wpa_supplicant/ctrl_iface.c

   1 /*
   2  * WPA Supplicant / Control interface (shared code for all backends)
   3  * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10 #ifdef CONFIG_TESTING_OPTIONS
  11 #include <net/ethernet.h>
  12 #include <netinet/ip.h>
  13 #endif /* CONFIG_TESTING_OPTIONS */
  14
  15 #include "utils/common.h"
  16 #include "utils/eloop.h"
  17 #include "utils/uuid.h"
  18 #include "utils/module_tests.h"
  19 #include "common/version.h"
  20 #include "common/ieee802_11_defs.h"
  21 #include "common/ieee802_11_common.h"
  22 #include "common/wpa_ctrl.h"
  23 #ifdef CONFIG_DPP
  24 #include "common/dpp.h"
  25 #endif /* CONFIG_DPP */
  26 #include "crypto/tls.h"
  27 #include "ap/hostapd.h"
  28 #include "eap_peer/eap.h"
  29 #include "eapol_supp/eapol_supp_sm.h"
  30 #include "rsn_supp/wpa.h"
  31 #include "rsn_supp/preauth.h"
  32 #include "rsn_supp/pmksa_cache.h"
  33 #include "l2_packet/l2_packet.h"
  34 #include "wps/wps.h"
  35 #include "fst/fst.h"
  36 #include "fst/fst_ctrl_iface.h"
  37 #include "config.h"
  38 #include "wpa_supplicant_i.h"
  39 #include "driver_i.h"
  40 #include "wps_supplicant.h"
  41 #include "ibss_rsn.h"
  42 #include "ap.h"
  43 #include "p2p_supplicant.h"
  44 #include "p2p/p2p.h"
  45 #include "hs20_supplicant.h"
  46 #include "wifi_display.h"
  47 #include "notify.h"
  48 #include "bss.h"
  49 #include "scan.h"
  50 #include "ctrl_iface.h"
  51 #include "interworking.h"
  52 #include "blacklist.h"
  53 #include "autoscan.h"
  54 #include "wnm_sta.h"
  55 #include "offchannel.h"
  56 #include "drivers/driver.h"
  57 #include "mesh.h"
  58 #include "dpp_supplicant.h"
  59 #include "sme.h"
  60
  61 static int wpa_supplicant_global_iface_list(struct wpa_global *global,
  62                                             char *buf, int len);
  63 static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
  64                                                   const char *input,
  65                                                   char *buf, int len);
  66 static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s,
  67                                         char *val);
  68
  69
  70 static int set_bssid_filter(struct wpa_supplicant *wpa_s, char *val)
  71 {
  72         char *pos;
  73         u8 addr[ETH_ALEN], *filter = NULL, *n;
  74         size_t count = 0;
  75
  76         pos = val;
  77         while (pos) {
  78                 if (*pos == '\0')
  79                         break;
  80                 if (hwaddr_aton(pos, addr)) {
  81                         os_free(filter);
  82                         return -1;
  83                 }
  84                 n = os_realloc_array(filter, count + 1, ETH_ALEN);
  85                 if (n == NULL) {
  86                         os_free(filter);
  87                         return -1;
  88                 }
  89                 filter = n;
  90                 os_memcpy(filter + count * ETH_ALEN, addr, ETH_ALEN);
  91                 count++;
  92
  93                 pos = os_strchr(pos, ' ');
  94                 if (pos)
  95                         pos++;
  96         }
  97
  98         wpa_hexdump(MSG_DEBUG, "bssid_filter", filter, count * ETH_ALEN);
  99         os_free(wpa_s->bssid_filter);
 100         wpa_s->bssid_filter = filter;
 101         wpa_s->bssid_filter_count = count;
 102
 103         return 0;
 104 }
 105
 106
 107 static int set_disallow_aps(struct wpa_supplicant *wpa_s, char *val)
 108 {
 109         char *pos;
 110         u8 addr[ETH_ALEN], *bssid = NULL, *n;
 111         struct wpa_ssid_value *ssid = NULL, *ns;
 112         size_t count = 0, ssid_count = 0;
 113         struct wpa_ssid *c;
 114
 115         /*
 116          * disallow_list ::= <ssid_spec> | <bssid_spec> | <disallow_list> | ""
 117          * SSID_SPEC ::= ssid <SSID_HEX>
 118          * BSSID_SPEC ::= bssid <BSSID_HEX>
 119          */
 120
 121         pos = val;
 122         while (pos) {
 123                 if (*pos == '\0')
 124                         break;
 125                 if (os_strncmp(pos, "bssid ", 6) == 0) {
 126                         int res;
 127                         pos += 6;
 128                         res = hwaddr_aton2(pos, addr);
 129                         if (res < 0) {
 130                                 os_free(ssid);
 131                                 os_free(bssid);
 132                                 wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
 133                                            "BSSID value '%s'", pos);
 134                                 return -1;
 135                         }
 136                         pos += res;
 137                         n = os_realloc_array(bssid, count + 1, ETH_ALEN);
 138                         if (n == NULL) {
 139                                 os_free(ssid);
 140                                 os_free(bssid);
 141                                 return -1;
 142                         }
 143                         bssid = n;
 144                         os_memcpy(bssid + count * ETH_ALEN, addr, ETH_ALEN);
 145                         count++;
 146                 } else if (os_strncmp(pos, "ssid ", 5) == 0) {
 147                         char *end;
 148                         pos += 5;
 149
 150                         end = pos;
 151                         while (*end) {
 152                                 if (*end == '\0' || *end == ' ')
 153                                         break;
 154                                 end++;
 155                         }
 156
 157                         ns = os_realloc_array(ssid, ssid_count + 1,
 158                                               sizeof(struct wpa_ssid_value));
 159                         if (ns == NULL) {
 160                                 os_free(ssid);
 161                                 os_free(bssid);
 162                                 return -1;
 163                         }
 164                         ssid = ns;
 165
 166                         if ((end - pos) & 0x01 ||
 167                             end - pos > 2 * SSID_MAX_LEN ||
 168                             hexstr2bin(pos, ssid[ssid_count].ssid,
 169                                        (end - pos) / 2) < 0) {
 170                                 os_free(ssid);
 171                                 os_free(bssid);
 172                                 wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
 173                                            "SSID value '%s'", pos);
 174                                 return -1;
 175                         }
 176                         ssid[ssid_count].ssid_len = (end - pos) / 2;
 177                         wpa_hexdump_ascii(MSG_DEBUG, "disallow_aps SSID",
 178                                           ssid[ssid_count].ssid,
 179                                           ssid[ssid_count].ssid_len);
 180                         ssid_count++;
 181                         pos = end;
 182                 } else {
 183                         wpa_printf(MSG_DEBUG, "Unexpected disallow_aps value "
 184                                    "'%s'", pos);
 185                         os_free(ssid);
 186                         os_free(bssid);
 187                         return -1;
 188                 }
 189
 190                 pos = os_strchr(pos, ' ');
 191                 if (pos)
 192                         pos++;
 193         }
 194
 195         wpa_hexdump(MSG_DEBUG, "disallow_aps_bssid", bssid, count * ETH_ALEN);
 196         os_free(wpa_s->disallow_aps_bssid);
 197         wpa_s->disallow_aps_bssid = bssid;
 198         wpa_s->disallow_aps_bssid_count = count;
 199
 200         wpa_printf(MSG_DEBUG, "disallow_aps_ssid_count %d", (int) ssid_count);
 201         os_free(wpa_s->disallow_aps_ssid);
 202         wpa_s->disallow_aps_ssid = ssid;
 203         wpa_s->disallow_aps_ssid_count = ssid_count;
 204
 205         if (!wpa_s->current_ssid || wpa_s->wpa_state < WPA_AUTHENTICATING)
 206                 return 0;
 207
 208         c = wpa_s->current_ssid;
 209         if (c->mode != WPAS_MODE_INFRA && c->mode != WPAS_MODE_IBSS)
 210                 return 0;
 211
 212         if (!disallowed_bssid(wpa_s, wpa_s->bssid) &&
 213             !disallowed_ssid(wpa_s, c->ssid, c->ssid_len))
 214                 return 0;
 215
 216         wpa_printf(MSG_DEBUG, "Disconnect and try to find another network "
 217                    "because current AP was marked disallowed");
 218
 219 #ifdef CONFIG_SME
 220         wpa_s->sme.prev_bssid_set = 0;
 221 #endif /* CONFIG_SME */
 222         wpa_s->reassociate = 1;
 223         wpa_s->own_disconnect_req = 1;
 224         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 225         wpa_supplicant_req_scan(wpa_s, 0, 0);
 226
 227         return 0;
 228 }
 229
 230
 231 #ifndef CONFIG_NO_CONFIG_BLOBS
 232 static int wpas_ctrl_set_blob(struct wpa_supplicant *wpa_s, char *pos)
 233 {
 234         char *name = pos;
 235         struct wpa_config_blob *blob;
 236         size_t len;
 237
 238         pos = os_strchr(pos, ' ');
 239         if (pos == NULL)
 240                 return -1;
 241         *pos++ = '\0';
 242         len = os_strlen(pos);
 243         if (len & 1)
 244                 return -1;
 245
 246         wpa_printf(MSG_DEBUG, "CTRL: Set blob '%s'", name);
 247         blob = os_zalloc(sizeof(*blob));
 248         if (blob == NULL)
 249                 return -1;
 250         blob->name = os_strdup(name);
 251         blob->data = os_malloc(len / 2);
 252         if (blob->name == NULL || blob->data == NULL) {
 253                 wpa_config_free_blob(blob);
 254                 return -1;
 255         }
 256
 257         if (hexstr2bin(pos, blob->data, len / 2) < 0) {
 258                 wpa_printf(MSG_DEBUG, "CTRL: Invalid blob hex data");
 259                 wpa_config_free_blob(blob);
 260                 return -1;
 261         }
 262         blob->len = len / 2;
 263
 264         wpa_config_set_blob(wpa_s->conf, blob);
 265
 266         return 0;
 267 }
 268 #endif /* CONFIG_NO_CONFIG_BLOBS */
 269
 270
 271 static int wpas_ctrl_pno(struct wpa_supplicant *wpa_s, char *cmd)
 272 {
 273         char *params;
 274         char *pos;
 275         int *freqs = NULL;
 276         int ret;
 277
 278         if (atoi(cmd)) {
 279                 params = os_strchr(cmd, ' ');
 280                 os_free(wpa_s->manual_sched_scan_freqs);
 281                 if (params) {
 282                         params++;
 283                         pos = os_strstr(params, "freq=");
 284                         if (pos)
 285                                 freqs = freq_range_to_channel_list(wpa_s,
 286                                                                    pos + 5);
 287                 }
 288                 wpa_s->manual_sched_scan_freqs = freqs;
 289                 ret = wpas_start_pno(wpa_s);
 290         } else {
 291                 ret = wpas_stop_pno(wpa_s);
 292         }
 293         return ret;
 294 }
 295
 296
 297 static int wpas_ctrl_set_band(struct wpa_supplicant *wpa_s, char *band)
 298 {
 299         union wpa_event_data event;
 300
 301         if (os_strcmp(band, "AUTO") == 0)
 302                 wpa_s->setband = WPA_SETBAND_AUTO;
 303         else if (os_strcmp(band, "5G") == 0)
 304                 wpa_s->setband = WPA_SETBAND_5G;
 305         else if (os_strcmp(band, "2G") == 0)
 306                 wpa_s->setband = WPA_SETBAND_2G;
 307         else
 308                 return -1;
 309
 310         if (wpa_drv_setband(wpa_s, wpa_s->setband) == 0) {
 311                 os_memset(&event, 0, sizeof(event));
 312                 event.channel_list_changed.initiator = REGDOM_SET_BY_USER;
 313                 event.channel_list_changed.type = REGDOM_TYPE_UNKNOWN;
 314                 wpa_supplicant_event(wpa_s, EVENT_CHANNEL_LIST_CHANGED, &event);
 315         }
 316
 317         return 0;
 318 }
 319
 320
 321 static int wpas_ctrl_iface_set_lci(struct wpa_supplicant *wpa_s,
 322                                    const char *cmd)
 323 {
 324         struct wpabuf *lci;
 325
 326         if (*cmd == '\0' || os_strcmp(cmd, "\"\"") == 0) {
 327                 wpabuf_free(wpa_s->lci);
 328                 wpa_s->lci = NULL;
 329                 return 0;
 330         }
 331
 332         lci = wpabuf_parse_bin(cmd);
 333         if (!lci)
 334                 return -1;
 335
 336         if (os_get_reltime(&wpa_s->lci_time)) {
 337                 wpabuf_free(lci);
 338                 return -1;
 339         }
 340
 341         wpabuf_free(wpa_s->lci);
 342         wpa_s->lci = lci;
 343
 344         return 0;
 345 }
 346
 347
 348 static int
 349 wpas_ctrl_set_relative_rssi(struct wpa_supplicant *wpa_s, const char *cmd)
 350 {
 351         int relative_rssi;
 352
 353         if (os_strcmp(cmd, "disable") == 0) {
 354                 wpa_s->srp.relative_rssi_set = 0;
 355                 return 0;
 356         }
 357
 358         relative_rssi = atoi(cmd);
 359         if (relative_rssi < 0 || relative_rssi > 100)
 360                 return -1;
 361         wpa_s->srp.relative_rssi = relative_rssi;
 362         wpa_s->srp.relative_rssi_set = 1;
 363         return 0;
 364 }
 365
 366
 367 static int wpas_ctrl_set_relative_band_adjust(struct wpa_supplicant *wpa_s,
 368                                               const char *cmd)
 369 {
 370         char *pos;
 371         int adjust_rssi;
 372
 373         /* <band>:adjust_value */
 374         pos = os_strchr(cmd, ':');
 375         if (!pos)
 376                 return -1;
 377         pos++;
 378         adjust_rssi = atoi(pos);
 379         if (adjust_rssi < -100 || adjust_rssi > 100)
 380                 return -1;
 381
 382         if (os_strncmp(cmd, "2G", 2) == 0)
 383                 wpa_s->srp.relative_adjust_band = WPA_SETBAND_2G;
 384         else if (os_strncmp(cmd, "5G", 2) == 0)
 385                 wpa_s->srp.relative_adjust_band = WPA_SETBAND_5G;
 386         else
 387                 return -1;
 388
 389         wpa_s->srp.relative_adjust_rssi = adjust_rssi;
 390
 391         return 0;
 392 }
 393
 394
 395 static int wpas_ctrl_iface_set_ric_ies(struct wpa_supplicant *wpa_s,
 396                                    const char *cmd)
 397 {
 398         struct wpabuf *ric_ies;
 399
 400         if (*cmd == '\0' || os_strcmp(cmd, "\"\"") == 0) {
 401                 wpabuf_free(wpa_s->ric_ies);
 402                 wpa_s->ric_ies = NULL;
 403                 return 0;
 404         }
 405
 406         ric_ies = wpabuf_parse_bin(cmd);
 407         if (!ric_ies)
 408                 return -1;
 409
 410         wpabuf_free(wpa_s->ric_ies);
 411         wpa_s->ric_ies = ric_ies;
 412
 413         return 0;
 414 }
 415
 416
 417 static int wpa_supplicant_ctrl_iface_set(struct wpa_supplicant *wpa_s,
 418                                          char *cmd)
 419 {
 420         char *value;
 421         int ret = 0;
 422
 423         value = os_strchr(cmd, ' ');
 424         if (value == NULL)
 425                 return -1;
 426         *value++ = '\0';
 427
 428         wpa_printf(MSG_DEBUG, "CTRL_IFACE SET '%s'='%s'", cmd, value);
 429         if (os_strcasecmp(cmd, "EAPOL::heldPeriod") == 0) {
 430                 eapol_sm_configure(wpa_s->eapol,
 431                                    atoi(value), -1, -1, -1);
 432         } else if (os_strcasecmp(cmd, "EAPOL::authPeriod") == 0) {
 433                 eapol_sm_configure(wpa_s->eapol,
 434                                    -1, atoi(value), -1, -1);
 435         } else if (os_strcasecmp(cmd, "EAPOL::startPeriod") == 0) {
 436                 eapol_sm_configure(wpa_s->eapol,
 437                                    -1, -1, atoi(value), -1);
 438         } else if (os_strcasecmp(cmd, "EAPOL::maxStart") == 0) {
 439                 eapol_sm_configure(wpa_s->eapol,
 440                                    -1, -1, -1, atoi(value));
 441         } else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKLifetime") == 0) {
 442                 if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
 443                                      atoi(value))) {
 444                         ret = -1;
 445                 } else {
 446                         value[-1] = '=';
 447                         wpa_config_process_global(wpa_s->conf, cmd, -1);
 448                 }
 449         } else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKReauthThreshold") ==
 450                    0) {
 451                 if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
 452                                      atoi(value))) {
 453                         ret = -1;
 454                 } else {
 455                         value[-1] = '=';
 456                         wpa_config_process_global(wpa_s->conf, cmd, -1);
 457                 }
 458         } else if (os_strcasecmp(cmd, "dot11RSNAConfigSATimeout") == 0) {
 459                 if (wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
 460                                      atoi(value))) {
 461                         ret = -1;
 462                 } else {
 463                         value[-1] = '=';
 464                         wpa_config_process_global(wpa_s->conf, cmd, -1);
 465                 }
 466         } else if (os_strcasecmp(cmd, "wps_fragment_size") == 0) {
 467                 wpa_s->wps_fragment_size = atoi(value);
 468 #ifdef CONFIG_WPS_TESTING
 469         } else if (os_strcasecmp(cmd, "wps_version_number") == 0) {
 470                 long int val;
 471                 val = strtol(value, NULL, 0);
 472                 if (val < 0 || val > 0xff) {
 473                         ret = -1;
 474                         wpa_printf(MSG_DEBUG, "WPS: Invalid "
 475                                    "wps_version_number %ld", val);
 476                 } else {
 477                         wps_version_number = val;
 478                         wpa_printf(MSG_DEBUG, "WPS: Testing - force WPS "
 479                                    "version %u.%u",
 480                                    (wps_version_number & 0xf0) >> 4,
 481                                    wps_version_number & 0x0f);
 482                 }
 483         } else if (os_strcasecmp(cmd, "wps_testing_dummy_cred") == 0) {
 484                 wps_testing_dummy_cred = atoi(value);
 485                 wpa_printf(MSG_DEBUG, "WPS: Testing - dummy_cred=%d",
 486                            wps_testing_dummy_cred);
 487         } else if (os_strcasecmp(cmd, "wps_corrupt_pkhash") == 0) {
 488                 wps_corrupt_pkhash = atoi(value);
 489                 wpa_printf(MSG_DEBUG, "WPS: Testing - wps_corrupt_pkhash=%d",
 490                            wps_corrupt_pkhash);
 491         } else if (os_strcasecmp(cmd, "wps_force_auth_types") == 0) {
 492                 if (value[0] == '\0') {
 493                         wps_force_auth_types_in_use = 0;
 494                 } else {
 495                         wps_force_auth_types = strtol(value, NULL, 0);
 496                         wps_force_auth_types_in_use = 1;
 497                 }
 498         } else if (os_strcasecmp(cmd, "wps_force_encr_types") == 0) {
 499                 if (value[0] == '\0') {
 500                         wps_force_encr_types_in_use = 0;
 501                 } else {
 502                         wps_force_encr_types = strtol(value, NULL, 0);
 503                         wps_force_encr_types_in_use = 1;
 504                 }
 505 #endif /* CONFIG_WPS_TESTING */
 506         } else if (os_strcasecmp(cmd, "ampdu") == 0) {
 507                 if (wpa_drv_ampdu(wpa_s, atoi(value)) < 0)
 508                         ret = -1;
 509 #ifdef CONFIG_TDLS
 510 #ifdef CONFIG_TDLS_TESTING
 511         } else if (os_strcasecmp(cmd, "tdls_testing") == 0) {
 512                 tdls_testing = strtol(value, NULL, 0);
 513                 wpa_printf(MSG_DEBUG, "TDLS: tdls_testing=0x%x", tdls_testing);
 514 #endif /* CONFIG_TDLS_TESTING */
 515         } else if (os_strcasecmp(cmd, "tdls_disabled") == 0) {
 516                 int disabled = atoi(value);
 517                 wpa_printf(MSG_DEBUG, "TDLS: tdls_disabled=%d", disabled);
 518                 if (disabled) {
 519                         if (wpa_drv_tdls_oper(wpa_s, TDLS_DISABLE, NULL) < 0)
 520                                 ret = -1;
 521                 } else if (wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL) < 0)
 522                         ret = -1;
 523                 wpa_tdls_enable(wpa_s->wpa, !disabled);
 524 #endif /* CONFIG_TDLS */
 525         } else if (os_strcasecmp(cmd, "pno") == 0) {
 526                 ret = wpas_ctrl_pno(wpa_s, value);
 527         } else if (os_strcasecmp(cmd, "radio_disabled") == 0) {
 528                 int disabled = atoi(value);
 529                 if (wpa_drv_radio_disable(wpa_s, disabled) < 0)
 530                         ret = -1;
 531                 else if (disabled)
 532                         wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
 533         } else if (os_strcasecmp(cmd, "uapsd") == 0) {
 534                 if (os_strcmp(value, "disable") == 0)
 535                         wpa_s->set_sta_uapsd = 0;
 536                 else {
 537                         int be, bk, vi, vo;
 538                         char *pos;
 539                         /* format: BE,BK,VI,VO;max SP Length */
 540                         be = atoi(value);
 541                         pos = os_strchr(value, ',');
 542                         if (pos == NULL)
 543                                 return -1;
 544                         pos++;
 545                         bk = atoi(pos);
 546                         pos = os_strchr(pos, ',');
 547                         if (pos == NULL)
 548                                 return -1;
 549                         pos++;
 550                         vi = atoi(pos);
 551                         pos = os_strchr(pos, ',');
 552                         if (pos == NULL)
 553                                 return -1;
 554                         pos++;
 555                         vo = atoi(pos);
 556                         /* ignore max SP Length for now */
 557
 558                         wpa_s->set_sta_uapsd = 1;
 559                         wpa_s->sta_uapsd = 0;
 560                         if (be)
 561                                 wpa_s->sta_uapsd |= BIT(0);
 562                         if (bk)
 563                                 wpa_s->sta_uapsd |= BIT(1);
 564                         if (vi)
 565                                 wpa_s->sta_uapsd |= BIT(2);
 566                         if (vo)
 567                                 wpa_s->sta_uapsd |= BIT(3);
 568                 }
 569         } else if (os_strcasecmp(cmd, "ps") == 0) {
 570                 ret = wpa_drv_set_p2p_powersave(wpa_s, atoi(value), -1, -1);
 571 #ifdef CONFIG_WIFI_DISPLAY
 572         } else if (os_strcasecmp(cmd, "wifi_display") == 0) {
 573                 int enabled = !!atoi(value);
 574                 if (enabled && !wpa_s->global->p2p)
 575                         ret = -1;
 576                 else
 577                         wifi_display_enable(wpa_s->global, enabled);
 578 #endif /* CONFIG_WIFI_DISPLAY */
 579         } else if (os_strcasecmp(cmd, "bssid_filter") == 0) {
 580                 ret = set_bssid_filter(wpa_s, value);
 581         } else if (os_strcasecmp(cmd, "disallow_aps") == 0) {
 582                 ret = set_disallow_aps(wpa_s, value);
 583         } else if (os_strcasecmp(cmd, "no_keep_alive") == 0) {
 584                 wpa_s->no_keep_alive = !!atoi(value);
 585 #ifdef CONFIG_DPP
 586         } else if (os_strcasecmp(cmd, "dpp_configurator_params") == 0) {
 587                 os_free(wpa_s->dpp_configurator_params);
 588                 wpa_s->dpp_configurator_params = os_strdup(value);
 589         } else if (os_strcasecmp(cmd, "dpp_init_max_tries") == 0) {
 590                 wpa_s->dpp_init_max_tries = atoi(value);
 591         } else if (os_strcasecmp(cmd, "dpp_init_retry_time") == 0) {
 592                 wpa_s->dpp_init_retry_time = atoi(value);
 593         } else if (os_strcasecmp(cmd, "dpp_resp_wait_time") == 0) {
 594                 wpa_s->dpp_resp_wait_time = atoi(value);
 595         } else if (os_strcasecmp(cmd, "dpp_resp_max_tries") == 0) {
 596                 wpa_s->dpp_resp_max_tries = atoi(value);
 597         } else if (os_strcasecmp(cmd, "dpp_resp_retry_time") == 0) {
 598                 wpa_s->dpp_resp_retry_time = atoi(value);
 599 #ifdef CONFIG_TESTING_OPTIONS
 600         } else if (os_strcasecmp(cmd, "dpp_pkex_own_mac_override") == 0) {
 601                 if (hwaddr_aton(value, dpp_pkex_own_mac_override))
 602                         ret = -1;
 603         } else if (os_strcasecmp(cmd, "dpp_pkex_peer_mac_override") == 0) {
 604                 if (hwaddr_aton(value, dpp_pkex_peer_mac_override))
 605                         ret = -1;
 606         } else if (os_strcasecmp(cmd, "dpp_pkex_ephemeral_key_override") == 0) {
 607                 size_t hex_len = os_strlen(value);
 608
 609                 if (hex_len >
 610                     2 * sizeof(dpp_pkex_ephemeral_key_override))
 611                         ret = -1;
 612                 else if (hexstr2bin(value, dpp_pkex_ephemeral_key_override,
 613                                     hex_len / 2))
 614                         ret = -1;
 615                 else
 616                         dpp_pkex_ephemeral_key_override_len = hex_len / 2;
 617         } else if (os_strcasecmp(cmd, "dpp_protocol_key_override") == 0) {
 618                 size_t hex_len = os_strlen(value);
 619
 620                 if (hex_len > 2 * sizeof(dpp_protocol_key_override))
 621                         ret = -1;
 622                 else if (hexstr2bin(value, dpp_protocol_key_override,
 623                                     hex_len / 2))
 624                         ret = -1;
 625                 else
 626                         dpp_protocol_key_override_len = hex_len / 2;
 627         } else if (os_strcasecmp(cmd, "dpp_nonce_override") == 0) {
 628                 size_t hex_len = os_strlen(value);
 629
 630                 if (hex_len > 2 * sizeof(dpp_nonce_override))
 631                         ret = -1;
 632                 else if (hexstr2bin(value, dpp_nonce_override, hex_len / 2))
 633                         ret = -1;
 634                 else
 635                         dpp_nonce_override_len = hex_len / 2;
 636 #endif /* CONFIG_TESTING_OPTIONS */
 637 #endif /* CONFIG_DPP */
 638 #ifdef CONFIG_TESTING_OPTIONS
 639         } else if (os_strcasecmp(cmd, "ext_mgmt_frame_handling") == 0) {
 640                 wpa_s->ext_mgmt_frame_handling = !!atoi(value);
 641         } else if (os_strcasecmp(cmd, "ext_eapol_frame_io") == 0) {
 642                 wpa_s->ext_eapol_frame_io = !!atoi(value);
 643 #ifdef CONFIG_AP
 644                 if (wpa_s->ap_iface) {
 645                         wpa_s->ap_iface->bss[0]->ext_eapol_frame_io =
 646                                 wpa_s->ext_eapol_frame_io;
 647                 }
 648 #endif /* CONFIG_AP */
 649         } else if (os_strcasecmp(cmd, "extra_roc_dur") == 0) {
 650                 wpa_s->extra_roc_dur = atoi(value);
 651         } else if (os_strcasecmp(cmd, "test_failure") == 0) {
 652                 wpa_s->test_failure = atoi(value);
 653         } else if (os_strcasecmp(cmd, "p2p_go_csa_on_inv") == 0) {
 654                 wpa_s->p2p_go_csa_on_inv = !!atoi(value);
 655         } else if (os_strcasecmp(cmd, "ignore_auth_resp") == 0) {
 656                 wpa_s->ignore_auth_resp = !!atoi(value);
 657         } else if (os_strcasecmp(cmd, "ignore_assoc_disallow") == 0) {
 658                 wpa_s->ignore_assoc_disallow = !!atoi(value);
 659                 wpa_drv_ignore_assoc_disallow(wpa_s,
 660                                               wpa_s->ignore_assoc_disallow);
 661         } else if (os_strcasecmp(cmd, "reject_btm_req_reason") == 0) {
 662                 wpa_s->reject_btm_req_reason = atoi(value);
 663         } else if (os_strcasecmp(cmd, "get_pref_freq_list_override") == 0) {
 664                 os_free(wpa_s->get_pref_freq_list_override);
 665                 if (!value[0])
 666                         wpa_s->get_pref_freq_list_override = NULL;
 667                 else
 668                         wpa_s->get_pref_freq_list_override = os_strdup(value);
 669         } else if (os_strcasecmp(cmd, "sae_commit_override") == 0) {
 670                 wpabuf_free(wpa_s->sae_commit_override);
 671                 if (value[0] == '\0')
 672                         wpa_s->sae_commit_override = NULL;
 673                 else
 674                         wpa_s->sae_commit_override = wpabuf_parse_bin(value);
 675 #ifdef CONFIG_DPP
 676         } else if (os_strcasecmp(cmd, "dpp_config_obj_override") == 0) {
 677                 os_free(wpa_s->dpp_config_obj_override);
 678                 if (value[0] == '\0')
 679                         wpa_s->dpp_config_obj_override = NULL;
 680                 else
 681                         wpa_s->dpp_config_obj_override = os_strdup(value);
 682         } else if (os_strcasecmp(cmd, "dpp_discovery_override") == 0) {
 683                 os_free(wpa_s->dpp_discovery_override);
 684                 if (value[0] == '\0')
 685                         wpa_s->dpp_discovery_override = NULL;
 686                 else
 687                         wpa_s->dpp_discovery_override = os_strdup(value);
 688         } else if (os_strcasecmp(cmd, "dpp_groups_override") == 0) {
 689                 os_free(wpa_s->dpp_groups_override);
 690                 if (value[0] == '\0')
 691                         wpa_s->dpp_groups_override = NULL;
 692                 else
 693                         wpa_s->dpp_groups_override = os_strdup(value);
 694         } else if (os_strcasecmp(cmd,
 695                                  "dpp_ignore_netaccesskey_mismatch") == 0) {
 696                 wpa_s->dpp_ignore_netaccesskey_mismatch = atoi(value);
 697         } else if (os_strcasecmp(cmd, "dpp_test") == 0) {
 698                 dpp_test = atoi(value);
 699 #endif /* CONFIG_DPP */
 700 #endif /* CONFIG_TESTING_OPTIONS */
 701 #ifdef CONFIG_FILS
 702         } else if (os_strcasecmp(cmd, "disable_fils") == 0) {
 703                 wpa_s->disable_fils = !!atoi(value);
 704                 wpa_drv_disable_fils(wpa_s, wpa_s->disable_fils);
 705                 wpa_supplicant_set_default_scan_ies(wpa_s);
 706 #endif /* CONFIG_FILS */
 707 #ifndef CONFIG_NO_CONFIG_BLOBS
 708         } else if (os_strcmp(cmd, "blob") == 0) {
 709                 ret = wpas_ctrl_set_blob(wpa_s, value);
 710 #endif /* CONFIG_NO_CONFIG_BLOBS */
 711         } else if (os_strcasecmp(cmd, "setband") == 0) {
 712                 ret = wpas_ctrl_set_band(wpa_s, value);
 713 #ifdef CONFIG_MBO
 714         } else if (os_strcasecmp(cmd, "non_pref_chan") == 0) {
 715                 ret = wpas_mbo_update_non_pref_chan(wpa_s, value);
 716                 if (ret == 0) {
 717                         value[-1] = '=';
 718                         wpa_config_process_global(wpa_s->conf, cmd, -1);
 719                 }
 720         } else if (os_strcasecmp(cmd, "mbo_cell_capa") == 0) {
 721                 wpas_mbo_update_cell_capa(wpa_s, atoi(value));
 722         } else if (os_strcasecmp(cmd, "oce") == 0) {
 723                 wpa_s->conf->oce = atoi(value);
 724                 if (wpa_s->conf->oce) {
 725                         if ((wpa_s->conf->oce & OCE_STA) &&
 726                             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OCE_STA))
 727                                 wpa_s->enable_oce = OCE_STA;
 728
 729                         if ((wpa_s->conf->oce & OCE_STA_CFON) &&
 730                             (wpa_s->drv_flags &
 731                              WPA_DRIVER_FLAGS_OCE_STA_CFON)) {
 732                                 /* TODO: Need to add STA-CFON support */
 733                                 wpa_printf(MSG_ERROR,
 734                                            "OCE STA-CFON feature is not yet supported");
 735                                 return -1;
 736                         }
 737                 } else {
 738                         wpa_s->enable_oce = 0;
 739                 }
 740                 wpa_supplicant_set_default_scan_ies(wpa_s);
 741 #endif /* CONFIG_MBO */
 742         } else if (os_strcasecmp(cmd, "lci") == 0) {
 743                 ret = wpas_ctrl_iface_set_lci(wpa_s, value);
 744         } else if (os_strcasecmp(cmd, "tdls_trigger_control") == 0) {
 745                 ret = wpa_drv_set_tdls_mode(wpa_s, atoi(value));
 746         } else if (os_strcasecmp(cmd, "relative_rssi") == 0) {
 747                 ret = wpas_ctrl_set_relative_rssi(wpa_s, value);
 748         } else if (os_strcasecmp(cmd, "relative_band_adjust") == 0) {
 749                 ret = wpas_ctrl_set_relative_band_adjust(wpa_s, value);
 750         } else if (os_strcasecmp(cmd, "ric_ies") == 0) {
 751                 ret = wpas_ctrl_iface_set_ric_ies(wpa_s, value);
 752         } else if (os_strcasecmp(cmd, "roaming") == 0) {
 753                 ret = wpa_drv_roaming(wpa_s, atoi(value), NULL);
 754 #ifdef CONFIG_WNM
 755         } else if (os_strcasecmp(cmd, "coloc_intf_elems") == 0) {
 756                 struct wpabuf *elems;
 757
 758                 elems = wpabuf_parse_bin(value);
 759                 if (!elems)
 760                         return -1;
 761                 wnm_set_coloc_intf_elems(wpa_s, elems);
 762 #endif /* CONFIG_WNM */
 763         } else {
 764                 value[-1] = '=';
 765                 ret = wpa_config_process_global(wpa_s->conf, cmd, -1);
 766                 if (ret == 0)
 767                         wpa_supplicant_update_config(wpa_s);
 768         }
 769
 770         return ret;
 771 }
 772
 773
 774 static int wpa_supplicant_ctrl_iface_get(struct wpa_supplicant *wpa_s,
 775                                          char *cmd, char *buf, size_t buflen)
 776 {
 777         int res = -1;
 778
 779         wpa_printf(MSG_DEBUG, "CTRL_IFACE GET '%s'", cmd);
 780
 781         if (os_strcmp(cmd, "version") == 0) {
 782                 res = os_snprintf(buf, buflen, "%s", VERSION_STR);
 783         } else if (os_strcasecmp(cmd, "country") == 0) {
 784                 if (wpa_s->conf->country[0] && wpa_s->conf->country[1])
 785                         res = os_snprintf(buf, buflen, "%c%c",
 786                                           wpa_s->conf->country[0],
 787                                           wpa_s->conf->country[1]);
 788 #ifdef CONFIG_WIFI_DISPLAY
 789         } else if (os_strcasecmp(cmd, "wifi_display") == 0) {
 790                 int enabled;
 791                 if (wpa_s->global->p2p == NULL ||
 792                     wpa_s->global->p2p_disabled)
 793                         enabled = 0;
 794                 else
 795                         enabled = wpa_s->global->wifi_display;
 796                 res = os_snprintf(buf, buflen, "%d", enabled);
 797 #endif /* CONFIG_WIFI_DISPLAY */
 798 #ifdef CONFIG_TESTING_GET_GTK
 799         } else if (os_strcmp(cmd, "gtk") == 0) {
 800                 if (wpa_s->last_gtk_len == 0)
 801                         return -1;
 802                 res = wpa_snprintf_hex(buf, buflen, wpa_s->last_gtk,
 803                                        wpa_s->last_gtk_len);
 804                 return res;
 805 #endif /* CONFIG_TESTING_GET_GTK */
 806         } else if (os_strcmp(cmd, "tls_library") == 0) {
 807                 res = tls_get_library_version(buf, buflen);
 808 #ifdef CONFIG_TESTING_OPTIONS
 809         } else if (os_strcmp(cmd, "anonce") == 0) {
 810                 return wpa_snprintf_hex(buf, buflen,
 811                                         wpa_sm_get_anonce(wpa_s->wpa),
 812                                         WPA_NONCE_LEN);
 813 #endif /* CONFIG_TESTING_OPTIONS */
 814         } else {
 815                 res = wpa_config_get_value(cmd, wpa_s->conf, buf, buflen);
 816         }
 817
 818         if (os_snprintf_error(buflen, res))
 819                 return -1;
 820         return res;
 821 }
 822
 823
 824 #ifdef IEEE8021X_EAPOL
 825 static int wpa_supplicant_ctrl_iface_preauth(struct wpa_supplicant *wpa_s,
 826                                              char *addr)
 827 {
 828         u8 bssid[ETH_ALEN];
 829         struct wpa_ssid *ssid = wpa_s->current_ssid;
 830
 831         if (hwaddr_aton(addr, bssid)) {
 832                 wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH: invalid address "
 833                            "'%s'", addr);
 834                 return -1;
 835         }
 836
 837         wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH " MACSTR, MAC2STR(bssid));
 838         rsn_preauth_deinit(wpa_s->wpa);
 839         if (rsn_preauth_init(wpa_s->wpa, bssid, ssid ? &ssid->eap : NULL))
 840                 return -1;
 841
 842         return 0;
 843 }
 844 #endif /* IEEE8021X_EAPOL */
 845
 846
 847 #ifdef CONFIG_TDLS
 848
 849 static int wpa_supplicant_ctrl_iface_tdls_discover(
 850         struct wpa_supplicant *wpa_s, char *addr)
 851 {
 852         u8 peer[ETH_ALEN];
 853         int ret;
 854
 855         if (hwaddr_aton(addr, peer)) {
 856                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER: invalid "
 857                            "address '%s'", addr);
 858                 return -1;
 859         }
 860
 861         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER " MACSTR,
 862                    MAC2STR(peer));
 863
 864         if (wpa_tdls_is_external_setup(wpa_s->wpa))
 865                 ret = wpa_tdls_send_discovery_request(wpa_s->wpa, peer);
 866         else
 867                 ret = wpa_drv_tdls_oper(wpa_s, TDLS_DISCOVERY_REQ, peer);
 868
 869         return ret;
 870 }
 871
 872
 873 static int wpa_supplicant_ctrl_iface_tdls_setup(
 874         struct wpa_supplicant *wpa_s, char *addr)
 875 {
 876         u8 peer[ETH_ALEN];
 877         int ret;
 878
 879         if (hwaddr_aton(addr, peer)) {
 880                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP: invalid "
 881                            "address '%s'", addr);
 882                 return -1;
 883         }
 884
 885         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP " MACSTR,
 886                    MAC2STR(peer));
 887
 888         if ((wpa_s->conf->tdls_external_control) &&
 889             wpa_tdls_is_external_setup(wpa_s->wpa))
 890                 return wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
 891
 892         wpa_tdls_remove(wpa_s->wpa, peer);
 893
 894         if (wpa_tdls_is_external_setup(wpa_s->wpa))
 895                 ret = wpa_tdls_start(wpa_s->wpa, peer);
 896         else
 897                 ret = wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
 898
 899         return ret;
 900 }
 901
 902
 903 static int wpa_supplicant_ctrl_iface_tdls_teardown(
 904         struct wpa_supplicant *wpa_s, char *addr)
 905 {
 906         u8 peer[ETH_ALEN];
 907         int ret;
 908
 909         if (os_strcmp(addr, "*") == 0) {
 910                 /* remove everyone */
 911                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN *");
 912                 wpa_tdls_teardown_peers(wpa_s->wpa);
 913                 return 0;
 914         }
 915
 916         if (hwaddr_aton(addr, peer)) {
 917                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN: invalid "
 918                            "address '%s'", addr);
 919                 return -1;
 920         }
 921
 922         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN " MACSTR,
 923                    MAC2STR(peer));
 924
 925         if ((wpa_s->conf->tdls_external_control) &&
 926             wpa_tdls_is_external_setup(wpa_s->wpa))
 927                 return wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
 928
 929         if (wpa_tdls_is_external_setup(wpa_s->wpa))
 930                 ret = wpa_tdls_teardown_link(
 931                         wpa_s->wpa, peer,
 932                         WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
 933         else
 934                 ret = wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
 935
 936         return ret;
 937 }
 938
 939
 940 static int ctrl_iface_get_capability_tdls(
 941         struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
 942 {
 943         int ret;
 944
 945         ret = os_snprintf(buf, buflen, "%s\n",
 946                           wpa_s->drv_flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT ?
