scan.c

   1 #include <net/if.h>
   2 #include <errno.h>
   3 #include <string.h>
   4 #include <ctype.h>
   5 #include <stdbool.h>
   6
   7 #include <netlink/genl/genl.h>
   8 #include <netlink/genl/family.h>
   9 #include <netlink/genl/ctrl.h>
  10 #include <netlink/msg.h>
  11 #include <netlink/attr.h>
  12
  13 #include "nl80211.h"
  14 #include "iw.h"
  15
  16 #define WLAN_CAPABILITY_ESS             (1<<0)
  17 #define WLAN_CAPABILITY_IBSS            (1<<1)
  18 #define WLAN_CAPABILITY_CF_POLLABLE     (1<<2)
  19 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
  20 #define WLAN_CAPABILITY_PRIVACY         (1<<4)
  21 #define WLAN_CAPABILITY_SHORT_PREAMBLE  (1<<5)
  22 #define WLAN_CAPABILITY_PBCC            (1<<6)
  23 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
  24 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
  25 #define WLAN_CAPABILITY_QOS             (1<<9)
  26 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
  27 #define WLAN_CAPABILITY_APSD            (1<<11)
  28 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
  29
  30 static unsigned char wifi_oui[3]      = { 0x00, 0x50, 0xf2 };
  31 static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };
  32
  33 struct scan_params {
  34         bool unknown;
  35         enum print_ie_type type;
  36         bool show_both_ie_sets;
  37 };
  38
  39 #define IEEE80211_COUNTRY_EXTENSION_ID 201
  40
  41 struct ieee80211_country_ie_triplet {
  42         union {
  43                 struct {
  44                         __u8 first_channel;
  45                         __u8 num_channels;
  46                         __s8 max_power;
  47                 } __attribute__ ((packed)) chans;
  48                 struct {
  49                         __u8 reg_extension_id;
  50                         __u8 reg_class;
  51                         __u8 coverage_class;
  52                 } __attribute__ ((packed)) ext;
  53         };
  54 } __attribute__ ((packed));
  55
  56 static int handle_scan(struct nl80211_state *state,
  57                        struct nl_cb *cb,
  58                        struct nl_msg *msg,
  59                        int argc, char **argv)
  60 {
  61         struct nl_msg *ssids = NULL, *freqs = NULL;
  62         char *eptr;
  63         int err = -ENOBUFS;
  64         int i;
  65         enum {
  66                 NONE,
  67                 FREQ,
  68                 IES,
  69                 SSID,
  70                 DONE,
  71         } parse = NONE;
  72         int freq;
  73         bool passive = false, have_ssids = false, have_freqs = false;
  74         size_t tmp;
  75         unsigned char *ies;
  76
  77         ssids = nlmsg_alloc();
  78         if (!ssids)
  79                 return -ENOMEM;
  80
  81         freqs = nlmsg_alloc();
  82         if (!freqs) {
  83                 nlmsg_free(ssids);
  84                 return -ENOMEM;
  85         }
  86
  87         for (i = 0; i < argc; i++) {
  88                 switch (parse) {
  89                 case NONE:
  90                         if (strcmp(argv[i], "freq") == 0) {
  91                                 parse = FREQ;
  92                                 have_freqs = true;
  93                                 break;
  94                         } else if (strcmp(argv[i], "ies") == 0) {
  95                                 parse = IES;
  96                                 break;
  97                         } else if (strcmp(argv[i], "ssid") == 0) {
  98                                 parse = SSID;
  99                                 have_ssids = true;
 100                                 break;
 101                         } else if (strcmp(argv[i], "passive") == 0) {
 102                                 parse = DONE;
 103                                 passive = true;
 104                                 break;
 105                         }
 106                 case DONE:
 107                         return 1;
 108                 case FREQ:
 109                         freq = strtoul(argv[i], &eptr, 10);
 110                         if (eptr != argv[i] + strlen(argv[i]))
 111                                 return 1;
 112                         NLA_PUT_U32(freqs, i, freq);
 113                         parse = NONE;
 114                         break;
 115                 case IES:
 116                         ies = parse_hex(argv[i], &tmp);
 117                         if (!ies)
 118                                 goto nla_put_failure;
 119                         NLA_PUT(msg, NL80211_ATTR_IE, tmp, ies);
 120                         free(ies);
 121                         parse = NONE;
 122                         break;
 123                 case SSID:
 124                         NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
 125                         break;
 126                 }
 127         }
 128
 129         if (!have_ssids)
 130                 NLA_PUT(ssids, 1, 0, "");
 131         if (!passive)
 132                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
 133
 134         if (have_freqs)
 135                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
 136
 137         err = 0;
 138  nla_put_failure:
 139         nlmsg_free(ssids);
 140         nlmsg_free(freqs);
 141         return err;
 142 }
 143
 144 static void tab_on_first(bool *first)
 145 {
 146         if (!*first)
 147                 printf("\t");
 148         else
 149                 *first = false;
 150 }
 151
 152 static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
 153 {
 154         printf(" ");
 155         print_ssid_escaped(len, data);
 156         printf("\n");
 157 }
 158
 159 static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 160 {
 161         int i;
 162
 163         printf(" ");
 164
 165         for (i = 0; i < len; i++) {
 166                 int r = data[i] & 0x7f;
 167                 printf("%d.%d%s ", r/2, 5*(r&1), data[i] & 0x80 ? "*":"");
 168         }
