Home | History | Annotate | Download | only in drivers
      1 /*
      2  * WPA Supplicant - Windows/NDIS driver interface
      3  * Copyright (c) 2004-2007, Jouni Malinen <j (at) w1.fi>
      4  *
      5  * This software may be distributed under the terms of the BSD license.
      6  * See README for more details.
      7  */
      8 
      9 #ifdef __CYGWIN__
     10 /* Avoid some header file conflicts by not including standard headers for
     11  * cygwin builds when Packet32.h is included. */
     12 #include "build_config.h"
     13 int close(int fd);
     14 #else /* __CYGWIN__ */
     15 #include "includes.h"
     16 #endif /* __CYGWIN__ */
     17 #ifdef CONFIG_USE_NDISUIO
     18 #include <winsock2.h>
     19 #else /* CONFIG_USE_NDISUIO */
     20 #include <Packet32.h>
     21 #endif /* CONFIG_USE_NDISUIO */
     22 #ifdef __MINGW32_VERSION
     23 #include <ddk/ntddndis.h>
     24 #else /* __MINGW32_VERSION */
     25 #include <ntddndis.h>
     26 #endif /* __MINGW32_VERSION */
     27 
     28 #ifdef _WIN32_WCE
     29 #include <winioctl.h>
     30 #include <nuiouser.h>
     31 #include <devload.h>
     32 #endif /* _WIN32_WCE */
     33 
     34 #include "common.h"
     35 #include "driver.h"
     36 #include "eloop.h"
     37 #include "common/ieee802_11_defs.h"
     38 #include "driver_ndis.h"
     39 
     40 int wpa_driver_register_event_cb(struct wpa_driver_ndis_data *drv);
     41 #ifdef CONFIG_NDIS_EVENTS_INTEGRATED
     42 void wpa_driver_ndis_event_pipe_cb(void *eloop_data, void *user_data);
     43 #endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
     44 
     45 static void wpa_driver_ndis_deinit(void *priv);
     46 static void wpa_driver_ndis_poll(void *drv);
     47 static void wpa_driver_ndis_poll_timeout(void *eloop_ctx, void *timeout_ctx);
     48 static int wpa_driver_ndis_adapter_init(struct wpa_driver_ndis_data *drv);
     49 static int wpa_driver_ndis_adapter_open(struct wpa_driver_ndis_data *drv);
     50 static void wpa_driver_ndis_adapter_close(struct wpa_driver_ndis_data *drv);
     51 
     52 
     53 static const u8 pae_group_addr[ETH_ALEN] =
     54 { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x03 };
     55 
     56 
     57 /* FIX: to be removed once this can be compiled with the complete NDIS
     58  * header files */
     59 #ifndef OID_802_11_BSSID
     60 #define OID_802_11_BSSID 			0x0d010101
     61 #define OID_802_11_SSID 			0x0d010102
     62 #define OID_802_11_INFRASTRUCTURE_MODE		0x0d010108
     63 #define OID_802_11_ADD_WEP			0x0D010113
     64 #define OID_802_11_REMOVE_WEP			0x0D010114
     65 #define OID_802_11_DISASSOCIATE			0x0D010115
     66 #define OID_802_11_BSSID_LIST 			0x0d010217
     67 #define OID_802_11_AUTHENTICATION_MODE		0x0d010118
     68 #define OID_802_11_PRIVACY_FILTER		0x0d010119
     69 #define OID_802_11_BSSID_LIST_SCAN 		0x0d01011A
     70 #define OID_802_11_WEP_STATUS	 		0x0d01011B
     71 #define OID_802_11_ENCRYPTION_STATUS OID_802_11_WEP_STATUS
     72 #define OID_802_11_ADD_KEY 			0x0d01011D
     73 #define OID_802_11_REMOVE_KEY 			0x0d01011E
     74 #define OID_802_11_ASSOCIATION_INFORMATION	0x0d01011F
     75 #define OID_802_11_TEST 			0x0d010120
     76 #define OID_802_11_CAPABILITY 			0x0d010122
     77 #define OID_802_11_PMKID 			0x0d010123
     78 
     79 #define NDIS_802_11_LENGTH_SSID 32
     80 #define NDIS_802_11_LENGTH_RATES 8
     81 #define NDIS_802_11_LENGTH_RATES_EX 16
     82 
     83 typedef UCHAR NDIS_802_11_MAC_ADDRESS[6];
     84 
     85 typedef struct NDIS_802_11_SSID {
     86 	ULONG SsidLength;
     87 	UCHAR Ssid[NDIS_802_11_LENGTH_SSID];
     88 } NDIS_802_11_SSID;
     89 
     90 typedef LONG NDIS_802_11_RSSI;
     91 
     92 typedef enum NDIS_802_11_NETWORK_TYPE {
     93 	Ndis802_11FH,
     94 	Ndis802_11DS,
     95 	Ndis802_11OFDM5,
     96 	Ndis802_11OFDM24,
     97 	Ndis802_11NetworkTypeMax
     98 } NDIS_802_11_NETWORK_TYPE;
     99 
    100 typedef struct NDIS_802_11_CONFIGURATION_FH {
    101 	ULONG Length;
    102 	ULONG HopPattern;
    103 	ULONG HopSet;
    104 	ULONG DwellTime;
    105 } NDIS_802_11_CONFIGURATION_FH;
    106 
    107 typedef struct NDIS_802_11_CONFIGURATION {
    108 	ULONG Length;
    109 	ULONG BeaconPeriod;
    110 	ULONG ATIMWindow;
    111 	ULONG DSConfig;
    112 	NDIS_802_11_CONFIGURATION_FH FHConfig;
    113 } NDIS_802_11_CONFIGURATION;
    114 
    115 typedef enum NDIS_802_11_NETWORK_INFRASTRUCTURE {
    116 	Ndis802_11IBSS,
    117 	Ndis802_11Infrastructure,
    118 	Ndis802_11AutoUnknown,
    119 	Ndis802_11InfrastructureMax
    120 } NDIS_802_11_NETWORK_INFRASTRUCTURE;
    121 
    122 typedef enum NDIS_802_11_AUTHENTICATION_MODE {
    123 	Ndis802_11AuthModeOpen,
    124 	Ndis802_11AuthModeShared,
    125 	Ndis802_11AuthModeAutoSwitch,
    126 	Ndis802_11AuthModeWPA,
    127 	Ndis802_11AuthModeWPAPSK,
    128 	Ndis802_11AuthModeWPANone,
    129 	Ndis802_11AuthModeWPA2,
    130 	Ndis802_11AuthModeWPA2PSK,
    131 	Ndis802_11AuthModeMax
    132 } NDIS_802_11_AUTHENTICATION_MODE;
    133 
    134 typedef enum NDIS_802_11_WEP_STATUS {
    135 	Ndis802_11WEPEnabled,
    136 	Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
    137 	Ndis802_11WEPDisabled,
    138 	Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
    139 	Ndis802_11WEPKeyAbsent,
    140 	Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
    141 	Ndis802_11WEPNotSupported,
    142 	Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
    143 	Ndis802_11Encryption2Enabled,
    144 	Ndis802_11Encryption2KeyAbsent,
    145 	Ndis802_11Encryption3Enabled,
    146 	Ndis802_11Encryption3KeyAbsent
    147 } NDIS_802_11_WEP_STATUS, NDIS_802_11_ENCRYPTION_STATUS;
    148 
    149 typedef enum NDIS_802_11_PRIVACY_FILTER {
    150 	Ndis802_11PrivFilterAcceptAll,
    151 	Ndis802_11PrivFilter8021xWEP
    152 } NDIS_802_11_PRIVACY_FILTER;
    153 
    154 typedef UCHAR NDIS_802_11_RATES[NDIS_802_11_LENGTH_RATES];
    155 typedef UCHAR NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];
    156 
    157 typedef struct NDIS_WLAN_BSSID_EX {
    158 	ULONG Length;
    159 	NDIS_802_11_MAC_ADDRESS MacAddress; /* BSSID */
    160 	UCHAR Reserved[2];
    161 	NDIS_802_11_SSID Ssid;
    162 	ULONG Privacy;
    163 	NDIS_802_11_RSSI Rssi;
    164 	NDIS_802_11_NETWORK_TYPE NetworkTypeInUse;
    165 	NDIS_802_11_CONFIGURATION Configuration;
    166 	NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode;
    167 	NDIS_802_11_RATES_EX SupportedRates;
    168 	ULONG IELength;
    169 	UCHAR IEs[1];
    170 } NDIS_WLAN_BSSID_EX;
    171 
    172 typedef struct NDIS_802_11_BSSID_LIST_EX {
    173 	ULONG NumberOfItems;
    174 	NDIS_WLAN_BSSID_EX Bssid[1];
    175 } NDIS_802_11_BSSID_LIST_EX;
    176 
    177 typedef struct NDIS_802_11_FIXED_IEs {
    178 	UCHAR Timestamp[8];
    179 	USHORT BeaconInterval;
    180 	USHORT Capabilities;
    181 } NDIS_802_11_FIXED_IEs;
    182 
    183 typedef struct NDIS_802_11_WEP {
    184 	ULONG Length;
    185 	ULONG KeyIndex;
    186 	ULONG KeyLength;
    187 	UCHAR KeyMaterial[1];
    188 } NDIS_802_11_WEP;
    189 
    190 typedef ULONG NDIS_802_11_KEY_INDEX;
    191 typedef ULONGLONG NDIS_802_11_KEY_RSC;
    192 
    193 typedef struct NDIS_802_11_KEY {
    194 	ULONG Length;
    195 	ULONG KeyIndex;
    196 	ULONG KeyLength;
    197 	NDIS_802_11_MAC_ADDRESS BSSID;
    198 	NDIS_802_11_KEY_RSC KeyRSC;
    199 	UCHAR KeyMaterial[1];
    200 } NDIS_802_11_KEY;
    201 
    202 typedef struct NDIS_802_11_REMOVE_KEY {
    203 	ULONG Length;
    204 	ULONG KeyIndex;
    205 	NDIS_802_11_MAC_ADDRESS BSSID;
    206 } NDIS_802_11_REMOVE_KEY;
    207 
    208 typedef struct NDIS_802_11_AI_REQFI {
    209 	USHORT Capabilities;
    210 	USHORT ListenInterval;
    211 	NDIS_802_11_MAC_ADDRESS CurrentAPAddress;
    212 } NDIS_802_11_AI_REQFI;
    213 
    214 typedef struct NDIS_802_11_AI_RESFI {
    215 	USHORT Capabilities;
    216 	USHORT StatusCode;
    217 	USHORT AssociationId;
    218 } NDIS_802_11_AI_RESFI;
    219 
    220 typedef struct NDIS_802_11_ASSOCIATION_INFORMATION {
    221 	ULONG Length;
    222 	USHORT AvailableRequestFixedIEs;
    223 	NDIS_802_11_AI_REQFI RequestFixedIEs;
    224 	ULONG RequestIELength;
    225 	ULONG OffsetRequestIEs;
    226 	USHORT AvailableResponseFixedIEs;
    227 	NDIS_802_11_AI_RESFI ResponseFixedIEs;
    228 	ULONG ResponseIELength;
    229 	ULONG OffsetResponseIEs;
    230 } NDIS_802_11_ASSOCIATION_INFORMATION;
    231 
    232 typedef struct NDIS_802_11_AUTHENTICATION_ENCRYPTION {
    233 	NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
    234 	NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
    235 } NDIS_802_11_AUTHENTICATION_ENCRYPTION;
    236 
    237 typedef struct NDIS_802_11_CAPABILITY {
    238 	ULONG Length;
    239 	ULONG Version;
    240 	ULONG NoOfPMKIDs;
    241 	ULONG NoOfAuthEncryptPairsSupported;
    242 	NDIS_802_11_AUTHENTICATION_ENCRYPTION
    243 		AuthenticationEncryptionSupported[1];
    244 } NDIS_802_11_CAPABILITY;
    245 
    246 typedef UCHAR NDIS_802_11_PMKID_VALUE[16];
    247 
    248 typedef struct BSSID_INFO {
    249 	NDIS_802_11_MAC_ADDRESS BSSID;
    250 	NDIS_802_11_PMKID_VALUE PMKID;
    251 } BSSID_INFO;
    252 
    253 typedef struct NDIS_802_11_PMKID {
    254 	ULONG Length;
    255 	ULONG BSSIDInfoCount;
    256 	BSSID_INFO BSSIDInfo[1];
    257 } NDIS_802_11_PMKID;
    258 
    259 typedef enum NDIS_802_11_STATUS_TYPE {
    260 	Ndis802_11StatusType_Authentication,
    261 	Ndis802_11StatusType_PMKID_CandidateList = 2,
    262 	Ndis802_11StatusTypeMax
    263 } NDIS_802_11_STATUS_TYPE;
    264 
    265 typedef struct NDIS_802_11_STATUS_INDICATION {
    266 	NDIS_802_11_STATUS_TYPE StatusType;
    267 } NDIS_802_11_STATUS_INDICATION;
    268 
    269 typedef struct PMKID_CANDIDATE {
    270 	NDIS_802_11_MAC_ADDRESS BSSID;
    271 	ULONG Flags;
    272 } PMKID_CANDIDATE;
    273 
    274 #define NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED 0x01
    275 
    276 typedef struct NDIS_802_11_PMKID_CANDIDATE_LIST {
    277 	ULONG Version;
    278 	ULONG NumCandidates;
    279 	PMKID_CANDIDATE CandidateList[1];
    280 } NDIS_802_11_PMKID_CANDIDATE_LIST;
    281 
    282 typedef struct NDIS_802_11_AUTHENTICATION_REQUEST {
    283 	ULONG Length;
    284 	NDIS_802_11_MAC_ADDRESS Bssid;
    285 	ULONG Flags;
    286 } NDIS_802_11_AUTHENTICATION_REQUEST;
    287 
    288 #define NDIS_802_11_AUTH_REQUEST_REAUTH			0x01
    289 #define NDIS_802_11_AUTH_REQUEST_KEYUPDATE		0x02
    290 #define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR		0x06
    291 #define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR		0x0E
    292 
    293 #endif /* OID_802_11_BSSID */
    294 
    295 
    296 #ifndef OID_802_11_PMKID
    297 /* Platform SDK for XP did not include WPA2, so add needed definitions */
    298 
    299 #define OID_802_11_CAPABILITY 			0x0d010122
    300 #define OID_802_11_PMKID 			0x0d010123
    301 
    302 #define Ndis802_11AuthModeWPA2 6
    303 #define Ndis802_11AuthModeWPA2PSK 7
    304 
    305 #define Ndis802_11StatusType_PMKID_CandidateList 2
    306 
    307 typedef struct NDIS_802_11_AUTHENTICATION_ENCRYPTION {
    308 	NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
    309 	NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
    310 } NDIS_802_11_AUTHENTICATION_ENCRYPTION;
    311 
    312 typedef struct NDIS_802_11_CAPABILITY {
    313 	ULONG Length;
    314 	ULONG Version;
    315 	ULONG NoOfPMKIDs;
    316 	ULONG NoOfAuthEncryptPairsSupported;
    317 	NDIS_802_11_AUTHENTICATION_ENCRYPTION
    318 		AuthenticationEncryptionSupported[1];
    319 } NDIS_802_11_CAPABILITY;
    320 
    321 typedef UCHAR NDIS_802_11_PMKID_VALUE[16];
    322 
    323 typedef struct BSSID_INFO {
    324 	NDIS_802_11_MAC_ADDRESS BSSID;
    325 	NDIS_802_11_PMKID_VALUE PMKID;
    326 } BSSID_INFO;
    327 
    328 typedef struct NDIS_802_11_PMKID {
    329 	ULONG Length;
    330 	ULONG BSSIDInfoCount;
    331 	BSSID_INFO BSSIDInfo[1];
    332 } NDIS_802_11_PMKID;
    333 
    334 typedef struct PMKID_CANDIDATE {
    335 	NDIS_802_11_MAC_ADDRESS BSSID;
    336 	ULONG Flags;
    337 } PMKID_CANDIDATE;
    338 
    339 #define NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED 0x01
    340 
    341 typedef struct NDIS_802_11_PMKID_CANDIDATE_LIST {
    342 	ULONG Version;
    343 	ULONG NumCandidates;
    344 	PMKID_CANDIDATE CandidateList[1];
    345 } NDIS_802_11_PMKID_CANDIDATE_LIST;
    346 
    347 #endif /* OID_802_11_CAPABILITY */
    348 
    349 
    350 #ifndef OID_DOT11_CURRENT_OPERATION_MODE
    351 /* Native 802.11 OIDs */
    352 #define OID_DOT11_NDIS_START 0x0D010300
    353 #define OID_DOT11_CURRENT_OPERATION_MODE (OID_DOT11_NDIS_START + 8)
    354 #define OID_DOT11_SCAN_REQUEST (OID_DOT11_NDIS_START + 11)
    355 
    356 typedef enum _DOT11_BSS_TYPE {
    357 	dot11_BSS_type_infrastructure = 1,
    358 	dot11_BSS_type_independent = 2,
    359 	dot11_BSS_type_any = 3
    360 } DOT11_BSS_TYPE, * PDOT11_BSS_TYPE;
    361 
    362 typedef UCHAR DOT11_MAC_ADDRESS[6];
    363 typedef DOT11_MAC_ADDRESS * PDOT11_MAC_ADDRESS;
    364 
    365 typedef enum _DOT11_SCAN_TYPE {
    366 	dot11_scan_type_active = 1,
    367 	dot11_scan_type_passive = 2,
    368 	dot11_scan_type_auto = 3,
    369 	dot11_scan_type_forced = 0x80000000
    370 } DOT11_SCAN_TYPE, * PDOT11_SCAN_TYPE;
    371 
    372 typedef struct _DOT11_SCAN_REQUEST_V2 {
    373 	DOT11_BSS_TYPE dot11BSSType;
    374 	DOT11_MAC_ADDRESS dot11BSSID;
    375 	DOT11_SCAN_TYPE dot11ScanType;
    376 	BOOLEAN bRestrictedScan;
    377 	ULONG udot11SSIDsOffset;
    378 	ULONG uNumOfdot11SSIDs;
    379 	BOOLEAN bUseRequestIE;
    380 	ULONG uRequestIDsOffset;
    381 	ULONG uNumOfRequestIDs;
    382 	ULONG uPhyTypeInfosOffset;
    383 	ULONG uNumOfPhyTypeInfos;
    384 	ULONG uIEsOffset;
    385 	ULONG uIEsLength;
    386 	UCHAR ucBuffer[1];
    387 } DOT11_SCAN_REQUEST_V2, * PDOT11_SCAN_REQUEST_V2;
    388 
    389 #endif /* OID_DOT11_CURRENT_OPERATION_MODE */
    390 
    391 #ifdef CONFIG_USE_NDISUIO
    392 #ifndef _WIN32_WCE
    393 #ifdef __MINGW32_VERSION
    394 typedef ULONG NDIS_OID;
    395 #endif /* __MINGW32_VERSION */
    396 /* from nuiouser.h */
    397 #define FSCTL_NDISUIO_BASE      FILE_DEVICE_NETWORK
    398 
    399 #define _NDISUIO_CTL_CODE(_Function, _Method, _Access) \
    400 	CTL_CODE(FSCTL_NDISUIO_BASE, _Function, _Method, _Access)
    401 
    402 #define IOCTL_NDISUIO_OPEN_DEVICE \
    403 	_NDISUIO_CTL_CODE(0x200, METHOD_BUFFERED, \
    404 			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
    405 
    406 #define IOCTL_NDISUIO_QUERY_OID_VALUE \
    407 	_NDISUIO_CTL_CODE(0x201, METHOD_BUFFERED, \
    408 			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
    409 
    410 #define IOCTL_NDISUIO_SET_OID_VALUE \
    411 	_NDISUIO_CTL_CODE(0x205, METHOD_BUFFERED, \
    412 			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
    413 
    414 #define IOCTL_NDISUIO_SET_ETHER_TYPE \
    415 	_NDISUIO_CTL_CODE(0x202, METHOD_BUFFERED, \
