_oid(drv, OID_802_3_CURRENT_ADDRESS,
2853			 (char *) drv->own_addr, ETH_ALEN) < 0) {
2854		wpa_printf(MSG_DEBUG, "NDIS: Get OID_802_3_CURRENT_ADDRESS "
2855			   "failed");
2856		wpa_driver_ndis_adapter_close(drv);
2857		os_free(drv);
2858		return NULL;
2859	}
2860	wpa_driver_ndis_get_capability(drv);
2861
2862	/* Make sure that the driver does not have any obsolete PMKID entries.
2863	 */
2864	wpa_driver_ndis_flush_pmkid(drv);
2865
2866	/*
2867	 * Disconnect to make sure that driver re-associates if it was
2868	 * connected.
2869	 */
2870	wpa_driver_ndis_disconnect(drv);
2871
2872	eloop_register_timeout(1, 0, wpa_driver_ndis_poll_timeout, drv, NULL);
2873
2874#ifdef CONFIG_NDIS_EVENTS_INTEGRATED
2875	drv->events = ndis_events_init(&drv->events_pipe, &drv->event_avail,
2876				       drv->ifname, drv->adapter_desc);
2877	if (drv->events == NULL) {
2878		wpa_driver_ndis_deinit(drv);
2879		return NULL;
2880	}
2881	eloop_register_event(drv->event_avail, sizeof(drv->event_avail),
2882			     wpa_driver_ndis_event_pipe_cb, drv, NULL);
2883#endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
2884
2885#ifdef _WIN32_WCE
2886	if (ndisuio_notification_init(drv) < 0) {
2887		wpa_driver_ndis_deinit(drv);
2888		return NULL;
2889	}
2890#endif /* _WIN32_WCE */
2891
2892	/* Set mode here in case card was configured for ad-hoc mode
2893	 * previously. */
2894	mode = Ndis802_11Infrastructure;
2895	if (ndis_set_oid(drv, OID_802_11_INFRASTRUCTURE_MODE,
2896			 (char *) &mode, sizeof(mode)) < 0) {
2897		char buf[8];
2898		int res;
2899		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
2900			   "OID_802_11_INFRASTRUCTURE_MODE (%d)",
2901			   (int) mode);
2902		/* Try to continue anyway */
2903
2904		res = ndis_get_oid(drv, OID_DOT11_CURRENT_OPERATION_MODE, buf,
2905				   sizeof(buf));
2906		if (res > 0) {
2907			wpa_printf(MSG_INFO, "NDIS: The driver seems to use "
2908				   "Native 802.11 OIDs. These are not yet "
2909				   "fully supported.");
2910			drv->native80211 = 1;
2911		} else if (!drv->has_capability || drv->capa.enc == 0) {
2912			/*
2913			 * Note: This will also happen with NDIS 6 drivers with
2914			 * Vista.
