1/*
2 * WPA Supplicant - Windows/NDIS driver interface
3 * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9#ifdef __CYGWIN__
10/* Avoid some header file conflicts by not including standard headers for
11 * cygwin builds when Packet32.h is included. */
12#include "build_config.h"
13int close(int fd);
14#else /* __CYGWIN__ */
15#include "includes.h"
16#endif /* __CYGWIN__ */
17#ifdef CONFIG_USE_NDISUIO
18#include <winsock2.h>
19#else /* CONFIG_USE_NDISUIO */
20#include <Packet32.h>
21#endif /* CONFIG_USE_NDISUIO */
22#ifdef __MINGW32_VERSION
23#include <ddk/ntddndis.h>
24#else /* __MINGW32_VERSION */
25#include <ntddndis.h>
26#endif /* __MINGW32_VERSION */
27
28#ifdef _WIN32_WCE
29#include <winioctl.h>
30#include <nuiouser.h>
31#include <devload.h>
32#endif /* _WIN32_WCE */
33
34#include "common.h"
35#include "driver.h"
36#include "eloop.h"
37#include "common/ieee802_11_defs.h"
38#include "driver_ndis.h"
39
40int wpa_driver_register_event_cb(struct wpa_driver_ndis_data *drv);
41#ifdef CONFIG_NDIS_EVENTS_INTEGRATED
42void wpa_driver_ndis_event_pipe_cb(void *eloop_data, void *user_data);
43#endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
44
45static void wpa_driver_ndis_deinit(void *priv);
46static void wpa_driver_ndis_poll(void *drv);
47static void wpa_driver_ndis_poll_timeout(void *eloop_ctx, void *timeout_ctx);
48static int wpa_driver_ndis_adapter_init(struct wpa_driver_ndis_data *drv);
49static int wpa_driver_ndis_adapter_open(struct wpa_driver_ndis_data *drv);
50static void wpa_driver_ndis_adapter_close(struct wpa_driver_ndis_data *drv);
51
52
53static const u8 pae_group_addr[ETH_ALEN] =
54{ 0x01, 0x80, 0xc2, 0x00, 0x00, 0x03 };
55
56
57/* FIX: to be removed once this can be compiled with the complete NDIS
58 * header files */
59#ifndef OID_802_11_BSSID
60#define OID_802_11_BSSID 			0x0d010101
61#define OID_802_11_SSID 			0x0d010102
62#define OID_802_11_INFRASTRUCTURE_MODE		0x0d010108
63#define OID_802_11_ADD_WEP			0x0D010113
64#define OID_802_11_REMOVE_WEP			0x0D010114
65#define OID_802_11_DISASSOCIATE			0x0D010115
66#define OID_802_11_BSSID_LIST 			0x0d010217
67#define OID_802_11_AUTHENTICATION_MODE		0x0d010118
68#define OID_802_11_PRIVACY_FILTER		0x0d010119
69#define OID_802_11_BSSID_LIST_SCAN 		0x0d01011A
70#define OID_802_11_WEP_STATUS	 		0x0d01011B
71#define OID_802_11_ENCRYPTION_STATUS OID_802_11_WEP_STATUS
72#define OID_802_11_ADD_KEY 			0x0d01011D
73#define OID_802_11_REMOVE_KEY 			0x0d01011E
74#define OID_802_11_ASSOCIATION_INFORMATION	0x0d01011F
75#define OID_802_11_TEST 			0x0d010120
76#define OID_802_11_CAPABILITY 			0x0d010122
77#define OID_802_11_PMKID 			0x0d010123
78
79#define NDIS_802_11_LENGTH_SSID 32
80#define NDIS_802_11_LENGTH_RATES 8
81#define NDIS_802_11_LENGTH_RATES_EX 16
82
83typedef UCHAR NDIS_802_11_MAC_ADDRESS[6];
84
85typedef struct NDIS_802_11_SSID {
86	ULONG SsidLength;
87	UCHAR Ssid[NDIS_802_11_LENGTH_SSID];
88} NDIS_802_11_SSID;
89
90typedef LONG NDIS_802_11_RSSI;
91
92typedef enum NDIS_802_11_NETWORK_TYPE {
93	Ndis802_11FH,
94	Ndis802_11DS,
95	Ndis802_11OFDM5,
96	Ndis802_11OFDM24,
97	Ndis802_11NetworkTypeMax
98} NDIS_802_11_NETWORK_TYPE;
99
100typedef struct NDIS_802_11_CONFIGURATION_FH {
101	ULONG Length;
102	ULONG HopPattern;
103	ULONG HopSet;
104	ULONG DwellTime;
105} NDIS_802_11_CONFIGURATION_FH;
106
107typedef struct NDIS_802_11_CONFIGURATION {
108	ULONG Length;
109	ULONG BeaconPeriod;
110	ULONG ATIMWindow;
111	ULONG DSConfig;
112	NDIS_802_11_CONFIGURATION_FH FHConfig;
113} NDIS_802_11_CONFIGURATION;
114
115typedef enum NDIS_802_11_NETWORK_INFRASTRUCTURE {
116	Ndis802_11IBSS,
117	Ndis802_11Infrastructure,
118	Ndis802_11AutoUnknown,
119	Ndis802_11InfrastructureMax
120} NDIS_802_11_NETWORK_INFRASTRUCTURE;
121
122typedef enum NDIS_802_11_AUTHENTICATION_MODE {
123	Ndis802_11AuthModeOpen,
124	Ndis802_11AuthModeShared,
125	Ndis802_11AuthModeAutoSwitch,
126	Ndis802_11AuthModeWPA,
127	Ndis802_11AuthModeWPAPSK,
128	Ndis802_11AuthModeWPANone,
129	Ndis802_11AuthModeWPA2,
130	Ndis802_11AuthModeWPA2PSK,
131	Ndis802_11AuthModeMax
132} NDIS_802_11_AUTHENTICATION_MODE;
133
134typedef enum NDIS_802_11_WEP_STATUS {
135	Ndis802_11WEPEnabled,
136	Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
137	Ndis802_11WEPDisabled,
138	Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
139	Ndis802_11WEPKeyAbsent,
140	Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
141	Ndis802_11WEPNotSupported,
142	Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
143	Ndis802_11Encryption2Enabled,
144	Ndis802_11Encryption2KeyAbsent,
145	Ndis802_11Encryption3Enabled,
146	Ndis802_11Encryption3KeyAbsent
147} NDIS_802_11_WEP_STATUS, NDIS_802_11_ENCRYPTION_STATUS;
148
149typedef enum NDIS_802_11_PRIVACY_FILTER {
150	Ndis802_11PrivFilterAcceptAll,
151	Ndis802_11PrivFilter8021xWEP
152} NDIS_802_11_PRIVACY_FILTER;
153
154typedef UCHAR NDIS_802_11_RATES[NDIS_802_11_LENGTH_RATES];
155typedef UCHAR NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];
156
157typedef struct NDIS_WLAN_BSSID_EX {
158	ULONG Length;
159	NDIS_802_11_MAC_ADDRESS MacAddress; /* BSSID */
160	UCHAR Reserved[2];
161	NDIS_802_11_SSID Ssid;
162	ULONG Privacy;
163	NDIS_802_11_RSSI Rssi;
164	NDIS_802_11_NETWORK_TYPE NetworkTypeInUse;
165	NDIS_802_11_CONFIGURATION Configuration;
166	NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode;
167	NDIS_802_11_RATES_EX SupportedRates;
168	ULONG IELength;
169	UCHAR IEs[1];
170} NDIS_WLAN_BSSID_EX;
171
172typedef struct NDIS_802_11_BSSID_LIST_EX {
173	ULONG NumberOfItems;
174	NDIS_WLAN_BSSID_EX Bssid[1];
175} NDIS_802_11_BSSID_LIST_EX;
176
177typedef struct NDIS_802_11_FIXED_IEs {
178	UCHAR Timestamp[8];
179	USHORT BeaconInterval;
180	USHORT Capabilities;
181} NDIS_802_11_FIXED_IEs;
182
183typedef struct NDIS_802_11_WEP {
184	ULONG Length;
185	ULONG KeyIndex;
186	ULONG KeyLength;
187	UCHAR KeyMaterial[1];
188} NDIS_802_11_WEP;
189
190typedef ULONG NDIS_802_11_KEY_INDEX;
191typedef ULONGLONG NDIS_802_11_KEY_RSC;
192
193typedef struct NDIS_802_11_KEY {
194	ULONG Length;
195	ULONG KeyIndex;
196	ULONG KeyLength;
197	NDIS_802_11_MAC_ADDRESS BSSID;
198	NDIS_802_11_KEY_RSC KeyRSC;
199	UCHAR KeyMaterial[1];
200} NDIS_802_11_KEY;
201
202typedef struct NDIS_802_11_REMOVE_KEY {
203	ULONG Length;
204	ULONG KeyIndex;
205	NDIS_802_11_MAC_ADDRESS BSSID;
206} NDIS_802_11_REMOVE_KEY;
207
208typedef struct NDIS_802_11_AI_REQFI {
209	USHORT Capabilities;
210	USHORT ListenInterval;
211	NDIS_802_11_MAC_ADDRESS CurrentAPAddress;
212} NDIS_802_11_AI_REQFI;
213
214typedef struct NDIS_802_11_AI_RESFI {
215	USHORT Capabilities;
216	USHORT StatusCode;
217	USHORT AssociationId;
218} NDIS_802_11_AI_RESFI;
219
220typedef struct NDIS_802_11_ASSOCIATION_INFORMATION {
221	ULONG Length;
222	USHORT AvailableRequestFixedIEs;
223	NDIS_802_11_AI_REQFI RequestFixedIEs;
224	ULONG RequestIELength;
225	ULONG OffsetRequestIEs;
226	USHORT AvailableResponseFixedIEs;
227	NDIS_802_11_AI_RESFI ResponseFixedIEs;
228	ULONG ResponseIELength;
229	ULONG OffsetResponseIEs;
230} NDIS_802_11_ASSOCIATION_INFORMATION;
231
232typedef struct NDIS_802_11_AUTHENTICATION_ENCRYPTION {
233	NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
234	NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
235} NDIS_802_11_AUTHENTICATION_ENCRYPTION;
236
237typedef struct NDIS_802_11_CAPABILITY {
238	ULONG Length;
239	ULONG Version;
240	ULONG NoOfPMKIDs;
241	ULONG NoOfAuthEncryptPairsSupported;
242	NDIS_802_11_AUTHENTICATION_ENCRYPTION
243		AuthenticationEncryptionSupported[1];
244} NDIS_802_11_CAPABILITY;
245
246typedef UCHAR NDIS_802_11_PMKID_VALUE[16];
247
248typedef struct BSSID_INFO {
249	NDIS_802_11_MAC_ADDRESS BSSID;
250	NDIS_802_11_PMKID_VALUE PMKID;
251} BSSID_INFO;
252
253typedef struct NDIS_802_11_PMKID {
254	ULONG Length;
255	ULONG BSSIDInfoCount;
256	BSSID_INFO BSSIDInfo[1];
257} NDIS_802_11_PMKID;
258
259typedef enum NDIS_802_11_STATUS_TYPE {
260	Ndis802_11StatusType_Authentication,
261	Ndis802_11StatusType_PMKID_CandidateList = 2,
262	Ndis802_11StatusTypeMax
263} NDIS_802_11_STATUS_TYPE;
264
265typedef struct NDIS_802_11_STATUS_INDICATION {
266	NDIS_802_11_STATUS_TYPE StatusType;
267} NDIS_802_11_STATUS_INDICATION;
268
269typedef struct PMKID_CANDIDATE {
270	NDIS_802_11_MAC_ADDRESS BSSID;
271	ULONG Flags;
272} PMKID_CANDIDATE;
273
274#define NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED 0x01
275
276typedef struct NDIS_802_11_PMKID_CANDIDATE_LIST {
277	ULONG Version;
278	ULONG NumCandidates;
279	PMKID_CANDIDATE CandidateList[1];
280} NDIS_802_11_PMKID_CANDIDATE_LIST;
281
282typedef struct NDIS_802_11_AUTHENTICATION_REQUEST {
283	ULONG Length;
284	NDIS_802_11_MAC_ADDRESS Bssid;
285	ULONG Flags;
286} NDIS_802_11_AUTHENTICATION_REQUEST;
287
288#define NDIS_802_11_AUTH_REQUEST_REAUTH			0x01
289#define NDIS_802_11_AUTH_REQUEST_KEYUPDATE		0x02
290#define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR		0x06
291#define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR		0x0E
292
293#endif /* OID_802_11_BSSID */
294
295
296#ifndef OID_802_11_PMKID
297/* Platform SDK for XP did not include WPA2, so add needed definitions */
298
299#define OID_802_11_CAPABILITY 			0x0d010122
300#define OID_802_11_PMKID 			0x0d010123
301
302#define Ndis802_11AuthModeWPA2 6
303#define Ndis802_11AuthModeWPA2PSK 7
304
305#define Ndis802_11StatusType_PMKID_CandidateList 2
306
307typedef struct NDIS_802_11_AUTHENTICATION_ENCRYPTION {
308	NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
309	NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
310} NDIS_802_11_AUTHENTICATION_ENCRYPTION;
311
312typedef struct NDIS_802_11_CAPABILITY {
313	ULONG Length;
314	ULONG Version;
315	ULONG NoOfPMKIDs;
316	ULONG NoOfAuthEncryptPairsSupported;
317	NDIS_802_11_AUTHENTICATION_ENCRYPTION
318		AuthenticationEncryptionSupported[1];
319} NDIS_802_11_CAPABILITY;
320
321typedef UCHAR NDIS_802_11_PMKID_VALUE[16];
322
323typedef struct BSSID_INFO {
324	NDIS_802_11_MAC_ADDRESS BSSID;
325	NDIS_802_11_PMKID_VALUE PMKID;
326} BSSID_INFO;
327
328typedef struct NDIS_802_11_PMKID {
329	ULONG Length;
330	ULONG BSSIDInfoCount;
331	BSSID_INFO BSSIDInfo[1];
332} NDIS_802_11_PMKID;
333
334typedef struct PMKID_CANDIDATE {
335	NDIS_802_11_MAC_ADDRESS BSSID;
336	ULONG Flags;
337} PMKID_CANDIDATE;
338
339#define NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED 0x01
340
341typedef struct NDIS_802_11_PMKID_CANDIDATE_LIST {
342	ULONG Version;
343	ULONG NumCandidates;
344	PMKID_CANDIDATE CandidateList[1];
345} NDIS_802_11_PMKID_CANDIDATE_LIST;
346
347#endif /* OID_802_11_CAPABILITY */
348
349
350#ifndef OID_DOT11_CURRENT_OPERATION_MODE
351/* Native 802.11 OIDs */
352#define OID_DOT11_NDIS_START 0x0D010300
353#define OID_DOT11_CURRENT_OPERATION_MODE (OID_DOT11_NDIS_START + 8)
354#define OID_DOT11_SCAN_REQUEST (OID_DOT11_NDIS_START + 11)
355
356typedef enum _DOT11_BSS_TYPE {
357	dot11_BSS_type_infrastructure = 1,
358	dot11_BSS_type_independent = 2,
359	dot11_BSS_type_any = 3
360} DOT11_BSS_TYPE, * PDOT11_BSS_TYPE;
361
362typedef UCHAR DOT11_MAC_ADDRESS[6];
363typedef DOT11_MAC_ADDRESS * PDOT11_MAC_ADDRESS;
364
365typedef enum _DOT11_SCAN_TYPE {
366	dot11_scan_type_active = 1,
367	dot11_scan_type_passive = 2,
368	dot11_scan_type_auto = 3,
369	dot11_scan_type_forced = 0x80000000
370} DOT11_SCAN_TYPE, * PDOT11_SCAN_TYPE;
371
372typedef struct _DOT11_SCAN_REQUEST_V2 {
373	DOT11_BSS_TYPE dot11BSSType;
374	DOT11_MAC_ADDRESS dot11BSSID;
375	DOT11_SCAN_TYPE dot11ScanType;
376	BOOLEAN bRestrictedScan;
377	ULONG udot11SSIDsOffset;
378	ULONG uNumOfdot11SSIDs;
379	BOOLEAN bUseRequestIE;
380	ULONG uRequestIDsOffset;
381	ULONG uNumOfRequestIDs;
382	ULONG uPhyTypeInfosOffset;
383	ULONG uNumOfPhyTypeInfos;
384	ULONG uIEsOffset;
385	ULONG uIEsLength;
386	UCHAR ucBuffer[1];
387} DOT11_SCAN_REQUEST_V2, * PDOT11_SCAN_REQUEST_V2;
388
389#endif /* OID_DOT11_CURRENT_OPERATION_MODE */
390
391#ifdef CONFIG_USE_NDISUIO
392#ifndef _WIN32_WCE
393#ifdef __MINGW32_VERSION
394typedef ULONG NDIS_OID;
395#endif /* __MINGW32_VERSION */
396/* from nuiouser.h */
397#define FSCTL_NDISUIO_BASE      FILE_DEVICE_NETWORK
398
399#define _NDISUIO_CTL_CODE(_Function, _Method, _Access) \
400	CTL_CODE(FSCTL_NDISUIO_BASE, _Function, _Method, _Access)
401
402#define IOCTL_NDISUIO_OPEN_DEVICE \
403	_NDISUIO_CTL_CODE(0x200, METHOD_BUFFERED, \
404			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
405
406#define IOCTL_NDISUIO_QUERY_OID_VALUE \
407	_NDISUIO_CTL_CODE(0x201, METHOD_BUFFERED, \
408			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
409
410#define IOCTL_NDISUIO_SET_OID_VALUE \
411	_NDISUIO_CTL_CODE(0x205, METHOD_BUFFERED, \
412			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
413
414#define IOCTL_NDISUIO_SET_ETHER_TYPE \
415	_NDISUIO_CTL_CODE(0x202, METHOD_BUFFERED, \