 947                           (wpa_s->drv_flags &
 948                            WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP ?
 949                            "EXTERNAL" : "INTERNAL") : "UNSUPPORTED");
 950         if (os_snprintf_error(buflen, ret))
 951                 return -1;
 952         return ret;
 953 }
 954
 955
 956 static int wpa_supplicant_ctrl_iface_tdls_chan_switch(
 957         struct wpa_supplicant *wpa_s, char *cmd)
 958 {
 959         u8 peer[ETH_ALEN];
 960         struct hostapd_freq_params freq_params;
 961         u8 oper_class;
 962         char *pos, *end;
 963
 964         if (!wpa_tdls_is_external_setup(wpa_s->wpa)) {
 965                 wpa_printf(MSG_INFO,
 966                            "tdls_chanswitch: Only supported with external setup");
 967                 return -1;
 968         }
 969
 970         os_memset(&freq_params, 0, sizeof(freq_params));
 971
 972         pos = os_strchr(cmd, ' ');
 973         if (pos == NULL)
 974                 return -1;
 975         *pos++ = '\0';
 976
 977         oper_class = strtol(pos, &end, 10);
 978         if (pos == end) {
 979                 wpa_printf(MSG_INFO,
 980                            "tdls_chanswitch: Invalid op class provided");
 981                 return -1;
 982         }
 983
 984         pos = end;
 985         freq_params.freq = atoi(pos);
 986         if (freq_params.freq == 0) {
 987                 wpa_printf(MSG_INFO, "tdls_chanswitch: Invalid freq provided");
 988                 return -1;
 989         }
 990
 991 #define SET_FREQ_SETTING(str) \
 992         do { \
 993                 const char *pos2 = os_strstr(pos, " " #str "="); \
 994                 if (pos2) { \
 995                         pos2 += sizeof(" " #str "=") - 1; \
 996                         freq_params.str = atoi(pos2); \
 997                 } \
 998         } while (0)
 999
1000         SET_FREQ_SETTING(center_freq1);
1001         SET_FREQ_SETTING(center_freq2);
1002         SET_FREQ_SETTING(bandwidth);
1003         SET_FREQ_SETTING(sec_channel_offset);
1004 #undef SET_FREQ_SETTING
1005
1006         freq_params.ht_enabled = !!os_strstr(pos, " ht");
1007         freq_params.vht_enabled = !!os_strstr(pos, " vht");
1008
1009         if (hwaddr_aton(cmd, peer)) {
1010                 wpa_printf(MSG_DEBUG,
1011                            "CTRL_IFACE TDLS_CHAN_SWITCH: Invalid address '%s'",
1012                            cmd);
1013                 return -1;
1014         }
1015
1016         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_CHAN_SWITCH " MACSTR
1017                    " OP CLASS %d FREQ %d CENTER1 %d CENTER2 %d BW %d SEC_OFFSET %d%s%s",
1018                    MAC2STR(peer), oper_class, freq_params.freq,
1019                    freq_params.center_freq1, freq_params.center_freq2,
1020                    freq_params.bandwidth, freq_params.sec_channel_offset,
1021                    freq_params.ht_enabled ? " HT" : "",
1022                    freq_params.vht_enabled ? " VHT" : "");
1023
1024         return wpa_tdls_enable_chan_switch(wpa_s->wpa, peer, oper_class,
1025                                            &freq_params);
1026 }
1027
1028
1029 static int wpa_supplicant_ctrl_iface_tdls_cancel_chan_switch(
1030         struct wpa_supplicant *wpa_s, char *cmd)
1031 {
1032         u8 peer[ETH_ALEN];
1033
1034         if (!wpa_tdls_is_external_setup(wpa_s->wpa)) {
1035                 wpa_printf(MSG_INFO,
1036                            "tdls_chanswitch: Only supported with external setup");
1037                 return -1;
1038         }
1039
1040         if (hwaddr_aton(cmd, peer)) {
1041                 wpa_printf(MSG_DEBUG,
1042                            "CTRL_IFACE TDLS_CANCEL_CHAN_SWITCH: Invalid address '%s'",
1043                            cmd);
1044                 return -1;
1045         }
1046
1047         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_CANCEL_CHAN_SWITCH " MACSTR,
1048                    MAC2STR(peer));
1049
1050         return wpa_tdls_disable_chan_switch(wpa_s->wpa, peer);
1051 }
1052
1053
1054 static int wpa_supplicant_ctrl_iface_tdls_link_status(
1055         struct wpa_supplicant *wpa_s, const char *addr,
1056         char *buf, size_t buflen)
1057 {
1058         u8 peer[ETH_ALEN];
1059         const char *tdls_status;
1060         int ret;
1061
1062         if (hwaddr_aton(addr, peer)) {
1063                 wpa_printf(MSG_DEBUG,
1064                            "CTRL_IFACE TDLS_LINK_STATUS: Invalid address '%s'",
1065                            addr);
1066                 return -1;
1067         }
1068         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_LINK_STATUS " MACSTR,
1069                    MAC2STR(peer));
1070
1071         tdls_status = wpa_tdls_get_link_status(wpa_s->wpa, peer);
1072         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_LINK_STATUS: %s", tdls_status);
1073         ret = os_snprintf(buf, buflen, "TDLS link status: %s\n", tdls_status);
1074         if (os_snprintf_error(buflen, ret))
1075                 return -1;
1076
1077         return ret;
1078 }
1079
1080 #endif /* CONFIG_TDLS */
1081
1082
1083 static int wmm_ac_ctrl_addts(struct wpa_supplicant *wpa_s, char *cmd)
1084 {
1085         char *token, *context = NULL;
1086         struct wmm_ac_ts_setup_params params = {
1087                 .tsid = 0xff,
1088                 .direction = 0xff,
1089         };
1090
1091         while ((token = str_token(cmd, " ", &context))) {
1092                 if (sscanf(token, "tsid=%i", &params.tsid) == 1 ||
1093                     sscanf(token, "up=%i", &params.user_priority) == 1 ||
1094                     sscanf(token, "nominal_msdu_size=%i",
1095                            &params.nominal_msdu_size) == 1 ||
1096                     sscanf(token, "mean_data_rate=%i",
1097                            &params.mean_data_rate) == 1 ||
1098                     sscanf(token, "min_phy_rate=%i",
1099                            &params.minimum_phy_rate) == 1 ||
1100                     sscanf(token, "sba=%i",
1101                            &params.surplus_bandwidth_allowance) == 1)
1102                         continue;
1103
1104                 if (os_strcasecmp(token, "downlink") == 0) {
1105                         params.direction = WMM_TSPEC_DIRECTION_DOWNLINK;
1106                 } else if (os_strcasecmp(token, "uplink") == 0) {
1107                         params.direction = WMM_TSPEC_DIRECTION_UPLINK;
1108                 } else if (os_strcasecmp(token, "bidi") == 0) {
1109                         params.direction = WMM_TSPEC_DIRECTION_BI_DIRECTIONAL;
1110                 } else if (os_strcasecmp(token, "fixed_nominal_msdu") == 0) {
1111                         params.fixed_nominal_msdu = 1;
1112                 } else {
1113                         wpa_printf(MSG_DEBUG,
1114                                    "CTRL: Invalid WMM_AC_ADDTS parameter: '%s'",
1115                                    token);
1116                         return -1;
1117                 }
1118
1119         }
1120
1121         return wpas_wmm_ac_addts(wpa_s, &params);
1122 }
1123
1124
1125 static int wmm_ac_ctrl_delts(struct wpa_supplicant *wpa_s, char *cmd)
1126 {
1127         u8 tsid = atoi(cmd);
1128
1129         return wpas_wmm_ac_delts(wpa_s, tsid);
1130 }
1131
1132
1133 #ifdef CONFIG_IEEE80211R
1134 static int wpa_supplicant_ctrl_iface_ft_ds(
1135         struct wpa_supplicant *wpa_s, char *addr)
1136 {
1137         u8 target_ap[ETH_ALEN];
1138         struct wpa_bss *bss;
1139         const u8 *mdie;
1140
1141         if (hwaddr_aton(addr, target_ap)) {
1142                 wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS: invalid "
1143                            "address '%s'", addr);
1144                 return -1;
1145         }
1146
1147         wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS " MACSTR, MAC2STR(target_ap));
1148
1149         bss = wpa_bss_get_bssid(wpa_s, target_ap);
1150         if (bss)
1151                 mdie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1152         else
1153                 mdie = NULL;
1154
1155         return wpa_ft_start_over_ds(wpa_s->wpa, target_ap, mdie);
1156 }
1157 #endif /* CONFIG_IEEE80211R */
1158
1159
1160 #ifdef CONFIG_WPS
1161 static int wpa_supplicant_ctrl_iface_wps_pbc(struct wpa_supplicant *wpa_s,
1162                                              char *cmd)
1163 {
1164         u8 bssid[ETH_ALEN], *_bssid = bssid;
1165 #ifdef CONFIG_P2P
1166         u8 p2p_dev_addr[ETH_ALEN];
1167 #endif /* CONFIG_P2P */
1168 #ifdef CONFIG_AP
1169         u8 *_p2p_dev_addr = NULL;
1170 #endif /* CONFIG_AP */
1171
1172         if (cmd == NULL || os_strcmp(cmd, "any") == 0) {
1173                 _bssid = NULL;
1174 #ifdef CONFIG_P2P
1175         } else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
1176                 if (hwaddr_aton(cmd + 13, p2p_dev_addr)) {
1177                         wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid "
1178                                    "P2P Device Address '%s'",
1179                                    cmd + 13);
1180                         return -1;
1181                 }
1182                 _p2p_dev_addr = p2p_dev_addr;
1183 #endif /* CONFIG_P2P */
1184         } else if (hwaddr_aton(cmd, bssid)) {
1185                 wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid BSSID '%s'",
1186                            cmd);
1187                 return -1;
1188         }
1189
1190 #ifdef CONFIG_AP
1191         if (wpa_s->ap_iface)
1192                 return wpa_supplicant_ap_wps_pbc(wpa_s, _bssid, _p2p_dev_addr);
1193 #endif /* CONFIG_AP */
1194
1195         return wpas_wps_start_pbc(wpa_s, _bssid, 0);
1196 }
1197
1198
1199 static int wpa_supplicant_ctrl_iface_wps_pin(struct wpa_supplicant *wpa_s,
1200                                              char *cmd, char *buf,
1201                                              size_t buflen)
1202 {
1203         u8 bssid[ETH_ALEN], *_bssid = bssid;
1204         char *pin;
1205         int ret;
1206
1207         pin = os_strchr(cmd, ' ');
1208         if (pin)
1209                 *pin++ = '\0';
1210
1211         if (os_strcmp(cmd, "any") == 0)
1212                 _bssid = NULL;
1213         else if (os_strcmp(cmd, "get") == 0) {
1214                 if (wps_generate_pin((unsigned int *) &ret) < 0)
1215                         return -1;
1216                 goto done;
1217         } else if (hwaddr_aton(cmd, bssid)) {
1218                 wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PIN: invalid BSSID '%s'",
1219                            cmd);
1220                 return -1;
1221         }
1222
1223 #ifdef CONFIG_AP
1224         if (wpa_s->ap_iface) {
1225                 int timeout = 0;
1226                 char *pos;
1227
1228                 if (pin) {
1229                         pos = os_strchr(pin, ' ');
1230                         if (pos) {
1231                                 *pos++ = '\0';
1232                                 timeout = atoi(pos);
1233                         }
1234                 }
1235
1236                 return wpa_supplicant_ap_wps_pin(wpa_s, _bssid, pin,
1237                                                  buf, buflen, timeout);
1238         }
1239 #endif /* CONFIG_AP */
1240
1241         if (pin) {
1242                 ret = wpas_wps_start_pin(wpa_s, _bssid, pin, 0,
1243                                          DEV_PW_DEFAULT);
1244                 if (ret < 0)
1245                         return -1;
1246                 ret = os_snprintf(buf, buflen, "%s", pin);
1247                 if (os_snprintf_error(buflen, ret))
1248                         return -1;
1249                 return ret;
1250         }
1251
1252         ret = wpas_wps_start_pin(wpa_s, _bssid, NULL, 0, DEV_PW_DEFAULT);
1253         if (ret < 0)
1254                 return -1;
1255
1256 done:
1257         /* Return the generated PIN */
1258         ret = os_snprintf(buf, buflen, "%08d", ret);
1259         if (os_snprintf_error(buflen, ret))
1260                 return -1;
1261         return ret;
1262 }
1263
1264
1265 static int wpa_supplicant_ctrl_iface_wps_check_pin(
1266         struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
1267 {
1268         char pin[9];
1269         size_t len;
1270         char *pos;
1271         int ret;
1272
1273         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS_CHECK_PIN",
1274                               (u8 *) cmd, os_strlen(cmd));
1275         for (pos = cmd, len = 0; *pos != '\0'; pos++) {
1276                 if (*pos < '0' || *pos > '9')
1277                         continue;
1278                 pin[len++] = *pos;
1279                 if (len == 9) {
1280                         wpa_printf(MSG_DEBUG, "WPS: Too long PIN");
1281                         return -1;
1282                 }
1283         }
1284         if (len != 4 && len != 8) {
1285                 wpa_printf(MSG_DEBUG, "WPS: Invalid PIN length %d", (int) len);
1286                 return -1;
1287         }
1288         pin[len] = '\0';
1289
1290         if (len == 8) {
1291                 unsigned int pin_val;
1292                 pin_val = atoi(pin);
1293                 if (!wps_pin_valid(pin_val)) {
1294                         wpa_printf(MSG_DEBUG, "WPS: Invalid checksum digit");
1295                         ret = os_snprintf(buf, buflen, "FAIL-CHECKSUM\n");
1296                         if (os_snprintf_error(buflen, ret))
1297                                 return -1;
1298                         return ret;
1299                 }
1300         }
1301
1302         ret = os_snprintf(buf, buflen, "%s", pin);
1303         if (os_snprintf_error(buflen, ret))
1304                 return -1;
1305
1306         return ret;
1307 }
1308
1309
1310 #ifdef CONFIG_WPS_NFC
1311
1312 static int wpa_supplicant_ctrl_iface_wps_nfc(struct wpa_supplicant *wpa_s,
1313                                              char *cmd)
1314 {
1315         u8 bssid[ETH_ALEN], *_bssid = bssid;
1316
1317         if (cmd == NULL || cmd[0] == '\0')
1318                 _bssid = NULL;
1319         else if (hwaddr_aton(cmd, bssid))
1320                 return -1;
1321
1322         return wpas_wps_start_nfc(wpa_s, NULL, _bssid, NULL, 0, 0, NULL, NULL,
1323                                   0, 0);
1324 }
1325
1326
1327 static int wpa_supplicant_ctrl_iface_wps_nfc_config_token(
1328         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1329 {
1330         int ndef;
1331         struct wpabuf *buf;
1332         int res;
1333         char *pos;
1334
1335         pos = os_strchr(cmd, ' ');
1336         if (pos)
1337                 *pos++ = '\0';
1338         if (os_strcmp(cmd, "WPS") == 0)
1339                 ndef = 0;
1340         else if (os_strcmp(cmd, "NDEF") == 0)
1341                 ndef = 1;
1342         else
1343                 return -1;
1344
1345         buf = wpas_wps_nfc_config_token(wpa_s, ndef, pos);
1346         if (buf == NULL)
1347                 return -1;
1348
1349         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1350                                          wpabuf_len(buf));
1351         reply[res++] = '\n';
1352         reply[res] = '\0';
1353
1354         wpabuf_free(buf);
1355
1356         return res;
1357 }
1358
1359
1360 static int wpa_supplicant_ctrl_iface_wps_nfc_token(
1361         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1362 {
1363         int ndef;
1364         struct wpabuf *buf;
1365         int res;
1366
1367         if (os_strcmp(cmd, "WPS") == 0)
1368                 ndef = 0;
1369         else if (os_strcmp(cmd, "NDEF") == 0)
1370                 ndef = 1;
1371         else
1372                 return -1;
1373
1374         buf = wpas_wps_nfc_token(wpa_s, ndef);
1375         if (buf == NULL)
1376                 return -1;
1377
1378         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1379                                          wpabuf_len(buf));
1380         reply[res++] = '\n';
1381         reply[res] = '\0';
1382
1383         wpabuf_free(buf);
1384
1385         return res;
1386 }
1387
1388
1389 static int wpa_supplicant_ctrl_iface_wps_nfc_tag_read(
1390         struct wpa_supplicant *wpa_s, char *pos)
1391 {
1392         size_t len;
1393         struct wpabuf *buf;
1394         int ret;
1395         char *freq;
1396         int forced_freq = 0;
1397
1398         freq = strstr(pos, " freq=");
1399         if (freq) {
1400                 *freq = '\0';
1401                 freq += 6;
1402                 forced_freq = atoi(freq);
1403         }
1404
1405         len = os_strlen(pos);
1406         if (len & 0x01)
1407                 return -1;
1408         len /= 2;
1409
1410         buf = wpabuf_alloc(len);
1411         if (buf == NULL)
1412                 return -1;
1413         if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
1414                 wpabuf_free(buf);
1415                 return -1;
1416         }
1417
1418         ret = wpas_wps_nfc_tag_read(wpa_s, buf, forced_freq);
1419         wpabuf_free(buf);
1420
1421         return ret;
1422 }
1423
1424
1425 static int wpas_ctrl_nfc_get_handover_req_wps(struct wpa_supplicant *wpa_s,
1426                                               char *reply, size_t max_len,
1427                                               int ndef)
1428 {
1429         struct wpabuf *buf;
1430         int res;
1431
1432         buf = wpas_wps_nfc_handover_req(wpa_s, ndef);
1433         if (buf == NULL)
1434                 return -1;
1435
1436         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1437                                          wpabuf_len(buf));
1438         reply[res++] = '\n';
1439         reply[res] = '\0';
1440
1441         wpabuf_free(buf);
1442
1443         return res;
1444 }
1445
1446
1447 #ifdef CONFIG_P2P
1448 static int wpas_ctrl_nfc_get_handover_req_p2p(struct wpa_supplicant *wpa_s,
1449                                               char *reply, size_t max_len,
1450                                               int ndef)
1451 {
1452         struct wpabuf *buf;
1453         int res;
1454
1455         buf = wpas_p2p_nfc_handover_req(wpa_s, ndef);
1456         if (buf == NULL) {
1457                 wpa_printf(MSG_DEBUG, "P2P: Could not generate NFC handover request");
1458                 return -1;
1459         }
1460
1461         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1462                                          wpabuf_len(buf));
1463         reply[res++] = '\n';
1464         reply[res] = '\0';
1465
1466         wpabuf_free(buf);
1467
1468         return res;
1469 }
1470 #endif /* CONFIG_P2P */
1471
1472
1473 static int wpas_ctrl_nfc_get_handover_req(struct wpa_supplicant *wpa_s,
1474                                           char *cmd, char *reply,
1475                                           size_t max_len)
1476 {
1477         char *pos;
1478         int ndef;
1479
1480         pos = os_strchr(cmd, ' ');
1481         if (pos == NULL)
1482                 return -1;
1483         *pos++ = '\0';
1484
1485         if (os_strcmp(cmd, "WPS") == 0)
1486                 ndef = 0;
1487         else if (os_strcmp(cmd, "NDEF") == 0)
1488                 ndef = 1;
1489         else
1490                 return -1;
1491
1492         if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1493                 if (!ndef)
1494                         return -1;
1495                 return wpas_ctrl_nfc_get_handover_req_wps(
1496                         wpa_s, reply, max_len, ndef);
1497         }
1498
1499 #ifdef CONFIG_P2P
1500         if (os_strcmp(pos, "P2P-CR") == 0) {
1501                 return wpas_ctrl_nfc_get_handover_req_p2p(
1502                         wpa_s, reply, max_len, ndef);
1503         }
1504 #endif /* CONFIG_P2P */
1505
1506         return -1;
1507 }
1508
1509
1510 static int wpas_ctrl_nfc_get_handover_sel_wps(struct wpa_supplicant *wpa_s,
1511                                               char *reply, size_t max_len,
1512                                               int ndef, int cr, char *uuid)
1513 {
1514         struct wpabuf *buf;
1515         int res;
1516
1517         buf = wpas_wps_nfc_handover_sel(wpa_s, ndef, cr, uuid);
1518         if (buf == NULL)
1519                 return -1;
1520
1521         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1522                                          wpabuf_len(buf));
1523         reply[res++] = '\n';
1524         reply[res] = '\0';
1525
1526         wpabuf_free(buf);
1527
1528         return res;
1529 }
1530
1531
1532 #ifdef CONFIG_P2P
1533 static int wpas_ctrl_nfc_get_handover_sel_p2p(struct wpa_supplicant *wpa_s,
1534                                               char *reply, size_t max_len,
1535                                               int ndef, int tag)
1536 {
1537         struct wpabuf *buf;
1538         int res;
1539
1540         buf = wpas_p2p_nfc_handover_sel(wpa_s, ndef, tag);
1541         if (buf == NULL)
1542                 return -1;
1543
1544         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1545                                          wpabuf_len(buf));
1546         reply[res++] = '\n';
1547         reply[res] = '\0';
1548
1549         wpabuf_free(buf);
1550
1551         return res;
1552 }
1553 #endif /* CONFIG_P2P */
1554
1555
1556 static int wpas_ctrl_nfc_get_handover_sel(struct wpa_supplicant *wpa_s,
1557                                           char *cmd, char *reply,
1558                                           size_t max_len)
1559 {
1560         char *pos, *pos2;
1561         int ndef;
1562
1563         pos = os_strchr(cmd, ' ');
1564         if (pos == NULL)
1565                 return -1;
1566         *pos++ = '\0';
1567
1568         if (os_strcmp(cmd, "WPS") == 0)
1569                 ndef = 0;
1570         else if (os_strcmp(cmd, "NDEF") == 0)
1571                 ndef = 1;
1572         else
1573                 return -1;
1574
1575         pos2 = os_strchr(pos, ' ');
1576         if (pos2)
1577                 *pos2++ = '\0';
1578         if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1579                 if (!ndef)
1580                         return -1;
1581                 return wpas_ctrl_nfc_get_handover_sel_wps(
1582                         wpa_s, reply, max_len, ndef,
1583                         os_strcmp(pos, "WPS-CR") == 0, pos2);
1584         }
1585
1586 #ifdef CONFIG_P2P
1587         if (os_strcmp(pos, "P2P-CR") == 0) {
1588                 return wpas_ctrl_nfc_get_handover_sel_p2p(
1589                         wpa_s, reply, max_len, ndef, 0);
1590         }
1591
1592         if (os_strcmp(pos, "P2P-CR-TAG") == 0) {
1593                 return wpas_ctrl_nfc_get_handover_sel_p2p(
1594                         wpa_s, reply, max_len, ndef, 1);
1595         }
1596 #endif /* CONFIG_P2P */
1597
1598         return -1;
1599 }
1600
1601
1602 static int wpas_ctrl_nfc_report_handover(struct wpa_supplicant *wpa_s,
1603                                          char *cmd)
1604 {
1605         size_t len;
1606         struct wpabuf *req, *sel;
1607         int ret;
1608         char *pos, *role, *type, *pos2;
1609 #ifdef CONFIG_P2P
1610         char *freq;
1611         int forced_freq = 0;
1612
1613         freq = strstr(cmd, " freq=");
1614         if (freq) {
1615                 *freq = '\0';
1616                 freq += 6;
1617                 forced_freq = atoi(freq);
1618         }
1619 #endif /* CONFIG_P2P */
1620
1621         role = cmd;
1622         pos = os_strchr(role, ' ');
1623         if (pos == NULL) {
1624                 wpa_printf(MSG_DEBUG, "NFC: Missing type in handover report");
1625                 return -1;
1626         }
1627         *pos++ = '\0';
1628
1629         type = pos;
1630         pos = os_strchr(type, ' ');
1631         if (pos == NULL) {
1632                 wpa_printf(MSG_DEBUG, "NFC: Missing request message in handover report");
1633                 return -1;
1634         }
1635         *pos++ = '\0';
1636
1637         pos2 = os_strchr(pos, ' ');
1638         if (pos2 == NULL) {
1639                 wpa_printf(MSG_DEBUG, "NFC: Missing select message in handover report");
1640                 return -1;
1641         }
1642         *pos2++ = '\0';
1643
1644         len = os_strlen(pos);
1645         if (len & 0x01) {
1646                 wpa_printf(MSG_DEBUG, "NFC: Invalid request message length in handover report");
1647                 return -1;
1648         }
1649         len /= 2;
1650
1651         req = wpabuf_alloc(len);
1652         if (req == NULL) {
1653                 wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for request message");
1654                 return -1;
1655         }
1656         if (hexstr2bin(pos, wpabuf_put(req, len), len) < 0) {
1657                 wpa_printf(MSG_DEBUG, "NFC: Invalid request message hexdump in handover report");
1658                 wpabuf_free(req);
1659                 return -1;
1660         }
1661
1662         len = os_strlen(pos2);
1663         if (len & 0x01) {
1664                 wpa_printf(MSG_DEBUG, "NFC: Invalid select message length in handover report");
1665                 wpabuf_free(req);
1666                 return -1;
1667         }
1668         len /= 2;
1669
1670         sel = wpabuf_alloc(len);
1671         if (sel == NULL) {
1672                 wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for select message");
1673                 wpabuf_free(req);
1674                 return -1;
1675         }
1676         if (hexstr2bin(pos2, wpabuf_put(sel, len), len) < 0) {
1677                 wpa_printf(MSG_DEBUG, "NFC: Invalid select message hexdump in handover report");
1678                 wpabuf_free(req);
1679                 wpabuf_free(sel);
1680                 return -1;
1681         }
1682
1683         wpa_printf(MSG_DEBUG, "NFC: Connection handover reported - role=%s type=%s req_len=%d sel_len=%d",
1684                    role, type, (int) wpabuf_len(req), (int) wpabuf_len(sel));
1685
1686         if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "WPS") == 0) {
1687                 ret = wpas_wps_nfc_report_handover(wpa_s, req, sel);
1688 #ifdef CONFIG_AP
1689         } else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "WPS") == 0)
1690         {
1691                 ret = wpas_ap_wps_nfc_report_handover(wpa_s, req, sel);
1692                 if (ret < 0)
1693                         ret = wpas_er_wps_nfc_report_handover(wpa_s, req, sel);
1694 #endif /* CONFIG_AP */
1695 #ifdef CONFIG_P2P
1696         } else if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "P2P") == 0)
1697         {
1698                 ret = wpas_p2p_nfc_report_handover(wpa_s, 1, req, sel, 0);
1699         } else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "P2P") == 0)
1700         {
1701                 ret = wpas_p2p_nfc_report_handover(wpa_s, 0, req, sel,
1702                                                    forced_freq);
1703 #endif /* CONFIG_P2P */
1704         } else {
1705                 wpa_printf(MSG_DEBUG, "NFC: Unsupported connection handover "
1706                            "reported: role=%s type=%s", role, type);
1707                 ret = -1;
1708         }
1709         wpabuf_free(req);
1710         wpabuf_free(sel);
1711
1712         if (ret)
1713                 wpa_printf(MSG_DEBUG, "NFC: Failed to process reported handover messages");
1714
1715         return ret;
1716 }
1717
1718 #endif /* CONFIG_WPS_NFC */
1719
1720
1721 static int wpa_supplicant_ctrl_iface_wps_reg(struct wpa_supplicant *wpa_s,
1722                                              char *cmd)
1723 {
1724         u8 bssid[ETH_ALEN];
1725         char *pin;
1726         char *new_ssid;
1727         char *new_auth;
1728         char *new_encr;
1729         char *new_key;
1730         struct wps_new_ap_settings ap;
1731
1732         pin = os_strchr(cmd, ' ');
1733         if (pin == NULL)
1734                 return -1;
1735         *pin++ = '\0';
1736
1737         if (hwaddr_aton(cmd, bssid)) {
1738                 wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_REG: invalid BSSID '%s'",
1739                            cmd);
1740                 return -1;
1741         }
1742
1743         new_ssid = os_strchr(pin, ' ');
1744         if (new_ssid == NULL)
1745                 return wpas_wps_start_reg(wpa_s, bssid, pin, NULL);
1746         *new_ssid++ = '\0';
1747
1748         new_auth = os_strchr(new_ssid, ' ');
1749         if (new_auth == NULL)
1750                 return -1;
1751         *new_auth++ = '\0';
1752
1753         new_encr = os_strchr(new_auth, ' ');
1754         if (new_encr == NULL)
1755                 return -1;
1756         *new_encr++ = '\0';
1757
1758         new_key = os_strchr(new_encr, ' ');
1759         if (new_key == NULL)
1760                 return -1;
1761         *new_key++ = '\0';
1762
1763         os_memset(&ap, 0, sizeof(ap));
1764         ap.ssid_hex = new_ssid;
1765         ap.auth = new_auth;
1766         ap.encr = new_encr;
1767         ap.key_hex = new_key;
1768         return wpas_wps_start_reg(wpa_s, bssid, pin, &ap);
1769 }
1770
1771
1772 #ifdef CONFIG_AP
1773 static int wpa_supplicant_ctrl_iface_wps_ap_pin(struct wpa_supplicant *wpa_s,
1774                                                 char *cmd, char *buf,
1775                                                 size_t buflen)
1776 {
1777         int timeout = 300;
1778         char *pos;
1779         const char *pin_txt;
1780
1781         if (!wpa_s->ap_iface)
1782                 return -1;
1783
1784         pos = os_strchr(cmd, ' ');
1785         if (pos)
1786                 *pos++ = '\0';
1787
1788         if (os_strcmp(cmd, "disable") == 0) {
1789                 wpas_wps_ap_pin_disable(wpa_s);
1790                 return os_snprintf(buf, buflen, "OK\n");
1791         }
1792
1793         if (os_strcmp(cmd, "random") == 0) {
1794                 if (pos)
1795                         timeout = atoi(pos);
1796                 pin_txt = wpas_wps_ap_pin_random(wpa_s, timeout);
1797                 if (pin_txt == NULL)
1798                         return -1;
1799                 return os_snprintf(buf, buflen, "%s", pin_txt);
1800         }
1801
1802         if (os_strcmp(cmd, "get") == 0) {
1803                 pin_txt = wpas_wps_ap_pin_get(wpa_s);
1804                 if (pin_txt == NULL)
1805                         return -1;
1806                 return os_snprintf(buf, buflen, "%s", pin_txt);
1807         }
1808
1809         if (os_strcmp(cmd, "set") == 0) {
1810                 char *pin;
1811                 if (pos == NULL)
1812                         return -1;
1813                 pin = pos;
1814                 pos = os_strchr(pos, ' ');
1815                 if (pos) {
1816                         *pos++ = '\0';
1817                         timeout = atoi(pos);
1818                 }
1819                 if (os_strlen(pin) > buflen)
1820                         return -1;
1821                 if (wpas_wps_ap_pin_set(wpa_s, pin, timeout) < 0)
1822                         return -1;
1823                 return os_snprintf(buf, buflen, "%s", pin);
1824         }
1825
1826         return -1;
1827 }
1828 #endif /* CONFIG_AP */
1829
1830
1831 #ifdef CONFIG_WPS_ER
1832 static int wpa_supplicant_ctrl_iface_wps_er_pin(struct wpa_supplicant *wpa_s,
1833                                                 char *cmd)
1834 {
1835         char *uuid = cmd, *pin, *pos;
1836         u8 addr_buf[ETH_ALEN], *addr = NULL;
1837         pin = os_strchr(uuid, ' ');
1838         if (pin == NULL)
1839                 return -1;
1840         *pin++ = '\0';
1841         pos = os_strchr(pin, ' ');
1842         if (pos) {
1843                 *pos++ = '\0';
1844                 if (hwaddr_aton(pos, addr_buf) == 0)
1845                         addr = addr_buf;
1846         }
1847         return wpas_wps_er_add_pin(wpa_s, addr, uuid, pin);
1848 }
1849
1850
1851 static int wpa_supplicant_ctrl_iface_wps_er_learn(struct wpa_supplicant *wpa_s,
1852                                                   char *cmd)
1853 {
1854         char *uuid = cmd, *pin;
1855         pin = os_strchr(uuid, ' ');
1856         if (pin == NULL)
1857                 return -1;
1858         *pin++ = '\0';
1859         return wpas_wps_er_learn(wpa_s, uuid, pin);
1860 }
1861
1862
1863 static int wpa_supplicant_ctrl_iface_wps_er_set_config(
1864         struct wpa_supplicant *wpa_s, char *cmd)
1865 {
1866         char *uuid = cmd, *id;
1867         id = os_strchr(uuid, ' ');
1868         if (id == NULL)
1869                 return -1;
1870         *id++ = '\0';
1871         return wpas_wps_er_set_config(wpa_s, uuid, atoi(id));
1872 }
1873
1874
1875 static int wpa_supplicant_ctrl_iface_wps_er_config(
1876         struct wpa_supplicant *wpa_s, char *cmd)
1877 {
1878         char *pin;
1879         char *new_ssid;
1880         char *new_auth;
1881         char *new_encr;
1882         char *new_key;
1883         struct wps_new_ap_settings ap;
1884
1885         pin = os_strchr(cmd, ' ');
1886         if (pin == NULL)
1887                 return -1;
1888         *pin++ = '\0';
1889
1890         new_ssid = os_strchr(pin, ' ');
1891         if (new_ssid == NULL)
1892                 return -1;
1893         *new_ssid++ = '\0';
1894
1895         new_auth = os_strchr(new_ssid, ' ');
1896         if (new_auth == NULL)
1897                 return -1;
1898         *new_auth++ = '\0';
1899
1900         new_encr = os_strchr(new_auth, ' ');
1901         if (new_encr == NULL)
1902                 return -1;
1903         *new_encr++ = '\0';
1904
1905         new_key = os_strchr(new_encr, ' ');
1906         if (new_key == NULL)
1907                 return -1;
1908         *new_key++ = '\0';
1909
1910         os_memset(&ap, 0, sizeof(ap));
1911         ap.ssid_hex = new_ssid;
1912         ap.auth = new_auth;
1913         ap.encr = new_encr;
1914         ap.key_hex = new_key;
1915         return wpas_wps_er_config(wpa_s, cmd, pin, &ap);
1916 }
1917
1918
1919 #ifdef CONFIG_WPS_NFC
1920 static int wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
1921         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1922 {
1923         int ndef;
1924         struct wpabuf *buf;
1925         int res;
1926         char *uuid;
1927
1928         uuid = os_strchr(cmd, ' ');
1929         if (uuid == NULL)
1930                 return -1;
1931         *uuid++ = '\0';
1932
1933         if (os_strcmp(cmd, "WPS") == 0)
1934                 ndef = 0;
1935         else if (os_strcmp(cmd, "NDEF") == 0)
1936                 ndef = 1;
1937         else
1938                 return -1;
1939
1940         buf = wpas_wps_er_nfc_config_token(wpa_s, ndef, uuid);
1941         if (buf == NULL)
1942                 return -1;
1943
1944         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1945                                          wpabuf_len(buf));
1946         reply[res++] = '\n';
1947         reply[res] = '\0';
1948
1949         wpabuf_free(buf);
1950
1951         return res;
1952 }
1953 #endif /* CONFIG_WPS_NFC */
1954 #endif /* CONFIG_WPS_ER */
1955
1956 #endif /* CONFIG_WPS */
1957
1958
1959 #ifdef CONFIG_IBSS_RSN
1960 static int wpa_supplicant_ctrl_iface_ibss_rsn(
1961         struct wpa_supplicant *wpa_s, char *addr)
1962 {
1963         u8 peer[ETH_ALEN];
1964
1965         if (hwaddr_aton(addr, peer)) {
1966                 wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN: invalid "
1967                            "address '%s'", addr);
1968                 return -1;
1969         }
1970
1971         wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN " MACSTR,
1972                    MAC2STR(peer));
1973
1974         return ibss_rsn_start(wpa_s->ibss_rsn, peer);
1975 }
1976 #endif /* CONFIG_IBSS_RSN */
1977
1978
1979 static int wpa_supplicant_ctrl_iface_ctrl_rsp(struct wpa_supplicant *wpa_s,
1980                                               char *rsp)
1981 {
1982 #ifdef IEEE8021X_EAPOL
1983         char *pos, *id_pos;
1984         int id;
1985         struct wpa_ssid *ssid;
1986
1987         pos = os_strchr(rsp, '-');
1988         if (pos == NULL)
1989                 return -1;
1990         *pos++ = '\0';
1991         id_pos = pos;
1992         pos = os_strchr(pos, ':');
1993         if (pos == NULL)
1994                 return -1;
1995         *pos++ = '\0';
1996         id = atoi(id_pos);
1997         wpa_printf(MSG_DEBUG, "CTRL_IFACE: field=%s id=%d", rsp, id);
1998         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
1999                               (u8 *) pos, os_strlen(pos));
2000
2001         ssid = wpa_config_get_network(wpa_s->conf, id);
2002         if (ssid == NULL) {
2003                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
2004                            "to update", id);
2005                 return -1;
2006         }
2007
2008         return wpa_supplicant_ctrl_iface_ctrl_rsp_handle(wpa_s, ssid, rsp,
2009                                                          pos);
2010 #else /* IEEE8021X_EAPOL */
2011         wpa_printf(MSG_DEBUG, "CTRL_IFACE: 802.1X not included");
2012         return -1;
2013 #endif /* IEEE8021X_EAPOL */
2014 }
2015
2016
2017 static int wpa_supplicant_ctrl_iface_status(struct wpa_supplicant *wpa_s,
2018                                             const char *params,
2019                                             char *buf, size_t buflen)
2020 {
2021         char *pos, *end, tmp[30];
2022         int res, verbose, wps, ret;
2023 #ifdef CONFIG_HS20
2024         const u8 *hs20;
2025 #endif /* CONFIG_HS20 */
2026         const u8 *sess_id;
2027         size_t sess_id_len;
2028
2029         if (os_strcmp(params, "-DRIVER") == 0)
2030                 return wpa_drv_status(wpa_s, buf, buflen);
2031         verbose = os_strcmp(params, "-VERBOSE") == 0;
2032         wps = os_strcmp(params, "-WPS") == 0;
2033         pos = buf;
2034         end = buf + buflen;
2035         if (wpa_s->wpa_state >= WPA_ASSOCIATED) {
2036                 struct wpa_ssid *ssid = wpa_s->current_ssid;
2037                 ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
2038                                   MAC2STR(wpa_s->bssid));
2039                 if (os_snprintf_error(end - pos, ret))
2040                         return pos - buf;
2041                 pos += ret;
2042                 ret = os_snprintf(pos, end - pos, "freq=%u\n",
2043                                   wpa_s->assoc_freq);
2044                 if (os_snprintf_error(end - pos, ret))
2045                         return pos - buf;
2046                 pos += ret;
2047                 if (ssid) {
2048                         u8 *_ssid = ssid->ssid;
2049                         size_t ssid_len = ssid->ssid_len;
2050                         u8 ssid_buf[SSID_MAX_LEN];
2051                         if (ssid_len == 0) {
2052                                 int _res = wpa_drv_get_ssid(wpa_s, ssid_buf);
2053                                 if (_res < 0)
2054                                         ssid_len = 0;
2055                                 else
2056                                         ssid_len = _res;
2057                                 _ssid = ssid_buf;
2058                         }
2059                         ret = os_snprintf(pos, end - pos, "ssid=%s\nid=%d\n",
2060                                           wpa_ssid_txt(_ssid, ssid_len),
2061                                           ssid->id);
2062                         if (os_snprintf_error(end - pos, ret))
2063                                 return pos - buf;
2064                         pos += ret;
2065
2066                         if (wps && ssid->passphrase &&
2067                             wpa_key_mgmt_wpa_psk(ssid->key_mgmt) &&
2068                             (ssid->mode == WPAS_MODE_AP ||
2069                              ssid->mode == WPAS_MODE_P2P_GO)) {
2070                                 ret = os_snprintf(pos, end - pos,
2071                                                   "passphrase=%s\n",
2072                                                   ssid->passphrase);
2073                                 if (os_snprintf_error(end - pos, ret))
2074                                         return pos - buf;
2075                                 pos += ret;
2076                         }
2077                         if (ssid->id_str) {
2078                                 ret = os_snprintf(pos, end - pos,
2079                                                   "id_str=%s\n",
2080                                                   ssid->id_str);
2081                                 if (os_snprintf_error(end - pos, ret))
2082                                         return pos - buf;
2083                                 pos += ret;
2084                         }
2085
2086                         switch (ssid->mode) {
2087                         case WPAS_MODE_INFRA:
2088                                 ret = os_snprintf(pos, end - pos,
2089                                                   "mode=station\n");
2090                                 break;
2091                         case WPAS_MODE_IBSS:
2092                                 ret = os_snprintf(pos, end - pos,
2093                                                   "mode=IBSS\n");
2094                                 break;
2095                         case WPAS_MODE_AP:
2096                                 ret = os_snprintf(pos, end - pos,
2097                                                   "mode=AP\n");
2098                                 break;
2099                         case WPAS_MODE_P2P_GO:
2100                                 ret = os_snprintf(pos, end - pos,
2101                                                   "mode=P2P GO\n");
2102                                 break;
2103                         case WPAS_MODE_P2P_GROUP_FORMATION:
2104                                 ret = os_snprintf(pos, end - pos,
2105                                                   "mode=P2P GO - group "
2106                                                   "formation\n");
2107                                 break;
2108                         case WPAS_MODE_MESH:
2109                                 ret = os_snprintf(pos, end - pos,
2110                                                   "mode=mesh\n");
2111                                 break;
2112                         default:
2113                                 ret = 0;
2114                                 break;
2115                         }
2116                         if (os_snprintf_error(end - pos, ret))
2117                                 return pos - buf;
2118                         pos += ret;
2119                 }
2120
2121 #ifdef CONFIG_AP
2122                 if (wpa_s->ap_iface) {
2123                         pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
2124                                                             end - pos,
2125                                                             verbose);
2126                 } else
2127 #endif /* CONFIG_AP */
2128                 pos += wpa_sm_get_status(wpa_s->wpa, pos, end - pos, verbose);
2129         }
2130 #ifdef CONFIG_SME
2131 #ifdef CONFIG_SAE
2132         if (wpa_s->wpa_state >= WPA_ASSOCIATED &&
2133 #ifdef CONFIG_AP
2134             !wpa_s->ap_iface &&
2135 #endif /* CONFIG_AP */
2136             wpa_s->sme.sae.state == SAE_ACCEPTED) {
2137                 ret = os_snprintf(pos, end - pos, "sae_group=%d\n",
2138                                   wpa_s->sme.sae.group);
2139                 if (os_snprintf_error(end - pos, ret))
2140                         return pos - buf;
2141                 pos += ret;
2142         }
2143 #endif /* CONFIG_SAE */
2144 #endif /* CONFIG_SME */
2145         ret = os_snprintf(pos, end - pos, "wpa_state=%s\n",
2146                           wpa_supplicant_state_txt(wpa_s->wpa_state));
2147         if (os_snprintf_error(end - pos, ret))
2148                 return pos - buf;
2149         pos += ret;
2150
2151         if (wpa_s->l2 &&
2152             l2_packet_get_ip_addr(wpa_s->l2, tmp, sizeof(tmp)) >= 0) {
2153                 ret = os_snprintf(pos, end - pos, "ip_address=%s\n", tmp);
2154                 if (os_snprintf_error(end - pos, ret))
2155                         return pos - buf;
2156                 pos += ret;
2157         }
2158
2159 #ifdef CONFIG_P2P
2160         if (wpa_s->global->p2p) {
2161                 ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
2162                                   "\n", MAC2STR(wpa_s->global->p2p_dev_addr));
2163                 if (os_snprintf_error(end - pos, ret))
2164                         return pos - buf;
2165                 pos += ret;
2166         }
2167 #endif /* CONFIG_P2P */
2168
2169         ret = os_snprintf(pos, end - pos, "address=" MACSTR "\n",
2170                           MAC2STR(wpa_s->own_addr));
2171         if (os_snprintf_error(end - pos, ret))
2172                 return pos - buf;
2173         pos += ret;
2174
2175 #ifdef CONFIG_HS20
2176         if (wpa_s->current_bss &&
2177             (hs20 = wpa_bss_get_vendor_ie(wpa_s->current_bss,
2178                                           HS20_IE_VENDOR_TYPE)) &&
2179             wpa_s->wpa_proto == WPA_PROTO_RSN &&
2180             wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
2181                 int release = 1;
2182                 if (hs20[1] >= 5) {
2183                         u8 rel_num = (hs20[6] & 0xf0) >> 4;
2184                         release = rel_num + 1;
2185                 }
2186                 ret = os_snprintf(pos, end - pos, "hs20=%d\n", release);
2187                 if (os_snprintf_error(end - pos, ret))
2188                         return pos - buf;
2189                 pos += ret;
2190         }
2191
2192         if (wpa_s->current_ssid) {
2193                 struct wpa_cred *cred;
2194                 char *type;
2195
2196                 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
2197                         size_t i;
2198
2199                         if (wpa_s->current_ssid->parent_cred != cred)
2200                                 continue;
2201
2202                         if (cred->provisioning_sp) {
2203                                 ret = os_snprintf(pos, end - pos,
2204                                                   "provisioning_sp=%s\n",
2205                                                   cred->provisioning_sp);
2206                                 if (os_snprintf_error(end - pos, ret))
2207                                         return pos - buf;
2208                                 pos += ret;
2209                         }
2210
2211                         if (!cred->domain)
2212                                 goto no_domain;
2213
2214                         i = 0;
2215                         if (wpa_s->current_bss && wpa_s->current_bss->anqp) {
2216                                 struct wpabuf *names =
2217                                         wpa_s->current_bss->anqp->domain_name;
2218                                 for (i = 0; names && i < cred->num_domain; i++)
2219                                 {
2220                                         if (domain_name_list_contains(
2221                                                     names, cred->domain[i], 1))
2222                                                 break;
2223                                 }
2224                                 if (i == cred->num_domain)
2225                                         i = 0; /* show first entry by default */
2226                         }
2227                         ret = os_snprintf(pos, end - pos, "home_sp=%s\n",
2228                                           cred->domain[i]);
2229                         if (os_snprintf_error(end - pos, ret))
2230                                 return pos - buf;
2231                         pos += ret;
2232
2233                 no_domain:
2234                         if (wpa_s->current_bss == NULL ||
2235                             wpa_s->current_bss->anqp == NULL)
2236                                 res = -1;
2237                         else
2238                                 res = interworking_home_sp_cred(
2239                                         wpa_s, cred,
2240                                         wpa_s->current_bss->anqp->domain_name);
2241                         if (res > 0)
2242                                 type = "home";
2243                         else if (res == 0)
2244                                 type = "roaming";
2245                         else
2246                                 type = "unknown";
2247
2248                         ret = os_snprintf(pos, end - pos, "sp_type=%s\n", type);
2249                         if (os_snprintf_error(end - pos, ret))
2250                                 return pos - buf;
2251                         pos += ret;
2252
2253                         break;
2254                 }
2255         }
2256 #endif /* CONFIG_HS20 */
2257
2258         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
2259             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2260                 res = eapol_sm_get_status(wpa_s->eapol, pos, end - pos,
2261                                           verbose);
2262                 if (res >= 0)
2263                         pos += res;
2264         }
2265
2266 #ifdef CONFIG_MACSEC
2267         res = ieee802_1x_kay_get_status(wpa_s->kay, pos, end - pos);
2268         if (res > 0)
2269                 pos += res;
2270 #endif /* CONFIG_MACSEC */
2271
2272         sess_id = eapol_sm_get_session_id(wpa_s->eapol, &sess_id_len);
2273         if (sess_id) {
2274                 char *start = pos;
2275
2276                 ret = os_snprintf(pos, end - pos, "eap_session_id=");
2277                 if (os_snprintf_error(end - pos, ret))
2278                         return start - buf;
2279                 pos += ret;
2280                 ret = wpa_snprintf_hex(pos, end - pos, sess_id, sess_id_len);
2281                 if (ret <= 0)
2282                         return start - buf;
2283                 pos += ret;
2284                 ret = os_snprintf(pos, end - pos, "\n");
2285                 if (os_snprintf_error(end - pos, ret))
2286                         return start - buf;
2287                 pos += ret;
2288         }
2289
2290         res = rsn_preauth_get_status(wpa_s->wpa, pos, end - pos, verbose);
2291         if (res >= 0)
2292                 pos += res;
2293
2294 #ifdef CONFIG_WPS
2295         {
2296                 char uuid_str[100];
2297                 uuid_bin2str(wpa_s->wps->uuid, uuid_str, sizeof(uuid_str));
2298                 ret = os_snprintf(pos, end - pos, "uuid=%s\n", uuid_str);
2299                 if (os_snprintf_error(end - pos, ret))
2300                         return pos - buf;
2301                 pos += ret;
2302         }
2303 #endif /* CONFIG_WPS */
2304
2305         if (wpa_s->ieee80211ac) {
2306                 ret = os_snprintf(pos, end - pos, "ieee80211ac=1\n");
2307                 if (os_snprintf_error(end - pos, ret))
2308                         return pos - buf;
2309                 pos += ret;
2310         }
2311
2312 #ifdef ANDROID
2313         /*
2314          * Allow using the STATUS command with default behavior, say for debug,
2315          * i.e., don't generate a "fake" CONNECTION and SUPPLICANT_STATE_CHANGE
2316          * events with STATUS-NO_EVENTS.