2915			 */
2916			wpa_printf(MSG_DEBUG, "NDIS: Driver did not provide "
2917				   "any wireless capabilities - assume it is "
2918				   "a wired interface");
2919			drv->wired = 1;
2920			drv->capa.flags |= WPA_DRIVER_FLAGS_WIRED;
2921			drv->has_capability = 1;
2922			ndis_add_multicast(drv);
2923		}
2924	}
2925
2926	return drv;
2927}
2928
2929
2930static void wpa_driver_ndis_deinit(void *priv)
2931{
2932	struct wpa_driver_ndis_data *drv = priv;
2933
2934#ifdef CONFIG_NDIS_EVENTS_INTEGRATED
2935	if (drv->events) {
2936		eloop_unregister_event(drv->event_avail,
2937				       sizeof(drv->event_avail));
2938		ndis_events_deinit(drv->events);
2939	}
2940#endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
2941
2942#ifdef _WIN32_WCE
2943	ndisuio_notification_deinit(drv);
2944#endif /* _WIN32_WCE */
2945
2946	eloop_cancel_timeout(wpa_driver_ndis_scan_timeout, drv, drv->ctx);
2947	eloop_cancel_timeout(wpa_driver_ndis_poll_timeout, drv, NULL);
2948	wpa_driver_ndis_flush_pmkid(drv);
2949	wpa_driver_ndis_disconnect(drv);
2950	if (wpa_driver_ndis_radio_off(drv) < 0) {
2951		wpa_printf(MSG_DEBUG, "NDIS: failed to disassociate and turn "
2952			   "radio off");
2953	}
2954
2955	wpa_driver_ndis_adapter_close(drv);
2956
2957	if (drv->wzc_disabled)
2958		wpa_driver_ndis_set_wzc(drv, 1);
2959
2960#ifdef _WIN32_WCE
2961	os_free(drv->adapter_name);
2962#endif /* _WIN32_WCE */
2963	os_free(drv->adapter_desc);
2964	os_free(drv);
2965}
2966
2967
2968static struct wpa_interface_info *
2969wpa_driver_ndis_get_interfaces(void *global_priv)
2970{
2971	struct wpa_interface_info *iface = NULL, *niface;
2972
2973#ifdef CONFIG_USE_NDISUIO
2974	NDISUIO_QUERY_BINDING *b;
2975	size_t blen = sizeof(*b) + 1024;
2976	int i, error;
2977	DWORD written;
2978	char name[256], desc[256];
2979	WCHAR *pos;
2980	size_t j, len;
2981	HANDLE ndisuio;
2982
2983	ndisuio = CreateFile(NDISUIO_DEVICE_NAME,
2984			     GENERIC_READ | GENERIC_WRITE, 0, NULL,
2985			     OPEN_EXISTING,
2986			     FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
2987			     INVALID_HANDLE_VALUE);
2988	if (ndisuio == INVALID_HANDLE_VALUE) {
2989		wpa_printf(MSG_ERROR, "NDIS: Failed to open connection to "
2990			   "NDISUIO: %d", (int) GetLastError());
2991		return NULL;
2992	}
2993
2994#ifndef _WIN32_WCE
2995	if (!DeviceIoControl(ndisuio, IOCTL_NDISUIO_BIND_WAIT, NULL, 0,
2996			     NULL, 0, &written, NULL)) {
2997		wpa_printf(MSG_ERROR, "NDIS: IOCTL_NDISUIO_BIND_WAIT failed: "
2998			   "%d", (int) GetLastError());
2999		CloseHandle(ndisuio);
3000		return NULL;
3001	}
3002#endif /* _WIN32_WCE */
3003
3004	b = os_malloc(blen);
3005	if (b == NULL) {
3006		CloseHandle(ndisuio);
3007		return NULL;
3008	}
3009
3010	for (i = 0; ; i++) {
3011		os_memset(b, 0, blen);
3012		b->BindingIndex = i;
3013		if (!DeviceIoControl(ndisuio, IOCTL_NDISUIO_QUERY_BINDING,
3014				     b, sizeof(NDISUIO_QUERY_BINDING), b, blen,
3015				     &written, NULL)) {
3016			error = (int) GetLastError();
3017			if (error == ERROR_NO_MORE_ITEMS)
3018				break;
3019			wpa_printf(MSG_DEBUG, "IOCTL_NDISUIO_QUERY_BINDING "
3020				   "failed: %d", error);
3021			break;
3022		}
3023
3024		pos = (WCHAR *) ((char *) b + b->DeviceNameOffset);
3025		len = b->DeviceNameLength;
3026		if (len >= sizeof(name))
3027			len = sizeof(name) - 1;
3028		for (j = 0; j < len; j++)
3029			name[j] = (char) pos[j];
3030		name[len] = '\0';
3031
3032		pos = (WCHAR *) ((char *) b + b->DeviceDescrOffset);