 169         printf("\n");
 170 }
 171
 172 static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
 173 {
 174         printf(" channel %d\n", data[0]);
 175 }
 176
 177 static const char *country_env_str(char environment)
 178 {
 179         switch (environment) {
 180         case 'I':
 181                 return "Indoor only";
 182         case 'O':
 183                 return "Outdoor only";
 184         case ' ':
 185                 return "Indoor/Outdoor";
 186         default:
 187                 return "bogus";
 188         }
 189 }
 190
 191 static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
 192 {
 193         printf(" %.*s", 2, data);
 194
 195         printf("\tEnvironment: %s\n", country_env_str(data[2]));
 196
 197         data += 3;
 198         len -= 3;
 199
 200         if (len < 3) {
 201                 printf("\t\tNo country IE triplets present\n");
 202                 return;
 203         }
 204
 205         while (len >= 3) {
 206                 int end_channel;
 207                 struct ieee80211_country_ie_triplet *triplet =
 208                         (struct ieee80211_country_ie_triplet *) data;
 209
 210                 if (triplet->ext.reg_extension_id >= IEEE80211_COUNTRY_EXTENSION_ID) {
 211                         printf("\t\tExtension ID: %d Regulatory Class: %d Coverage class: %d (up to %dm)\n",
 212                                triplet->ext.reg_extension_id,
 213                                triplet->ext.reg_class,
 214                                triplet->ext.coverage_class,
 215                                triplet->ext.coverage_class * 450);
 216
 217                         data += 3;
 218                         len -= 3;
 219                         continue;
 220                 }
 221
 222                 /* 2 GHz */
 223                 if (triplet->chans.first_channel <= 14)
 224                         end_channel = triplet->chans.first_channel + (triplet->chans.num_channels - 1);
 225                 else
 226                         end_channel =  triplet->chans.first_channel + (4 * (triplet->chans.num_channels - 1));
 227
 228                 printf("\t\tChannels [%d - %d]\n", triplet->chans.first_channel, end_channel);
 229
 230                 data += 3;
 231                 len -= 3;
 232         }
 233
 234         return;
 235 }
 236
 237 static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
 238 {
 239         printf(" %d dB\n", data[0]);
 240 }
 241
 242 static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 243 {
 244         if (data[0] == 0x00)
 245                 printf(" <no flags>");
 246         if (data[0] & 0x01)
 247                 printf(" NonERP_Present");
 248         if (data[0] & 0x02)
 249                 printf(" Use_Protection");
 250         if (data[0] & 0x04)
 251                 printf(" Barker_Preamble_Mode");
 252         printf("\n");
 253 }
 254
 255 static void print_cipher(const uint8_t *data)
 256 {
 257         if (memcmp(data, wifi_oui, 3) == 0) {
 258                 switch (data[3]) {
 259                 case 0:
 260                         printf("Use group cipher suite");
 261                         break;
 262                 case 1:
 263                         printf("WEP-40");
 264                         break;
 265                 case 2:
 266                         printf("TKIP");
 267                         break;
 268                 case 4:
 269                         printf("CCMP");
 270                         break;
 271                 case 5:
 272                         printf("WEP-104");
 273                         break;
 274                 default:
 275                         printf("%.02x-%.02x-%.02x:%d",
 276                                 data[0], data[1] ,data[2], data[3]);
 277                         break;
 278                 }
 279         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 280                 switch (data[3]) {
 281                 case 0:
 282                         printf("Use group cipher suite");
 283                         break;
 284                 case 1:
 285                         printf("WEP-40");
 286                         break;
 287                 case 2:
 288                         printf("TKIP");
 289                         break;
 290                 case 4:
 291                         printf("CCMP");
 292                         break;
 293                 case 5:
 294                         printf("WEP-104");
 295                         break;
 296                 case 6:
 297                         printf("AES-128-CMAC");
 298                         break;
 299                 default:
 300                         printf("%.02x-%.02x-%.02x:%d",
 301                                 data[0], data[1] ,data[2], data[3]);
 302                         break;
 303                 }
 304         } else
 305                 printf("%.02x-%.02x-%.02x:%d",
 306                         data[0], data[1] ,data[2], data[3]);
 307 }
 308
 309 static void print_auth(const uint8_t *data)
 310 {
 311         if (memcmp(data, wifi_oui, 3) == 0) {
 312                 switch (data[3]) {
 313                 case 1:
 314                         printf("IEEE 802.1X");
 315                         break;
 316                 case 2:
 317                         printf("PSK");
 318                         break;
 319                 default:
 320                         printf("%.02x-%.02x-%.02x:%d",
 321                                 data[0], data[1] ,data[2], data[3]);
 322                         break;
 323                 }
 324         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 325                 switch (data[3]) {
 326                 case 1:
 327                         printf("IEEE 802.1X");
 328                         break;
 329                 case 2:
 330                         printf("PSK");
 331                         break;
 332                 case 3:
 333                         printf("FT/IEEE 802.1X");
