wlan: Validate and Rectify RSN IE in probe response frame.

There are some Access points that have not included the
capability field in the RSN ie's though the length for the
RSN ie's indicate for the presence of this field. This shall
result in the next byte after this RSN ie as the capability
field , thus resulting in the improper interpretation of this
field , the end result being a failure to connect to such AP's.
This commit introduces a work around to interop with such AP's
by appending the capability field with 0 value to the obtained ie.
It updates MPDU length of received RxPacket based on addition of
RSN Capability if it is missing in Probe response.

Change-Id: Ic599c8bdb19e368fefb13293499451e7ab38d517
CRs-Fixed: 667983

3 files changed, 93 insertions, 8 deletions

diff --git a/CORE/MAC/src/include/parserApi.h b/CORE/MAC/src/include/parserApi.h
index 03fa7c5fe676..dd75d5e7b123 100644
--- a/CORE/MAC/src/include/parserApi.h
+++ b/CORE/MAC/src/include/parserApi.h
@@ -71,6 +71,13 @@ struct sAvoidChannelIE {
 };
 #endif /* FEATURE_AP_MCC_CH_AVOIDANCE */
 
+#define SIZE_OF_FIXED_PARAM ( 12 )
+#define SIZE_OF_TAG_PARAM_NUM  ( 1 )
+#define SIZE_OF_TAG_PARAM_LEN ( 1 )
+#define RSNIEID ( 0x30 )
+#define RSNIE_CAPABILITY_LEN ( 2 )
+#define DEFAULT_RSNIE_CAP_VAL ( 0x00 )
+
 typedef struct sSirCountryInformation
 {
     tANI_U8 countryString[COUNTRY_STRING_LENGTH];
@@ -537,8 +544,6 @@ sirConvertQosMapConfigureFrame2Struct(tpAniSirGlobal    pMac,
                           tANI_U32               nFrame,
                           tSirQosMapSet      *pQosMapSet);
 
-
-
 /**
  * \brief Populated a tDot11fFfCapabilities
  *
@@ -996,3 +1001,8 @@ sap_auth_offload_update_rsn_ie(tpAniSirGlobal pmac,
 
 tSirRetStatus PopulateDot11fTimingAdvertFrame(tpAniSirGlobal pMac,
     tDot11fTimingAdvertisementFrame *frame);
+
+tSirRetStatus sirvalidateandrectifyies(tpAniSirGlobal pMac,
+                                       tANI_U8 *pMgmtFrame,
+                                       tANI_U32 nFrameBytes,
+                                       tANI_U32 *nMissingRsnBytes);
diff --git a/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c b/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c
index 796dab3bdae7..79853ced64d6 100644
--- a/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessProbeRspFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -53,13 +53,32 @@
 #include "parserApi.h"
 
 tSirRetStatus
-limValidateIEInformationInProbeRspFrame (tANI_U8 *pRxPacketInfo)
+limValidateIEInformationInProbeRspFrame (tpAniSirGlobal pMac,
+                                         tANI_U8 *pRxPacketInfo)
 {
    tSirRetStatus       status = eSIR_SUCCESS;
-
+   tANI_U8             *pFrame;
+   tANI_U32            nFrame;
+   tANI_U32            nMissingRsnBytes;
+
+   /*
+    * Validate a Probe response frame for malformed frame.
+    * If the frame is malformed then do not consider as it
+    * may cause problem fetching wrong IE values
+    */
    if (WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo) < (SIR_MAC_B_PR_SSID_OFFSET + SIR_MAC_MIN_IE_LEN))
    {
-      status = eSIR_FAILURE;
+      return eSIR_FAILURE;
+   }
+
+   pFrame = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
+   nFrame = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
+   nMissingRsnBytes = 0;
+
+   status = sirvalidateandrectifyies(pMac, pFrame, nFrame, &nMissingRsnBytes);
+   if ( status == eSIR_SUCCESS )
+   {
+       WDA_GET_RX_MPDU_LEN(pRxPacketInfo) += nMissingRsnBytes;
    }
 
    return status;
@@ -136,7 +155,8 @@ limProcessProbeRspFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession
    }
 