    416 			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
    417 
    418 #define IOCTL_NDISUIO_QUERY_BINDING \
    419 	_NDISUIO_CTL_CODE(0x203, METHOD_BUFFERED, \
    420 			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
    421 
    422 #define IOCTL_NDISUIO_BIND_WAIT \
    423 	_NDISUIO_CTL_CODE(0x204, METHOD_BUFFERED, \
    424 			  FILE_READ_ACCESS | FILE_WRITE_ACCESS)
    425 
    426 typedef struct _NDISUIO_QUERY_OID
    427 {
    428     NDIS_OID Oid;
    429     UCHAR Data[sizeof(ULONG)];
    430 } NDISUIO_QUERY_OID, *PNDISUIO_QUERY_OID;
    431 
    432 typedef struct _NDISUIO_SET_OID
    433 {
    434     NDIS_OID Oid;
    435     UCHAR Data[sizeof(ULONG)];
    436 } NDISUIO_SET_OID, *PNDISUIO_SET_OID;
    437 
    438 typedef struct _NDISUIO_QUERY_BINDING
    439 {
    440 	ULONG BindingIndex;
    441 	ULONG DeviceNameOffset;
    442 	ULONG DeviceNameLength;
    443 	ULONG DeviceDescrOffset;
    444 	ULONG DeviceDescrLength;
    445 } NDISUIO_QUERY_BINDING, *PNDISUIO_QUERY_BINDING;
    446 #endif /* _WIN32_WCE */
    447 #endif /* CONFIG_USE_NDISUIO */
    448 
    449 
    450 static int ndis_get_oid(struct wpa_driver_ndis_data *drv, unsigned int oid,
    451 			char *data, size_t len)
    452 {
    453 #ifdef CONFIG_USE_NDISUIO
    454 	NDISUIO_QUERY_OID *o;
    455 	size_t buflen = sizeof(*o) + len;
    456 	DWORD written;
    457 	int ret;
    458 	size_t hdrlen;
    459 
    460 	o = os_zalloc(buflen);
    461 	if (o == NULL)
    462 		return -1;
    463 	o->Oid = oid;
    464 #ifdef _WIN32_WCE
    465 	o->ptcDeviceName = drv->adapter_name;
    466 #endif /* _WIN32_WCE */
    467 	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_QUERY_OID_VALUE,
    468 			     o, sizeof(NDISUIO_QUERY_OID), o, buflen, &written,
    469 			     NULL)) {
    470 		wpa_printf(MSG_DEBUG, "NDIS: IOCTL_NDISUIO_QUERY_OID_VALUE "
    471 			   "failed (oid=%08x): %d", oid, (int) GetLastError());
    472 		os_free(o);
    473 		return -1;
    474 	}
    475 	hdrlen = sizeof(NDISUIO_QUERY_OID) - sizeof(o->Data);
    476 	if (written < hdrlen) {
    477 		wpa_printf(MSG_DEBUG, "NDIS: query oid=%08x written (%d); "
    478 			   "too short", oid, (unsigned int) written);
    479 		os_free(o);
    480 		return -1;
    481 	}
    482 	written -= hdrlen;
    483 	if (written > len) {
    484 		wpa_printf(MSG_DEBUG, "NDIS: query oid=%08x written (%d) > "
    485 			   "len (%d)",oid, (unsigned int) written, len);
    486 		os_free(o);
    487 		return -1;
    488 	}
    489 	os_memcpy(data, o->Data, written);
    490 	ret = written;
    491 	os_free(o);
    492 	return ret;
    493 #else /* CONFIG_USE_NDISUIO */
    494 	char *buf;
    495 	PACKET_OID_DATA *o;
    496 	int ret;
    497 
    498 	buf = os_zalloc(sizeof(*o) + len);
    499 	if (buf == NULL)
    500 		return -1;
    501 	o = (PACKET_OID_DATA *) buf;
    502 	o->Oid = oid;
    503 	o->Length = len;
    504 
    505 	if (!PacketRequest(drv->adapter, FALSE, o)) {
    506 		wpa_printf(MSG_DEBUG, "%s: oid=0x%x len (%d) failed",
    507 			   __func__, oid, len);
    508 		os_free(buf);
    509 		return -1;
    510 	}
    511 	if (o->Length > len) {
    512 		wpa_printf(MSG_DEBUG, "%s: oid=0x%x Length (%d) > len (%d)",
    513 			   __func__, oid, (unsigned int) o->Length, len);
    514 		os_free(buf);
    515 		return -1;
    516 	}
    517 	os_memcpy(data, o->Data, o->Length);
    518 	ret = o->Length;
    519 	os_free(buf);
    520 	return ret;
    521 #endif /* CONFIG_USE_NDISUIO */
    522 }
    523 
    524 
    525 static int ndis_set_oid(struct wpa_driver_ndis_data *drv, unsigned int oid,
    526 			const char *data, size_t len)
    527 {
    528 #ifdef CONFIG_USE_NDISUIO
    529 	NDISUIO_SET_OID *o;
    530 	size_t buflen, reallen;
    531 	DWORD written;
    532 	char txt[50];
    533 
    534 	os_snprintf(txt, sizeof(txt), "NDIS: Set OID %08x", oid);
    535 	wpa_hexdump_key(MSG_MSGDUMP, txt, (const u8 *) data, len);
    536 
    537 	buflen = sizeof(*o) + len;
    538 	reallen = buflen - sizeof(o->Data);
    539 	o = os_zalloc(buflen);
    540 	if (o == NULL)
    541 		return -1;
    542 	o->Oid = oid;
    543 #ifdef _WIN32_WCE
    544 	o->ptcDeviceName = drv->adapter_name;
    545 #endif /* _WIN32_WCE */
    546 	if (data)
    547 		os_memcpy(o->Data, data, len);
    548 	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_SET_OID_VALUE,
    549 			     o, reallen, NULL, 0, &written, NULL)) {
    550 		wpa_printf(MSG_DEBUG, "NDIS: IOCTL_NDISUIO_SET_OID_VALUE "
    551 			   "(oid=%08x) failed: %d", oid, (int) GetLastError());
    552 		os_free(o);
    553 		return -1;
    554 	}
    555 	os_free(o);
    556 	return 0;
    557 #else /* CONFIG_USE_NDISUIO */
    558 	char *buf;
    559 	PACKET_OID_DATA *o;
    560 	char txt[50];
    561 
    562 	os_snprintf(txt, sizeof(txt), "NDIS: Set OID %08x", oid);
    563 	wpa_hexdump_key(MSG_MSGDUMP, txt, (const u8 *) data, len);
    564 
    565 	buf = os_zalloc(sizeof(*o) + len);
    566 	if (buf == NULL)
    567 		return -1;
    568 	o = (PACKET_OID_DATA *) buf;
    569 	o->Oid = oid;
    570 	o->Length = len;
    571 	if (data)
    572 		os_memcpy(o->Data, data, len);
    573 
    574 	if (!PacketRequest(drv->adapter, TRUE, o)) {
    575 		wpa_printf(MSG_DEBUG, "%s: oid=0x%x len (%d) failed",
    576 			   __func__, oid, len);
    577 		os_free(buf);
    578 		return -1;
    579 	}
    580 	os_free(buf);
    581 	return 0;
    582 #endif /* CONFIG_USE_NDISUIO */
    583 }
    584 
    585 
    586 static int ndis_set_auth_mode(struct wpa_driver_ndis_data *drv, int mode)
    587 {
    588 	u32 auth_mode = mode;
    589 	if (ndis_set_oid(drv, OID_802_11_AUTHENTICATION_MODE,
    590 			 (char *) &auth_mode, sizeof(auth_mode)) < 0) {
    591 		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
    592 			   "OID_802_11_AUTHENTICATION_MODE (%d)",
    593 			   (int) auth_mode);
    594 		return -1;
    595 	}
    596 	return 0;
    597 }
    598 
    599 
    600 static int ndis_get_auth_mode(struct wpa_driver_ndis_data *drv)
    601 {
    602 	u32 auth_mode;
    603 	int res;
    604 	res = ndis_get_oid(drv, OID_802_11_AUTHENTICATION_MODE,
    605 			   (char *) &auth_mode, sizeof(auth_mode));
    606 	if (res != sizeof(auth_mode)) {
    607 		wpa_printf(MSG_DEBUG, "NDIS: Failed to get "
    608 			   "OID_802_11_AUTHENTICATION_MODE");
    609 		return -1;
    610 	}
    611 	return auth_mode;
    612 }
    613 
    614 
    615 static int ndis_set_encr_status(struct wpa_driver_ndis_data *drv, int encr)
    616 {
    617 	u32 encr_status = encr;
    618 	if (ndis_set_oid(drv, OID_802_11_ENCRYPTION_STATUS,
    619 			 (char *) &encr_status, sizeof(encr_status)) < 0) {
    620 		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
    621 			   "OID_802_11_ENCRYPTION_STATUS (%d)", encr);
    622 		return -1;
    623 	}
    624 	return 0;
    625 }
    626 
    627 
    628 static int ndis_get_encr_status(struct wpa_driver_ndis_data *drv)
    629 {
    630 	u32 encr;
    631 	int res;
    632 	res = ndis_get_oid(drv, OID_802_11_ENCRYPTION_STATUS,
    633 			   (char *) &encr, sizeof(encr));
    634 	if (res != sizeof(encr)) {
    635 		wpa_printf(MSG_DEBUG, "NDIS: Failed to get "
    636 			   "OID_802_11_ENCRYPTION_STATUS");
    637 		return -1;
    638 	}
    639 	return encr;
    640 }
    641 
    642 
    643 static int wpa_driver_ndis_get_bssid(void *priv, u8 *bssid)
    644 {
    645 	struct wpa_driver_ndis_data *drv = priv;
    646 
    647 	if (drv->wired) {
    648 		/*
    649 		 * Report PAE group address as the "BSSID" for wired
    650 		 * connection.
    651 		 */
    652 		os_memcpy(bssid, pae_group_addr, ETH_ALEN);
    653 		return 0;
    654 	}
    655 
    656 	return ndis_get_oid(drv, OID_802_11_BSSID, (char *) bssid, ETH_ALEN) <
    657 		0 ? -1 : 0;
    658 }
    659 
    660 
    661 static int wpa_driver_ndis_get_ssid(void *priv, u8 *ssid)
    662 {
    663 	struct wpa_driver_ndis_data *drv = priv;
    664 	NDIS_802_11_SSID buf;
    665 	int res;
    666 
    667 	res = ndis_get_oid(drv, OID_802_11_SSID, (char *) &buf, sizeof(buf));
    668 	if (res < 4) {
    669 		wpa_printf(MSG_DEBUG, "NDIS: Failed to get SSID");
    670 		if (drv->wired) {
    671 			wpa_printf(MSG_DEBUG, "NDIS: Allow get_ssid failure "
    672 				   "with a wired interface");
    673 			return 0;
    674 		}
    675 		return -1;
    676 	}
    677 	os_memcpy(ssid, buf.Ssid, buf.SsidLength);
    678 	return buf.SsidLength;
    679 }
    680 
    681 
    682 static int wpa_driver_ndis_set_ssid(struct wpa_driver_ndis_data *drv,
    683 				    const u8 *ssid, size_t ssid_len)
    684 {
    685 	NDIS_802_11_SSID buf;
    686 
    687 	os_memset(&buf, 0, sizeof(buf));
    688 	buf.SsidLength = ssid_len;
    689 	os_memcpy(buf.Ssid, ssid, ssid_len);
    690 	/*
    691 	 * Make sure radio is marked enabled here so that scan request will not
    692 	 * force SSID to be changed to a random one in order to enable radio at
    693 	 * that point.
    694 	 */
    695 	drv->radio_enabled = 1;
    696 	return ndis_set_oid(drv, OID_802_11_SSID, (char *) &buf, sizeof(buf));
    697 }
    698 
    699 
    700 /* Disconnect using OID_802_11_DISASSOCIATE. This will also turn the radio off.
    701  */
    702 static int wpa_driver_ndis_radio_off(struct wpa_driver_ndis_data *drv)
    703 {
    704 	drv->radio_enabled = 0;
    705 	return ndis_set_oid(drv, OID_802_11_DISASSOCIATE, "    ", 4);
    706 }
    707 
    708 
    709 /* Disconnect by setting SSID to random (i.e., likely not used). */
    710 static int wpa_driver_ndis_disconnect(struct wpa_driver_ndis_data *drv)
    711 {
    712 	char ssid[32];
    713 	int i;
    714 	for (i = 0; i < 32; i++)
    715 		ssid[i] = rand() & 0xff;
    716 	return wpa_driver_ndis_set_ssid(drv, (u8 *) ssid, 32);
    717 }
    718 
    719 
    720 static int wpa_driver_ndis_deauthenticate(void *priv, const u8 *addr,
    721 					  int reason_code)
    722 {
    723 	struct wpa_driver_ndis_data *drv = priv;
    724 	return wpa_driver_ndis_disconnect(drv);
    725 }
    726 
    727 
    728 static void wpa_driver_ndis_scan_timeout(void *eloop_ctx, void *timeout_ctx)
    729 {
    730 	wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
    731 	wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
    732 }
    733 
    734 
    735 static int wpa_driver_ndis_scan_native80211(
    736 	struct wpa_driver_ndis_data *drv,
    737 	struct wpa_driver_scan_params *params)
    738 {
    739 	DOT11_SCAN_REQUEST_V2 req;
    740 	int res;
    741 
    742 	os_memset(&req, 0, sizeof(req));
    743 	req.dot11BSSType = dot11_BSS_type_any;
    744 	os_memset(req.dot11BSSID, 0xff, ETH_ALEN);
    745 	req.dot11ScanType = dot11_scan_type_auto;
    746 	res = ndis_set_oid(drv, OID_DOT11_SCAN_REQUEST, (char *) &req,
    747 			   sizeof(req));
    748 	eloop_cancel_timeout(wpa_driver_ndis_scan_timeout, drv, drv->ctx);
    749 	eloop_register_timeout(7, 0, wpa_driver_ndis_scan_timeout, drv,
    750 			       drv->ctx);
    751 	return res;
    752 }
    753 
    754 
    755 static int wpa_driver_ndis_scan(void *priv,
    756 				struct wpa_driver_scan_params *params)
    757 {
    758 	struct wpa_driver_ndis_data *drv = priv;
    759 	int res;
    760 
    761 	if (drv->native80211)
    762 		return wpa_driver_ndis_scan_native80211(drv, params);
    763 
    764 	if (!drv->radio_enabled) {
    765 		wpa_printf(MSG_DEBUG, "NDIS: turning radio on before the first"
    766 			   " scan");
    767 		if (wpa_driver_ndis_disconnect(drv) < 0) {
    768 			wpa_printf(MSG_DEBUG, "NDIS: failed to enable radio");
    769 		}
    770 		drv->radio_enabled = 1;
    771 	}
    772 
    773 	res = ndis_set_oid(drv, OID_802_11_BSSID_LIST_SCAN, "    ", 4);
    774 	eloop_cancel_timeout(wpa_driver_ndis_scan_timeout, drv, drv->ctx);
    775 	eloop_register_timeout(7, 0, wpa_driver_ndis_scan_timeout, drv,
    776 			       drv->ctx);
    777 	return res;
    778 }
    779 
    780 
    781 static const u8 * wpa_scan_get_ie(const struct wpa_scan_res *res, u8 ie)
    782 {
    783 	const u8 *end, *pos;
    784 
    785 	pos = (const u8 *) (res + 1);
    786 	end = pos + res->ie_len;
    787 
    788 	while (pos + 1 < end) {
    789 		if (pos + 2 + pos[1] > end)
    790 			break;
    791 		if (pos[0] == ie)
    792 			return pos;
    793 		pos += 2 + pos[1];
    794 	}
    795 
    796 	return NULL;
    797 }
    798 
    799 
    800 static struct wpa_scan_res * wpa_driver_ndis_add_scan_ssid(
    801 	struct wpa_scan_res *r, NDIS_802_11_SSID *ssid)
    802 {
    803 	struct wpa_scan_res *nr;
    804 	u8 *pos;
    805 
    806 	if (wpa_scan_get_ie(r, WLAN_EID_SSID))
    807 		return r; /* SSID IE already present */
    808 
    809 	if (ssid->SsidLength == 0 || ssid->SsidLength > 32)
    810 		return r; /* No valid SSID inside scan data */
    811 
    812 	nr = os_realloc(r, sizeof(*r) + r->ie_len + 2 + ssid->SsidLength);
    813 	if (nr == NULL)
    814 		return r;
    815 
    816 	pos = ((u8 *) (nr + 1)) + nr->ie_len;
    817 	*pos++ = WLAN_EID_SSID;
    818 	*pos++ = ssid->SsidLength;
    819 	os_memcpy(pos, ssid->Ssid, ssid->SsidLength);
    820 	nr->ie_len += 2 + ssid->SsidLength;
    821 
    822 	return nr;
    823 }
    824 
    825 
    826 static struct wpa_scan_results * wpa_driver_ndis_get_scan_results(void *priv)
    827 {
    828 	struct wpa_driver_ndis_data *drv = priv;
    829 	NDIS_802_11_BSSID_LIST_EX *b;
    830 	size_t blen, count, i;
    831 	int len;
    832 	char *pos;
    833 	struct wpa_scan_results *results;
    834 	struct wpa_scan_res *r;
    835 
    836 	blen = 65535;
    837 	b = os_zalloc(blen);
    838 	if (b == NULL)
    839 		return NULL;
    840 	len = ndis_get_oid(drv, OID_802_11_BSSID_LIST, (char *) b, blen);
    841 	if (len < 0) {
    842 		wpa_printf(MSG_DEBUG, "NDIS: failed to get scan results");
    843 		os_free(b);
    844 		return NULL;
    845 	}
    846 	count = b->NumberOfItems;
    847 
    848 	results = os_zalloc(sizeof(*results));
    849 	if (results == NULL) {
    850 		os_free(b);
    851 		return NULL;
    852 	}
    853 	results->res = os_calloc(count, sizeof(struct wpa_scan_res *));
    854 	if (results->res == NULL) {
    855 		os_free(results);
    856 		os_free(b);
    857 		return NULL;
    858 	}
    859 
    860 	pos = (char *) &b->Bssid[0];
    861 	for (i = 0; i < count; i++) {
    862 		NDIS_WLAN_BSSID_EX *bss = (NDIS_WLAN_BSSID_EX *) pos;
    863 		NDIS_802_11_FIXED_IEs *fixed;
    864 
    865 		if (bss->IELength < sizeof(NDIS_802_11_FIXED_IEs)) {
    866 			wpa_printf(MSG_DEBUG, "NDIS: too small IELength=%d",
    867 				   (int) bss->IELength);
    868 			break;
    869 		}
    870 		if (((char *) bss->IEs) + bss->IELength  > (char *) b + blen) {
    871 			/*
    872 			 * Some NDIS drivers have been reported to include an
    873 			 * entry with an invalid IELength in scan results and
    874 			 * this has crashed wpa_supplicant, so validate the
    875 			 * returned value before using it.