 334                         break;
 335                 case 4:
 336                         printf("FT/PSK");
 337                         break;
 338                 case 5:
 339                         printf("IEEE 802.1X/SHA-256");
 340                         break;
 341                 case 6:
 342                         printf("PSK/SHA-256");
 343                         break;
 344                 default:
 345                         printf("%.02x-%.02x-%.02x:%d",
 346                                 data[0], data[1] ,data[2], data[3]);
 347                         break;
 348                 }
 349         } else
 350                 printf("%.02x-%.02x-%.02x:%d",
 351                         data[0], data[1] ,data[2], data[3]);
 352 }
 353
 354 static void print_rsn_ie(const char *defcipher, const char *defauth,
 355                          uint8_t len, const uint8_t *data)
 356 {
 357         bool first = true;
 358         __u16 version, count, capa;
 359         int i;
 360
 361         version = data[0] + (data[1] << 8);
 362         tab_on_first(&first);
 363         printf("\t * Version: %d\n", version);
 364
 365         data += 2;
 366         len -= 2;
 367
 368         if (len < 4) {
 369                 tab_on_first(&first);
 370                 printf("\t * Group cipher: %s\n", defcipher);
 371                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 372                 return;
 373         }
 374
 375         tab_on_first(&first);
 376         printf("\t * Group cipher: ");
 377         print_cipher(data);
 378         printf("\n");
 379
 380         data += 4;
 381         len -= 4;
 382
 383         if (len < 2) {
 384                 tab_on_first(&first);
 385                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 386                 return;
 387         }
 388
 389         count = data[0] | (data[1] << 8);
 390         if (2 + (count * 4) > len)
 391                 goto invalid;
 392
 393         tab_on_first(&first);
 394         printf("\t * Pairwise ciphers:");
 395         for (i = 0; i < count; i++) {
 396                 printf(" ");
 397                 print_cipher(data + 2 + (i * 4));
 398         }
 399         printf("\n");
 400
 401         data += 2 + (count * 4);
 402         len -= 2 + (count * 4);
 403
 404         if (len < 2) {
 405                 tab_on_first(&first);
 406                 printf("\t * Authentication suites: %s\n", defauth);
 407                 return;
 408         }
 409
 410         count = data[0] | (data[1] << 8);
 411         if (2 + (count * 4) > len)
 412                 goto invalid;
 413
 414         tab_on_first(&first);
 415         printf("\t * Authentication suites:");
 416         for (i = 0; i < count; i++) {
 417                 printf(" ");
 418                 print_auth(data + 2 + (i * 4));
 419         }
 420         printf("\n");
 421
 422         data += 2 + (count * 4);
 423         len -= 2 + (count * 4);
 424
 425         if (len >= 2) {
 426                 capa = data[0] | (data[1] << 8);
 427                 tab_on_first(&first);
 428                 printf("\t * Capabilities:");
 429                 if (capa & 0x0001)
 430                         printf(" PreAuth");
 431                 if (capa & 0x0002)
 432                         printf(" NoPairwise");
 433                 switch ((capa & 0x000c) >> 2) {
 434                 case 0:
 435                         break;
 436                 case 1:
 437                         printf(" 2-PTKSA-RC");
 438                         break;
 439                 case 2:
 440                         printf(" 4-PTKSA-RC");
 441                         break;
 442                 case 3:
 443                         printf(" 16-PTKSA-RC");
 444                         break;
 445                 }
 446                 switch ((capa & 0x0030) >> 4) {
 447                 case 0:
 448                         break;
 449                 case 1:
 450                         printf(" 2-GTKSA-RC");
 451                         break;
 452                 case 2:
 453                         printf(" 4-GTKSA-RC");
 454                         break;
 455                 case 3:
 456                         printf(" 16-GTKSA-RC");
 457                         break;
 458                 }
 459                 if (capa & 0x0040)
 460                         printf(" MFP-required");
 461                 if (capa & 0x0080)
 462                         printf(" MFP-capable");
 463                 if (capa & 0x0200)
 464                         printf(" Peerkey-enabled");
 465                 if (capa & 0x0400)
 466                         printf(" SPP-AMSDU-capable");
 467                 if (capa & 0x0800)
 468                         printf(" SPP-AMSDU-required");
 469                 printf(" (0x%.4x)\n", capa);
 470                 data += 2;
 471                 len -= 2;
 472         }
 473
 474  invalid:
 475         if (len != 0) {
 476                 printf("\t\t * bogus tail data (%d):", len);
 477                 while (len) {
 478                         printf(" %.2x", *data);
 479                         data++;
 480                         len--;
 481                 }
 482                 printf("\n");
 483         }
 484 }
 485
 486 static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
 487 {
 488         print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 489 }
 490
 491 static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
 492 {
 493         printf("\n");
 494         print_ht_capability(data[0] | (data[1] << 8));
 495         print_ampdu_length(data[2] & 3);
 496         print_ampdu_spacing((data[2] >> 2) & 7);
 497         print_ht_mcs(data + 3);
 498 }
 499
 500 static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
 501 {
 502         static const char *offset[4] = {
 503                 "no secondary",
 504                 "above",
 505                 "[reserved!]",
 506                 "below",