416			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
417
418#define IOCTL_NDISUIO_QUERY_BINDING \
419	_NDISUIO_CTL_CODE(0x203, METHOD_BUFFERED, \
420			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
421
422#define IOCTL_NDISUIO_BIND_WAIT \
423	_NDISUIO_CTL_CODE(0x204, METHOD_BUFFERED, \
424			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
425
426typedef struct _NDISUIO_QUERY_OID
427{
428    NDIS_OID Oid;
429    UCHAR Data[sizeof(ULONG)];
430} NDISUIO_QUERY_OID, *PNDISUIO_QUERY_OID;
431
432typedef struct _NDISUIO_SET_OID
433{
434    NDIS_OID Oid;
435    UCHAR Data[sizeof(ULONG)];
436} NDISUIO_SET_OID, *PNDISUIO_SET_OID;
437
438typedef struct _NDISUIO_QUERY_BINDING
439{
440	ULONG BindingIndex;
441	ULONG DeviceNameOffset;
442	ULONG DeviceNameLength;
443	ULONG DeviceDescrOffset;
444	ULONG DeviceDescrLength;
445} NDISUIO_QUERY_BINDING, *PNDISUIO_QUERY_BINDING;
446#endif /* _WIN32_WCE */
447#endif /* CONFIG_USE_NDISUIO */
448
449
450static int ndis_get_oid(struct wpa_driver_ndis_data *drv, unsigned int oid,
451			char *data, size_t len)
452{
453#ifdef CONFIG_USE_NDISUIO
454	NDISUIO_QUERY_OID *o;
455	size_t buflen = sizeof(*o) + len;
456	DWORD written;
457	int ret;
458	size_t hdrlen;
459
460	o = os_zalloc(buflen);
461	if (o == NULL)
462		return -1;
463	o->Oid = oid;
464#ifdef _WIN32_WCE
465	o->ptcDeviceName = drv->adapter_name;
466#endif /* _WIN32_WCE */
467	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_QUERY_OID_VALUE,
468			     o, sizeof(NDISUIO_QUERY_OID), o, buflen, &written,
469			     NULL)) {
470		wpa_printf(MSG_DEBUG, "NDIS: IOCTL_NDISUIO_QUERY_OID_VALUE "
471			   "failed (oid=%08x): %d", oid, (int) GetLastError());
472		os_free(o);
473		return -1;
474	}
475	hdrlen = sizeof(NDISUIO_QUERY_OID) - sizeof(o->Data);
476	if (written < hdrlen) {
477		wpa_printf(MSG_DEBUG, "NDIS: query oid=%08x written (%d); "
478			   "too short", oid, (unsigned int) written);
479		os_free(o);
480		return -1;
481	}
482	written -= hdrlen;
483	if (written > len) {
484		wpa_printf(MSG_DEBUG, "NDIS: query oid=%08x written (%d) > "
485			   "len (%d)",oid, (unsigned int) written, len);
486		os_free(o);
487		return -1;
488	}
489	os_memcpy(data, o->Data, written);
490	ret = written;
491	os_free(o);
492	return ret;
493#else /* CONFIG_USE_NDISUIO */
494	char *buf;
495	PACKET_OID_DATA *o;
496	int ret;
497
498	buf = os_zalloc(sizeof(*o) + len);
499	if (buf == NULL)
500		return -1;
501	o = (PACKET_OID_DATA *) buf;
502	o->Oid = oid;
503	o->Length = len;
504
505	if (!PacketRequest(drv->adapter, FALSE, o)) {
506		wpa_printf(MSG_DEBUG, "%s: oid=0x%x len (%d) failed",
507			   __func__, oid, len);
508		os_free(buf);
509		return -1;
510	}
511	if (o->Length > len) {
512		wpa_printf(MSG_DEBUG, "%s: oid=0x%x Length (%d) > len (%d)",
513			   __func__, oid, (unsigned int) o->Length, len);
514		os_free(buf);
515		return -1;
516	}
517	os_memcpy(data, o->Data, o->Length);
518	ret = o->Length;
519	os_free(buf);
520	return ret;
521#endif /* CONFIG_USE_NDISUIO */
522}
523
524
525static int ndis_set_oid(struct wpa_driver_ndis_data *drv, unsigned int oid,
526			const char *data, size_t len)
527{
528#ifdef CONFIG_USE_NDISUIO
529	NDISUIO_SET_OID *o;
530	size_t buflen, reallen;
531	DWORD written;
532	char txt[50];
533
534	os_snprintf(txt, sizeof(txt), "NDIS: Set OID %08x", oid);
535	wpa_hexdump_key(MSG_MSGDUMP, txt, (const u8 *) data, len);
536
537	buflen = sizeof(*o) + len;
538	reallen = buflen - sizeof(o->Data);
539	o = os_zalloc(buflen);
540	if (o == NULL)
541		return -1;
542	o->Oid = oid;
543#ifdef _WIN32_WCE
544	o->ptcDeviceName = drv->adapter_name;
545#endif /* _WIN32_WCE */
546	if (data)
547		os_memcpy(o->Data, data, len);
548	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_SET_OID_VALUE,
549			     o, reallen, NULL, 0, &written, NULL)) {
550		wpa_printf(MSG_DEBUG, "NDIS: IOCTL_NDISUIO_SET_OID_VALUE "
551			   "(oid=%08x) failed: %d", oid, (int) GetLastError());
552		os_free(o);
553		return -1;
554	}
555	os_free(o);
556	return 0;
557#else /* CONFIG_USE_NDISUIO */
558	char *buf;
559	PACKET_OID_DATA *o;
560	char txt[50];
561
562	os_snprintf(txt, sizeof(txt), "NDIS: Set OID %08x", oid);
563	wpa_hexdump_key(MSG_MSGDUMP, txt, (const u8 *) data, len);
564
565	buf = os_zalloc(sizeof(*o) + len);
566	if (buf == NULL)
567		return -1;
568	o = (PACKET_OID_DATA *) buf;
569	o->Oid = oid;
570	o->Length = len;
571	if (data)
572		os_memcpy(o->Data, data, len);
573
574	if (!PacketRequest(drv->adapter, TRUE, o)) {
575		wpa_printf(MSG_DEBUG, "%s: oid=0x%x len (%d) failed",
576			   __func__, oid, len);
577		os_free(buf);
578		return -1;
579	}
580	os_free(buf);
581	return 0;
582#endif /* CONFIG_USE_NDISUIO */
583}
584
585
586static int ndis_set_auth_mode(struct wpa_driver_ndis_data *drv, int mode)
587{
588	u32 auth_mode = mode;
589	if (ndis_set_oid(drv, OID_802_11_AUTHENTICATION_MODE,
590			 (char *) &auth_mode, sizeof(auth_mode)) < 0) {
591		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
592			   "OID_802_11_AUTHENTICATION_MODE (%d)",
593			   (int) auth_mode);
594		return -1;
595	}
596	return 0;
597}
598
599
600static int ndis_get_auth_mode(struct wpa_driver_ndis_data *drv)
601{
602	u32 auth_mode;
603	int res;
604	res = ndis_get_oid(drv, OID_802_11_AUTHENTICATION_MODE,
605			   (char *) &auth_mode, sizeof(auth_mode));
606	if (res != sizeof(auth_mode)) {
607		wpa_printf(MSG_DEBUG, "NDIS: Failed to get "
608			   "OID_802_11_AUTHENTICATION_MODE");
609		return -1;
610	}
611	return auth_mode;
612}
613
614
615static int ndis_set_encr_status(struct wpa_driver_ndis_data *drv, int encr)
616{
617	u32 encr_status = encr;
618	if (ndis_set_oid(drv, OID_802_11_ENCRYPTION_STATUS,
619			 (char *) &encr_status, sizeof(encr_status)) < 0) {
620		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
621			   "OID_802_11_ENCRYPTION_STATUS (%d)", encr);
622		return -1;
623	}
624	return 0;
625}
626
627
628static int ndis_get_encr_status(struct wpa_driver_ndis_data *drv)
629{
630	u32 encr;
631	int res;
632	res = ndis_get_oid(drv, OID_802_11_ENCRYPTION_STATUS,
633			   (char *) &encr, sizeof(encr));
634	if (res != sizeof(encr)) {
635		wpa_printf(MSG_DEBUG, "NDIS: Failed to get "
636			   "OID_802_11_ENCRYPTION_STATUS");
637		return -1;
638	}
639	return encr;
640}
641
642
643static int wpa_driver_ndis_get_bssid(void *priv, u8 *bssid)
644{
645	struct wpa_driver_ndis_data *drv = priv;
646
647	if (drv->wired) {
648		/*
649		 * Report PAE group address as the "BSSID" for wired
650		 * connection.
651		 */
652		os_memcpy(bssid, pae_group_addr, ETH_ALEN);
653		return 0;
654	}
655
656	return ndis_get_oid(drv, OID_802_11_BSSID, (char *) bssid, ETH_ALEN) <
657		0 ? -1 : 0;
658}
659
660
661static int wpa_driver_ndis_get_ssid(void *priv, u8 *ssid)
662{
663	struct wpa_driver_ndis_data *drv = priv;
664	NDIS_802_11_SSID buf;
665	int res;
666
667	res = ndis_get_oid(drv, OID_802_11_SSID, (char *) &buf, sizeof(buf));
668	if (res < 4) {
669		wpa_printf(MSG_DEBUG, "NDIS: Failed to get SSID");
670		if (drv->wired) {
671			wpa_printf(MSG_DEBUG, "NDIS: Allow get_ssid failure "
672				   "with a wired interface");
673			return 0;
674		}
675		return -1;
676	}
677	os_memcpy(ssid, buf.Ssid, buf.SsidLength);
678	return buf.SsidLength;
679}
680
681
682static int wpa_driver_ndis_set_ssid(struct wpa_driver_ndis_data *drv,
683				    const u8 *ssid, size_t ssid_len)
684{
685	NDIS_802_11_SSID buf;
686
687	os_memset(&buf, 0, sizeof(buf));
688	buf.SsidLength = ssid_len;
689	os_memcpy(buf.Ssid, ssid, ssid_len);
690	/*
691	 * Make sure radio is marked enabled here so that scan request will not
692	 * force SSID to be changed to a random one in order to enable radio at
693	 * that point.
694	 */
695	drv->radio_enabled = 1;
696	return ndis_set_oid(drv, OID_802_11_SSID, (char *) &buf, sizeof(buf));
697}
698
699
700/* Disconnect using OID_802_11_DISASSOCIATE. This will also turn the radio off.
701 */
702static int wpa_driver_ndis_radio_off(struct wpa_driver_ndis_data *drv)
703{
704	drv->radio_enabled = 0;
705	return ndis_set_oid(drv, OID_802_11_DISASSOCIATE, "    ", 4);
706}
707
708
709/* Disconnect by setting SSID to random (i.e., likely not used). */
710static int wpa_driver_ndis_disconnect(struct wpa_driver_ndis_data *drv)
711{
712	char ssid[32];
713	int i;
714	for (i = 0; i < 32; i++)
715		ssid[i] = rand() & 0xff;
716	return wpa_driver_ndis_set_ssid(drv, (u8 *) ssid, 32);
717}
718
719
720static int wpa_driver_ndis_deauthenticate(void *priv, const u8 *addr,
721					  int reason_code)
722{
723	struct wpa_driver_ndis_data *drv = priv;
724	return wpa_driver_ndis_disconnect(drv);
725}
726
727
728static void wpa_driver_ndis_scan_timeout(void *eloop_ctx, void *timeout_ctx)
729{
730	wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
731	wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
732}
733
734
735static int wpa_driver_ndis_scan_native80211(
736	struct wpa_driver_ndis_data *drv,
737	struct wpa_driver_scan_params *params)
738{
739	DOT11_SCAN_REQUEST_V2 req;
740	int res;
741
742	os_memset(&req, 0, sizeof(req));
743	req.dot11BSSType = dot11_BSS_type_any;
744	os_memset(req.dot11BSSID, 0xff, ETH_ALEN);
745	req.dot11ScanType = dot11_scan_type_auto;
746	res = ndis_set_oid(drv, OID_DOT11_SCAN_REQUEST, (char *) &req,
747			   sizeof(req));
748	eloop_cancel_timeout(wpa_driver_ndis_scan_timeout, drv, drv->ctx);
749	eloop_register_timeout(7, 0, wpa_driver_ndis_scan_timeout, drv,
750			       drv->ctx);
751	return res;
752}
753
754
755static int wpa_driver_ndis_scan(void *priv,
756				struct wpa_driver_scan_params *params)
757{
758	struct wpa_driver_ndis_data *drv = priv;
759	int res;
760
761	if (drv->native80211)
762		return wpa_driver_ndis_scan_native80211(drv, params);
763
764	if (!drv->radio_enabled) {
765		wpa_printf(MSG_DEBUG, "NDIS: turning radio on before the first"
766			   " scan");
767		if (wpa_driver_ndis_disconnect(drv) < 0) {
768			wpa_printf(MSG_DEBUG, "NDIS: failed to enable radio");
769		}
770		drv->radio_enabled = 1;
771	}
772
773	res = ndis_set_oid(drv, OID_802_11_BSSID_LIST_SCAN, "    ", 4);
774	eloop_cancel_timeout(wpa_driver_ndis_scan_timeout, drv, drv->ctx);
775	eloop_register_timeout(7, 0, wpa_driver_ndis_scan_timeout, drv,
776			       drv->ctx);
777	return res;
778}
779
780
781static const u8 * wpa_scan_get_ie(const struct wpa_scan_res *res, u8 ie)
782{
783	const u8 *end, *pos;
784
785	pos = (const u8 *) (res + 1);
786	end = pos + res->ie_len;
787
788	while (pos + 1 < end) {
789		if (pos + 2 + pos[1] > end)
790			break;
791		if (pos[0] == ie)
792			return pos;
793		pos += 2 + pos[1];
794	}
795
796	return NULL;
797}
798
799
800static struct wpa_scan_res * wpa_driver_ndis_add_scan_ssid(
801	struct wpa_scan_res *r, NDIS_802_11_SSID *ssid)
802{
803	struct wpa_scan_res *nr;
804	u8 *pos;
805
806	if (wpa_scan_get_ie(r, WLAN_EID_SSID))
807		return r; /* SSID IE already present */
808
809	if (ssid->SsidLength == 0 || ssid->SsidLength > 32)
810		return r; /* No valid SSID inside scan data */
811
812	nr = os_realloc(r, sizeof(*r) + r->ie_len + 2 + ssid->SsidLength);
813	if (nr == NULL)
814		return r;
815
816	pos = ((u8 *) (nr + 1)) + nr->ie_len;
817	*pos++ = WLAN_EID_SSID;
818	*pos++ = ssid->SsidLength;
819	os_memcpy(pos, ssid->Ssid, ssid->SsidLength);
820	nr->ie_len += 2 + ssid->SsidLength;
821
822	return nr;
823}
824
825
826static struct wpa_scan_results * wpa_driver_ndis_get_scan_results(void *priv)
827{
828	struct wpa_driver_ndis_data *drv = priv;
829	NDIS_802_11_BSSID_LIST_EX *b;
830	size_t blen, count, i;
831	int len;
832	char *pos;
833	struct wpa_scan_results *results;
834	struct wpa_scan_res *r;
835
836	blen = 65535;
837	b = os_zalloc(blen);
838	if (b == NULL)
839		return NULL;
840	len = ndis_get_oid(drv, OID_802_11_BSSID_LIST, (char *) b, blen);
841	if (len < 0) {
842		wpa_printf(MSG_DEBUG, "NDIS: failed to get scan results");
843		os_free(b);
844		return NULL;
845	}
846	count = b->NumberOfItems;
847
848	results = os_zalloc(sizeof(*results));
849	if (results == NULL) {
850		os_free(b);
851		return NULL;
852	}
853	results->res = os_calloc(count, sizeof(struct wpa_scan_res *));
854	if (results->res == NULL) {
855		os_free(results);
856		os_free(b);
857		return NULL;
858	}
859
860	pos = (char *) &b->Bssid[0];
861	for (i = 0; i < count; i++) {
862		NDIS_WLAN_BSSID_EX *bss = (NDIS_WLAN_BSSID_EX *) pos;
863		NDIS_802_11_FIXED_IEs *fixed;
864
865		if (bss->IELength < sizeof(NDIS_802_11_FIXED_IEs)) {
866			wpa_printf(MSG_DEBUG, "NDIS: too small IELength=%d",
867				   (int) bss->IELength);
868			break;
869		}
870		if (((char *) bss->IEs) + bss->IELength  > (char *) b + blen) {
871			/*
872			 * Some NDIS drivers have been reported to include an
873			 * entry with an invalid IELength in scan results and
874			 * this has crashed wpa_supplicant, so validate the
875			 * returned value before using it.