    876 			 */
    877 			wpa_printf(MSG_DEBUG, "NDIS: skipped invalid scan "
    878 				   "result IE (BSSID=" MACSTR ") IELength=%d",
    879 				   MAC2STR(bss->MacAddress),
    880 				   (int) bss->IELength);
    881 			break;
    882 		}
    883 
    884 		r = os_zalloc(sizeof(*r) + bss->IELength -
    885 			      sizeof(NDIS_802_11_FIXED_IEs));
    886 		if (r == NULL)
    887 			break;
    888 
    889 		os_memcpy(r->bssid, bss->MacAddress, ETH_ALEN);
    890 		r->level = (int) bss->Rssi;
    891 		r->freq = bss->Configuration.DSConfig / 1000;
    892 		fixed = (NDIS_802_11_FIXED_IEs *) bss->IEs;
    893 		r->beacon_int = WPA_GET_LE16((u8 *) &fixed->BeaconInterval);
    894 		r->caps = WPA_GET_LE16((u8 *) &fixed->Capabilities);
    895 		r->tsf = WPA_GET_LE64(fixed->Timestamp);
    896 		os_memcpy(r + 1, bss->IEs + sizeof(NDIS_802_11_FIXED_IEs),
    897 			  bss->IELength - sizeof(NDIS_802_11_FIXED_IEs));
    898 		r->ie_len = bss->IELength - sizeof(NDIS_802_11_FIXED_IEs);
    899 		r = wpa_driver_ndis_add_scan_ssid(r, &bss->Ssid);
    900 
    901 		results->res[results->num++] = r;
    902 
    903 		pos += bss->Length;
    904 		if (pos > (char *) b + blen)
    905 			break;
    906 	}
    907 
    908 	os_free(b);
    909 
    910 	return results;
    911 }
    912 
    913 
    914 static int wpa_driver_ndis_remove_key(struct wpa_driver_ndis_data *drv,
    915 				      int key_idx, const u8 *addr,
    916 				      const u8 *bssid, int pairwise)
    917 {
    918 	NDIS_802_11_REMOVE_KEY rkey;
    919 	NDIS_802_11_KEY_INDEX index;
    920 	int res, res2;
    921 
    922 	os_memset(&rkey, 0, sizeof(rkey));
    923 
    924 	rkey.Length = sizeof(rkey);
    925 	rkey.KeyIndex = key_idx;
    926 	if (pairwise)
    927 		rkey.KeyIndex |= 1 << 30;
    928 	os_memcpy(rkey.BSSID, bssid, ETH_ALEN);
    929 
    930 	res = ndis_set_oid(drv, OID_802_11_REMOVE_KEY, (char *) &rkey,
    931 			   sizeof(rkey));
    932 	if (!pairwise) {
    933 		index = key_idx;
    934 		res2 = ndis_set_oid(drv, OID_802_11_REMOVE_WEP,
    935 				    (char *) &index, sizeof(index));
    936 	} else
    937 		res2 = 0;
    938 
    939 	if (res < 0 && res2 < 0)
    940 		return -1;
    941 	return 0;
    942 }
    943 
    944 
    945 static int wpa_driver_ndis_add_wep(struct wpa_driver_ndis_data *drv,
    946 				   int pairwise, int key_idx, int set_tx,
    947 				   const u8 *key, size_t key_len)
    948 {
    949 	NDIS_802_11_WEP *wep;
    950 	size_t len;
    951 	int res;
    952 
    953 	len = 12 + key_len;
    954 	wep = os_zalloc(len);
    955 	if (wep == NULL)
    956 		return -1;
    957 	wep->Length = len;
    958 	wep->KeyIndex = key_idx;
    959 	if (set_tx)
    960 		wep->KeyIndex |= 1 << 31;
    961 #if 0 /* Setting bit30 does not seem to work with some NDIS drivers */
    962 	if (pairwise)
    963 		wep->KeyIndex |= 1 << 30;
    964 #endif
    965 	wep->KeyLength = key_len;
    966 	os_memcpy(wep->KeyMaterial, key, key_len);
    967 
    968 	wpa_hexdump_key(MSG_MSGDUMP, "NDIS: OID_802_11_ADD_WEP",
    969 			(u8 *) wep, len);
    970 	res = ndis_set_oid(drv, OID_802_11_ADD_WEP, (char *) wep, len);
    971 
    972 	os_free(wep);
    973 
    974 	return res;
    975 }
    976 
    977 
    978 static int wpa_driver_ndis_set_key(const char *ifname, void *priv,
    979 				   enum wpa_alg alg, const u8 *addr,
    980 				   int key_idx, int set_tx,
    981 				   const u8 *seq, size_t seq_len,
    982 				   const u8 *key, size_t key_len)
    983 {
    984 	struct wpa_driver_ndis_data *drv = priv;
    985 	size_t len, i;
    986 	NDIS_802_11_KEY *nkey;
    987 	int res, pairwise;
    988 	u8 bssid[ETH_ALEN];
    989 
    990 	if (addr == NULL || is_broadcast_ether_addr(addr)) {
    991 		/* Group Key */
    992 		pairwise = 0;
    993 		if (wpa_driver_ndis_get_bssid(drv, bssid) < 0)
    994 			os_memset(bssid, 0xff, ETH_ALEN);
    995 	} else {
    996 		/* Pairwise Key */
    997 		pairwise = 1;
    998 		os_memcpy(bssid, addr, ETH_ALEN);
    999 	}
   1000 
   1001 	if (alg == WPA_ALG_NONE || key_len == 0) {
   1002 		return wpa_driver_ndis_remove_key(drv, key_idx, addr, bssid,
   1003 						  pairwise);
   1004 	}
   1005 
   1006 	if (alg == WPA_ALG_WEP) {
   1007 		return wpa_driver_ndis_add_wep(drv, pairwise, key_idx, set_tx,
   1008 					       key, key_len);
   1009 	}
   1010 
   1011 	len = 12 + 6 + 6 + 8 + key_len;
   1012 
   1013 	nkey = os_zalloc(len);
   1014 	if (nkey == NULL)
   1015 		return -1;
   1016 
   1017 	nkey->Length = len;
   1018 	nkey->KeyIndex = key_idx;
   1019 	if (set_tx)
   1020 		nkey->KeyIndex |= 1 << 31;
   1021 	if (pairwise)
   1022 		nkey->KeyIndex |= 1 << 30;
   1023 	if (seq && seq_len)
   1024 		nkey->KeyIndex |= 1 << 29;
   1025 	nkey->KeyLength = key_len;
   1026 	os_memcpy(nkey->BSSID, bssid, ETH_ALEN);
   1027 	if (seq && seq_len) {
   1028 		for (i = 0; i < seq_len; i++)
   1029 			nkey->KeyRSC |= (ULONGLONG) seq[i] << (i * 8);
   1030 	}
   1031 	if (alg == WPA_ALG_TKIP && key_len == 32) {
   1032 		os_memcpy(nkey->KeyMaterial, key, 16);
   1033 		os_memcpy(nkey->KeyMaterial + 16, key + 24, 8);
   1034 		os_memcpy(nkey->KeyMaterial + 24, key + 16, 8);
   1035 	} else {
   1036 		os_memcpy(nkey->KeyMaterial, key, key_len);
   1037 	}
   1038 
   1039 	wpa_hexdump_key(MSG_MSGDUMP, "NDIS: OID_802_11_ADD_KEY",
   1040 			(u8 *) nkey, len);
   1041 	res = ndis_set_oid(drv, OID_802_11_ADD_KEY, (char *) nkey, len);
   1042 	os_free(nkey);
   1043 
   1044 	return res;
   1045 }
   1046 
   1047 
   1048 static int
   1049 wpa_driver_ndis_associate(void *priv,
   1050 			  struct wpa_driver_associate_params *params)
   1051 {
   1052 	struct wpa_driver_ndis_data *drv = priv;
   1053 	u32 auth_mode, encr, priv_mode, mode;
   1054 	u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
   1055 
   1056 	drv->mode = params->mode;
   1057 
   1058 	/* Note: Setting OID_802_11_INFRASTRUCTURE_MODE clears current keys,
   1059 	 * so static WEP keys needs to be set again after this. */
   1060 	if (params->mode == IEEE80211_MODE_IBSS) {
   1061 		mode = Ndis802_11IBSS;
   1062 		/* Need to make sure that BSSID polling is enabled for
   1063 		 * IBSS mode. */
   1064 		eloop_cancel_timeout(wpa_driver_ndis_poll_timeout, drv, NULL);
   1065 		eloop_register_timeout(1, 0, wpa_driver_ndis_poll_timeout,
   1066 				       drv, NULL);
   1067 	} else
   1068 		mode = Ndis802_11Infrastructure;
   1069 	if (ndis_set_oid(drv, OID_802_11_INFRASTRUCTURE_MODE,
   1070 			 (char *) &mode, sizeof(mode)) < 0) {
   1071 		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
   1072 			   "OID_802_11_INFRASTRUCTURE_MODE (%d)",
   1073 			   (int) mode);
   1074 		/* Try to continue anyway */
   1075 	}
   1076 
   1077 	if (params->key_mgmt_suite == WPA_KEY_MGMT_NONE ||
   1078 	    params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
   1079 		/* Re-set WEP keys if static WEP configuration is used. */
   1080 		int i;
   1081 		for (i = 0; i < 4; i++) {
   1082 			if (!params->wep_key[i])
   1083 				continue;
   1084 			wpa_printf(MSG_DEBUG, "NDIS: Re-setting static WEP "
   1085 				   "key %d", i);
   1086 			wpa_driver_ndis_set_key(drv->ifname, drv, WPA_ALG_WEP,
   1087 						bcast, i,
   1088 						i == params->wep_tx_keyidx,
   1089 						NULL, 0, params->wep_key[i],
   1090 						params->wep_key_len[i]);
   1091 		}
   1092 	}
   1093 
   1094 	if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
   1095 		if (params->auth_alg & WPA_AUTH_ALG_SHARED) {
   1096 			if (params->auth_alg & WPA_AUTH_ALG_OPEN)
   1097 				auth_mode = Ndis802_11AuthModeAutoSwitch;
   1098 			else
   1099 				auth_mode = Ndis802_11AuthModeShared;
   1100 		} else
   1101 			auth_mode = Ndis802_11AuthModeOpen;
   1102 		priv_mode = Ndis802_11PrivFilterAcceptAll;
   1103 	} else if (params->wpa_ie[0] == WLAN_EID_RSN) {
   1104 		priv_mode = Ndis802_11PrivFilter8021xWEP;
   1105 		if (params->key_mgmt_suite == WPA_KEY_MGMT_PSK)
   1106 			auth_mode = Ndis802_11AuthModeWPA2PSK;
   1107 		else
   1108 			auth_mode = Ndis802_11AuthModeWPA2;
   1109 #ifdef CONFIG_WPS
   1110 	} else if (params->key_mgmt_suite == WPA_KEY_MGMT_WPS) {
   1111 		auth_mode = Ndis802_11AuthModeOpen;
   1112 		priv_mode = Ndis802_11PrivFilterAcceptAll;
   1113 		if (params->wps == WPS_MODE_PRIVACY) {
   1114 			u8 dummy_key[5] = { 0x11, 0x22, 0x33, 0x44, 0x55 };
   1115 			/*
   1116 			 * Some NDIS drivers refuse to associate in open mode
   1117 			 * configuration due to Privacy field mismatch, so use
   1118 			 * a workaround to make the configuration look like
   1119 			 * matching one for WPS provisioning.
   1120 			 */
   1121 			wpa_printf(MSG_DEBUG, "NDIS: Set dummy WEP key as a "
   1122 				   "workaround to allow driver to associate "
   1123 				   "for WPS");
   1124 			wpa_driver_ndis_set_key(drv->ifname, drv, WPA_ALG_WEP,
   1125 						bcast, 0, 1,
   1126 						NULL, 0, dummy_key,
   1127 						sizeof(dummy_key));
   1128 		}
   1129 #endif /* CONFIG_WPS */
   1130 	} else {
   1131 		priv_mode = Ndis802_11PrivFilter8021xWEP;
   1132 		if (params->key_mgmt_suite == WPA_KEY_MGMT_WPA_NONE)
   1133 			auth_mode = Ndis802_11AuthModeWPANone;
   1134 		else if (params->key_mgmt_suite == WPA_KEY_MGMT_PSK)
   1135 			auth_mode = Ndis802_11AuthModeWPAPSK;
   1136 		else
   1137 			auth_mode = Ndis802_11AuthModeWPA;
   1138 	}
   1139 
   1140 	switch (params->pairwise_suite) {
   1141 	case WPA_CIPHER_CCMP:
   1142 		encr = Ndis802_11Encryption3Enabled;
   1143 		break;
   1144 	case WPA_CIPHER_TKIP:
   1145 		encr = Ndis802_11Encryption2Enabled;
   1146 		break;
   1147 	case WPA_CIPHER_WEP40:
   1148 	case WPA_CIPHER_WEP104:
   1149 		encr = Ndis802_11Encryption1Enabled;
   1150 		break;
   1151 	case WPA_CIPHER_NONE:
   1152 #ifdef CONFIG_WPS
   1153 		if (params->wps == WPS_MODE_PRIVACY) {
   1154 			encr = Ndis802_11Encryption1Enabled;
   1155 			break;
   1156 		}
   1157 #endif /* CONFIG_WPS */
   1158 		if (params->group_suite == WPA_CIPHER_CCMP)
   1159 			encr = Ndis802_11Encryption3Enabled;
   1160 		else if (params->group_suite == WPA_CIPHER_TKIP)
   1161 			encr = Ndis802_11Encryption2Enabled;
   1162 		else
   1163 			encr = Ndis802_11EncryptionDisabled;
   1164 		break;
   1165 	default:
   1166 #ifdef CONFIG_WPS
   1167 		if (params->wps == WPS_MODE_PRIVACY) {
   1168 			encr = Ndis802_11Encryption1Enabled;
   1169 			break;
   1170 		}
   1171 #endif /* CONFIG_WPS */
   1172 		encr = Ndis802_11EncryptionDisabled;
   1173 		break;
   1174 	};
   1175 
   1176 	if (ndis_set_oid(drv, OID_802_11_PRIVACY_FILTER,
   1177 			 (char *) &priv_mode, sizeof(priv_mode)) < 0) {
   1178 		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
   1179 			   "OID_802_11_PRIVACY_FILTER (%d)",
   1180 			   (int) priv_mode);
   1181 		/* Try to continue anyway */
   1182 	}
   1183 
   1184 	ndis_set_auth_mode(drv, auth_mode);
   1185 	ndis_set_encr_status(drv, encr);
   1186 
   1187 	if (params->bssid) {
   1188 		ndis_set_oid(drv, OID_802_11_BSSID, (char *) params->bssid,
   1189 			     ETH_ALEN);
   1190 		drv->oid_bssid_set = 1;
   1191 	} else if (drv->oid_bssid_set) {
   1192 		ndis_set_oid(drv, OID_802_11_BSSID, "\xff\xff\xff\xff\xff\xff",
   1193 			     ETH_ALEN);
   1194 		drv->oid_bssid_set = 0;
   1195 	}
   1196 
   1197 	return wpa_driver_ndis_set_ssid(drv, params->ssid, params->ssid_len);
   1198 }
   1199 
   1200 
   1201 static int wpa_driver_ndis_set_pmkid(struct wpa_driver_ndis_data *drv)
   1202 {
   1203 	int len, count, i, ret;
   1204 	struct ndis_pmkid_entry *entry;
   1205 	NDIS_802_11_PMKID *p;
   1206 
   1207 	count = 0;
   1208 	entry = drv->pmkid;
   1209 	while (entry) {
   1210 		count++;
   1211 		if (count >= drv->no_of_pmkid)
   1212 			break;
   1213 		entry = entry->next;
   1214 	}
   1215 	len = 8 + count * sizeof(BSSID_INFO);
   1216 	p = os_zalloc(len);
   1217 	if (p == NULL)
   1218 		return -1;
   1219 
   1220 	p->Length = len;
   1221 	p->BSSIDInfoCount = count;
   1222 	entry = drv->pmkid;
   1223 	for (i = 0; i < count; i++) {
   1224 		os_memcpy(&p->BSSIDInfo[i].BSSID, entry->bssid, ETH_ALEN);
   1225 		os_memcpy(&p->BSSIDInfo[i].PMKID, entry->pmkid, 16);
   1226 		entry = entry->next;
   1227 	}
   1228 	wpa_hexdump(MSG_MSGDUMP, "NDIS: OID_802_11_PMKID", (u8 *) p, len);
   1229 	ret = ndis_set_oid(drv, OID_802_11_PMKID, (char *) p, len);
   1230 	os_free(p);
   1231 	return ret;
   1232 }
   1233 
   1234 
   1235 static int wpa_driver_ndis_add_pmkid(void *priv, const u8 *bssid,
   1236 				     const u8 *pmkid)
   1237 {
   1238 	struct wpa_driver_ndis_data *drv = priv;
   1239 	struct ndis_pmkid_entry *entry, *prev;
   1240 
   1241 	if (drv->no_of_pmkid == 0)
   1242 		return 0;
   1243 
   1244 	prev = NULL;
   1245 	entry = drv->pmkid;
   1246 	while (entry) {
   1247 		if (os_memcmp(entry->bssid, bssid, ETH_ALEN) == 0)
   1248 			break;
   1249 		prev = entry;
   1250 		entry = entry->next;
   1251 	}
   1252 
   1253 	if (entry) {
   1254 		/* Replace existing entry for this BSSID and move it into the
   1255 		 * beginning of the list. */
   1256 		os_memcpy(entry->pmkid, pmkid, 16);
   1257 		if (prev) {
   1258 			prev->next = entry->next;
   1259 			entry->next = drv->pmkid;
   1260 			drv->pmkid = entry;
   1261 		}
   1262 	} else {
   1263 		entry = os_malloc(sizeof(*entry));
   1264 		if (entry) {
   1265 			os_memcpy(entry->bssid, bssid, ETH_ALEN);
   1266 			os_memcpy(entry->pmkid, pmkid, 16);
   1267 			entry->next = drv->pmkid;
   1268 			drv->pmkid = entry;
   1269 		}
   1270 	}
   1271 
   1272 	return wpa_driver_ndis_set_pmkid(drv);
   1273 }
   1274 
   1275 
   1276 static int wpa_driver_ndis_remove_pmkid(void *priv, const u8 *bssid,
   1277 		 			const u8 *pmkid)
   1278 {
   1279 	struct wpa_driver_ndis_data *drv = priv;
   1280 	struct ndis_pmkid_entry *entry, *prev;
   1281 
   1282 	if (drv->no_of_pmkid == 0)
   1283 		return 0;
   1284 
   1285 	entry = drv->pmkid;
   1286 	prev = NULL;
   1287 	while (entry) {
   1288 		if (os_memcmp(entry->bssid, bssid, ETH_ALEN) == 0 &&
   1289 		    os_memcmp(entry->pmkid, pmkid, 16) == 0) {
   1290 			if (prev)
   1291 				prev->next = entry->next;
   1292 			else
   1293 				drv->pmkid = entry->next;
   1294 			os_free(entry);
   1295 			break;
   1296 		}
   1297 		prev = entry;
   1298 		entry = entry->next;
   1299 	}
   1300 	return wpa_driver_ndis_set_pmkid(drv);
   1301 }
   1302 
   1303 
   1304 static int wpa_driver_ndis_flush_pmkid(void *priv)
   1305 {
   1306 	struct wpa_driver_ndis_data *drv = priv;
   1307 	NDIS_802_11_PMKID p;
   1308 	struct ndis_pmkid_entry *pmkid, *prev;
   1309 	int prev_authmode, ret;
   1310 
   1311 	if (drv->no_of_pmkid == 0)
   1312 		return 0;
   1313 
   1314 	pmkid = drv->pmkid;
   1315 	drv->pmkid = NULL;
   1316 	while (pmkid) {
   1317 		prev = pmkid;
   1318 		pmkid = pmkid->next;
   1319 		os_free(prev);
   1320 	}
   1321 
   1322 	/*
   1323 	 * Some drivers may refuse OID_802_11_PMKID if authMode is not set to
   1324 	 * WPA2, so change authMode temporarily, if needed.