 507         };
 508         static const char *protection[4] = {
 509                 "no",
 510                 "nonmember",
 511                 "20 MHz",
 512                 "non-HT mixed",
 513         };
 514         static const char *sta_chan_width[2] = {
 515                 "20 MHz",
 516                 "any",
 517         };
 518
 519         printf("\n");
 520         printf("\t\t * primary channel: %d\n", data[0]);
 521         printf("\t\t * secondary channel offset: %s\n",
 522                 offset[data[1] & 0x3]);
 523         printf("\t\t * STA channel width: %s\n", sta_chan_width[(data[1] & 0x4)>>2]);
 524         printf("\t\t * RIFS: %d\n", (data[1] & 0x8)>>3);
 525         printf("\t\t * HT protection: %s\n", protection[data[2] & 0x3]);
 526         printf("\t\t * non-GF present: %d\n", (data[2] & 0x4) >> 2);
 527         printf("\t\t * OBSS non-GF present: %d\n", (data[2] & 0x10) >> 4);
 528         printf("\t\t * dual beacon: %d\n", (data[4] & 0x40) >> 6);
 529         printf("\t\t * dual CTS protection: %d\n", (data[4] & 0x80) >> 7);
 530         printf("\t\t * STBC beacon: %d\n", data[5] & 0x1);
 531         printf("\t\t * L-SIG TXOP Prot: %d\n", (data[5] & 0x2) >> 1);
 532         printf("\t\t * PCO active: %d\n", (data[5] & 0x4) >> 2);
 533         printf("\t\t * PCO phase: %d\n", (data[5] & 0x8) >> 3);
 534 }
 535
 536 static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 537 {
 538         int i, base, bit;
 539         bool first = true;
 540
 541
 542         for (i = 0; i < len; i++) {
 543                 base = i * 8;
 544
 545                 for (bit = 0; bit < 8; bit++) {
 546                         if (!(data[i] & (1 << bit)))
 547                                 continue;
 548
 549                         if (!first)
 550                                 printf(",");
 551                         else
 552                                 first = false;
 553
 554                         switch (bit + base) {
 555                         case 0:
 556                                 printf(" HT Information Exchange Supported");
 557                                 break;
 558                         case 1:
 559                                 printf(" On-demand Beacon");
 560                                 break;
 561                         case 2:
 562                                 printf(" Extended Channel Switching");
 563                                 break;
 564                         case 3:
 565                                 printf(" Wave Indication");
 566                                 break;
 567                         case 4:
 568                                 printf(" PSMP Capability");
 569                                 break;
 570                         case 5:
 571                                 printf(" Service Interval Granularity");
 572                                 break;
 573                         case 6:
 574                                 printf(" S-PSMP Capability");
 575                                 break;
 576                         default:
 577                                 printf(" %d", bit);
 578                                 break;
 579                         }
 580                 }
 581         }
 582
 583         printf("\n");
 584 }
 585
 586 static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data)
 587 {
 588         printf(" DTIM Count %u DTIM Period %u Bitmap Control 0x%x "
 589                "Bitmap[0] 0x%x",
 590                data[0], data[1], data[2], data[3]);
 591         if (len - 4)
 592                 printf(" (+ %u octet%s)", len - 4, len - 4 == 1 ? "" : "s");
 593         printf("\n");
 594 }
 595
 596 struct ie_print {
 597         const char *name;
 598         void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
 599         uint8_t minlen, maxlen;
 600         uint8_t flags;
 601 };
 602
 603 static void print_ie(const struct ie_print *p, const uint8_t type,
 604                      uint8_t len, const uint8_t *data)
 605 {
 606         int i;
 607
 608         if (!p->print)
 609                 return;
 610
 611         printf("\t%s:", p->name);
 612         if (len < p->minlen || len > p->maxlen) {
 613                 if (len > 1) {
 614                         printf(" <invalid: %d bytes:", len);
 615                         for (i = 0; i < len; i++)
 616                                 printf(" %.02x", data[i]);
 617                         printf(">\n");
 618                 } else if (len)
 619                         printf(" <invalid: 1 byte: %.02x>\n", data[0]);
 620                 else
 621                         printf(" <invalid: no data>\n");
 622                 return;
 623         }
 624
 625         p->print(type, len, data);
 626 }
 627
 628 #define PRINT_IGN {             \
 629         .name = "IGNORE",       \
 630         .print = NULL,          \
 631         .minlen = 0,            \
 632         .maxlen = 255,          \
 633 }
 634
 635 static const struct ie_print ieprinters[] = {
 636         [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
 637         [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 638         [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
 639         [5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), },
 640         [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
 641         [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
 642         [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
 643         [45] = { "HT capabilities", print_ht_capa, 26, 26, BIT(PRINT_SCAN), },
 644         [61] = { "HT operation", print_ht_op, 22, 22, BIT(PRINT_SCAN), },
 645         [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
 646         [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 647         [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
 648 };
 649
 650 static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
 651 {