876			 */
877			wpa_printf(MSG_DEBUG, "NDIS: skipped invalid scan "
878				   "result IE (BSSID=" MACSTR ") IELength=%d",
879				   MAC2STR(bss->MacAddress),
880				   (int) bss->IELength);
881			break;
882		}
883
884		r = os_zalloc(sizeof(*r) + bss->IELength -
885			      sizeof(NDIS_802_11_FIXED_IEs));
886		if (r == NULL)
887			break;
888
889		os_memcpy(r->bssid, bss->MacAddress, ETH_ALEN);
890		r->level = (int) bss->Rssi;
891		r->freq = bss->Configuration.DSConfig / 1000;
892		fixed = (NDIS_802_11_FIXED_IEs *) bss->IEs;
893		r->beacon_int = WPA_GET_LE16((u8 *) &fixed->BeaconInterval);
894		r->caps = WPA_GET_LE16((u8 *) &fixed->Capabilities);
895		r->tsf = WPA_GET_LE64(fixed->Timestamp);
896		os_memcpy(r + 1, bss->IEs + sizeof(NDIS_802_11_FIXED_IEs),
897			  bss->IELength - sizeof(NDIS_802_11_FIXED_IEs));
898		r->ie_len = bss->IELength - sizeof(NDIS_802_11_FIXED_IEs);
899		r = wpa_driver_ndis_add_scan_ssid(r, &bss->Ssid);
900
901		results->res[results->num++] = r;
902
903		pos += bss->Length;
904		if (pos > (char *) b + blen)
905			break;
906	}
907
908	os_free(b);
909
910	return results;
911}
912
913
914static int wpa_driver_ndis_remove_key(struct wpa_driver_ndis_data *drv,
915				      int key_idx, const u8 *addr,
916				      const u8 *bssid, int pairwise)
917{
918	NDIS_802_11_REMOVE_KEY rkey;
919	NDIS_802_11_KEY_INDEX index;
920	int res, res2;
921
922	os_memset(&rkey, 0, sizeof(rkey));
923
924	rkey.Length = sizeof(rkey);
925	rkey.KeyIndex = key_idx;
926	if (pairwise)
927		rkey.KeyIndex |= 1 << 30;
928	os_memcpy(rkey.BSSID, bssid, ETH_ALEN);
929
930	res = ndis_set_oid(drv, OID_802_11_REMOVE_KEY, (char *) &rkey,
931			   sizeof(rkey));
932	if (!pairwise) {
933		index = key_idx;
934		res2 = ndis_set_oid(drv, OID_802_11_REMOVE_WEP,
935				    (char *) &index, sizeof(index));
936	} else
937		res2 = 0;
938
939	if (res < 0 && res2 < 0)
940		return -1;
941	return 0;
942}
943
944
945static int wpa_driver_ndis_add_wep(struct wpa_driver_ndis_data *drv,
946				   int pairwise, int key_idx, int set_tx,
947				   const u8 *key, size_t key_len)
948{
949	NDIS_802_11_WEP *wep;
950	size_t len;
951	int res;
952
953	len = 12 + key_len;
954	wep = os_zalloc(len);
955	if (wep == NULL)
956		return -1;
957	wep->Length = len;
958	wep->KeyIndex = key_idx;
959	if (set_tx)
960		wep->KeyIndex |= 1 << 31;
961#if 0 /* Setting bit30 does not seem to work with some NDIS drivers */
962	if (pairwise)
963		wep->KeyIndex |= 1 << 30;
964#endif
965	wep->KeyLength = key_len;
966	os_memcpy(wep->KeyMaterial, key, key_len);
967
968	wpa_hexdump_key(MSG_MSGDUMP, "NDIS: OID_802_11_ADD_WEP",
969			(u8 *) wep, len);
970	res = ndis_set_oid(drv, OID_802_11_ADD_WEP, (char *) wep, len);
971
972	os_free(wep);
973
974	return res;
975}
976
977
978static int wpa_driver_ndis_set_key(const char *ifname, void *priv,
979				   enum wpa_alg alg, const u8 *addr,
980				   int key_idx, int set_tx,
981				   const u8 *seq, size_t seq_len,
982				   const u8 *key, size_t key_len)
983{
984	struct wpa_driver_ndis_data *drv = priv;
985	size_t len, i;
986	NDIS_802_11_KEY *nkey;
987	int res, pairwise;
988	u8 bssid[ETH_ALEN];
989
990	if (addr == NULL || is_broadcast_ether_addr(addr)) {
991		/* Group Key */
992		pairwise = 0;
993		if (wpa_driver_ndis_get_bssid(drv, bssid) < 0)
994			os_memset(bssid, 0xff, ETH_ALEN);
995	} else {
996		/* Pairwise Key */
997		pairwise = 1;
998		os_memcpy(bssid, addr, ETH_ALEN);
999	}
1000
1001	if (alg == WPA_ALG_NONE || key_len == 0) {
1002		return wpa_driver_ndis_remove_key(drv, key_idx, addr, bssid,
1003						  pairwise);
1004	}
1005
1006	if (alg == WPA_ALG_WEP) {
1007		return wpa_driver_ndis_add_wep(drv, pairwise, key_idx, set_tx,
1008					       key, key_len);
1009	}
1010
1011	len = 12 + 6 + 6 + 8 + key_len;
1012
1013	nkey = os_zalloc(len);
1014	if (nkey == NULL)
1015		return -1;
1016
1017	nkey->Length = len;
1018	nkey->KeyIndex = key_idx;
1019	if (set_tx)
1020		nkey->KeyIndex |= 1 << 31;
1021	if (pairwise)
1022		nkey->KeyIndex |= 1 << 30;
1023	if (seq && seq_len)
1024		nkey->KeyIndex |= 1 << 29;
1025	nkey->KeyLength = key_len;
1026	os_memcpy(nkey->BSSID, bssid, ETH_ALEN);
1027	if (seq && seq_len) {
1028		for (i = 0; i < seq_len; i++)
1029			nkey->KeyRSC |= (ULONGLONG) seq[i] << (i * 8);
1030	}
1031	if (alg == WPA_ALG_TKIP && key_len == 32) {
1032		os_memcpy(nkey->KeyMaterial, key, 16);
1033		os_memcpy(nkey->KeyMaterial + 16, key + 24, 8);
1034		os_memcpy(nkey->KeyMaterial + 24, key + 16, 8);
1035	} else {
1036		os_memcpy(nkey->KeyMaterial, key, key_len);
1037	}
1038
1039	wpa_hexdump_key(MSG_MSGDUMP, "NDIS: OID_802_11_ADD_KEY",
1040			(u8 *) nkey, len);
1041	res = ndis_set_oid(drv, OID_802_11_ADD_KEY, (char *) nkey, len);
1042	os_free(nkey);
1043
1044	return res;
1045}
1046
1047
1048static int
1049wpa_driver_ndis_associate(void *priv,
1050			  struct wpa_driver_associate_params *params)
1051{
1052	struct wpa_driver_ndis_data *drv = priv;
1053	u32 auth_mode, encr, priv_mode, mode;
1054	u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
1055
1056	drv->mode = params->mode;
1057
1058	/* Note: Setting OID_802_11_INFRASTRUCTURE_MODE clears current keys,
1059	 * so static WEP keys needs to be set again after this. */
1060	if (params->mode == IEEE80211_MODE_IBSS) {
1061		mode = Ndis802_11IBSS;
1062		/* Need to make sure that BSSID polling is enabled for
1063		 * IBSS mode. */
1064		eloop_cancel_timeout(wpa_driver_ndis_poll_timeout, drv, NULL);
1065		eloop_register_timeout(1, 0, wpa_driver_ndis_poll_timeout,
1066				       drv, NULL);
1067	} else
1068		mode = Ndis802_11Infrastructure;
1069	if (ndis_set_oid(drv, OID_802_11_INFRASTRUCTURE_MODE,
1070			 (char *) &mode, sizeof(mode)) < 0) {
1071		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
1072			   "OID_802_11_INFRASTRUCTURE_MODE (%d)",
1073			   (int) mode);
1074		/* Try to continue anyway */
1075	}
1076
1077	if (params->key_mgmt_suite == KEY_MGMT_NONE ||
1078	    params->key_mgmt_suite == KEY_MGMT_802_1X_NO_WPA) {
1079		/* Re-set WEP keys if static WEP configuration is used. */
1080		int i;
1081		for (i = 0; i < 4; i++) {
1082			if (!params->wep_key[i])
1083				continue;
1084			wpa_printf(MSG_DEBUG, "NDIS: Re-setting static WEP "
1085				   "key %d", i);
1086			wpa_driver_ndis_set_key(drv->ifname, drv, WPA_ALG_WEP,
1087						bcast, i,
1088						i == params->wep_tx_keyidx,
1089						NULL, 0, params->wep_key[i],
1090						params->wep_key_len[i]);
1091		}
1092	}
1093
1094	if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
1095		if (params->auth_alg & WPA_AUTH_ALG_SHARED) {
1096			if (params->auth_alg & WPA_AUTH_ALG_OPEN)
1097				auth_mode = Ndis802_11AuthModeAutoSwitch;
1098			else
1099				auth_mode = Ndis802_11AuthModeShared;
1100		} else
1101			auth_mode = Ndis802_11AuthModeOpen;
1102		priv_mode = Ndis802_11PrivFilterAcceptAll;
1103	} else if (params->wpa_ie[0] == WLAN_EID_RSN) {
1104		priv_mode = Ndis802_11PrivFilter8021xWEP;
1105		if (params->key_mgmt_suite == KEY_MGMT_PSK)
1106			auth_mode = Ndis802_11AuthModeWPA2PSK;
1107		else
1108			auth_mode = Ndis802_11AuthModeWPA2;
1109#ifdef CONFIG_WPS
1110	} else if (params->key_mgmt_suite == KEY_MGMT_WPS) {
1111		auth_mode = Ndis802_11AuthModeOpen;
1112		priv_mode = Ndis802_11PrivFilterAcceptAll;
1113		if (params->wps == WPS_MODE_PRIVACY) {
1114			u8 dummy_key[5] = { 0x11, 0x22, 0x33, 0x44, 0x55 };
1115			/*
1116			 * Some NDIS drivers refuse to associate in open mode
1117			 * configuration due to Privacy field mismatch, so use
1118			 * a workaround to make the configuration look like
1119			 * matching one for WPS provisioning.
1120			 */
1121			wpa_printf(MSG_DEBUG, "NDIS: Set dummy WEP key as a "
1122				   "workaround to allow driver to associate "
1123				   "for WPS");
1124			wpa_driver_ndis_set_key(drv->ifname, drv, WPA_ALG_WEP,
1125						bcast, 0, 1,
1126						NULL, 0, dummy_key,
1127						sizeof(dummy_key));
1128		}
1129#endif /* CONFIG_WPS */
1130	} else {
1131		priv_mode = Ndis802_11PrivFilter8021xWEP;
1132		if (params->key_mgmt_suite == KEY_MGMT_WPA_NONE)
1133			auth_mode = Ndis802_11AuthModeWPANone;
1134		else if (params->key_mgmt_suite == KEY_MGMT_PSK)
1135			auth_mode = Ndis802_11AuthModeWPAPSK;
1136		else
1137			auth_mode = Ndis802_11AuthModeWPA;
1138	}
1139
1140	switch (params->pairwise_suite) {
1141	case CIPHER_CCMP:
1142		encr = Ndis802_11Encryption3Enabled;
1143		break;
1144	case CIPHER_TKIP:
1145		encr = Ndis802_11Encryption2Enabled;
1146		break;
1147	case CIPHER_WEP40:
1148	case CIPHER_WEP104:
1149		encr = Ndis802_11Encryption1Enabled;
1150		break;
1151	case CIPHER_NONE:
1152#ifdef CONFIG_WPS
1153		if (params->wps == WPS_MODE_PRIVACY) {
1154			encr = Ndis802_11Encryption1Enabled;
1155			break;
1156		}
1157#endif /* CONFIG_WPS */
1158		if (params->group_suite == CIPHER_CCMP)
1159			encr = Ndis802_11Encryption3Enabled;
1160		else if (params->group_suite == CIPHER_TKIP)
1161			encr = Ndis802_11Encryption2Enabled;
1162		else
1163			encr = Ndis802_11EncryptionDisabled;
1164		break;
1165	default:
1166#ifdef CONFIG_WPS
1167		if (params->wps == WPS_MODE_PRIVACY) {
1168			encr = Ndis802_11Encryption1Enabled;
1169			break;
1170		}
1171#endif /* CONFIG_WPS */
1172		encr = Ndis802_11EncryptionDisabled;
1173		break;
1174	};
1175
1176	if (ndis_set_oid(drv, OID_802_11_PRIVACY_FILTER,
1177			 (char *) &priv_mode, sizeof(priv_mode)) < 0) {
1178		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
1179			   "OID_802_11_PRIVACY_FILTER (%d)",
1180			   (int) priv_mode);
1181		/* Try to continue anyway */
1182	}
1183
1184	ndis_set_auth_mode(drv, auth_mode);
1185	ndis_set_encr_status(drv, encr);
1186
1187	if (params->bssid) {
1188		ndis_set_oid(drv, OID_802_11_BSSID, (char *) params->bssid,
1189			     ETH_ALEN);
1190		drv->oid_bssid_set = 1;
1191	} else if (drv->oid_bssid_set) {
1192		ndis_set_oid(drv, OID_802_11_BSSID, "\xff\xff\xff\xff\xff\xff",
1193			     ETH_ALEN);
1194		drv->oid_bssid_set = 0;
1195	}
1196
1197	return wpa_driver_ndis_set_ssid(drv, params->ssid, params->ssid_len);
1198}
1199
1200
1201static int wpa_driver_ndis_set_pmkid(struct wpa_driver_ndis_data *drv)
1202{
1203	int len, count, i, ret;
1204	struct ndis_pmkid_entry *entry;
1205	NDIS_802_11_PMKID *p;
1206
1207	count = 0;
1208	entry = drv->pmkid;
1209	while (entry) {
1210		count++;
1211		if (count >= drv->no_of_pmkid)
1212			break;
1213		entry = entry->next;
1214	}
1215	len = 8 + count * sizeof(BSSID_INFO);
1216	p = os_zalloc(len);
1217	if (p == NULL)
1218		return -1;
1219
1220	p->Length = len;
1221	p->BSSIDInfoCount = count;
1222	entry = drv->pmkid;
1223	for (i = 0; i < count; i++) {
1224		os_memcpy(&p->BSSIDInfo[i].BSSID, entry->bssid, ETH_ALEN);
1225		os_memcpy(&p->BSSIDInfo[i].PMKID, entry->pmkid, 16);
1226		entry = entry->next;
1227	}
1228	wpa_hexdump(MSG_MSGDUMP, "NDIS: OID_802_11_PMKID", (u8 *) p, len);
1229	ret = ndis_set_oid(drv, OID_802_11_PMKID, (char *) p, len);
1230	os_free(p);
1231	return ret;
1232}
1233
1234
1235static int wpa_driver_ndis_add_pmkid(void *priv, const u8 *bssid,
1236				     const u8 *pmkid)
1237{
1238	struct wpa_driver_ndis_data *drv = priv;
1239	struct ndis_pmkid_entry *entry, *prev;
1240
1241	if (drv->no_of_pmkid == 0)
1242		return 0;
1243
1244	prev = NULL;
1245	entry = drv->pmkid;
1246	while (entry) {
1247		if (os_memcmp(entry->bssid, bssid, ETH_ALEN) == 0)
1248			break;
1249		prev = entry;
1250		entry = entry->next;
1251	}
1252
1253	if (entry) {
1254		/* Replace existing entry for this BSSID and move it into the
1255		 * beginning of the list. */
1256		os_memcpy(entry->pmkid, pmkid, 16);
1257		if (prev) {
1258			prev->next = entry->next;
1259			entry->next = drv->pmkid;
1260			drv->pmkid = entry;
1261		}
1262	} else {
1263		entry = os_malloc(sizeof(*entry));
1264		if (entry) {
1265			os_memcpy(entry->bssid, bssid, ETH_ALEN);
1266			os_memcpy(entry->pmkid, pmkid, 16);
1267			entry->next = drv->pmkid;
1268			drv->pmkid = entry;
1269		}
1270	}
1271
1272	return wpa_driver_ndis_set_pmkid(drv);
1273}
1274
1275
1276static int wpa_driver_ndis_remove_pmkid(void *priv, const u8 *bssid,
1277		 			const u8 *pmkid)
1278{
1279	struct wpa_driver_ndis_data *drv = priv;
1280	struct ndis_pmkid_entry *entry, *prev;
1281
1282	if (drv->no_of_pmkid == 0)
1283		return 0;
1284
1285	entry = drv->pmkid;
1286	prev = NULL;
1287	while (entry) {
1288		if (os_memcmp(entry->bssid, bssid, ETH_ALEN) == 0 &&
1289		    os_memcmp(entry->pmkid, pmkid, 16) == 0) {
1290			if (prev)
1291				prev->next = entry->next;
1292			else
1293				drv->pmkid = entry->next;
1294			os_free(entry);
1295			break;
1296		}
1297		prev = entry;
1298		entry = entry->next;
1299	}
1300	return wpa_driver_ndis_set_pmkid(drv);
1301}
1302
1303
1304static int wpa_driver_ndis_flush_pmkid(void *priv)
1305{
1306	struct wpa_driver_ndis_data *drv = priv;
1307	NDIS_802_11_PMKID p;
1308	struct ndis_pmkid_entry *pmkid, *prev;
1309	int prev_authmode, ret;
1310
1311	if (drv->no_of_pmkid == 0)
1312		return 0;
1313
1314	pmkid = drv->pmkid;
1315	drv->pmkid = NULL;
1316	while (pmkid) {
1317		prev = pmkid;
1318		pmkid = pmkid->next;
1319		os_free(prev);
1320	}
1321
1322	/*
1323	 * Some drivers may refuse OID_802_11_PMKID if authMode is not set to
1324	 * WPA2, so change authMode temporarily, if needed.