2317          */
2318         if (os_strcmp(params, "-NO_EVENTS")) {
2319                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_STATE_CHANGE
2320                              "id=%d state=%d BSSID=" MACSTR " SSID=%s",
2321                              wpa_s->current_ssid ? wpa_s->current_ssid->id : -1,
2322                              wpa_s->wpa_state,
2323                              MAC2STR(wpa_s->bssid),
2324                              wpa_s->current_ssid && wpa_s->current_ssid->ssid ?
2325                              wpa_ssid_txt(wpa_s->current_ssid->ssid,
2326                                           wpa_s->current_ssid->ssid_len) : "");
2327                 if (wpa_s->wpa_state == WPA_COMPLETED) {
2328                         struct wpa_ssid *ssid = wpa_s->current_ssid;
2329                         wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED
2330                                      "- connection to " MACSTR
2331                                      " completed %s [id=%d id_str=%s]",
2332                                      MAC2STR(wpa_s->bssid), "(auth)",
2333                                      ssid ? ssid->id : -1,
2334                                      ssid && ssid->id_str ? ssid->id_str : "");
2335                 }
2336         }
2337 #endif /* ANDROID */
2338
2339         return pos - buf;
2340 }
2341
2342
2343 static int wpa_supplicant_ctrl_iface_bssid(struct wpa_supplicant *wpa_s,
2344                                            char *cmd)
2345 {
2346         char *pos;
2347         int id;
2348         struct wpa_ssid *ssid;
2349         u8 bssid[ETH_ALEN];
2350
2351         /* cmd: "<network id> <BSSID>" */
2352         pos = os_strchr(cmd, ' ');
2353         if (pos == NULL)
2354                 return -1;
2355         *pos++ = '\0';
2356         id = atoi(cmd);
2357         wpa_printf(MSG_DEBUG, "CTRL_IFACE: id=%d bssid='%s'", id, pos);
2358         if (hwaddr_aton(pos, bssid)) {
2359                 wpa_printf(MSG_DEBUG ,"CTRL_IFACE: invalid BSSID '%s'", pos);
2360                 return -1;
2361         }
2362
2363         ssid = wpa_config_get_network(wpa_s->conf, id);
2364         if (ssid == NULL) {
2365                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
2366                            "to update", id);
2367                 return -1;
2368         }
2369
2370         os_memcpy(ssid->bssid, bssid, ETH_ALEN);
2371         ssid->bssid_set = !is_zero_ether_addr(bssid);
2372
2373         return 0;
2374 }
2375
2376
2377 static int wpa_supplicant_ctrl_iface_blacklist(struct wpa_supplicant *wpa_s,
2378                                                char *cmd, char *buf,
2379                                                size_t buflen)
2380 {
2381         u8 bssid[ETH_ALEN];
2382         struct wpa_blacklist *e;
2383         char *pos, *end;
2384         int ret;
2385
2386         /* cmd: "BLACKLIST [<BSSID>]" */
2387         if (*cmd == '\0') {
2388                 pos = buf;
2389                 end = buf + buflen;
2390                 e = wpa_s->blacklist;
2391                 while (e) {
2392                         ret = os_snprintf(pos, end - pos, MACSTR "\n",
2393                                           MAC2STR(e->bssid));
2394                         if (os_snprintf_error(end - pos, ret))
2395                                 return pos - buf;
2396                         pos += ret;
2397                         e = e->next;
2398                 }
2399                 return pos - buf;
2400         }
2401
2402         cmd++;
2403         if (os_strncmp(cmd, "clear", 5) == 0) {
2404                 wpa_blacklist_clear(wpa_s);
2405                 os_memcpy(buf, "OK\n", 3);
2406                 return 3;
2407         }
2408
2409         wpa_printf(MSG_DEBUG, "CTRL_IFACE: BLACKLIST bssid='%s'", cmd);
2410         if (hwaddr_aton(cmd, bssid)) {
2411                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: invalid BSSID '%s'", cmd);
2412                 return -1;
2413         }
2414
2415         /*
2416          * Add the BSSID twice, so its count will be 2, causing it to be
2417          * skipped when processing scan results.
2418          */
2419         ret = wpa_blacklist_add(wpa_s, bssid);
2420         if (ret < 0)
2421                 return -1;
2422         ret = wpa_blacklist_add(wpa_s, bssid);
2423         if (ret < 0)
2424                 return -1;
2425         os_memcpy(buf, "OK\n", 3);
2426         return 3;
2427 }
2428
2429
2430 static int wpa_supplicant_ctrl_iface_log_level(struct wpa_supplicant *wpa_s,
2431                                                char *cmd, char *buf,
2432                                                size_t buflen)
2433 {
2434         char *pos, *end, *stamp;
2435         int ret;
2436
2437         /* cmd: "LOG_LEVEL [<level>]" */
2438         if (*cmd == '\0') {
2439                 pos = buf;
2440                 end = buf + buflen;
2441                 ret = os_snprintf(pos, end - pos, "Current level: %s\n"
2442                                   "Timestamp: %d\n",
2443                                   debug_level_str(wpa_debug_level),
2444                                   wpa_debug_timestamp);
2445                 if (os_snprintf_error(end - pos, ret))
2446                         ret = 0;
2447
2448                 return ret;
2449         }
2450
2451         while (*cmd == ' ')
2452                 cmd++;
2453
2454         stamp = os_strchr(cmd, ' ');
2455         if (stamp) {
2456                 *stamp++ = '\0';
2457                 while (*stamp == ' ') {
2458                         stamp++;
2459                 }
2460         }
2461
2462         if (os_strlen(cmd)) {
2463                 int level = str_to_debug_level(cmd);
2464                 if (level < 0)
2465                         return -1;
2466                 wpa_debug_level = level;
2467         }
2468
2469         if (stamp && os_strlen(stamp))
2470                 wpa_debug_timestamp = atoi(stamp);
2471
2472         os_memcpy(buf, "OK\n", 3);
2473         return 3;
2474 }
2475
2476
2477 static int wpa_supplicant_ctrl_iface_list_networks(
2478         struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
2479 {
2480         char *pos, *end, *prev;
2481         struct wpa_ssid *ssid;
2482         int ret;
2483
2484         pos = buf;
2485         end = buf + buflen;
2486         ret = os_snprintf(pos, end - pos,
2487                           "network id / ssid / bssid / flags\n");
2488         if (os_snprintf_error(end - pos, ret))
2489                 return pos - buf;
2490         pos += ret;
2491
2492         ssid = wpa_s->conf->ssid;
2493
2494         /* skip over ssids until we find next one */
2495         if (cmd != NULL && os_strncmp(cmd, "LAST_ID=", 8) == 0) {
2496                 int last_id = atoi(cmd + 8);
2497                 if (last_id != -1) {
2498                         while (ssid != NULL && ssid->id <= last_id) {
2499                                 ssid = ssid->next;
2500                         }
2501                 }
2502         }
2503
2504         while (ssid) {
2505                 prev = pos;
2506                 ret = os_snprintf(pos, end - pos, "%d\t%s",
2507                                   ssid->id,
2508                                   wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2509                 if (os_snprintf_error(end - pos, ret))
2510                         return prev - buf;
2511                 pos += ret;
2512                 if (ssid->bssid_set) {
2513                         ret = os_snprintf(pos, end - pos, "\t" MACSTR,
2514                                           MAC2STR(ssid->bssid));
2515                 } else {
2516                         ret = os_snprintf(pos, end - pos, "\tany");
2517                 }
2518                 if (os_snprintf_error(end - pos, ret))
2519                         return prev - buf;
2520                 pos += ret;
2521                 ret = os_snprintf(pos, end - pos, "\t%s%s%s%s",
2522                                   ssid == wpa_s->current_ssid ?
2523                                   "[CURRENT]" : "",
2524                                   ssid->disabled ? "[DISABLED]" : "",
2525                                   ssid->disabled_until.sec ?
2526                                   "[TEMP-DISABLED]" : "",
2527                                   ssid->disabled == 2 ? "[P2P-PERSISTENT]" :
2528                                   "");
2529                 if (os_snprintf_error(end - pos, ret))
2530                         return prev - buf;
2531                 pos += ret;
2532                 ret = os_snprintf(pos, end - pos, "\n");
2533                 if (os_snprintf_error(end - pos, ret))
2534                         return prev - buf;
2535                 pos += ret;
2536
2537                 ssid = ssid->next;
2538         }
2539
2540         return pos - buf;
2541 }
2542
2543
2544 static char * wpa_supplicant_cipher_txt(char *pos, char *end, int cipher)
2545 {
2546         int ret;
2547         ret = os_snprintf(pos, end - pos, "-");
2548         if (os_snprintf_error(end - pos, ret))
2549                 return pos;
2550         pos += ret;
2551         ret = wpa_write_ciphers(pos, end, cipher, "+");
2552         if (ret < 0)
2553                 return pos;
2554         pos += ret;
2555         return pos;
2556 }
2557
2558
2559 static char * wpa_supplicant_ie_txt(char *pos, char *end, const char *proto,
2560                                     const u8 *ie, size_t ie_len)
2561 {
2562         struct wpa_ie_data data;
2563         char *start;
2564         int ret;
2565
2566         ret = os_snprintf(pos, end - pos, "[%s-", proto);
2567         if (os_snprintf_error(end - pos, ret))
2568                 return pos;
2569         pos += ret;
2570
2571         if (wpa_parse_wpa_ie(ie, ie_len, &data) < 0) {
2572                 ret = os_snprintf(pos, end - pos, "?]");
2573                 if (os_snprintf_error(end - pos, ret))
2574                         return pos;
2575                 pos += ret;
2576                 return pos;
2577         }
2578
2579         start = pos;
2580         if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
2581                 ret = os_snprintf(pos, end - pos, "%sEAP",
2582                                   pos == start ? "" : "+");
2583                 if (os_snprintf_error(end - pos, ret))
2584                         return pos;
2585                 pos += ret;
2586         }
2587         if (data.key_mgmt & WPA_KEY_MGMT_PSK) {
2588                 ret = os_snprintf(pos, end - pos, "%sPSK",
2589                                   pos == start ? "" : "+");
2590                 if (os_snprintf_error(end - pos, ret))
2591                         return pos;
2592                 pos += ret;
2593         }
2594         if (data.key_mgmt & WPA_KEY_MGMT_WPA_NONE) {
2595                 ret = os_snprintf(pos, end - pos, "%sNone",
2596                                   pos == start ? "" : "+");
2597                 if (os_snprintf_error(end - pos, ret))
2598                         return pos;
2599                 pos += ret;
2600         }
2601         if (data.key_mgmt & WPA_KEY_MGMT_SAE) {
2602                 ret = os_snprintf(pos, end - pos, "%sSAE",
2603                                   pos == start ? "" : "+");
2604                 if (os_snprintf_error(end - pos, ret))
2605                         return pos;
2606                 pos += ret;
2607         }
2608 #ifdef CONFIG_IEEE80211R
2609         if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
2610                 ret = os_snprintf(pos, end - pos, "%sFT/EAP",
2611                                   pos == start ? "" : "+");
2612                 if (os_snprintf_error(end - pos, ret))
2613                         return pos;
2614                 pos += ret;
2615         }
2616         if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK) {
2617                 ret = os_snprintf(pos, end - pos, "%sFT/PSK",
2618                                   pos == start ? "" : "+");
2619                 if (os_snprintf_error(end - pos, ret))
2620                         return pos;
2621                 pos += ret;
2622         }
2623         if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE) {
2624                 ret = os_snprintf(pos, end - pos, "%sFT/SAE",
2625                                   pos == start ? "" : "+");
2626                 if (os_snprintf_error(end - pos, ret))
2627                         return pos;
2628                 pos += ret;
2629         }
2630 #endif /* CONFIG_IEEE80211R */
2631 #ifdef CONFIG_IEEE80211W
2632         if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
2633                 ret = os_snprintf(pos, end - pos, "%sEAP-SHA256",
2634                                   pos == start ? "" : "+");
2635                 if (os_snprintf_error(end - pos, ret))
2636                         return pos;
2637                 pos += ret;
2638         }
2639         if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
2640                 ret = os_snprintf(pos, end - pos, "%sPSK-SHA256",
2641                                   pos == start ? "" : "+");
2642                 if (os_snprintf_error(end - pos, ret))
2643                         return pos;
2644                 pos += ret;
2645         }
2646 #endif /* CONFIG_IEEE80211W */
2647
2648 #ifdef CONFIG_SUITEB
2649         if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
2650                 ret = os_snprintf(pos, end - pos, "%sEAP-SUITE-B",
2651                                   pos == start ? "" : "+");
2652                 if (os_snprintf_error(end - pos, ret))
2653                         return pos;
2654                 pos += ret;
2655         }
2656 #endif /* CONFIG_SUITEB */
2657
2658 #ifdef CONFIG_SUITEB192
2659         if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
2660                 ret = os_snprintf(pos, end - pos, "%sEAP-SUITE-B-192",
2661                                   pos == start ? "" : "+");
2662                 if (os_snprintf_error(end - pos, ret))
2663                         return pos;
2664                 pos += ret;
2665         }
2666 #endif /* CONFIG_SUITEB192 */
2667
2668 #ifdef CONFIG_FILS
2669         if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA256) {
2670                 ret = os_snprintf(pos, end - pos, "%sFILS-SHA256",
2671                                   pos == start ? "" : "+");
2672                 if (os_snprintf_error(end - pos, ret))
2673                         return pos;
2674                 pos += ret;
2675         }
2676         if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA384) {
2677                 ret = os_snprintf(pos, end - pos, "%sFILS-SHA384",
2678                                   pos == start ? "" : "+");
2679                 if (os_snprintf_error(end - pos, ret))
2680                         return pos;
2681                 pos += ret;
2682         }
2683 #ifdef CONFIG_IEEE80211R
2684         if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) {
2685                 ret = os_snprintf(pos, end - pos, "%sFT-FILS-SHA256",
2686                                   pos == start ? "" : "+");
2687                 if (os_snprintf_error(end - pos, ret))
2688                         return pos;
2689                 pos += ret;
2690         }
2691         if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) {
2692                 ret = os_snprintf(pos, end - pos, "%sFT-FILS-SHA384",
2693                                   pos == start ? "" : "+");
2694                 if (os_snprintf_error(end - pos, ret))
2695                         return pos;
2696                 pos += ret;
2697         }
2698 #endif /* CONFIG_IEEE80211R */
2699 #endif /* CONFIG_FILS */
2700
2701 #ifdef CONFIG_OWE
2702         if (data.key_mgmt & WPA_KEY_MGMT_OWE) {
2703                 ret = os_snprintf(pos, end - pos, "%sOWE",
2704                                   pos == start ? "" : "+");
2705                 if (os_snprintf_error(end - pos, ret))
2706                         return pos;
2707                 pos += ret;
2708         }
2709 #endif /* CONFIG_OWE */
2710
2711 #ifdef CONFIG_DPP
2712         if (data.key_mgmt & WPA_KEY_MGMT_DPP) {
2713                 ret = os_snprintf(pos, end - pos, "%sDPP",
2714                                   pos == start ? "" : "+");
2715                 if (os_snprintf_error(end - pos, ret))
2716                         return pos;
2717                 pos += ret;
2718         }
2719 #endif /* CONFIG_DPP */
2720
2721         if (data.key_mgmt & WPA_KEY_MGMT_OSEN) {
2722                 ret = os_snprintf(pos, end - pos, "%sOSEN",
2723                                   pos == start ? "" : "+");
2724                 if (os_snprintf_error(end - pos, ret))
2725                         return pos;
2726                 pos += ret;
2727         }
2728
2729         pos = wpa_supplicant_cipher_txt(pos, end, data.pairwise_cipher);
2730
2731         if (data.capabilities & WPA_CAPABILITY_PREAUTH) {
2732                 ret = os_snprintf(pos, end - pos, "-preauth");
2733                 if (os_snprintf_error(end - pos, ret))
2734                         return pos;
2735                 pos += ret;
2736         }
2737
2738         ret = os_snprintf(pos, end - pos, "]");
2739         if (os_snprintf_error(end - pos, ret))
2740                 return pos;
2741         pos += ret;
2742
2743         return pos;
2744 }
2745
2746
2747 #ifdef CONFIG_WPS
2748 static char * wpa_supplicant_wps_ie_txt_buf(struct wpa_supplicant *wpa_s,
2749                                             char *pos, char *end,
2750                                             struct wpabuf *wps_ie)
2751 {
2752         int ret;
2753         const char *txt;
2754
2755         if (wps_ie == NULL)
2756                 return pos;
2757         if (wps_is_selected_pbc_registrar(wps_ie))
2758                 txt = "[WPS-PBC]";
2759         else if (wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 0))
2760                 txt = "[WPS-AUTH]";
2761         else if (wps_is_selected_pin_registrar(wps_ie))
2762                 txt = "[WPS-PIN]";
2763         else
2764                 txt = "[WPS]";
2765
2766         ret = os_snprintf(pos, end - pos, "%s", txt);
2767         if (!os_snprintf_error(end - pos, ret))
2768                 pos += ret;
2769         wpabuf_free(wps_ie);
2770         return pos;
2771 }
2772 #endif /* CONFIG_WPS */
2773
2774
2775 static char * wpa_supplicant_wps_ie_txt(struct wpa_supplicant *wpa_s,
2776                                         char *pos, char *end,
2777                                         const struct wpa_bss *bss)
2778 {
2779 #ifdef CONFIG_WPS
2780         struct wpabuf *wps_ie;
2781         wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
2782         return wpa_supplicant_wps_ie_txt_buf(wpa_s, pos, end, wps_ie);
2783 #else /* CONFIG_WPS */
2784         return pos;
2785 #endif /* CONFIG_WPS */
2786 }
2787
2788
2789 /* Format one result on one text line into a buffer. */
2790 static int wpa_supplicant_ctrl_iface_scan_result(
2791         struct wpa_supplicant *wpa_s,
2792         const struct wpa_bss *bss, char *buf, size_t buflen)
2793 {
2794         char *pos, *end;
2795         int ret;
2796         const u8 *ie, *ie2, *osen_ie, *p2p, *mesh, *owe;
2797
2798         mesh = wpa_bss_get_ie(bss, WLAN_EID_MESH_ID);
2799         p2p = wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE);
2800         if (!p2p)
2801                 p2p = wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE);
2802         if (p2p && bss->ssid_len == P2P_WILDCARD_SSID_LEN &&
2803             os_memcmp(bss->ssid, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) ==
2804             0)
2805                 return 0; /* Do not show P2P listen discovery results here */
2806
2807         pos = buf;
2808         end = buf + buflen;
2809
2810         ret = os_snprintf(pos, end - pos, MACSTR "\t%d\t%d\t",
2811                           MAC2STR(bss->bssid), bss->freq, bss->level);
2812         if (os_snprintf_error(end - pos, ret))
2813                 return -1;
2814         pos += ret;
2815         ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
2816         if (ie)
2817                 pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie, 2 + ie[1]);
2818         ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2819         if (ie2) {
2820                 pos = wpa_supplicant_ie_txt(pos, end, mesh ? "RSN" : "WPA2",
2821                                             ie2, 2 + ie2[1]);
2822         }
2823         osen_ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
2824         if (osen_ie)
2825                 pos = wpa_supplicant_ie_txt(pos, end, "OSEN",
2826                                             osen_ie, 2 + osen_ie[1]);
2827         owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
2828         if (owe) {
2829                 ret = os_snprintf(pos, end - pos,
2830                                   ie2 ? "[OWE-TRANS]" : "[OWE-TRANS-OPEN]");
2831                 if (os_snprintf_error(end - pos, ret))
2832                         return -1;
2833                 pos += ret;
2834         }
2835         pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
2836         if (!ie && !ie2 && !osen_ie && (bss->caps & IEEE80211_CAP_PRIVACY)) {
2837                 ret = os_snprintf(pos, end - pos, "[WEP]");
2838                 if (os_snprintf_error(end - pos, ret))
2839                         return -1;
2840                 pos += ret;
2841         }
2842         if (mesh) {
2843                 ret = os_snprintf(pos, end - pos, "[MESH]");
2844                 if (os_snprintf_error(end - pos, ret))
2845                         return -1;
2846                 pos += ret;
2847         }
2848         if (bss_is_dmg(bss)) {
2849                 const char *s;
2850                 ret = os_snprintf(pos, end - pos, "[DMG]");
2851                 if (os_snprintf_error(end - pos, ret))
2852                         return -1;
2853                 pos += ret;
2854                 switch (bss->caps & IEEE80211_CAP_DMG_MASK) {
2855                 case IEEE80211_CAP_DMG_IBSS:
2856                         s = "[IBSS]";
2857                         break;
2858                 case IEEE80211_CAP_DMG_AP:
2859                         s = "[ESS]";
2860                         break;
2861                 case IEEE80211_CAP_DMG_PBSS:
2862                         s = "[PBSS]";
2863                         break;
2864                 default:
2865                         s = "";
2866                         break;
2867                 }
2868                 ret = os_snprintf(pos, end - pos, "%s", s);
2869                 if (os_snprintf_error(end - pos, ret))
2870                         return -1;
2871                 pos += ret;
2872         } else {
2873                 if (bss->caps & IEEE80211_CAP_IBSS) {
2874                         ret = os_snprintf(pos, end - pos, "[IBSS]");
2875                         if (os_snprintf_error(end - pos, ret))
2876                                 return -1;
2877                         pos += ret;
2878                 }
2879                 if (bss->caps & IEEE80211_CAP_ESS) {
2880                         ret = os_snprintf(pos, end - pos, "[ESS]");
2881                         if (os_snprintf_error(end - pos, ret))
2882                                 return -1;
2883                         pos += ret;
2884                 }
2885         }
2886         if (p2p) {
2887                 ret = os_snprintf(pos, end - pos, "[P2P]");
2888                 if (os_snprintf_error(end - pos, ret))
2889                         return -1;
2890                 pos += ret;
2891         }
2892 #ifdef CONFIG_HS20
2893         if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE) && ie2) {
2894                 ret = os_snprintf(pos, end - pos, "[HS20]");
2895                 if (os_snprintf_error(end - pos, ret))
2896                         return -1;
2897                 pos += ret;
2898         }
2899 #endif /* CONFIG_HS20 */
2900 #ifdef CONFIG_FILS
2901         if (wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION)) {
2902                 ret = os_snprintf(pos, end - pos, "[FILS]");
2903                 if (os_snprintf_error(end - pos, ret))
2904                         return -1;
2905                 pos += ret;
2906         }
2907 #endif /* CONFIG_FILS */
2908 #ifdef CONFIG_FST
2909         if (wpa_bss_get_ie(bss, WLAN_EID_MULTI_BAND)) {
2910                 ret = os_snprintf(pos, end - pos, "[FST]");
2911                 if (os_snprintf_error(end - pos, ret))
2912                         return -1;
2913                 pos += ret;
2914         }
2915 #endif /* CONFIG_FST */
2916
2917         ret = os_snprintf(pos, end - pos, "\t%s",
2918                           wpa_ssid_txt(bss->ssid, bss->ssid_len));
2919         if (os_snprintf_error(end - pos, ret))
2920                 return -1;
2921         pos += ret;
2922
2923         ret = os_snprintf(pos, end - pos, "\n");
2924         if (os_snprintf_error(end - pos, ret))
2925                 return -1;
2926         pos += ret;
2927
2928         return pos - buf;
2929 }
2930
2931
2932 static int wpa_supplicant_ctrl_iface_scan_results(
2933         struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
2934 {
2935         char *pos, *end;
2936         struct wpa_bss *bss;
2937         int ret;
2938
2939         pos = buf;
2940         end = buf + buflen;
2941         ret = os_snprintf(pos, end - pos, "bssid / frequency / signal level / "
2942                           "flags / ssid\n");
2943         if (os_snprintf_error(end - pos, ret))
2944                 return pos - buf;
2945         pos += ret;
2946
2947         dl_list_for_each(bss, &wpa_s->bss_id, struct wpa_bss, list_id) {
2948                 ret = wpa_supplicant_ctrl_iface_scan_result(wpa_s, bss, pos,
2949                                                             end - pos);
2950                 if (ret < 0 || ret >= end - pos)
2951                         return pos - buf;
2952                 pos += ret;
2953         }
2954
2955         return pos - buf;
2956 }
2957
2958
2959 #ifdef CONFIG_MESH
2960
2961 static int wpa_supplicant_ctrl_iface_mesh_interface_add(
2962         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
2963 {
2964         char *pos, ifname[IFNAMSIZ + 1];
2965
2966         ifname[0] = '\0';
2967
2968         pos = os_strstr(cmd, "ifname=");
2969         if (pos) {
2970                 pos += 7;
2971                 os_strlcpy(ifname, pos, sizeof(ifname));
2972         }
2973
2974         if (wpas_mesh_add_interface(wpa_s, ifname, sizeof(ifname)) < 0)
2975                 return -1;
2976
2977         os_strlcpy(reply, ifname, max_len);
2978         return os_strlen(ifname);
2979 }
2980
2981
2982 static int wpa_supplicant_ctrl_iface_mesh_group_add(
2983         struct wpa_supplicant *wpa_s, char *cmd)
2984 {
2985         int id;
2986         struct wpa_ssid *ssid;
2987
2988         id = atoi(cmd);
2989         wpa_printf(MSG_DEBUG, "CTRL_IFACE: MESH_GROUP_ADD id=%d", id);
2990
2991         ssid = wpa_config_get_network(wpa_s->conf, id);
2992         if (ssid == NULL) {
2993                 wpa_printf(MSG_DEBUG,
2994                            "CTRL_IFACE: Could not find network id=%d", id);
2995                 return -1;
2996         }
2997         if (ssid->mode != WPAS_MODE_MESH) {
2998                 wpa_printf(MSG_DEBUG,
2999                            "CTRL_IFACE: Cannot use MESH_GROUP_ADD on a non mesh network");
3000                 return -1;
3001         }
3002         if (ssid->key_mgmt != WPA_KEY_MGMT_NONE &&
3003             ssid->key_mgmt != WPA_KEY_MGMT_SAE) {
3004                 wpa_printf(MSG_ERROR,
3005                            "CTRL_IFACE: key_mgmt for mesh network should be open or SAE");
3006                 return -1;
3007         }
3008
3009         /*
3010          * TODO: If necessary write our own group_add function,
3011          * for now we can reuse select_network
3012          */
3013         wpa_supplicant_select_network(wpa_s, ssid);
3014
3015         return 0;
3016 }
3017
3018
3019 static int wpa_supplicant_ctrl_iface_mesh_group_remove(
3020         struct wpa_supplicant *wpa_s, char *cmd)
3021 {
3022         struct wpa_supplicant *orig;
3023         struct wpa_global *global;
3024         int found = 0;
3025
3026         wpa_printf(MSG_DEBUG, "CTRL_IFACE: MESH_GROUP_REMOVE ifname=%s", cmd);
3027
3028         global = wpa_s->global;
3029         orig = wpa_s;
3030
3031         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
3032                 if (os_strcmp(wpa_s->ifname, cmd) == 0) {
3033                         found = 1;
3034                         break;
3035                 }
3036         }
3037         if (!found) {
3038                 wpa_printf(MSG_ERROR,
3039                            "CTRL_IFACE: MESH_GROUP_REMOVE ifname=%s not found",
3040                            cmd);
3041                 return -1;
3042         }
3043         if (wpa_s->mesh_if_created && wpa_s == orig) {
3044                 wpa_printf(MSG_ERROR,
3045                            "CTRL_IFACE: MESH_GROUP_REMOVE can't remove itself");
3046                 return -1;
3047         }
3048
3049         wpa_s->reassociate = 0;
3050         wpa_s->disconnected = 1;
3051         wpa_supplicant_cancel_sched_scan(wpa_s);
3052         wpa_supplicant_cancel_scan(wpa_s);
3053
3054         /*
3055          * TODO: If necessary write our own group_remove function,
3056          * for now we can reuse deauthenticate
3057          */
3058         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
3059
3060         if (wpa_s->mesh_if_created)
3061                 wpa_supplicant_remove_iface(global, wpa_s, 0);
3062
3063         return 0;
3064 }
3065
3066
3067 static int wpa_supplicant_ctrl_iface_mesh_peer_remove(
3068         struct wpa_supplicant *wpa_s, char *cmd)
3069 {
3070         u8 addr[ETH_ALEN];
3071
3072         if (hwaddr_aton(cmd, addr) < 0)
3073                 return -1;
3074
3075         return wpas_mesh_peer_remove(wpa_s, addr);
3076 }
3077
3078
3079 static int wpa_supplicant_ctrl_iface_mesh_peer_add(
3080         struct wpa_supplicant *wpa_s, char *cmd)
3081 {
3082         u8 addr[ETH_ALEN];
3083         int duration;
3084         char *pos;
3085
3086         pos = os_strstr(cmd, " duration=");
3087         if (pos) {
3088                 *pos = '\0';
3089                 duration = atoi(pos + 10);
3090         } else {
3091                 duration = -1;
3092         }
3093
3094         if (hwaddr_aton(cmd, addr))
3095                 return -1;
3096
3097         return wpas_mesh_peer_add(wpa_s, addr, duration);
3098 }
3099
3100 #endif /* CONFIG_MESH */
3101
3102
3103 static int wpa_supplicant_ctrl_iface_select_network(
3104         struct wpa_supplicant *wpa_s, char *cmd)
3105 {
3106         int id;
3107         struct wpa_ssid *ssid;
3108         char *pos;
3109
3110         /* cmd: "<network id>" or "any" */
3111         if (os_strncmp(cmd, "any", 3) == 0) {
3112                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK any");
3113                 ssid = NULL;
3114         } else {
3115                 id = atoi(cmd);
3116                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK id=%d", id);
3117
3118                 ssid = wpa_config_get_network(wpa_s->conf, id);
3119                 if (ssid == NULL) {
3120                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3121                                    "network id=%d", id);
3122                         return -1;
3123                 }
3124                 if (ssid->disabled == 2) {
3125                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
3126                                    "SELECT_NETWORK with persistent P2P group");
3127                         return -1;
3128                 }
3129         }
3130
3131         pos = os_strstr(cmd, " freq=");
3132         if (pos) {
3133                 int *freqs = freq_range_to_channel_list(wpa_s, pos + 6);
3134                 if (freqs) {
3135                         os_free(wpa_s->select_network_scan_freqs);
3136                         wpa_s->select_network_scan_freqs = freqs;
3137                 }
3138         }
3139
3140         wpa_s->scan_min_time.sec = 0;
3141         wpa_s->scan_min_time.usec = 0;
3142         wpa_supplicant_select_network(wpa_s, ssid);
3143
3144         return 0;
3145 }
3146
3147
3148 static int wpa_supplicant_ctrl_iface_enable_network(
3149         struct wpa_supplicant *wpa_s, char *cmd)
3150 {
3151         int id;
3152         struct wpa_ssid *ssid;
3153
3154         /* cmd: "<network id>" or "all" */
3155         if (os_strcmp(cmd, "all") == 0) {
3156                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK all");
3157                 ssid = NULL;
3158         } else {
3159                 id = atoi(cmd);
3160                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK id=%d", id);
3161
3162                 ssid = wpa_config_get_network(wpa_s->conf, id);
3163                 if (ssid == NULL) {
3164                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3165                                    "network id=%d", id);
3166                         return -1;
3167                 }
3168                 if (ssid->disabled == 2) {
3169                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
3170                                    "ENABLE_NETWORK with persistent P2P group");
3171                         return -1;
3172                 }
3173
3174                 if (os_strstr(cmd, " no-connect")) {
3175                         ssid->disabled = 0;
3176                         return 0;
3177                 }
3178         }
3179         wpa_s->scan_min_time.sec = 0;
3180         wpa_s->scan_min_time.usec = 0;
3181         wpa_supplicant_enable_network(wpa_s, ssid);
3182
3183         return 0;
3184 }
3185
3186
3187 static int wpa_supplicant_ctrl_iface_disable_network(
3188         struct wpa_supplicant *wpa_s, char *cmd)
3189 {
3190         int id;
3191         struct wpa_ssid *ssid;
3192
3193         /* cmd: "<network id>" or "all" */
3194         if (os_strcmp(cmd, "all") == 0) {
3195                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK all");
3196                 ssid = NULL;
3197         } else {
3198                 id = atoi(cmd);
3199                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK id=%d", id);
3200
3201                 ssid = wpa_config_get_network(wpa_s->conf, id);
3202                 if (ssid == NULL) {
3203                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3204                                    "network id=%d", id);
3205                         return -1;
3206                 }
3207                 if (ssid->disabled == 2) {
3208                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
3209                                    "DISABLE_NETWORK with persistent P2P "
3210                                    "group");
3211                         return -1;
3212                 }
3213         }
3214         wpa_supplicant_disable_network(wpa_s, ssid);
3215
3216         return 0;
3217 }
3218
3219
3220 static int wpa_supplicant_ctrl_iface_add_network(
3221         struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
3222 {
3223         struct wpa_ssid *ssid;
3224         int ret;
3225
3226         wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_NETWORK");
3227
3228         ssid = wpa_supplicant_add_network(wpa_s);
3229         if (ssid == NULL)
3230                 return -1;
3231
3232         ret = os_snprintf(buf, buflen, "%d\n", ssid->id);
3233         if (os_snprintf_error(buflen, ret))
3234                 return -1;
3235         return ret;
3236 }
3237
3238
3239 static int wpa_supplicant_ctrl_iface_remove_network(
3240         struct wpa_supplicant *wpa_s, char *cmd)
3241 {
3242         int id;
3243         struct wpa_ssid *ssid;
3244         int result;
3245
3246         /* cmd: "<network id>" or "all" */
3247         if (os_strcmp(cmd, "all") == 0) {
3248                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK all");
3249                 if (wpa_s->sched_scanning)
3250                         wpa_supplicant_cancel_sched_scan(wpa_s);
3251
3252                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
3253                 if (wpa_s->current_ssid) {
3254 #ifdef CONFIG_SME
3255                         wpa_s->sme.prev_bssid_set = 0;
3256 #endif /* CONFIG_SME */
3257                         wpa_sm_set_config(wpa_s->wpa, NULL);
3258                         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
3259                         if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
3260                                 wpa_s->own_disconnect_req = 1;
3261                         wpa_supplicant_deauthenticate(
3262                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
3263                 }
3264                 ssid = wpa_s->conf->ssid;
3265                 while (ssid) {
3266                         struct wpa_ssid *remove_ssid = ssid;
3267                         id = ssid->id;
3268                         ssid = ssid->next;
3269                         if (wpa_s->last_ssid == remove_ssid)
3270                                 wpa_s->last_ssid = NULL;
3271                         wpas_notify_network_removed(wpa_s, remove_ssid);
3272                         wpa_config_remove_network(wpa_s->conf, id);
3273                 }
3274                 return 0;
3275         }
3276
3277         id = atoi(cmd);
3278         wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK id=%d", id);
3279
3280         result = wpa_supplicant_remove_network(wpa_s, id);
3281         if (result == -1) {
3282                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
3283                            "id=%d", id);
3284                 return -1;
3285         }
3286         if (result == -2) {
3287                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Not able to remove the "
3288                            "network id=%d", id);
3289                 return -1;
3290         }
3291         return 0;
3292 }
3293
3294
3295 static int wpa_supplicant_ctrl_iface_update_network(
3296         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3297         char *name, char *value)
3298 {
3299         int ret;
3300
3301         ret = wpa_config_set(ssid, name, value, 0);
3302         if (ret < 0) {
3303                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set network "
3304                            "variable '%s'", name);
3305                 return -1;
3306         }
3307         if (ret == 1)
3308                 return 0; /* No change to the previously configured value */
3309
3310         if (os_strcmp(name, "bssid") != 0 &&
3311             os_strcmp(name, "bssid_hint") != 0 &&
3312             os_strcmp(name, "priority") != 0) {
3313                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
3314
3315                 if (wpa_s->current_ssid == ssid ||
3316                     wpa_s->current_ssid == NULL) {
3317                         /*
3318                          * Invalidate the EAP session cache if anything in the
3319                          * current or previously used configuration changes.