 652         print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
 653 }
 654
 655 static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
 656 {
 657         int i;
 658         static const char *aci_tbl[] = { "BE", "BK", "VI", "VO" };
 659
 660         if (len < 19)
 661                 goto invalid;
 662
 663         if (data[0] != 1) {
 664                 printf("Parameter: not version 1: ");
 665                 return false;
 666         }
 667
 668         printf("\t * Parameter version 1");
 669
 670         data++;
 671
 672         if (data[0] & 0x80)
 673                 printf("\n\t\t * u-APSD");
 674
 675         data += 2;
 676
 677         for (i = 0; i < 4; i++) {
 678                 printf("\n\t\t * %s:", aci_tbl[(data[0] >> 5) & 3]);
 679                 if (data[4] & 0x10)
 680                         printf(" acm");
 681                 printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1,
 682                                     (1 << (data[1] >> 4)) - 1);
 683                 printf(", AIFSN %d", data[0] & 0xf);
 684                 if (data[2] | data[3])
 685                         printf(", TXOP %d usec", (data[2] + (data[3] << 8)) * 32);
 686                 data += 4;
 687         }
 688
 689         printf("\n");
 690         return true;
 691
 692  invalid:
 693         printf("invalid: ");
 694         return false;
 695 }
 696
 697 static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
 698 {
 699         int i;
 700
 701         switch (data[0]) {
 702         case 0x00:
 703                 printf(" information:");
 704                 break;
 705         case 0x01:
 706                 if (print_wifi_wmm_param(data + 1, len - 1))
 707                         return;
 708                 break;
 709         default:
 710                 printf(" type %d:", data[0]);
 711                 break;
 712         }
 713
 714         for(i = 1; i < len; i++)
 715                 printf(" %.02x", data[i]);
 716         printf("\n");
 717 }
 718
 719 static const char * wifi_wps_dev_passwd_id(uint16_t id)
 720 {
 721         switch (id) {
 722         case 0:
 723                 return "Default (PIN)";
 724         case 1:
 725                 return "User-specified";
 726         case 2:
 727                 return "Machine-specified";
 728         case 3:
 729                 return "Rekey";
 730         case 4:
 731                 return "PushButton";
 732         case 5:
 733                 return "Registrar-specified";
 734         default:
 735                 return "??";
 736         }
 737 }
 738
 739 static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
 740 {
 741         bool first = true;
 742         __u16 subtype, sublen;
 743
 744         while (len >= 4) {
 745                 subtype = (data[0] << 8) + data[1];
 746                 sublen = (data[2] << 8) + data[3];
 747                 if (sublen > len)
 748                         break;
 749
 750                 switch (subtype) {
 751                 case 0x104a:
 752                         tab_on_first(&first);
 753                         printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
 754                         break;
 755                 case 0x1011:
 756                         tab_on_first(&first);
 757                         printf("\t * Device name: %.*s\n", sublen, data + 4);
 758                         break;
 759                 case 0x1012: {
 760                         uint16_t id;
 761                         tab_on_first(&first);
 762                         if (sublen != 2) {
 763                                 printf("\t * Device Password ID: (invalid "
 764                                        "length %d)\n", sublen);
 765                                 break;
 766                         }
 767                         id = data[4] << 8 | data[5];
 768                         printf("\t * Device Password ID: %u (%s)\n",
 769                                id, wifi_wps_dev_passwd_id(id));
 770                         break;
 771                 }
 772                 case 0x1021:
 773                         tab_on_first(&first);
 774                         printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
 775                         break;
 776                 case 0x1023:
 777                         tab_on_first(&first);
 778                         printf("\t * Model: %.*s\n", sublen, data + 4);
 779                         break;
 780                 case 0x1024:
 781                         tab_on_first(&first);
 782                         printf("\t * Model Number: %.*s\n", sublen, data + 4);
 783                         break;
 784                 case 0x103b: {
 785                         __u8 val = data[4];
 786                         tab_on_first(&first);
 787                         printf("\t * Response Type: %d%s\n",
 788                                val, val == 3 ? " (AP)" : "");
 789                         break;
 790                 }
 791                 case 0x103c: {
 792                         __u8 val = data[4];
 793                         tab_on_first(&first);
 794                         printf("\t * RF Bands: 0x%x\n", val);
 795                         break;
 796                 }
 797                 case 0x1041: {
 798                         __u8 val = data[4];
 799                         tab_on_first(&first);
 800                         printf("\t * Selected Registrar: 0x%x\n", val);
 801                         break;
 802                 }
 803                 case 0x1042:
 804                         tab_on_first(&first);
 805                         printf("\t * Serial Number: %.*s\n", sublen, data + 4);
 806                         break;
 807                 case 0x1044: {
 808                         __u8 val = data[4];
 809                         tab_on_first(&first);
 810                         printf("\t * Wi-Fi Protected Setup State: %d%s%s\n",
 811                                val,