3033		len = b->DeviceDescrLength;
3034		if (len >= sizeof(desc))
3035			len = sizeof(desc) - 1;
3036		for (j = 0; j < len; j++)
3037			desc[j] = (char) pos[j];
3038		desc[len] = '\0';
3039
3040		wpa_printf(MSG_DEBUG, "NDIS: %d - %s - %s", i, name, desc);
3041
3042		niface = os_zalloc(sizeof(*niface));
3043		if (niface == NULL)
3044			break;
3045		niface->drv_name = "ndis";
3046		if (os_strncmp(name, "\\DEVICE\\", 8) == 0)
3047			niface->ifname = os_strdup(name + 8);
3048		else
3049			niface->ifname = os_strdup(name);
3050		if (niface->ifname == NULL) {
3051			os_free(niface);
3052			break;
3053		}
3054		niface->desc = os_strdup(desc);
3055		niface->next = iface;
3056		iface = niface;
3057	}
3058
3059	os_free(b);
3060	CloseHandle(ndisuio);
3061#else /* CONFIG_USE_NDISUIO */
3062	PTSTR _names;
3063	char *names, *pos, *pos2;
3064	ULONG len;
3065	BOOLEAN res;
3066	char *name[MAX_ADAPTERS];
3067	char *desc[MAX_ADAPTERS];
3068	int num_name, num_desc, i;
3069
3070	wpa_printf(MSG_DEBUG, "NDIS: Packet.dll version: %s",
3071		   PacketGetVersion());
3072
3073	len = 8192;
3074	_names = os_zalloc(len);
3075	if (_names == NULL)
3076		return NULL;
3077
3078	res = PacketGetAdapterNames(_names, &len);
3079	if (!res && len > 8192) {
3080		os_free(_names);
3081		_names = os_zalloc(len);
3082		if (_names == NULL)
3083			return NULL;
3084		res = PacketGetAdapterNames(_names, &len);
3085	}
3086
3087	if (!res) {
3088		wpa_printf(MSG_ERROR, "NDIS: Failed to get adapter list "
3089			   "(PacketGetAdapterNames)");
3090		os_free(_names);
3091		return NULL;
3092	}
3093
3094	names = (char *) _names;
3095	if (names[0] && names[1] == '\0' && names[2] && names[3] == '\0') {
3096		wpa_printf(MSG_DEBUG, "NDIS: Looks like adapter names are in "
3097			   "UNICODE");
3098		/* Convert to ASCII */
3099		pos2 = pos = names;
3100		while (pos2 < names + len) {
3101			if (pos2[0] == '\0' && pos2[1] == '\0' &&
3102			    pos2[2] == '\0' && pos2[3] == '\0') {
3103				pos2 += 4;
3104				break;
3105			}
3106			*pos++ = pos2[0];
3107			pos2 += 2;
3108		}
3109		os_memcpy(pos + 2, names, pos - names);
3110		pos += 2;
3111	} else
3112		pos = names;
3113
3114	num_name = 0;
3115	while (pos < names + len) {
3116		name[num_name] = pos;
3117		while (*pos && pos < names + len)
3118			pos++;
3119		if (pos + 1 >= names + len) {
3120			os_free(names);
3121			return NULL;
3122		}
3123		pos++;
3124		num_name++;
3125		if (num_name >= MAX_ADAPTERS) {
3126			wpa_printf(MSG_DEBUG, "NDIS: Too many adapters");
3127			os_free(names);
3128			return NULL;
3129		}
3130		if (*pos == '\0') {
3131			wpa_printf(MSG_DEBUG, "NDIS: %d adapter names found",
3132				   num_name);
3133			pos++;
3134			break;
3135		}
3136	}
3137
3138	num_desc = 0;
3139	while (pos < names + len) {
3140		desc[num_desc] = pos;
3141		while (*pos && pos < names + len)
3142			pos++;
3143		if (pos + 1 >= names + len) {
3144			os_free(names);
3145			return NULL;
3146		}
3147		pos++;
3148		num_desc++;
3149		if (num_desc >= MAX_ADAPTERS) {
3150			wpa_printf(MSG_DEBUG, "NDIS: Too many adapter "
3151				   "descriptions");
3152			os_free(names);
3153			return NULL;
3154		}
3155		if (*pos == '\0') {
3156			wpa_printf(MSG_DEBUG, "NDIS: %d adapter descriptions "
3157				   "found", num_name);
3158			pos++;
3159			break;
3160		}
3161	}
3162
3163	/*
3164	 * Windows 98 with Packet.dll 3.0 alpha3 does not include adapter
3165	 * descriptions. Fill in dummy descriptors to work around this.