3320                          */
3321                         eapol_sm_invalidate_cached_session(wpa_s->eapol);
3322                 }
3323         }
3324
3325         if ((os_strcmp(name, "psk") == 0 &&
3326              value[0] == '"' && ssid->ssid_len) ||
3327             (os_strcmp(name, "ssid") == 0 && ssid->passphrase))
3328                 wpa_config_update_psk(ssid);
3329         else if (os_strcmp(name, "priority") == 0)
3330                 wpa_config_update_prio_list(wpa_s->conf);
3331
3332         return 0;
3333 }
3334
3335
3336 static int wpa_supplicant_ctrl_iface_set_network(
3337         struct wpa_supplicant *wpa_s, char *cmd)
3338 {
3339         int id, ret, prev_bssid_set, prev_disabled;
3340         struct wpa_ssid *ssid;
3341         char *name, *value;
3342         u8 prev_bssid[ETH_ALEN];
3343
3344         /* cmd: "<network id> <variable name> <value>" */
3345         name = os_strchr(cmd, ' ');
3346         if (name == NULL)
3347                 return -1;
3348         *name++ = '\0';
3349
3350         value = os_strchr(name, ' ');
3351         if (value == NULL)
3352                 return -1;
3353         *value++ = '\0';
3354
3355         id = atoi(cmd);
3356         wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_NETWORK id=%d name='%s'",
3357                    id, name);
3358         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
3359                               (u8 *) value, os_strlen(value));
3360
3361         ssid = wpa_config_get_network(wpa_s->conf, id);
3362         if (ssid == NULL) {
3363                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
3364                            "id=%d", id);
3365                 return -1;
3366         }
3367
3368         prev_bssid_set = ssid->bssid_set;
3369         prev_disabled = ssid->disabled;
3370         os_memcpy(prev_bssid, ssid->bssid, ETH_ALEN);
3371         ret = wpa_supplicant_ctrl_iface_update_network(wpa_s, ssid, name,
3372                                                        value);
3373         if (ret == 0 &&
3374             (ssid->bssid_set != prev_bssid_set ||
3375              os_memcmp(ssid->bssid, prev_bssid, ETH_ALEN) != 0))
3376                 wpas_notify_network_bssid_set_changed(wpa_s, ssid);
3377
3378         if (prev_disabled != ssid->disabled &&
3379             (prev_disabled == 2 || ssid->disabled == 2))
3380                 wpas_notify_network_type_changed(wpa_s, ssid);
3381
3382         return ret;
3383 }
3384
3385
3386 static int wpa_supplicant_ctrl_iface_get_network(
3387         struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
3388 {
3389         int id;
3390         size_t res;
3391         struct wpa_ssid *ssid;
3392         char *name, *value;
3393
3394         /* cmd: "<network id> <variable name>" */
3395         name = os_strchr(cmd, ' ');
3396         if (name == NULL || buflen == 0)
3397                 return -1;
3398         *name++ = '\0';
3399
3400         id = atoi(cmd);
3401         wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: GET_NETWORK id=%d name='%s'",
3402                    id, name);
3403
3404         ssid = wpa_config_get_network(wpa_s->conf, id);
3405         if (ssid == NULL) {
3406                 wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: Could not find network "
3407                            "id=%d", id);
3408                 return -1;
3409         }
3410
3411         value = wpa_config_get_no_key(ssid, name);
3412         if (value == NULL) {
3413                 wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: Failed to get network "
3414                            "variable '%s'", name);
3415                 return -1;
3416         }
3417
3418         res = os_strlcpy(buf, value, buflen);
3419         if (res >= buflen) {
3420                 os_free(value);
3421                 return -1;
3422         }
3423
3424         os_free(value);
3425
3426         return res;
3427 }
3428
3429
3430 static int wpa_supplicant_ctrl_iface_dup_network(
3431         struct wpa_supplicant *wpa_s, char *cmd,
3432         struct wpa_supplicant *dst_wpa_s)
3433 {
3434         struct wpa_ssid *ssid_s, *ssid_d;
3435         char *name, *id, *value;
3436         int id_s, id_d, ret;
3437
3438         /* cmd: "<src network id> <dst network id> <variable name>" */
3439         id = os_strchr(cmd, ' ');
3440         if (id == NULL)
3441                 return -1;
3442         *id++ = '\0';
3443
3444         name = os_strchr(id, ' ');
3445         if (name == NULL)
3446                 return -1;
3447         *name++ = '\0';
3448
3449         id_s = atoi(cmd);
3450         id_d = atoi(id);
3451
3452         wpa_printf(MSG_DEBUG,
3453                    "CTRL_IFACE: DUP_NETWORK ifname=%s->%s id=%d->%d name='%s'",
3454                    wpa_s->ifname, dst_wpa_s->ifname, id_s, id_d, name);
3455
3456         ssid_s = wpa_config_get_network(wpa_s->conf, id_s);
3457         if (ssid_s == NULL) {
3458                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3459                            "network id=%d", id_s);
3460                 return -1;
3461         }
3462
3463         ssid_d = wpa_config_get_network(dst_wpa_s->conf, id_d);
3464         if (ssid_d == NULL) {
3465                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3466                            "network id=%d", id_d);
3467                 return -1;
3468         }
3469
3470         value = wpa_config_get(ssid_s, name);
3471         if (value == NULL) {
3472                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get network "
3473                            "variable '%s'", name);
3474                 return -1;
3475         }
3476
3477         ret = wpa_supplicant_ctrl_iface_update_network(dst_wpa_s, ssid_d, name,
3478                                                        value);
3479
3480         os_free(value);
3481
3482         return ret;
3483 }
3484
3485
3486 static int wpa_supplicant_ctrl_iface_list_creds(struct wpa_supplicant *wpa_s,
3487                                                 char *buf, size_t buflen)
3488 {
3489         char *pos, *end;
3490         struct wpa_cred *cred;
3491         int ret;
3492
3493         pos = buf;
3494         end = buf + buflen;
3495         ret = os_snprintf(pos, end - pos,
3496                           "cred id / realm / username / domain / imsi\n");
3497         if (os_snprintf_error(end - pos, ret))
3498                 return pos - buf;
3499         pos += ret;
3500
3501         cred = wpa_s->conf->cred;
3502         while (cred) {
3503                 ret = os_snprintf(pos, end - pos, "%d\t%s\t%s\t%s\t%s\n",
3504                                   cred->id, cred->realm ? cred->realm : "",
3505                                   cred->username ? cred->username : "",
3506                                   cred->domain ? cred->domain[0] : "",
3507                                   cred->imsi ? cred->imsi : "");
3508                 if (os_snprintf_error(end - pos, ret))
3509                         return pos - buf;
3510                 pos += ret;
3511
3512                 cred = cred->next;
3513         }
3514
3515         return pos - buf;
3516 }
3517
3518
3519 static int wpa_supplicant_ctrl_iface_add_cred(struct wpa_supplicant *wpa_s,
3520                                               char *buf, size_t buflen)
3521 {
3522         struct wpa_cred *cred;
3523         int ret;
3524
3525         wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_CRED");
3526
3527         cred = wpa_config_add_cred(wpa_s->conf);
3528         if (cred == NULL)
3529                 return -1;
3530
3531         wpa_msg(wpa_s, MSG_INFO, CRED_ADDED "%d", cred->id);
3532
3533         ret = os_snprintf(buf, buflen, "%d\n", cred->id);
3534         if (os_snprintf_error(buflen, ret))
3535                 return -1;
3536         return ret;
3537 }
3538
3539
3540 static int wpas_ctrl_remove_cred(struct wpa_supplicant *wpa_s,
3541                                  struct wpa_cred *cred)
3542 {
3543         struct wpa_ssid *ssid;
3544         char str[20];
3545         int id;
3546
3547         if (cred == NULL) {
3548                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred");
3549                 return -1;
3550         }
3551
3552         id = cred->id;
3553         if (wpa_config_remove_cred(wpa_s->conf, id) < 0) {
3554                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred");
3555                 return -1;
3556         }
3557
3558         wpa_msg(wpa_s, MSG_INFO, CRED_REMOVED "%d", id);
3559
3560         /* Remove any network entry created based on the removed credential */
3561         ssid = wpa_s->conf->ssid;
3562         while (ssid) {
3563                 if (ssid->parent_cred == cred) {
3564                         int res;
3565
3566                         wpa_printf(MSG_DEBUG, "Remove network id %d since it "
3567                                    "used the removed credential", ssid->id);
3568                         res = os_snprintf(str, sizeof(str), "%d", ssid->id);
3569                         if (os_snprintf_error(sizeof(str), res))
3570                                 str[sizeof(str) - 1] = '\0';
3571                         ssid = ssid->next;
3572                         wpa_supplicant_ctrl_iface_remove_network(wpa_s, str);
3573                 } else
3574                         ssid = ssid->next;
3575         }
3576
3577         return 0;
3578 }
3579
3580
3581 static int wpa_supplicant_ctrl_iface_remove_cred(struct wpa_supplicant *wpa_s,
3582                                                  char *cmd)
3583 {
3584         int id;
3585         struct wpa_cred *cred, *prev;
3586
3587         /* cmd: "<cred id>", "all", "sp_fqdn=<FQDN>", or
3588          * "provisioning_sp=<FQDN> */
3589         if (os_strcmp(cmd, "all") == 0) {
3590                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED all");
3591                 cred = wpa_s->conf->cred;
3592                 while (cred) {
3593                         prev = cred;
3594                         cred = cred->next;
3595                         wpas_ctrl_remove_cred(wpa_s, prev);
3596                 }
3597                 return 0;
3598         }
3599
3600         if (os_strncmp(cmd, "sp_fqdn=", 8) == 0) {
3601                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED SP FQDN '%s'",
3602                            cmd + 8);
3603                 cred = wpa_s->conf->cred;
3604                 while (cred) {
3605                         prev = cred;
3606                         cred = cred->next;
3607                         if (prev->domain) {
3608                                 size_t i;
3609                                 for (i = 0; i < prev->num_domain; i++) {
3610                                         if (os_strcmp(prev->domain[i], cmd + 8)
3611                                             != 0)
3612                                                 continue;
3613                                         wpas_ctrl_remove_cred(wpa_s, prev);
3614                                         break;
3615                                 }
3616                         }
3617                 }
3618                 return 0;
3619         }
3620
3621         if (os_strncmp(cmd, "provisioning_sp=", 16) == 0) {
3622                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED provisioning SP FQDN '%s'",
3623                            cmd + 16);
3624                 cred = wpa_s->conf->cred;
3625                 while (cred) {
3626                         prev = cred;
3627                         cred = cred->next;
3628                         if (prev->provisioning_sp &&
3629                             os_strcmp(prev->provisioning_sp, cmd + 16) == 0)
3630                                 wpas_ctrl_remove_cred(wpa_s, prev);
3631                 }
3632                 return 0;
3633         }
3634
3635         id = atoi(cmd);
3636         wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED id=%d", id);
3637
3638         cred = wpa_config_get_cred(wpa_s->conf, id);
3639         return wpas_ctrl_remove_cred(wpa_s, cred);
3640 }
3641
3642
3643 static int wpa_supplicant_ctrl_iface_set_cred(struct wpa_supplicant *wpa_s,
3644                                               char *cmd)
3645 {
3646         int id;
3647         struct wpa_cred *cred;
3648         char *name, *value;
3649
3650         /* cmd: "<cred id> <variable name> <value>" */
3651         name = os_strchr(cmd, ' ');
3652         if (name == NULL)
3653                 return -1;
3654         *name++ = '\0';
3655
3656         value = os_strchr(name, ' ');
3657         if (value == NULL)
3658                 return -1;
3659         *value++ = '\0';
3660
3661         id = atoi(cmd);
3662         wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_CRED id=%d name='%s'",
3663                    id, name);
3664         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
3665                               (u8 *) value, os_strlen(value));
3666
3667         cred = wpa_config_get_cred(wpa_s->conf, id);
3668         if (cred == NULL) {
3669                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
3670                            id);
3671                 return -1;
3672         }
3673
3674         if (wpa_config_set_cred(cred, name, value, 0) < 0) {
3675                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set cred "
3676                            "variable '%s'", name);
3677                 return -1;
3678         }
3679
3680         wpa_msg(wpa_s, MSG_INFO, CRED_MODIFIED "%d %s", cred->id, name);
3681
3682         return 0;
3683 }
3684
3685
3686 static int wpa_supplicant_ctrl_iface_get_cred(struct wpa_supplicant *wpa_s,
3687                                               char *cmd, char *buf,
3688                                               size_t buflen)
3689 {
3690         int id;
3691         size_t res;
3692         struct wpa_cred *cred;
3693         char *name, *value;
3694
3695         /* cmd: "<cred id> <variable name>" */
3696         name = os_strchr(cmd, ' ');
3697         if (name == NULL)
3698                 return -1;
3699         *name++ = '\0';
3700
3701         id = atoi(cmd);
3702         wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CRED id=%d name='%s'",
3703                    id, name);
3704
3705         cred = wpa_config_get_cred(wpa_s->conf, id);
3706         if (cred == NULL) {
3707                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
3708                            id);
3709                 return -1;
3710         }
3711
3712         value = wpa_config_get_cred_no_key(cred, name);
3713         if (value == NULL) {
3714                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get cred variable '%s'",
3715                            name);
3716                 return -1;
3717         }
3718
3719         res = os_strlcpy(buf, value, buflen);
3720         if (res >= buflen) {
3721                 os_free(value);
3722                 return -1;
3723         }
3724
3725         os_free(value);
3726
3727         return res;
3728 }
3729
3730
3731 #ifndef CONFIG_NO_CONFIG_WRITE
3732 static int wpa_supplicant_ctrl_iface_save_config(struct wpa_supplicant *wpa_s)
3733 {
3734         int ret;
3735
3736         if (!wpa_s->conf->update_config) {
3737                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed "
3738                            "to update configuration (update_config=0)");
3739                 return -1;
3740         }
3741
3742         ret = wpa_config_write(wpa_s->confname, wpa_s->conf);
3743         if (ret) {
3744                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to "
3745                            "update configuration");
3746         } else {
3747                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration"
3748                            " updated");
3749         }
3750
3751         return ret;
3752 }
3753 #endif /* CONFIG_NO_CONFIG_WRITE */
3754
3755
3756 struct cipher_info {
3757         unsigned int capa;
3758         const char *name;
3759         int group_only;
3760 };
3761
3762 static const struct cipher_info ciphers[] = {
3763         { WPA_DRIVER_CAPA_ENC_CCMP_256, "CCMP-256", 0 },
3764         { WPA_DRIVER_CAPA_ENC_GCMP_256, "GCMP-256", 0 },
3765         { WPA_DRIVER_CAPA_ENC_CCMP, "CCMP", 0 },
3766         { WPA_DRIVER_CAPA_ENC_GCMP, "GCMP", 0 },
3767         { WPA_DRIVER_CAPA_ENC_TKIP, "TKIP", 0 },
3768         { WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE, "NONE", 0 },
3769         { WPA_DRIVER_CAPA_ENC_WEP104, "WEP104", 1 },
3770         { WPA_DRIVER_CAPA_ENC_WEP40, "WEP40", 1 }
3771 };
3772
3773 static const struct cipher_info ciphers_group_mgmt[] = {
3774         { WPA_DRIVER_CAPA_ENC_BIP, "AES-128-CMAC", 1 },
3775         { WPA_DRIVER_CAPA_ENC_BIP_GMAC_128, "BIP-GMAC-128", 1 },
3776         { WPA_DRIVER_CAPA_ENC_BIP_GMAC_256, "BIP-GMAC-256", 1 },
3777         { WPA_DRIVER_CAPA_ENC_BIP_CMAC_256, "BIP-CMAC-256", 1 },
3778 };
3779
3780
3781 static int ctrl_iface_get_capability_pairwise(int res, char *strict,
3782                                               struct wpa_driver_capa *capa,
3783                                               char *buf, size_t buflen)
3784 {
3785         int ret;
3786         char *pos, *end;
3787         size_t len;
3788         unsigned int i;
3789
3790         pos = buf;
3791         end = pos + buflen;
3792
3793         if (res < 0) {
3794                 if (strict)
3795                         return 0;
3796                 len = os_strlcpy(buf, "CCMP TKIP NONE", buflen);
3797                 if (len >= buflen)
3798                         return -1;
3799                 return len;
3800         }
3801
3802         for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
3803                 if (!ciphers[i].group_only && capa->enc & ciphers[i].capa) {
3804                         ret = os_snprintf(pos, end - pos, "%s%s",
3805                                           pos == buf ? "" : " ",
3806                                           ciphers[i].name);
3807                         if (os_snprintf_error(end - pos, ret))
3808                                 return pos - buf;
3809                         pos += ret;
3810                 }
3811         }
3812
3813         return pos - buf;
3814 }
3815
3816
3817 static int ctrl_iface_get_capability_group(int res, char *strict,
3818                                            struct wpa_driver_capa *capa,
3819                                            char *buf, size_t buflen)
3820 {
3821         int ret;
3822         char *pos, *end;
3823         size_t len;
3824         unsigned int i;
3825
3826         pos = buf;
3827         end = pos + buflen;
3828
3829         if (res < 0) {
3830                 if (strict)
3831                         return 0;
3832                 len = os_strlcpy(buf, "CCMP TKIP WEP104 WEP40", buflen);
3833                 if (len >= buflen)
3834                         return -1;
3835                 return len;
3836         }
3837
3838         for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
3839                 if (capa->enc & ciphers[i].capa) {
3840                         ret = os_snprintf(pos, end - pos, "%s%s",
3841                                           pos == buf ? "" : " ",
3842                                           ciphers[i].name);
3843                         if (os_snprintf_error(end - pos, ret))
3844                                 return pos - buf;
3845                         pos += ret;
3846                 }
3847         }
3848
3849         return pos - buf;
3850 }
3851
3852
3853 static int ctrl_iface_get_capability_group_mgmt(int res, char *strict,
3854                                                 struct wpa_driver_capa *capa,
3855                                                 char *buf, size_t buflen)
3856 {
3857         int ret;
3858         char *pos, *end;
3859         unsigned int i;
3860
3861         pos = buf;
3862         end = pos + buflen;
3863
3864         if (res < 0)
3865                 return 0;
3866
3867         for (i = 0; i < ARRAY_SIZE(ciphers_group_mgmt); i++) {
3868                 if (capa->enc & ciphers_group_mgmt[i].capa) {
3869                         ret = os_snprintf(pos, end - pos, "%s%s",
3870                                           pos == buf ? "" : " ",
3871                                           ciphers_group_mgmt[i].name);
3872                         if (os_snprintf_error(end - pos, ret))
3873                                 return pos - buf;
3874                         pos += ret;
3875                 }
3876         }
3877
3878         return pos - buf;
3879 }
3880
3881
3882 static int ctrl_iface_get_capability_key_mgmt(int res, char *strict,
3883                                               struct wpa_driver_capa *capa,
3884                                               char *buf, size_t buflen)
3885 {
3886         int ret;
3887         char *pos, *end;
3888         size_t len;
3889
3890         pos = buf;
3891         end = pos + buflen;
3892
3893         if (res < 0) {
3894                 if (strict)
3895                         return 0;
3896                 len = os_strlcpy(buf, "WPA-PSK WPA-EAP IEEE8021X WPA-NONE "
3897                                  "NONE", buflen);
3898                 if (len >= buflen)
3899                         return -1;
3900                 return len;
3901         }
3902
3903         ret = os_snprintf(pos, end - pos, "NONE IEEE8021X");
3904         if (os_snprintf_error(end - pos, ret))
3905                 return pos - buf;
3906         pos += ret;
3907
3908         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3909                               WPA_DRIVER_CAPA_KEY_MGMT_WPA2)) {
3910                 ret = os_snprintf(pos, end - pos, " WPA-EAP");
3911                 if (os_snprintf_error(end - pos, ret))
3912                         return pos - buf;
3913                 pos += ret;
3914         }
3915
3916         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
3917                               WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
3918                 ret = os_snprintf(pos, end - pos, " WPA-PSK");
3919                 if (os_snprintf_error(end - pos, ret))
3920                         return pos - buf;
3921                 pos += ret;
3922         }
3923
3924         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE) {
3925                 ret = os_snprintf(pos, end - pos, " WPA-NONE");
3926                 if (os_snprintf_error(end - pos, ret))
3927                         return pos - buf;
3928                 pos += ret;
3929         }
3930
3931 #ifdef CONFIG_SUITEB
3932         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B) {
3933                 ret = os_snprintf(pos, end - pos, " WPA-EAP-SUITE-B");
3934                 if (os_snprintf_error(end - pos, ret))
3935                         return pos - buf;
3936                 pos += ret;
3937         }
3938 #endif /* CONFIG_SUITEB */
3939 #ifdef CONFIG_SUITEB192
3940         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B_192) {
3941                 ret = os_snprintf(pos, end - pos, " WPA-EAP-SUITE-B-192");
3942                 if (os_snprintf_error(end - pos, ret))
3943                         return pos - buf;
3944                 pos += ret;
3945         }
3946 #endif /* CONFIG_SUITEB192 */
3947 #ifdef CONFIG_OWE
3948         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_OWE) {
3949                 ret = os_snprintf(pos, end - pos, " OWE");
3950                 if (os_snprintf_error(end - pos, ret))
3951                         return pos - buf;
3952                 pos += ret;
3953         }
3954 #endif /* CONFIG_OWE */
3955 #ifdef CONFIG_DPP
3956         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_DPP) {
3957                 ret = os_snprintf(pos, end - pos, " DPP");
3958                 if (os_snprintf_error(end - pos, ret))
3959                         return pos - buf;
3960                 pos += ret;
3961         }
3962 #endif /* CONFIG_DPP */
3963 #ifdef CONFIG_FILS
3964         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA256) {
3965                 ret = os_snprintf(pos, end - pos, " FILS-SHA256");
3966                 if (os_snprintf_error(end - pos, ret))
3967                         return pos - buf;
3968                 pos += ret;
3969         }
3970         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA384) {
3971                 ret = os_snprintf(pos, end - pos, " FILS-SHA384");
3972                 if (os_snprintf_error(end - pos, ret))
3973                         return pos - buf;
3974                 pos += ret;
3975         }
3976 #ifdef CONFIG_IEEE80211R
3977         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT_FILS_SHA256) {
3978                 ret = os_snprintf(pos, end - pos, " FT-FILS-SHA256");
3979                 if (os_snprintf_error(end - pos, ret))
3980                         return pos - buf;
3981                 pos += ret;
3982         }
3983         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT_FILS_SHA384) {
3984                 ret = os_snprintf(pos, end - pos, " FT-FILS-SHA384");
3985                 if (os_snprintf_error(end - pos, ret))
3986                         return pos - buf;
3987                 pos += ret;
3988         }
3989 #endif /* CONFIG_IEEE80211R */
3990 #endif /* CONFIG_FILS */
3991 #ifdef CONFIG_SAE
3992         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SAE) {
3993                 ret = os_snprintf(pos, end - pos, " SAE");
3994                 if (os_snprintf_error(end - pos, ret))
3995                         return pos - buf;
3996                 pos += ret;
3997         }
3998 #endif /* CONFIG_SAE */
3999
4000         return pos - buf;
4001 }
4002
4003
4004 static int ctrl_iface_get_capability_proto(int res, char *strict,
4005                                            struct wpa_driver_capa *capa,
4006                                            char *buf, size_t buflen)
4007 {
4008         int ret;
4009         char *pos, *end;
4010         size_t len;
4011
4012         pos = buf;
4013         end = pos + buflen;
4014
4015         if (res < 0) {
4016                 if (strict)
4017                         return 0;
4018                 len = os_strlcpy(buf, "RSN WPA", buflen);
4019                 if (len >= buflen)
4020                         return -1;
4021                 return len;
4022         }
4023
4024         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
4025                               WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
4026                 ret = os_snprintf(pos, end - pos, "%sRSN",
4027                                   pos == buf ? "" : " ");
4028                 if (os_snprintf_error(end - pos, ret))
4029                         return pos - buf;
4030                 pos += ret;
4031         }
4032
4033         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
4034                               WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK)) {
4035                 ret = os_snprintf(pos, end - pos, "%sWPA",
4036                                   pos == buf ? "" : " ");
4037                 if (os_snprintf_error(end - pos, ret))
4038                         return pos - buf;
4039                 pos += ret;
4040         }
4041
4042         return pos - buf;
4043 }
4044
4045
4046 static int ctrl_iface_get_capability_auth_alg(struct wpa_supplicant *wpa_s,
4047                                               int res, char *strict,
4048                                               struct wpa_driver_capa *capa,
4049                                               char *buf, size_t buflen)
4050 {
4051         int ret;
4052         char *pos, *end;
4053         size_t len;
4054
4055         pos = buf;
4056         end = pos + buflen;
4057
4058         if (res < 0) {
4059                 if (strict)
4060                         return 0;
4061                 len = os_strlcpy(buf, "OPEN SHARED LEAP", buflen);
4062                 if (len >= buflen)
4063                         return -1;
4064                 return len;
4065         }
4066
4067         if (capa->auth & (WPA_DRIVER_AUTH_OPEN)) {
4068                 ret = os_snprintf(pos, end - pos, "%sOPEN",
4069                                   pos == buf ? "" : " ");
4070                 if (os_snprintf_error(end - pos, ret))
4071                         return pos - buf;
4072                 pos += ret;
4073         }
4074
4075         if (capa->auth & (WPA_DRIVER_AUTH_SHARED)) {
4076                 ret = os_snprintf(pos, end - pos, "%sSHARED",
4077                                   pos == buf ? "" : " ");
4078                 if (os_snprintf_error(end - pos, ret))
4079                         return pos - buf;
4080                 pos += ret;
4081         }
4082
4083         if (capa->auth & (WPA_DRIVER_AUTH_LEAP)) {
4084                 ret = os_snprintf(pos, end - pos, "%sLEAP",
4085                                   pos == buf ? "" : " ");
4086                 if (os_snprintf_error(end - pos, ret))
4087                         return pos - buf;
4088                 pos += ret;
4089         }
4090
4091 #ifdef CONFIG_SAE
4092         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE) {
4093                 ret = os_snprintf(pos, end - pos, "%sSAE",
4094                                   pos == buf ? "" : " ");
4095                 if (os_snprintf_error(end - pos, ret))
4096                         return pos - buf;
4097                 pos += ret;
4098         }
4099 #endif /* CONFIG_SAE */
4100
4101 #ifdef CONFIG_FILS
4102         if (wpa_is_fils_supported(wpa_s)) {
4103                 ret = os_snprintf(pos, end - pos, "%sFILS_SK_WITHOUT_PFS",
4104                                   pos == buf ? "" : " ");
4105                 if (os_snprintf_error(end - pos, ret))
4106                         return pos - buf;
4107                 pos += ret;
4108         }
4109
4110 #ifdef CONFIG_FILS_SK_PFS
4111         if (wpa_is_fils_sk_pfs_supported(wpa_s)) {
4112                 ret = os_snprintf(pos, end - pos, "%sFILS_SK_WITH_PFS",
4113                                   pos == buf ? "" : " ");
4114                 if (os_snprintf_error(end - pos, ret))
4115                         return pos - buf;
4116                 pos += ret;
4117         }
4118 #endif /* CONFIG_FILS_SK_PFS */
4119 #endif /* CONFIG_FILS */
4120
4121         return pos - buf;
4122 }
4123
4124
4125 static int ctrl_iface_get_capability_modes(int res, char *strict,
4126                                            struct wpa_driver_capa *capa,
4127                                            char *buf, size_t buflen)
4128 {
4129         int ret;
4130         char *pos, *end;
4131         size_t len;
4132
4133         pos = buf;
4134         end = pos + buflen;
4135
4136         if (res < 0) {
4137                 if (strict)
4138                         return 0;
4139                 len = os_strlcpy(buf, "IBSS AP", buflen);
4140                 if (len >= buflen)
4141                         return -1;
4142                 return len;
4143         }
4144
4145         if (capa->flags & WPA_DRIVER_FLAGS_IBSS) {
4146                 ret = os_snprintf(pos, end - pos, "%sIBSS",
4147                                   pos == buf ? "" : " ");
4148                 if (os_snprintf_error(end - pos, ret))
4149                         return pos - buf;
4150                 pos += ret;
4151         }
4152
4153         if (capa->flags & WPA_DRIVER_FLAGS_AP) {
4154                 ret = os_snprintf(pos, end - pos, "%sAP",
4155                                   pos == buf ? "" : " ");
4156                 if (os_snprintf_error(end - pos, ret))
4157                         return pos - buf;
4158                 pos += ret;
4159         }
4160
4161 #ifdef CONFIG_MESH
4162         if (capa->flags & WPA_DRIVER_FLAGS_MESH) {
4163                 ret = os_snprintf(pos, end - pos, "%sMESH",
4164                                   pos == buf ? "" : " ");
4165                 if (os_snprintf_error(end - pos, ret))
4166                         return pos - buf;
4167                 pos += ret;
4168         }
4169 #endif /* CONFIG_MESH */
4170
4171         return pos - buf;
4172 }
4173
4174
4175 static int ctrl_iface_get_capability_channels(struct wpa_supplicant *wpa_s,
4176                                               char *buf, size_t buflen)
4177 {
4178         struct hostapd_channel_data *chnl;
4179         int ret, i, j;
4180         char *pos, *end, *hmode;
4181
4182         pos = buf;
4183         end = pos + buflen;
4184
4185         for (j = 0; j < wpa_s->hw.num_modes; j++) {
4186                 switch (wpa_s->hw.modes[j].mode) {
4187                 case HOSTAPD_MODE_IEEE80211B:
4188                         hmode = "B";
4189                         break;
4190                 case HOSTAPD_MODE_IEEE80211G:
4191                         hmode = "G";
4192                         break;
4193                 case HOSTAPD_MODE_IEEE80211A:
4194                         hmode = "A";
4195                         break;
4196                 case HOSTAPD_MODE_IEEE80211AD:
4197                         hmode = "AD";
4198                         break;
4199                 default:
4200                         continue;
4201                 }
4202                 ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:", hmode);
4203                 if (os_snprintf_error(end - pos, ret))
4204                         return pos - buf;
4205                 pos += ret;
4206                 chnl = wpa_s->hw.modes[j].channels;
4207                 for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
4208                         if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
4209                                 continue;
4210                         ret = os_snprintf(pos, end - pos, " %d", chnl[i].chan);
4211                         if (os_snprintf_error(end - pos, ret))
4212                                 return pos - buf;
4213                         pos += ret;
4214                 }
4215                 ret = os_snprintf(pos, end - pos, "\n");
4216                 if (os_snprintf_error(end - pos, ret))
4217                         return pos - buf;
4218                 pos += ret;
4219         }
4220
4221         return pos - buf;
4222 }
4223
4224
4225 static int ctrl_iface_get_capability_freq(struct wpa_supplicant *wpa_s,
4226                                           char *buf, size_t buflen)
4227 {
4228         struct hostapd_channel_data *chnl;
4229         int ret, i, j;
4230         char *pos, *end, *hmode;
4231
4232         pos = buf;
4233         end = pos + buflen;
4234
4235         for (j = 0; j < wpa_s->hw.num_modes; j++) {
4236                 switch (wpa_s->hw.modes[j].mode) {
4237                 case HOSTAPD_MODE_IEEE80211B:
4238                         hmode = "B";
4239                         break;
4240                 case HOSTAPD_MODE_IEEE80211G:
4241                         hmode = "G";
4242                         break;
4243                 case HOSTAPD_MODE_IEEE80211A:
4244                         hmode = "A";
4245                         break;
4246                 case HOSTAPD_MODE_IEEE80211AD:
4247                         hmode = "AD";
4248                         break;
4249                 default:
4250                         continue;
4251                 }
4252                 ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:\n",
4253                                   hmode);
4254                 if (os_snprintf_error(end - pos, ret))
4255                         return pos - buf;
4256                 pos += ret;
4257                 chnl = wpa_s->hw.modes[j].channels;
4258                 for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
4259                         if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
4260                                 continue;
4261                         ret = os_snprintf(pos, end - pos, " %d = %d MHz%s%s\n",
4262                                           chnl[i].chan, chnl[i].freq,
4263                                           chnl[i].flag & HOSTAPD_CHAN_NO_IR ?
4264                                           " (NO_IR)" : "",
4265                                           chnl[i].flag & HOSTAPD_CHAN_RADAR ?