1325	 */
1326	prev_authmode = ndis_get_auth_mode(drv);
1327	if (prev_authmode != Ndis802_11AuthModeWPA2)
1328		ndis_set_auth_mode(drv, Ndis802_11AuthModeWPA2);
1329
1330	os_memset(&p, 0, sizeof(p));
1331	p.Length = 8;
1332	p.BSSIDInfoCount = 0;
1333	wpa_hexdump(MSG_MSGDUMP, "NDIS: OID_802_11_PMKID (flush)",
1334		    (u8 *) &p, 8);
1335	ret = ndis_set_oid(drv, OID_802_11_PMKID, (char *) &p, 8);
1336
1337	if (prev_authmode != Ndis802_11AuthModeWPA2)
1338		ndis_set_auth_mode(drv, prev_authmode);
1339
1340	return ret;
1341}
1342
1343
1344static int wpa_driver_ndis_get_associnfo(struct wpa_driver_ndis_data *drv)
1345{
1346	char buf[512], *pos;
1347	NDIS_802_11_ASSOCIATION_INFORMATION *ai;
1348	int len;
1349	union wpa_event_data data;
1350	NDIS_802_11_BSSID_LIST_EX *b;
1351	size_t blen, i;
1352
1353	len = ndis_get_oid(drv, OID_802_11_ASSOCIATION_INFORMATION, buf,
1354			   sizeof(buf));
1355	if (len < 0) {
1356		wpa_printf(MSG_DEBUG, "NDIS: failed to get association "
1357			   "information");
1358		return -1;
1359	}
1360	if (len > sizeof(buf)) {
1361		/* Some drivers seem to be producing incorrect length for this
1362		 * data. Limit the length to the current buffer size to avoid
1363		 * crashing in hexdump. The data seems to be otherwise valid,
1364		 * so better try to use it. */
1365		wpa_printf(MSG_DEBUG, "NDIS: ignored bogus association "
1366			   "information length %d", len);
1367		len = ndis_get_oid(drv, OID_802_11_ASSOCIATION_INFORMATION,
1368				   buf, sizeof(buf));
1369		if (len < -1) {
1370			wpa_printf(MSG_DEBUG, "NDIS: re-reading association "
1371				   "information failed");
1372			return -1;
1373		}
1374		if (len > sizeof(buf)) {
1375			wpa_printf(MSG_DEBUG, "NDIS: ignored bogus association"
1376				   " information length %d (re-read)", len);
1377			len = sizeof(buf);
1378		}
1379	}
1380	wpa_hexdump(MSG_MSGDUMP, "NDIS: association information",
1381		    (u8 *) buf, len);
1382	if (len < sizeof(*ai)) {
1383		wpa_printf(MSG_DEBUG, "NDIS: too short association "
1384			   "information");
1385		return -1;
1386	}
1387	ai = (NDIS_802_11_ASSOCIATION_INFORMATION *) buf;
1388	wpa_printf(MSG_DEBUG, "NDIS: ReqFixed=0x%x RespFixed=0x%x off_req=%d "
1389		   "off_resp=%d len_req=%d len_resp=%d",
1390		   ai->AvailableRequestFixedIEs, ai->AvailableResponseFixedIEs,
1391		   (int) ai->OffsetRequestIEs, (int) ai->OffsetResponseIEs,
1392		   (int) ai->RequestIELength, (int) ai->ResponseIELength);
1393
1394	if (ai->OffsetRequestIEs + ai->RequestIELength > (unsigned) len ||
1395	    ai->OffsetResponseIEs + ai->ResponseIELength > (unsigned) len) {
1396		wpa_printf(MSG_DEBUG, "NDIS: association information - "
1397			   "IE overflow");
1398		return -1;
1399	}
1400
1401	wpa_hexdump(MSG_MSGDUMP, "NDIS: Request IEs",
1402		    (u8 *) buf + ai->OffsetRequestIEs, ai->RequestIELength);
1403	wpa_hexdump(MSG_MSGDUMP, "NDIS: Response IEs",
1404		    (u8 *) buf + ai->OffsetResponseIEs, ai->ResponseIELength);
1405
1406	os_memset(&data, 0, sizeof(data));
1407	data.assoc_info.req_ies = (u8 *) buf + ai->OffsetRequestIEs;
1408	data.assoc_info.req_ies_len = ai->RequestIELength;
1409	data.assoc_info.resp_ies = (u8 *) buf + ai->OffsetResponseIEs;
1410	data.assoc_info.resp_ies_len = ai->ResponseIELength;
1411
1412	blen = 65535;
1413	b = os_zalloc(blen);
1414	if (b == NULL)
1415		goto skip_scan_results;
1416	len = ndis_get_oid(drv, OID_802_11_BSSID_LIST, (char *) b, blen);
1417	if (len < 0) {
1418		wpa_printf(MSG_DEBUG, "NDIS: failed to get scan results");
1419		os_free(b);
1420		b = NULL;
1421		goto skip_scan_results;
1422	}
1423	wpa_printf(MSG_DEBUG, "NDIS: %d BSSID items to process for AssocInfo",
1424		   (unsigned int) b->NumberOfItems);
1425
1426	pos = (char *) &b->Bssid[0];
1427	for (i = 0; i < b->NumberOfItems; i++) {
1428		NDIS_WLAN_BSSID_EX *bss = (NDIS_WLAN_BSSID_EX *) pos;
1429		if (os_memcmp(drv->bssid, bss->MacAddress, ETH_ALEN) == 0 &&
1430		    bss->IELength > sizeof(NDIS_802_11_FIXED_IEs)) {
1431			data.assoc_info.beacon_ies =
1432				((u8 *) bss->IEs) +
1433				sizeof(NDIS_802_11_FIXED_IEs);
1434			data.assoc_info.beacon_ies_len =
1435				bss->IELength - sizeof(NDIS_802_11_FIXED_IEs);
1436			wpa_hexdump(MSG_MSGDUMP, "NDIS: Beacon IEs",
1437				    data.assoc_info.beacon_ies,
1438				    data.assoc_info.beacon_ies_len);
1439			break;
1440		}
1441		pos += bss->Length;
1442		if (pos > (char *) b + blen)
1443			break;
1444	}
1445
1446skip_scan_results:
1447	wpa_supplicant_event(drv->ctx, EVENT_ASSOCINFO, &data);
1448
1449	os_free(b);
1450
1451	return 0;
1452}
1453
1454
1455static void wpa_driver_ndis_poll_timeout(void *eloop_ctx, void *timeout_ctx)
1456{
1457	struct wpa_driver_ndis_data *drv = eloop_ctx;
1458	u8 bssid[ETH_ALEN];
1459	int poll;
1460
1461	if (drv->wired)
1462		return;
1463
1464	if (wpa_driver_ndis_get_bssid(drv, bssid)) {
1465		/* Disconnected */
1466		if (!is_zero_ether_addr(drv->bssid)) {
1467			os_memset(drv->bssid, 0, ETH_ALEN);
1468			wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
1469		}
1470	} else {
1471		/* Connected */
1472		if (os_memcmp(drv->bssid, bssid, ETH_ALEN) != 0) {
1473			os_memcpy(drv->bssid, bssid, ETH_ALEN);
1474			wpa_driver_ndis_get_associnfo(drv);
1475			wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
1476		}
1477	}
1478
1479	/* When using integrated NDIS event receiver, we can skip BSSID
1480	 * polling when using infrastructure network. However, when using
1481	 * IBSS mode, many driver do not seem to generate connection event,
1482	 * so we need to enable BSSID polling to figure out when IBSS network
1483	 * has been formed.
1484	 */
1485	poll = drv->mode == IEEE80211_MODE_IBSS;
1486#ifndef CONFIG_NDIS_EVENTS_INTEGRATED
1487#ifndef _WIN32_WCE
1488	poll = 1;
1489#endif /* _WIN32_WCE */
1490#endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
1491
1492	if (poll) {
1493		eloop_register_timeout(1, 0, wpa_driver_ndis_poll_timeout,
1494					drv, NULL);
1495	}
1496}
1497
1498
1499static void wpa_driver_ndis_poll(void *priv)
1500{
1501	struct wpa_driver_ndis_data *drv = priv;
1502	eloop_cancel_timeout(wpa_driver_ndis_poll_timeout, drv, NULL);
1503	wpa_driver_ndis_poll_timeout(drv, NULL);
1504}
1505
1506
1507/* Called when driver generates Media Connect Event by calling
1508 * NdisMIndicateStatus() with NDIS_STATUS_MEDIA_CONNECT */
1509void wpa_driver_ndis_event_connect(struct wpa_driver_ndis_data *drv)
1510{
1511	wpa_printf(MSG_DEBUG, "NDIS: Media Connect Event");
1512	if (wpa_driver_ndis_get_bssid(drv, drv->bssid) == 0) {
1513		wpa_driver_ndis_get_associnfo(drv);
1514		wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
1515	}
1516}
1517
1518
1519/* Called when driver generates Media Disconnect Event by calling
1520 * NdisMIndicateStatus() with NDIS_STATUS_MEDIA_DISCONNECT */
1521void wpa_driver_ndis_event_disconnect(struct wpa_driver_ndis_data *drv)
1522{
1523	wpa_printf(MSG_DEBUG, "NDIS: Media Disconnect Event");
1524	os_memset(drv->bssid, 0, ETH_ALEN);
1525	wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
1526}
1527
1528
1529static void wpa_driver_ndis_event_auth(struct wpa_driver_ndis_data *drv,
1530				       const u8 *data, size_t data_len)
1531{
1532	NDIS_802_11_AUTHENTICATION_REQUEST *req;
1533	int pairwise = 0, group = 0;
1534	union wpa_event_data event;
1535
1536	if (data_len < sizeof(*req)) {
1537		wpa_printf(MSG_DEBUG, "NDIS: Too short Authentication Request "
1538			   "Event (len=%d)", data_len);
1539		return;
1540	}
1541	req = (NDIS_802_11_AUTHENTICATION_REQUEST *) data;
1542
1543	wpa_printf(MSG_DEBUG, "NDIS: Authentication Request Event: "
1544		   "Bssid " MACSTR " Flags 0x%x",
1545		   MAC2STR(req->Bssid), (int) req->Flags);
1546
1547	if ((req->Flags & NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR) ==
1548	    NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR)
1549		pairwise = 1;
1550	else if ((req->Flags & NDIS_802_11_AUTH_REQUEST_GROUP_ERROR) ==
1551	    NDIS_802_11_AUTH_REQUEST_GROUP_ERROR)
1552		group = 1;
1553
1554	if (pairwise || group) {
1555		os_memset(&event, 0, sizeof(event));
1556		event.michael_mic_failure.unicast = pairwise;
1557		wpa_supplicant_event(drv->ctx, EVENT_MICHAEL_MIC_FAILURE,
1558				     &event);
1559	}
1560}
1561
1562
1563static void wpa_driver_ndis_event_pmkid(struct wpa_driver_ndis_data *drv,
1564					const u8 *data, size_t data_len)
1565{
1566	NDIS_802_11_PMKID_CANDIDATE_LIST *pmkid;
1567	size_t i;
1568	union wpa_event_data event;
1569
1570	if (data_len < 8) {
1571		wpa_printf(MSG_DEBUG, "NDIS: Too short PMKID Candidate List "
1572			   "Event (len=%d)", data_len);
1573		return;
1574	}
1575	pmkid = (NDIS_802_11_PMKID_CANDIDATE_LIST *) data;
1576	wpa_printf(MSG_DEBUG, "NDIS: PMKID Candidate List Event - Version %d "
1577		   "NumCandidates %d",
1578		   (int) pmkid->Version, (int) pmkid->NumCandidates);
1579
1580	if (pmkid->Version != 1) {
1581		wpa_printf(MSG_DEBUG, "NDIS: Unsupported PMKID Candidate List "
1582			   "Version %d", (int) pmkid->Version);
1583		return;
1584	}
1585
1586	if (data_len < 8 + pmkid->NumCandidates * sizeof(PMKID_CANDIDATE)) {
1587		wpa_printf(MSG_DEBUG, "NDIS: PMKID Candidate List underflow");
1588		return;
1589	}
1590
1591	os_memset(&event, 0, sizeof(event));
1592	for (i = 0; i < pmkid->NumCandidates; i++) {
1593		PMKID_CANDIDATE *p = &pmkid->CandidateList[i];
1594		wpa_printf(MSG_DEBUG, "NDIS: %d: " MACSTR " Flags 0x%x",
1595			   i, MAC2STR(p->BSSID), (int) p->Flags);
1596		os_memcpy(event.pmkid_candidate.bssid, p->BSSID, ETH_ALEN);
1597		event.pmkid_candidate.index = i;
1598		event.pmkid_candidate.preauth =
1599			p->Flags & NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
1600		wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE,
1601				     &event);
1602	}
1603}
1604
1605
1606/* Called when driver calls NdisMIndicateStatus() with
1607 * NDIS_STATUS_MEDIA_SPECIFIC_INDICATION */
1608void wpa_driver_ndis_event_media_specific(struct wpa_driver_ndis_data *drv,
1609					  const u8 *data, size_t data_len)
1610{
1611	NDIS_802_11_STATUS_INDICATION *status;
1612
1613	if (data == NULL || data_len < sizeof(*status))
1614		return;
1615
1616	wpa_hexdump(MSG_DEBUG, "NDIS: Media Specific Indication",
1617		    data, data_len);
1618
1619	status = (NDIS_802_11_STATUS_INDICATION *) data;
1620	data += sizeof(status);
1621	data_len -= sizeof(status);
1622
1623	switch (status->StatusType) {
1624	case Ndis802_11StatusType_Authentication:
1625		wpa_driver_ndis_event_auth(drv, data, data_len);
1626		break;
1627	case Ndis802_11StatusType_PMKID_CandidateList:
1628		wpa_driver_ndis_event_pmkid(drv, data, data_len);
1629		break;
1630	default:
1631		wpa_printf(MSG_DEBUG, "NDIS: Unknown StatusType %d",
1632			   (int) status->StatusType);
1633		break;
1634	}
1635}
1636
1637
1638/* Called when an adapter is added */
1639void wpa_driver_ndis_event_adapter_arrival(struct wpa_driver_ndis_data *drv)
1640{
1641	union wpa_event_data event;
1642	int i;
1643
1644	wpa_printf(MSG_DEBUG, "NDIS: Notify Adapter Arrival");
1645
1646	for (i = 0; i < 30; i++) {
1647		/* Re-open Packet32/NDISUIO connection */
1648		wpa_driver_ndis_adapter_close(drv);
1649		if (wpa_driver_ndis_adapter_init(drv) < 0 ||
1650		    wpa_driver_ndis_adapter_open(drv) < 0) {
1651			wpa_printf(MSG_DEBUG, "NDIS: Driver re-initialization "
1652				   "(%d) failed", i);
1653			os_sleep(1, 0);
1654		} else {
1655			wpa_printf(MSG_DEBUG, "NDIS: Driver re-initialized");
1656			break;
1657		}
1658	}
1659
1660	os_memset(&event, 0, sizeof(event));
1661	os_strlcpy(event.interface_status.ifname, drv->ifname,
1662		   sizeof(event.interface_status.ifname));
1663	event.interface_status.ievent = EVENT_INTERFACE_ADDED;
1664	wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
1665}
1666
1667
1668/* Called when an adapter is removed */
1669void wpa_driver_ndis_event_adapter_removal(struct wpa_driver_ndis_data *drv)