 812                                val == 1 ? " (Unconfigured)" : "",
 813                                val == 2 ? " (Configured)" : "");
 814                         break;
 815                 }
 816                 case 0x1054: {
 817                         tab_on_first(&first);
 818                         if (sublen != 8) {
 819                                 printf("\t * Primary Device Type: (invalid "
 820                                        "length %d)\n", sublen);
 821                                 break;
 822                         }
 823                         printf("\t * Primary Device Type: "
 824                                "%u-%02x%02x%02x%02x-%u\n",
 825                                data[4] << 8 | data[5],
 826                                data[6], data[7], data[8], data[9],
 827                                data[10] << 8 | data[11]);
 828                         break;
 829                 }
 830                 case 0x1057: {
 831                         __u8 val = data[4];
 832                         tab_on_first(&first);
 833                         printf("\t * AP setup locked: 0x%.2x\n", val);
 834                         break;
 835                 }
 836                 case 0x1008:
 837                 case 0x1053: {
 838                         __u16 meth = (data[4] << 8) + data[5];
 839                         bool comma = false;
 840                         tab_on_first(&first);
 841                         printf("\t * %sConfig methods:",
 842                                subtype == 0x1053 ? "Selected Registrar ": "");
 843 #define T(bit, name) do {               \
 844         if (meth & (1<<bit)) {          \
 845                 if (comma)              \
 846                         printf(",");    \
 847                 comma = true;           \
 848                 printf(" " name);       \
 849         } } while (0)
 850                         T(0, "USB");
 851                         T(1, "Ethernet");
 852                         T(2, "Label");
 853                         T(3, "Display");
 854                         T(4, "Ext. NFC");
 855                         T(5, "Int. NFC");
 856                         T(6, "NFC Intf.");
 857                         T(7, "PBC");
 858                         T(8, "Keypad");
 859                         printf("\n");
 860                         break;
 861 #undef T
 862                 }
 863                 default: {
 864                         const __u8 *subdata = data + 4;
 865                         __u16 tmplen = sublen;
 866
 867                         tab_on_first(&first);
 868                         printf("\t * Unknown TLV (%#.4x, %d bytes):",
 869                                subtype, tmplen);
 870                         while (tmplen) {
 871                                 printf(" %.2x", *subdata);
 872                                 subdata++;
 873                                 tmplen--;
 874                         }
 875                         printf("\n");
 876                         break;
 877                 }
 878                 }
 879
 880                 data += sublen + 4;
 881                 len -= sublen + 4;
 882         }
 883
 884         if (len != 0) {
 885                 printf("\t\t * bogus tail data (%d):", len);
 886                 while (len) {
 887                         printf(" %.2x", *data);
 888                         data++;
 889                         len--;
 890                 }
 891                 printf("\n");
 892         }
 893 }
 894
 895 static const struct ie_print wifiprinters[] = {
 896         [1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
 897         [2] = { "WMM", print_wifi_wmm, 1, 255, BIT(PRINT_SCAN), },
 898         [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
 899 };
 900
 901 static void print_vendor(unsigned char len, unsigned char *data,
 902                          bool unknown, enum print_ie_type ptype)
 903 {
 904         int i;
 905
 906         if (len < 3) {
 907                 printf("\tVendor specific: <too short> data:");
 908                 for(i = 0; i < len; i++)
 909                         printf(" %.02x", data[i]);
 910                 printf("\n");
 911                 return;
 912         }
 913
 914         if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) {
 915                 if (data[3] < ARRAY_SIZE(wifiprinters) &&
 916                     wifiprinters[data[3]].name &&
 917                     wifiprinters[data[3]].flags & BIT(ptype)) {
 918                         print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
 919                         return;
 920                 }
 921                 if (!unknown)
 922                         return;
 923                 printf("\tWiFi OUI %#.2x, data:", data[3]);
 924                 for(i = 0; i < len - 4; i++)
 925                         printf(" %.02x", data[i + 4]);
 926                 printf("\n");
 927                 return;
 928         }
 929
 930         if (!unknown)
 931                 return;
 932
 933         printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
 934                 data[0], data[1], data[2]);
 935         for (i = 3; i < len; i++)
 936                 printf(" %.2x", data[i]);
 937         printf("\n");
 938 }
 939
 940 void print_ies(unsigned char *ie, int ielen, bool unknown,
 941                enum print_ie_type ptype)
 942 {
 943         while (ielen >= 2 && ielen >= ie[1]) {
 944                 if (ie[0] < ARRAY_SIZE(ieprinters) &&
 945                     ieprinters[ie[0]].name &&
 946                     ieprinters[ie[0]].flags & BIT(ptype)) {
 947                         print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
 948                 } else if (ie[0] == 221 /* vendor */) {
 949                         print_vendor(ie[1], ie + 2, unknown, ptype);
 950                 } else if (unknown) {
 951                         int i;
 952
 953                         printf("\tUnknown IE (%d):", ie[0]);