4266                                           " (DFS)" : "");
4267
4268                         if (os_snprintf_error(end - pos, ret))
4269                                 return pos - buf;
4270                         pos += ret;
4271                 }
4272                 ret = os_snprintf(pos, end - pos, "\n");
4273                 if (os_snprintf_error(end - pos, ret))
4274                         return pos - buf;
4275                 pos += ret;
4276         }
4277
4278         return pos - buf;
4279 }
4280
4281
4282 static int wpa_supplicant_ctrl_iface_get_capability(
4283         struct wpa_supplicant *wpa_s, const char *_field, char *buf,
4284         size_t buflen)
4285 {
4286         struct wpa_driver_capa capa;
4287         int res;
4288         char *strict;
4289         char field[30];
4290         size_t len;
4291
4292         /* Determine whether or not strict checking was requested */
4293         len = os_strlcpy(field, _field, sizeof(field));
4294         if (len >= sizeof(field))
4295                 return -1;
4296         strict = os_strchr(field, ' ');
4297         if (strict != NULL) {
4298                 *strict++ = '\0';
4299                 if (os_strcmp(strict, "strict") != 0)
4300                         return -1;
4301         }
4302
4303         wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CAPABILITY '%s' %s",
4304                 field, strict ? strict : "");
4305
4306         if (os_strcmp(field, "eap") == 0) {
4307                 return eap_get_names(buf, buflen);
4308         }
4309
4310         res = wpa_drv_get_capa(wpa_s, &capa);
4311
4312         if (os_strcmp(field, "pairwise") == 0)
4313                 return ctrl_iface_get_capability_pairwise(res, strict, &capa,
4314                                                           buf, buflen);
4315
4316         if (os_strcmp(field, "group") == 0)
4317                 return ctrl_iface_get_capability_group(res, strict, &capa,
4318                                                        buf, buflen);
4319
4320         if (os_strcmp(field, "group_mgmt") == 0)
4321                 return ctrl_iface_get_capability_group_mgmt(res, strict, &capa,
4322                                                             buf, buflen);
4323
4324         if (os_strcmp(field, "key_mgmt") == 0)
4325                 return ctrl_iface_get_capability_key_mgmt(res, strict, &capa,
4326                                                           buf, buflen);
4327
4328         if (os_strcmp(field, "proto") == 0)
4329                 return ctrl_iface_get_capability_proto(res, strict, &capa,
4330                                                        buf, buflen);
4331
4332         if (os_strcmp(field, "auth_alg") == 0)
4333                 return ctrl_iface_get_capability_auth_alg(wpa_s, res, strict,
4334                                                           &capa, buf, buflen);
4335
4336         if (os_strcmp(field, "modes") == 0)
4337                 return ctrl_iface_get_capability_modes(res, strict, &capa,
4338                                                        buf, buflen);
4339
4340         if (os_strcmp(field, "channels") == 0)
4341                 return ctrl_iface_get_capability_channels(wpa_s, buf, buflen);
4342
4343         if (os_strcmp(field, "freq") == 0)
4344                 return ctrl_iface_get_capability_freq(wpa_s, buf, buflen);
4345
4346 #ifdef CONFIG_TDLS
4347         if (os_strcmp(field, "tdls") == 0)
4348                 return ctrl_iface_get_capability_tdls(wpa_s, buf, buflen);
4349 #endif /* CONFIG_TDLS */
4350
4351 #ifdef CONFIG_ERP
4352         if (os_strcmp(field, "erp") == 0) {
4353                 res = os_snprintf(buf, buflen, "ERP");
4354                 if (os_snprintf_error(buflen, res))
4355                         return -1;
4356                 return res;
4357         }
4358 #endif /* CONFIG_EPR */
4359
4360 #ifdef CONFIG_FIPS
4361         if (os_strcmp(field, "fips") == 0) {
4362                 res = os_snprintf(buf, buflen, "FIPS");
4363                 if (os_snprintf_error(buflen, res))
4364                         return -1;
4365                 return res;
4366         }
4367 #endif /* CONFIG_FIPS */
4368
4369 #ifdef CONFIG_ACS
4370         if (os_strcmp(field, "acs") == 0) {
4371                 res = os_snprintf(buf, buflen, "ACS");
4372                 if (os_snprintf_error(buflen, res))
4373                         return -1;
4374                 return res;
4375         }
4376 #endif /* CONFIG_ACS */
4377
4378 #ifdef CONFIG_FILS
4379         if (os_strcmp(field, "fils") == 0) {
4380 #ifdef CONFIG_FILS_SK_PFS
4381                 if (wpa_is_fils_supported(wpa_s) &&
4382                     wpa_is_fils_sk_pfs_supported(wpa_s)) {
4383                         res = os_snprintf(buf, buflen, "FILS FILS-SK-PFS");
4384                         if (os_snprintf_error(buflen, res))
4385                                 return -1;
4386                         return res;
4387                 }
4388 #endif /* CONFIG_FILS_SK_PFS */
4389
4390                 if (wpa_is_fils_supported(wpa_s)) {
4391                         res = os_snprintf(buf, buflen, "FILS");
4392                         if (os_snprintf_error(buflen, res))
4393                                 return -1;
4394                         return res;
4395                 }
4396         }
4397 #endif /* CONFIG_FILS */
4398
4399         if (os_strcmp(field, "multibss") == 0 && wpa_s->multi_bss_support) {
4400                 res = os_snprintf(buf, buflen, "MULTIBSS-STA");
4401                 if (os_snprintf_error(buflen, res))
4402                         return -1;
4403                 return res;
4404         }
4405
4406         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown GET_CAPABILITY field '%s'",
4407                    field);
4408
4409         return -1;
4410 }
4411
4412
4413 #ifdef CONFIG_INTERWORKING
4414 static char * anqp_add_hex(char *pos, char *end, const char *title,
4415                            struct wpabuf *data)
4416 {
4417         char *start = pos;
4418         size_t i;
4419         int ret;
4420         const u8 *d;
4421
4422         if (data == NULL)
4423                 return start;
4424
4425         ret = os_snprintf(pos, end - pos, "%s=", title);
4426         if (os_snprintf_error(end - pos, ret))
4427                 return start;
4428         pos += ret;
4429
4430         d = wpabuf_head_u8(data);
4431         for (i = 0; i < wpabuf_len(data); i++) {
4432                 ret = os_snprintf(pos, end - pos, "%02x", *d++);
4433                 if (os_snprintf_error(end - pos, ret))
4434                         return start;
4435                 pos += ret;
4436         }
4437
4438         ret = os_snprintf(pos, end - pos, "\n");
4439         if (os_snprintf_error(end - pos, ret))
4440                 return start;
4441         pos += ret;
4442
4443         return pos;
4444 }
4445 #endif /* CONFIG_INTERWORKING */
4446
4447
4448 #ifdef CONFIG_FILS
4449 static int print_fils_indication(struct wpa_bss *bss, char *pos, char *end)
4450 {
4451         char *start = pos;
4452         const u8 *ie, *ie_end;
4453         u16 info, realms;
4454         int ret;
4455
4456         ie = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
4457         if (!ie)
4458                 return 0;
4459         ie_end = ie + 2 + ie[1];
4460         ie += 2;
4461         if (ie_end - ie < 2)
4462                 return -1;
4463
4464         info = WPA_GET_LE16(ie);
4465         ie += 2;
4466         ret = os_snprintf(pos, end - pos, "fils_info=%04x\n", info);
4467         if (os_snprintf_error(end - pos, ret))
4468                 return 0;
4469         pos += ret;
4470
4471         if (info & BIT(7)) {
4472                 /* Cache Identifier Included */
4473                 if (ie_end - ie < 2)
4474                         return -1;
4475                 ret = os_snprintf(pos, end - pos, "fils_cache_id=%02x%02x\n",
4476                                   ie[0], ie[1]);
4477                 if (os_snprintf_error(end - pos, ret))
4478                         return 0;
4479                 pos += ret;
4480                 ie += 2;
4481         }
4482
4483         if (info & BIT(8)) {
4484                 /* HESSID Included */
4485                 if (ie_end - ie < ETH_ALEN)
4486                         return -1;
4487                 ret = os_snprintf(pos, end - pos, "fils_hessid=" MACSTR "\n",
4488                                   MAC2STR(ie));
4489                 if (os_snprintf_error(end - pos, ret))
4490                         return 0;
4491                 pos += ret;
4492                 ie += ETH_ALEN;
4493         }
4494
4495         realms = (info & (BIT(3) | BIT(4) | BIT(5))) >> 3;
4496         if (realms) {
4497                 if (ie_end - ie < realms * 2)
4498                         return -1;
4499                 ret = os_snprintf(pos, end - pos, "fils_realms=");
4500                 if (os_snprintf_error(end - pos, ret))
4501                         return 0;
4502                 pos += ret;
4503
4504                 ret = wpa_snprintf_hex(pos, end - pos, ie, realms * 2);
4505                 if (ret <= 0)
4506                         return 0;
4507                 pos += ret;
4508                 ie += realms * 2;
4509                 ret = os_snprintf(pos, end - pos, "\n");
4510                 if (os_snprintf_error(end - pos, ret))
4511                         return 0;
4512                 pos += ret;
4513         }
4514
4515         return pos - start;
4516 }
4517 #endif /* CONFIG_FILS */
4518
4519
4520 static int print_bss_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
4521                           unsigned long mask, char *buf, size_t buflen)
4522 {
4523         size_t i;
4524         int ret;
4525         char *pos, *end;
4526         const u8 *ie, *ie2, *osen_ie, *mesh, *owe;
4527
4528         pos = buf;
4529         end = buf + buflen;
4530
4531         if (mask & WPA_BSS_MASK_ID) {
4532                 ret = os_snprintf(pos, end - pos, "id=%u\n", bss->id);
4533                 if (os_snprintf_error(end - pos, ret))
4534                         return 0;
4535                 pos += ret;
4536         }
4537
4538         if (mask & WPA_BSS_MASK_BSSID) {
4539                 ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
4540                                   MAC2STR(bss->bssid));
4541                 if (os_snprintf_error(end - pos, ret))
4542                         return 0;
4543                 pos += ret;
4544         }
4545
4546         if (mask & WPA_BSS_MASK_FREQ) {
4547                 ret = os_snprintf(pos, end - pos, "freq=%d\n", bss->freq);
4548                 if (os_snprintf_error(end - pos, ret))
4549                         return 0;
4550                 pos += ret;
4551         }
4552
4553         if (mask & WPA_BSS_MASK_BEACON_INT) {
4554                 ret = os_snprintf(pos, end - pos, "beacon_int=%d\n",
4555                                   bss->beacon_int);
4556                 if (os_snprintf_error(end - pos, ret))
4557                         return 0;
4558                 pos += ret;
4559         }
4560
4561         if (mask & WPA_BSS_MASK_CAPABILITIES) {
4562                 ret = os_snprintf(pos, end - pos, "capabilities=0x%04x\n",
4563                                   bss->caps);
4564                 if (os_snprintf_error(end - pos, ret))
4565                         return 0;
4566                 pos += ret;
4567         }
4568
4569         if (mask & WPA_BSS_MASK_QUAL) {
4570                 ret = os_snprintf(pos, end - pos, "qual=%d\n", bss->qual);
4571                 if (os_snprintf_error(end - pos, ret))
4572                         return 0;
4573                 pos += ret;
4574         }
4575
4576         if (mask & WPA_BSS_MASK_NOISE) {
4577                 ret = os_snprintf(pos, end - pos, "noise=%d\n", bss->noise);
4578                 if (os_snprintf_error(end - pos, ret))
4579                         return 0;
4580                 pos += ret;
4581         }
4582
4583         if (mask & WPA_BSS_MASK_LEVEL) {
4584                 ret = os_snprintf(pos, end - pos, "level=%d\n", bss->level);
4585                 if (os_snprintf_error(end - pos, ret))
4586                         return 0;
4587                 pos += ret;
4588         }
4589
4590         if (mask & WPA_BSS_MASK_TSF) {
4591                 ret = os_snprintf(pos, end - pos, "tsf=%016llu\n",
4592                                   (unsigned long long) bss->tsf);
4593                 if (os_snprintf_error(end - pos, ret))
4594                         return 0;
4595                 pos += ret;
4596         }
4597
4598         if (mask & WPA_BSS_MASK_AGE) {
4599                 struct os_reltime now;
4600
4601                 os_get_reltime(&now);
4602                 ret = os_snprintf(pos, end - pos, "age=%d\n",
4603                                   (int) (now.sec - bss->last_update.sec));
4604                 if (os_snprintf_error(end - pos, ret))
4605                         return 0;
4606                 pos += ret;
4607         }
4608
4609         if (mask & WPA_BSS_MASK_IE) {
4610                 ret = os_snprintf(pos, end - pos, "ie=");
4611                 if (os_snprintf_error(end - pos, ret))
4612                         return 0;
4613                 pos += ret;
4614
4615                 ie = (const u8 *) (bss + 1);
4616                 for (i = 0; i < bss->ie_len; i++) {
4617                         ret = os_snprintf(pos, end - pos, "%02x", *ie++);
4618                         if (os_snprintf_error(end - pos, ret))
4619                                 return 0;
4620                         pos += ret;
4621                 }
4622
4623                 ret = os_snprintf(pos, end - pos, "\n");
4624                 if (os_snprintf_error(end - pos, ret))
4625                         return 0;
4626                 pos += ret;
4627         }
4628
4629         if (mask & WPA_BSS_MASK_FLAGS) {
4630                 ret = os_snprintf(pos, end - pos, "flags=");
4631                 if (os_snprintf_error(end - pos, ret))
4632                         return 0;
4633                 pos += ret;
4634
4635                 mesh = wpa_bss_get_ie(bss, WLAN_EID_MESH_ID);
4636
4637                 ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
4638                 if (ie)
4639                         pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie,
4640                                                     2 + ie[1]);
4641                 ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
4642                 if (ie2)
4643                         pos = wpa_supplicant_ie_txt(pos, end,
4644                                                     mesh ? "RSN" : "WPA2", ie2,
4645                                                     2 + ie2[1]);
4646                 osen_ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
4647                 if (osen_ie)
4648                         pos = wpa_supplicant_ie_txt(pos, end, "OSEN",
4649                                                     osen_ie, 2 + osen_ie[1]);
4650                 owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
4651                 if (owe) {
4652                         ret = os_snprintf(
4653                                 pos, end - pos,
4654                                 ie2 ? "[OWE-TRANS]" : "[OWE-TRANS-OPEN]");
4655                         if (os_snprintf_error(end - pos, ret))
4656                                 return 0;
4657                         pos += ret;
4658                 }
4659                 pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
4660                 if (!ie && !ie2 && !osen_ie &&
4661                     (bss->caps & IEEE80211_CAP_PRIVACY)) {
4662                         ret = os_snprintf(pos, end - pos, "[WEP]");
4663                         if (os_snprintf_error(end - pos, ret))
4664                                 return 0;
4665                         pos += ret;
4666                 }
4667
4668                 if (mesh) {
4669                         ret = os_snprintf(pos, end - pos, "[MESH]");
4670                         if (os_snprintf_error(end - pos, ret))
4671                                 return 0;
4672                         pos += ret;
4673                 }
4674
4675                 if (bss_is_dmg(bss)) {
4676                         const char *s;
4677                         ret = os_snprintf(pos, end - pos, "[DMG]");
4678                         if (os_snprintf_error(end - pos, ret))
4679                                 return 0;
4680                         pos += ret;
4681                         switch (bss->caps & IEEE80211_CAP_DMG_MASK) {
4682                         case IEEE80211_CAP_DMG_IBSS:
4683                                 s = "[IBSS]";
4684                                 break;
4685                         case IEEE80211_CAP_DMG_AP:
4686                                 s = "[ESS]";
4687                                 break;
4688                         case IEEE80211_CAP_DMG_PBSS:
4689                                 s = "[PBSS]";
4690                                 break;
4691                         default:
4692                                 s = "";
4693                                 break;
4694                         }
4695                         ret = os_snprintf(pos, end - pos, "%s", s);
4696                         if (os_snprintf_error(end - pos, ret))
4697                                 return 0;
4698                         pos += ret;
4699                 } else {
4700                         if (bss->caps & IEEE80211_CAP_IBSS) {
4701                                 ret = os_snprintf(pos, end - pos, "[IBSS]");
4702                                 if (os_snprintf_error(end - pos, ret))
4703                                         return 0;
4704                                 pos += ret;
4705                         }
4706                         if (bss->caps & IEEE80211_CAP_ESS) {
4707                                 ret = os_snprintf(pos, end - pos, "[ESS]");
4708                                 if (os_snprintf_error(end - pos, ret))
4709                                         return 0;
4710                                 pos += ret;
4711                         }
4712                 }
4713                 if (wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE) ||
4714                     wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE)) {
4715                         ret = os_snprintf(pos, end - pos, "[P2P]");
4716                         if (os_snprintf_error(end - pos, ret))
4717                                 return 0;
4718                         pos += ret;
4719                 }
4720 #ifdef CONFIG_HS20
4721                 if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
4722                         ret = os_snprintf(pos, end - pos, "[HS20]");
4723                         if (os_snprintf_error(end - pos, ret))
4724                                 return 0;
4725                         pos += ret;
4726                 }
4727 #endif /* CONFIG_HS20 */
4728 #ifdef CONFIG_FILS
4729                 if (wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION)) {
4730                         ret = os_snprintf(pos, end - pos, "[FILS]");
4731                         if (os_snprintf_error(end - pos, ret))
4732                                 return 0;
4733                         pos += ret;
4734                 }
4735 #endif /* CONFIG_FILS */
4736
4737                 ret = os_snprintf(pos, end - pos, "\n");
4738                 if (os_snprintf_error(end - pos, ret))
4739                         return 0;
4740                 pos += ret;
4741         }
4742
4743         if (mask & WPA_BSS_MASK_SSID) {
4744                 ret = os_snprintf(pos, end - pos, "ssid=%s\n",
4745                                   wpa_ssid_txt(bss->ssid, bss->ssid_len));
4746                 if (os_snprintf_error(end - pos, ret))
4747                         return 0;
4748                 pos += ret;
4749         }
4750
4751 #ifdef CONFIG_WPS
4752         if (mask & WPA_BSS_MASK_WPS_SCAN) {
4753                 ie = (const u8 *) (bss + 1);
4754                 ret = wpas_wps_scan_result_text(ie, bss->ie_len, pos, end);
4755                 if (ret >= end - pos)
4756                         return 0;
4757                 if (ret > 0)
4758                         pos += ret;
4759         }
4760 #endif /* CONFIG_WPS */
4761
4762 #ifdef CONFIG_P2P
4763         if (mask & WPA_BSS_MASK_P2P_SCAN) {
4764                 ie = (const u8 *) (bss + 1);
4765                 ret = wpas_p2p_scan_result_text(ie, bss->ie_len, pos, end);
4766                 if (ret >= end - pos)
4767                         return 0;
4768                 if (ret > 0)
4769                         pos += ret;
4770         }
4771 #endif /* CONFIG_P2P */
4772
4773 #ifdef CONFIG_WIFI_DISPLAY
4774         if (mask & WPA_BSS_MASK_WIFI_DISPLAY) {
4775                 struct wpabuf *wfd;
4776                 ie = (const u8 *) (bss + 1);
4777                 wfd = ieee802_11_vendor_ie_concat(ie, bss->ie_len,
4778                                                   WFD_IE_VENDOR_TYPE);
4779                 if (wfd) {
4780                         ret = os_snprintf(pos, end - pos, "wfd_subelems=");
4781                         if (os_snprintf_error(end - pos, ret)) {
4782                                 wpabuf_free(wfd);
4783                                 return 0;
4784                         }
4785                         pos += ret;
4786
4787                         pos += wpa_snprintf_hex(pos, end - pos,
4788                                                 wpabuf_head(wfd),
4789                                                 wpabuf_len(wfd));
4790                         wpabuf_free(wfd);
4791
4792                         ret = os_snprintf(pos, end - pos, "\n");
4793                         if (os_snprintf_error(end - pos, ret))
4794                                 return 0;
4795                         pos += ret;
4796                 }
4797         }
4798 #endif /* CONFIG_WIFI_DISPLAY */
4799
4800 #ifdef CONFIG_INTERWORKING
4801         if ((mask & WPA_BSS_MASK_INTERNETW) && bss->anqp) {
4802                 struct wpa_bss_anqp *anqp = bss->anqp;
4803                 struct wpa_bss_anqp_elem *elem;
4804
4805                 pos = anqp_add_hex(pos, end, "anqp_capability_list",
4806                                    anqp->capability_list);
4807                 pos = anqp_add_hex(pos, end, "anqp_venue_name",
4808                                    anqp->venue_name);
4809                 pos = anqp_add_hex(pos, end, "anqp_network_auth_type",
4810                                    anqp->network_auth_type);
4811                 pos = anqp_add_hex(pos, end, "anqp_roaming_consortium",
4812                                    anqp->roaming_consortium);
4813                 pos = anqp_add_hex(pos, end, "anqp_ip_addr_type_availability",
4814                                    anqp->ip_addr_type_availability);
4815                 pos = anqp_add_hex(pos, end, "anqp_nai_realm",
4816                                    anqp->nai_realm);
4817                 pos = anqp_add_hex(pos, end, "anqp_3gpp", anqp->anqp_3gpp);
4818                 pos = anqp_add_hex(pos, end, "anqp_domain_name",
4819                                    anqp->domain_name);
4820                 pos = anqp_add_hex(pos, end, "anqp_fils_realm_info",
4821                                    anqp->fils_realm_info);
4822 #ifdef CONFIG_HS20
4823                 pos = anqp_add_hex(pos, end, "hs20_capability_list",
4824                                    anqp->hs20_capability_list);
4825                 pos = anqp_add_hex(pos, end, "hs20_operator_friendly_name",
4826                                    anqp->hs20_operator_friendly_name);
4827                 pos = anqp_add_hex(pos, end, "hs20_wan_metrics",
4828                                    anqp->hs20_wan_metrics);
4829                 pos = anqp_add_hex(pos, end, "hs20_connection_capability",
4830                                    anqp->hs20_connection_capability);
4831                 pos = anqp_add_hex(pos, end, "hs20_operating_class",
4832                                    anqp->hs20_operating_class);
4833                 pos = anqp_add_hex(pos, end, "hs20_osu_providers_list",
4834                                    anqp->hs20_osu_providers_list);
4835                 pos = anqp_add_hex(pos, end, "hs20_operator_icon_metadata",
4836                                    anqp->hs20_operator_icon_metadata);
4837                 pos = anqp_add_hex(pos, end, "hs20_osu_providers_nai_list",
4838                                    anqp->hs20_osu_providers_nai_list);
4839 #endif /* CONFIG_HS20 */
4840
4841                 dl_list_for_each(elem, &anqp->anqp_elems,
4842                                  struct wpa_bss_anqp_elem, list) {
4843                         char title[20];
4844
4845                         os_snprintf(title, sizeof(title), "anqp[%u]",
4846                                     elem->infoid);
4847                         pos = anqp_add_hex(pos, end, title, elem->payload);
4848                 }
4849         }
4850 #endif /* CONFIG_INTERWORKING */
4851
4852 #ifdef CONFIG_MESH
4853         if (mask & WPA_BSS_MASK_MESH_SCAN) {
4854                 ie = (const u8 *) (bss + 1);
4855                 ret = wpas_mesh_scan_result_text(ie, bss->ie_len, pos, end);
4856                 if (ret >= end - pos)
4857                         return 0;
4858                 if (ret > 0)
4859                         pos += ret;
4860         }
4861 #endif /* CONFIG_MESH */
4862
4863         if (mask & WPA_BSS_MASK_SNR) {
4864                 ret = os_snprintf(pos, end - pos, "snr=%d\n", bss->snr);
4865                 if (os_snprintf_error(end - pos, ret))
4866                         return 0;
4867                 pos += ret;
4868         }
4869
4870         if (mask & WPA_BSS_MASK_EST_THROUGHPUT) {
4871                 ret = os_snprintf(pos, end - pos, "est_throughput=%d\n",
4872                                   bss->est_throughput);
4873                 if (os_snprintf_error(end - pos, ret))
4874                         return 0;
4875                 pos += ret;
4876         }
4877
4878 #ifdef CONFIG_FST
4879         if (mask & WPA_BSS_MASK_FST) {
4880                 ret = fst_ctrl_iface_mb_info(bss->bssid, pos, end - pos);
4881                 if (ret < 0 || ret >= end - pos)
4882                         return 0;
4883                 pos += ret;
4884         }
4885 #endif /* CONFIG_FST */
4886
4887         if (mask & WPA_BSS_MASK_UPDATE_IDX) {
4888                 ret = os_snprintf(pos, end - pos, "update_idx=%u\n",
4889                                   bss->last_update_idx);
4890                 if (os_snprintf_error(end - pos, ret))
4891                         return 0;
4892                 pos += ret;
4893         }
4894
4895         if ((mask & WPA_BSS_MASK_BEACON_IE) && bss->beacon_ie_len) {
4896                 ret = os_snprintf(pos, end - pos, "beacon_ie=");
4897                 if (os_snprintf_error(end - pos, ret))
4898                         return 0;
4899                 pos += ret;
4900
4901                 ie = (const u8 *) (bss + 1);
4902                 ie += bss->ie_len;
4903                 for (i = 0; i < bss->beacon_ie_len; i++) {
4904                         ret = os_snprintf(pos, end - pos, "%02x", *ie++);
4905                         if (os_snprintf_error(end - pos, ret))
4906                                 return 0;
4907                         pos += ret;
4908                 }
4909
4910                 ret = os_snprintf(pos, end - pos, "\n");
4911                 if (os_snprintf_error(end - pos, ret))
4912                         return 0;
4913                 pos += ret;
4914         }
4915
4916 #ifdef CONFIG_FILS
4917         if (mask & WPA_BSS_MASK_FILS_INDICATION) {
4918                 ret = print_fils_indication(bss, pos, end);
4919                 if (ret < 0)
4920                         return 0;
4921                 pos += ret;
4922         }
4923 #endif /* CONFIG_FILS */
4924
4925         if (mask & WPA_BSS_MASK_DELIM) {
4926                 ret = os_snprintf(pos, end - pos, "====\n");
4927                 if (os_snprintf_error(end - pos, ret))
4928                         return 0;
4929                 pos += ret;
4930         }
4931
4932         return pos - buf;
4933 }
4934
4935
4936 static int wpa_supplicant_ctrl_iface_bss(struct wpa_supplicant *wpa_s,
4937                                          const char *cmd, char *buf,
4938                                          size_t buflen)
4939 {
4940         u8 bssid[ETH_ALEN];
4941         size_t i;
4942         struct wpa_bss *bss;
4943         struct wpa_bss *bsslast = NULL;
4944         struct dl_list *next;
4945         int ret = 0;
4946         int len;
4947         char *ctmp, *end = buf + buflen;
4948         unsigned long mask = WPA_BSS_MASK_ALL;
4949
4950         if (os_strncmp(cmd, "RANGE=", 6) == 0) {
4951                 if (os_strncmp(cmd + 6, "ALL", 3) == 0) {
4952                         bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss,
4953                                             list_id);
4954                         bsslast = dl_list_last(&wpa_s->bss_id, struct wpa_bss,
4955                                                list_id);
4956                 } else { /* N1-N2 */
4957                         unsigned int id1, id2;
4958
4959                         if ((ctmp = os_strchr(cmd + 6, '-')) == NULL) {
4960                                 wpa_printf(MSG_INFO, "Wrong BSS range "
4961                                            "format");
4962                                 return 0;
4963                         }
4964
4965                         if (*(cmd + 6) == '-')
4966                                 id1 = 0;
4967                         else
4968                                 id1 = atoi(cmd + 6);
4969                         ctmp++;
4970                         if (*ctmp >= '0' && *ctmp <= '9')
4971                                 id2 = atoi(ctmp);
4972                         else
4973                                 id2 = (unsigned int) -1;
4974                         bss = wpa_bss_get_id_range(wpa_s, id1, id2);
4975                         if (id2 == (unsigned int) -1)
4976                                 bsslast = dl_list_last(&wpa_s->bss_id,
4977                                                        struct wpa_bss,
4978                                                        list_id);
4979                         else {
4980                                 bsslast = wpa_bss_get_id(wpa_s, id2);
4981                                 if (bsslast == NULL && bss && id2 > id1) {
4982                                         struct wpa_bss *tmp = bss;
4983                                         for (;;) {
4984                                                 next = tmp->list_id.next;
4985                                                 if (next == &wpa_s->bss_id)
4986                                                         break;
4987                                                 tmp = dl_list_entry(
4988                                                         next, struct wpa_bss,
4989                                                         list_id);
4990                                                 if (tmp->id > id2)
4991                                                         break;
4992                                                 bsslast = tmp;
4993                                         }
4994                                 }
4995                         }
4996                 }
4997         } else if (os_strncmp(cmd, "FIRST", 5) == 0)
4998                 bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss, list_id);
4999         else if (os_strncmp(cmd, "LAST", 4) == 0)
5000                 bss = dl_list_last(&wpa_s->bss_id, struct wpa_bss, list_id);
5001         else if (os_strncmp(cmd, "ID-", 3) == 0) {
5002                 i = atoi(cmd + 3);
5003                 bss = wpa_bss_get_id(wpa_s, i);
5004         } else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
5005                 i = atoi(cmd + 5);
5006                 bss = wpa_bss_get_id(wpa_s, i);
5007                 if (bss) {
5008                         next = bss->list_id.next;
5009                         if (next == &wpa_s->bss_id)
5010                                 bss = NULL;
5011                         else
5012                                 bss = dl_list_entry(next, struct wpa_bss,
5013                                                     list_id);
5014                 }
5015         } else if (os_strncmp(cmd, "CURRENT", 7) == 0) {
5016                 bss = wpa_s->current_bss;
5017 #ifdef CONFIG_P2P
5018         } else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
5019                 if (hwaddr_aton(cmd + 13, bssid) == 0)
5020                         bss = wpa_bss_get_p2p_dev_addr(wpa_s, bssid);
5021                 else
5022                         bss = NULL;
5023 #endif /* CONFIG_P2P */
5024         } else if (hwaddr_aton(cmd, bssid) == 0)
5025                 bss = wpa_bss_get_bssid(wpa_s, bssid);
5026         else {
5027                 struct wpa_bss *tmp;
5028                 i = atoi(cmd);
5029                 bss = NULL;
5030                 dl_list_for_each(tmp, &wpa_s->bss_id, struct wpa_bss, list_id)
5031                 {
5032                         if (i-- == 0) {
5033                                 bss = tmp;
5034                                 break;
5035                         }
5036                 }
5037         }
5038
5039         if ((ctmp = os_strstr(cmd, "MASK=")) != NULL) {
5040                 mask = strtoul(ctmp + 5, NULL, 0x10);
5041                 if (mask == 0)
5042                         mask = WPA_BSS_MASK_ALL;
5043         }
5044
5045         if (bss == NULL)
5046                 return 0;
5047
5048         if (bsslast == NULL)
5049                 bsslast = bss;
5050         do {
5051                 len = print_bss_info(wpa_s, bss, mask, buf, buflen);
5052                 ret += len;
5053                 buf += len;
5054                 buflen -= len;
5055                 if (bss == bsslast) {
5056                         if ((mask & WPA_BSS_MASK_DELIM) && len &&
5057                             (bss == dl_list_last(&wpa_s->bss_id,
5058                                                  struct wpa_bss, list_id))) {
5059                                 int res;
5060
5061                                 res = os_snprintf(buf - 5, end - buf + 5,
5062                                                   "####\n");
5063                                 if (os_snprintf_error(end - buf + 5, res)) {
5064                                         wpa_printf(MSG_DEBUG,
5065                                                    "Could not add end delim");
5066                                 }
5067                         }
5068                         break;
5069                 }
5070                 next = bss->list_id.next;
5071                 if (next == &wpa_s->bss_id)
5072                         break;
5073                 bss = dl_list_entry(next, struct wpa_bss, list_id);
5074         } while (bss && len);
5075
5076         return ret;
5077 }
5078
5079
5080 static int wpa_supplicant_ctrl_iface_ap_scan(
5081         struct wpa_supplicant *wpa_s, char *cmd)
5082 {
5083         int ap_scan = atoi(cmd);
5084         return wpa_supplicant_set_ap_scan(wpa_s, ap_scan);
5085 }
5086
5087
5088 static int wpa_supplicant_ctrl_iface_scan_interval(
5089         struct wpa_supplicant *wpa_s, char *cmd)
5090 {
5091         int scan_int = atoi(cmd);
5092         return wpa_supplicant_set_scan_interval(wpa_s, scan_int);
5093 }
5094
5095
5096 static int wpa_supplicant_ctrl_iface_bss_expire_age(
5097         struct wpa_supplicant *wpa_s, char *cmd)
5098 {
5099         int expire_age = atoi(cmd);
5100         return wpa_supplicant_set_bss_expiration_age(wpa_s, expire_age);
5101 }
5102
5103
5104 static int wpa_supplicant_ctrl_iface_bss_expire_count(
5105         struct wpa_supplicant *wpa_s, char *cmd)
5106 {
5107         int expire_count = atoi(cmd);
5108         return wpa_supplicant_set_bss_expiration_count(wpa_s, expire_count);
5109 }
5110
5111
5112 static void wpa_supplicant_ctrl_iface_bss_flush(
5113         struct wpa_supplicant *wpa_s, char *cmd)
5114 {
5115         int flush_age = atoi(cmd);
5116
5117         if (flush_age == 0)
5118                 wpa_bss_flush(wpa_s);
5119         else
5120                 wpa_bss_flush_by_age(wpa_s, flush_age);
5121 }
5122
5123
5124 #ifdef CONFIG_TESTING_OPTIONS
5125 static void wpa_supplicant_ctrl_iface_drop_sa(struct wpa_supplicant *wpa_s)
5126 {
5127         wpa_printf(MSG_DEBUG, "Dropping SA without deauthentication");
5128         /* MLME-DELETEKEYS.request */
5129         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 0, 0, NULL, 0, NULL, 0);
5130         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 1, 0, NULL, 0, NULL, 0);
5131         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 2, 0, NULL, 0, NULL, 0);
5132         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 3, 0, NULL, 0, NULL, 0);
5133 #ifdef CONFIG_IEEE80211W
5134         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 4, 0, NULL, 0, NULL, 0);
5135         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 5, 0, NULL, 0, NULL, 0);
5136 #endif /* CONFIG_IEEE80211W */
5137
5138         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, wpa_s->bssid, 0, 0, NULL, 0, NULL,
5139                         0);
5140         /* MLME-SETPROTECTION.request(None) */
5141         wpa_drv_mlme_setprotection(wpa_s, wpa_s->bssid,
5142                                    MLME_SETPROTECTION_PROTECT_TYPE_NONE,
5143                                    MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
5144         wpa_sm_drop_sa(wpa_s->wpa);
5145 }
5146 #endif /* CONFIG_TESTING_OPTIONS */
5147
5148
5149 static int wpa_supplicant_ctrl_iface_roam(struct wpa_supplicant *wpa_s,
5150                                           char *addr)
5151 {
5152 #ifdef CONFIG_NO_SCAN_PROCESSING
5153         return -1;
5154 #else /* CONFIG_NO_SCAN_PROCESSING */
5155         u8 bssid[ETH_ALEN];
5156         struct wpa_bss *bss;
5157         struct wpa_ssid *ssid = wpa_s->current_ssid;
5158
5159         if (hwaddr_aton(addr, bssid)) {
5160                 wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: invalid "
5161                            "address '%s'", addr);
5162                 return -1;
5163         }
5164
5165         wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM " MACSTR, MAC2STR(bssid));
5166
5167         if (!ssid) {
5168                 wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: No network "
5169                            "configuration known for the target AP");
5170                 return -1;
5171         }
5172
5173         bss = wpa_bss_get(wpa_s, bssid, ssid->ssid, ssid->ssid_len);
5174         if (!bss) {
5175                 wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: Target AP not found "
5176                            "from BSS table");
5177                 return -1;
5178         }
5179
5180         /*
5181          * TODO: Find best network configuration block from configuration to
5182          * allow roaming to other networks
5183          */
5184
5185         wpa_s->reassociate = 1;
5186         wpa_supplicant_connect(wpa_s, bss, ssid);
5187
5188         return 0;
5189 #endif /* CONFIG_NO_SCAN_PROCESSING */
5190 }
5191
5192
5193 #ifdef CONFIG_P2P
5194 static int p2p_ctrl_find(struct wpa_supplicant *wpa_s, char *cmd)
5195 {
5196         unsigned int timeout = atoi(cmd);
5197         enum p2p_discovery_type type = P2P_FIND_START_WITH_FULL;
5198         u8 dev_id[ETH_ALEN], *_dev_id = NULL;
5199         u8 dev_type[WPS_DEV_TYPE_LEN], *_dev_type = NULL;
5200         char *pos;
5201         unsigned int search_delay;
5202         const char *_seek[P2P_MAX_QUERY_HASH + 1], **seek = NULL;
5203         u8 seek_count = 0;
5204         int freq = 0;
5205
5206         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
5207                 wpa_dbg(wpa_s, MSG_INFO,
5208                         "Reject P2P_FIND since interface is disabled");
5209                 return -1;
5210         }
5211         if (os_strstr(cmd, "type=social"))
5212                 type = P2P_FIND_ONLY_SOCIAL;
5213         else if (os_strstr(cmd, "type=progressive"))
5214                 type = P2P_FIND_PROGRESSIVE;
5215
5216         pos = os_strstr(cmd, "dev_id=");
5217         if (pos) {
5218                 pos += 7;
5219                 if (hwaddr_aton(pos, dev_id))
5220                         return -1;
5221                 _dev_id = dev_id;
5222         }
5223
5224         pos = os_strstr(cmd, "dev_type=");
5225         if (pos) {
5226                 pos += 9;
5227                 if (wps_dev_type_str2bin(pos, dev_type) < 0)
5228                         return -1;
5229                 _dev_type = dev_type;
5230         }
5231
5232         pos = os_strstr(cmd, "delay=");
5233         if (pos) {
5234                 pos += 6;
5235                 search_delay = atoi(pos);
5236         } else
5237                 search_delay = wpas_p2p_search_delay(wpa_s);
5238
5239         pos = os_strstr(cmd, "freq=");
5240         if (pos) {
5241                 pos += 5;
5242                 freq = atoi(pos);
5243                 if (freq <= 0)
5244                         return -1;
5245         }
5246
5247         /* Must be searched for last, because it adds nul termination */
5248         pos = os_strstr(cmd, " seek=");
5249         if (pos)
5250                 pos += 6;
5251         while (pos && seek_count < P2P_MAX_QUERY_HASH + 1) {
5252                 char *term;
5253
5254                 _seek[seek_count++] = pos;
5255                 seek = _seek;
5256                 term = os_strchr(pos, ' ');
5257                 if (!term)
5258                         break;
5259                 *term = '\0';
5260                 pos = os_strstr(term + 1, "seek=");
5261                 if (pos)
5262                         pos += 5;
5263         }
5264         if (seek_count > P2P_MAX_QUERY_HASH) {
5265                 seek[0] = NULL;
5266                 seek_count = 1;
5267         }
5268
5269         return wpas_p2p_find(wpa_s, timeout, type, _dev_type != NULL, _dev_type,
5270                              _dev_id, search_delay, seek_count, seek, freq);
5271 }
5272
5273
5274 static int p2ps_ctrl_parse_cpt_priority(const char *pos, u8 *cpt)
5275 {
5276         const char *last = NULL;
5277         const char *token;
5278         long int token_len;
5279         unsigned int i;
5280
5281         /* Expected predefined CPT names delimited by ':' */
5282         for (i = 0; (token = cstr_token(pos, ": \t", &last)); i++) {
5283                 if (i >= P2PS_FEATURE_CAPAB_CPT_MAX) {
5284                         wpa_printf(MSG_ERROR,
5285                                    "P2PS: CPT name list is too long, expected up to %d names",
5286                                    P2PS_FEATURE_CAPAB_CPT_MAX);
5287                         cpt[0] = 0;
5288                         return -1;
5289                 }
5290
5291                 token_len = last - token;
5292
5293                 if (token_len  == 3 &&
5294                     os_memcmp(token, "UDP", token_len) == 0) {
5295                         cpt[i] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
5296                 } else if (token_len == 3 &&
5297                            os_memcmp(token, "MAC", token_len) == 0) {
5298                         cpt[i] = P2PS_FEATURE_CAPAB_MAC_TRANSPORT;
5299                 } else {
5300                         wpa_printf(MSG_ERROR,
5301                                    "P2PS: Unsupported CPT name '%s'", token);
5302                         cpt[0] = 0;
5303                         return -1;
5304                 }
5305
5306                 if (isblank((unsigned char) *last)) {
5307                         i++;
5308                         break;
5309                 }
5310         }
5311         cpt[i] = 0;
5312         return 0;
5313 }
5314
5315
5316 static struct p2ps_provision * p2p_parse_asp_provision_cmd(const char *cmd)
5317 {
5318         struct p2ps_provision *p2ps_prov;
5319         char *pos;
5320         size_t info_len = 0;
5321         char *info = NULL;
5322         u8 role = P2PS_SETUP_NONE;
5323         long long unsigned val;
5324         int i;
5325
5326         pos = os_strstr(cmd, "info=");
5327         if (pos) {
5328                 pos += 5;
5329                 info_len = os_strlen(pos);
5330
5331                 if (info_len) {
5332                         info = os_malloc(info_len + 1);
5333                         if (info) {
5334                                 info_len = utf8_unescape(pos, info_len,
5335                                                          info, info_len + 1);
5336                         } else
5337                                 info_len = 0;
5338                 }
5339         }
5340
5341         p2ps_prov = os_zalloc(sizeof(struct p2ps_provision) + info_len + 1);
5342         if (p2ps_prov == NULL) {
5343                 os_free(info);
5344                 return NULL;
5345         }
5346
5347         if (info) {
5348                 os_memcpy(p2ps_prov->info, info, info_len);
5349                 p2ps_prov->info[info_len] = '\0';
5350                 os_free(info);
5351         }
5352
5353         pos = os_strstr(cmd, "status=");
5354         if (pos)
5355                 p2ps_prov->status = atoi(pos + 7);
5356         else
5357                 p2ps_prov->status = -1;
5358
5359         pos = os_strstr(cmd, "adv_id=");