1670{
1671	union wpa_event_data event;
1672
1673	wpa_printf(MSG_DEBUG, "NDIS: Notify Adapter Removal");
1674	os_memset(&event, 0, sizeof(event));
1675	os_strlcpy(event.interface_status.ifname, drv->ifname,
1676		   sizeof(event.interface_status.ifname));
1677	event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
1678	wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
1679}
1680
1681
1682static void
1683wpa_driver_ndis_get_wpa_capability(struct wpa_driver_ndis_data *drv)
1684{
1685	wpa_printf(MSG_DEBUG, "NDIS: verifying driver WPA capability");
1686
1687	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeWPA) == 0 &&
1688	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeWPA) {
1689		wpa_printf(MSG_DEBUG, "NDIS: WPA key management supported");
1690		drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA;
1691	}
1692
1693	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeWPAPSK) == 0 &&
1694	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeWPAPSK) {
1695		wpa_printf(MSG_DEBUG, "NDIS: WPA-PSK key management "
1696			   "supported");
1697		drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
1698	}
1699
1700	if (ndis_set_encr_status(drv, Ndis802_11Encryption3Enabled) == 0 &&
1701	    ndis_get_encr_status(drv) == Ndis802_11Encryption3KeyAbsent) {
1702		wpa_printf(MSG_DEBUG, "NDIS: CCMP encryption supported");
1703		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
1704	}
1705
1706	if (ndis_set_encr_status(drv, Ndis802_11Encryption2Enabled) == 0 &&
1707	    ndis_get_encr_status(drv) == Ndis802_11Encryption2KeyAbsent) {
1708		wpa_printf(MSG_DEBUG, "NDIS: TKIP encryption supported");
1709		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
1710	}
1711
1712	if (ndis_set_encr_status(drv, Ndis802_11Encryption1Enabled) == 0 &&
1713	    ndis_get_encr_status(drv) == Ndis802_11Encryption1KeyAbsent) {
1714		wpa_printf(MSG_DEBUG, "NDIS: WEP encryption supported");
1715		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40 |
1716			WPA_DRIVER_CAPA_ENC_WEP104;
1717	}
1718
1719	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeShared) == 0 &&
1720	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeShared) {
1721		drv->capa.auth |= WPA_DRIVER_AUTH_SHARED;
1722	}
1723
1724	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeOpen) == 0 &&
1725	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeOpen) {
1726		drv->capa.auth |= WPA_DRIVER_AUTH_OPEN;
1727	}
1728
1729	ndis_set_encr_status(drv, Ndis802_11EncryptionDisabled);
1730
1731	/* Could also verify OID_802_11_ADD_KEY error reporting and
1732	 * support for OID_802_11_ASSOCIATION_INFORMATION. */
1733
1734	if (drv->capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA &&
1735	    drv->capa.enc & (WPA_DRIVER_CAPA_ENC_TKIP |
1736			     WPA_DRIVER_CAPA_ENC_CCMP)) {
1737		wpa_printf(MSG_DEBUG, "NDIS: driver supports WPA");
1738		drv->has_capability = 1;
1739	} else {
1740		wpa_printf(MSG_DEBUG, "NDIS: no WPA support found");
1741	}
1742
1743	wpa_printf(MSG_DEBUG, "NDIS: driver capabilities: key_mgmt 0x%x "
1744		   "enc 0x%x auth 0x%x",
1745		   drv->capa.key_mgmt, drv->capa.enc, drv->capa.auth);
1746}
1747
1748
1749static void wpa_driver_ndis_get_capability(struct wpa_driver_ndis_data *drv)
1750{
1751	char buf[512];
1752	int len;
1753	size_t i;
1754	NDIS_802_11_CAPABILITY *c;
1755
1756	drv->capa.flags = WPA_DRIVER_FLAGS_DRIVER_IE;
1757
1758	len = ndis_get_oid(drv, OID_802_11_CAPABILITY, buf, sizeof(buf));
1759	if (len < 0) {
1760		wpa_driver_ndis_get_wpa_capability(drv);
1761		return;
1762	}
1763
1764	wpa_hexdump(MSG_MSGDUMP, "OID_802_11_CAPABILITY", (u8 *) buf, len);
1765	c = (NDIS_802_11_CAPABILITY *) buf;
1766	if (len < sizeof(*c) || c->Version != 2) {
1767		wpa_printf(MSG_DEBUG, "NDIS: unsupported "
1768			   "OID_802_11_CAPABILITY data");
1769		return;
1770	}
1771	wpa_printf(MSG_DEBUG, "NDIS: Driver supports OID_802_11_CAPABILITY - "
1772		   "NoOfPMKIDs %d NoOfAuthEncrPairs %d",
1773		   (int) c->NoOfPMKIDs,
1774		   (int) c->NoOfAuthEncryptPairsSupported);
1775	drv->has_capability = 1;
1776	drv->no_of_pmkid = c->NoOfPMKIDs;
1777	for (i = 0; i < c->NoOfAuthEncryptPairsSupported; i++) {
1778		NDIS_802_11_AUTHENTICATION_ENCRYPTION *ae;
1779		ae = &c->AuthenticationEncryptionSupported[i];
1780		if ((char *) (ae + 1) > buf + len) {
1781			wpa_printf(MSG_DEBUG, "NDIS: auth/encr pair list "
1782				   "overflow");
1783			break;
1784		}
1785		wpa_printf(MSG_MSGDUMP, "NDIS: %d - auth %d encr %d",
1786			   i, (int) ae->AuthModeSupported,
1787			   (int) ae->EncryptStatusSupported);
1788		switch (ae->AuthModeSupported) {
1789		case Ndis802_11AuthModeOpen:
1790			drv->capa.auth |= WPA_DRIVER_AUTH_OPEN;
1791			break;
1792		case Ndis802_11AuthModeShared:
1793			drv->capa.auth |= WPA_DRIVER_AUTH_SHARED;
1794			break;
1795		case Ndis802_11AuthModeWPA:
1796			drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA;
1797			break;
1798		case Ndis802_11AuthModeWPAPSK:
1799			drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
1800			break;
1801		case Ndis802_11AuthModeWPA2:
1802			drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA2;
1803			break;
1804		case Ndis802_11AuthModeWPA2PSK:
1805			drv->capa.key_mgmt |=
1806				WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
1807			break;
1808		case Ndis802_11AuthModeWPANone:
1809			drv->capa.key_mgmt |=
1810				WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE;
1811			break;
1812		default:
1813			break;
1814		}
1815		switch (ae->EncryptStatusSupported) {
1816		case Ndis802_11Encryption1Enabled:
1817			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40;
1818			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP104;
1819			break;
1820		case Ndis802_11Encryption2Enabled:
1821			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
1822			break;
1823		case Ndis802_11Encryption3Enabled:
1824			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
1825			break;
1826		default:
1827			break;
1828		}
1829	}
1830
1831	wpa_printf(MSG_DEBUG, "NDIS: driver capabilities: key_mgmt 0x%x "
1832		   "enc 0x%x auth 0x%x",
1833		   drv->capa.key_mgmt, drv->capa.enc, drv->capa.auth);
1834}
1835
1836
1837static int wpa_driver_ndis_get_capa(void *priv, struct wpa_driver_capa *capa)
1838{
1839	struct wpa_driver_ndis_data *drv = priv;
1840	if (!drv->has_capability)
1841		return -1;
1842	os_memcpy(capa, &drv->capa, sizeof(*capa));
1843	return 0;
1844}
1845
1846
1847static const char * wpa_driver_ndis_get_ifname(void *priv)
1848{
1849	struct wpa_driver_ndis_data *drv = priv;
1850	return drv->ifname;
1851}
1852
1853
1854static const u8 * wpa_driver_ndis_get_mac_addr(void *priv)
1855{
1856	struct wpa_driver_ndis_data *drv = priv;
1857	return drv->own_addr;
1858}
1859
1860
1861#ifdef _WIN32_WCE
1862
1863#define NDISUIO_MSG_SIZE (sizeof(NDISUIO_DEVICE_NOTIFICATION) + 512)
1864
1865static void ndisuio_notification_receive(void *eloop_data, void *user_ctx)
1866{
1867	struct wpa_driver_ndis_data *drv = eloop_data;
1868	NDISUIO_DEVICE_NOTIFICATION *hdr;
1869	u8 buf[NDISUIO_MSG_SIZE];
1870	DWORD len, flags;
1871
1872	if (!ReadMsgQueue(drv->event_queue, buf, NDISUIO_MSG_SIZE, &len, 0,
1873			  &flags)) {
1874		wpa_printf(MSG_DEBUG, "ndisuio_notification_receive: "
1875			   "ReadMsgQueue failed: %d", (int) GetLastError());
1876		return;
1877	}
1878
1879	if (len < sizeof(NDISUIO_DEVICE_NOTIFICATION)) {
1880		wpa_printf(MSG_DEBUG, "ndisuio_notification_receive: "
1881			   "Too short message (len=%d)", (int) len);
1882		return;
1883	}
1884
1885	hdr = (NDISUIO_DEVICE_NOTIFICATION *) buf;
1886	wpa_printf(MSG_DEBUG, "NDIS: Notification received: len=%d type=0x%x",
1887		   (int) len, hdr->dwNotificationType);
1888
1889	switch (hdr->dwNotificationType) {
1890#ifdef NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL
1891	case NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL:
1892		wpa_printf(MSG_DEBUG, "NDIS: ADAPTER_ARRIVAL");
1893		wpa_driver_ndis_event_adapter_arrival(drv);
1894		break;
1895#endif
1896#ifdef NDISUIO_NOTIFICATION_ADAPTER_REMOVAL
1897	case NDISUIO_NOTIFICATION_ADAPTER_REMOVAL:
1898		wpa_printf(MSG_DEBUG, "NDIS: ADAPTER_REMOVAL");
1899		wpa_driver_ndis_event_adapter_removal(drv);
1900		break;
1901#endif
1902	case NDISUIO_NOTIFICATION_MEDIA_CONNECT:
1903		wpa_printf(MSG_DEBUG, "NDIS: MEDIA_CONNECT");
1904		SetEvent(drv->connected_event);
1905		wpa_driver_ndis_event_connect(drv);
1906		break;
1907	case NDISUIO_NOTIFICATION_MEDIA_DISCONNECT:
1908		ResetEvent(drv->connected_event);
1909		wpa_printf(MSG_DEBUG, "NDIS: MEDIA_DISCONNECT");
1910		wpa_driver_ndis_event_disconnect(drv);
1911		break;
1912	case NDISUIO_NOTIFICATION_MEDIA_SPECIFIC_NOTIFICATION:
1913		wpa_printf(MSG_DEBUG, "NDIS: MEDIA_SPECIFIC_NOTIFICATION");
1914#if _WIN32_WCE == 420 || _WIN32_WCE == 0x420
1915		wpa_driver_ndis_event_media_specific(
1916			drv, hdr->pvStatusBuffer, hdr->uiStatusBufferSize);
1917#else
1918		wpa_driver_ndis_event_media_specific(
1919			drv, ((const u8 *) hdr) + hdr->uiOffsetToStatusBuffer,
1920			(size_t) hdr->uiStatusBufferSize);
1921#endif
1922		break;
1923	default:
1924		wpa_printf(MSG_DEBUG, "NDIS: Unknown notification type 0x%x",
1925			   hdr->dwNotificationType);
1926		break;
1927	}
1928}
1929
1930
1931static void ndisuio_notification_deinit(struct wpa_driver_ndis_data *drv)
1932{
1933	NDISUIO_REQUEST_NOTIFICATION req;
1934
1935	memset(&req, 0, sizeof(req));
1936	req.hMsgQueue = drv->event_queue;
1937	req.dwNotificationTypes = 0;
1938
1939	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_REQUEST_NOTIFICATION,
1940			     &req, sizeof(req), NULL, 0, NULL, NULL)) {
1941		wpa_printf(MSG_INFO, "ndisuio_notification_deinit: "
1942			   "IOCTL_NDISUIO_REQUEST_NOTIFICATION failed: %d",
1943			   (int) GetLastError());
1944	}
1945
1946	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_CANCEL_NOTIFICATION,
1947			     NULL, 0, NULL, 0, NULL, NULL)) {
1948		wpa_printf(MSG_INFO, "ndisuio_notification_deinit: "
1949			   "IOCTL_NDISUIO_CANCEL_NOTIFICATION failed: %d",
1950			   (int) GetLastError());
1951	}
1952
1953	if (drv->event_queue) {
1954		eloop_unregister_event(drv->event_queue,
1955				       sizeof(drv->event_queue));
1956		CloseHandle(drv->event_queue);
1957		drv->event_queue = NULL;
1958	}
1959
1960	if (drv->connected_event) {
1961		CloseHandle(drv->connected_event);
1962		drv->connected_event = NULL;
1963	}
1964}
1965
1966
1967static int ndisuio_notification_init(struct wpa_driver_ndis_data *drv)
1968{
1969	MSGQUEUEOPTIONS opt;
1970	NDISUIO_REQUEST_NOTIFICATION req;
1971
1972	drv->connected_event =
1973		CreateEvent(NULL, TRUE, FALSE, TEXT("WpaSupplicantConnected"));
1974	if (drv->connected_event == NULL) {
1975		wpa_printf(MSG_INFO, "ndisuio_notification_init: "
1976			   "CreateEvent failed: %d",
1977			   (int) GetLastError());
1978		return -1;
1979	}
1980
1981	memset(&opt, 0, sizeof(opt));
1982	opt.dwSize = sizeof(opt);
1983	opt.dwMaxMessages = 5;
1984	opt.cbMaxMessage = NDISUIO_MSG_SIZE;
1985	opt.bReadAccess = TRUE;
1986
1987	drv->event_queue = CreateMsgQueue(NULL, &opt);
1988	if (drv->event_queue == NULL) {
1989		wpa_printf(MSG_INFO, "ndisuio_notification_init: "
1990			   "CreateMsgQueue failed: %d",
1991			   (int) GetLastError());
1992		ndisuio_notification_deinit(drv);
1993		return -1;
1994	}
1995
1996	memset(&req, 0, sizeof(req));
1997	req.hMsgQueue = drv->event_queue;
1998	req.dwNotificationTypes =
1999#ifdef NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL
2000		NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL |
2001#endif
2002#ifdef NDISUIO_NOTIFICATION_ADAPTER_REMOVAL
2003		NDISUIO_NOTIFICATION_ADAPTER_REMOVAL |
2004#endif
2005		NDISUIO_NOTIFICATION_MEDIA_CONNECT |
2006		NDISUIO_NOTIFICATION_MEDIA_DISCONNECT |
2007		NDISUIO_NOTIFICATION_MEDIA_SPECIFIC_NOTIFICATION;
2008
