drivers/staging/rt2860/sta/auth.c

   1 /*
   2  *************************************************************************
   3  * Ralink Tech Inc.
   4  * 5F., No.36, Taiyuan St., Jhubei City,
   5  * Hsinchu County 302,
   6  * Taiwan, R.O.C.
   7  *
   8  * (c) Copyright 2002-2007, Ralink Technology, Inc.
   9  *
  10  * This program is free software; you can redistribute it and/or modify  *
  11  * it under the terms of the GNU General Public License as published by  *
  12  * the Free Software Foundation; either version 2 of the License, or     *
  13  * (at your option) any later version.                                   *
  14  *                                                                       *
  15  * This program is distributed in the hope that it will be useful,       *
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  18  * GNU General Public License for more details.                          *
  19  *                                                                       *
  20  * You should have received a copy of the GNU General Public License     *
  21  * along with this program; if not, write to the                         *
  22  * Free Software Foundation, Inc.,                                       *
  23  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  24  *                                                                       *
  25  *************************************************************************
  26
  27         Module Name:
  28         auth.c
  29
  30         Abstract:
  31
  32         Revision History:
  33         Who                     When                    What
  34         --------        ----------              ----------------------------------------------
  35         John            2004-9-3                porting from RT2500
  36 */
  37 #include "../rt_config.h"
  38
  39 /*
  40     ==========================================================================
  41     Description:
  42         authenticate state machine init, including state transition and timer init
  43     Parameters:
  44         Sm - pointer to the auth state machine
  45     Note:
  46         The state machine looks like this
  47
  48                         AUTH_REQ_IDLE           AUTH_WAIT_SEQ2                   AUTH_WAIT_SEQ4
  49     MT2_MLME_AUTH_REQ   mlme_auth_req_action    invalid_state_when_auth          invalid_state_when_auth
  50     MT2_PEER_AUTH_EVEN  drop                    peer_auth_even_at_seq2_action    peer_auth_even_at_seq4_action
  51     MT2_AUTH_TIMEOUT    Drop                    auth_timeout_action              auth_timeout_action
  52
  53         IRQL = PASSIVE_LEVEL
  54
  55     ==========================================================================
  56  */
  57
  58 void AuthStateMachineInit(struct rt_rtmp_adapter *pAd,
  59                           struct rt_state_machine *Sm, OUT STATE_MACHINE_FUNC Trans[])
  60 {
  61         StateMachineInit(Sm, Trans, MAX_AUTH_STATE, MAX_AUTH_MSG,
  62                          (STATE_MACHINE_FUNC) Drop, AUTH_REQ_IDLE,
  63                          AUTH_MACHINE_BASE);
  64
  65         /* the first column */
  66         StateMachineSetAction(Sm, AUTH_REQ_IDLE, MT2_MLME_AUTH_REQ,
  67                               (STATE_MACHINE_FUNC) MlmeAuthReqAction);
  68
  69         /* the second column */
  70         StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_MLME_AUTH_REQ,
  71                               (STATE_MACHINE_FUNC) InvalidStateWhenAuth);
  72         StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_PEER_AUTH_EVEN,
  73                               (STATE_MACHINE_FUNC) PeerAuthRspAtSeq2Action);
  74         StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_AUTH_TIMEOUT,
  75                               (STATE_MACHINE_FUNC) AuthTimeoutAction);
  76
  77         /* the third column */
  78         StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_MLME_AUTH_REQ,
  79                               (STATE_MACHINE_FUNC) InvalidStateWhenAuth);
  80         StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_PEER_AUTH_EVEN,
  81                               (STATE_MACHINE_FUNC) PeerAuthRspAtSeq4Action);
  82         StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_AUTH_TIMEOUT,
  83                               (STATE_MACHINE_FUNC) AuthTimeoutAction);
  84
  85         RTMPInitTimer(pAd, &pAd->MlmeAux.AuthTimer,
  86                       GET_TIMER_FUNCTION(AuthTimeout), pAd, FALSE);
  87 }
  88
  89 /*
  90     ==========================================================================
  91     Description:
  92         function to be executed at timer thread when auth timer expires
  93
  94         IRQL = DISPATCH_LEVEL
  95