5360         if (!pos || sscanf(pos + 7, "%llx", &val) != 1 || val > 0xffffffffULL)
5361                 goto invalid_args;
5362         p2ps_prov->adv_id = val;
5363
5364         pos = os_strstr(cmd, "method=");
5365         if (pos)
5366                 p2ps_prov->method = strtol(pos + 7, NULL, 16);
5367         else
5368                 p2ps_prov->method = 0;
5369
5370         pos = os_strstr(cmd, "session=");
5371         if (!pos || sscanf(pos + 8, "%llx", &val) != 1 || val > 0xffffffffULL)
5372                 goto invalid_args;
5373         p2ps_prov->session_id = val;
5374
5375         pos = os_strstr(cmd, "adv_mac=");
5376         if (!pos || hwaddr_aton(pos + 8, p2ps_prov->adv_mac))
5377                 goto invalid_args;
5378
5379         pos = os_strstr(cmd, "session_mac=");
5380         if (!pos || hwaddr_aton(pos + 12, p2ps_prov->session_mac))
5381                 goto invalid_args;
5382
5383         pos = os_strstr(cmd, "cpt=");
5384         if (pos) {
5385                 if (p2ps_ctrl_parse_cpt_priority(pos + 4,
5386                                                  p2ps_prov->cpt_priority))
5387                         goto invalid_args;
5388         } else {
5389                 p2ps_prov->cpt_priority[0] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
5390         }
5391
5392         for (i = 0; p2ps_prov->cpt_priority[i]; i++)
5393                 p2ps_prov->cpt_mask |= p2ps_prov->cpt_priority[i];
5394
5395         /* force conncap with tstCap (no sanity checks) */
5396         pos = os_strstr(cmd, "tstCap=");
5397         if (pos) {
5398                 role = strtol(pos + 7, NULL, 16);
5399         } else {
5400                 pos = os_strstr(cmd, "role=");
5401                 if (pos) {
5402                         role = strtol(pos + 5, NULL, 16);
5403                         if (role != P2PS_SETUP_CLIENT &&
5404                             role != P2PS_SETUP_GROUP_OWNER)
5405                                 role = P2PS_SETUP_NONE;
5406                 }
5407         }
5408         p2ps_prov->role = role;
5409
5410         return p2ps_prov;
5411
5412 invalid_args:
5413         os_free(p2ps_prov);
5414         return NULL;
5415 }
5416
5417
5418 static int p2p_ctrl_asp_provision_resp(struct wpa_supplicant *wpa_s, char *cmd)
5419 {
5420         u8 addr[ETH_ALEN];
5421         struct p2ps_provision *p2ps_prov;
5422         char *pos;
5423
5424         /* <addr> id=<adv_id> [role=<conncap>] [info=<infodata>] */
5425
5426         wpa_printf(MSG_DEBUG, "%s: %s", __func__, cmd);
5427
5428         if (hwaddr_aton(cmd, addr))
5429                 return -1;
5430
5431         pos = cmd + 17;
5432         if (*pos != ' ')
5433                 return -1;
5434
5435         p2ps_prov = p2p_parse_asp_provision_cmd(pos);
5436         if (!p2ps_prov)
5437                 return -1;
5438
5439         if (p2ps_prov->status < 0) {
5440                 os_free(p2ps_prov);
5441                 return -1;
5442         }
5443
5444         return wpas_p2p_prov_disc(wpa_s, addr, NULL, WPAS_P2P_PD_FOR_ASP,
5445                                   p2ps_prov);
5446 }
5447
5448
5449 static int p2p_ctrl_asp_provision(struct wpa_supplicant *wpa_s, char *cmd)
5450 {
5451         u8 addr[ETH_ALEN];
5452         struct p2ps_provision *p2ps_prov;
5453         char *pos;
5454
5455         /* <addr> id=<adv_id> adv_mac=<adv_mac> conncap=<conncap>
5456          *        session=<ses_id> mac=<ses_mac> [info=<infodata>]
5457          */
5458
5459         wpa_printf(MSG_DEBUG, "%s: %s", __func__, cmd);
5460         if (hwaddr_aton(cmd, addr))
5461                 return -1;
5462
5463         pos = cmd + 17;
5464         if (*pos != ' ')
5465                 return -1;
5466
5467         p2ps_prov = p2p_parse_asp_provision_cmd(pos);
5468         if (!p2ps_prov)
5469                 return -1;
5470
5471         p2ps_prov->pd_seeker = 1;
5472
5473         return wpas_p2p_prov_disc(wpa_s, addr, NULL, WPAS_P2P_PD_FOR_ASP,
5474                                   p2ps_prov);
5475 }
5476
5477
5478 static int parse_freq(int chwidth, int freq2)
5479 {
5480         if (freq2 < 0)
5481                 return -1;
5482         if (freq2)
5483                 return VHT_CHANWIDTH_80P80MHZ;
5484
5485         switch (chwidth) {
5486         case 0:
5487         case 20:
5488         case 40:
5489                 return VHT_CHANWIDTH_USE_HT;
5490         case 80:
5491                 return VHT_CHANWIDTH_80MHZ;
5492         case 160:
5493                 return VHT_CHANWIDTH_160MHZ;
5494         default:
5495                 wpa_printf(MSG_DEBUG, "Unknown max oper bandwidth: %d",
5496                            chwidth);
5497                 return -1;
5498         }
5499 }
5500
5501
5502 static int p2p_ctrl_connect(struct wpa_supplicant *wpa_s, char *cmd,
5503                             char *buf, size_t buflen)
5504 {
5505         u8 addr[ETH_ALEN];
5506         char *pos, *pos2;
5507         char *pin = NULL;
5508         enum p2p_wps_method wps_method;
5509         int new_pin;
5510         int ret;
5511         int persistent_group, persistent_id = -1;
5512         int join;
5513         int auth;
5514         int automatic;
5515         int go_intent = -1;
5516         int freq = 0;
5517         int pd;
5518         int ht40, vht, max_oper_chwidth, chwidth = 0, freq2 = 0;
5519         u8 _group_ssid[SSID_MAX_LEN], *group_ssid = NULL;
5520         size_t group_ssid_len = 0;
5521
5522         if (!wpa_s->global->p2p_init_wpa_s)
5523                 return -1;
5524         if (wpa_s->global->p2p_init_wpa_s != wpa_s) {
5525                 wpa_dbg(wpa_s, MSG_DEBUG, "Direct P2P_CONNECT command to %s",
5526                         wpa_s->global->p2p_init_wpa_s->ifname);
5527                 wpa_s = wpa_s->global->p2p_init_wpa_s;
5528         }
5529
5530         /* <addr> <"pbc" | "pin" | PIN> [label|display|keypad|p2ps]
5531          * [persistent|persistent=<network id>]
5532          * [join] [auth] [go_intent=<0..15>] [freq=<in MHz>] [provdisc]
5533          * [ht40] [vht] [auto] [ssid=<hexdump>] */
5534
5535         if (hwaddr_aton(cmd, addr))
5536                 return -1;
5537
5538         pos = cmd + 17;
5539         if (*pos != ' ')
5540                 return -1;
5541         pos++;
5542
5543         persistent_group = os_strstr(pos, " persistent") != NULL;
5544         pos2 = os_strstr(pos, " persistent=");
5545         if (pos2) {
5546                 struct wpa_ssid *ssid;
5547                 persistent_id = atoi(pos2 + 12);
5548                 ssid = wpa_config_get_network(wpa_s->conf, persistent_id);
5549                 if (ssid == NULL || ssid->disabled != 2 ||
5550                     ssid->mode != WPAS_MODE_P2P_GO) {
5551                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
5552                                    "SSID id=%d for persistent P2P group (GO)",
5553                                    persistent_id);
5554                         return -1;
5555                 }
5556         }
5557         join = os_strstr(pos, " join") != NULL;
5558         auth = os_strstr(pos, " auth") != NULL;
5559         automatic = os_strstr(pos, " auto") != NULL;
5560         pd = os_strstr(pos, " provdisc") != NULL;
5561         vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
5562         ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
5563                 vht;
5564
5565         pos2 = os_strstr(pos, " go_intent=");
5566         if (pos2) {
5567                 pos2 += 11;
5568                 go_intent = atoi(pos2);
5569                 if (go_intent < 0 || go_intent > 15)
5570                         return -1;
5571         }
5572
5573         pos2 = os_strstr(pos, " freq=");
5574         if (pos2) {
5575                 pos2 += 6;
5576                 freq = atoi(pos2);
5577                 if (freq <= 0)
5578                         return -1;
5579         }
5580
5581         pos2 = os_strstr(pos, " freq2=");
5582         if (pos2)
5583                 freq2 = atoi(pos2 + 7);
5584
5585         pos2 = os_strstr(pos, " max_oper_chwidth=");
5586         if (pos2)
5587                 chwidth = atoi(pos2 + 18);
5588
5589         max_oper_chwidth = parse_freq(chwidth, freq2);
5590         if (max_oper_chwidth < 0)
5591                 return -1;
5592
5593         pos2 = os_strstr(pos, " ssid=");
5594         if (pos2) {
5595                 char *end;
5596
5597                 pos2 += 6;
5598                 end = os_strchr(pos2, ' ');
5599                 if (!end)
5600                         group_ssid_len = os_strlen(pos2) / 2;
5601                 else
5602                         group_ssid_len = (end - pos2) / 2;
5603                 if (group_ssid_len == 0 || group_ssid_len > SSID_MAX_LEN ||
5604                     hexstr2bin(pos2, _group_ssid, group_ssid_len) < 0)
5605                         return -1;
5606                 group_ssid = _group_ssid;
5607         }
5608
5609         if (os_strncmp(pos, "pin", 3) == 0) {
5610                 /* Request random PIN (to be displayed) and enable the PIN */
5611                 wps_method = WPS_PIN_DISPLAY;
5612         } else if (os_strncmp(pos, "pbc", 3) == 0) {
5613                 wps_method = WPS_PBC;
5614         } else if (os_strstr(pos, "p2ps") != NULL) {
5615                 wps_method = WPS_P2PS;
5616         } else {
5617                 pin = pos;
5618                 pos = os_strchr(pin, ' ');
5619                 wps_method = WPS_PIN_KEYPAD;
5620                 if (pos) {
5621                         *pos++ = '\0';
5622                         if (os_strncmp(pos, "display", 7) == 0)
5623                                 wps_method = WPS_PIN_DISPLAY;
5624                 }
5625                 if (!wps_pin_str_valid(pin)) {
5626                         os_memcpy(buf, "FAIL-INVALID-PIN\n", 17);
5627                         return 17;
5628                 }
5629         }
5630
5631         new_pin = wpas_p2p_connect(wpa_s, addr, pin, wps_method,
5632                                    persistent_group, automatic, join,
5633                                    auth, go_intent, freq, freq2, persistent_id,
5634                                    pd, ht40, vht, max_oper_chwidth,
5635                                    group_ssid, group_ssid_len);
5636         if (new_pin == -2) {
5637                 os_memcpy(buf, "FAIL-CHANNEL-UNAVAILABLE\n", 25);
5638                 return 25;
5639         }
5640         if (new_pin == -3) {
5641                 os_memcpy(buf, "FAIL-CHANNEL-UNSUPPORTED\n", 25);
5642                 return 25;
5643         }
5644         if (new_pin < 0)
5645                 return -1;
5646         if (wps_method == WPS_PIN_DISPLAY && pin == NULL) {
5647                 ret = os_snprintf(buf, buflen, "%08d", new_pin);
5648                 if (os_snprintf_error(buflen, ret))
5649                         return -1;
5650                 return ret;
5651         }
5652
5653         os_memcpy(buf, "OK\n", 3);
5654         return 3;
5655 }
5656
5657
5658 static int p2p_ctrl_listen(struct wpa_supplicant *wpa_s, char *cmd)
5659 {
5660         unsigned int timeout = atoi(cmd);
5661         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
5662                 wpa_dbg(wpa_s, MSG_INFO,
5663                         "Reject P2P_LISTEN since interface is disabled");
5664                 return -1;
5665         }
5666         return wpas_p2p_listen(wpa_s, timeout);
5667 }
5668
5669
5670 static int p2p_ctrl_prov_disc(struct wpa_supplicant *wpa_s, char *cmd)
5671 {
5672         u8 addr[ETH_ALEN];
5673         char *pos;
5674         enum wpas_p2p_prov_disc_use use = WPAS_P2P_PD_FOR_GO_NEG;
5675
5676         /* <addr> <config method> [join|auto] */
5677
5678         if (hwaddr_aton(cmd, addr))
5679                 return -1;
5680
5681         pos = cmd + 17;
5682         if (*pos != ' ')
5683                 return -1;
5684         pos++;
5685
5686         if (os_strstr(pos, " join") != NULL)
5687                 use = WPAS_P2P_PD_FOR_JOIN;
5688         else if (os_strstr(pos, " auto") != NULL)
5689                 use = WPAS_P2P_PD_AUTO;
5690
5691         return wpas_p2p_prov_disc(wpa_s, addr, pos, use, NULL);
5692 }
5693
5694
5695 static int p2p_get_passphrase(struct wpa_supplicant *wpa_s, char *buf,
5696                               size_t buflen)
5697 {
5698         struct wpa_ssid *ssid = wpa_s->current_ssid;
5699
5700         if (ssid == NULL || ssid->mode != WPAS_MODE_P2P_GO ||
5701             ssid->passphrase == NULL)
5702                 return -1;
5703
5704         os_strlcpy(buf, ssid->passphrase, buflen);
5705         return os_strlen(buf);
5706 }
5707
5708
5709 static int p2p_ctrl_serv_disc_req(struct wpa_supplicant *wpa_s, char *cmd,
5710                                   char *buf, size_t buflen)
5711 {
5712         u64 ref;
5713         int res;
5714         u8 dst_buf[ETH_ALEN], *dst;
5715         struct wpabuf *tlvs;
5716         char *pos;
5717         size_t len;
5718
5719         if (hwaddr_aton(cmd, dst_buf))
5720                 return -1;
5721         dst = dst_buf;
5722         if (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
5723             dst[3] == 0 && dst[4] == 0 && dst[5] == 0)
5724                 dst = NULL;
5725         pos = cmd + 17;
5726         if (*pos != ' ')
5727                 return -1;
5728         pos++;
5729
5730         if (os_strncmp(pos, "upnp ", 5) == 0) {
5731                 u8 version;
5732                 pos += 5;
5733                 if (hexstr2bin(pos, &version, 1) < 0)
5734                         return -1;
5735                 pos += 2;
5736                 if (*pos != ' ')
5737                         return -1;
5738                 pos++;
5739                 ref = wpas_p2p_sd_request_upnp(wpa_s, dst, version, pos);
5740 #ifdef CONFIG_WIFI_DISPLAY
5741         } else if (os_strncmp(pos, "wifi-display ", 13) == 0) {
5742                 ref = wpas_p2p_sd_request_wifi_display(wpa_s, dst, pos + 13);
5743 #endif /* CONFIG_WIFI_DISPLAY */
5744         } else if (os_strncmp(pos, "asp ", 4) == 0) {
5745                 char *svc_str;
5746                 char *svc_info = NULL;
5747                 u32 id;
5748
5749                 pos += 4;
5750                 if (sscanf(pos, "%x", &id) != 1 || id > 0xff)
5751                         return -1;
5752
5753                 pos = os_strchr(pos, ' ');
5754                 if (pos == NULL || pos[1] == '\0' || pos[1] == ' ')
5755                         return -1;
5756
5757                 svc_str = pos + 1;
5758
5759                 pos = os_strchr(svc_str, ' ');
5760
5761                 if (pos)
5762                         *pos++ = '\0';
5763
5764                 /* All remaining data is the svc_info string */
5765                 if (pos && pos[0] && pos[0] != ' ') {
5766                         len = os_strlen(pos);
5767
5768                         /* Unescape in place */
5769                         len = utf8_unescape(pos, len, pos, len);
5770                         if (len > 0xff)
5771                                 return -1;
5772
5773                         svc_info = pos;
5774                 }
5775
5776                 ref = wpas_p2p_sd_request_asp(wpa_s, dst, (u8) id,
5777                                               svc_str, svc_info);
5778         } else {
5779                 len = os_strlen(pos);
5780                 if (len & 1)
5781                         return -1;
5782                 len /= 2;
5783                 tlvs = wpabuf_alloc(len);
5784                 if (tlvs == NULL)
5785                         return -1;
5786                 if (hexstr2bin(pos, wpabuf_put(tlvs, len), len) < 0) {
5787                         wpabuf_free(tlvs);
5788                         return -1;
5789                 }
5790
5791                 ref = wpas_p2p_sd_request(wpa_s, dst, tlvs);
5792                 wpabuf_free(tlvs);
5793         }
5794         if (ref == 0)
5795                 return -1;
5796         res = os_snprintf(buf, buflen, "%llx", (long long unsigned) ref);
5797         if (os_snprintf_error(buflen, res))
5798                 return -1;
5799         return res;
5800 }
5801
5802
5803 static int p2p_ctrl_serv_disc_cancel_req(struct wpa_supplicant *wpa_s,
5804                                          char *cmd)
5805 {
5806         long long unsigned val;
5807         u64 req;
5808         if (sscanf(cmd, "%llx", &val) != 1)
5809                 return -1;
5810         req = val;
5811         return wpas_p2p_sd_cancel_request(wpa_s, req);
5812 }
5813
5814
5815 static int p2p_ctrl_serv_disc_resp(struct wpa_supplicant *wpa_s, char *cmd)
5816 {
5817         int freq;
5818         u8 dst[ETH_ALEN];
5819         u8 dialog_token;
5820         struct wpabuf *resp_tlvs;
5821         char *pos, *pos2;
5822         size_t len;
5823
5824         pos = os_strchr(cmd, ' ');
5825         if (pos == NULL)
5826                 return -1;
5827         *pos++ = '\0';
5828         freq = atoi(cmd);
5829         if (freq == 0)
5830                 return -1;
5831
5832         if (hwaddr_aton(pos, dst))
5833                 return -1;
5834         pos += 17;
5835         if (*pos != ' ')
5836                 return -1;
5837         pos++;
5838
5839         pos2 = os_strchr(pos, ' ');
5840         if (pos2 == NULL)
5841                 return -1;
5842         *pos2++ = '\0';
5843         dialog_token = atoi(pos);
5844
5845         len = os_strlen(pos2);
5846         if (len & 1)
5847                 return -1;
5848         len /= 2;
5849         resp_tlvs = wpabuf_alloc(len);
5850         if (resp_tlvs == NULL)
5851                 return -1;
5852         if (hexstr2bin(pos2, wpabuf_put(resp_tlvs, len), len) < 0) {
5853                 wpabuf_free(resp_tlvs);
5854                 return -1;
5855         }
5856
5857         wpas_p2p_sd_response(wpa_s, freq, dst, dialog_token, resp_tlvs);
5858         wpabuf_free(resp_tlvs);
5859         return 0;
5860 }
5861
5862
5863 static int p2p_ctrl_serv_disc_external(struct wpa_supplicant *wpa_s,
5864                                        char *cmd)
5865 {
5866         if (os_strcmp(cmd, "0") && os_strcmp(cmd, "1"))
5867                 return -1;
5868         wpa_s->p2p_sd_over_ctrl_iface = atoi(cmd);
5869         return 0;
5870 }
5871
5872
5873 static int p2p_ctrl_service_add_bonjour(struct wpa_supplicant *wpa_s,
5874                                         char *cmd)
5875 {
5876         char *pos;
5877         size_t len;
5878         struct wpabuf *query, *resp;
5879
5880         pos = os_strchr(cmd, ' ');
5881         if (pos == NULL)
5882                 return -1;
5883         *pos++ = '\0';
5884
5885         len = os_strlen(cmd);
5886         if (len & 1)
5887                 return -1;
5888         len /= 2;
5889         query = wpabuf_alloc(len);
5890         if (query == NULL)
5891                 return -1;
5892         if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
5893                 wpabuf_free(query);
5894                 return -1;
5895         }
5896
5897         len = os_strlen(pos);
5898         if (len & 1) {
5899                 wpabuf_free(query);
5900                 return -1;
5901         }
5902         len /= 2;
5903         resp = wpabuf_alloc(len);
5904         if (resp == NULL) {
5905                 wpabuf_free(query);
5906                 return -1;
5907         }
5908         if (hexstr2bin(pos, wpabuf_put(resp, len), len) < 0) {
5909                 wpabuf_free(query);
5910                 wpabuf_free(resp);
5911                 return -1;
5912         }
5913
5914         if (wpas_p2p_service_add_bonjour(wpa_s, query, resp) < 0) {
5915                 wpabuf_free(query);
5916                 wpabuf_free(resp);
5917                 return -1;
5918         }
5919         return 0;
5920 }
5921
5922
5923 static int p2p_ctrl_service_add_upnp(struct wpa_supplicant *wpa_s, char *cmd)
5924 {
5925         char *pos;
5926         u8 version;
5927
5928         pos = os_strchr(cmd, ' ');
5929         if (pos == NULL)
5930                 return -1;
5931         *pos++ = '\0';
5932
5933         if (hexstr2bin(cmd, &version, 1) < 0)
5934                 return -1;
5935
5936         return wpas_p2p_service_add_upnp(wpa_s, version, pos);
5937 }
5938
5939
5940 static int p2p_ctrl_service_add_asp(struct wpa_supplicant *wpa_s,
5941                                     u8 replace, char *cmd)
5942 {
5943         char *pos;
5944         char *adv_str;
5945         u32 auto_accept, adv_id, svc_state, config_methods;
5946         char *svc_info = NULL;
5947         char *cpt_prio_str;
5948         u8 cpt_prio[P2PS_FEATURE_CAPAB_CPT_MAX + 1];
5949
5950         pos = os_strchr(cmd, ' ');
5951         if (pos == NULL)
5952                 return -1;
5953         *pos++ = '\0';
5954
5955         /* Auto-Accept value is mandatory, and must be one of the
5956          * single values (0, 1, 2, 4) */
5957         auto_accept = atoi(cmd);
5958         switch (auto_accept) {
5959         case P2PS_SETUP_NONE: /* No auto-accept */
5960         case P2PS_SETUP_NEW:
5961         case P2PS_SETUP_CLIENT:
5962         case P2PS_SETUP_GROUP_OWNER:
5963                 break;
5964         default:
5965                 return -1;
5966         }
5967
5968         /* Advertisement ID is mandatory */
5969         cmd = pos;
5970         pos = os_strchr(cmd, ' ');
5971         if (pos == NULL)
5972                 return -1;
5973         *pos++ = '\0';
5974
5975         /* Handle Adv_ID == 0 (wildcard "org.wi-fi.wfds") internally. */
5976         if (sscanf(cmd, "%x", &adv_id) != 1 || adv_id == 0)
5977                 return -1;
5978
5979         /* Only allow replacements if exist, and adds if not */
5980         if (wpas_p2p_service_p2ps_id_exists(wpa_s, adv_id)) {
5981                 if (!replace)
5982                         return -1;
5983         } else {
5984                 if (replace)
5985                         return -1;
5986         }
5987
5988         /* svc_state between 0 - 0xff is mandatory */
5989         if (sscanf(pos, "%x", &svc_state) != 1 || svc_state > 0xff)
5990                 return -1;
5991
5992         pos = os_strchr(pos, ' ');
5993         if (pos == NULL)
5994                 return -1;
5995
5996         /* config_methods is mandatory */
5997         pos++;
5998         if (sscanf(pos, "%x", &config_methods) != 1)
5999                 return -1;
6000
6001         if (!(config_methods &
6002               (WPS_CONFIG_DISPLAY | WPS_CONFIG_KEYPAD | WPS_CONFIG_P2PS)))
6003                 return -1;
6004
6005         pos = os_strchr(pos, ' ');
6006         if (pos == NULL)
6007                 return -1;
6008
6009         pos++;
6010         adv_str = pos;
6011
6012         /* Advertisement string is mandatory */
6013         if (!pos[0] || pos[0] == ' ')
6014                 return -1;
6015
6016         /* Terminate svc string */
6017         pos = os_strchr(pos, ' ');
6018         if (pos != NULL)
6019                 *pos++ = '\0';
6020
6021         cpt_prio_str = (pos && pos[0]) ? os_strstr(pos, "cpt=") : NULL;
6022         if (cpt_prio_str) {
6023                 pos = os_strchr(pos, ' ');
6024                 if (pos != NULL)
6025                         *pos++ = '\0';
6026
6027                 if (p2ps_ctrl_parse_cpt_priority(cpt_prio_str + 4, cpt_prio))
6028                         return -1;
6029         } else {
6030                 cpt_prio[0] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
6031                 cpt_prio[1] = 0;
6032         }
6033
6034         /* Service and Response Information are optional */
6035         if (pos && pos[0]) {
6036                 size_t len;
6037
6038                 /* Note the bare ' included, which cannot exist legally
6039                  * in unescaped string. */
6040                 svc_info = os_strstr(pos, "svc_info='");
6041
6042                 if (svc_info) {
6043                         svc_info += 9;
6044                         len = os_strlen(svc_info);
6045                         utf8_unescape(svc_info, len, svc_info, len);
6046                 }
6047         }
6048
6049         return wpas_p2p_service_add_asp(wpa_s, auto_accept, adv_id, adv_str,
6050                                         (u8) svc_state, (u16) config_methods,
6051                                         svc_info, cpt_prio);
6052 }
6053
6054
6055 static int p2p_ctrl_service_add(struct wpa_supplicant *wpa_s, char *cmd)
6056 {
6057         char *pos;
6058
6059         pos = os_strchr(cmd, ' ');
6060         if (pos == NULL)
6061                 return -1;
6062         *pos++ = '\0';
6063
6064         if (os_strcmp(cmd, "bonjour") == 0)
6065                 return p2p_ctrl_service_add_bonjour(wpa_s, pos);
6066         if (os_strcmp(cmd, "upnp") == 0)
6067                 return p2p_ctrl_service_add_upnp(wpa_s, pos);
6068         if (os_strcmp(cmd, "asp") == 0)
6069                 return p2p_ctrl_service_add_asp(wpa_s, 0, pos);
6070         wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
6071         return -1;
6072 }
6073
6074
6075 static int p2p_ctrl_service_del_bonjour(struct wpa_supplicant *wpa_s,
6076                                         char *cmd)
6077 {
6078         size_t len;
6079         struct wpabuf *query;
6080         int ret;
6081
6082         len = os_strlen(cmd);
6083         if (len & 1)
6084                 return -1;
6085         len /= 2;
6086         query = wpabuf_alloc(len);
6087         if (query == NULL)
6088                 return -1;
6089         if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
6090                 wpabuf_free(query);
6091                 return -1;
6092         }
6093
6094         ret = wpas_p2p_service_del_bonjour(wpa_s, query);
6095         wpabuf_free(query);
6096         return ret;
6097 }
6098
6099
6100 static int p2p_ctrl_service_del_upnp(struct wpa_supplicant *wpa_s, char *cmd)
6101 {
6102         char *pos;
6103         u8 version;
6104
6105         pos = os_strchr(cmd, ' ');
6106         if (pos == NULL)
6107                 return -1;
6108         *pos++ = '\0';
6109
6110         if (hexstr2bin(cmd, &version, 1) < 0)
6111                 return -1;
6112
6113         return wpas_p2p_service_del_upnp(wpa_s, version, pos);
6114 }
6115
6116
6117 static int p2p_ctrl_service_del_asp(struct wpa_supplicant *wpa_s, char *cmd)
6118 {
6119         u32 adv_id;
6120
6121         if (os_strcmp(cmd, "all") == 0) {
6122                 wpas_p2p_service_flush_asp(wpa_s);
6123                 return 0;
6124         }
6125
6126         if (sscanf(cmd, "%x", &adv_id) != 1)
6127                 return -1;
6128
6129         return wpas_p2p_service_del_asp(wpa_s, adv_id);
6130 }
6131
6132
6133 static int p2p_ctrl_service_del(struct wpa_supplicant *wpa_s, char *cmd)
6134 {
6135         char *pos;
6136
6137         pos = os_strchr(cmd, ' ');
6138         if (pos == NULL)
6139                 return -1;
6140         *pos++ = '\0';
6141
6142         if (os_strcmp(cmd, "bonjour") == 0)
6143                 return p2p_ctrl_service_del_bonjour(wpa_s, pos);
6144         if (os_strcmp(cmd, "upnp") == 0)
6145                 return p2p_ctrl_service_del_upnp(wpa_s, pos);
6146         if (os_strcmp(cmd, "asp") == 0)
6147                 return p2p_ctrl_service_del_asp(wpa_s, pos);
6148         wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
6149         return -1;
6150 }
6151
6152
6153 static int p2p_ctrl_service_replace(struct wpa_supplicant *wpa_s, char *cmd)
6154 {
6155         char *pos;
6156
6157         pos = os_strchr(cmd, ' ');
6158         if (pos == NULL)
6159                 return -1;
6160         *pos++ = '\0';
6161
6162         if (os_strcmp(cmd, "asp") == 0)
6163                 return p2p_ctrl_service_add_asp(wpa_s, 1, pos);
6164
6165         wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
6166         return -1;
6167 }
6168
6169
6170 static int p2p_ctrl_reject(struct wpa_supplicant *wpa_s, char *cmd)
6171 {
6172         u8 addr[ETH_ALEN];
6173
6174         /* <addr> */
6175
6176         if (hwaddr_aton(cmd, addr))
6177                 return -1;
6178
6179         return wpas_p2p_reject(wpa_s, addr);
6180 }
6181
6182
6183 static int p2p_ctrl_invite_persistent(struct wpa_supplicant *wpa_s, char *cmd)
6184 {
6185         char *pos;
6186         int id;
6187         struct wpa_ssid *ssid;
6188         u8 *_peer = NULL, peer[ETH_ALEN];
6189         int freq = 0, pref_freq = 0;
6190         int ht40, vht, max_oper_chwidth, chwidth = 0, freq2 = 0;
6191
6192         id = atoi(cmd);
6193         pos = os_strstr(cmd, " peer=");
6194         if (pos) {
6195                 pos += 6;
6196                 if (hwaddr_aton(pos, peer))
6197                         return -1;
6198                 _peer = peer;
6199         }
6200         ssid = wpa_config_get_network(wpa_s->conf, id);
6201         if (ssid == NULL || ssid->disabled != 2) {
6202                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
6203                            "for persistent P2P group",
6204                            id);
6205                 return -1;
6206         }
6207
6208         pos = os_strstr(cmd, " freq=");
6209         if (pos) {
6210                 pos += 6;
6211                 freq = atoi(pos);
6212                 if (freq <= 0)
6213                         return -1;
6214         }
6215
6216         pos = os_strstr(cmd, " pref=");
6217         if (pos) {
6218                 pos += 6;
6219                 pref_freq = atoi(pos);
6220                 if (pref_freq <= 0)
6221                         return -1;
6222         }
6223
6224         vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
6225         ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
6226                 vht;
6227
6228         pos = os_strstr(cmd, "freq2=");
6229         if (pos)
6230                 freq2 = atoi(pos + 6);
6231
6232         pos = os_strstr(cmd, " max_oper_chwidth=");
6233         if (pos)
6234                 chwidth = atoi(pos + 18);
6235
6236         max_oper_chwidth = parse_freq(chwidth, freq2);
6237         if (max_oper_chwidth < 0)
6238                 return -1;
6239
6240         return wpas_p2p_invite(wpa_s, _peer, ssid, NULL, freq, freq2, ht40, vht,
6241                                max_oper_chwidth, pref_freq);
6242 }
6243
6244
6245 static int p2p_ctrl_invite_group(struct wpa_supplicant *wpa_s, char *cmd)
6246 {
6247         char *pos;
6248         u8 peer[ETH_ALEN], go_dev_addr[ETH_ALEN], *go_dev = NULL;
6249
6250         pos = os_strstr(cmd, " peer=");
6251         if (!pos)
6252                 return -1;
6253
6254         *pos = '\0';
6255         pos += 6;
6256         if (hwaddr_aton(pos, peer)) {
6257                 wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'", pos);
6258                 return -1;
6259         }
6260
6261         pos = os_strstr(pos, " go_dev_addr=");
6262         if (pos) {
6263                 pos += 13;
6264                 if (hwaddr_aton(pos, go_dev_addr)) {
6265                         wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'",
6266                                    pos);
6267                         return -1;
6268                 }
6269                 go_dev = go_dev_addr;
6270         }
6271
6272         return wpas_p2p_invite_group(wpa_s, cmd, peer, go_dev);
6273 }
6274
6275
6276 static int p2p_ctrl_invite(struct wpa_supplicant *wpa_s, char *cmd)
6277 {
6278         if (os_strncmp(cmd, "persistent=", 11) == 0)
6279                 return p2p_ctrl_invite_persistent(wpa_s, cmd + 11);
6280         if (os_strncmp(cmd, "group=", 6) == 0)
6281                 return p2p_ctrl_invite_group(wpa_s, cmd + 6);
6282
6283         return -1;
6284 }
6285
6286
6287 static int p2p_ctrl_group_add_persistent(struct wpa_supplicant *wpa_s,
6288                                          int id, int freq, int vht_center_freq2,
6289                                          int ht40, int vht, int vht_chwidth)
6290 {
6291         struct wpa_ssid *ssid;
6292
6293         ssid = wpa_config_get_network(wpa_s->conf, id);
6294         if (ssid == NULL || ssid->disabled != 2) {
6295                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
6296                            "for persistent P2P group",
6297                            id);
6298                 return -1;
6299         }
6300
6301         return wpas_p2p_group_add_persistent(wpa_s, ssid, 0, freq,
6302                                              vht_center_freq2, 0, ht40, vht,
6303                                              vht_chwidth, NULL, 0, 0);
6304 }
6305
6306
6307 static int p2p_ctrl_group_add(struct wpa_supplicant *wpa_s, char *cmd)
6308 {
6309         int freq = 0, persistent = 0, group_id = -1;
6310         int vht = wpa_s->conf->p2p_go_vht;
6311         int ht40 = wpa_s->conf->p2p_go_ht40 || vht;
6312         int max_oper_chwidth, chwidth = 0, freq2 = 0;
6313         char *token, *context = NULL;
6314 #ifdef CONFIG_ACS
6315         int acs = 0;
6316 #endif /* CONFIG_ACS */
6317
6318         while ((token = str_token(cmd, " ", &context))) {
6319                 if (sscanf(token, "freq2=%d", &freq2) == 1 ||
6320                     sscanf(token, "persistent=%d", &group_id) == 1 ||
6321                     sscanf(token, "max_oper_chwidth=%d", &chwidth) == 1) {
6322                         continue;
6323 #ifdef CONFIG_ACS
6324                 } else if (os_strcmp(token, "freq=acs") == 0) {
6325                         acs = 1;
6326 #endif /* CONFIG_ACS */
6327                 } else if (sscanf(token, "freq=%d", &freq) == 1) {
6328                         continue;
6329                 } else if (os_strcmp(token, "ht40") == 0) {
6330                         ht40 = 1;
6331                 } else if (os_strcmp(token, "vht") == 0) {
6332                         vht = 1;
6333                         ht40 = 1;
6334                 } else if (os_strcmp(token, "persistent") == 0) {
6335                         persistent = 1;
6336                 } else {
6337                         wpa_printf(MSG_DEBUG,
6338                                    "CTRL: Invalid P2P_GROUP_ADD parameter: '%s'",
6339                                    token);
6340                         return -1;
6341                 }
6342         }
6343
6344 #ifdef CONFIG_ACS
6345         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_ACS_OFFLOAD) &&
6346             (acs || freq == 2 || freq == 5)) {
6347                 if (freq == 2 && wpa_s->best_24_freq <= 0) {
6348                         wpa_s->p2p_go_acs_band = HOSTAPD_MODE_IEEE80211G;
6349                         wpa_s->p2p_go_do_acs = 1;
6350                         freq = 0;
6351                 } else if (freq == 5 && wpa_s->best_5_freq <= 0) {
6352                         wpa_s->p2p_go_acs_band = HOSTAPD_MODE_IEEE80211A;
6353                         wpa_s->p2p_go_do_acs = 1;
6354                         freq = 0;
6355                 } else {
6356                         wpa_s->p2p_go_acs_band = HOSTAPD_MODE_IEEE80211ANY;
6357                         wpa_s->p2p_go_do_acs = 1;
6358                 }
6359         }
6360 #endif /* CONFIG_ACS */
6361
6362         max_oper_chwidth = parse_freq(chwidth, freq2);
6363         if (max_oper_chwidth < 0)
6364                 return -1;
6365
6366         if (group_id >= 0)
6367                 return p2p_ctrl_group_add_persistent(wpa_s, group_id,
6368                                                      freq, freq2, ht40, vht,
6369                                                      max_oper_chwidth);
6370
6371         return wpas_p2p_group_add(wpa_s, persistent, freq, freq2, ht40, vht,
6372                                   max_oper_chwidth);
6373 }
6374
6375
6376 static int p2p_ctrl_group_member(struct wpa_supplicant *wpa_s, const char *cmd,
6377                                  char *buf, size_t buflen)
6378 {
6379         u8 dev_addr[ETH_ALEN];
6380         struct wpa_ssid *ssid;
6381         int res;
6382         const u8 *iaddr;
6383
6384         ssid = wpa_s->current_ssid;
6385         if (!wpa_s->global->p2p || !ssid || ssid->mode != WPAS_MODE_P2P_GO ||
6386             hwaddr_aton(cmd, dev_addr))
6387                 return -1;
6388
6389         iaddr = p2p_group_get_client_interface_addr(wpa_s->p2p_group, dev_addr);
6390         if (!iaddr)
6391                 return -1;
6392         res = os_snprintf(buf, buflen, MACSTR, MAC2STR(iaddr));
6393         if (os_snprintf_error(buflen, res))
6394                 return -1;
6395         return res;
6396 }
6397
6398
6399 static int wpas_find_p2p_dev_addr_bss(struct wpa_global *global,
6400                                       const u8 *p2p_dev_addr)
6401 {
6402         struct wpa_supplicant *wpa_s;
6403
6404         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
6405                 if (wpa_bss_get_p2p_dev_addr(wpa_s, p2p_dev_addr))
6406                         return 1;
6407         }
6408
6409         return 0;
6410 }
6411
6412
6413 static int p2p_ctrl_peer(struct wpa_supplicant *wpa_s, char *cmd,
6414                          char *buf, size_t buflen)
6415 {
6416         u8 addr[ETH_ALEN], *addr_ptr, group_capab;
6417         int next, res;
6418         const struct p2p_peer_info *info;
6419         char *pos, *end;
6420         char devtype[WPS_DEV_TYPE_BUFSIZE];
6421         struct wpa_ssid *ssid;
6422         size_t i;
6423
6424         if (!wpa_s->global->p2p)
6425                 return -1;
6426
6427         if (os_strcmp(cmd, "FIRST") == 0) {
6428                 addr_ptr = NULL;
6429                 next = 0;
6430         } else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
6431                 if (hwaddr_aton(cmd + 5, addr) < 0)
6432                         return -1;
6433                 addr_ptr = addr;
6434                 next = 1;
6435         } else {
6436                 if (hwaddr_aton(cmd, addr) < 0)
6437                         return -1;
6438                 addr_ptr = addr;
6439                 next = 0;
6440         }
6441
6442         info = p2p_get_peer_info(wpa_s->global->p2p, addr_ptr, next);
6443         if (info == NULL)
6444                 return -1;
6445         group_capab = info->group_capab;
6446
6447         if (group_capab &&
6448             !wpas_find_p2p_dev_addr_bss(wpa_s->global, info->p2p_device_addr)) {
6449                 wpa_printf(MSG_DEBUG,
6450                            "P2P: Could not find any BSS with p2p_dev_addr "
6451                            MACSTR ", hence override group_capab from 0x%x to 0",
6452                            MAC2STR(info->p2p_device_addr), group_capab);
6453                 group_capab = 0;
6454         }
6455
6456         pos = buf;
6457         end = buf + buflen;
6458
6459         res = os_snprintf(pos, end - pos, MACSTR "\n"
6460                           "pri_dev_type=%s\n"
6461                           "device_name=%s\n"
6462                           "manufacturer=%s\n"
6463                           "model_name=%s\n"
6464                           "model_number=%s\n"
6465                           "serial_number=%s\n"
6466                           "config_methods=0x%x\n"
6467                           "dev_capab=0x%x\n"
6468                           "group_capab=0x%x\n"
6469                           "level=%d\n",
6470                           MAC2STR(info->p2p_device_addr),
6471                           wps_dev_type_bin2str(info->pri_dev_type,
6472                                                devtype, sizeof(devtype)),
6473                           info->device_name,
6474                           info->manufacturer,
6475                           info->model_name,
6476                           info->model_number,
6477                           info->serial_number,
6478                           info->config_methods,
6479                           info->dev_capab,
6480                           group_capab,
6481                           info->level);
6482         if (os_snprintf_error(end - pos, res))
6483                 return pos - buf;
6484         pos += res;
6485
6486         for (i = 0; i < info->wps_sec_dev_type_list_len / WPS_DEV_TYPE_LEN; i++)
6487         {
6488                 const u8 *t;
6489                 t = &info->wps_sec_dev_type_list[i * WPS_DEV_TYPE_LEN];
6490                 res = os_snprintf(pos, end - pos, "sec_dev_type=%s\n",
6491                                   wps_dev_type_bin2str(t, devtype,
6492                                                        sizeof(devtype)));
6493                 if (os_snprintf_error(end - pos, res))
6494                         return pos - buf;
6495                 pos += res;
6496         }
6497
6498         ssid = wpas_p2p_get_persistent(wpa_s, info->p2p_device_addr, NULL, 0);
6499         if (ssid) {
6500                 res = os_snprintf(pos, end - pos, "persistent=%d\n", ssid->id);
6501                 if (os_snprintf_error(end - pos, res))
6502                         return pos - buf;
6503                 pos += res;
6504         }
6505
6506         res = p2p_get_peer_info_txt(info, pos, end - pos);
6507         if (res < 0)
6508                 return pos - buf;
6509         pos += res;
6510
6511         if (info->vendor_elems) {
6512                 res = os_snprintf(pos, end - pos, "vendor_elems=");
6513                 if (os_snprintf_error(end - pos, res))
6514                         return pos - buf;
6515                 pos += res;
6516
6517                 pos += wpa_snprintf_hex(pos, end - pos,
6518                                         wpabuf_head(info->vendor_elems),
6519                                         wpabuf_len(info->vendor_elems));
6520
6521                 res = os_snprintf(pos, end - pos, "\n");
6522                 if (os_snprintf_error(end - pos, res))
6523                         return pos - buf;
6524                 pos += res;
6525         }
6526
6527         return pos - buf;
6528 }
6529
6530
6531 static int p2p_ctrl_disallow_freq(struct wpa_supplicant *wpa_s,
6532                                   const char *param)
6533 {
6534         unsigned int i;
6535
6536         if (wpa_s->global->p2p == NULL)
6537                 return -1;
6538
6539         if (freq_range_list_parse(&wpa_s->global->p2p_disallow_freq, param) < 0)
6540                 return -1;
6541
6542         for (i = 0; i < wpa_s->global->p2p_disallow_freq.num; i++) {
6543                 struct wpa_freq_range *freq;
6544                 freq = &wpa_s->global->p2p_disallow_freq.range[i];
6545                 wpa_printf(MSG_DEBUG, "P2P: Disallowed frequency range %u-%u",
6546                            freq->min, freq->max);
6547         }
6548
6549         wpas_p2p_update_channel_list(wpa_s, WPAS_P2P_CHANNEL_UPDATE_DISALLOW);
6550         return 0;
6551 }
6552
6553
6554 static int p2p_ctrl_set(struct wpa_supplicant *wpa_s, char *cmd)
6555 {
6556         char *param;
6557
6558         if (wpa_s->global->p2p == NULL)
6559                 return -1;
6560
6561         param = os_strchr(cmd, ' ');
6562         if (param == NULL)
6563                 return -1;
6564         *param++ = '\0';
6565
6566         if (os_strcmp(cmd, "discoverability") == 0) {
6567                 p2p_set_client_discoverability(wpa_s->global->p2p,
6568                                                atoi(param));
6569                 return 0;
6570         }
6571
6572         if (os_strcmp(cmd, "managed") == 0) {
6573                 p2p_set_managed_oper(wpa_s->global->p2p, atoi(param));
6574                 return 0;
6575         }
6576
6577         if (os_strcmp(cmd, "listen_channel") == 0) {
6578                 char *pos;
6579                 u8 channel, op_class;
6580
6581                 channel = atoi(param);
6582                 pos = os_strchr(param, ' ');
6583                 op_class = pos ? atoi(pos) : 81;
6584
6585                 return p2p_set_listen_channel(wpa_s->global->p2p, op_class,
6586                                               channel, 1);
6587         }
6588
6589         if (os_strcmp(cmd, "ssid_postfix") == 0) {
6590                 return p2p_set_ssid_postfix(wpa_s->global->p2p, (u8 *) param,
6591                                             os_strlen(param));
6592         }
6593
6594         if (os_strcmp(cmd, "noa") == 0) {
6595                 char *pos;
6596                 int count, start, duration;
6597                 /* GO NoA parameters: count,start_offset(ms),duration(ms) */
6598                 count = atoi(param);
6599                 pos = os_strchr(param, ',');
6600                 if (pos == NULL)
6601                         return -1;
6602                 pos++;
6603                 start = atoi(pos);
6604                 pos = os_strchr(pos, ',');
6605                 if (pos == NULL)
6606                         return -1;
6607                 pos++;
6608                 duration = atoi(pos);
6609                 if (count < 0 || count > 255 || start < 0 || duration < 0)
6610                         return -1;
6611                 if (count == 0 && duration > 0)
6612                         return -1;
6613                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: P2P_SET GO NoA: count=%d "
6614                            "start=%d duration=%d", count, start, duration);
6615                 return wpas_p2p_set_noa(wpa_s, count, start, duration);
6616         }
6617
6618         if (os_strcmp(cmd, "ps") == 0)
6619                 return wpa_drv_set_p2p_powersave(wpa_s, atoi(param), -1, -1);
6620
6621         if (os_strcmp(cmd, "oppps") == 0)
6622                 return wpa_drv_set_p2p_powersave(wpa_s, -1, atoi(param), -1);
6623
6624         if (os_strcmp(cmd, "ctwindow") == 0)
6625                 return wpa_drv_set_p2p_powersave(wpa_s, -1, -1, atoi(param));
6626
6627         if (os_strcmp(cmd, "disabled") == 0) {
6628                 wpa_s->global->p2p_disabled = atoi(param);
6629                 wpa_printf(MSG_DEBUG, "P2P functionality %s",
6630                            wpa_s->global->p2p_disabled ?