   1325 	 */
   1326 	prev_authmode = ndis_get_auth_mode(drv);
   1327 	if (prev_authmode != Ndis802_11AuthModeWPA2)
   1328 		ndis_set_auth_mode(drv, Ndis802_11AuthModeWPA2);
   1329 
   1330 	os_memset(&p, 0, sizeof(p));
   1331 	p.Length = 8;
   1332 	p.BSSIDInfoCount = 0;
   1333 	wpa_hexdump(MSG_MSGDUMP, "NDIS: OID_802_11_PMKID (flush)",
   1334 		    (u8 *) &p, 8);
   1335 	ret = ndis_set_oid(drv, OID_802_11_PMKID, (char *) &p, 8);
   1336 
   1337 	if (prev_authmode != Ndis802_11AuthModeWPA2)
   1338 		ndis_set_auth_mode(drv, prev_authmode);
   1339 
   1340 	return ret;
   1341 }
   1342 
   1343 
   1344 static int wpa_driver_ndis_get_associnfo(struct wpa_driver_ndis_data *drv)
   1345 {
   1346 	char buf[512], *pos;
   1347 	NDIS_802_11_ASSOCIATION_INFORMATION *ai;
   1348 	int len;
   1349 	union wpa_event_data data;
   1350 	NDIS_802_11_BSSID_LIST_EX *b;
   1351 	size_t blen, i;
   1352 
   1353 	len = ndis_get_oid(drv, OID_802_11_ASSOCIATION_INFORMATION, buf,
   1354 			   sizeof(buf));
   1355 	if (len < 0) {
   1356 		wpa_printf(MSG_DEBUG, "NDIS: failed to get association "
   1357 			   "information");
   1358 		return -1;
   1359 	}
   1360 	if (len > sizeof(buf)) {
   1361 		/* Some drivers seem to be producing incorrect length for this
   1362 		 * data. Limit the length to the current buffer size to avoid
   1363 		 * crashing in hexdump. The data seems to be otherwise valid,
   1364 		 * so better try to use it. */
   1365 		wpa_printf(MSG_DEBUG, "NDIS: ignored bogus association "
   1366 			   "information length %d", len);
   1367 		len = ndis_get_oid(drv, OID_802_11_ASSOCIATION_INFORMATION,
   1368 				   buf, sizeof(buf));
   1369 		if (len < -1) {
   1370 			wpa_printf(MSG_DEBUG, "NDIS: re-reading association "
   1371 				   "information failed");
   1372 			return -1;
   1373 		}
   1374 		if (len > sizeof(buf)) {
   1375 			wpa_printf(MSG_DEBUG, "NDIS: ignored bogus association"
   1376 				   " information length %d (re-read)", len);
   1377 			len = sizeof(buf);
   1378 		}
   1379 	}
   1380 	wpa_hexdump(MSG_MSGDUMP, "NDIS: association information",
   1381 		    (u8 *) buf, len);
   1382 	if (len < sizeof(*ai)) {
   1383 		wpa_printf(MSG_DEBUG, "NDIS: too short association "
   1384 			   "information");
   1385 		return -1;
   1386 	}
   1387 	ai = (NDIS_802_11_ASSOCIATION_INFORMATION *) buf;
   1388 	wpa_printf(MSG_DEBUG, "NDIS: ReqFixed=0x%x RespFixed=0x%x off_req=%d "
   1389 		   "off_resp=%d len_req=%d len_resp=%d",
   1390 		   ai->AvailableRequestFixedIEs, ai->AvailableResponseFixedIEs,
   1391 		   (int) ai->OffsetRequestIEs, (int) ai->OffsetResponseIEs,
   1392 		   (int) ai->RequestIELength, (int) ai->ResponseIELength);
   1393 
   1394 	if (ai->OffsetRequestIEs + ai->RequestIELength > (unsigned) len ||
   1395 	    ai->OffsetResponseIEs + ai->ResponseIELength > (unsigned) len) {
   1396 		wpa_printf(MSG_DEBUG, "NDIS: association information - "
   1397 			   "IE overflow");
   1398 		return -1;
   1399 	}
   1400 
   1401 	wpa_hexdump(MSG_MSGDUMP, "NDIS: Request IEs",
   1402 		    (u8 *) buf + ai->OffsetRequestIEs, ai->RequestIELength);
   1403 	wpa_hexdump(MSG_MSGDUMP, "NDIS: Response IEs",
   1404 		    (u8 *) buf + ai->OffsetResponseIEs, ai->ResponseIELength);
   1405 
   1406 	os_memset(&data, 0, sizeof(data));
   1407 	data.assoc_info.req_ies = (u8 *) buf + ai->OffsetRequestIEs;
   1408 	data.assoc_info.req_ies_len = ai->RequestIELength;
   1409 	data.assoc_info.resp_ies = (u8 *) buf + ai->OffsetResponseIEs;
   1410 	data.assoc_info.resp_ies_len = ai->ResponseIELength;
   1411 
   1412 	blen = 65535;
   1413 	b = os_zalloc(blen);
   1414 	if (b == NULL)
   1415 		goto skip_scan_results;
   1416 	len = ndis_get_oid(drv, OID_802_11_BSSID_LIST, (char *) b, blen);
   1417 	if (len < 0) {
   1418 		wpa_printf(MSG_DEBUG, "NDIS: failed to get scan results");
   1419 		os_free(b);
   1420 		b = NULL;
   1421 		goto skip_scan_results;
   1422 	}
   1423 	wpa_printf(MSG_DEBUG, "NDIS: %d BSSID items to process for AssocInfo",
   1424 		   (unsigned int) b->NumberOfItems);
   1425 
   1426 	pos = (char *) &b->Bssid[0];
   1427 	for (i = 0; i < b->NumberOfItems; i++) {
   1428 		NDIS_WLAN_BSSID_EX *bss = (NDIS_WLAN_BSSID_EX *) pos;
   1429 		if (os_memcmp(drv->bssid, bss->MacAddress, ETH_ALEN) == 0 &&
   1430 		    bss->IELength > sizeof(NDIS_802_11_FIXED_IEs)) {
   1431 			data.assoc_info.beacon_ies =
   1432 				((u8 *) bss->IEs) +
   1433 				sizeof(NDIS_802_11_FIXED_IEs);
   1434 			data.assoc_info.beacon_ies_len =
   1435 				bss->IELength - sizeof(NDIS_802_11_FIXED_IEs);
   1436 			wpa_hexdump(MSG_MSGDUMP, "NDIS: Beacon IEs",
   1437 				    data.assoc_info.beacon_ies,
   1438 				    data.assoc_info.beacon_ies_len);
   1439 			break;
   1440 		}
   1441 		pos += bss->Length;
   1442 		if (pos > (char *) b + blen)
   1443 			break;
   1444 	}
   1445 
   1446 skip_scan_results:
   1447 	wpa_supplicant_event(drv->ctx, EVENT_ASSOCINFO, &data);
   1448 
   1449 	os_free(b);
   1450 
   1451 	return 0;
   1452 }
   1453 
   1454 
   1455 static void wpa_driver_ndis_poll_timeout(void *eloop_ctx, void *timeout_ctx)
   1456 {
   1457 	struct wpa_driver_ndis_data *drv = eloop_ctx;
   1458 	u8 bssid[ETH_ALEN];
   1459 	int poll;
   1460 
   1461 	if (drv->wired)
   1462 		return;
   1463 
   1464 	if (wpa_driver_ndis_get_bssid(drv, bssid)) {
   1465 		/* Disconnected */
   1466 		if (!is_zero_ether_addr(drv->bssid)) {
   1467 			os_memset(drv->bssid, 0, ETH_ALEN);
   1468 			wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
   1469 		}
   1470 	} else {
   1471 		/* Connected */
   1472 		if (os_memcmp(drv->bssid, bssid, ETH_ALEN) != 0) {
   1473 			os_memcpy(drv->bssid, bssid, ETH_ALEN);
   1474 			wpa_driver_ndis_get_associnfo(drv);
   1475 			wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
   1476 		}
   1477 	}
   1478 
   1479 	/* When using integrated NDIS event receiver, we can skip BSSID
   1480 	 * polling when using infrastructure network. However, when using
   1481 	 * IBSS mode, many driver do not seem to generate connection event,
   1482 	 * so we need to enable BSSID polling to figure out when IBSS network
   1483 	 * has been formed.
   1484 	 */
   1485 	poll = drv->mode == IEEE80211_MODE_IBSS;
   1486 #ifndef CONFIG_NDIS_EVENTS_INTEGRATED
   1487 #ifndef _WIN32_WCE
   1488 	poll = 1;
   1489 #endif /* _WIN32_WCE */
   1490 #endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
   1491 
   1492 	if (poll) {
   1493 		eloop_register_timeout(1, 0, wpa_driver_ndis_poll_timeout,
   1494 					drv, NULL);
   1495 	}
   1496 }
   1497 
   1498 
   1499 static void wpa_driver_ndis_poll(void *priv)
   1500 {
   1501 	struct wpa_driver_ndis_data *drv = priv;
   1502 	eloop_cancel_timeout(wpa_driver_ndis_poll_timeout, drv, NULL);
   1503 	wpa_driver_ndis_poll_timeout(drv, NULL);
   1504 }
   1505 
   1506 
   1507 /* Called when driver generates Media Connect Event by calling
   1508  * NdisMIndicateStatus() with NDIS_STATUS_MEDIA_CONNECT */
   1509 void wpa_driver_ndis_event_connect(struct wpa_driver_ndis_data *drv)
   1510 {
   1511 	wpa_printf(MSG_DEBUG, "NDIS: Media Connect Event");
   1512 	if (wpa_driver_ndis_get_bssid(drv, drv->bssid) == 0) {
   1513 		wpa_driver_ndis_get_associnfo(drv);
   1514 		wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
   1515 	}
   1516 }
   1517 
   1518 
   1519 /* Called when driver generates Media Disconnect Event by calling
   1520  * NdisMIndicateStatus() with NDIS_STATUS_MEDIA_DISCONNECT */
   1521 void wpa_driver_ndis_event_disconnect(struct wpa_driver_ndis_data *drv)
   1522 {
   1523 	wpa_printf(MSG_DEBUG, "NDIS: Media Disconnect Event");
   1524 	os_memset(drv->bssid, 0, ETH_ALEN);
   1525 	wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
   1526 }
   1527 
   1528 
   1529 static void wpa_driver_ndis_event_auth(struct wpa_driver_ndis_data *drv,
   1530 				       const u8 *data, size_t data_len)
   1531 {
   1532 	NDIS_802_11_AUTHENTICATION_REQUEST *req;
   1533 	int pairwise = 0, group = 0;
   1534 	union wpa_event_data event;
   1535 
   1536 	if (data_len < sizeof(*req)) {
   1537 		wpa_printf(MSG_DEBUG, "NDIS: Too short Authentication Request "
   1538 			   "Event (len=%d)", data_len);
   1539 		return;
   1540 	}
   1541 	req = (NDIS_802_11_AUTHENTICATION_REQUEST *) data;
   1542 
   1543 	wpa_printf(MSG_DEBUG, "NDIS: Authentication Request Event: "
   1544 		   "Bssid " MACSTR " Flags 0x%x",
   1545 		   MAC2STR(req->Bssid), (int) req->Flags);
   1546 
   1547 	if ((req->Flags & NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR) ==
   1548 	    NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR)
   1549 		pairwise = 1;
   1550 	else if ((req->Flags & NDIS_802_11_AUTH_REQUEST_GROUP_ERROR) ==
   1551 	    NDIS_802_11_AUTH_REQUEST_GROUP_ERROR)
   1552 		group = 1;
   1553 
   1554 	if (pairwise || group) {
   1555 		os_memset(&event, 0, sizeof(event));
   1556 		event.michael_mic_failure.unicast = pairwise;
   1557 		wpa_supplicant_event(drv->ctx, EVENT_MICHAEL_MIC_FAILURE,
   1558 				     &event);
   1559 	}
   1560 }
   1561 
   1562 
   1563 static void wpa_driver_ndis_event_pmkid(struct wpa_driver_ndis_data *drv,
   1564 					const u8 *data, size_t data_len)
   1565 {
   1566 	NDIS_802_11_PMKID_CANDIDATE_LIST *pmkid;
   1567 	size_t i;
   1568 	union wpa_event_data event;
   1569 
   1570 	if (data_len < 8) {
   1571 		wpa_printf(MSG_DEBUG, "NDIS: Too short PMKID Candidate List "
   1572 			   "Event (len=%d)", data_len);
   1573 		return;
   1574 	}
   1575 	pmkid = (NDIS_802_11_PMKID_CANDIDATE_LIST *) data;
   1576 	wpa_printf(MSG_DEBUG, "NDIS: PMKID Candidate List Event - Version %d "
   1577 		   "NumCandidates %d",
   1578 		   (int) pmkid->Version, (int) pmkid->NumCandidates);
   1579 
   1580 	if (pmkid->Version != 1) {
   1581 		wpa_printf(MSG_DEBUG, "NDIS: Unsupported PMKID Candidate List "
   1582 			   "Version %d", (int) pmkid->Version);
   1583 		return;
   1584 	}
   1585 
   1586 	if (data_len < 8 + pmkid->NumCandidates * sizeof(PMKID_CANDIDATE)) {
   1587 		wpa_printf(MSG_DEBUG, "NDIS: PMKID Candidate List underflow");
   1588 		return;
   1589 	}
   1590 
   1591 	os_memset(&event, 0, sizeof(event));
   1592 	for (i = 0; i < pmkid->NumCandidates; i++) {
   1593 		PMKID_CANDIDATE *p = &pmkid->CandidateList[i];
   1594 		wpa_printf(MSG_DEBUG, "NDIS: %d: " MACSTR " Flags 0x%x",
   1595 			   i, MAC2STR(p->BSSID), (int) p->Flags);
   1596 		os_memcpy(event.pmkid_candidate.bssid, p->BSSID, ETH_ALEN);
   1597 		event.pmkid_candidate.index = i;
   1598 		event.pmkid_candidate.preauth =
   1599 			p->Flags & NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED;
   1600 		wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE,
   1601 				     &event);
   1602 	}
   1603 }
   1604 
   1605 
   1606 /* Called when driver calls NdisMIndicateStatus() with
   1607  * NDIS_STATUS_MEDIA_SPECIFIC_INDICATION */
   1608 void wpa_driver_ndis_event_media_specific(struct wpa_driver_ndis_data *drv,
   1609 					  const u8 *data, size_t data_len)
   1610 {
   1611 	NDIS_802_11_STATUS_INDICATION *status;
   1612 
   1613 	if (data == NULL || data_len < sizeof(*status))
   1614 		return;
   1615 
   1616 	wpa_hexdump(MSG_DEBUG, "NDIS: Media Specific Indication",
   1617 		    data, data_len);
   1618 
   1619 	status = (NDIS_802_11_STATUS_INDICATION *) data;
   1620 	data += sizeof(status);
   1621 	data_len -= sizeof(status);
   1622 
   1623 	switch (status->StatusType) {
   1624 	case Ndis802_11StatusType_Authentication:
   1625 		wpa_driver_ndis_event_auth(drv, data, data_len);
   1626 		break;
   1627 	case Ndis802_11StatusType_PMKID_CandidateList:
   1628 		wpa_driver_ndis_event_pmkid(drv, data, data_len);
   1629 		break;
   1630 	default:
   1631 		wpa_printf(MSG_DEBUG, "NDIS: Unknown StatusType %d",
   1632 			   (int) status->StatusType);
   1633 		break;
   1634 	}
   1635 }
   1636 
   1637 
   1638 /* Called when an adapter is added */
   1639 void wpa_driver_ndis_event_adapter_arrival(struct wpa_driver_ndis_data *drv)
   1640 {
   1641 	union wpa_event_data event;
   1642 	int i;
   1643 
   1644 	wpa_printf(MSG_DEBUG, "NDIS: Notify Adapter Arrival");
   1645 
   1646 	for (i = 0; i < 30; i++) {
   1647 		/* Re-open Packet32/NDISUIO connection */
   1648 		wpa_driver_ndis_adapter_close(drv);
   1649 		if (wpa_driver_ndis_adapter_init(drv) < 0 ||
   1650 		    wpa_driver_ndis_adapter_open(drv) < 0) {
   1651 			wpa_printf(MSG_DEBUG, "NDIS: Driver re-initialization "
   1652 				   "(%d) failed", i);
   1653 			os_sleep(1, 0);
   1654 		} else {
   1655 			wpa_printf(MSG_DEBUG, "NDIS: Driver re-initialized");
   1656 			break;
   1657 		}
   1658 	}
   1659 
   1660 	os_memset(&event, 0, sizeof(event));
   1661 	os_strlcpy(event.interface_status.ifname, drv->ifname,
   1662 		   sizeof(event.interface_status.ifname));
   1663 	event.interface_status.ievent = EVENT_INTERFACE_ADDED;
   1664 	wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
   1665 }
   1666 
   1667 
   1668 /* Called when an adapter is removed */
   1669 void wpa_driver_ndis_event_adapter_removal(struct wpa_driver_ndis_data *drv)
   1670 {
   1671 	union wpa_event_data event;
   1672 