  96     ==========================================================================
  97  */
  98 void AuthTimeout(void *SystemSpecific1,
  99                  void *FunctionContext,
 100                  void *SystemSpecific2, void *SystemSpecific3)
 101 {
 102         struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
 103
 104         DBGPRINT(RT_DEBUG_TRACE, ("AUTH - AuthTimeout\n"));
 105
 106         /* Do nothing if the driver is starting halt state. */
 107         /* This might happen when timer already been fired before cancel timer with mlmehalt */
 108         if (RTMP_TEST_FLAG
 109             (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 110                 return;
 111
 112         /* send a de-auth to reset AP's state machine (Patch AP-Dir635) */
 113         if (pAd->Mlme.AuthMachine.CurrState == AUTH_WAIT_SEQ2)
 114                 Cls2errAction(pAd, pAd->MlmeAux.Bssid);
 115
 116         MlmeEnqueue(pAd, AUTH_STATE_MACHINE, MT2_AUTH_TIMEOUT, 0, NULL);
 117         RTMP_MLME_HANDLER(pAd);
 118 }
 119
 120 /*
 121     ==========================================================================
 122     Description:
 123
 124         IRQL = DISPATCH_LEVEL
 125
 126     ==========================================================================
 127  */
 128 void MlmeAuthReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 129 {
 130         if (AUTH_ReqSend
 131             (pAd, Elem, &pAd->MlmeAux.AuthTimer, "AUTH", 1, NULL, 0))
 132                 pAd->Mlme.AuthMachine.CurrState = AUTH_WAIT_SEQ2;
 133         else {
 134                 u16 Status;
 135
 136                 pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
 137                 Status = MLME_INVALID_FORMAT;
 138                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2,
 139                             &Status);
 140         }
 141 }
 142
 143 /*
 144     ==========================================================================
 145     Description:
 146
 147         IRQL = DISPATCH_LEVEL
 148
 149     ==========================================================================
 150  */
 151 void PeerAuthRspAtSeq2Action(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 152 {
 153         u8 Addr2[MAC_ADDR_LEN];
 154         u16 Seq, Status, RemoteStatus, Alg;
 155         u8 ChlgText[CIPHER_TEXT_LEN];
 156         u8 CyperChlgText[CIPHER_TEXT_LEN + 8 + 8];
 157         u8 Element[2];
 158         struct rt_header_802_11 AuthHdr;
 159         BOOLEAN TimerCancelled;
 160         u8 *pOutBuffer = NULL;
 161         int NStatus;
 162         unsigned long FrameLen = 0;
 163         u16 Status2;
 164
 165         if (PeerAuthSanity
 166             (pAd, Elem->Msg, Elem->MsgLen, Addr2, &Alg, &Seq, &Status,
 167              (char *)ChlgText)) {
 168                 if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Addr2) && Seq == 2) {
 169                         DBGPRINT(RT_DEBUG_TRACE,
 170                                  ("AUTH - Receive AUTH_RSP seq#2 to me (Alg=%d, Status=%d)\n",
 171                                   Alg, Status));
 172                         RTMPCancelTimer(&pAd->MlmeAux.AuthTimer,
 173                                         &TimerCancelled);
 174
 175                         if (Status == MLME_SUCCESS) {
 176                                 /* Authentication Mode "LEAP" has allow for CCX 1.X */
 177                                 if (pAd->MlmeAux.Alg == Ndis802_11AuthModeOpen) {
 178                                         pAd->Mlme.AuthMachine.CurrState =
 179                                             AUTH_REQ_IDLE;
 180                                         MlmeEnqueue(pAd,
 181                                                     MLME_CNTL_STATE_MACHINE,
 182                                                     MT2_AUTH_CONF, 2, &Status);
 183                                 } else {
 184                                         /* 2. shared key, need to be challenged */
 185                                         Seq++;
 186                                         RemoteStatus = MLME_SUCCESS;
 187
 188                                         /* Get an unused nonpaged memory */
 189                                         NStatus =
 190                                             MlmeAllocateMemory(pAd,
 191                                                                &pOutBuffer);
 192                                         if (NStatus != NDIS_STATUS_SUCCESS) {
 193                                                 DBGPRINT(RT_DEBUG_TRACE,
 194                                                          ("AUTH - PeerAuthRspAtSeq2Action() allocate memory fail\n"));
 195                                                 pAd->Mlme.AuthMachine.