2009	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_REQUEST_NOTIFICATION,
2010			     &req, sizeof(req), NULL, 0, NULL, NULL)) {
2011		wpa_printf(MSG_INFO, "ndisuio_notification_init: "
2012			   "IOCTL_NDISUIO_REQUEST_NOTIFICATION failed: %d",
2013			   (int) GetLastError());
2014		ndisuio_notification_deinit(drv);
2015		return -1;
2016	}
2017
2018	eloop_register_event(drv->event_queue, sizeof(drv->event_queue),
2019			     ndisuio_notification_receive, drv, NULL);
2020
2021	return 0;
2022}
2023#endif /* _WIN32_WCE */
2024
2025
2026static int wpa_driver_ndis_get_names(struct wpa_driver_ndis_data *drv)
2027{
2028#ifdef CONFIG_USE_NDISUIO
2029	NDISUIO_QUERY_BINDING *b;
2030	size_t blen = sizeof(*b) + 1024;
2031	int i, error, found = 0;
2032	DWORD written;
2033	char name[256], desc[256], *dpos;
2034	WCHAR *pos;
2035	size_t j, len, dlen;
2036
2037	b = os_malloc(blen);
2038	if (b == NULL)
2039		return -1;
2040
2041	for (i = 0; ; i++) {
2042		os_memset(b, 0, blen);
2043		b->BindingIndex = i;
2044		if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_QUERY_BINDING,
2045				     b, sizeof(NDISUIO_QUERY_BINDING), b, blen,
2046				     &written, NULL)) {
2047			error = (int) GetLastError();
2048			if (error == ERROR_NO_MORE_ITEMS)
2049				break;
2050			wpa_printf(MSG_DEBUG, "IOCTL_NDISUIO_QUERY_BINDING "
2051				   "failed: %d", error);
2052			break;
2053		}
2054
2055		pos = (WCHAR *) ((char *) b + b->DeviceNameOffset);
2056		len = b->DeviceNameLength;
2057		if (len >= sizeof(name))
2058			len = sizeof(name) - 1;
2059		for (j = 0; j < len; j++)
2060			name[j] = (char) pos[j];
2061		name[len] = '\0';
2062
2063		pos = (WCHAR *) ((char *) b + b->DeviceDescrOffset);
2064		len = b->DeviceDescrLength;
2065		if (len >= sizeof(desc))
2066			len = sizeof(desc) - 1;
2067		for (j = 0; j < len; j++)
2068			desc[j] = (char) pos[j];
2069		desc[len] = '\0';
2070
2071		wpa_printf(MSG_DEBUG, "NDIS: %d - %s - %s", i, name, desc);
2072
2073		if (os_strstr(name, drv->ifname)) {
2074			wpa_printf(MSG_DEBUG, "NDIS: Interface name match");
2075			found = 1;
2076			break;
2077		}
2078
2079		if (os_strncmp(desc, drv->ifname, os_strlen(drv->ifname)) == 0)
2080		{
2081			wpa_printf(MSG_DEBUG, "NDIS: Interface description "
2082				   "match");
2083			found = 1;
2084			break;
2085		}
2086	}
2087
2088	if (!found) {
2089		wpa_printf(MSG_DEBUG, "NDIS: Could not find interface '%s'",
2090			   drv->ifname);
2091		os_free(b);
2092		return -1;
2093	}
2094
2095	os_strlcpy(drv->ifname,
2096		   os_strncmp(name, "\\DEVICE\\", 8) == 0 ? name + 8 : name,
2097		   sizeof(drv->ifname));
2098#ifdef _WIN32_WCE
2099	drv->adapter_name = wpa_strdup_tchar(drv->ifname);
2100	if (drv->adapter_name == NULL) {
2101		wpa_printf(MSG_ERROR, "NDIS: Failed to allocate memory for "
2102			   "adapter name");
2103		os_free(b);
2104		return -1;
2105	}
2106#endif /* _WIN32_WCE */
2107
2108	dpos = os_strstr(desc, " - ");
2109	if (dpos)
2110		dlen = dpos - desc;
2111	else
2112		dlen = os_strlen(desc);
2113	drv->adapter_desc = dup_binstr(desc, dlen);
2114	os_free(b);
2115	if (drv->adapter_desc == NULL)
2116		return -1;
2117
2118	wpa_printf(MSG_DEBUG, "NDIS: Adapter description prefix '%s'",
2119		   drv->adapter_desc);
2120
2121	return 0;
2122#else /* CONFIG_USE_NDISUIO */
2123	PTSTR _names;
2124	char *names, *pos, *pos2;
2125	ULONG len;
2126	BOOLEAN res;
2127#define MAX_ADAPTERS 32
2128	char *name[MAX_ADAPTERS];
2129	char *desc[MAX_ADAPTERS];
2130	int num_name, num_desc, i, found_name, found_desc;
2131	size_t dlen;
2132
2133	wpa_printf(MSG_DEBUG, "NDIS: Packet.dll version: %s",
2134		   PacketGetVersion());
2135
2136	len = 8192;
2137	_names = os_zalloc(len);
2138	if (_names == NULL)
2139		return -1;
2140
2141	res = PacketGetAdapterNames(_names, &len);
2142	if (!res && len > 8192) {
2143		os_free(_names);
2144		_names = os_zalloc(len);
2145		if (_names == NULL)
2146			return -1;
2147		res = PacketGetAdapterNames(_names, &len);
2148	}
2149
2150	if (!res) {
2151		wpa_printf(MSG_ERROR, "NDIS: Failed to get adapter list "
2152			   "(PacketGetAdapterNames)");
2153		os_free(_names);
2154		return -1;
2155	}
2156
2157	names = (char *) _names;
2158	if (names[0] && names[1] == '\0' && names[2] && names[3] == '\0') {
2159		wpa_printf(MSG_DEBUG, "NDIS: Looks like adapter names are in "
2160			   "UNICODE");
2161		/* Convert to ASCII */
2162		pos2 = pos = names;
2163		while (pos2 < names + len) {
2164			if (pos2[0] == '\0' && pos2[1] == '\0' &&
2165			    pos2[2] == '\0' && pos2[3] == '\0') {
2166				pos2 += 4;
2167				break;
2168			}
2169			*pos++ = pos2[0];
2170			pos2 += 2;
2171		}
2172		os_memcpy(pos + 2, names, pos - names);
2173		pos += 2;
2174	} else
2175		pos = names;
2176
2177	num_name = 0;
2178	while (pos < names + len) {
2179		name[num_name] = pos;
2180		while (*pos && pos < names + len)
2181			pos++;
2182		if (pos + 1 >= names + len) {
2183			os_free(names);
2184			return -1;
2185		}
2186		pos++;
2187		num_name++;
2188		if (num_name >= MAX_ADAPTERS) {
2189			wpa_printf(MSG_DEBUG, "NDIS: Too many adapters");
2190			os_free(names);
2191			return -1;
2192		}
2193		if (*pos == '\0') {
2194			wpa_printf(MSG_DEBUG, "NDIS: %d adapter names found",
2195				   num_name);
2196			pos++;
2197			break;
2198		}
2199	}
2200
2201	num_desc = 0;
2202	while (pos < names + len) {
2203		desc[num_desc] = pos;
2204		while (*pos && pos < names + len)
2205			pos++;
2206		if (pos + 1 >= names + len) {
2207			os_free(names);
2208			return -1;
2209		}
2210		pos++;
2211		num_desc++;
2212		if (num_desc >= MAX_ADAPTERS) {
2213			wpa_printf(MSG_DEBUG, "NDIS: Too many adapter "
2214				   "descriptions");
2215			os_free(names);
2216			return -1;
2217		}
2218		if (*pos == '\0') {
2219			wpa_printf(MSG_DEBUG, "NDIS: %d adapter descriptions "
2220				   "found", num_name);
2221			pos++;
2222			break;
2223		}
2224	}
2225
2226	/*
2227	 * Windows 98 with Packet.dll 3.0 alpha3 does not include adapter
2228	 * descriptions. Fill in dummy descriptors to work around this.
2229	 */
2230	while (num_desc < num_name)
2231		desc[num_desc++] = "dummy description";
2232
2233	if (num_name != num_desc) {
2234		wpa_printf(MSG_DEBUG, "NDIS: mismatch in adapter name and "
2235			   "description counts (%d != %d)",
2236			   num_name, num_desc);
2237		os_free(names);
2238		return -1;
2239	}
2240
2241	found_name = found_desc = -1;
2242	for (i = 0; i < num_name; i++) {
2243		wpa_printf(MSG_DEBUG, "NDIS: %d - %s - %s",
2244			   i, name[i], desc[i]);
2245		if (found_name == -1 && os_strstr(name[i], drv->ifname))
2246			found_name = i;
2247		if (found_desc == -1 &&
2248		    os_strncmp(desc[i], drv->ifname, os_strlen(drv->ifname)) ==
2249		    0)
2250			found_desc = i;
2251	}
2252
2253	if (found_name < 0 && found_desc >= 0) {
2254		wpa_printf(MSG_DEBUG, "NDIS: Matched interface '%s' based on "
2255			   "description '%s'",
2256			   name[found_desc], desc[found_desc]);
2257		found_name = found_desc;
2258		os_strlcpy(drv->ifname,
2259			   os_strncmp(name[found_desc], "\\Device\\NPF_", 12)
2260			   == 0 ? name[found_desc] + 12 : name[found_desc],
2261			   sizeof(drv->ifname));
2262	}
2263
2264	if (found_name < 0) {
2265		wpa_printf(MSG_DEBUG, "NDIS: Could not find interface '%s'",
2266			   drv->ifname);
2267		os_free(names);
2268		return -1;
2269	}
2270
2271	i = found_name;
2272	pos = os_strrchr(desc[i], '(');
2273	if (pos) {
2274		dlen = pos - desc[i];
2275		pos--;
2276		if (pos > desc[i] && *pos == ' ')
2277			dlen--;
2278	} else {
2279		dlen = os_strlen(desc[i]);
2280	}
2281	drv->adapter_desc = dup_binstr(desc[i], dlen);
2282	os_free(names);
2283	if (drv->adapter_desc == NULL)
2284		return -1;
2285
2286	wpa_printf(MSG_DEBUG, "NDIS: Adapter description prefix '%s'",
2287		   drv->adapter_desc);
2288
2289	return 0;
2290#endif /* CONFIG_USE_NDISUIO */
2291}
2292
2293
2294#if defined(CONFIG_NATIVE_WINDOWS) || defined(__CYGWIN__)
2295#ifndef _WIN32_WCE
2296/*
2297 * These structures are undocumented for WinXP; only WinCE version is
2298 * documented. These would be included wzcsapi.h if it were available. Some
2299 * changes here have been needed to make the structures match with WinXP SP2.
2300 * It is unclear whether these work with any other version.
2301 */
2302
2303typedef struct {
2304	LPWSTR wszGuid;
2305} INTF_KEY_ENTRY, *PINTF_KEY_ENTRY;
2306
2307typedef struct {
2308	DWORD dwNumIntfs;
2309	PINTF_KEY_ENTRY pIntfs;
2310} INTFS_KEY_TABLE, *PINTFS_KEY_TABLE;
2311
2312typedef struct {
2313	DWORD dwDataLen;
2314	LPBYTE pData;
2315} RAW_DATA, *PRAW_DATA;
2316
2317typedef struct {
2318	LPWSTR wszGuid;
2319	LPWSTR wszDescr;
2320	ULONG ulMediaState;
2321	ULONG ulMediaType;
2322	ULONG ulPhysicalMediaType;
2323	INT nInfraMode;
2324	INT nAuthMode;
2325	INT nWepStatus;
2326#ifndef _WIN32_WCE
2327	u8 pad[2]; /* why is this needed? */
2328#endif /* _WIN32_WCE */
2329	DWORD dwCtlFlags;
2330	DWORD dwCapabilities; /* something added for WinXP SP2(?) */
2331	RAW_DATA rdSSID;
2332	RAW_DATA rdBSSID;
2333	RAW_DATA rdBSSIDList;
2334	RAW_DATA rdStSSIDList;
2335	RAW_DATA rdCtrlData;
2336#ifdef UNDER_CE
2337	BOOL bInitialized;
2338#endif
2339	DWORD nWPAMCastCipher;
2340	/* add some extra buffer for later additions since this interface is
2341	 * far from stable */
2342	u8 later_additions[100];
2343} INTF_ENTRY, *PINTF_ENTRY;
2344
2345#define INTF_ALL 0xffffffff
2346#define INTF_ALL_FLAGS 0x0000ffff
2347#define INTF_CTLFLAGS 0x00000010
2348#define INTFCTL_ENABLED 0x8000
2349#endif /* _WIN32_WCE */
2350
2351
2352#ifdef _WIN32_WCE
2353static int wpa_driver_ndis_rebind_adapter(struct wpa_driver_ndis_data *drv)
2354{
2355	HANDLE ndis;
2356	TCHAR multi[100];
2357	int len;
2358
2359	len = _tcslen(drv->adapter_name);
2360	if (len > 80)
2361		return -1;
2362
2363	ndis = CreateFile(DD_NDIS_DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
2364			  0, NULL, OPEN_EXISTING, 0, NULL);
2365	if (ndis == INVALID_HANDLE_VALUE) {
2366		wpa_printf(MSG_DEBUG, "NDIS: Failed to open file to NDIS "
2367			   "device: %d", (int) GetLastError());
2368		return -1;
2369	}
2370
2371	len++;
2372	memcpy(multi, drv->adapter_name, len * sizeof(TCHAR));
2373	memcpy(&multi[len], TEXT("NDISUIO\0"), 9 * sizeof(TCHAR));
2374	len += 9;
2375
2376	if (!DeviceIoControl(ndis, IOCTL_NDIS_REBIND_ADAPTER,
2377			     multi, len * sizeof(TCHAR), NULL, 0, NULL, NULL))
2378	{
2379		wpa_printf(MSG_DEBUG, "NDIS: IOCTL_NDIS_REBIND_ADAPTER "
2380			   "failed: 0x%x", (int) GetLastError());
2381		wpa_hexdump_ascii(MSG_DEBUG, "NDIS: rebind multi_sz",
2382				  (u8 *) multi, len * sizeof(TCHAR));
2383		CloseHandle(ndis);
2384		return -1;
2385	}
2386
2387	CloseHandle(ndis);
2388
2389	wpa_printf(MSG_DEBUG, "NDIS: Requested NDIS rebind of NDISUIO "
2390		   "protocol");
2391
2392	return 0;
2393}
2394#endif /* _WIN32_WCE */
2395
2396
2397static int wpa_driver_ndis_set_wzc(struct wpa_driver_ndis_data *drv,
2398				   int enable)
2399{
2400#ifdef _WIN32_WCE
2401	HKEY hk, hk2;
2402	LONG ret;
2403	DWORD i, hnd, len;
2404	TCHAR keyname[256], devname[256];
2405
2406#define WZC_DRIVER TEXT("Drivers\\BuiltIn\\ZeroConfig")
2407
2408	if (enable) {
2409		HANDLE h;
2410		h = ActivateDeviceEx(WZC_DRIVER, NULL, 0, NULL);
2411		if (h == INVALID_HANDLE_VALUE || h == 0) {
2412			wpa_printf(MSG_DEBUG, "NDIS: Failed to re-enable WZC "
2413				   "- ActivateDeviceEx failed: %d",
2414				   (int) GetLastError());
2415			return -1;
2416		}
2417
2418		wpa_printf(MSG_DEBUG, "NDIS: WZC re-enabled");
2419		return wpa_driver_ndis_rebind_adapter(drv);
2420	}
2421
2422	/*
2423	 * Unfortunately, just disabling the WZC for an interface is not enough
2424	 * to free NDISUIO for us, so need to disable and unload WZC completely
2425	 * for now when using WinCE with NDISUIO. In addition, must request
2426	 * NDISUIO protocol to be rebound to the adapter in order to free the
2427	 * NDISUIO binding that WZC hold before us.