6631                            "disabled" : "enabled");
6632                 if (wpa_s->global->p2p_disabled) {
6633                         wpas_p2p_stop_find(wpa_s);
6634                         os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
6635                         p2p_flush(wpa_s->global->p2p);
6636                 }
6637                 return 0;
6638         }
6639
6640         if (os_strcmp(cmd, "conc_pref") == 0) {
6641                 if (os_strcmp(param, "sta") == 0)
6642                         wpa_s->global->conc_pref = WPA_CONC_PREF_STA;
6643                 else if (os_strcmp(param, "p2p") == 0)
6644                         wpa_s->global->conc_pref = WPA_CONC_PREF_P2P;
6645                 else {
6646                         wpa_printf(MSG_INFO, "Invalid conc_pref value");
6647                         return -1;
6648                 }
6649                 wpa_printf(MSG_DEBUG, "Single channel concurrency preference: "
6650                            "%s", param);
6651                 return 0;
6652         }
6653
6654         if (os_strcmp(cmd, "force_long_sd") == 0) {
6655                 wpa_s->force_long_sd = atoi(param);
6656                 return 0;
6657         }
6658
6659         if (os_strcmp(cmd, "peer_filter") == 0) {
6660                 u8 addr[ETH_ALEN];
6661                 if (hwaddr_aton(param, addr))
6662                         return -1;
6663                 p2p_set_peer_filter(wpa_s->global->p2p, addr);
6664                 return 0;
6665         }
6666
6667         if (os_strcmp(cmd, "cross_connect") == 0)
6668                 return wpas_p2p_set_cross_connect(wpa_s, atoi(param));
6669
6670         if (os_strcmp(cmd, "go_apsd") == 0) {
6671                 if (os_strcmp(param, "disable") == 0)
6672                         wpa_s->set_ap_uapsd = 0;
6673                 else {
6674                         wpa_s->set_ap_uapsd = 1;
6675                         wpa_s->ap_uapsd = atoi(param);
6676                 }
6677                 return 0;
6678         }
6679
6680         if (os_strcmp(cmd, "client_apsd") == 0) {
6681                 if (os_strcmp(param, "disable") == 0)
6682                         wpa_s->set_sta_uapsd = 0;
6683                 else {
6684                         int be, bk, vi, vo;
6685                         char *pos;
6686                         /* format: BE,BK,VI,VO;max SP Length */
6687                         be = atoi(param);
6688                         pos = os_strchr(param, ',');
6689                         if (pos == NULL)
6690                                 return -1;
6691                         pos++;
6692                         bk = atoi(pos);
6693                         pos = os_strchr(pos, ',');
6694                         if (pos == NULL)
6695                                 return -1;
6696                         pos++;
6697                         vi = atoi(pos);
6698                         pos = os_strchr(pos, ',');
6699                         if (pos == NULL)
6700                                 return -1;
6701                         pos++;
6702                         vo = atoi(pos);
6703                         /* ignore max SP Length for now */
6704
6705                         wpa_s->set_sta_uapsd = 1;
6706                         wpa_s->sta_uapsd = 0;
6707                         if (be)
6708                                 wpa_s->sta_uapsd |= BIT(0);
6709                         if (bk)
6710                                 wpa_s->sta_uapsd |= BIT(1);
6711                         if (vi)
6712                                 wpa_s->sta_uapsd |= BIT(2);
6713                         if (vo)
6714                                 wpa_s->sta_uapsd |= BIT(3);
6715                 }
6716                 return 0;
6717         }
6718
6719         if (os_strcmp(cmd, "disallow_freq") == 0)
6720                 return p2p_ctrl_disallow_freq(wpa_s, param);
6721
6722         if (os_strcmp(cmd, "disc_int") == 0) {
6723                 int min_disc_int, max_disc_int, max_disc_tu;
6724                 char *pos;
6725
6726                 pos = param;
6727
6728                 min_disc_int = atoi(pos);
6729                 pos = os_strchr(pos, ' ');
6730                 if (pos == NULL)
6731                         return -1;
6732                 *pos++ = '\0';
6733
6734                 max_disc_int = atoi(pos);
6735                 pos = os_strchr(pos, ' ');
6736                 if (pos == NULL)
6737                         return -1;
6738                 *pos++ = '\0';
6739
6740                 max_disc_tu = atoi(pos);
6741
6742                 return p2p_set_disc_int(wpa_s->global->p2p, min_disc_int,
6743                                         max_disc_int, max_disc_tu);
6744         }
6745
6746         if (os_strcmp(cmd, "per_sta_psk") == 0) {
6747                 wpa_s->global->p2p_per_sta_psk = !!atoi(param);
6748                 return 0;
6749         }
6750
6751 #ifdef CONFIG_WPS_NFC
6752         if (os_strcmp(cmd, "nfc_tag") == 0)
6753                 return wpas_p2p_nfc_tag_enabled(wpa_s, !!atoi(param));
6754 #endif /* CONFIG_WPS_NFC */
6755
6756         if (os_strcmp(cmd, "disable_ip_addr_req") == 0) {
6757                 wpa_s->p2p_disable_ip_addr_req = !!atoi(param);
6758                 return 0;
6759         }
6760
6761         if (os_strcmp(cmd, "override_pref_op_chan") == 0) {
6762                 int op_class, chan;
6763
6764                 op_class = atoi(param);
6765                 param = os_strchr(param, ':');
6766                 if (!param)
6767                         return -1;
6768                 param++;
6769                 chan = atoi(param);
6770                 p2p_set_override_pref_op_chan(wpa_s->global->p2p, op_class,
6771                                               chan);
6772                 return 0;
6773         }
6774
6775         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown P2P_SET field value '%s'",
6776                    cmd);
6777
6778         return -1;
6779 }
6780
6781
6782 static void p2p_ctrl_flush(struct wpa_supplicant *wpa_s)
6783 {
6784         os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
6785         wpa_s->force_long_sd = 0;
6786
6787 #ifdef CONFIG_TESTING_OPTIONS
6788         os_free(wpa_s->get_pref_freq_list_override);
6789         wpa_s->get_pref_freq_list_override = NULL;
6790 #endif /* CONFIG_TESTING_OPTIONS */
6791
6792         wpas_p2p_stop_find(wpa_s);
6793         wpa_s->parent->p2ps_method_config_any = 0;
6794         if (wpa_s->global->p2p)
6795                 p2p_flush(wpa_s->global->p2p);
6796 }
6797
6798
6799 static int p2p_ctrl_presence_req(struct wpa_supplicant *wpa_s, char *cmd)
6800 {
6801         char *pos, *pos2;
6802         unsigned int dur1 = 0, int1 = 0, dur2 = 0, int2 = 0;
6803
6804         if (cmd[0]) {
6805                 pos = os_strchr(cmd, ' ');
6806                 if (pos == NULL)
6807                         return -1;
6808                 *pos++ = '\0';
6809                 dur1 = atoi(cmd);
6810
6811                 pos2 = os_strchr(pos, ' ');
6812                 if (pos2)
6813                         *pos2++ = '\0';
6814                 int1 = atoi(pos);
6815         } else
6816                 pos2 = NULL;
6817
6818         if (pos2) {
6819                 pos = os_strchr(pos2, ' ');
6820                 if (pos == NULL)
6821                         return -1;
6822                 *pos++ = '\0';
6823                 dur2 = atoi(pos2);
6824                 int2 = atoi(pos);
6825         }
6826
6827         return wpas_p2p_presence_req(wpa_s, dur1, int1, dur2, int2);
6828 }
6829
6830
6831 static int p2p_ctrl_ext_listen(struct wpa_supplicant *wpa_s, char *cmd)
6832 {
6833         char *pos;
6834         unsigned int period = 0, interval = 0;
6835
6836         if (cmd[0]) {
6837                 pos = os_strchr(cmd, ' ');
6838                 if (pos == NULL)
6839                         return -1;
6840                 *pos++ = '\0';
6841                 period = atoi(cmd);
6842                 interval = atoi(pos);
6843         }
6844
6845         return wpas_p2p_ext_listen(wpa_s, period, interval);
6846 }
6847
6848
6849 static int p2p_ctrl_remove_client(struct wpa_supplicant *wpa_s, const char *cmd)
6850 {
6851         const char *pos;
6852         u8 peer[ETH_ALEN];
6853         int iface_addr = 0;
6854
6855         pos = cmd;
6856         if (os_strncmp(pos, "iface=", 6) == 0) {
6857                 iface_addr = 1;
6858                 pos += 6;
6859         }
6860         if (hwaddr_aton(pos, peer))
6861                 return -1;
6862
6863         wpas_p2p_remove_client(wpa_s, peer, iface_addr);
6864         return 0;
6865 }
6866
6867
6868 static int p2p_ctrl_iface_p2p_lo_start(struct wpa_supplicant *wpa_s, char *cmd)
6869 {
6870         int freq = 0, period = 0, interval = 0, count = 0;
6871
6872         if (sscanf(cmd, "%d %d %d %d", &freq, &period, &interval, &count) != 4)
6873         {
6874                 wpa_printf(MSG_DEBUG,
6875                            "CTRL: Invalid P2P LO Start parameter: '%s'", cmd);
6876                 return -1;
6877         }
6878
6879         return wpas_p2p_lo_start(wpa_s, freq, period, interval, count);
6880 }
6881
6882 #endif /* CONFIG_P2P */
6883
6884
6885 static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s, char *val)
6886 {
6887         struct wpa_freq_range_list ranges;
6888         int *freqs = NULL;
6889         struct hostapd_hw_modes *mode;
6890         u16 i;
6891
6892         if (wpa_s->hw.modes == NULL)
6893                 return NULL;
6894
6895         os_memset(&ranges, 0, sizeof(ranges));
6896         if (freq_range_list_parse(&ranges, val) < 0)
6897                 return NULL;
6898
6899         for (i = 0; i < wpa_s->hw.num_modes; i++) {
6900                 int j;
6901
6902                 mode = &wpa_s->hw.modes[i];
6903                 for (j = 0; j < mode->num_channels; j++) {
6904                         unsigned int freq;
6905
6906                         if (mode->channels[j].flag & HOSTAPD_CHAN_DISABLED)
6907                                 continue;
6908
6909                         freq = mode->channels[j].freq;
6910                         if (!freq_range_list_includes(&ranges, freq))
6911                                 continue;
6912
6913                         int_array_add_unique(&freqs, freq);
6914                 }
6915         }
6916
6917         os_free(ranges.range);
6918         return freqs;
6919 }
6920
6921
6922 #ifdef CONFIG_INTERWORKING
6923
6924 static int ctrl_interworking_select(struct wpa_supplicant *wpa_s, char *param)
6925 {
6926         int auto_sel = 0;
6927         int *freqs = NULL;
6928
6929         if (param) {
6930                 char *pos;
6931
6932                 auto_sel = os_strstr(param, "auto") != NULL;
6933
6934                 pos = os_strstr(param, "freq=");
6935                 if (pos) {
6936                         freqs = freq_range_to_channel_list(wpa_s, pos + 5);
6937                         if (freqs == NULL)
6938                                 return -1;
6939                 }
6940
6941         }
6942
6943         return interworking_select(wpa_s, auto_sel, freqs);
6944 }
6945
6946
6947 static int ctrl_interworking_connect(struct wpa_supplicant *wpa_s, char *dst,
6948                                      int only_add)
6949 {
6950         u8 bssid[ETH_ALEN];
6951         struct wpa_bss *bss;
6952
6953         if (hwaddr_aton(dst, bssid)) {
6954                 wpa_printf(MSG_DEBUG, "Invalid BSSID '%s'", dst);
6955                 return -1;
6956         }
6957
6958         bss = wpa_bss_get_bssid(wpa_s, bssid);
6959         if (bss == NULL) {
6960                 wpa_printf(MSG_DEBUG, "Could not find BSS " MACSTR,
6961                            MAC2STR(bssid));
6962                 return -1;
6963         }
6964
6965         if (bss->ssid_len == 0) {
6966                 int found = 0;
6967
6968                 wpa_printf(MSG_DEBUG, "Selected BSS entry for " MACSTR
6969                            " does not have SSID information", MAC2STR(bssid));
6970
6971                 dl_list_for_each_reverse(bss, &wpa_s->bss, struct wpa_bss,
6972                                          list) {
6973                         if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0 &&
6974                             bss->ssid_len > 0) {
6975                                 found = 1;
6976                                 break;
6977                         }
6978                 }
6979
6980                 if (!found)
6981                         return -1;
6982                 wpa_printf(MSG_DEBUG,
6983                            "Found another matching BSS entry with SSID");
6984         }
6985
6986         return interworking_connect(wpa_s, bss, only_add);
6987 }
6988
6989
6990 static int get_anqp(struct wpa_supplicant *wpa_s, char *dst)
6991 {
6992         u8 dst_addr[ETH_ALEN];
6993         int used;
6994         char *pos;
6995 #define MAX_ANQP_INFO_ID 100
6996         u16 id[MAX_ANQP_INFO_ID];
6997         size_t num_id = 0;
6998         u32 subtypes = 0;
6999         u32 mbo_subtypes = 0;
7000
7001         used = hwaddr_aton2(dst, dst_addr);
7002         if (used < 0)
7003                 return -1;
7004         pos = dst + used;
7005         if (*pos == ' ')
7006                 pos++;
7007         while (num_id < MAX_ANQP_INFO_ID) {
7008                 if (os_strncmp(pos, "hs20:", 5) == 0) {
7009 #ifdef CONFIG_HS20
7010                         int num = atoi(pos + 5);
7011                         if (num <= 0 || num > 31)
7012                                 return -1;
7013                         subtypes |= BIT(num);
7014 #else /* CONFIG_HS20 */
7015                         return -1;
7016 #endif /* CONFIG_HS20 */
7017                 } else if (os_strncmp(pos, "mbo:", 4) == 0) {
7018 #ifdef CONFIG_MBO
7019                         int num = atoi(pos + 4);
7020
7021                         if (num <= 0 || num > MAX_MBO_ANQP_SUBTYPE)
7022                                 return -1;
7023                         mbo_subtypes |= BIT(num);
7024 #else /* CONFIG_MBO */
7025                         return -1;
7026 #endif /* CONFIG_MBO */
7027                 } else {
7028                         id[num_id] = atoi(pos);
7029                         if (id[num_id])
7030                                 num_id++;
7031                 }
7032                 pos = os_strchr(pos + 1, ',');
7033                 if (pos == NULL)
7034                         break;
7035                 pos++;
7036         }
7037
7038         if (num_id == 0 && !subtypes && !mbo_subtypes)
7039                 return -1;
7040
7041         return anqp_send_req(wpa_s, dst_addr, id, num_id, subtypes,
7042                              mbo_subtypes);
7043 }
7044
7045
7046 static int gas_request(struct wpa_supplicant *wpa_s, char *cmd)
7047 {
7048         u8 dst_addr[ETH_ALEN];
7049         struct wpabuf *advproto, *query = NULL;
7050         int used, ret = -1;
7051         char *pos, *end;
7052         size_t len;
7053
7054         used = hwaddr_aton2(cmd, dst_addr);
7055         if (used < 0)
7056                 return -1;
7057
7058         pos = cmd + used;
7059         while (*pos == ' ')
7060                 pos++;
7061
7062         /* Advertisement Protocol ID */
7063         end = os_strchr(pos, ' ');
7064         if (end)
7065                 len = end - pos;
7066         else
7067                 len = os_strlen(pos);
7068         if (len & 0x01)
7069                 return -1;
7070         len /= 2;
7071         if (len == 0)
7072                 return -1;
7073         advproto = wpabuf_alloc(len);
7074         if (advproto == NULL)
7075                 return -1;
7076         if (hexstr2bin(pos, wpabuf_put(advproto, len), len) < 0)
7077                 goto fail;
7078
7079         if (end) {
7080                 /* Optional Query Request */
7081                 pos = end + 1;
7082                 while (*pos == ' ')
7083                         pos++;
7084
7085                 len = os_strlen(pos);
7086                 if (len) {
7087                         if (len & 0x01)
7088                                 goto fail;
7089                         len /= 2;
7090                         if (len == 0)
7091                                 goto fail;
7092                         query = wpabuf_alloc(len);
7093                         if (query == NULL)
7094                                 goto fail;
7095                         if (hexstr2bin(pos, wpabuf_put(query, len), len) < 0)
7096                                 goto fail;
7097                 }
7098         }
7099
7100         ret = gas_send_request(wpa_s, dst_addr, advproto, query);
7101
7102 fail:
7103         wpabuf_free(advproto);
7104         wpabuf_free(query);
7105
7106         return ret;
7107 }
7108
7109
7110 static int gas_response_get(struct wpa_supplicant *wpa_s, char *cmd, char *buf,
7111                             size_t buflen)
7112 {
7113         u8 addr[ETH_ALEN];
7114         int dialog_token;
7115         int used;
7116         char *pos;
7117         size_t resp_len, start, requested_len;
7118         struct wpabuf *resp;
7119         int ret;
7120
7121         used = hwaddr_aton2(cmd, addr);
7122         if (used < 0)
7123                 return -1;
7124
7125         pos = cmd + used;
7126         while (*pos == ' ')
7127                 pos++;
7128         dialog_token = atoi(pos);
7129
7130         if (wpa_s->last_gas_resp &&
7131             os_memcmp(addr, wpa_s->last_gas_addr, ETH_ALEN) == 0 &&
7132             dialog_token == wpa_s->last_gas_dialog_token)
7133                 resp = wpa_s->last_gas_resp;
7134         else if (wpa_s->prev_gas_resp &&
7135                  os_memcmp(addr, wpa_s->prev_gas_addr, ETH_ALEN) == 0 &&
7136                  dialog_token == wpa_s->prev_gas_dialog_token)
7137                 resp = wpa_s->prev_gas_resp;
7138         else
7139                 return -1;
7140
7141         resp_len = wpabuf_len(resp);
7142         start = 0;
7143         requested_len = resp_len;
7144
7145         pos = os_strchr(pos, ' ');
7146         if (pos) {
7147                 start = atoi(pos);
7148                 if (start > resp_len)
7149                         return os_snprintf(buf, buflen, "FAIL-Invalid range");
7150                 pos = os_strchr(pos, ',');
7151                 if (pos == NULL)
7152                         return -1;
7153                 pos++;
7154                 requested_len = atoi(pos);
7155                 if (start + requested_len > resp_len)
7156                         return os_snprintf(buf, buflen, "FAIL-Invalid range");
7157         }
7158
7159         if (requested_len * 2 + 1 > buflen)
7160                 return os_snprintf(buf, buflen, "FAIL-Too long response");
7161
7162         ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(resp) + start,
7163                                requested_len);
7164
7165         if (start + requested_len == resp_len) {
7166                 /*
7167                  * Free memory by dropping the response after it has been
7168                  * fetched.
7169                  */
7170                 if (resp == wpa_s->prev_gas_resp) {
7171                         wpabuf_free(wpa_s->prev_gas_resp);
7172                         wpa_s->prev_gas_resp = NULL;
7173                 } else {
7174                         wpabuf_free(wpa_s->last_gas_resp);
7175                         wpa_s->last_gas_resp = NULL;
7176                 }
7177         }
7178
7179         return ret;
7180 }
7181 #endif /* CONFIG_INTERWORKING */
7182
7183
7184 #ifdef CONFIG_HS20
7185
7186 static int get_hs20_anqp(struct wpa_supplicant *wpa_s, char *dst)
7187 {
7188         u8 dst_addr[ETH_ALEN];
7189         int used;
7190         char *pos;
7191         u32 subtypes = 0;
7192
7193         used = hwaddr_aton2(dst, dst_addr);
7194         if (used < 0)
7195                 return -1;
7196         pos = dst + used;
7197         if (*pos == ' ')
7198                 pos++;
7199         for (;;) {
7200                 int num = atoi(pos);
7201                 if (num <= 0 || num > 31)
7202                         return -1;
7203                 subtypes |= BIT(num);
7204                 pos = os_strchr(pos + 1, ',');
7205                 if (pos == NULL)
7206                         break;
7207                 pos++;
7208         }
7209
7210         if (subtypes == 0)
7211                 return -1;
7212
7213         return hs20_anqp_send_req(wpa_s, dst_addr, subtypes, NULL, 0, 0);
7214 }
7215
7216
7217 static int hs20_nai_home_realm_list(struct wpa_supplicant *wpa_s,
7218                                     const u8 *addr, const char *realm)
7219 {
7220         u8 *buf;
7221         size_t rlen, len;
7222         int ret;
7223
7224         rlen = os_strlen(realm);
7225         len = 3 + rlen;
7226         buf = os_malloc(len);
7227         if (buf == NULL)
7228                 return -1;
7229         buf[0] = 1; /* NAI Home Realm Count */
7230         buf[1] = 0; /* Formatted in accordance with RFC 4282 */
7231         buf[2] = rlen;
7232         os_memcpy(buf + 3, realm, rlen);
7233
7234         ret = hs20_anqp_send_req(wpa_s, addr,
7235                                  BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
7236                                  buf, len, 0);
7237
7238         os_free(buf);
7239
7240         return ret;
7241 }
7242
7243
7244 static int hs20_get_nai_home_realm_list(struct wpa_supplicant *wpa_s,
7245                                         char *dst)
7246 {
7247         struct wpa_cred *cred = wpa_s->conf->cred;
7248         u8 dst_addr[ETH_ALEN];
7249         int used;
7250         u8 *buf;
7251         size_t len;
7252         int ret;
7253
7254         used = hwaddr_aton2(dst, dst_addr);
7255         if (used < 0)
7256                 return -1;
7257
7258         while (dst[used] == ' ')
7259                 used++;
7260         if (os_strncmp(dst + used, "realm=", 6) == 0)
7261                 return hs20_nai_home_realm_list(wpa_s, dst_addr,
7262                                                 dst + used + 6);
7263
7264         len = os_strlen(dst + used);
7265
7266         if (len == 0 && cred && cred->realm)
7267                 return hs20_nai_home_realm_list(wpa_s, dst_addr, cred->realm);
7268
7269         if (len & 1)
7270                 return -1;
7271         len /= 2;
7272         buf = os_malloc(len);
7273         if (buf == NULL)
7274                 return -1;
7275         if (hexstr2bin(dst + used, buf, len) < 0) {
7276                 os_free(buf);
7277                 return -1;
7278         }
7279
7280         ret = hs20_anqp_send_req(wpa_s, dst_addr,
7281                                  BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
7282                                  buf, len, 0);
7283         os_free(buf);
7284
7285         return ret;
7286 }
7287
7288
7289 static int get_hs20_icon(struct wpa_supplicant *wpa_s, char *cmd, char *reply,
7290                          int buflen)
7291 {
7292         u8 dst_addr[ETH_ALEN];
7293         int used;
7294         char *ctx = NULL, *icon, *poffset, *psize;
7295
7296         used = hwaddr_aton2(cmd, dst_addr);
7297         if (used < 0)
7298                 return -1;
7299         cmd += used;
7300
7301         icon = str_token(cmd, " ", &ctx);
7302         poffset = str_token(cmd, " ", &ctx);
7303         psize = str_token(cmd, " ", &ctx);
7304         if (!icon || !poffset || !psize)
7305                 return -1;
7306
7307         wpa_s->fetch_osu_icon_in_progress = 0;
7308         return hs20_get_icon(wpa_s, dst_addr, icon, atoi(poffset), atoi(psize),
7309                              reply, buflen);
7310 }
7311
7312
7313 static int del_hs20_icon(struct wpa_supplicant *wpa_s, char *cmd)
7314 {
7315         u8 dst_addr[ETH_ALEN];
7316         int used;
7317         char *icon;
7318
7319         if (!cmd[0])
7320                 return hs20_del_icon(wpa_s, NULL, NULL);
7321
7322         used = hwaddr_aton2(cmd, dst_addr);
7323         if (used < 0)
7324                 return -1;
7325
7326         while (cmd[used] == ' ')
7327                 used++;
7328         icon = cmd[used] ? &cmd[used] : NULL;
7329
7330         return hs20_del_icon(wpa_s, dst_addr, icon);
7331 }
7332
7333
7334 static int hs20_icon_request(struct wpa_supplicant *wpa_s, char *cmd, int inmem)
7335 {
7336         u8 dst_addr[ETH_ALEN];
7337         int used;
7338         char *icon;
7339
7340         used = hwaddr_aton2(cmd, dst_addr);
7341         if (used < 0)
7342                 return -1;
7343
7344         while (cmd[used] == ' ')
7345                 used++;
7346         icon = &cmd[used];
7347
7348         wpa_s->fetch_osu_icon_in_progress = 0;
7349         return hs20_anqp_send_req(wpa_s, dst_addr, BIT(HS20_STYPE_ICON_REQUEST),
7350                                   (u8 *) icon, os_strlen(icon), inmem);
7351 }
7352
7353 #endif /* CONFIG_HS20 */
7354
7355
7356 #ifdef CONFIG_AUTOSCAN
7357
7358 static int wpa_supplicant_ctrl_iface_autoscan(struct wpa_supplicant *wpa_s,
7359                                               char *cmd)
7360 {
7361         enum wpa_states state = wpa_s->wpa_state;
7362         char *new_params = NULL;
7363
7364         if (os_strlen(cmd) > 0) {
7365                 new_params = os_strdup(cmd);
7366                 if (new_params == NULL)
7367                         return -1;
7368         }
7369
7370         os_free(wpa_s->conf->autoscan);
7371         wpa_s->conf->autoscan = new_params;
7372
7373         if (wpa_s->conf->autoscan == NULL)
7374                 autoscan_deinit(wpa_s);
7375         else if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
7376                 autoscan_init(wpa_s, 1);
7377         else if (state == WPA_SCANNING)
7378                 wpa_supplicant_reinit_autoscan(wpa_s);
7379         else
7380                 wpa_printf(MSG_DEBUG, "No autoscan update in state %s",
7381                            wpa_supplicant_state_txt(state));
7382
7383         return 0;
7384 }
7385
7386 #endif /* CONFIG_AUTOSCAN */
7387
7388
7389 #ifdef CONFIG_WNM
7390
7391 static int wpas_ctrl_iface_wnm_sleep(struct wpa_supplicant *wpa_s, char *cmd)
7392 {
7393         int enter;
7394         int intval = 0;
7395         char *pos;
7396         int ret;
7397         struct wpabuf *tfs_req = NULL;
7398
7399         if (os_strncmp(cmd, "enter", 5) == 0)
7400                 enter = 1;
7401         else if (os_strncmp(cmd, "exit", 4) == 0)
7402                 enter = 0;
7403         else
7404                 return -1;
7405
7406         pos = os_strstr(cmd, " interval=");
7407         if (pos)
7408                 intval = atoi(pos + 10);
7409
7410         pos = os_strstr(cmd, " tfs_req=");
7411         if (pos) {
7412                 char *end;
7413                 size_t len;
7414                 pos += 9;
7415                 end = os_strchr(pos, ' ');
7416                 if (end)
7417                         len = end - pos;
7418                 else
7419                         len = os_strlen(pos);
7420                 if (len & 1)
7421                         return -1;
7422                 len /= 2;
7423                 tfs_req = wpabuf_alloc(len);
7424                 if (tfs_req == NULL)
7425                         return -1;
7426                 if (hexstr2bin(pos, wpabuf_put(tfs_req, len), len) < 0) {
7427                         wpabuf_free(tfs_req);
7428                         return -1;
7429                 }
7430         }
7431
7432         ret = ieee802_11_send_wnmsleep_req(wpa_s, enter ? WNM_SLEEP_MODE_ENTER :
7433                                            WNM_SLEEP_MODE_EXIT, intval,
7434                                            tfs_req);
7435         wpabuf_free(tfs_req);
7436
7437         return ret;
7438 }
7439
7440
7441 static int wpas_ctrl_iface_wnm_bss_query(struct wpa_supplicant *wpa_s, char *cmd)
7442 {
7443         int query_reason, list = 0;
7444         char *btm_candidates = NULL;
7445
7446         query_reason = atoi(cmd);
7447
7448         cmd = os_strchr(cmd, ' ');
7449         if (cmd) {
7450                 if (os_strncmp(cmd, " list", 5) == 0)
7451                         list = 1;
7452                 else
7453                         btm_candidates = cmd;
7454         }
7455
7456         wpa_printf(MSG_DEBUG,
7457                    "CTRL_IFACE: WNM_BSS_QUERY query_reason=%d%s",
7458                    query_reason, list ? " candidate list" : "");
7459
7460         return wnm_send_bss_transition_mgmt_query(wpa_s, query_reason,
7461                                                   btm_candidates,
7462                                                   list);
7463 }
7464
7465
7466 static int wpas_ctrl_iface_coloc_intf_report(struct wpa_supplicant *wpa_s,
7467                                              char *cmd)
7468 {
7469         struct wpabuf *elems;
7470         int ret;
7471
7472         elems = wpabuf_parse_bin(cmd);
7473         if (!elems)
7474                 return -1;
7475
7476         ret = wnm_send_coloc_intf_report(wpa_s, 0, elems);
7477         wpabuf_free(elems);
7478         return ret;
7479 }
7480
7481 #endif /* CONFIG_WNM */
7482
7483
7484 static int wpa_supplicant_signal_poll(struct wpa_supplicant *wpa_s, char *buf,
7485                                       size_t buflen)
7486 {
7487         struct wpa_signal_info si;
7488         int ret;
7489         char *pos, *end;
7490
7491         ret = wpa_drv_signal_poll(wpa_s, &si);
7492         if (ret)
7493                 return -1;
7494
7495         pos = buf;
7496         end = buf + buflen;
7497
7498         ret = os_snprintf(pos, end - pos, "RSSI=%d\nLINKSPEED=%d\n"
7499                           "NOISE=%d\nFREQUENCY=%u\n",
7500                           si.current_signal, si.current_txrate / 1000,
7501                           si.current_noise, si.frequency);
7502         if (os_snprintf_error(end - pos, ret))
7503                 return -1;
7504         pos += ret;
7505
7506         if (si.chanwidth != CHAN_WIDTH_UNKNOWN) {
7507                 ret = os_snprintf(pos, end - pos, "WIDTH=%s\n",
7508                                   channel_width_to_string(si.chanwidth));
7509                 if (os_snprintf_error(end - pos, ret))
7510                         return -1;
7511                 pos += ret;
7512         }
7513
7514         if (si.center_frq1 > 0) {
7515                 ret = os_snprintf(pos, end - pos, "CENTER_FRQ1=%d\n",
7516                                   si.center_frq1);
7517                 if (os_snprintf_error(end - pos, ret))
7518                         return -1;
7519                 pos += ret;
7520         }
7521
7522         if (si.center_frq2 > 0) {
7523                 ret = os_snprintf(pos, end - pos, "CENTER_FRQ2=%d\n",
7524                                   si.center_frq2);
7525                 if (os_snprintf_error(end - pos, ret))
7526                         return -1;
7527                 pos += ret;
7528         }
7529
7530         if (si.avg_signal) {
7531                 ret = os_snprintf(pos, end - pos,
7532                                   "AVG_RSSI=%d\n", si.avg_signal);
7533                 if (os_snprintf_error(end - pos, ret))
7534                         return -1;
7535                 pos += ret;
7536         }
7537
7538         if (si.avg_beacon_signal) {
7539                 ret = os_snprintf(pos, end - pos,
7540                                   "AVG_BEACON_RSSI=%d\n", si.avg_beacon_signal);
7541                 if (os_snprintf_error(end - pos, ret))
7542                         return -1;
7543                 pos += ret;
7544         }
7545
7546         return pos - buf;
7547 }
7548
7549
7550 static int wpas_ctrl_iface_signal_monitor(struct wpa_supplicant *wpa_s,
7551                                           const char *cmd)
7552 {
7553         const char *pos;
7554         int threshold = 0;
7555         int hysteresis = 0;
7556
7557         if (wpa_s->bgscan && wpa_s->bgscan_priv) {
7558                 wpa_printf(MSG_DEBUG,
7559                            "Reject SIGNAL_MONITOR command - bgscan is active");
7560                 return -1;
7561         }
7562         pos = os_strstr(cmd, "THRESHOLD=");
7563         if (pos)
7564                 threshold = atoi(pos + 10);
7565         pos = os_strstr(cmd, "HYSTERESIS=");
7566         if (pos)
7567                 hysteresis = atoi(pos + 11);
7568         return wpa_drv_signal_monitor(wpa_s, threshold, hysteresis);
7569 }
7570
7571
7572 #ifdef CONFIG_TESTING_OPTIONS
7573 int wpas_ctrl_iface_get_pref_freq_list_override(struct wpa_supplicant *wpa_s,
7574                                                 enum wpa_driver_if_type if_type,
7575                                                 unsigned int *num,
7576                                                 unsigned int *freq_list)
7577 {
7578         char *pos = wpa_s->get_pref_freq_list_override;
7579         char *end;
7580         unsigned int count = 0;
7581
7582         /* Override string format:
7583          *  <if_type1>:<freq1>,<freq2>,... <if_type2>:... */
7584
7585         while (pos) {
7586                 if (atoi(pos) == (int) if_type)
7587                         break;
7588                 pos = os_strchr(pos, ' ');
7589                 if (pos)
7590                         pos++;
7591         }
7592         if (!pos)
7593                 return -1;
7594         pos = os_strchr(pos, ':');
7595         if (!pos)
7596                 return -1;
7597         pos++;
7598         end = os_strchr(pos, ' ');
7599         while (pos && (!end || pos < end) && count < *num) {
7600                 freq_list[count++] = atoi(pos);
7601                 pos = os_strchr(pos, ',');
7602                 if (pos)
7603                         pos++;
7604         }
7605
7606         *num = count;
7607         return 0;
7608 }
7609 #endif /* CONFIG_TESTING_OPTIONS */
7610
7611
7612 static int wpas_ctrl_iface_get_pref_freq_list(
7613         struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
7614 {
7615         unsigned int freq_list[100], num = 100, i;
7616         int ret;
7617         enum wpa_driver_if_type iface_type;
7618         char *pos, *end;
7619
7620         pos = buf;
7621         end = buf + buflen;
7622
7623         /* buf: "<interface_type>" */
7624         if (os_strcmp(cmd, "STATION") == 0)
7625                 iface_type = WPA_IF_STATION;
7626         else if (os_strcmp(cmd, "AP") == 0)
7627                 iface_type = WPA_IF_AP_BSS;
7628         else if (os_strcmp(cmd, "P2P_GO") == 0)
7629                 iface_type = WPA_IF_P2P_GO;
7630         else if (os_strcmp(cmd, "P2P_CLIENT") == 0)
7631                 iface_type = WPA_IF_P2P_CLIENT;
7632         else if (os_strcmp(cmd, "IBSS") == 0)
7633                 iface_type = WPA_IF_IBSS;
7634         else if (os_strcmp(cmd, "TDLS") == 0)
7635                 iface_type = WPA_IF_TDLS;
7636         else
7637                 return -1;
7638
7639         wpa_printf(MSG_DEBUG,
7640                    "CTRL_IFACE: GET_PREF_FREQ_LIST iface_type=%d (%s)",
7641                    iface_type, buf);
7642
7643         ret = wpa_drv_get_pref_freq_list(wpa_s, iface_type, &num, freq_list);
7644         if (ret)
7645                 return -1;
7646
7647         for (i = 0; i < num; i++) {
7648                 ret = os_snprintf(pos, end - pos, "%s%u",
7649                                   i > 0 ? "," : "", freq_list[i]);
7650                 if (os_snprintf_error(end - pos, ret))
7651                         return -1;
7652                 pos += ret;
7653         }
7654
7655         return pos - buf;
7656 }
7657
7658
7659 static int wpas_ctrl_iface_driver_flags(struct wpa_supplicant *wpa_s,
7660                                         char *buf, size_t buflen)
7661 {
7662         int ret, i;
7663         char *pos, *end;
7664
7665         ret = os_snprintf(buf, buflen, "%016llX:\n",
7666                           (long long unsigned) wpa_s->drv_flags);
7667         if (os_snprintf_error(buflen, ret))
7668                 return -1;
7669
7670         pos = buf + ret;
7671         end = buf + buflen;
7672
7673         for (i = 0; i < 64; i++) {
7674                 if (wpa_s->drv_flags & (1LLU << i)) {
7675                         ret = os_snprintf(pos, end - pos, "%s\n",
7676                                           driver_flag_to_string(1LLU << i));
7677                         if (os_snprintf_error(end - pos, ret))
7678                                 return -1;
7679                         pos += ret;
7680                 }
7681         }
7682
7683         return pos - buf;
7684 }
7685
7686
7687 static int wpa_supplicant_pktcnt_poll(struct wpa_supplicant *wpa_s, char *buf,
7688                                       size_t buflen)
7689 {
7690         struct hostap_sta_driver_data sta;
7691         int ret;
7692
7693         ret = wpa_drv_pktcnt_poll(wpa_s, &sta);
7694         if (ret)
7695                 return -1;
7696
7697         ret = os_snprintf(buf, buflen, "TXGOOD=%lu\nTXBAD=%lu\nRXGOOD=%lu\n",
7698                           sta.tx_packets, sta.tx_retry_failed, sta.rx_packets);
7699         if (os_snprintf_error(buflen, ret))
7700                 return -1;
7701         return ret;
7702 }
7703
7704
7705 #ifdef ANDROID
7706 static int wpa_supplicant_driver_cmd(struct wpa_supplicant *wpa_s, char *cmd,
7707                                      char *buf, size_t buflen)
7708 {
7709         int ret;
7710
7711         ret = wpa_drv_driver_cmd(wpa_s, cmd, buf, buflen);
7712         if (ret == 0) {
7713                 if (os_strncasecmp(cmd, "COUNTRY", 7) == 0) {
7714                         struct p2p_data *p2p = wpa_s->global->p2p;
7715                         if (p2p) {
7716                                 char country[3];
7717                                 country[0] = cmd[8];
7718                                 country[1] = cmd[9];
7719                                 country[2] = 0x04;
7720                                 p2p_set_country(p2p, country);
7721                         }
7722                 }
7723                 ret = os_snprintf(buf, buflen, "%s\n", "OK");
7724                 if (os_snprintf_error(buflen, ret))
7725                         ret = -1;
7726         }
7727         return ret;
7728 }
7729 #endif /* ANDROID */
7730
7731
7732 static int wpa_supplicant_vendor_cmd(struct wpa_supplicant *wpa_s, char *cmd,
7733                                      char *buf, size_t buflen)
7734 {
7735         int ret;
7736         char *pos;
7737         u8 *data = NULL;
7738         unsigned int vendor_id, subcmd;
7739         struct wpabuf *reply;
7740         size_t data_len = 0;
7741
7742         /* cmd: <vendor id> <subcommand id> [<hex formatted data>] */
7743         vendor_id = strtoul(cmd, &pos, 16);
7744         if (!isblank((unsigned char) *pos))
7745                 return -EINVAL;
7746
7747         subcmd = strtoul(pos, &pos, 10);
7748
7749         if (*pos != '\0') {
7750                 if (!isblank((unsigned char) *pos++))
7751                         return -EINVAL;
7752                 data_len = os_strlen(pos);
7753         }
7754
7755         if (data_len) {
7756                 data_len /= 2;
7757                 data = os_malloc(data_len);
7758                 if (!data)
7759                         return -1;
7760
7761                 if (hexstr2bin(pos, data, data_len)) {
7762                         wpa_printf(MSG_DEBUG,
7763                                    "Vendor command: wrong parameter format");
7764                         os_free(data);
7765                         return -EINVAL;
7766                 }
7767         }
7768
7769         reply = wpabuf_alloc((buflen - 1) / 2);
7770         if (!reply) {
7771                 os_free(data);
7772                 return -1;
7773         }
7774
7775         ret = wpa_drv_vendor_cmd(wpa_s, vendor_id, subcmd, data, data_len,
7776                                  reply);
7777
7778         if (ret == 0)
7779                 ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(reply),
7780                                        wpabuf_len(reply));
7781
7782         wpabuf_free(reply);
7783         os_free(data);
7784
7785         return ret;
7786 }
7787
7788
7789 static void wpa_supplicant_ctrl_iface_flush(struct wpa_supplicant *wpa_s)
7790 {
7791 #ifdef CONFIG_P2P
7792         struct wpa_supplicant *p2p_wpa_s = wpa_s->global->p2p_init_wpa_s ?
7793                 wpa_s->global->p2p_init_wpa_s : wpa_s;
7794 #endif /* CONFIG_P2P */
7795
7796         wpa_dbg(wpa_s, MSG_DEBUG, "Flush all wpa_supplicant state");
7797
7798         if (wpas_abort_ongoing_scan(wpa_s) == 0)
7799                 wpa_s->ignore_post_flush_scan_res = 1;
7800
7801         if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
7802                 /*
7803                  * Avoid possible auto connect re-connection on getting
7804                  * disconnected due to state flush.
7805                  */
7806                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
7807         }
7808
7809 #ifdef CONFIG_P2P
7810         wpas_p2p_group_remove(p2p_wpa_s, "*");
7811         wpas_p2p_cancel(p2p_wpa_s);
7812         p2p_ctrl_flush(p2p_wpa_s);
7813         wpas_p2p_service_flush(p2p_wpa_s);
7814         p2p_wpa_s->global->p2p_disabled = 0;
7815         p2p_wpa_s->global->p2p_per_sta_psk = 0;
7816         p2p_wpa_s->conf->num_sec_device_types = 0;
7817         p2p_wpa_s->p2p_disable_ip_addr_req = 0;
7818         os_free(p2p_wpa_s->global->p2p_go_avoid_freq.range);
7819         p2p_wpa_s->global->p2p_go_avoid_freq.range = NULL;
7820         p2p_wpa_s->global->p2p_go_avoid_freq.num = 0;
7821         p2p_wpa_s->global->pending_p2ps_group = 0;
7822         p2p_wpa_s->global->pending_p2ps_group_freq = 0;
7823 #endif /* CONFIG_P2P */
7824
7825 #ifdef CONFIG_WPS_TESTING
7826         wps_version_number = 0x20;
7827         wps_testing_dummy_cred = 0;
7828         wps_corrupt_pkhash = 0;
7829         wps_force_auth_types_in_use = 0;
7830         wps_force_encr_types_in_use = 0;
7831 #endif /* CONFIG_WPS_TESTING */
7832 #ifdef CONFIG_WPS
7833         wpa_s->wps_fragment_size = 0;
7834         wpas_wps_cancel(wpa_s);
7835         wps_registrar_flush(wpa_s->wps->registrar);
7836 #endif /* CONFIG_WPS */
7837         wpa_s->after_wps = 0;
7838         wpa_s->known_wps_freq = 0;
7839
7840 #ifdef CONFIG_DPP
7841         wpas_dpp_deinit(wpa_s);
7842         wpa_s->dpp_init_max_tries = 0;
7843         wpa_s->dpp_init_retry_time = 0;
7844         wpa_s->dpp_resp_wait_time = 0;
7845         wpa_s->dpp_resp_max_tries = 0;
7846         wpa_s->dpp_resp_retry_time = 0;
7847 #ifdef CONFIG_TESTING_OPTIONS
7848         os_memset(dpp_pkex_own_mac_override, 0, ETH_ALEN);
7849         os_memset(dpp_pkex_peer_mac_override, 0, ETH_ALEN);
7850         dpp_pkex_ephemeral_key_override_len = 0;
7851         dpp_protocol_key_override_len = 0;
7852         dpp_nonce_override_len = 0;
7853 #endif /* CONFIG_TESTING_OPTIONS */
7854 #endif /* CONFIG_DPP */
7855
7856 #ifdef CONFIG_TDLS
7857 #ifdef CONFIG_TDLS_TESTING
7858         tdls_testing = 0;
7859 #endif /* CONFIG_TDLS_TESTING */
7860         wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL);
7861         wpa_tdls_enable(wpa_s->wpa, 1);
7862 #endif /* CONFIG_TDLS */
7863
7864         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
7865         wpa_supplicant_stop_countermeasures(wpa_s, NULL);
7866
7867         wpa_s->no_keep_alive = 0;
7868         wpa_s->own_disconnect_req = 0;
7869
7870         os_free(wpa_s->disallow_aps_bssid);
7871         wpa_s->disallow_aps_bssid = NULL;
7872         wpa_s->disallow_aps_bssid_count = 0;
7873         os_free(wpa_s->disallow_aps_ssid);
7874         wpa_s->disallow_aps_ssid = NULL;
7875         wpa_s->disallow_aps_ssid_count = 0;
7876
7877         wpa_s->set_sta_uapsd = 0;
7878         wpa_s->sta_uapsd = 0;
7879
7880         wpa_drv_radio_disable(wpa_s, 0);
7881         wpa_blacklist_clear(wpa_s);
7882         wpa_s->extra_blacklist_count = 0;
7883         wpa_supplicant_ctrl_iface_remove_network(wpa_s, "all");
7884         wpa_supplicant_ctrl_iface_remove_cred(wpa_s, "all");
7885         wpa_config_flush_blobs(wpa_s->conf);
7886         wpa_s->conf->auto_interworking = 0;
7887         wpa_s->conf->okc = 0;
7888
7889         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
7890         rsn_preauth_deinit(wpa_s->wpa);
7891
7892         wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME, 43200);
7893         wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD, 70);
7894         wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT, 60);
7895         eapol_sm_notify_logoff(wpa_s->eapol, FALSE);
7896
7897         radio_remove_works(wpa_s, NULL, 1);
7898         wpa_s->ext_work_in_progress = 0;
7899
7900         wpa_s->next_ssid = NULL;
7901
7902 #ifdef CONFIG_INTERWORKING
7903 #ifdef CONFIG_HS20
7904         hs20_cancel_fetch_osu(wpa_s);
7905         hs20_del_icon(wpa_s, NULL, NULL);
7906 #endif /* CONFIG_HS20 */
7907 #endif /* CONFIG_INTERWORKING */
7908
7909         wpa_s->ext_mgmt_frame_handling = 0;
7910         wpa_s->ext_eapol_frame_io = 0;
7911 #ifdef CONFIG_TESTING_OPTIONS
7912         wpa_s->extra_roc_dur = 0;
7913         wpa_s->test_failure = WPAS_TEST_FAILURE_NONE;
7914         wpa_s->p2p_go_csa_on_inv = 0;
7915         wpa_s->ignore_auth_resp = 0;
7916         wpa_s->ignore_assoc_disallow = 0;
7917         wpa_s->testing_resend_assoc = 0;
7918         wpa_s->reject_btm_req_reason = 0;
7919         wpa_sm_set_test_assoc_ie(wpa_s->wpa, NULL);
7920         os_free(wpa_s->get_pref_freq_list_override);
7921         wpa_s->get_pref_freq_list_override = NULL;
7922         wpabuf_free(wpa_s->sae_commit_override);
7923         wpa_s->sae_commit_override = NULL;
7924 #ifdef CONFIG_DPP
7925         os_free(wpa_s->dpp_config_obj_override);
7926         wpa_s->dpp_config_obj_override = NULL;
7927         os_free(wpa_s->dpp_discovery_override);
7928         wpa_s->dpp_discovery_override = NULL;
7929         os_free(wpa_s->dpp_groups_override);
7930         wpa_s->dpp_groups_override = NULL;
7931         dpp_test = DPP_TEST_DISABLED;
7932 #endif /* CONFIG_DPP */
7933 #endif /* CONFIG_TESTING_OPTIONS */
7934
7935         wpa_s->disconnected = 0;
7936         os_free(wpa_s->next_scan_freqs);
7937         wpa_s->next_scan_freqs = NULL;
7938         os_free(wpa_s->select_network_scan_freqs);
7939         wpa_s->select_network_scan_freqs = NULL;
7940
7941         wpa_bss_flush(wpa_s);
7942         if (!dl_list_empty(&wpa_s->bss)) {
7943                 wpa_printf(MSG_DEBUG,
7944                            "BSS table not empty after flush: %u entries, current_bss=%p bssid="
7945                            MACSTR " pending_bssid=" MACSTR,
7946                            dl_list_len(&wpa_s->bss), wpa_s->current_bss,
7947                            MAC2STR(wpa_s->bssid),
7948                            MAC2STR(wpa_s->pending_bssid));
7949         }
7950
7951         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
7952         wpa_s->wnmsleep_used = 0;
7953
7954 #ifdef CONFIG_SME
7955         wpa_s->sme.last_unprot_disconnect.sec = 0;
7956 #endif /* CONFIG_SME */
7957
7958         wpabuf_free(wpa_s->ric_ies);
7959         wpa_s->ric_ies = NULL;
7960
7961         wpa_supplicant_update_channel_list(wpa_s, NULL);
7962
7963         free_bss_tmp_disallowed(wpa_s);
7964 }
7965
7966
7967 static int wpas_ctrl_radio_work_show(struct wpa_supplicant *wpa_s,
7968                                      char *buf, size_t buflen)
7969 {
7970         struct wpa_radio_work *work;
7971         char *pos, *end;
7972         struct os_reltime now, diff;
7973
7974         pos = buf;
7975         end = buf + buflen;
7976
7977         os_get_reltime(&now);
7978
7979         dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
7980         {
7981                 int ret;
7982
7983                 os_reltime_sub(&now, &work->time, &diff);
7984                 ret = os_snprintf(pos, end - pos, "%s@%s:%u:%u:%ld.%06ld\n",
7985                                   work->type, work->wpa_s->ifname, work->freq,
7986                                   work->started, diff.sec, diff.usec);
7987                 if (os_snprintf_error(end - pos, ret))
7988                         break;
7989                 pos += ret;
7990         }
7991
7992         return pos - buf;
7993 }
7994
7995
7996 static void wpas_ctrl_radio_work_timeout(void *eloop_ctx, void *timeout_ctx)
7997 {
7998         struct wpa_radio_work *work = eloop_ctx;
7999         struct wpa_external_work *ework = work->ctx;
8000
8001         wpa_dbg(work->wpa_s, MSG_DEBUG,
8002                 "Timing out external radio work %u (%s)",
8003                 ework->id, work->type);
8004         wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_TIMEOUT "%u", ework->id);
8005         work->wpa_s->ext_work_in_progress = 0;
8006         radio_work_done(work);
8007         os_free(ework);
8008 }
8009
8010
8011 static void wpas_ctrl_radio_work_cb(struct wpa_radio_work *work, int deinit)
8012 {
8013         struct wpa_external_work *ework = work->ctx;
8014
8015         if (deinit) {
8016                 if (work->started)
8017                         eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
8018                                              work, NULL);
8019
8020                 /*
8021                  * work->type points to a buffer in ework, so need to replace
8022                  * that here with a fixed string to avoid use of freed memory
8023                  * in debug prints.