 196                                                     CurrState = AUTH_REQ_IDLE;
 197                                                 Status2 = MLME_FAIL_NO_RESOURCE;
 198                                                 MlmeEnqueue(pAd,
 199                                                             MLME_CNTL_STATE_MACHINE,
 200                                                             MT2_AUTH_CONF, 2,
 201                                                             &Status2);
 202                                                 return;
 203                                         }
 204
 205                                         DBGPRINT(RT_DEBUG_TRACE,
 206                                                  ("AUTH - Send AUTH request seq#3...\n"));
 207                                         MgtMacHeaderInit(pAd, &AuthHdr,
 208                                                          SUBTYPE_AUTH, 0, Addr2,
 209                                                          pAd->MlmeAux.Bssid);
 210                                         AuthHdr.FC.Wep = 1;
 211                                         /* Encrypt challenge text & auth information */
 212                                         RTMPInitWepEngine(pAd,
 213                                                           pAd->
 214                                                           SharedKey[BSS0][pAd->
 215                                                                           StaCfg.
 216                                                                           DefaultKeyId].
 217                                                           Key,
 218                                                           pAd->StaCfg.
 219                                                           DefaultKeyId,
 220                                                           pAd->
 221                                                           SharedKey[BSS0][pAd->
 222                                                                           StaCfg.
 223                                                                           DefaultKeyId].
 224                                                           KeyLen,
 225                                                           CyperChlgText);
 226
 227                                         Alg = cpu2le16(*(u16 *) & Alg);
 228                                         Seq = cpu2le16(*(u16 *) & Seq);
 229                                         RemoteStatus =
 230                                             cpu2le16(*(u16 *) &
 231                                                      RemoteStatus);
 232
 233                                         RTMPEncryptData(pAd, (u8 *)& Alg,
 234                                                         CyperChlgText + 4, 2);
 235                                         RTMPEncryptData(pAd, (u8 *)& Seq,
 236                                                         CyperChlgText + 6, 2);
 237                                         RTMPEncryptData(pAd,
 238                                                         (u8 *)& RemoteStatus,
 239                                                         CyperChlgText + 8, 2);
 240                                         Element[0] = 16;
 241                                         Element[1] = 128;
 242                                         RTMPEncryptData(pAd, Element,
 243                                                         CyperChlgText + 10, 2);
 244                                         RTMPEncryptData(pAd, ChlgText,
 245                                                         CyperChlgText + 12,
 246                                                         128);
 247                                         RTMPSetICV(pAd, CyperChlgText + 140);
 248                                         MakeOutgoingFrame(pOutBuffer, &FrameLen,
 249                                                           sizeof(struct rt_header_802_11),
 250                                                           &AuthHdr,
 251                                                           CIPHER_TEXT_LEN + 16,
 252                                                           CyperChlgText,
 253                                                           END_OF_ARGS);
 254                                         MiniportMMRequest(pAd, 0, pOutBuffer,
 255                                                           FrameLen);
 256                                         MlmeFreeMemory(pAd, pOutBuffer);
 257
 258                                         RTMPSetTimer(&pAd->MlmeAux.AuthTimer,
 259                                                      AUTH_TIMEOUT);
 260                                         pAd->Mlme.AuthMachine.CurrState =
 261                                             AUTH_WAIT_SEQ4;
 262                                 }
 263                         } else {
 264                                 pAd->StaCfg.AuthFailReason = Status;
 265                                 COPY_MAC_ADDR(pAd->StaCfg.AuthFailSta, Addr2);
 266                                 pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
 267                                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE,
 268                                             MT2_AUTH_CONF, 2, &Status);
 269                         }
 270                 }
 271         } else {
