如果我在AP模式下向手机发送特制的身份验证框架，我将登陆到sirConvertAuthFrame2Struct，并立即调用dot11fUnpackAuthentication。对于认证数据包，我可以附加一些特定的TLV：

static const tIEDefn IES_Authentication[] = { {offsetof(tDot11fAuthentication, ChallengeText), offsetof(tDot11fIEChallengeText, present), 0, "ChallengeText" , 0, 3, 255, SigIeChallengeText, {0, 0, 0, 0, 0}, 0, DOT11F_EID_CHALLENGETEXT, 0, }, {offsetof(tDot11fAuthentication, RSNOpaque), offsetof(tDot11fIERSNOpaque, present), 0, "RSNOpaque" , 0, 8, 255, SigIeRSNOpaque, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RSNOPAQUE, 0, }, {offsetof(tDot11fAuthentication, MobilityDomain), offsetof(tDot11fIEMobilityDomain, present), 0, "MobilityDomain" , 0, 5, 5, SigIeMobilityDomain, {0, 0, 0, 0, 0}, 0, DOT11F_EID_MOBILITYDOMAIN, 0, }, {offsetof(tDot11fAuthentication, FTInfo), offsetof(tDot11fIEFTInfo, present), 0, "FTInfo" , 0, 84, 222, SigIeFTInfo, {0, 0, 0, 0, 0}, 0, DOT11F_EID_FTINFO, 0, }, {offsetof(tDot11fAuthentication, TimeoutInterval), offsetof(tDot11fIETimeoutInterval, present), 0, "TimeoutInterval" , 0, 7, 7, SigIeTimeoutInterval, {0, 0, 0, 0, 0}, 0, DOT11F_EID_TIMEOUTINTERVAL, 0, }, {offsetof(tDot11fAuthentication, RICDataDesc), offsetof(tDot11fIERICDataDesc, present), offsetof(tDot11fAuthentication, num_RICDataDesc), "RICDataDesc" , 2, 2, 550, SigIeRICDataDesc, {0, 0, 0, 0, 0}, 0, DOT11F_EID_RICDATADESC, 0, }, {0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, }, };

对我来说，我最感兴趣的是挑战字串 (Challenge Text) ，不过请注意，挑战字串仅在WEP加密方案中有用。无论手机的AP是否启用了WEP，你都可以将其添加到身份验证框架中，并让驱动程序解析它，如下所示，UnpackCore会调用挑战文本的特定解析函数：

tANI_U32 dot11fUnpackIeChallengeText(tpAniSirGlobal pCtx, tANI_U8 *pBuf, tANI_U8 ielen, tDot11fIEChallengeText *pDst) { tANI_U32 status = DOT11F_PARSE_SUCCESS; (void) pBuf; (void)ielen; /* Shutup the compiler */ if (pDst->present) status = DOT11F_DUPLICATE_IE; pDst->present = 1; pDst->num_text = (tANI_U8)( ielen ); if (ielen > 253){ pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; } DOT11F_MEMCPY(pCtx, pDst->text, pBuf, ( ielen ) ); (void)pCtx; return status; } /* End dot11fUnpackIeChallengeText. */

正如你所看到的，他们将挑战字串的数量限制在253个字节。当这个函数完成UnpackCore和dot11fUnpackAuthentication后，我将返回到sirConvertAuthFrame2Struct，开始执行以下操作：

// & "transliterate" from a ’tDot11fAuthentication’ to a ’tSirMacAuthFrameBody’... pAuth->authAlgoNumber = auth.AuthAlgo.algo; pAuth->authTransactionSeqNumber = auth.AuthSeqNo.no; pAuth->authStatusCode = auth.Status.status; if ( auth.ChallengeText.present ) { pAuth->type = SIR_MAC_CHALLENGE_TEXT_EID; pAuth->length = auth.ChallengeText.num_text; vos_mem_copy( pAuth->challengeText, auth.ChallengeText.text, auth.ChallengeText.num_text ); }

截至目前，一切看起来都很正常，但由于pAuth是我的身份验证转换函数的一个参数，所以我需要看看这个pAuth结构是什么样的。

sirConvertAuthFrame2Struct(tpAniSirGlobal pMac, tANI_U8 *pFrame, tANI_U32 nFrame, tpSirMacAuthFrameBody pAuth)

它的类型是tpSirMacAuthFrameBody，如下所示：

typedef __ani_attr_pre_packed struct sSirMacAuthFrameBody { tANI_U16 authAlgoNumber; tANI_U16 authTransactionSeqNumber; tANI_U16 authStatusCode; tANI_U8 type; // = SIR_MAC_CHALLENGE_TEXT_EID tANI_U8 length; // = SIR_MAC_AUTH_CHALLENGE_LENGTH tANI_U8 challengeText[SIR_MAC_AUTH_CHALLENGE_LENGTH]; } __ani_attr_packed tSirMacAuthFrameBody, *tpSirMacAuthFrameBody;

最后，我需要看看SIR_MAC_AUTH_CHALLENGE_LENGTH是多大：

#define SIR_MAC_AUTH_CHALLENGE_LENGTH 128

所以挑战字串有足够的空间容纳128字节的字符数组，但是请记住，在原始数据包解析时，我使用了最大长度——253字节，所以memcpy函数如下所示。

vos_mem_copy( pAuth->challengeText, auth.ChallengeText.text, auth.ChallengeText.num_text );

可以看出，我复制的字节比结构分配多了125个字节。