2428	 */
2429
2430	/* Enumerate HKLM\Drivers\Active\* to find a handle to WZC. */
2431	ret = RegOpenKeyEx(HKEY_LOCAL_MACHINE, DEVLOAD_ACTIVE_KEY, 0, 0, &hk);
2432	if (ret != ERROR_SUCCESS) {
2433		wpa_printf(MSG_DEBUG, "NDIS: RegOpenKeyEx(DEVLOAD_ACTIVE_KEY) "
2434			   "failed: %d %d", (int) ret, (int) GetLastError());
2435		return -1;
2436	}
2437
2438	for (i = 0; ; i++) {
2439		len = sizeof(keyname);
2440		ret = RegEnumKeyEx(hk, i, keyname, &len, NULL, NULL, NULL,
2441				   NULL);
2442		if (ret != ERROR_SUCCESS) {
2443			wpa_printf(MSG_DEBUG, "NDIS: Could not find active "
2444				   "WZC - assuming it is not running.");
2445			RegCloseKey(hk);
2446			return -1;
2447		}
2448
2449		ret = RegOpenKeyEx(hk, keyname, 0, 0, &hk2);
2450		if (ret != ERROR_SUCCESS) {
2451			wpa_printf(MSG_DEBUG, "NDIS: RegOpenKeyEx(active dev) "
2452				   "failed: %d %d",
2453				   (int) ret, (int) GetLastError());
2454			continue;
2455		}
2456
2457		len = sizeof(devname);
2458		ret = RegQueryValueEx(hk2, DEVLOAD_DEVKEY_VALNAME, NULL, NULL,
2459				      (LPBYTE) devname, &len);
2460		if (ret != ERROR_SUCCESS) {
2461			wpa_printf(MSG_DEBUG, "NDIS: RegQueryValueEx("
2462				   "DEVKEY_VALNAME) failed: %d %d",
2463				   (int) ret, (int) GetLastError());
2464			RegCloseKey(hk2);
2465			continue;
2466		}
2467
2468		if (_tcscmp(devname, WZC_DRIVER) == 0)
2469			break;
2470
2471		RegCloseKey(hk2);
2472	}
2473
2474	RegCloseKey(hk);
2475
2476	/* Found WZC - get handle to it. */
2477	len = sizeof(hnd);
2478	ret = RegQueryValueEx(hk2, DEVLOAD_HANDLE_VALNAME, NULL, NULL,
2479			      (PUCHAR) &hnd, &len);
2480	if (ret != ERROR_SUCCESS) {
2481		wpa_printf(MSG_DEBUG, "NDIS: RegQueryValueEx(HANDLE_VALNAME) "
2482			   "failed: %d %d", (int) ret, (int) GetLastError());
2483		RegCloseKey(hk2);
2484		return -1;
2485	}
2486
2487	RegCloseKey(hk2);
2488
2489	/* Deactivate WZC */
2490	if (!DeactivateDevice((HANDLE) hnd)) {
2491		wpa_printf(MSG_DEBUG, "NDIS: DeactivateDevice failed: %d",
2492			   (int) GetLastError());
2493		return -1;
2494	}
2495
2496	wpa_printf(MSG_DEBUG, "NDIS: Disabled WZC temporarily");
2497	drv->wzc_disabled = 1;
2498	return wpa_driver_ndis_rebind_adapter(drv);
2499
2500#else /* _WIN32_WCE */
2501
2502	HMODULE hm;
2503	DWORD (WINAPI *wzc_enum_interf)(LPWSTR pSrvAddr,
2504					PINTFS_KEY_TABLE pIntfs);
2505	DWORD (WINAPI *wzc_query_interf)(LPWSTR pSrvAddr, DWORD dwInFlags,
2506					 PINTF_ENTRY pIntf,
2507					 LPDWORD pdwOutFlags);
2508	DWORD (WINAPI *wzc_set_interf)(LPWSTR pSrvAddr, DWORD dwInFlags,
2509				       PINTF_ENTRY pIntf, LPDWORD pdwOutFlags);
2510	int ret = -1, j;
2511	DWORD res;
2512	INTFS_KEY_TABLE guids;
2513	INTF_ENTRY intf;
2514	char guid[128];
2515	WCHAR *pos;
2516	DWORD flags, i;
2517
2518	hm = LoadLibrary(TEXT("wzcsapi.dll"));
2519	if (hm == NULL) {
2520		wpa_printf(MSG_DEBUG, "NDIS: Failed to load wzcsapi.dll (%u) "
2521			   "- WZC probably not running",
2522			   (unsigned int) GetLastError());
2523		return -1;
2524	}
2525
2526#ifdef _WIN32_WCE
2527	wzc_enum_interf = (void *) GetProcAddressA(hm, "WZCEnumInterfaces");
2528	wzc_query_interf = (void *) GetProcAddressA(hm, "WZCQueryInterface");
2529	wzc_set_interf = (void *) GetProcAddressA(hm, "WZCSetInterface");
2530#else /* _WIN32_WCE */
2531	wzc_enum_interf = (void *) GetProcAddress(hm, "WZCEnumInterfaces");
2532	wzc_query_interf = (void *) GetProcAddress(hm, "WZCQueryInterface");
2533	wzc_set_interf = (void *) GetProcAddress(hm, "WZCSetInterface");
2534#endif /* _WIN32_WCE */
2535
2536	if (wzc_enum_interf == NULL || wzc_query_interf == NULL ||
2537	    wzc_set_interf == NULL) {
2538		wpa_printf(MSG_DEBUG, "NDIS: WZCEnumInterfaces, "
2539			   "WZCQueryInterface, or WZCSetInterface not found "
2540			   "in wzcsapi.dll");
2541		goto fail;
2542	}
2543
2544	os_memset(&guids, 0, sizeof(guids));
2545	res = wzc_enum_interf(NULL, &guids);
2546	if (res != 0) {
2547		wpa_printf(MSG_DEBUG, "NDIS: WZCEnumInterfaces failed: %d; "
2548			   "WZC service is apparently not running",
2549			   (int) res);
2550		goto fail;
2551	}
2552
2553	wpa_printf(MSG_DEBUG, "NDIS: WZCEnumInterfaces: %d interfaces",
2554		   (int) guids.dwNumIntfs);
2555
2556	for (i = 0; i < guids.dwNumIntfs; i++) {
2557		pos = guids.pIntfs[i].wszGuid;
2558		for (j = 0; j < sizeof(guid); j++) {
2559			guid[j] = (char) *pos;
2560			if (*pos == 0)
2561				break;
2562			pos++;
2563		}
2564		guid[sizeof(guid) - 1] = '\0';
2565		wpa_printf(MSG_DEBUG, "NDIS: intfs %d GUID '%s'",
2566			   (int) i, guid);
2567		if (os_strstr(drv->ifname, guid) == NULL)
2568			continue;
2569
2570		wpa_printf(MSG_DEBUG, "NDIS: Current interface found from "
2571			   "WZC");
2572		break;
2573	}
2574
2575	if (i >= guids.dwNumIntfs) {
2576		wpa_printf(MSG_DEBUG, "NDIS: Current interface not found from "
2577			   "WZC");
2578		goto fail;
2579	}
2580
2581	os_memset(&intf, 0, sizeof(intf));
2582	intf.wszGuid = guids.pIntfs[i].wszGuid;
2583	/* Set flags to verify that the structure has not changed. */
2584	intf.dwCtlFlags = -1;
2585	flags = 0;
2586	res = wzc_query_interf(NULL, INTFCTL_ENABLED, &intf, &flags);
2587	if (res != 0) {
2588		wpa_printf(MSG_DEBUG, "NDIS: Could not query flags for the "
2589			   "WZC interface: %d (0x%x)",
2590			   (int) res, (int) res);
2591		wpa_printf(MSG_DEBUG, "NDIS: GetLastError: %u",
2592			   (unsigned int) GetLastError());
2593		goto fail;
2594	}
2595
2596	wpa_printf(MSG_DEBUG, "NDIS: WZC interface flags 0x%x dwCtlFlags 0x%x",
2597		   (int) flags, (int) intf.dwCtlFlags);
2598
2599	if (intf.dwCtlFlags == -1) {
2600		wpa_printf(MSG_DEBUG, "NDIS: Looks like wzcsapi has changed "
2601			   "again - could not disable WZC");
2602		wpa_hexdump(MSG_MSGDUMP, "NDIS: intf",
2603			    (u8 *) &intf, sizeof(intf));
2604		goto fail;
2605	}
2606
2607	if (enable) {
2608		if (!(intf.dwCtlFlags & INTFCTL_ENABLED)) {
2609			wpa_printf(MSG_DEBUG, "NDIS: Enabling WZC for this "
2610				   "interface");
2611			intf.dwCtlFlags |= INTFCTL_ENABLED;
2612			res = wzc_set_interf(NULL, INTFCTL_ENABLED, &intf,
2613					     &flags);
2614			if (res != 0) {
2615				wpa_printf(MSG_DEBUG, "NDIS: Failed to enable "
2616					   "WZC: %d (0x%x)",
2617					   (int) res, (int) res);
2618				wpa_printf(MSG_DEBUG, "NDIS: GetLastError: %u",
2619					   (unsigned int) GetLastError());
2620				goto fail;
2621			}
2622			wpa_printf(MSG_DEBUG, "NDIS: Re-enabled WZC for this "
2623				   "interface");
2624			drv->wzc_disabled = 0;
2625		}
2626	} else {
2627		if (intf.dwCtlFlags & INTFCTL_ENABLED) {
2628			wpa_printf(MSG_DEBUG, "NDIS: Disabling WZC for this "
2629				   "interface");
2630			intf.dwCtlFlags &= ~INTFCTL_ENABLED;
2631			res = wzc_set_interf(NULL, INTFCTL_ENABLED, &intf,
2632					     &flags);
2633			if (res != 0) {
2634				wpa_printf(MSG_DEBUG, "NDIS: Failed to "
2635					   "disable WZC: %d (0x%x)",
2636					   (int) res, (int) res);
2637				wpa_printf(MSG_DEBUG, "NDIS: GetLastError: %u",
2638					   (unsigned int) GetLastError());
2639				goto fail;
2640			}
2641			wpa_printf(MSG_DEBUG, "NDIS: Disabled WZC temporarily "
2642				   "for this interface");
2643			drv->wzc_disabled = 1;
2644		} else {
2645			wpa_printf(MSG_DEBUG, "NDIS: WZC was not enabled for "
2646				   "this interface");
2647		}
2648	}
2649
2650	ret = 0;
2651
2652fail:
2653	FreeLibrary(hm);
2654
2655	return ret;
2656#endif /* _WIN32_WCE */
2657}
2658
2659#else /* CONFIG_NATIVE_WINDOWS || __CYGWIN__ */
2660
2661static int wpa_driver_ndis_set_wzc(struct wpa_driver_ndis_data *drv,
2662				   int enable)
2663{
2664	return 0;
2665}
2666
2667#endif /* CONFIG_NATIVE_WINDOWS || __CYGWIN__ */
2668
2669
2670#ifdef CONFIG_USE_NDISUIO
2671/*
2672 * l2_packet_ndis.c is sharing the same handle to NDISUIO, so we must be able
2673 * to export this handle. This is somewhat ugly, but there is no better
2674 * mechanism available to pass data from driver interface to l2_packet wrapper.
2675 */
2676static HANDLE driver_ndis_ndisuio_handle = INVALID_HANDLE_VALUE;
2677
2678HANDLE driver_ndis_get_ndisuio_handle(void)
2679{
2680	return driver_ndis_ndisuio_handle;
2681}
2682#endif /* CONFIG_USE_NDISUIO */
2683
2684
2685static int wpa_driver_ndis_adapter_init(struct wpa_driver_ndis_data *drv)
2686{
2687#ifdef CONFIG_USE_NDISUIO
2688#ifndef _WIN32_WCE
2689#define NDISUIO_DEVICE_NAME TEXT("\\\\.\\\\Ndisuio")
2690	DWORD written;
2691#endif /* _WIN32_WCE */
2692	drv->ndisuio = CreateFile(NDISUIO_DEVICE_NAME,
2693				  GENERIC_READ | GENERIC_WRITE, 0, NULL,
2694				  OPEN_EXISTING,
2695				  FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
2696				  INVALID_HANDLE_VALUE);
2697	if (drv->ndisuio == INVALID_HANDLE_VALUE) {
2698		wpa_printf(MSG_ERROR, "NDIS: Failed to open connection to "
2699			   "NDISUIO: %d", (int) GetLastError());
2700		return -1;
2701	}
2702	driver_ndis_ndisuio_handle = drv->ndisuio;
2703
2704#ifndef _WIN32_WCE
2705	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_BIND_WAIT, NULL, 0,
2706			     NULL, 0, &written, NULL)) {
2707		wpa_printf(MSG_ERROR, "NDIS: IOCTL_NDISUIO_BIND_WAIT failed: "
2708			   "%d", (int) GetLastError());
2709		CloseHandle(drv->ndisuio);
2710		drv->ndisuio = INVALID_HANDLE_VALUE;
2711		return -1;
2712	}
2713#endif /* _WIN32_WCE */
2714
2715	return 0;
2716#else /* CONFIG_USE_NDISUIO */
2717	return 0;
2718#endif /* CONFIG_USE_NDISUIO */
2719}
2720
2721
2722static int wpa_driver_ndis_adapter_open(struct wpa_driver_ndis_data *drv)
2723{
2724#ifdef CONFIG_USE_NDISUIO
2725	DWORD written;
2726#define MAX_NDIS_DEVICE_NAME_LEN 256
2727	WCHAR ifname[MAX_NDIS_DEVICE_NAME_LEN];
2728	size_t len, i, pos;
2729	const char *prefix = "\\DEVICE\\";
2730
2731#ifdef _WIN32_WCE
2732	pos = 0;
2733#else /* _WIN32_WCE */
2734	pos = 8;
2735#endif /* _WIN32_WCE */
2736	len = pos + os_strlen(drv->ifname);
2737	if (len >= MAX_NDIS_DEVICE_NAME_LEN)
2738		return -1;
2739	for (i = 0; i < pos; i++)
2740		ifname[i] = (WCHAR) prefix[i];
2741	for (i = pos; i < len; i++)
2742		ifname[i] = (WCHAR) drv->ifname[i - pos];
2743	ifname[i] = L'\0';
2744
2745	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_OPEN_DEVICE,
2746			     ifname, len * sizeof(WCHAR), NULL, 0, &written,
2747			     NULL)) {
2748		wpa_printf(MSG_ERROR, "NDIS: IOCTL_NDISUIO_OPEN_DEVICE "
2749			   "failed: %d", (int) GetLastError());
2750		wpa_hexdump_ascii(MSG_DEBUG, "NDIS: ifname",
2751				  (const u8 *) ifname, len * sizeof(WCHAR));
2752		CloseHandle(drv->ndisuio);
2753		drv->ndisuio = INVALID_HANDLE_VALUE;
2754		return -1;
2755	}
2756
2757	wpa_printf(MSG_DEBUG, "NDIS: Opened NDISUIO device successfully");
2758
2759	return 0;
2760#else /* CONFIG_USE_NDISUIO */
2761	char ifname[128];
2762	os_snprintf(ifname, sizeof(ifname), "\\Device\\NPF_%s", drv->ifname);
2763	drv->adapter = PacketOpenAdapter(ifname);
2764	if (drv->adapter == NULL) {
2765		wpa_printf(MSG_DEBUG, "NDIS: PacketOpenAdapter failed for "
2766			   "'%s'", ifname);
2767		return -1;
2768	}
2769	return 0;
2770#endif /* CONFIG_USE_NDISUIO */
2771}
2772
2773
2774static void wpa_driver_ndis_adapter_close(struct wpa_driver_ndis_data *drv)
2775{
2776#ifdef CONFIG_USE_NDISUIO
2777	driver_ndis_ndisuio_handle = INVALID_HANDLE_VALUE;
2778	if (drv->ndisuio != INVALID_HANDLE_VALUE)
2779		CloseHandle(drv->ndisuio);
2780#else /* CONFIG_USE_NDISUIO */
2781	if (drv->adapter)
2782		PacketCloseAdapter(drv->adapter);
2783#endif /* CONFIG_USE_NDISUIO */
2784}
2785
2786
2787static int ndis_add_multicast(struct wpa_driver_ndis_data *drv)
2788{
2789	if (ndis_set_oid(drv, OID_802_3_MULTICAST_LIST,
2790			 (const char *) pae_group_addr, ETH_ALEN) < 0) {
2791		wpa_printf(MSG_DEBUG, "NDIS: Failed to add PAE group address "
2792			   "to the multicast list");
2793		return -1;
2794	}
2795
2796	return 0;
2797}
2798
2799
2800static void * wpa_driver_ndis_init(void *ctx, const char *ifname)
2801{
2802	struct wpa_driver_ndis_data *drv;
2803	u32 mode;
2804
2805	drv = os_zalloc(sizeof(*drv));
2806	if (drv == NULL)
2807		return NULL;
2808	drv->ctx = ctx;
2809	/*
2810	 * Compatibility code to strip possible prefix from the GUID. Previous
2811	 * versions include \Device\NPF_ prefix for all names, but the internal
2812	 * interface name is now only the GUI. Both Packet32 and NDISUIO
2813	 * prefixes are supported.