    // Validate IE information before processing Probe Response Frame
-   if (limValidateIEInformationInProbeRspFrame(pRxPacketInfo) != eSIR_SUCCESS)
+   if (limValidateIEInformationInProbeRspFrame(pMac, pRxPacketInfo)
+       != eSIR_SUCCESS)
    {
        PELOG1(limLog(pMac, LOG1,
                  FL("Parse error ProbeResponse, length=%d"), frameLen);)
@@ -370,7 +390,8 @@ limProcessProbeRspFrameNoSession(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo)
     }
 #endif
      // Validate IE information before processing Probe Response Frame
-    if (limValidateIEInformationInProbeRspFrame(pRxPacketInfo) != eSIR_SUCCESS)
+    if (limValidateIEInformationInProbeRspFrame(pMac, pRxPacketInfo)
+        != eSIR_SUCCESS)
     {
        PELOG1(limLog(pMac, LOG1,FL("Parse error ProbeResponse, length=%d"),
               frameLen);)
diff --git a/CORE/SYS/legacy/src/utils/src/parserApi.c b/CORE/SYS/legacy/src/utils/src/parserApi.c
index ba40dbe2dd05..1290ea8ff091 100644
--- a/CORE/SYS/legacy/src/utils/src/parserApi.c
+++ b/CORE/SYS/legacy/src/utils/src/parserApi.c
@@ -2113,6 +2113,60 @@ sirConvertProbeReqFrame2Struct(tpAniSirGlobal  pMac,
 
 } // End sirConvertProbeReqFrame2Struct.
 
+/**
+    * sirvalidateandrectifyies checks for the malformed frame.
+    * The frame would contain fixed IEs of 12 bytes follwed by Variable IEs
+    * (Tagged elements).
+    * Every Tagged IE has tag number, tag length and data. Tag length indicates
+    * the size of data in bytes.
+    * This function checks for size of Frame recived with the sum of all IEs.
+    * And also rectifies missing optional fields in IE.
+    *
+    * NOTE : Presently this function rectifies RSN capability in RSN IE, can
+    * extended to rectify other optional fields in other IEs.
+    */
+tSirRetStatus sirvalidateandrectifyies(tpAniSirGlobal pMac,
+                                    tANI_U8 *pMgmtFrame,
+                                    tANI_U32 nFrameBytes,
+                                    tANI_U32 *nMissingRsnBytes)
+{
+    tANI_U32 length = SIZE_OF_FIXED_PARAM;
+    tANI_U8 *refFrame;
+
+    /* Frame contains atleast one IE */
+    if (nFrameBytes > (SIZE_OF_FIXED_PARAM + 2)) {
+        while (length < nFrameBytes) {
+            /* refFrame points to next IE */
+            refFrame = pMgmtFrame + length;
+            length += (tANI_U32)(SIZE_OF_TAG_PARAM_NUM + SIZE_OF_TAG_PARAM_LEN
+                                 + (*(refFrame + SIZE_OF_TAG_PARAM_NUM)));
+        }
+        if (length != nFrameBytes) {
+            /*
+             * Workaround : Some APs may not include RSN Capability but
+             * the length of which is included in RSN IE length.
+             * this may cause in updating RSN Capability with junk value.
+             * To avoid this, add RSN Capability value with default value.
+             * Going further we can have such workaround for other IEs
+             */
+            if ((*refFrame == RSNIEID) &&
+                (length == (nFrameBytes + RSNIE_CAPABILITY_LEN))) {
+                /* Assume RSN Capability as 00 */
+                vos_mem_set( ( tANI_U8* ) (pMgmtFrame + (nFrameBytes)),
+                             RSNIE_CAPABILITY_LEN, DEFAULT_RSNIE_CAP_VAL );
+                *nMissingRsnBytes = RSNIE_CAPABILITY_LEN;
+                limLog(pMac, LOG1,
+                       FL("Added RSN Capability to the RSNIE as 0x00 0x00\n"));
+
+                return eHAL_STATUS_SUCCESS;
+            }
+            return eSIR_FAILURE;
+        }
+    }
+
+    return eHAL_STATUS_SUCCESS;
+}
+
 tSirRetStatus sirConvertProbeFrame2Struct(tpAniSirGlobal       pMac,
                                           tANI_U8             *pFrame,
                                           tANI_U32             nFrame,