 954                         for (i=0; i<ie[1]; i++)
 955                                 printf(" %.2x", ie[2+i]);
 956                         printf("\n");
 957                 }
 958                 ielen -= ie[1] + 2;
 959                 ie += ie[1] + 2;
 960         }
 961 }
 962
 963 static int print_bss_handler(struct nl_msg *msg, void *arg)
 964 {
 965         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 966         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 967         struct nlattr *bss[NL80211_BSS_MAX + 1];
 968         char mac_addr[20], dev[20];
 969         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
 970                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
 971                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
 972                 [NL80211_BSS_BSSID] = { },
 973                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
 974                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
 975                 [NL80211_BSS_INFORMATION_ELEMENTS] = { },
 976                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
 977                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
 978                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
 979                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
 980                 [NL80211_BSS_BEACON_IES] = { },
 981         };
 982         struct scan_params *params = arg;
 983         int show = params->show_both_ie_sets ? 2 : 1;
 984
 985         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 986                   genlmsg_attrlen(gnlh, 0), NULL);
 987
 988         if (!tb[NL80211_ATTR_BSS]) {
 989                 fprintf(stderr, "bss info missing!\n");
 990                 return NL_SKIP;
 991         }
 992         if (nla_parse_nested(bss, NL80211_BSS_MAX,
 993                              tb[NL80211_ATTR_BSS],
 994                              bss_policy)) {
 995                 fprintf(stderr, "failed to parse nested attributes!\n");
 996                 return NL_SKIP;
 997         }
 998
 999         if (!bss[NL80211_BSS_BSSID])
1000                 return NL_SKIP;
1001
1002         mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
1003         if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
1004         printf("BSS %s (on %s)", mac_addr, dev);
1005
1006         if (bss[NL80211_BSS_STATUS]) {
1007                 switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
1008                 case NL80211_BSS_STATUS_AUTHENTICATED:
1009                         printf(" -- authenticated");
1010                         break;
1011                 case NL80211_BSS_STATUS_ASSOCIATED:
1012                         printf(" -- associated");
1013                         break;
1014                 case NL80211_BSS_STATUS_IBSS_JOINED:
1015                         printf(" -- joined");
1016                         break;
1017                 default:
1018                         printf(" -- unknown status: %d",
1019                                 nla_get_u32(bss[NL80211_BSS_STATUS]));
1020                         break;
1021                 }
1022         }
1023         printf("\n");
1024
1025         if (bss[NL80211_BSS_TSF]) {
1026                 unsigned long long tsf;
1027                 tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
1028                 printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
1029                         tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
1030                         (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
1031         }
1032         if (bss[NL80211_BSS_FREQUENCY])
1033                 printf("\tfreq: %d\n",
1034                         nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
1035         if (bss[NL80211_BSS_BEACON_INTERVAL])
1036                 printf("\tbeacon interval: %d\n",
1037                         nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
1038         if (bss[NL80211_BSS_CAPABILITY]) {
1039                 __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1040                 printf("\tcapability:");
1041                 if (capa & WLAN_CAPABILITY_ESS)
1042                         printf(" ESS");
1043                 if (capa & WLAN_CAPABILITY_IBSS)
1044                         printf(" IBSS");
1045                 if (capa & WLAN_CAPABILITY_PRIVACY)
1046                         printf(" Privacy");
1047                 if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
1048                         printf(" ShortPreamble");
1049                 if (capa & WLAN_CAPABILITY_PBCC)
1050                         printf(" PBCC");
1051                 if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
1052                         printf(" ChannelAgility");
1053                 if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
1054                         printf(" SpectrumMgmt");
1055                 if (capa & WLAN_CAPABILITY_QOS)
1056                         printf(" QoS");
1057                 if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
1058                         printf(" ShortSlotTime");
1059                 if (capa & WLAN_CAPABILITY_APSD)
1060                         printf(" APSD");
1061                 if (capa & WLAN_CAPABILITY_DSSS_OFDM)
1062                         printf(" DSSS-OFDM");
1063                 printf(" (0x%.4x)\n", capa);
1064         }
1065         if (bss[NL80211_BSS_SIGNAL_MBM]) {
1066                 int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
1067                 printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
1068         }
1069         if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
1070                 unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
1071                 printf("\tsignal: %d/100\n", s);
1072         }
1073         if (bss[NL80211_BSS_SEEN_MS_AGO]) {