 272                 DBGPRINT(RT_DEBUG_TRACE,
 273                          ("AUTH - PeerAuthSanity() sanity check fail\n"));
 274         }
 275 }
 276
 277 /*
 278     ==========================================================================
 279     Description:
 280
 281         IRQL = DISPATCH_LEVEL
 282
 283     ==========================================================================
 284  */
 285 void PeerAuthRspAtSeq4Action(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 286 {
 287         u8 Addr2[MAC_ADDR_LEN];
 288         u16 Alg, Seq, Status;
 289         char ChlgText[CIPHER_TEXT_LEN];
 290         BOOLEAN TimerCancelled;
 291
 292         if (PeerAuthSanity
 293             (pAd, Elem->Msg, Elem->MsgLen, Addr2, &Alg, &Seq, &Status,
 294              ChlgText)) {
 295                 if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Addr2) && Seq == 4) {
 296                         DBGPRINT(RT_DEBUG_TRACE,
 297                                  ("AUTH - Receive AUTH_RSP seq#4 to me\n"));
 298                         RTMPCancelTimer(&pAd->MlmeAux.AuthTimer,
 299                                         &TimerCancelled);
 300
 301                         if (Status != MLME_SUCCESS) {
 302                                 pAd->StaCfg.AuthFailReason = Status;
 303                                 COPY_MAC_ADDR(pAd->StaCfg.AuthFailSta, Addr2);
 304                         }
 305
 306                         pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
 307                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF,
 308                                     2, &Status);
 309                 }
 310         } else {
 311                 DBGPRINT(RT_DEBUG_TRACE,
 312                          ("AUTH - PeerAuthRspAtSeq4Action() sanity check fail\n"));
 313         }
 314 }
 315
 316 /*
 317     ==========================================================================
 318     Description:
 319
 320         IRQL = DISPATCH_LEVEL
 321
 322     ==========================================================================
 323  */
 324 void MlmeDeauthReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 325 {
 326         struct rt_mlme_deauth_req *pInfo;
 327         struct rt_header_802_11 DeauthHdr;
 328         u8 *pOutBuffer = NULL;
 329         int NStatus;
 330         unsigned long FrameLen = 0;
 331         u16 Status;
 332
 333         pInfo = (struct rt_mlme_deauth_req *)Elem->Msg;
 334
 335         NStatus = MlmeAllocateMemory(pAd, &pOutBuffer); /*Get an unused nonpaged memory */
 336         if (NStatus != NDIS_STATUS_SUCCESS) {
 337                 DBGPRINT(RT_DEBUG_TRACE,
 338                          ("AUTH - MlmeDeauthReqAction() allocate memory fail\n"));
 339                 pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
 340                 Status = MLME_FAIL_NO_RESOURCE;
 341                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DEAUTH_CONF, 2,
 342                             &Status);
 343                 return;
 344         }
 345
 346         DBGPRINT(RT_DEBUG_TRACE,
 347                  ("AUTH - Send DE-AUTH request (Reason=%d)...\n",
 348                   pInfo->Reason));
 349         MgtMacHeaderInit(pAd, &DeauthHdr, SUBTYPE_DEAUTH, 0, pInfo->Addr,
 350                          pAd->MlmeAux.Bssid);
 351         MakeOutgoingFrame(pOutBuffer, &FrameLen, sizeof(struct rt_header_802_11),
 352                           &DeauthHdr, 2, &pInfo->Reason, END_OF_ARGS);
 353         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 354         MlmeFreeMemory(pAd, pOutBuffer);
 355
 356         pAd->StaCfg.DeauthReason = pInfo->Reason;
 357         COPY_MAC_ADDR(pAd->StaCfg.DeauthSta, pInfo->Addr);
 358         pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
 359         Status = MLME_SUCCESS;
 360         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DEAUTH_CONF, 2, &Status);
 361
 362         /* send wireless event - for deauthentication */
 363         if (pAd->CommonCfg.bWirelessEvent)
 364                 RTMPSendWirelessEvent(pAd, IW_DEAUTH_EVENT_FLAG,
 365                                       pAd->MacTab.Content[BSSID_WCID].Addr,
 366                                       BSS0, 0);
 367 }
 368
 369 /*
 370     ==========================================================================
 371     Description:
 372
 373         IRQL = DISPATCH_LEVEL
 374
 375     ==========================================================================
 376  */
 377 void AuthTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 378 {
 379         u16 Status;
 380         DBGPRINT(RT_DEBUG_TRACE, ("AUTH - AuthTimeoutAction\n"));
 381         pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
 382         Status = MLME_REJ_TIMEOUT;
 383         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
 384 }
 385
 386 /*
 387     ==========================================================================
 388     Description:
 389
 390         IRQL = DISPATCH_LEVEL
 391
 392     ==========================================================================
 393  */
 394 void InvalidStateWhenAuth(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 395 {
 396         u16 Status;
 397         DBGPRINT(RT_DEBUG_TRACE,
 398                  ("AUTH - InvalidStateWhenAuth (state=%ld), reset AUTH state machine\n",
 399                   pAd->Mlme.AuthMachine.CurrState));