   1673 	wpa_printf(MSG_DEBUG, "NDIS: Notify Adapter Removal");
   1674 	os_memset(&event, 0, sizeof(event));
   1675 	os_strlcpy(event.interface_status.ifname, drv->ifname,
   1676 		   sizeof(event.interface_status.ifname));
   1677 	event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
   1678 	wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
   1679 }
   1680 
   1681 
   1682 static void
   1683 wpa_driver_ndis_get_wpa_capability(struct wpa_driver_ndis_data *drv)
   1684 {
   1685 	wpa_printf(MSG_DEBUG, "NDIS: verifying driver WPA capability");
   1686 
   1687 	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeWPA) == 0 &&
   1688 	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeWPA) {
   1689 		wpa_printf(MSG_DEBUG, "NDIS: WPA key management supported");
   1690 		drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA;
   1691 	}
   1692 
   1693 	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeWPAPSK) == 0 &&
   1694 	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeWPAPSK) {
   1695 		wpa_printf(MSG_DEBUG, "NDIS: WPA-PSK key management "
   1696 			   "supported");
   1697 		drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
   1698 	}
   1699 
   1700 	if (ndis_set_encr_status(drv, Ndis802_11Encryption3Enabled) == 0 &&
   1701 	    ndis_get_encr_status(drv) == Ndis802_11Encryption3KeyAbsent) {
   1702 		wpa_printf(MSG_DEBUG, "NDIS: CCMP encryption supported");
   1703 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
   1704 	}
   1705 
   1706 	if (ndis_set_encr_status(drv, Ndis802_11Encryption2Enabled) == 0 &&
   1707 	    ndis_get_encr_status(drv) == Ndis802_11Encryption2KeyAbsent) {
   1708 		wpa_printf(MSG_DEBUG, "NDIS: TKIP encryption supported");
   1709 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
   1710 	}
   1711 
   1712 	if (ndis_set_encr_status(drv, Ndis802_11Encryption1Enabled) == 0 &&
   1713 	    ndis_get_encr_status(drv) == Ndis802_11Encryption1KeyAbsent) {
   1714 		wpa_printf(MSG_DEBUG, "NDIS: WEP encryption supported");
   1715 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40 |
   1716 			WPA_DRIVER_CAPA_ENC_WEP104;
   1717 	}
   1718 
   1719 	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeShared) == 0 &&
   1720 	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeShared) {
   1721 		drv->capa.auth |= WPA_DRIVER_AUTH_SHARED;
   1722 	}
   1723 
   1724 	if (ndis_set_auth_mode(drv, Ndis802_11AuthModeOpen) == 0 &&
   1725 	    ndis_get_auth_mode(drv) == Ndis802_11AuthModeOpen) {
   1726 		drv->capa.auth |= WPA_DRIVER_AUTH_OPEN;
   1727 	}
   1728 
   1729 	ndis_set_encr_status(drv, Ndis802_11EncryptionDisabled);
   1730 
   1731 	/* Could also verify OID_802_11_ADD_KEY error reporting and
   1732 	 * support for OID_802_11_ASSOCIATION_INFORMATION. */
   1733 
   1734 	if (drv->capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA &&
   1735 	    drv->capa.enc & (WPA_DRIVER_CAPA_ENC_TKIP |
   1736 			     WPA_DRIVER_CAPA_ENC_CCMP)) {
   1737 		wpa_printf(MSG_DEBUG, "NDIS: driver supports WPA");
   1738 		drv->has_capability = 1;
   1739 	} else {
   1740 		wpa_printf(MSG_DEBUG, "NDIS: no WPA support found");
   1741 	}
   1742 
   1743 	wpa_printf(MSG_DEBUG, "NDIS: driver capabilities: key_mgmt 0x%x "
   1744 		   "enc 0x%x auth 0x%x",
   1745 		   drv->capa.key_mgmt, drv->capa.enc, drv->capa.auth);
   1746 }
   1747 
   1748 
   1749 static void wpa_driver_ndis_get_capability(struct wpa_driver_ndis_data *drv)
   1750 {
   1751 	char buf[512];
   1752 	int len;
   1753 	size_t i;
   1754 	NDIS_802_11_CAPABILITY *c;
   1755 
   1756 	drv->capa.flags = WPA_DRIVER_FLAGS_DRIVER_IE;
   1757 
   1758 	len = ndis_get_oid(drv, OID_802_11_CAPABILITY, buf, sizeof(buf));
   1759 	if (len < 0) {
   1760 		wpa_driver_ndis_get_wpa_capability(drv);
   1761 		return;
   1762 	}
   1763 
   1764 	wpa_hexdump(MSG_MSGDUMP, "OID_802_11_CAPABILITY", (u8 *) buf, len);
   1765 	c = (NDIS_802_11_CAPABILITY *) buf;
   1766 	if (len < sizeof(*c) || c->Version != 2) {
   1767 		wpa_printf(MSG_DEBUG, "NDIS: unsupported "
   1768 			   "OID_802_11_CAPABILITY data");
   1769 		return;
   1770 	}
   1771 	wpa_printf(MSG_DEBUG, "NDIS: Driver supports OID_802_11_CAPABILITY - "
   1772 		   "NoOfPMKIDs %d NoOfAuthEncrPairs %d",
   1773 		   (int) c->NoOfPMKIDs,
   1774 		   (int) c->NoOfAuthEncryptPairsSupported);
   1775 	drv->has_capability = 1;
   1776 	drv->no_of_pmkid = c->NoOfPMKIDs;
   1777 	for (i = 0; i < c->NoOfAuthEncryptPairsSupported; i++) {
   1778 		NDIS_802_11_AUTHENTICATION_ENCRYPTION *ae;
   1779 		ae = &c->AuthenticationEncryptionSupported[i];
   1780 		if ((char *) (ae + 1) > buf + len) {
   1781 			wpa_printf(MSG_DEBUG, "NDIS: auth/encr pair list "
   1782 				   "overflow");
   1783 			break;
   1784 		}
   1785 		wpa_printf(MSG_MSGDUMP, "NDIS: %d - auth %d encr %d",
   1786 			   i, (int) ae->AuthModeSupported,
   1787 			   (int) ae->EncryptStatusSupported);
   1788 		switch (ae->AuthModeSupported) {
   1789 		case Ndis802_11AuthModeOpen:
   1790 			drv->capa.auth |= WPA_DRIVER_AUTH_OPEN;
   1791 			break;
   1792 		case Ndis802_11AuthModeShared:
   1793 			drv->capa.auth |= WPA_DRIVER_AUTH_SHARED;
   1794 			break;
   1795 		case Ndis802_11AuthModeWPA:
   1796 			drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA;
   1797 			break;
   1798 		case Ndis802_11AuthModeWPAPSK:
   1799 			drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
   1800 			break;
   1801 		case Ndis802_11AuthModeWPA2:
   1802 			drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA2;
   1803 			break;
   1804 		case Ndis802_11AuthModeWPA2PSK:
   1805 			drv->capa.key_mgmt |=
   1806 				WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
   1807 			break;
   1808 		case Ndis802_11AuthModeWPANone:
   1809 			drv->capa.key_mgmt |=
   1810 				WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE;
   1811 			break;
   1812 		default:
   1813 			break;
   1814 		}
   1815 		switch (ae->EncryptStatusSupported) {
   1816 		case Ndis802_11Encryption1Enabled:
   1817 			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40;
   1818 			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP104;
   1819 			break;
   1820 		case Ndis802_11Encryption2Enabled:
   1821 			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
   1822 			break;
   1823 		case Ndis802_11Encryption3Enabled:
   1824 			drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
   1825 			break;
   1826 		default:
   1827 			break;
   1828 		}
   1829 	}
   1830 
   1831 	wpa_printf(MSG_DEBUG, "NDIS: driver capabilities: key_mgmt 0x%x "
   1832 		   "enc 0x%x auth 0x%x",
   1833 		   drv->capa.key_mgmt, drv->capa.enc, drv->capa.auth);
   1834 }
   1835 
   1836 
   1837 static int wpa_driver_ndis_get_capa(void *priv, struct wpa_driver_capa *capa)
   1838 {
   1839 	struct wpa_driver_ndis_data *drv = priv;
   1840 	if (!drv->has_capability)
   1841 		return -1;
   1842 	os_memcpy(capa, &drv->capa, sizeof(*capa));
   1843 	return 0;
   1844 }
   1845 
   1846 
   1847 static const char * wpa_driver_ndis_get_ifname(void *priv)
   1848 {
   1849 	struct wpa_driver_ndis_data *drv = priv;
   1850 	return drv->ifname;
   1851 }
   1852 
   1853 
   1854 static const u8 * wpa_driver_ndis_get_mac_addr(void *priv)
   1855 {
   1856 	struct wpa_driver_ndis_data *drv = priv;
   1857 	return drv->own_addr;
   1858 }
   1859 
   1860 
   1861 #ifdef _WIN32_WCE
   1862 
   1863 #define NDISUIO_MSG_SIZE (sizeof(NDISUIO_DEVICE_NOTIFICATION) + 512)
   1864 
   1865 static void ndisuio_notification_receive(void *eloop_data, void *user_ctx)
   1866 {
   1867 	struct wpa_driver_ndis_data *drv = eloop_data;
   1868 	NDISUIO_DEVICE_NOTIFICATION *hdr;
   1869 	u8 buf[NDISUIO_MSG_SIZE];
   1870 	DWORD len, flags;
   1871 
   1872 	if (!ReadMsgQueue(drv->event_queue, buf, NDISUIO_MSG_SIZE, &len, 0,
   1873 			  &flags)) {
   1874 		wpa_printf(MSG_DEBUG, "ndisuio_notification_receive: "
   1875 			   "ReadMsgQueue failed: %d", (int) GetLastError());
   1876 		return;
   1877 	}
   1878 
   1879 	if (len < sizeof(NDISUIO_DEVICE_NOTIFICATION)) {
   1880 		wpa_printf(MSG_DEBUG, "ndisuio_notification_receive: "
   1881 			   "Too short message (len=%d)", (int) len);
   1882 		return;
   1883 	}
   1884 
   1885 	hdr = (NDISUIO_DEVICE_NOTIFICATION *) buf;
   1886 	wpa_printf(MSG_DEBUG, "NDIS: Notification received: len=%d type=0x%x",
   1887 		   (int) len, hdr->dwNotificationType);
   1888 
   1889 	switch (hdr->dwNotificationType) {
   1890 #ifdef NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL
   1891 	case NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL:
   1892 		wpa_printf(MSG_DEBUG, "NDIS: ADAPTER_ARRIVAL");
   1893 		wpa_driver_ndis_event_adapter_arrival(drv);
   1894 		break;
   1895 #endif
   1896 #ifdef NDISUIO_NOTIFICATION_ADAPTER_REMOVAL
   1897 	case NDISUIO_NOTIFICATION_ADAPTER_REMOVAL:
   1898 		wpa_printf(MSG_DEBUG, "NDIS: ADAPTER_REMOVAL");
   1899 		wpa_driver_ndis_event_adapter_removal(drv);
   1900 		break;
   1901 #endif
   1902 	case NDISUIO_NOTIFICATION_MEDIA_CONNECT:
   1903 		wpa_printf(MSG_DEBUG, "NDIS: MEDIA_CONNECT");
   1904 		SetEvent(drv->connected_event);
   1905 		wpa_driver_ndis_event_connect(drv);
   1906 		break;
   1907 	case NDISUIO_NOTIFICATION_MEDIA_DISCONNECT:
   1908 		ResetEvent(drv->connected_event);
   1909 		wpa_printf(MSG_DEBUG, "NDIS: MEDIA_DISCONNECT");
   1910 		wpa_driver_ndis_event_disconnect(drv);
   1911 		break;
   1912 	case NDISUIO_NOTIFICATION_MEDIA_SPECIFIC_NOTIFICATION:
   1913 		wpa_printf(MSG_DEBUG, "NDIS: MEDIA_SPECIFIC_NOTIFICATION");
   1914 #if _WIN32_WCE == 420 || _WIN32_WCE == 0x420
   1915 		wpa_driver_ndis_event_media_specific(
   1916 			drv, hdr->pvStatusBuffer, hdr->uiStatusBufferSize);
   1917 #else
   1918 		wpa_driver_ndis_event_media_specific(
   1919 			drv, ((const u8 *) hdr) + hdr->uiOffsetToStatusBuffer,
   1920 			(size_t) hdr->uiStatusBufferSize);
   1921 #endif
   1922 		break;
   1923 	default:
   1924 		wpa_printf(MSG_DEBUG, "NDIS: Unknown notification type 0x%x",
   1925 			   hdr->dwNotificationType);
   1926 		break;
   1927 	}
   1928 }
   1929 
   1930 
   1931 static void ndisuio_notification_deinit(struct wpa_driver_ndis_data *drv)
   1932 {
   1933 	NDISUIO_REQUEST_NOTIFICATION req;
   1934 
   1935 	memset(&req, 0, sizeof(req));
   1936 	req.hMsgQueue = drv->event_queue;
   1937 	req.dwNotificationTypes = 0;
   1938 
   1939 	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_REQUEST_NOTIFICATION,
   1940 			     &req, sizeof(req), NULL, 0, NULL, NULL)) {
   1941 		wpa_printf(MSG_INFO, "ndisuio_notification_deinit: "
   1942 			   "IOCTL_NDISUIO_REQUEST_NOTIFICATION failed: %d",
   1943 			   (int) GetLastError());
   1944 	}
   1945 
   1946 	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_CANCEL_NOTIFICATION,
   1947 			     NULL, 0, NULL, 0, NULL, NULL)) {
   1948 		wpa_printf(MSG_INFO, "ndisuio_notification_deinit: "
   1949 			   "IOCTL_NDISUIO_CANCEL_NOTIFICATION failed: %d",
   1950 			   (int) GetLastError());
   1951 	}
   1952 
   1953 	if (drv->event_queue) {
   1954 		eloop_unregister_event(drv->event_queue,
   1955 				       sizeof(drv->event_queue));
   1956 		CloseHandle(drv->event_queue);
   1957 		drv->event_queue = NULL;
   1958 	}
   1959 
   1960 	if (drv->connected_event) {
   1961 		CloseHandle(drv->connected_event);
   1962 		drv->connected_event = NULL;
   1963 	}
   1964 }
   1965 
   1966 
   1967 static int ndisuio_notification_init(struct wpa_driver_ndis_data *drv)
   1968 {
   1969 	MSGQUEUEOPTIONS opt;
   1970 	NDISUIO_REQUEST_NOTIFICATION req;
   1971 
   1972 	drv->connected_event =
   1973 		CreateEvent(NULL, TRUE, FALSE, TEXT("WpaSupplicantConnected"));
   1974 	if (drv->connected_event == NULL) {
   1975 		wpa_printf(MSG_INFO, "ndisuio_notification_init: "
   1976 			   "CreateEvent failed: %d",
   1977 			   (int) GetLastError());
   1978 		return -1;
   1979 	}
   1980 
   1981 	memset(&opt, 0, sizeof(opt));
   1982 	opt.dwSize = sizeof(opt);
   1983 	opt.dwMaxMessages = 5;
   1984 	opt.cbMaxMessage = NDISUIO_MSG_SIZE;
   1985 	opt.bReadAccess = TRUE;
   1986 
   1987 	drv->event_queue = CreateMsgQueue(NULL, &opt);
   1988 	if (drv->event_queue == NULL) {
   1989 		wpa_printf(MSG_INFO, "ndisuio_notification_init: "
   1990 			   "CreateMsgQueue failed: %d",
   1991 			   (int) GetLastError());
   1992 		ndisuio_notification_deinit(drv);
   1993 		return -1;
   1994 	}
   1995 
   1996 	memset(&req, 0, sizeof(req));
   1997 	req.hMsgQueue = drv->event_queue;
   1998 	req.dwNotificationTypes =
   1999 #ifdef NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL
   2000 		NDISUIO_NOTIFICATION_ADAPTER_ARRIVAL |
   2001 #endif
   2002 #ifdef NDISUIO_NOTIFICATION_ADAPTER_REMOVAL
   2003 		NDISUIO_NOTIFICATION_ADAPTER_REMOVAL |
   2004 #endif
   2005 		NDISUIO_NOTIFICATION_MEDIA_CONNECT |
   2006 		NDISUIO_NOTIFICATION_MEDIA_DISCONNECT |
   2007 		NDISUIO_NOTIFICATION_MEDIA_SPECIFIC_NOTIFICATION;
   2008 
   2009 	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_REQUEST_NOTIFICATION,
   2010 			     &req, sizeof(req), NULL, 0, NULL, NULL)) {
   2011 		wpa_printf(MSG_INFO, "ndisuio_notification_init: "
   2012 			   "IOCTL_NDISUIO_REQUEST_NOTIFICATION failed: %d",