2814	 */
2815	if (os_strncmp(ifname, "\\Device\\NPF_", 12) == 0)
2816		ifname += 12;
2817	else if (os_strncmp(ifname, "\\DEVICE\\", 8) == 0)
2818		ifname += 8;
2819	os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
2820
2821	if (wpa_driver_ndis_adapter_init(drv) < 0) {
2822		os_free(drv);
2823		return NULL;
2824	}
2825
2826	if (wpa_driver_ndis_get_names(drv) < 0) {
2827		wpa_driver_ndis_adapter_close(drv);
2828		os_free(drv);
2829		return NULL;
2830	}
2831
2832	wpa_driver_ndis_set_wzc(drv, 0);
2833
2834	if (wpa_driver_ndis_adapter_open(drv) < 0) {
2835		wpa_driver_ndis_adapter_close(drv);
2836		os_free(drv);
2837		return NULL;
2838	}
2839
2840	if (ndis_get_oid(drv, OID_802_3_CURRENT_ADDRESS,
2841			 (char *) drv->own_addr, ETH_ALEN) < 0) {
2842		wpa_printf(MSG_DEBUG, "NDIS: Get OID_802_3_CURRENT_ADDRESS "
2843			   "failed");
2844		wpa_driver_ndis_adapter_close(drv);
2845		os_free(drv);
2846		return NULL;
2847	}
2848	wpa_driver_ndis_get_capability(drv);
2849
2850	/* Make sure that the driver does not have any obsolete PMKID entries.
2851	 */
2852	wpa_driver_ndis_flush_pmkid(drv);
2853
2854	/*
2855	 * Disconnect to make sure that driver re-associates if it was
2856	 * connected.
2857	 */
2858	wpa_driver_ndis_disconnect(drv);
2859
2860	eloop_register_timeout(1, 0, wpa_driver_ndis_poll_timeout, drv, NULL);
2861
2862#ifdef CONFIG_NDIS_EVENTS_INTEGRATED
2863	drv->events = ndis_events_init(&drv->events_pipe, &drv->event_avail,
2864				       drv->ifname, drv->adapter_desc);
2865	if (drv->events == NULL) {
2866		wpa_driver_ndis_deinit(drv);
2867		return NULL;
2868	}
2869	eloop_register_event(drv->event_avail, sizeof(drv->event_avail),
2870			     wpa_driver_ndis_event_pipe_cb, drv, NULL);
2871#endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
2872
2873#ifdef _WIN32_WCE
2874	if (ndisuio_notification_init(drv) < 0) {
2875		wpa_driver_ndis_deinit(drv);
2876		return NULL;
2877	}
2878#endif /* _WIN32_WCE */
2879
2880	/* Set mode here in case card was configured for ad-hoc mode
2881	 * previously. */
2882	mode = Ndis802_11Infrastructure;
2883	if (ndis_set_oid(drv, OID_802_11_INFRASTRUCTURE_MODE,
2884			 (char *) &mode, sizeof(mode)) < 0) {
2885		char buf[8];
2886		int res;
2887		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
2888			   "OID_802_11_INFRASTRUCTURE_MODE (%d)",
2889			   (int) mode);
2890		/* Try to continue anyway */
2891
2892		res = ndis_get_oid(drv, OID_DOT11_CURRENT_OPERATION_MODE, buf,
2893				   sizeof(buf));
2894		if (res > 0) {
2895			wpa_printf(MSG_INFO, "NDIS: The driver seems to use "
2896				   "Native 802.11 OIDs. These are not yet "
2897				   "fully supported.");
2898			drv->native80211 = 1;
2899		} else if (!drv->has_capability || drv->capa.enc == 0) {
2900			/*
2901			 * Note: This will also happen with NDIS 6 drivers with
2902			 * Vista.
2903			 */
2904			wpa_printf(MSG_DEBUG, "NDIS: Driver did not provide "
2905				   "any wireless capabilities - assume it is "
2906				   "a wired interface");
2907			drv->wired = 1;
2908			drv->capa.flags |= WPA_DRIVER_FLAGS_WIRED;
2909			drv->has_capability = 1;
2910			ndis_add_multicast(drv);
2911		}
2912	}
2913
2914	return drv;
2915}
2916
2917
2918static void wpa_driver_ndis_deinit(void *priv)
2919{
2920	struct wpa_driver_ndis_data *drv = priv;
2921
2922#ifdef CONFIG_NDIS_EVENTS_INTEGRATED
2923	if (drv->events) {
2924		eloop_unregister_event(drv->event_avail,
2925				       sizeof(drv->event_avail));
2926		ndis_events_deinit(drv->events);
2927	}
2928#endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
2929
2930#ifdef _WIN32_WCE
2931	ndisuio_notification_deinit(drv);
2932#endif /* _WIN32_WCE */
2933
2934	eloop_cancel_timeout(wpa_driver_ndis_scan_timeout, drv, drv->ctx);
2935	eloop_cancel_timeout(wpa_driver_ndis_poll_timeout, drv, NULL);
2936	wpa_driver_ndis_flush_pmkid(drv);
2937	wpa_driver_ndis_disconnect(drv);
2938	if (wpa_driver_ndis_radio_off(drv) < 0) {
2939		wpa_printf(MSG_DEBUG, "NDIS: failed to disassociate and turn "
2940			   "radio off");
2941	}
2942
2943	wpa_driver_ndis_adapter_close(drv);
2944
2945	if (drv->wzc_disabled)
2946		wpa_driver_ndis_set_wzc(drv, 1);
2947
2948#ifdef _WIN32_WCE
2949	os_free(drv->adapter_name);
2950#endif /* _WIN32_WCE */
2951	os_free(drv->adapter_desc);
2952	os_free(drv);
2953}
2954
2955
2956static struct wpa_interface_info *
2957wpa_driver_ndis_get_interfaces(void *global_priv)
2958{
2959	struct wpa_interface_info *iface = NULL, *niface;
2960
2961#ifdef CONFIG_USE_NDISUIO
2962	NDISUIO_QUERY_BINDING *b;
2963	size_t blen = sizeof(*b) + 1024;
2964	int i, error;
2965	DWORD written;
2966	char name[256], desc[256];
2967	WCHAR *pos;
2968	size_t j, len;
2969	HANDLE ndisuio;
2970
2971	ndisuio = CreateFile(NDISUIO_DEVICE_NAME,
2972			     GENERIC_READ | GENERIC_WRITE, 0, NULL,
2973			     OPEN_EXISTING,
2974			     FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
2975			     INVALID_HANDLE_VALUE);
2976	if (ndisuio == INVALID_HANDLE_VALUE) {
2977		wpa_printf(MSG_ERROR, "NDIS: Failed to open connection to "
2978			   "NDISUIO: %d", (int) GetLastError());
2979		return NULL;
2980	}
2981
2982#ifndef _WIN32_WCE
2983	if (!DeviceIoControl(ndisuio, IOCTL_NDISUIO_BIND_WAIT, NULL, 0,
2984			     NULL, 0, &written, NULL)) {
2985		wpa_printf(MSG_ERROR, "NDIS: IOCTL_NDISUIO_BIND_WAIT failed: "
2986			   "%d", (int) GetLastError());
2987		CloseHandle(ndisuio);
2988		return NULL;
2989	}
2990#endif /* _WIN32_WCE */
2991
2992	b = os_malloc(blen);
2993	if (b == NULL) {
2994		CloseHandle(ndisuio);
2995		return NULL;
2996	}
2997
2998	for (i = 0; ; i++) {
2999		os_memset(b, 0, blen);
3000		b->BindingIndex = i;
3001		if (!DeviceIoControl(ndisuio, IOCTL_NDISUIO_QUERY_BINDING,
3002				     b, sizeof(NDISUIO_QUERY_BINDING), b, blen,
3003				     &written, NULL)) {
3004			error = (int) GetLastError();
3005			if (error == ERROR_NO_MORE_ITEMS)
3006				break;
3007			wpa_printf(MSG_DEBUG, "IOCTL_NDISUIO_QUERY_BINDING "
3008				   "failed: %d", error);
3009			break;
3010		}
3011
3012		pos = (WCHAR *) ((char *) b + b->DeviceNameOffset);
3013		len = b->DeviceNameLength;
3014		if (len >= sizeof(name))
3015			len = sizeof(name) - 1;
3016		for (j = 0; j < len; j++)
3017			name[j] = (char) pos[j];
3018		name[len] = '\0';
3019
3020		pos = (WCHAR *) ((char *) b + b->DeviceDescrOffset);
3021		len = b->DeviceDescrLength;
3022		if (len >= sizeof(desc))
3023			len = sizeof(desc) - 1;
3024		for (j = 0; j < len; j++)
3025			desc[j] = (char) pos[j];
3026		desc[len] = '\0';
3027
3028		wpa_printf(MSG_DEBUG, "NDIS: %d - %s - %s", i, name, desc);
3029
3030		niface = os_zalloc(sizeof(*niface));
3031		if (niface == NULL)
3032			break;
3033		niface->drv_name = "ndis";
3034		if (os_strncmp(name, "\\DEVICE\\", 8) == 0)
3035			niface->ifname = os_strdup(name + 8);
3036		else
3037			niface->ifname = os_strdup(name);
3038		if (niface->ifname == NULL) {
3039			os_free(niface);
3040			break;
3041		}
3042		niface->desc = os_strdup(desc);
3043		niface->next = iface;
3044		iface = niface;
3045	}
3046
3047	os_free(b);
3048	CloseHandle(ndisuio);
3049#else /* CONFIG_USE_NDISUIO */
3050	PTSTR _names;
3051	char *names, *pos, *pos2;
3052	ULONG len;
3053	BOOLEAN res;
3054	char *name[MAX_ADAPTERS];
3055	char *desc[MAX_ADAPTERS];
3056	int num_name, num_desc, i;
3057
3058	wpa_printf(MSG_DEBUG, "NDIS: Packet.dll version: %s",
3059		   PacketGetVersion());
3060
3061	len = 8192;
3062	_names = os_zalloc(len);
3063	if (_names == NULL)
3064		return NULL;
3065
3066	res = PacketGetAdapterNames(_names, &len);
3067	if (!res && len > 8192) {
3068		os_free(_names);
3069		_names = os_zalloc(len);
3070		if (_names == NULL)
3071			return NULL;
3072		res = PacketGetAdapterNames(_names, &len);
3073	}
3074
3075	if (!res) {
3076		wpa_printf(MSG_ERROR, "NDIS: Failed to get adapter list "
3077			   "(PacketGetAdapterNames)");
3078		os_free(_names);
3079		return NULL;
3080	}
3081
3082	names = (char *) _names;
3083	if (names[0] && names[1] == '\0' && names[2] && names[3] == '\0') {
3084		wpa_printf(MSG_DEBUG, "NDIS: Looks like adapter names are in "
3085			   "UNICODE");
3086		/* Convert to ASCII */
3087		pos2 = pos = names;
3088		while (pos2 < names + len) {
3089			if (pos2[0] == '\0' && pos2[1] == '\0' &&
3090			    pos2[2] == '\0' && pos2[3] == '\0') {
3091				pos2 += 4;
3092				break;
3093			}
3094			*pos++ = pos2[0];
3095			pos2 += 2;
3096		}
3097		os_memcpy(pos + 2, names, pos - names);
3098		pos += 2;
3099	} else
3100		pos = names;
3101
3102	num_name = 0;
3103	while (pos < names + len) {
3104		name[num_name] = pos;
3105		while (*pos && pos < names + len)
3106			pos++;
3107		if (pos + 1 >= names + len) {
3108			os_free(names);
3109			return NULL;
3110		}
3111		pos++;
3112		num_name++;
3113		if (num_name >= MAX_ADAPTERS) {
3114			wpa_printf(MSG_DEBUG, "NDIS: Too many adapters");
3115			os_free(names);
3116			return NULL;
3117		}
3118		if (*pos == '\0') {
3119			wpa_printf(MSG_DEBUG, "NDIS: %d adapter names found",
3120				   num_name);
3121			pos++;
3122			break;
3123		}
3124	}
3125
3126	num_desc = 0;
3127	while (pos < names + len) {
3128		desc[num_desc] = pos;
3129		while (*pos && pos < names + len)
3130			pos++;
3131		if (pos + 1 >= names + len) {
3132			os_free(names);
3133			return NULL;
3134		}
3135		pos++;
3136		num_desc++;
3137		if (num_desc >= MAX_ADAPTERS) {
3138			wpa_printf(MSG_DEBUG, "NDIS: Too many adapter "
3139				   "descriptions");
3140			os_free(names);
3141			return NULL;
3142		}
3143		if (*pos == '\0') {
3144			wpa_printf(MSG_DEBUG, "NDIS: %d adapter descriptions "
3145				   "found", num_name);
3146			pos++;
3147			break;
3148		}
3149	}
3150
3151	/*
3152	 * Windows 98 with Packet.dll 3.0 alpha3 does not include adapter
3153	 * descriptions. Fill in dummy descriptors to work around this.
3154	 */
3155	while (num_desc < num_name)
3156		desc[num_desc++] = "dummy description";
3157
3158	if (num_name != num_desc) {
3159		wpa_printf(MSG_DEBUG, "NDIS: mismatch in adapter name and "
3160			   "description counts (%d != %d)",
3161			   num_name, num_desc);
3162		os_free(names);
3163		return NULL;
3164	}
3165
3166	for (i = 0; i < num_name; i++) {
3167		niface = os_zalloc(sizeof(*niface));
3168		if (niface == NULL)
3169			break;
3170		niface->drv_name = "ndis";
3171		if (os_strncmp(name[i], "\\Device\\NPF_", 12) == 0)
3172			niface->ifname = os_strdup(name[i] + 12);
3173		else
3174			niface->ifname = os_strdup(name[i]);
3175		if (niface->ifname == NULL) {
3176			os_free(niface);
3177			break;
3178		}
3179		niface->desc = os_strdup(desc[i]);
3180		niface->next = iface;
3181		iface = niface;
3182	}
3183
3184#endif /* CONFIG_USE_NDISUIO */
3185
3186	return iface;
3187}
3188
3189
3190static const char *ndis_drv_name = "ndis";
3191static const char *ndis_drv_desc = "Windows NDIS driver";
3192
3193struct wpa_driver_ops wpa_driver_ndis_ops;
3194
3195void driver_ndis_init_ops(void)
3196{
3197	os_memset(&wpa_driver_ndis_ops, 0, sizeof(wpa_driver_ndis_ops));
3198	wpa_driver_ndis_ops.name = ndis_drv_name;
3199	wpa_driver_ndis_ops.desc = ndis_drv_desc;
3200	wpa_driver_ndis_ops.get_bssid = wpa_driver_ndis_get_bssid;
3201	wpa_driver_ndis_ops.get_ssid = wpa_driver_ndis_get_ssid;
3202	wpa_driver_ndis_ops.set_key = wpa_driver_ndis_set_key;
3203	wpa_driver_ndis_ops.init = wpa_driver_ndis_init;
3204	wpa_driver_ndis_ops.deinit = wpa_driver_ndis_deinit;
3205	wpa_driver_ndis_ops.deauthenticate = wpa_driver_ndis_deauthenticate;
3206	wpa_driver_ndis_ops.associate = wpa_driver_ndis_associate;
3207	wpa_driver_ndis_ops.add_pmkid = wpa_driver_ndis_add_pmkid;
3208	wpa_driver_ndis_ops.remove_pmkid = wpa_driver_ndis_remove_pmkid;
3209	wpa_driver_ndis_ops.flush_pmkid = wpa_driver_ndis_flush_pmkid;
3210	wpa_driver_ndis_ops.get_capa = wpa_driver_ndis_get_capa;
3211	wpa_driver_ndis_ops.poll = wpa_driver_ndis_poll;
3212	wpa_driver_ndis_ops.get_ifname = wpa_driver_ndis_get_ifname;
3213	wpa_driver_ndis_ops.get_mac_addr = wpa_driver_ndis_get_mac_addr;
3214	wpa_driver_ndis_ops.get_scan_results2 =
3215		wpa_driver_ndis_get_scan_results;
3216	wpa_driver_ndis_ops.get_interfaces = wpa_driver_ndis_get_interfaces;
3217	wpa_driver_ndis_ops.scan2 = wpa_driver_ndis_scan;
3218}
3219