3166	 */
3167	while (num_desc < num_name)
3168		desc[num_desc++] = "dummy description";
3169
3170	if (num_name != num_desc) {
3171		wpa_printf(MSG_DEBUG, "NDIS: mismatch in adapter name and "
3172			   "description counts (%d != %d)",
3173			   num_name, num_desc);
3174		os_free(names);
3175		return NULL;
3176	}
3177
3178	for (i = 0; i < num_name; i++) {
3179		niface = os_zalloc(sizeof(*niface));
3180		if (niface == NULL)
3181			break;
3182		niface->drv_name = "ndis";
3183		if (os_strncmp(name[i], "\\Device\\NPF_", 12) == 0)
3184			niface->ifname = os_strdup(name[i] + 12);
3185		else
3186			niface->ifname = os_strdup(name[i]);
3187		if (niface->ifname == NULL) {
3188			os_free(niface);
3189			break;
3190		}
3191		niface->desc = os_strdup(desc[i]);
3192		niface->next = iface;
3193		iface = niface;
3194	}
3195
3196#endif /* CONFIG_USE_NDISUIO */
3197
3198	return iface;
3199}
3200
3201
3202static const char *ndis_drv_name = "ndis";
3203static const char *ndis_drv_desc = "Windows NDIS driver";
3204
3205struct wpa_driver_ops wpa_driver_ndis_ops;
3206
3207void driver_ndis_init_ops(void)
3208{
3209	os_memset(&wpa_driver_ndis_ops, 0, sizeof(wpa_driver_ndis_ops));
3210	wpa_driver_ndis_ops.name = ndis_drv_name;
3211	wpa_driver_ndis_ops.desc = ndis_drv_desc;
3212	wpa_driver_ndis_ops.get_bssid = wpa_driver_ndis_get_bssid;
3213	wpa_driver_ndis_ops.get_ssid = wpa_driver_ndis_get_ssid;
3214	wpa_driver_ndis_ops.set_key = wpa_driver_ndis_set_key;
3215	wpa_driver_ndis_ops.init = wpa_driver_ndis_init;
3216	wpa_driver_ndis_ops.deinit = wpa_driver_ndis_deinit;
3217	wpa_driver_ndis_ops.deauthenticate = wpa_driver_ndis_deauthenticate;
3218	wpa_driver_ndis_ops.associate = wpa_driver_ndis_associate;
3219	wpa_driver_ndis_ops.add_pmkid = wpa_driver_ndis_add_pmkid;
3220	wpa_driver_ndis_ops.remove_pmkid = wpa_driver_ndis_remove_pmkid;
3221	wpa_driver_ndis_ops.flush_pmkid = wpa_driver_ndis_flush_pmkid;
3222	wpa_driver_ndis_ops.get_capa = wpa_driver_ndis_get_capa;
3223	wpa_driver_ndis_ops.poll = wpa_driver_ndis_poll;
3224	wpa_driver_ndis_ops.get_ifname = wpa_driver_ndis_get_ifname;
3225	wpa_driver_ndis_ops.get_mac_addr = wpa_driver_ndis_get_mac_addr;
3226	wpa_driver_ndis_ops.get_scan_results2 =
3227		wpa_driver_ndis_get_scan_results;
3228	wpa_driver_ndis_ops.get_interfaces = wpa_driver_ndis_get_interfaces;
3229	wpa_driver_ndis_ops.scan2 = wpa_driver_ndis_scan;
3230}
3231