   2013 			   (int) GetLastError());
   2014 		ndisuio_notification_deinit(drv);
   2015 		return -1;
   2016 	}
   2017 
   2018 	eloop_register_event(drv->event_queue, sizeof(drv->event_queue),
   2019 			     ndisuio_notification_receive, drv, NULL);
   2020 
   2021 	return 0;
   2022 }
   2023 #endif /* _WIN32_WCE */
   2024 
   2025 
   2026 static int wpa_driver_ndis_get_names(struct wpa_driver_ndis_data *drv)
   2027 {
   2028 #ifdef CONFIG_USE_NDISUIO
   2029 	NDISUIO_QUERY_BINDING *b;
   2030 	size_t blen = sizeof(*b) + 1024;
   2031 	int i, error, found = 0;
   2032 	DWORD written;
   2033 	char name[256], desc[256], *dpos;
   2034 	WCHAR *pos;
   2035 	size_t j, len, dlen;
   2036 
   2037 	b = os_malloc(blen);
   2038 	if (b == NULL)
   2039 		return -1;
   2040 
   2041 	for (i = 0; ; i++) {
   2042 		os_memset(b, 0, blen);
   2043 		b->BindingIndex = i;
   2044 		if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_QUERY_BINDING,
   2045 				     b, sizeof(NDISUIO_QUERY_BINDING), b, blen,
   2046 				     &written, NULL)) {
   2047 			error = (int) GetLastError();
   2048 			if (error == ERROR_NO_MORE_ITEMS)
   2049 				break;
   2050 			wpa_printf(MSG_DEBUG, "IOCTL_NDISUIO_QUERY_BINDING "
   2051 				   "failed: %d", error);
   2052 			break;
   2053 		}
   2054 
   2055 		pos = (WCHAR *) ((char *) b + b->DeviceNameOffset);
   2056 		len = b->DeviceNameLength;
   2057 		if (len >= sizeof(name))
   2058 			len = sizeof(name) - 1;
   2059 		for (j = 0; j < len; j++)
   2060 			name[j] = (char) pos[j];
   2061 		name[len] = '\0';
   2062 
   2063 		pos = (WCHAR *) ((char *) b + b->DeviceDescrOffset);
   2064 		len = b->DeviceDescrLength;
   2065 		if (len >= sizeof(desc))
   2066 			len = sizeof(desc) - 1;
   2067 		for (j = 0; j < len; j++)
   2068 			desc[j] = (char) pos[j];
   2069 		desc[len] = '\0';
   2070 
   2071 		wpa_printf(MSG_DEBUG, "NDIS: %d - %s - %s", i, name, desc);
   2072 
   2073 		if (os_strstr(name, drv->ifname)) {
   2074 			wpa_printf(MSG_DEBUG, "NDIS: Interface name match");
   2075 			found = 1;
   2076 			break;
   2077 		}
   2078 
   2079 		if (os_strncmp(desc, drv->ifname, os_strlen(drv->ifname)) == 0)
   2080 		{
   2081 			wpa_printf(MSG_DEBUG, "NDIS: Interface description "
   2082 				   "match");
   2083 			found = 1;
   2084 			break;
   2085 		}
   2086 	}
   2087 
   2088 	if (!found) {
   2089 		wpa_printf(MSG_DEBUG, "NDIS: Could not find interface '%s'",
   2090 			   drv->ifname);
   2091 		os_free(b);
   2092 		return -1;
   2093 	}
   2094 
   2095 	os_strlcpy(drv->ifname,
   2096 		   os_strncmp(name, "\\DEVICE\\", 8) == 0 ? name + 8 : name,
   2097 		   sizeof(drv->ifname));
   2098 #ifdef _WIN32_WCE
   2099 	drv->adapter_name = wpa_strdup_tchar(drv->ifname);
   2100 	if (drv->adapter_name == NULL) {
   2101 		wpa_printf(MSG_ERROR, "NDIS: Failed to allocate memory for "
   2102 			   "adapter name");
   2103 		os_free(b);
   2104 		return -1;
   2105 	}
   2106 #endif /* _WIN32_WCE */
   2107 
   2108 	dpos = os_strstr(desc, " - ");
   2109 	if (dpos)
   2110 		dlen = dpos - desc;
   2111 	else
   2112 		dlen = os_strlen(desc);
   2113 	drv->adapter_desc = dup_binstr(desc, dlen);
   2114 	os_free(b);
   2115 	if (drv->adapter_desc == NULL)
   2116 		return -1;
   2117 
   2118 	wpa_printf(MSG_DEBUG, "NDIS: Adapter description prefix '%s'",
   2119 		   drv->adapter_desc);
   2120 
   2121 	return 0;
   2122 #else /* CONFIG_USE_NDISUIO */
   2123 	PTSTR _names;
   2124 	char *names, *pos, *pos2;
   2125 	ULONG len;
   2126 	BOOLEAN res;
   2127 #define MAX_ADAPTERS 32
   2128 	char *name[MAX_ADAPTERS];
   2129 	char *desc[MAX_ADAPTERS];
   2130 	int num_name, num_desc, i, found_name, found_desc;
   2131 	size_t dlen;
   2132 
   2133 	wpa_printf(MSG_DEBUG, "NDIS: Packet.dll version: %s",
   2134 		   PacketGetVersion());
   2135 
   2136 	len = 8192;
   2137 	_names = os_zalloc(len);
   2138 	if (_names == NULL)
   2139 		return -1;
   2140 
   2141 	res = PacketGetAdapterNames(_names, &len);
   2142 	if (!res && len > 8192) {
   2143 		os_free(_names);
   2144 		_names = os_zalloc(len);
   2145 		if (_names == NULL)
   2146 			return -1;
   2147 		res = PacketGetAdapterNames(_names, &len);
   2148 	}
   2149 
   2150 	if (!res) {
   2151 		wpa_printf(MSG_ERROR, "NDIS: Failed to get adapter list "
   2152 			   "(PacketGetAdapterNames)");
   2153 		os_free(_names);
   2154 		return -1;
   2155 	}
   2156 
   2157 	names = (char *) _names;
   2158 	if (names[0] && names[1] == '\0' && names[2] && names[3] == '\0') {
   2159 		wpa_printf(MSG_DEBUG, "NDIS: Looks like adapter names are in "
   2160 			   "UNICODE");
   2161 		/* Convert to ASCII */
   2162 		pos2 = pos = names;
   2163 		while (pos2 < names + len) {
   2164 			if (pos2[0] == '\0' && pos2[1] == '\0' &&
   2165 			    pos2[2] == '\0' && pos2[3] == '\0') {
   2166 				pos2 += 4;
   2167 				break;
   2168 			}
   2169 			*pos++ = pos2[0];
   2170 			pos2 += 2;
   2171 		}
   2172 		os_memcpy(pos + 2, names, pos - names);
   2173 		pos += 2;
   2174 	} else
   2175 		pos = names;
   2176 
   2177 	num_name = 0;
   2178 	while (pos < names + len) {
   2179 		name[num_name] = pos;
   2180 		while (*pos && pos < names + len)
   2181 			pos++;
   2182 		if (pos + 1 >= names + len) {
   2183 			os_free(names);
   2184 			return -1;
   2185 		}
   2186 		pos++;
   2187 		num_name++;
   2188 		if (num_name >= MAX_ADAPTERS) {
   2189 			wpa_printf(MSG_DEBUG, "NDIS: Too many adapters");
   2190 			os_free(names);
   2191 			return -1;
   2192 		}
   2193 		if (*pos == '\0') {
   2194 			wpa_printf(MSG_DEBUG, "NDIS: %d adapter names found",
   2195 				   num_name);
   2196 			pos++;
   2197 			break;
   2198 		}
   2199 	}
   2200 
   2201 	num_desc = 0;
   2202 	while (pos < names + len) {
   2203 		desc[num_desc] = pos;
   2204 		while (*pos && pos < names + len)
   2205 			pos++;
   2206 		if (pos + 1 >= names + len) {
   2207 			os_free(names);
   2208 			return -1;
   2209 		}
   2210 		pos++;
   2211 		num_desc++;
   2212 		if (num_desc >= MAX_ADAPTERS) {
   2213 			wpa_printf(MSG_DEBUG, "NDIS: Too many adapter "
   2214 				   "descriptions");
   2215 			os_free(names);
   2216 			return -1;
   2217 		}
   2218 		if (*pos == '\0') {
   2219 			wpa_printf(MSG_DEBUG, "NDIS: %d adapter descriptions "
   2220 				   "found", num_name);
   2221 			pos++;
   2222 			break;
   2223 		}
   2224 	}
   2225 
   2226 	/*
   2227 	 * Windows 98 with Packet.dll 3.0 alpha3 does not include adapter
   2228 	 * descriptions. Fill in dummy descriptors to work around this.
   2229 	 */
   2230 	while (num_desc < num_name)
   2231 		desc[num_desc++] = "dummy description";
   2232 
   2233 	if (num_name != num_desc) {
   2234 		wpa_printf(MSG_DEBUG, "NDIS: mismatch in adapter name and "
   2235 			   "description counts (%d != %d)",
   2236 			   num_name, num_desc);
   2237 		os_free(names);
   2238 		return -1;
   2239 	}
   2240 
   2241 	found_name = found_desc = -1;
   2242 	for (i = 0; i < num_name; i++) {
   2243 		wpa_printf(MSG_DEBUG, "NDIS: %d - %s - %s",
   2244 			   i, name[i], desc[i]);
   2245 		if (found_name == -1 && os_strstr(name[i], drv->ifname))
   2246 			found_name = i;
   2247 		if (found_desc == -1 &&
   2248 		    os_strncmp(desc[i], drv->ifname, os_strlen(drv->ifname)) ==
   2249 		    0)
   2250 			found_desc = i;
   2251 	}
   2252 
   2253 	if (found_name < 0 && found_desc >= 0) {
   2254 		wpa_printf(MSG_DEBUG, "NDIS: Matched interface '%s' based on "
   2255 			   "description '%s'",
   2256 			   name[found_desc], desc[found_desc]);
   2257 		found_name = found_desc;
   2258 		os_strlcpy(drv->ifname,
   2259 			   os_strncmp(name[found_desc], "\\Device\\NPF_", 12)
   2260 			   == 0 ? name[found_desc] + 12 : name[found_desc],
   2261 			   sizeof(drv->ifname));
   2262 	}
   2263 
   2264 	if (found_name < 0) {
   2265 		wpa_printf(MSG_DEBUG, "NDIS: Could not find interface '%s'",
   2266 			   drv->ifname);
   2267 		os_free(names);
   2268 		return -1;
   2269 	}
   2270 
   2271 	i = found_name;
   2272 	pos = os_strrchr(desc[i], '(');
   2273 	if (pos) {
   2274 		dlen = pos - desc[i];
   2275 		pos--;
   2276 		if (pos > desc[i] && *pos == ' ')
   2277 			dlen--;
   2278 	} else {
   2279 		dlen = os_strlen(desc[i]);
   2280 	}
   2281 	drv->adapter_desc = dup_binstr(desc[i], dlen);
   2282 	os_free(names);
   2283 	if (drv->adapter_desc == NULL)
   2284 		return -1;
   2285 
   2286 	wpa_printf(MSG_DEBUG, "NDIS: Adapter description prefix '%s'",
   2287 		   drv->adapter_desc);
   2288 
   2289 	return 0;
   2290 #endif /* CONFIG_USE_NDISUIO */
   2291 }
   2292 
   2293 
   2294 #if defined(CONFIG_NATIVE_WINDOWS) || defined(__CYGWIN__)
   2295 #ifndef _WIN32_WCE
   2296 /*
   2297  * These structures are undocumented for WinXP; only WinCE version is
   2298  * documented. These would be included wzcsapi.h if it were available. Some
   2299  * changes here have been needed to make the structures match with WinXP SP2.
   2300  * It is unclear whether these work with any other version.
   2301  */
   2302 
   2303 typedef struct {
   2304 	LPWSTR wszGuid;
   2305 } INTF_KEY_ENTRY, *PINTF_KEY_ENTRY;
   2306 
   2307 typedef struct {
   2308 	DWORD dwNumIntfs;
   2309 	PINTF_KEY_ENTRY pIntfs;
   2310 } INTFS_KEY_TABLE, *PINTFS_KEY_TABLE;
   2311 
   2312 typedef struct {
   2313 	DWORD dwDataLen;
   2314 	LPBYTE pData;
   2315 } RAW_DATA, *PRAW_DATA;
   2316 
   2317 typedef struct {
   2318 	LPWSTR wszGuid;
   2319 	LPWSTR wszDescr;
   2320 	ULONG ulMediaState;
   2321 	ULONG ulMediaType;
   2322 	ULONG ulPhysicalMediaType;
   2323 	INT nInfraMode;
   2324 	INT nAuthMode;
   2325 	INT nWepStatus;
   2326 #ifndef _WIN32_WCE
   2327 	u8 pad[2]; /* why is this needed? */
   2328 #endif /* _WIN32_WCE */
   2329 	DWORD dwCtlFlags;
   2330 	DWORD dwCapabilities; /* something added for WinXP SP2(?) */
   2331 	RAW_DATA rdSSID;
   2332 	RAW_DATA rdBSSID;
   2333 	RAW_DATA rdBSSIDList;
   2334 	RAW_DATA rdStSSIDList;
   2335 	RAW_DATA rdCtrlData;
   2336 #ifdef UNDER_CE
   2337 	BOOL bInitialized;
   2338 #endif
   2339 	DWORD nWPAMCastCipher;
   2340 	/* add some extra buffer for later additions since this interface is
   2341 	 * far from stable */
   2342 	u8 later_additions[100];
   2343 } INTF_ENTRY, *PINTF_ENTRY;
   2344 
   2345 #define INTF_ALL 0xffffffff
   2346 #define INTF_ALL_FLAGS 0x0000ffff
   2347 #define INTF_CTLFLAGS 0x00000010
   2348 #define INTFCTL_ENABLED 0x8000
   2349 #endif /* _WIN32_WCE */
   2350 
   2351 
   2352 #ifdef _WIN32_WCE
   2353 static int wpa_driver_ndis_rebind_adapter(struct wpa_driver_ndis_data *drv)
   2354 {
   2355 	HANDLE ndis;
   2356 	TCHAR multi[100];
   2357 	int len;
   2358 
   2359 	len = _tcslen(drv->adapter_name);
   2360 	if (len > 80)
   2361 		return -1;
   2362 
   2363 	ndis = CreateFile(DD_NDIS_DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
   2364 			  0, NULL, OPEN_EXISTING, 0, NULL);
   2365 	if (ndis == INVALID_HANDLE_VALUE) {
   2366 		wpa_printf(MSG_DEBUG, "NDIS: Failed to open file to NDIS "
   2367 			   "device: %d", (int) GetLastError());
   2368 		return -1;
   2369 	}
   2370 
   2371 	len++;
   2372 	memcpy(multi, drv->adapter_name, len * sizeof(TCHAR));
   2373 	memcpy(&multi[len], TEXT("NDISUIO\0"), 9 * sizeof(TCHAR));
   2374 	len += 9;
   2375 
   2376 	if (!DeviceIoControl(ndis, IOCTL_NDIS_REBIND_ADAPTER,
   2377 			     multi, len * sizeof(TCHAR), NULL, 0, NULL, NULL))
   2378 	{
   2379 		wpa_printf(MSG_DEBUG, "NDIS: IOCTL_NDIS_REBIND_ADAPTER "
   2380 			   "failed: 0x%x", (int) GetLastError());
   2381 		wpa_hexdump_ascii(MSG_DEBUG, "NDIS: rebind multi_sz",
   2382 				  (u8 *) multi, len * sizeof(TCHAR));
   2383 		CloseHandle(ndis);
   2384 		return -1;
   2385 	}
   2386 
   2387 	CloseHandle(ndis);
   2388 
   2389 	wpa_printf(MSG_DEBUG, "NDIS: Requested NDIS rebind of NDISUIO "
   2390 		   "protocol");
   2391 
   2392 	return 0;
   2393 }
   2394 #endif /* _WIN32_WCE */
   2395 
   2396 
   2397 static int wpa_driver_ndis_set_wzc(struct wpa_driver_ndis_data *drv,
   2398 				   int enable)
   2399 {
   2400 #ifdef _WIN32_WCE
   2401 	HKEY hk, hk2;
   2402 	LONG ret;
   2403 	DWORD i, hnd, len;
   2404 	TCHAR keyname[256], devname[256];
   2405 
   2406 #define WZC_DRIVER TEXT("Drivers\\BuiltIn\\ZeroConfig")
   2407 
   2408 	if (enable) {
   2409 		HANDLE h;
   2410 		h = ActivateDeviceEx(WZC_DRIVER, NULL, 0, NULL);
   2411 		if (h == INVALID_HANDLE_VALUE || h == 0) {
   2412 			wpa_printf(MSG_DEBUG, "NDIS: Failed to re-enable WZC "
   2413 				   "- ActivateDeviceEx failed: %d",
   2414 				   (int) GetLastError());
   2415 			return -1;
   2416 		}
   2417 
   2418 		wpa_printf(MSG_DEBUG, "NDIS: WZC re-enabled");
   2419 		return wpa_driver_ndis_rebind_adapter(drv);
   2420 	}
   2421 
   2422 	/*
   2423 	 * Unfortunately, just disabling the WZC for an interface is not enough
   2424 	 * to free NDISUIO for us, so need to disable and unload WZC completely
   2425 	 * for now when using WinCE with NDISUIO. In addition, must request
   2426 	 * NDISUIO protocol to be rebound to the adapter in order to free the
   2427 	 * NDISUIO binding that WZC hold before us.