1074                 int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
1075                 printf("\tlast seen: %d ms ago\n", age);
1076         }
1077
1078         if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) {
1079                 if (bss[NL80211_BSS_BEACON_IES])
1080                         printf("\tInformation elements from Probe Response "
1081                                "frame:\n");
1082                 print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1083                           nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1084                           params->unknown, params->type);
1085         }
1086         if (bss[NL80211_BSS_BEACON_IES] && show--) {
1087                 printf("\tInformation elements from Beacon frame:\n");
1088                 print_ies(nla_data(bss[NL80211_BSS_BEACON_IES]),
1089                           nla_len(bss[NL80211_BSS_BEACON_IES]),
1090                           params->unknown, params->type);
1091         }
1092
1093         return NL_SKIP;
1094 }
1095
1096 static struct scan_params scan_params;
1097
1098 static int handle_scan_dump(struct nl80211_state *state,
1099                             struct nl_cb *cb,
1100                             struct nl_msg *msg,
1101                             int argc, char **argv)
1102 {
1103         if (argc > 1)
1104                 return 1;
1105
1106         memset(&scan_params, 0, sizeof(scan_params));
1107
1108         if (argc == 1 && !strcmp(argv[0], "-u"))
1109                 scan_params.unknown = true;
1110         else if (argc == 1 && !strcmp(argv[0], "-b"))
1111                 scan_params.show_both_ie_sets = true;
1112
1113         scan_params.type = PRINT_SCAN;
1114
1115         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
1116                   &scan_params);
1117         return 0;
1118 }
1119
1120 static int handle_scan_combined(struct nl80211_state *state,
1121                                 struct nl_cb *cb,
1122                                 struct nl_msg *msg,
1123                                 int argc, char **argv)
1124 {
1125         char **trig_argv;
1126         static char *dump_argv[] = {
1127                 NULL,
1128                 "scan",
1129                 "dump",
1130                 NULL,
1131         };
1132         static const __u32 cmds[] = {
1133                 NL80211_CMD_NEW_SCAN_RESULTS,
1134                 NL80211_CMD_SCAN_ABORTED,
1135         };
1136         int trig_argc, dump_argc, err;
1137
1138         if (argc >= 3 && !strcmp(argv[2], "-u")) {
1139                 dump_argc = 4;
1140                 dump_argv[3] = "-u";
1141         } else if (argc >= 3 && !strcmp(argv[2], "-b")) {
1142                 dump_argc = 4;
1143                 dump_argv[3] = "-b";
1144         } else
1145                 dump_argc = 3;
1146
1147         trig_argc = 3 + (argc - 2) + (3 - dump_argc);
1148         trig_argv = calloc(trig_argc, sizeof(*trig_argv));
1149         if (!trig_argv)
1150                 return -ENOMEM;
1151         trig_argv[0] = argv[0];
1152         trig_argv[1] = "scan";
1153         trig_argv[2] = "trigger";
1154         int i;
1155         for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
1156                 trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
1157         err = handle_cmd(state, II_NETDEV, trig_argc, trig_argv);
1158         free(trig_argv);
1159         if (err)
1160                 return err;
1161
1162         /*
1163          * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
1164          *
1165          * This code has a bug, which requires creating a separate
1166          * nl80211 socket to fix:
1167          * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
1168          * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
1169          * before (!) we listen to it, because we only start listening
1170          * after we send our scan request.
1171          *
1172          * Doing it the other way around has a race condition as well,
1173          * if you first open the events socket you may get a notification
1174          * for a previous scan.
1175          *
1176          * The only proper way to fix this would be to listen to events
1177          * before sending the command, and for the kernel to send the
1178          * scan request along with the event, so that you can match up
1179          * whether the scan you requested was finished or aborted (this
1180          * may result in processing a scan that another application
1181          * requested, but that doesn't seem to be a problem).
1182          *
1183          * Alas, the kernel doesn't do that (yet).
1184          */
1185
1186         if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
1187                                         NL80211_CMD_SCAN_ABORTED) {
1188                 printf("scan aborted!\n");
1189                 return 0;
1190         }
1191
1192         dump_argv[0] = argv[0];
1193         return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
1194 }
1195 TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]", 0, 0,
1196          CIB_NETDEV, handle_scan_combined,
1197          "Scan on the given frequencies and probe for the given SSIDs\n"
1198          "(or wildcard if not given) unless passive scanning is requested.\n"
1199          "If -u is specified print unknown data in the scan results.\n"
1200          "Specified (vendor) IEs must be well-formed.");
1201 COMMAND(scan, dump, "[-u]",
1202         NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
1203         "Dump the current scan results. If -u is specified, print unknown\n"
1204         "data in scan results.");
1205 COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]",
1206         NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
1207          "Trigger a scan on the given frequencies with probing for the given\n"
1208          "SSIDs (or wildcard if not given) unless passive scanning is requested.");