 400         pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
 401         Status = MLME_STATE_MACHINE_REJECT;
 402         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
 403 }
 404
 405 /*
 406     ==========================================================================
 407     Description:
 408         Some STA/AP
 409     Note:
 410         This action should never trigger AUTH state transition, therefore we
 411         separate it from AUTH state machine, and make it as a standalone service
 412
 413         IRQL = DISPATCH_LEVEL
 414
 415     ==========================================================================
 416  */
 417 void Cls2errAction(struct rt_rtmp_adapter *pAd, u8 *pAddr)
 418 {
 419         struct rt_header_802_11 DeauthHdr;
 420         u8 *pOutBuffer = NULL;
 421         int NStatus;
 422         unsigned long FrameLen = 0;
 423         u16 Reason = REASON_CLS2ERR;
 424
 425         NStatus = MlmeAllocateMemory(pAd, &pOutBuffer); /*Get an unused nonpaged memory */
 426         if (NStatus != NDIS_STATUS_SUCCESS)
 427                 return;
 428
 429         DBGPRINT(RT_DEBUG_TRACE,
 430                  ("AUTH - Class 2 error, Send DEAUTH frame...\n"));
 431         MgtMacHeaderInit(pAd, &DeauthHdr, SUBTYPE_DEAUTH, 0, pAddr,
 432                          pAd->MlmeAux.Bssid);
 433         MakeOutgoingFrame(pOutBuffer, &FrameLen, sizeof(struct rt_header_802_11),
 434                           &DeauthHdr, 2, &Reason, END_OF_ARGS);
 435         MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 436         MlmeFreeMemory(pAd, pOutBuffer);
 437
 438         pAd->StaCfg.DeauthReason = Reason;
 439         COPY_MAC_ADDR(pAd->StaCfg.DeauthSta, pAddr);
 440 }
 441
 442 BOOLEAN AUTH_ReqSend(struct rt_rtmp_adapter *pAd,
 443                      struct rt_mlme_queue_elem *pElem,
 444                      struct rt_ralink_timer *pAuthTimer,
 445                      char *pSMName,
 446                      u16 SeqNo,
 447                      u8 *pNewElement, unsigned long ElementLen)
 448 {
 449         u16 Alg, Seq, Status;
 450         u8 Addr[6];
 451         unsigned long Timeout;
 452         struct rt_header_802_11 AuthHdr;
 453         BOOLEAN TimerCancelled;
 454         int NStatus;
 455         u8 *pOutBuffer = NULL;
 456         unsigned long FrameLen = 0, tmp = 0;
 457
 458         /* Block all authentication request durning WPA block period */
 459         if (pAd->StaCfg.bBlockAssoc == TRUE) {
 460                 DBGPRINT(RT_DEBUG_TRACE,
 461                          ("%s - Block Auth request durning WPA block period!\n",
 462                           pSMName));
 463                 pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
 464                 Status = MLME_STATE_MACHINE_REJECT;
 465                 MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2,
 466                             &Status);
 467         } else
 468             if (MlmeAuthReqSanity
 469                 (pAd, pElem->Msg, pElem->MsgLen, Addr, &Timeout, &Alg)) {
 470                 /* reset timer */
 471                 RTMPCancelTimer(pAuthTimer, &TimerCancelled);
 472
 473                 COPY_MAC_ADDR(pAd->MlmeAux.Bssid, Addr);
 474                 pAd->MlmeAux.Alg = Alg;
 475                 Seq = SeqNo;
 476                 Status = MLME_SUCCESS;
 477
 478                 NStatus = MlmeAllocateMemory(pAd, &pOutBuffer); /*Get an unused nonpaged memory */
 479                 if (NStatus != NDIS_STATUS_SUCCESS) {
 480                         DBGPRINT(RT_DEBUG_TRACE,
 481                                  ("%s - MlmeAuthReqAction(Alg:%d) allocate memory failed\n",
 482                                   pSMName, Alg));
 483                         pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
 484                         Status = MLME_FAIL_NO_RESOURCE;
 485                         MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF,
 486                                     2, &Status);
 487                         return FALSE;
 488                 }
 489
 490                 DBGPRINT(RT_DEBUG_TRACE,
 491                          ("%s - Send AUTH request seq#1 (Alg=%d)...\n", pSMName,
 492                           Alg));
 493                 MgtMacHeaderInit(pAd, &AuthHdr, SUBTYPE_AUTH, 0, Addr,
 494                                  pAd->MlmeAux.Bssid);
 495                 MakeOutgoingFrame(pOutBuffer, &FrameLen, sizeof(struct rt_header_802_11),
 496                                   &AuthHdr, 2, &Alg, 2, &Seq, 2, &Status,
 497                                   END_OF_ARGS);
 498
 499                 if (pNewElement && ElementLen) {
 500                         MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
 501                                           ElementLen, pNewElement, END_OF_ARGS);
 502                         FrameLen += tmp;
 503                 }
 504
 505                 MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 506                 MlmeFreeMemory(pAd, pOutBuffer);
 507
 508                 RTMPSetTimer(pAuthTimer, Timeout);
 509                 return TRUE;
 510         } else {
 511                 DBGPRINT_ERR(("%s - MlmeAuthReqAction() sanity check failed\n",
 512                               pSMName));
 513                 return FALSE;
 514         }
 515
 516         return TRUE;
 517 }