   2428 	 */
   2429 
   2430 	/* Enumerate HKLM\Drivers\Active\* to find a handle to WZC. */
   2431 	ret = RegOpenKeyEx(HKEY_LOCAL_MACHINE, DEVLOAD_ACTIVE_KEY, 0, 0, &hk);
   2432 	if (ret != ERROR_SUCCESS) {
   2433 		wpa_printf(MSG_DEBUG, "NDIS: RegOpenKeyEx(DEVLOAD_ACTIVE_KEY) "
   2434 			   "failed: %d %d", (int) ret, (int) GetLastError());
   2435 		return -1;
   2436 	}
   2437 
   2438 	for (i = 0; ; i++) {
   2439 		len = sizeof(keyname);
   2440 		ret = RegEnumKeyEx(hk, i, keyname, &len, NULL, NULL, NULL,
   2441 				   NULL);
   2442 		if (ret != ERROR_SUCCESS) {
   2443 			wpa_printf(MSG_DEBUG, "NDIS: Could not find active "
   2444 				   "WZC - assuming it is not running.");
   2445 			RegCloseKey(hk);
   2446 			return -1;
   2447 		}
   2448 
   2449 		ret = RegOpenKeyEx(hk, keyname, 0, 0, &hk2);
   2450 		if (ret != ERROR_SUCCESS) {
   2451 			wpa_printf(MSG_DEBUG, "NDIS: RegOpenKeyEx(active dev) "
   2452 				   "failed: %d %d",
   2453 				   (int) ret, (int) GetLastError());
   2454 			continue;
   2455 		}
   2456 
   2457 		len = sizeof(devname);
   2458 		ret = RegQueryValueEx(hk2, DEVLOAD_DEVKEY_VALNAME, NULL, NULL,
   2459 				      (LPBYTE) devname, &len);
   2460 		if (ret != ERROR_SUCCESS) {
   2461 			wpa_printf(MSG_DEBUG, "NDIS: RegQueryValueEx("
   2462 				   "DEVKEY_VALNAME) failed: %d %d",
   2463 				   (int) ret, (int) GetLastError());
   2464 			RegCloseKey(hk2);
   2465 			continue;
   2466 		}
   2467 
   2468 		if (_tcscmp(devname, WZC_DRIVER) == 0)
   2469 			break;
   2470 
   2471 		RegCloseKey(hk2);
   2472 	}
   2473 
   2474 	RegCloseKey(hk);
   2475 
   2476 	/* Found WZC - get handle to it. */
   2477 	len = sizeof(hnd);
   2478 	ret = RegQueryValueEx(hk2, DEVLOAD_HANDLE_VALNAME, NULL, NULL,
   2479 			      (PUCHAR) &hnd, &len);
   2480 	if (ret != ERROR_SUCCESS) {
   2481 		wpa_printf(MSG_DEBUG, "NDIS: RegQueryValueEx(HANDLE_VALNAME) "
   2482 			   "failed: %d %d", (int) ret, (int) GetLastError());
   2483 		RegCloseKey(hk2);
   2484 		return -1;
   2485 	}
   2486 
   2487 	RegCloseKey(hk2);
   2488 
   2489 	/* Deactivate WZC */
   2490 	if (!DeactivateDevice((HANDLE) hnd)) {
   2491 		wpa_printf(MSG_DEBUG, "NDIS: DeactivateDevice failed: %d",
   2492 			   (int) GetLastError());
   2493 		return -1;
   2494 	}
   2495 
   2496 	wpa_printf(MSG_DEBUG, "NDIS: Disabled WZC temporarily");
   2497 	drv->wzc_disabled = 1;
   2498 	return wpa_driver_ndis_rebind_adapter(drv);
   2499 
   2500 #else /* _WIN32_WCE */
   2501 
   2502 	HMODULE hm;
   2503 	DWORD (WINAPI *wzc_enum_interf)(LPWSTR pSrvAddr,
   2504 					PINTFS_KEY_TABLE pIntfs);
   2505 	DWORD (WINAPI *wzc_query_interf)(LPWSTR pSrvAddr, DWORD dwInFlags,
   2506 					 PINTF_ENTRY pIntf,
   2507 					 LPDWORD pdwOutFlags);
   2508 	DWORD (WINAPI *wzc_set_interf)(LPWSTR pSrvAddr, DWORD dwInFlags,
   2509 				       PINTF_ENTRY pIntf, LPDWORD pdwOutFlags);
   2510 	int ret = -1, j;
   2511 	DWORD res;
   2512 	INTFS_KEY_TABLE guids;
   2513 	INTF_ENTRY intf;
   2514 	char guid[128];
   2515 	WCHAR *pos;
   2516 	DWORD flags, i;
   2517 
   2518 	hm = LoadLibrary(TEXT("wzcsapi.dll"));
   2519 	if (hm == NULL) {
   2520 		wpa_printf(MSG_DEBUG, "NDIS: Failed to load wzcsapi.dll (%u) "
   2521 			   "- WZC probably not running",
   2522 			   (unsigned int) GetLastError());
   2523 		return -1;
   2524 	}
   2525 
   2526 #ifdef _WIN32_WCE
   2527 	wzc_enum_interf = (void *) GetProcAddressA(hm, "WZCEnumInterfaces");
   2528 	wzc_query_interf = (void *) GetProcAddressA(hm, "WZCQueryInterface");
   2529 	wzc_set_interf = (void *) GetProcAddressA(hm, "WZCSetInterface");
   2530 #else /* _WIN32_WCE */
   2531 	wzc_enum_interf = (void *) GetProcAddress(hm, "WZCEnumInterfaces");
   2532 	wzc_query_interf = (void *) GetProcAddress(hm, "WZCQueryInterface");
   2533 	wzc_set_interf = (void *) GetProcAddress(hm, "WZCSetInterface");
   2534 #endif /* _WIN32_WCE */
   2535 
   2536 	if (wzc_enum_interf == NULL || wzc_query_interf == NULL ||
   2537 	    wzc_set_interf == NULL) {
   2538 		wpa_printf(MSG_DEBUG, "NDIS: WZCEnumInterfaces, "
   2539 			   "WZCQueryInterface, or WZCSetInterface not found "
   2540 			   "in wzcsapi.dll");
   2541 		goto fail;
   2542 	}
   2543 
   2544 	os_memset(&guids, 0, sizeof(guids));
   2545 	res = wzc_enum_interf(NULL, &guids);
   2546 	if (res != 0) {
   2547 		wpa_printf(MSG_DEBUG, "NDIS: WZCEnumInterfaces failed: %d; "
   2548 			   "WZC service is apparently not running",
   2549 			   (int) res);
   2550 		goto fail;
   2551 	}
   2552 
   2553 	wpa_printf(MSG_DEBUG, "NDIS: WZCEnumInterfaces: %d interfaces",
   2554 		   (int) guids.dwNumIntfs);
   2555 
   2556 	for (i = 0; i < guids.dwNumIntfs; i++) {
   2557 		pos = guids.pIntfs[i].wszGuid;
   2558 		for (j = 0; j < sizeof(guid); j++) {
   2559 			guid[j] = (char) *pos;
   2560 			if (*pos == 0)
   2561 				break;
   2562 			pos++;
   2563 		}
   2564 		guid[sizeof(guid) - 1] = '\0';
   2565 		wpa_printf(MSG_DEBUG, "NDIS: intfs %d GUID '%s'",
   2566 			   (int) i, guid);
   2567 		if (os_strstr(drv->ifname, guid) == NULL)
   2568 			continue;
   2569 
   2570 		wpa_printf(MSG_DEBUG, "NDIS: Current interface found from "
   2571 			   "WZC");
   2572 		break;
   2573 	}
   2574 
   2575 	if (i >= guids.dwNumIntfs) {
   2576 		wpa_printf(MSG_DEBUG, "NDIS: Current interface not found from "
   2577 			   "WZC");
   2578 		goto fail;
   2579 	}
   2580 
   2581 	os_memset(&intf, 0, sizeof(intf));
   2582 	intf.wszGuid = guids.pIntfs[i].wszGuid;
   2583 	/* Set flags to verify that the structure has not changed. */
   2584 	intf.dwCtlFlags = -1;
   2585 	flags = 0;
   2586 	res = wzc_query_interf(NULL, INTFCTL_ENABLED, &intf, &flags);
   2587 	if (res != 0) {
   2588 		wpa_printf(MSG_DEBUG, "NDIS: Could not query flags for the "
   2589 			   "WZC interface: %d (0x%x)",
   2590 			   (int) res, (int) res);
   2591 		wpa_printf(MSG_DEBUG, "NDIS: GetLastError: %u",
   2592 			   (unsigned int) GetLastError());
   2593 		goto fail;
   2594 	}
   2595 
   2596 	wpa_printf(MSG_DEBUG, "NDIS: WZC interface flags 0x%x dwCtlFlags 0x%x",
   2597 		   (int) flags, (int) intf.dwCtlFlags);
   2598 
   2599 	if (intf.dwCtlFlags == -1) {
   2600 		wpa_printf(MSG_DEBUG, "NDIS: Looks like wzcsapi has changed "
   2601 			   "again - could not disable WZC");
   2602 		wpa_hexdump(MSG_MSGDUMP, "NDIS: intf",
   2603 			    (u8 *) &intf, sizeof(intf));
   2604 		goto fail;
   2605 	}
   2606 
   2607 	if (enable) {
   2608 		if (!(intf.dwCtlFlags & INTFCTL_ENABLED)) {
   2609 			wpa_printf(MSG_DEBUG, "NDIS: Enabling WZC for this "
   2610 				   "interface");
   2611 			intf.dwCtlFlags |= INTFCTL_ENABLED;
   2612 			res = wzc_set_interf(NULL, INTFCTL_ENABLED, &intf,
   2613 					     &flags);
   2614 			if (res != 0) {
   2615 				wpa_printf(MSG_DEBUG, "NDIS: Failed to enable "
   2616 					   "WZC: %d (0x%x)",
   2617 					   (int) res, (int) res);
   2618 				wpa_printf(MSG_DEBUG, "NDIS: GetLastError: %u",
   2619 					   (unsigned int) GetLastError());
   2620 				goto fail;
   2621 			}
   2622 			wpa_printf(MSG_DEBUG, "NDIS: Re-enabled WZC for this "
   2623 				   "interface");
   2624 			drv->wzc_disabled = 0;
   2625 		}
   2626 	} else {
   2627 		if (intf.dwCtlFlags & INTFCTL_ENABLED) {
   2628 			wpa_printf(MSG_DEBUG, "NDIS: Disabling WZC for this "
   2629 				   "interface");
   2630 			intf.dwCtlFlags &= ~INTFCTL_ENABLED;
   2631 			res = wzc_set_interf(NULL, INTFCTL_ENABLED, &intf,
   2632 					     &flags);
   2633 			if (res != 0) {
   2634 				wpa_printf(MSG_DEBUG, "NDIS: Failed to "
   2635 					   "disable WZC: %d (0x%x)",
   2636 					   (int) res, (int) res);
   2637 				wpa_printf(MSG_DEBUG, "NDIS: GetLastError: %u",
   2638 					   (unsigned int) GetLastError());
   2639 				goto fail;
   2640 			}
   2641 			wpa_printf(MSG_DEBUG, "NDIS: Disabled WZC temporarily "
   2642 				   "for this interface");
   2643 			drv->wzc_disabled = 1;
   2644 		} else {
   2645 			wpa_printf(MSG_DEBUG, "NDIS: WZC was not enabled for "
   2646 				   "this interface");
   2647 		}
   2648 	}
   2649 
   2650 	ret = 0;
   2651 
   2652 fail:
   2653 	FreeLibrary(hm);
   2654 
   2655 	return ret;
   2656 #endif /* _WIN32_WCE */
   2657 }
   2658 
   2659 #else /* CONFIG_NATIVE_WINDOWS || __CYGWIN__ */
   2660 
   2661 static int wpa_driver_ndis_set_wzc(struct wpa_driver_ndis_data *drv,
   2662 				   int enable)
   2663 {
   2664 	return 0;
   2665 }
   2666 
   2667 #endif /* CONFIG_NATIVE_WINDOWS || __CYGWIN__ */
   2668 
   2669 
   2670 #ifdef CONFIG_USE_NDISUIO
   2671 /*
   2672  * l2_packet_ndis.c is sharing the same handle to NDISUIO, so we must be able
   2673  * to export this handle. This is somewhat ugly, but there is no better
   2674  * mechanism available to pass data from driver interface to l2_packet wrapper.
   2675  */
   2676 static HANDLE driver_ndis_ndisuio_handle = INVALID_HANDLE_VALUE;
   2677 
   2678 HANDLE driver_ndis_get_ndisuio_handle(void)
   2679 {
   2680 	return driver_ndis_ndisuio_handle;
   2681 }
   2682 #endif /* CONFIG_USE_NDISUIO */
   2683 
   2684 
   2685 static int wpa_driver_ndis_adapter_init(struct wpa_driver_ndis_data *drv)
   2686 {
   2687 #ifdef CONFIG_USE_NDISUIO
   2688 #ifndef _WIN32_WCE
   2689 #define NDISUIO_DEVICE_NAME TEXT("\\\\.\\\\Ndisuio")
   2690 	DWORD written;
   2691 #endif /* _WIN32_WCE */
   2692 	drv->ndisuio = CreateFile(NDISUIO_DEVICE_NAME,
   2693 				  GENERIC_READ | GENERIC_WRITE, 0, NULL,
   2694 				  OPEN_EXISTING,
   2695 				  FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
   2696 				  INVALID_HANDLE_VALUE);
   2697 	if (drv->ndisuio == INVALID_HANDLE_VALUE) {
   2698 		wpa_printf(MSG_ERROR, "NDIS: Failed to open connection to "
   2699 			   "NDISUIO: %d", (int) GetLastError());
   2700 		return -1;
   2701 	}
   2702 	driver_ndis_ndisuio_handle = drv->ndisuio;
   2703 
   2704 #ifndef _WIN32_WCE
   2705 	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_BIND_WAIT, NULL, 0,
   2706 			     NULL, 0, &written, NULL)) {
   2707 		wpa_printf(MSG_ERROR, "NDIS: IOCTL_NDISUIO_BIND_WAIT failed: "
   2708 			   "%d", (int) GetLastError());
   2709 		CloseHandle(drv->ndisuio);
   2710 		drv->ndisuio = INVALID_HANDLE_VALUE;
   2711 		return -1;
   2712 	}
   2713 #endif /* _WIN32_WCE */
   2714 
   2715 	return 0;
   2716 #else /* CONFIG_USE_NDISUIO */
   2717 	return 0;
   2718 #endif /* CONFIG_USE_NDISUIO */
   2719 }
   2720 
   2721 
   2722 static int wpa_driver_ndis_adapter_open(struct wpa_driver_ndis_data *drv)
   2723 {
   2724 #ifdef CONFIG_USE_NDISUIO
   2725 	DWORD written;
   2726 #define MAX_NDIS_DEVICE_NAME_LEN 256
   2727 	WCHAR ifname[MAX_NDIS_DEVICE_NAME_LEN];
   2728 	size_t len, i, pos;
   2729 	const char *prefix = "\\DEVICE\\";
   2730 
   2731 #ifdef _WIN32_WCE
   2732 	pos = 0;
   2733 #else /* _WIN32_WCE */
   2734 	pos = 8;
   2735 #endif /* _WIN32_WCE */
   2736 	len = pos + os_strlen(drv->ifname);
   2737 	if (len >= MAX_NDIS_DEVICE_NAME_LEN)
   2738 		return -1;
   2739 	for (i = 0; i < pos; i++)
   2740 		ifname[i] = (WCHAR) prefix[i];
   2741 	for (i = pos; i < len; i++)
   2742 		ifname[i] = (WCHAR) drv->ifname[i - pos];
   2743 	ifname[i] = L'\0';
   2744 
   2745 	if (!DeviceIoControl(drv->ndisuio, IOCTL_NDISUIO_OPEN_DEVICE,
   2746 			     ifname, len * sizeof(WCHAR), NULL, 0, &written,
   2747 			     NULL)) {
   2748 		wpa_printf(MSG_ERROR, "NDIS: IOCTL_NDISUIO_OPEN_DEVICE "
   2749 			   "failed: %d", (int) GetLastError());
   2750 		wpa_hexdump_ascii(MSG_DEBUG, "NDIS: ifname",
   2751 				  (const u8 *) ifname, len * sizeof(WCHAR));
   2752 		CloseHandle(drv->ndisuio);
   2753 		drv->ndisuio = INVALID_HANDLE_VALUE;
   2754 		return -1;
   2755 	}
   2756 
   2757 	wpa_printf(MSG_DEBUG, "NDIS: Opened NDISUIO device successfully");
   2758 
   2759 	return 0;
   2760 #else /* CONFIG_USE_NDISUIO */
   2761 	char ifname[128];
   2762 	os_snprintf(ifname, sizeof(ifname), "\\Device\\NPF_%s", drv->ifname);
   2763 	drv->adapter = PacketOpenAdapter(ifname);
   2764 	if (drv->adapter == NULL) {
   2765 		wpa_printf(MSG_DEBUG, "NDIS: PacketOpenAdapter failed for "
   2766 			   "'%s'", ifname);
   2767 		return -1;
   2768 	}
   2769 	return 0;
   2770 #endif /* CONFIG_USE_NDISUIO */
   2771 }
   2772 
   2773 
   2774 static void wpa_driver_ndis_adapter_close(struct wpa_driver_ndis_data *drv)
   2775 {
   2776 #ifdef CONFIG_USE_NDISUIO
   2777 	driver_ndis_ndisuio_handle = INVALID_HANDLE_VALUE;
   2778 	if (drv->ndisuio != INVALID_HANDLE_VALUE)
   2779 		CloseHandle(drv->ndisuio);
   2780 #else /* CONFIG_USE_NDISUIO */
   2781 	if (drv->adapter)
   2782 		PacketCloseAdapter(drv->adapter);
   2783 #endif /* CONFIG_USE_NDISUIO */
   2784 }
   2785 
   2786 
   2787 static int ndis_add_multicast(struct wpa_driver_ndis_data *drv)
   2788 {
   2789 	if (ndis_set_oid(drv, OID_802_3_MULTICAST_LIST,
   2790 			 (const char *) pae_group_addr, ETH_ALEN) < 0) {
   2791 		wpa_printf(MSG_DEBUG, "NDIS: Failed to add PAE group address "
   2792 			   "to the multicast list");
   2793 		return -1;
   2794 	}
   2795 
   2796 	return 0;
   2797 }
   2798 
   2799 
   2800 static void * wpa_driver_ndis_init(void *ctx, const char *ifname)
   2801 {
   2802 	struct wpa_driver_ndis_data *drv;
   2803 	u32 mode;
   2804 
   2805 	drv = os_zalloc(sizeof(*drv));
   2806 	if (drv == NULL)
   2807 		return NULL;
   2808 	drv->ctx = ctx;
   2809 	/*
   2810 	 * Compatibility code to strip possible prefix from the GUID. Previous
   2811 	 * versions include \Device\NPF_ prefix for all names, but the internal
   2812 	 * interface name is now only the GUI. Both Packet32 and NDISUIO
   2813 	 * prefixes are supported.
   2814 	 */
   2815 	if (os_strncmp(ifname, "\\Device\\NPF_", 12) == 0)
   2816 		ifname += 12;
   2817 	else if (os_strncmp(ifname, "\\DEVICE\\", 8) == 0)
   2818 		ifname += 8;
   2819 	os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
   2820 
   2821 	if (wpa_driver_ndis_adapter_init(drv) < 0) {
   2822 		os_free(drv);
   2823 		return NULL;
   2824 	}
   2825 
   2826 	if (wpa_driver_ndis_get_names(drv) < 0) {
   2827 		wpa_driver_ndis_adapter_close(drv);
   2828 		os_free(drv);
   2829 		return NULL;
   2830 	}
   2831 
   2832 	wpa_driver_ndis_set_wzc(drv, 0);
   2833 
   2834 	if (wpa_driver_ndis_adapter_open(drv) < 0) {
   2835 		wpa_driver_ndis_adapter_close(drv);
   2836 		os_free(drv);
   2837 		return NULL;
   2838 	}
   2839 
   2840 	if (ndis_get_oid(drv, OID_802_3_CURRENT_ADDRESS,
   2841 			 (char *) drv->own_addr, ETH_ALEN) < 0) {
   2842 		wpa_printf(MSG_DEBUG, "NDIS: Get OID_802_3_CURRENT_ADDRESS "
   2843 			   "failed");
   2844 		wpa_driver_ndis_adapter_close(drv);
   2845 		os_free(drv);
   2846 		return NULL;
   2847 	}
   2848 	wpa_driver_ndis_get_capability(drv);
   2849 
   2850 	/* Make sure that the driver does not have any obsolete PMKID entries.
   2851 	 */
   2852 	wpa_driver_ndis_flush_pmkid(drv);
   2853 
   2854 	/*
   2855 	 * Disconnect to make sure that driver re-associates if it was
   2856 	 * connected.
   2857 	 */
   2858 	wpa_driver_ndis_disconnect(drv);
   2859 
   2860 	eloop_register_timeout(1, 0, wpa_driver_ndis_poll_timeout, drv, NULL);
   2861 
   2862 #ifdef CONFIG_NDIS_EVENTS_INTEGRATED
   2863 	drv->events = ndis_events_init(&drv->events_pipe, &drv->event_avail,
   2864 				       drv->ifname, drv->adapter_desc);
   2865 	if (drv->events == NULL) {
   2866 		wpa_driver_ndis_deinit(drv);
   2867 		return NULL;
   2868 	}
   2869 	eloop_register_event(drv->event_avail, sizeof(drv->event_avail),
   2870 			     wpa_driver_ndis_event_pipe_cb, drv, NULL);
   2871 #endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
   2872 
   2873 #ifdef _WIN32_WCE
   2874 	if (ndisuio_notification_init(drv) < 0) {
   2875 		wpa_driver_ndis_deinit(drv);
   2876 		return NULL;
   2877 	}
   2878 #endif /* _WIN32_WCE */
   2879 
   2880 	/* Set mode here in case card was configured for ad-hoc mode
   2881 	 * previously. */
   2882 	mode = Ndis802_11Infrastructure;
   2883 	if (ndis_set_oid(drv, OID_802_11_INFRASTRUCTURE_MODE,
   2884 			 (char *) &mode, sizeof(mode)) < 0) {
   2885 		char buf[8];
   2886 		int res;
   2887 		wpa_printf(MSG_DEBUG, "NDIS: Failed to set "
   2888 			   "OID_802_11_INFRASTRUCTURE_MODE (%d)",
   2889 			   (int) mode);
   2890 		/* Try to continue anyway */
   2891 
   2892 		res = ndis_get_oid(drv, OID_DOT11_CURRENT_OPERATION_MODE, buf,
   2893 				   sizeof(buf));
   2894 		if (res > 0) {
   2895 			wpa_printf(MSG_INFO, "NDIS: The driver seems to use "
   2896 				   "Native 802.11 OIDs. These are not yet "
   2897 				   "fully supported.");
   2898 			drv->native80211 = 1;
   2899 		} else if (!drv->has_capability || drv->capa.enc == 0) {
   2900 			/*
   2901 			 * Note: This will also happen with NDIS 6 drivers with
   2902 			 * Vista.
   2903 			 */
   2904 			wpa_printf(MSG_DEBUG, "NDIS: Driver did not provide "
   2905 				   "any wireless capabilities - assume it is "
   2906 				   "a wired interface");
   2907 			drv->wired = 1;
   2908 			drv->capa.flags |= WPA_DRIVER_FLAGS_WIRED;
   2909 			drv->has_capability = 1;
   2910 			ndis_add_multicast(drv);
   2911 		}
   2912 	}
   2913 
   2914 	return drv;
   2915 }
   2916 
   2917 
   2918 static void wpa_driver_ndis_deinit(void *priv)
   2919 {
   2920 	struct wpa_driver_ndis_data *drv = priv;
   2921 
   2922 #ifdef CONFIG_NDIS_EVENTS_INTEGRATED
   2923 	if (drv->events) {
   2924 		eloop_unregister_event(drv->event_avail,
   2925 				       sizeof(drv->event_avail));
   2926 		ndis_events_deinit(drv->events);
   2927 	}
   2928 #endif /* CONFIG_NDIS_EVENTS_INTEGRATED */
   2929 
   2930 #ifdef _WIN32_WCE
   2931 	ndisuio_notification_deinit(drv);
   2932 #endif /* _WIN32_WCE */
   2933 
   2934 	eloop_cancel_timeout(wpa_driver_ndis_scan_timeout, drv, drv->ctx);
   2935 	eloop_cancel_timeout(wpa_driver_ndis_poll_timeout, drv, NULL);
   2936 	wpa_driver_ndis_flush_pmkid(drv);
   2937 	wpa_driver_ndis_disconnect(drv);
   2938 	if (wpa_driver_ndis_radio_off(drv) < 0) {
   2939 		wpa_printf(MSG_DEBUG, "NDIS: failed to disassociate and turn "
   2940 			   "radio off");
   2941 	}
   2942 
   2943 	wpa_driver_ndis_adapter_close(drv);
   2944 
   2945 	if (drv->wzc_disabled)
   2946 		wpa_driver_ndis_set_wzc(drv, 1);
   2947 
   2948 #ifdef _WIN32_WCE
   2949 	os_free(drv->adapter_name);
   2950 #endif /* _WIN32_WCE */
   2951 	os_free(drv->adapter_desc);
   2952 	os_free(drv);
   2953 }
   2954 
   2955 
   2956 static struct wpa_interface_info *
   2957 wpa_driver_ndis_get_interfaces(void *global_priv)
   2958 {
   2959 	struct wpa_interface_info *iface = NULL, *niface;
   2960 
   2961 #ifdef CONFIG_USE_NDISUIO
   2962 	NDISUIO_QUERY_BINDING *b;
   2963 	size_t blen = sizeof(*b) + 1024;
   2964 	int i, error;
   2965 	DWORD written;
   2966 	char name[256], desc[256];
   2967 	WCHAR *pos;
   2968 	size_t j, len;
   2969 	HANDLE ndisuio;
   2970 
   2971 	ndisuio = CreateFile(NDISUIO_DEVICE_NAME,
   2972 			     GENERIC_READ | GENERIC_WRITE, 0, NULL,
   2973 			     OPEN_EXISTING,
   2974 			     FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED,
   2975 			     INVALID_HANDLE_VALUE);
   2976 	if (ndisuio == INVALID_HANDLE_VALUE) {
   2977 		wpa_printf(MSG_ERROR, "NDIS: Failed to open connection to "
   2978 			   "NDISUIO: %d", (int) GetLastError());
   2979 		return NULL;
   2980 	}
   2981 
   2982 #ifndef _WIN32_WCE
   2983 	if (!DeviceIoControl(ndisuio, IOCTL_NDISUIO_BIND_WAIT, NULL, 0,
   2984 			     NULL, 0, &written, NULL)) {
   2985 		wpa_printf(MSG_ERROR, "NDIS: IOCTL_NDISUIO_BIND_WAIT failed: "
   2986 			   "%d", (int) GetLastError());
   2987 		CloseHandle(ndisuio);
   2988 		return NULL;
   2989 	}
   2990 #endif /* _WIN32_WCE */
   2991 
   2992 	b = os_malloc(blen);
   2993 	if (b == NULL) {
   2994 		CloseHandle(ndisuio);
   2995 		return NULL;
   2996 	}
   2997 
   2998 	for (i = 0; ; i++) {
   2999 		os_memset(b, 0, blen);
   3000 		b->BindingIndex = i;
   3001 		if (!DeviceIoControl(ndisuio, IOCTL_NDISUIO_QUERY_BINDING,
   3002 				     b, sizeof(NDISUIO_QUERY_BINDING), b, blen,
   3003 				     &written, NULL)) {
   3004 			error = (int) GetLastError();
   3005 			if (error == ERROR_NO_MORE_ITEMS)
   3006 				break;
   3007 			wpa_printf(MSG_DEBUG, "IOCTL_NDISUIO_QUERY_BINDING "
   3008 				   "failed: %d", error);
   3009 			break;
   3010 		}
   3011 
   3012 		pos = (WCHAR *) ((char *) b + b->DeviceNameOffset);
   3013 		len = b->DeviceNameLength;
   3014 		if (len >= sizeof(name))
   3015 			len = sizeof(name) - 1;
   3016 		for (j = 0; j < len; j++)
   3017 			name[j] = (char) pos[j];
   3018 		name[len] = '\0';
   3019 
   3020 		pos = (WCHAR *) ((char *) b + b->DeviceDescrOffset);
   3021 		len = b->DeviceDescrLength;
   3022 		if (len >= sizeof(desc))
   3023 			len = sizeof(desc) - 1;
   3024 		for (j = 0; j < len; j++)
   3025 			desc[j] = (char) pos[j];
   3026 		desc[len] = '\0';
   3027 
   3028 		wpa_printf(MSG_DEBUG, "NDIS: %d - %s - %s", i, name, desc);
   3029 
   3030 		niface = os_zalloc(sizeof(*niface));
   3031 		if (niface == NULL)
   3032 			break;
   3033 		niface->drv_name = "ndis";
   3034 		if (os_strncmp(name, "\\DEVICE\\", 8) == 0)
   3035 			niface->ifname = os_strdup(name + 8);
   3036 		else
   3037 			niface->ifname = os_strdup(name);
   3038 		if (niface->ifname == NULL) {
   3039 			os_free(niface);
   3040 			break;
   3041 		}
   3042 		niface->desc = os_strdup(desc);
   3043 		niface->next = iface;
   3044 		iface = niface;
   3045 	}
   3046 
   3047 	os_free(b);
   3048 	CloseHandle(ndisuio);
   3049 #else /* CONFIG_USE_NDISUIO */
   3050 	PTSTR _names;
   3051 	char *names, *pos, *pos2;
   3052 	ULONG len;
   3053 	BOOLEAN res;
   3054 	char *name[MAX_ADAPTERS];
   3055 	char *desc[MAX_ADAPTERS];
   3056 	int num_name, num_desc, i;
   3057 
   3058 	wpa_printf(MSG_DEBUG, "NDIS: Packet.dll version: %s",
   3059 		   PacketGetVersion());
   3060 
   3061 	len = 8192;
   3062 	_names = os_zalloc(len);
   3063 	if (_names == NULL)
   3064 		return NULL;
   3065 
   3066 	res = PacketGetAdapterNames(_names, &len);
   3067 	if (!res && len > 8192) {
   3068 		os_free(_names);
   3069 		_names = os_zalloc(len);
   3070 		if (_names == NULL)
   3071 			return NULL;
   3072 		res = PacketGetAdapterNames(_names, &len);
   3073 	}
   3074 
   3075 	if (!res) {
   3076 		wpa_printf(MSG_ERROR, "NDIS: Failed to get adapter list "
   3077 			   "(PacketGetAdapterNames)");
   3078 		os_free(_names);
   3079 		return NULL;
   3080 	}
   3081 
   3082 	names = (char *) _names;
   3083 	if (names[0] && names[1] == '\0' && names[2] && names[3] == '\0') {
   3084 		wpa_printf(MSG_DEBUG, "NDIS: Looks like adapter names are in "
   3085 			   "UNICODE");
   3086 		/* Convert to ASCII */
   3087 		pos2 = pos = names;
   3088 		while (pos2 < names + len) {
   3089 			if (pos2[0] == '\0' && pos2[1] == '\0' &&
   3090 			    pos2[2] == '\0' && pos2[3] == '\0') {
   3091 				pos2 += 4;
   3092 				break;
   3093 			}
   3094 			*pos++ = pos2[0];
   3095 			pos2 += 2;
   3096 		}
   3097 		os_memcpy(pos + 2, names, pos - names);
   3098 		pos += 2;
   3099 	} else
   3100 		pos = names;
   3101 
   3102 	num_name = 0;
   3103 	while (pos < names + len) {
   3104 		name[num_name] = pos;
   3105 		while (*pos && pos < names + len)
   3106 			pos++;
   3107 		if (pos + 1 >= names + len) {
   3108 			os_free(names);
   3109 			return NULL;
   3110 		}
   3111 		pos++;
   3112 		num_name++;
   3113 		if (num_name >= MAX_ADAPTERS) {
   3114 			wpa_printf(MSG_DEBUG, "NDIS: Too many adapters");
   3115 			os_free(names);
   3116 			return NULL;
   3117 		}
   3118 		if (*pos == '\0') {
   3119 			wpa_printf(MSG_DEBUG, "NDIS: %d adapter names found",
   3120 				   num_name);
   3121 			pos++;
   3122 			break;
   3123 		}
   3124 	}
   3125 
   3126 	num_desc = 0;
   3127 	while (pos < names + len) {
   3128 		desc[num_desc] = pos;
   3129 		while (*pos && pos < names + len)
   3130 			pos++;
   3131 		if (pos + 1 >= names + len) {
   3132 			os_free(names);
   3133 			return NULL;
   3134 		}
   3135 		pos++;
   3136 		num_desc++;
   3137 		if (num_desc >= MAX_ADAPTERS) {
   3138 			wpa_printf(MSG_DEBUG, "NDIS: Too many adapter "
   3139 				   "descriptions");
   3140 			os_free(names);
   3141 			return NULL;
   3142 		}
   3143 		if (*pos == '\0') {
   3144 			wpa_printf(MSG_DEBUG, "NDIS: %d adapter descriptions "
   3145 				   "found", num_name);
   3146 			pos++;
   3147 			break;
   3148 		}
   3149 	}
   3150 
   3151 	/*
   3152 	 * Windows 98 with Packet.dll 3.0 alpha3 does not include adapter
   3153 	 * descriptions. Fill in dummy descriptors to work around this.
   3154 	 */
   3155 	while (num_desc < num_name)
   3156 		desc[num_desc++] = "dummy description";
   3157 
   3158 	if (num_name != num_desc) {
   3159 		wpa_printf(MSG_DEBUG, "NDIS: mismatch in adapter name and "
   3160 			   "description counts (%d != %d)",
   3161 			   num_name, num_desc);
   3162 		os_free(names);
   3163 		return NULL;
   3164 	}
   3165 
   3166 	for (i = 0; i < num_name; i++) {
   3167 		niface = os_zalloc(sizeof(*niface));
   3168 		if (niface == NULL)
   3169 			break;
   3170 		niface->drv_name = "ndis";
   3171 		if (os_strncmp(name[i], "\\Device\\NPF_", 12) == 0)
   3172 			niface->ifname = os_strdup(name[i] + 12);
   3173 		else
   3174 			niface->ifname = os_strdup(name[i]);
   3175 		if (niface->ifname == NULL) {
   3176 			os_free(niface);
   3177 			break;
   3178 		}
   3179 		niface->desc = os_strdup(desc[i]);
   3180 		niface->next = iface;
   3181 		iface = niface;
   3182 	}
   3183 
   3184 #endif /* CONFIG_USE_NDISUIO */
   3185 
   3186 	return iface;
   3187 }
   3188 
   3189 
   3190 static const char *ndis_drv_name = "ndis";
   3191 static const char *ndis_drv_desc = "Windows NDIS driver";
   3192 
   3193 struct wpa_driver_ops wpa_driver_ndis_ops;
   3194 
   3195 void driver_ndis_init_ops(void)
   3196 {
   3197 	os_memset(&wpa_driver_ndis_ops, 0, sizeof(wpa_driver_ndis_ops));
   3198 	wpa_driver_ndis_ops.name = ndis_drv_name;
   3199 	wpa_driver_ndis_ops.desc = ndis_drv_desc;
   3200 	wpa_driver_ndis_ops.get_bssid = wpa_driver_ndis_get_bssid;
   3201 	wpa_driver_ndis_ops.get_ssid = wpa_driver_ndis_get_ssid;
   3202 	wpa_driver_ndis_ops.set_key = wpa_driver_ndis_set_key;
   3203 	wpa_driver_ndis_ops.init = wpa_driver_ndis_init;
   3204 	wpa_driver_ndis_ops.deinit = wpa_driver_ndis_deinit;
   3205 	wpa_driver_ndis_ops.deauthenticate = wpa_driver_ndis_deauthenticate;
   3206 	wpa_driver_ndis_ops.associate = wpa_driver_ndis_associate;
   3207 	wpa_driver_ndis_ops.add_pmkid = wpa_driver_ndis_add_pmkid;
   3208 	wpa_driver_ndis_ops.remove_pmkid = wpa_driver_ndis_remove_pmkid;
   3209 	wpa_driver_ndis_ops.flush_pmkid = wpa_driver_ndis_flush_pmkid;
   3210 	wpa_driver_ndis_ops.get_capa = wpa_driver_ndis_get_capa;
   3211 	wpa_driver_ndis_ops.poll = wpa_driver_ndis_poll;
   3212 	wpa_driver_ndis_ops.get_ifname = wpa_driver_ndis_get_ifname;
   3213 	wpa_driver_ndis_ops.get_mac_addr = wpa_driver_ndis_get_mac_addr;
   3214 	wpa_driver_ndis_ops.get_scan_results2 =
   3215 		wpa_driver_ndis_get_scan_results;
   3216 	wpa_driver_ndis_ops.get_interfaces = wpa_driver_ndis_get_interfaces;
   3217 	wpa_driver_ndis_ops.scan2 = wpa_driver_ndis_scan;
   3218 }
   3219