8024                  */
8025                 work->type = "freed-ext-work";
8026                 work->ctx = NULL;
8027                 os_free(ework);
8028                 return;
8029         }
8030
8031         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting external radio work %u (%s)",
8032                 ework->id, ework->type);
8033         wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_START "%u", ework->id);
8034         work->wpa_s->ext_work_in_progress = 1;
8035         if (!ework->timeout)
8036                 ework->timeout = 10;
8037         eloop_register_timeout(ework->timeout, 0, wpas_ctrl_radio_work_timeout,
8038                                work, NULL);
8039 }
8040
8041
8042 static int wpas_ctrl_radio_work_add(struct wpa_supplicant *wpa_s, char *cmd,
8043                                     char *buf, size_t buflen)
8044 {
8045         struct wpa_external_work *ework;
8046         char *pos, *pos2;
8047         size_t type_len;
8048         int ret;
8049         unsigned int freq = 0;
8050
8051         /* format: <name> [freq=<MHz>] [timeout=<seconds>] */
8052
8053         ework = os_zalloc(sizeof(*ework));
8054         if (ework == NULL)
8055                 return -1;
8056
8057         pos = os_strchr(cmd, ' ');
8058         if (pos) {
8059                 type_len = pos - cmd;
8060                 pos++;
8061
8062                 pos2 = os_strstr(pos, "freq=");
8063                 if (pos2)
8064                         freq = atoi(pos2 + 5);
8065
8066                 pos2 = os_strstr(pos, "timeout=");
8067                 if (pos2)
8068                         ework->timeout = atoi(pos2 + 8);
8069         } else {
8070                 type_len = os_strlen(cmd);
8071         }
8072         if (4 + type_len >= sizeof(ework->type))
8073                 type_len = sizeof(ework->type) - 4 - 1;
8074         os_strlcpy(ework->type, "ext:", sizeof(ework->type));
8075         os_memcpy(ework->type + 4, cmd, type_len);
8076         ework->type[4 + type_len] = '\0';
8077
8078         wpa_s->ext_work_id++;
8079         if (wpa_s->ext_work_id == 0)
8080                 wpa_s->ext_work_id++;
8081         ework->id = wpa_s->ext_work_id;
8082
8083         if (radio_add_work(wpa_s, freq, ework->type, 0, wpas_ctrl_radio_work_cb,
8084                            ework) < 0) {
8085                 os_free(ework);
8086                 return -1;
8087         }
8088
8089         ret = os_snprintf(buf, buflen, "%u", ework->id);
8090         if (os_snprintf_error(buflen, ret))
8091                 return -1;
8092         return ret;
8093 }
8094
8095
8096 static int wpas_ctrl_radio_work_done(struct wpa_supplicant *wpa_s, char *cmd)
8097 {
8098         struct wpa_radio_work *work;
8099         unsigned int id = atoi(cmd);
8100
8101         dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
8102         {
8103                 struct wpa_external_work *ework;
8104
8105                 if (os_strncmp(work->type, "ext:", 4) != 0)
8106                         continue;
8107                 ework = work->ctx;
8108                 if (id && ework->id != id)
8109                         continue;
8110                 wpa_dbg(wpa_s, MSG_DEBUG,
8111                         "Completed external radio work %u (%s)",
8112                         ework->id, ework->type);
8113                 eloop_cancel_timeout(wpas_ctrl_radio_work_timeout, work, NULL);
8114                 wpa_s->ext_work_in_progress = 0;
8115                 radio_work_done(work);
8116                 os_free(ework);
8117                 return 3; /* "OK\n" */
8118         }
8119
8120         return -1;
8121 }
8122
8123
8124 static int wpas_ctrl_radio_work(struct wpa_supplicant *wpa_s, char *cmd,
8125                                 char *buf, size_t buflen)
8126 {
8127         if (os_strcmp(cmd, "show") == 0)
8128                 return wpas_ctrl_radio_work_show(wpa_s, buf, buflen);
8129         if (os_strncmp(cmd, "add ", 4) == 0)
8130                 return wpas_ctrl_radio_work_add(wpa_s, cmd + 4, buf, buflen);
8131         if (os_strncmp(cmd, "done ", 5) == 0)
8132                 return wpas_ctrl_radio_work_done(wpa_s, cmd + 4);
8133         return -1;
8134 }
8135
8136
8137 void wpas_ctrl_radio_work_flush(struct wpa_supplicant *wpa_s)
8138 {
8139         struct wpa_radio_work *work, *tmp;
8140
8141         if (!wpa_s || !wpa_s->radio)
8142                 return;
8143
8144         dl_list_for_each_safe(work, tmp, &wpa_s->radio->work,
8145                               struct wpa_radio_work, list) {
8146                 struct wpa_external_work *ework;
8147
8148                 if (os_strncmp(work->type, "ext:", 4) != 0)
8149                         continue;
8150                 ework = work->ctx;
8151                 wpa_dbg(wpa_s, MSG_DEBUG,
8152                         "Flushing%s external radio work %u (%s)",
8153                         work->started ? " started" : "", ework->id,
8154                         ework->type);
8155                 if (work->started)
8156                         eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
8157                                              work, NULL);
8158                 radio_work_done(work);
8159                 os_free(ework);
8160         }
8161 }
8162
8163
8164 static void wpas_ctrl_eapol_response(void *eloop_ctx, void *timeout_ctx)
8165 {
8166         struct wpa_supplicant *wpa_s = eloop_ctx;
8167         eapol_sm_notify_ctrl_response(wpa_s->eapol);
8168 }
8169
8170
8171 static int scan_id_list_parse(struct wpa_supplicant *wpa_s, const char *value,
8172                               unsigned int *scan_id_count, int scan_id[])
8173 {
8174         const char *pos = value;
8175
8176         while (pos) {
8177                 if (*pos == ' ' || *pos == '\0')
8178                         break;
8179                 if (*scan_id_count == MAX_SCAN_ID)
8180                         return -1;
8181                 scan_id[(*scan_id_count)++] = atoi(pos);
8182                 pos = os_strchr(pos, ',');
8183                 if (pos)
8184                         pos++;
8185         }
8186
8187         return 0;
8188 }
8189
8190
8191 static void wpas_ctrl_scan(struct wpa_supplicant *wpa_s, char *params,
8192                            char *reply, int reply_size, int *reply_len)
8193 {
8194         char *pos;
8195         unsigned int manual_scan_passive = 0;
8196         unsigned int manual_scan_use_id = 0;
8197         unsigned int manual_scan_only_new = 0;
8198         unsigned int scan_only = 0;
8199         unsigned int scan_id_count = 0;
8200         int scan_id[MAX_SCAN_ID];
8201         void (*scan_res_handler)(struct wpa_supplicant *wpa_s,
8202                                  struct wpa_scan_results *scan_res);
8203         int *manual_scan_freqs = NULL;
8204         struct wpa_ssid_value *ssid = NULL, *ns;
8205         unsigned int ssid_count = 0;
8206
8207         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
8208                 *reply_len = -1;
8209                 return;
8210         }
8211
8212         if (radio_work_pending(wpa_s, "scan")) {
8213                 wpa_printf(MSG_DEBUG,
8214                            "Pending scan scheduled - reject new request");
8215                 *reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
8216                 return;
8217         }
8218
8219 #ifdef CONFIG_INTERWORKING
8220         if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select) {
8221                 wpa_printf(MSG_DEBUG,
8222                            "Interworking select in progress - reject new scan");
8223                 *reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
8224                 return;
8225         }
8226 #endif /* CONFIG_INTERWORKING */
8227
8228         if (params) {
8229                 if (os_strncasecmp(params, "TYPE=ONLY", 9) == 0)
8230                         scan_only = 1;
8231
8232                 pos = os_strstr(params, "freq=");
8233                 if (pos) {
8234                         manual_scan_freqs = freq_range_to_channel_list(wpa_s,
8235                                                                        pos + 5);
8236                         if (manual_scan_freqs == NULL) {
8237                                 *reply_len = -1;
8238                                 goto done;
8239                         }
8240                 }
8241
8242                 pos = os_strstr(params, "passive=");
8243                 if (pos)
8244                         manual_scan_passive = !!atoi(pos + 8);
8245
8246                 pos = os_strstr(params, "use_id=");
8247                 if (pos)
8248                         manual_scan_use_id = atoi(pos + 7);
8249
8250                 pos = os_strstr(params, "only_new=1");
8251                 if (pos)
8252                         manual_scan_only_new = 1;
8253
8254                 pos = os_strstr(params, "scan_id=");
8255                 if (pos && scan_id_list_parse(wpa_s, pos + 8, &scan_id_count,
8256                                               scan_id) < 0) {
8257                         *reply_len = -1;
8258                         goto done;
8259                 }
8260
8261                 pos = os_strstr(params, "bssid=");
8262                 if (pos) {
8263                         u8 bssid[ETH_ALEN];
8264
8265                         pos += 6;
8266                         if (hwaddr_aton(pos, bssid)) {
8267                                 wpa_printf(MSG_ERROR, "Invalid BSSID %s", pos);
8268                                 *reply_len = -1;
8269                                 goto done;
8270                         }
8271                         os_memcpy(wpa_s->next_scan_bssid, bssid, ETH_ALEN);
8272                 }
8273
8274                 pos = params;
8275                 while (pos && *pos != '\0') {
8276                         if (os_strncmp(pos, "ssid ", 5) == 0) {
8277                                 char *end;
8278
8279                                 pos += 5;
8280                                 end = pos;
8281                                 while (*end) {
8282                                         if (*end == '\0' || *end == ' ')
8283                                                 break;
8284                                         end++;
8285                                 }
8286
8287                                 ns = os_realloc_array(
8288                                         ssid, ssid_count + 1,
8289                                         sizeof(struct wpa_ssid_value));
8290                                 if (ns == NULL) {
8291                                         *reply_len = -1;
8292                                         goto done;
8293                                 }
8294                                 ssid = ns;
8295
8296                                 if ((end - pos) & 0x01 ||
8297                                     end - pos > 2 * SSID_MAX_LEN ||
8298                                     hexstr2bin(pos, ssid[ssid_count].ssid,
8299                                                (end - pos) / 2) < 0) {
8300                                         wpa_printf(MSG_DEBUG,
8301                                                    "Invalid SSID value '%s'",
8302                                                    pos);
8303                                         *reply_len = -1;
8304                                         goto done;
8305                                 }
8306                                 ssid[ssid_count].ssid_len = (end - pos) / 2;
8307                                 wpa_hexdump_ascii(MSG_DEBUG, "scan SSID",
8308                                                   ssid[ssid_count].ssid,
8309                                                   ssid[ssid_count].ssid_len);
8310                                 ssid_count++;
8311                                 pos = end;
8312                         }
8313
8314                         pos = os_strchr(pos, ' ');
8315                         if (pos)
8316                                 pos++;
8317                 }
8318         }
8319
8320         wpa_s->num_ssids_from_scan_req = ssid_count;
8321         os_free(wpa_s->ssids_from_scan_req);
8322         if (ssid_count) {
8323                 wpa_s->ssids_from_scan_req = ssid;
8324                 ssid = NULL;
8325         } else {
8326                 wpa_s->ssids_from_scan_req = NULL;
8327         }
8328
8329         if (scan_only)
8330                 scan_res_handler = scan_only_handler;
8331         else if (wpa_s->scan_res_handler == scan_only_handler)
8332                 scan_res_handler = NULL;
8333         else
8334                 scan_res_handler = wpa_s->scan_res_handler;
8335
8336         if (!wpa_s->sched_scanning && !wpa_s->scanning &&
8337             ((wpa_s->wpa_state <= WPA_SCANNING) ||
8338              (wpa_s->wpa_state == WPA_COMPLETED))) {
8339                 wpa_s->manual_scan_passive = manual_scan_passive;
8340                 wpa_s->manual_scan_use_id = manual_scan_use_id;
8341                 wpa_s->manual_scan_only_new = manual_scan_only_new;
8342                 wpa_s->scan_id_count = scan_id_count;
8343                 os_memcpy(wpa_s->scan_id, scan_id, scan_id_count * sizeof(int));
8344                 wpa_s->scan_res_handler = scan_res_handler;
8345                 os_free(wpa_s->manual_scan_freqs);
8346                 wpa_s->manual_scan_freqs = manual_scan_freqs;
8347                 manual_scan_freqs = NULL;
8348
8349                 wpa_s->normal_scans = 0;
8350                 wpa_s->scan_req = MANUAL_SCAN_REQ;
8351                 wpa_s->after_wps = 0;
8352                 wpa_s->known_wps_freq = 0;
8353                 wpa_supplicant_req_scan(wpa_s, 0, 0);
8354                 if (wpa_s->manual_scan_use_id) {
8355                         wpa_s->manual_scan_id++;
8356                         wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
8357                                 wpa_s->manual_scan_id);
8358                         *reply_len = os_snprintf(reply, reply_size, "%u\n",
8359                                                  wpa_s->manual_scan_id);
8360                 }
8361         } else if (wpa_s->sched_scanning) {
8362                 wpa_s->manual_scan_passive = manual_scan_passive;
8363                 wpa_s->manual_scan_use_id = manual_scan_use_id;
8364                 wpa_s->manual_scan_only_new = manual_scan_only_new;
8365                 wpa_s->scan_id_count = scan_id_count;
8366                 os_memcpy(wpa_s->scan_id, scan_id, scan_id_count * sizeof(int));
8367                 wpa_s->scan_res_handler = scan_res_handler;
8368                 os_free(wpa_s->manual_scan_freqs);
8369                 wpa_s->manual_scan_freqs = manual_scan_freqs;
8370                 manual_scan_freqs = NULL;
8371
8372                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to allow requested full scan to proceed");
8373                 wpa_supplicant_cancel_sched_scan(wpa_s);
8374                 wpa_s->scan_req = MANUAL_SCAN_REQ;
8375                 wpa_supplicant_req_scan(wpa_s, 0, 0);
8376                 if (wpa_s->manual_scan_use_id) {
8377                         wpa_s->manual_scan_id++;
8378                         *reply_len = os_snprintf(reply, reply_size, "%u\n",
8379                                                  wpa_s->manual_scan_id);
8380                         wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
8381                                 wpa_s->manual_scan_id);
8382                 }
8383         } else {
8384                 wpa_printf(MSG_DEBUG, "Ongoing scan action - reject new request");
8385                 *reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
8386         }
8387
8388 done:
8389         os_free(manual_scan_freqs);
8390         os_free(ssid);
8391 }
8392
8393
8394 #ifdef CONFIG_TESTING_OPTIONS
8395
8396 static void wpas_ctrl_iface_mgmt_tx_cb(struct wpa_supplicant *wpa_s,
8397                                        unsigned int freq, const u8 *dst,
8398                                        const u8 *src, const u8 *bssid,
8399                                        const u8 *data, size_t data_len,
8400                                        enum offchannel_send_action_result
8401                                        result)
8402 {
8403         wpa_msg(wpa_s, MSG_INFO, "MGMT-TX-STATUS freq=%u dst=" MACSTR
8404                 " src=" MACSTR " bssid=" MACSTR " result=%s",
8405                 freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid),
8406                 result == OFFCHANNEL_SEND_ACTION_SUCCESS ?
8407                 "SUCCESS" : (result == OFFCHANNEL_SEND_ACTION_NO_ACK ?
8408                              "NO_ACK" : "FAILED"));
8409 }
8410
8411
8412 static int wpas_ctrl_iface_mgmt_tx(struct wpa_supplicant *wpa_s, char *cmd)
8413 {
8414         char *pos, *param;
8415         size_t len;
8416         u8 *buf, da[ETH_ALEN], bssid[ETH_ALEN];
8417         int res, used;
8418         int freq = 0, no_cck = 0, wait_time = 0;
8419
8420         /* <DA> <BSSID> [freq=<MHz>] [wait_time=<ms>] [no_cck=1]
8421          *    <action=Action frame payload> */
8422
8423         wpa_printf(MSG_DEBUG, "External MGMT TX: %s", cmd);
8424
8425         pos = cmd;
8426         used = hwaddr_aton2(pos, da);
8427         if (used < 0)
8428                 return -1;
8429         pos += used;
8430         while (*pos == ' ')
8431                 pos++;
8432         used = hwaddr_aton2(pos, bssid);
8433         if (used < 0)
8434                 return -1;
8435         pos += used;
8436
8437         param = os_strstr(pos, " freq=");
8438         if (param) {
8439                 param += 6;
8440                 freq = atoi(param);
8441         }
8442
8443         param = os_strstr(pos, " no_cck=");
8444         if (param) {
8445                 param += 8;
8446                 no_cck = atoi(param);
8447         }
8448
8449         param = os_strstr(pos, " wait_time=");
8450         if (param) {
8451                 param += 11;
8452                 wait_time = atoi(param);
8453         }
8454
8455         param = os_strstr(pos, " action=");
8456         if (param == NULL)
8457                 return -1;
8458         param += 8;
8459
8460         len = os_strlen(param);
8461         if (len & 1)
8462                 return -1;
8463         len /= 2;
8464
8465         buf = os_malloc(len);
8466         if (buf == NULL)
8467                 return -1;
8468
8469         if (hexstr2bin(param, buf, len) < 0) {
8470                 os_free(buf);
8471                 return -1;
8472         }
8473
8474         res = offchannel_send_action(wpa_s, freq, da, wpa_s->own_addr, bssid,
8475                                      buf, len, wait_time,
8476                                      wpas_ctrl_iface_mgmt_tx_cb, no_cck);
8477         os_free(buf);
8478         return res;
8479 }
8480
8481
8482 static void wpas_ctrl_iface_mgmt_tx_done(struct wpa_supplicant *wpa_s)
8483 {
8484         wpa_printf(MSG_DEBUG, "External MGMT TX - done waiting");
8485         offchannel_send_action_done(wpa_s);
8486 }
8487
8488
8489 static int wpas_ctrl_iface_mgmt_rx_process(struct wpa_supplicant *wpa_s,
8490                                            char *cmd)
8491 {
8492         char *pos, *param;
8493         size_t len;
8494         u8 *buf;
8495         int freq = 0, datarate = 0, ssi_signal = 0;
8496         union wpa_event_data event;
8497
8498         if (!wpa_s->ext_mgmt_frame_handling)
8499                 return -1;
8500
8501         /* freq=<MHz> datarate=<val> ssi_signal=<val> frame=<frame hexdump> */
8502
8503         wpa_printf(MSG_DEBUG, "External MGMT RX process: %s", cmd);
8504
8505         pos = cmd;
8506         param = os_strstr(pos, "freq=");
8507         if (param) {
8508                 param += 5;
8509                 freq = atoi(param);
8510         }
8511
8512         param = os_strstr(pos, " datarate=");
8513         if (param) {
8514                 param += 10;
8515                 datarate = atoi(param);
8516         }
8517
8518         param = os_strstr(pos, " ssi_signal=");
8519         if (param) {
8520                 param += 12;
8521                 ssi_signal = atoi(param);
8522         }
8523
8524         param = os_strstr(pos, " frame=");
8525         if (param == NULL)
8526                 return -1;
8527         param += 7;
8528
8529         len = os_strlen(param);
8530         if (len & 1)
8531                 return -1;
8532         len /= 2;
8533
8534         buf = os_malloc(len);
8535         if (buf == NULL)
8536                 return -1;
8537
8538         if (hexstr2bin(param, buf, len) < 0) {
8539                 os_free(buf);
8540                 return -1;
8541         }
8542
8543         os_memset(&event, 0, sizeof(event));
8544         event.rx_mgmt.freq = freq;
8545         event.rx_mgmt.frame = buf;
8546         event.rx_mgmt.frame_len = len;
8547         event.rx_mgmt.ssi_signal = ssi_signal;
8548         event.rx_mgmt.datarate = datarate;
8549         wpa_s->ext_mgmt_frame_handling = 0;
8550         wpa_supplicant_event(wpa_s, EVENT_RX_MGMT, &event);
8551         wpa_s->ext_mgmt_frame_handling = 1;
8552
8553         os_free(buf);
8554
8555         return 0;
8556 }
8557
8558
8559 static int wpas_ctrl_iface_driver_scan_res(struct wpa_supplicant *wpa_s,
8560                                            char *param)
8561 {
8562         struct wpa_scan_res *res;
8563         struct os_reltime now;
8564         char *pos, *end;
8565         int ret = -1;
8566
8567         if (!param)
8568                 return -1;
8569
8570         if (os_strcmp(param, "START") == 0) {
8571                 wpa_bss_update_start(wpa_s);
8572                 return 0;
8573         }
8574
8575         if (os_strcmp(param, "END") == 0) {
8576                 wpa_bss_update_end(wpa_s, NULL, 1);
8577                 return 0;
8578         }
8579
8580         if (os_strncmp(param, "BSS ", 4) != 0)
8581                 return -1;
8582         param += 3;
8583
8584         res = os_zalloc(sizeof(*res) + os_strlen(param) / 2);
8585         if (!res)
8586                 return -1;
8587
8588         pos = os_strstr(param, " flags=");
8589         if (pos)
8590                 res->flags = strtol(pos + 7, NULL, 16);
8591
8592         pos = os_strstr(param, " bssid=");
8593         if (pos && hwaddr_aton(pos + 7, res->bssid))
8594                 goto fail;
8595
8596         pos = os_strstr(param, " freq=");
8597         if (pos)
8598                 res->freq = atoi(pos + 6);
8599
8600         pos = os_strstr(param, " beacon_int=");
8601         if (pos)
8602                 res->beacon_int = atoi(pos + 12);
8603
8604         pos = os_strstr(param, " caps=");
8605         if (pos)
8606                 res->caps = strtol(pos + 6, NULL, 16);
8607
8608         pos = os_strstr(param, " qual=");
8609         if (pos)
8610                 res->qual = atoi(pos + 6);
8611
8612         pos = os_strstr(param, " noise=");
8613         if (pos)
8614                 res->noise = atoi(pos + 7);
8615
8616         pos = os_strstr(param, " level=");
8617         if (pos)
8618                 res->level = atoi(pos + 7);
8619
8620         pos = os_strstr(param, " tsf=");
8621         if (pos)
8622                 res->tsf = strtoll(pos + 5, NULL, 16);
8623
8624         pos = os_strstr(param, " age=");
8625         if (pos)
8626                 res->age = atoi(pos + 5);
8627
8628         pos = os_strstr(param, " est_throughput=");
8629         if (pos)
8630                 res->est_throughput = atoi(pos + 16);
8631
8632         pos = os_strstr(param, " snr=");
8633         if (pos)
8634                 res->snr = atoi(pos + 5);
8635
8636         pos = os_strstr(param, " parent_tsf=");
8637         if (pos)
8638                 res->parent_tsf = strtoll(pos + 7, NULL, 16);
8639
8640         pos = os_strstr(param, " tsf_bssid=");
8641         if (pos && hwaddr_aton(pos + 11, res->tsf_bssid))
8642                 goto fail;
8643
8644         pos = os_strstr(param, " ie=");
8645         if (pos) {
8646                 pos += 4;
8647                 end = os_strchr(pos, ' ');
8648                 if (!end)
8649                         end = pos + os_strlen(pos);
8650                 res->ie_len = (end - pos) / 2;
8651                 if (hexstr2bin(pos, (u8 *) (res + 1), res->ie_len))
8652                         goto fail;
8653         }
8654
8655         pos = os_strstr(param, " beacon_ie=");
8656         if (pos) {
8657                 pos += 11;
8658                 end = os_strchr(pos, ' ');
8659                 if (!end)
8660                         end = pos + os_strlen(pos);
8661                 res->beacon_ie_len = (end - pos) / 2;
8662                 if (hexstr2bin(pos, ((u8 *) (res + 1)) + res->ie_len,
8663                                res->beacon_ie_len))
8664                         goto fail;
8665         }
8666
8667         os_get_reltime(&now);
8668         wpa_bss_update_scan_res(wpa_s, res, &now);
8669         ret = 0;
8670 fail:
8671         os_free(res);
8672
8673         return ret;
8674 }
8675
8676
8677 static int wpas_ctrl_iface_driver_event(struct wpa_supplicant *wpa_s, char *cmd)
8678 {
8679         char *pos, *param;
8680         union wpa_event_data event;
8681         enum wpa_event_type ev;
8682
8683         /* <event name> [parameters..] */
8684
8685         wpa_dbg(wpa_s, MSG_DEBUG, "Testing - external driver event: %s", cmd);
8686
8687         pos = cmd;
8688         param = os_strchr(pos, ' ');
8689         if (param)
8690                 *param++ = '\0';
8691
8692         os_memset(&event, 0, sizeof(event));
8693
8694         if (os_strcmp(cmd, "INTERFACE_ENABLED") == 0) {
8695                 ev = EVENT_INTERFACE_ENABLED;
8696         } else if (os_strcmp(cmd, "INTERFACE_DISABLED") == 0) {
8697                 ev = EVENT_INTERFACE_DISABLED;
8698         } else if (os_strcmp(cmd, "AVOID_FREQUENCIES") == 0) {
8699                 ev = EVENT_AVOID_FREQUENCIES;
8700                 if (param == NULL)
8701                         param = "";
8702                 if (freq_range_list_parse(&event.freq_range, param) < 0)
8703                         return -1;
8704                 wpa_supplicant_event(wpa_s, ev, &event);
8705                 os_free(event.freq_range.range);
8706                 return 0;
8707         } else if (os_strcmp(cmd, "SCAN_RES") == 0) {
8708                 return wpas_ctrl_iface_driver_scan_res(wpa_s, param);
8709         } else {
8710                 wpa_dbg(wpa_s, MSG_DEBUG, "Testing - unknown driver event: %s",
8711                         cmd);
8712                 return -1;
8713         }
8714
8715         wpa_supplicant_event(wpa_s, ev, &event);
8716
8717         return 0;
8718 }
8719
8720
8721 static int wpas_ctrl_iface_eapol_rx(struct wpa_supplicant *wpa_s, char *cmd)
8722 {
8723         char *pos;
8724         u8 src[ETH_ALEN], *buf;
8725         int used;
8726         size_t len;
8727
8728         wpa_printf(MSG_DEBUG, "External EAPOL RX: %s", cmd);
8729
8730         pos = cmd;
8731         used = hwaddr_aton2(pos, src);
8732         if (used < 0)
8733                 return -1;
8734         pos += used;
8735         while (*pos == ' ')
8736                 pos++;
8737
8738         len = os_strlen(pos);
8739         if (len & 1)
8740                 return -1;
8741         len /= 2;
8742
8743         buf = os_malloc(len);
8744         if (buf == NULL)
8745                 return -1;
8746
8747         if (hexstr2bin(pos, buf, len) < 0) {
8748                 os_free(buf);
8749                 return -1;
8750         }
8751
8752         wpa_supplicant_rx_eapol(wpa_s, src, buf, len);
8753         os_free(buf);
8754
8755         return 0;
8756 }
8757
8758
8759 static u16 ipv4_hdr_checksum(const void *buf, size_t len)
8760 {
8761         size_t i;
8762         u32 sum = 0;
8763         const u16 *pos = buf;
8764
8765         for (i = 0; i < len / 2; i++)
8766                 sum += *pos++;
8767
8768         while (sum >> 16)
8769                 sum = (sum & 0xffff) + (sum >> 16);
8770
8771         return sum ^ 0xffff;
8772 }
8773
8774
8775 #define HWSIM_PACKETLEN 1500
8776 #define HWSIM_IP_LEN (HWSIM_PACKETLEN - sizeof(struct ether_header))
8777
8778 static void wpas_data_test_rx(void *ctx, const u8 *src_addr, const u8 *buf,
8779                               size_t len)
8780 {
8781         struct wpa_supplicant *wpa_s = ctx;
8782         const struct ether_header *eth;
8783         struct iphdr ip;
8784         const u8 *pos;
8785         unsigned int i;
8786         char extra[30];
8787
8788         if (len < sizeof(*eth) + sizeof(ip) || len > HWSIM_PACKETLEN) {
8789                 wpa_printf(MSG_DEBUG,
8790                            "test data: RX - ignore unexpected length %d",
8791                            (int) len);
8792                 return;
8793         }
8794
8795         eth = (const struct ether_header *) buf;
8796         os_memcpy(&ip, eth + 1, sizeof(ip));
8797         pos = &buf[sizeof(*eth) + sizeof(ip)];
8798
8799         if (ip.ihl != 5 || ip.version != 4 ||
8800             ntohs(ip.tot_len) > HWSIM_IP_LEN) {
8801                 wpa_printf(MSG_DEBUG,
8802                            "test data: RX - ignore unexpect IP header");
8803                 return;
8804         }
8805
8806         for (i = 0; i < ntohs(ip.tot_len) - sizeof(ip); i++) {
8807                 if (*pos != (u8) i) {
8808                         wpa_printf(MSG_DEBUG,
8809                                    "test data: RX - ignore mismatching payload");
8810                         return;
8811                 }
8812                 pos++;
8813         }
8814         extra[0] = '\0';
8815         if (ntohs(ip.tot_len) != HWSIM_IP_LEN)
8816                 os_snprintf(extra, sizeof(extra), " len=%d", ntohs(ip.tot_len));
8817         wpa_msg(wpa_s, MSG_INFO, "DATA-TEST-RX " MACSTR " " MACSTR "%s",
8818                 MAC2STR(eth->ether_dhost), MAC2STR(eth->ether_shost), extra);
8819 }
8820
8821
8822 static int wpas_ctrl_iface_data_test_config(struct wpa_supplicant *wpa_s,
8823                                             char *cmd)
8824 {
8825         int enabled = atoi(cmd);
8826         char *pos;
8827         const char *ifname;
8828
8829         if (!enabled) {
8830                 if (wpa_s->l2_test) {
8831                         l2_packet_deinit(wpa_s->l2_test);
8832                         wpa_s->l2_test = NULL;
8833                         wpa_dbg(wpa_s, MSG_DEBUG, "test data: Disabled");
8834                 }
8835                 return 0;
8836         }
8837
8838         if (wpa_s->l2_test)
8839                 return 0;
8840
8841         pos = os_strstr(cmd, " ifname=");
8842         if (pos)
8843                 ifname = pos + 8;
8844         else
8845                 ifname = wpa_s->ifname;
8846
8847         wpa_s->l2_test = l2_packet_init(ifname, wpa_s->own_addr,
8848                                         ETHERTYPE_IP, wpas_data_test_rx,
8849                                         wpa_s, 1);
8850         if (wpa_s->l2_test == NULL)
8851                 return -1;
8852
8853         wpa_dbg(wpa_s, MSG_DEBUG, "test data: Enabled");
8854
8855         return 0;
8856 }
8857
8858
8859 static int wpas_ctrl_iface_data_test_tx(struct wpa_supplicant *wpa_s, char *cmd)
8860 {
8861         u8 dst[ETH_ALEN], src[ETH_ALEN];
8862         char *pos, *pos2;
8863         int used;
8864         long int val;
8865         u8 tos;
8866         u8 buf[2 + HWSIM_PACKETLEN];
8867         struct ether_header *eth;
8868         struct iphdr *ip;
8869         u8 *dpos;
8870         unsigned int i;
8871         size_t send_len = HWSIM_IP_LEN;
8872
8873         if (wpa_s->l2_test == NULL)
8874                 return -1;
8875
8876         /* format: <dst> <src> <tos> [len=<length>] */
8877
8878         pos = cmd;
8879         used = hwaddr_aton2(pos, dst);
8880         if (used < 0)
8881                 return -1;
8882         pos += used;
8883         while (*pos == ' ')
8884                 pos++;
8885         used = hwaddr_aton2(pos, src);
8886         if (used < 0)
8887                 return -1;
8888         pos += used;
8889
8890         val = strtol(pos, &pos2, 0);
8891         if (val < 0 || val > 0xff)
8892                 return -1;
8893         tos = val;
8894
8895         pos = os_strstr(pos2, " len=");
8896         if (pos) {
8897                 i = atoi(pos + 5);
8898                 if (i < sizeof(*ip) || i > HWSIM_IP_LEN)
8899                         return -1;
8900                 send_len = i;
8901         }
8902
8903         eth = (struct ether_header *) &buf[2];
8904         os_memcpy(eth->ether_dhost, dst, ETH_ALEN);
8905         os_memcpy(eth->ether_shost, src, ETH_ALEN);
8906         eth->ether_type = htons(ETHERTYPE_IP);
8907         ip = (struct iphdr *) (eth + 1);
8908         os_memset(ip, 0, sizeof(*ip));
8909         ip->ihl = 5;
8910         ip->version = 4;
8911         ip->ttl = 64;
8912         ip->tos = tos;
8913         ip->tot_len = htons(send_len);
8914         ip->protocol = 1;
8915         ip->saddr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 1);
8916         ip->daddr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 2);
8917         ip->check = ipv4_hdr_checksum(ip, sizeof(*ip));
8918         dpos = (u8 *) (ip + 1);
8919         for (i = 0; i < send_len - sizeof(*ip); i++)
8920                 *dpos++ = i;
8921
8922         if (l2_packet_send(wpa_s->l2_test, dst, ETHERTYPE_IP, &buf[2],
8923                            sizeof(struct ether_header) + send_len) < 0)
8924                 return -1;
8925
8926         wpa_dbg(wpa_s, MSG_DEBUG, "test data: TX dst=" MACSTR " src=" MACSTR
8927                 " tos=0x%x", MAC2STR(dst), MAC2STR(src), tos);
8928
8929         return 0;
8930 }
8931
8932
8933 static int wpas_ctrl_iface_data_test_frame(struct wpa_supplicant *wpa_s,
8934                                            char *cmd)
8935 {
8936         u8 *buf;
8937         struct ether_header *eth;
8938         struct l2_packet_data *l2 = NULL;
8939         size_t len;
8940         u16 ethertype;
8941         int res = -1;
8942
8943         len = os_strlen(cmd);
8944         if (len & 1 || len < ETH_HLEN * 2)
8945                 return -1;
8946         len /= 2;
8947
8948         buf = os_malloc(len);
8949         if (buf == NULL)
8950                 return -1;
8951
8952         if (hexstr2bin(cmd, buf, len) < 0)
8953                 goto done;
8954
8955         eth = (struct ether_header *) buf;
8956         ethertype = ntohs(eth->ether_type);
8957
8958         l2 = l2_packet_init(wpa_s->ifname, wpa_s->own_addr, ethertype,
8959                             wpas_data_test_rx, wpa_s, 1);
8960         if (l2 == NULL)
8961                 goto done;
8962
8963         res = l2_packet_send(l2, eth->ether_dhost, ethertype, buf, len);
8964         wpa_dbg(wpa_s, MSG_DEBUG, "test data: TX frame res=%d", res);
8965 done:
8966         if (l2)
8967                 l2_packet_deinit(l2);
8968         os_free(buf);
8969
8970         return res < 0 ? -1 : 0;
8971 }
8972
8973
8974 static int wpas_ctrl_test_alloc_fail(struct wpa_supplicant *wpa_s, char *cmd)
8975 {
8976 #ifdef WPA_TRACE_BFD
8977         char *pos;
8978
8979         wpa_trace_fail_after = atoi(cmd);
8980         pos = os_strchr(cmd, ':');
8981         if (pos) {
8982                 pos++;
8983                 os_strlcpy(wpa_trace_fail_func, pos,
8984                            sizeof(wpa_trace_fail_func));
8985         } else {
8986                 wpa_trace_fail_after = 0;
8987         }
8988         return 0;
8989 #else /* WPA_TRACE_BFD */
8990         return -1;
8991 #endif /* WPA_TRACE_BFD */
8992 }
8993
8994
8995 static int wpas_ctrl_get_alloc_fail(struct wpa_supplicant *wpa_s,
8996                                     char *buf, size_t buflen)
8997 {
8998 #ifdef WPA_TRACE_BFD
8999         return os_snprintf(buf, buflen, "%u:%s", wpa_trace_fail_after,
9000                            wpa_trace_fail_func);
9001 #else /* WPA_TRACE_BFD */
9002         return -1;
9003 #endif /* WPA_TRACE_BFD */
9004 }
9005
9006
9007 static int wpas_ctrl_test_fail(struct wpa_supplicant *wpa_s, char *cmd)
9008 {
9009 #ifdef WPA_TRACE_BFD
9010         char *pos;
9011
9012         wpa_trace_test_fail_after = atoi(cmd);
9013         pos = os_strchr(cmd, ':');
9014         if (pos) {
9015                 pos++;
9016                 os_strlcpy(wpa_trace_test_fail_func, pos,
9017                            sizeof(wpa_trace_test_fail_func));
9018         } else {
9019                 wpa_trace_test_fail_after = 0;
9020         }
9021         return 0;
9022 #else /* WPA_TRACE_BFD */
9023         return -1;
9024 #endif /* WPA_TRACE_BFD */
9025 }
9026
9027
9028 static int wpas_ctrl_get_fail(struct wpa_supplicant *wpa_s,
9029                                     char *buf, size_t buflen)
9030 {
9031 #ifdef WPA_TRACE_BFD
9032         return os_snprintf(buf, buflen, "%u:%s", wpa_trace_test_fail_after,
9033                            wpa_trace_test_fail_func);
9034 #else /* WPA_TRACE_BFD */
9035         return -1;
9036 #endif /* WPA_TRACE_BFD */
9037 }
9038
9039
9040 static void wpas_ctrl_event_test_cb(void *eloop_ctx, void *timeout_ctx)
9041 {
9042         struct wpa_supplicant *wpa_s = eloop_ctx;
9043         int i, count = (intptr_t) timeout_ctx;
9044
9045         wpa_printf(MSG_DEBUG, "TEST: Send %d control interface event messages",
9046                    count);
9047         for (i = 0; i < count; i++) {
9048                 wpa_msg_ctrl(wpa_s, MSG_INFO, "TEST-EVENT-MESSAGE %d/%d",
9049                              i + 1, count);
9050         }
9051 }
9052
9053
9054 static int wpas_ctrl_event_test(struct wpa_supplicant *wpa_s, const char *cmd)
9055 {
9056         int count;
9057
9058         count = atoi(cmd);
9059         if (count <= 0)
9060                 return -1;
9061
9062         return eloop_register_timeout(0, 0, wpas_ctrl_event_test_cb, wpa_s,
9063                                       (void *) (intptr_t) count);
9064 }
9065
9066
9067 static int wpas_ctrl_test_assoc_ie(struct wpa_supplicant *wpa_s,
9068                                    const char *cmd)
9069 {
9070         struct wpabuf *buf;
9071         size_t len;
9072
9073         len = os_strlen(cmd);
9074         if (len & 1)
9075                 return -1;
9076         len /= 2;
9077
9078         if (len == 0) {
9079                 buf = NULL;
9080         } else {
9081                 buf = wpabuf_alloc(len);
9082                 if (buf == NULL)
9083                         return -1;
9084
9085                 if (hexstr2bin(cmd, wpabuf_put(buf, len), len) < 0) {
9086                         wpabuf_free(buf);
9087                         return -1;
9088                 }
9089         }
9090
9091         wpa_sm_set_test_assoc_ie(wpa_s->wpa, buf);
9092         return 0;
9093 }
9094
9095
9096 static int wpas_ctrl_reset_pn(struct wpa_supplicant *wpa_s)
9097 {
9098         u8 zero[WPA_TK_MAX_LEN];
9099
9100         if (wpa_s->last_tk_alg == WPA_ALG_NONE)
9101                 return -1;
9102
9103         wpa_printf(MSG_INFO, "TESTING: Reset PN");
9104         os_memset(zero, 0, sizeof(zero));
9105
9106         /* First, use a zero key to avoid any possible duplicate key avoidance
9107          * in the driver. */
9108         if (wpa_drv_set_key(wpa_s, wpa_s->last_tk_alg, wpa_s->last_tk_addr,
9109                             wpa_s->last_tk_key_idx, 1, zero, 6,
9110                             zero, wpa_s->last_tk_len) < 0)
9111                 return -1;
9112
9113         /* Set the previously configured key to reset its TSC/RSC */
9114         return wpa_drv_set_key(wpa_s, wpa_s->last_tk_alg, wpa_s->last_tk_addr,
9115                                wpa_s->last_tk_key_idx, 1, zero, 6,
9116                                wpa_s->last_tk, wpa_s->last_tk_len);
9117 }
9118
9119
9120 static int wpas_ctrl_key_request(struct wpa_supplicant *wpa_s, const char *cmd)
9121 {
9122         const char *pos = cmd;
9123         int error, pairwise;
9124
9125         error = atoi(pos);
9126         pos = os_strchr(pos, ' ');
9127         if (!pos)
9128                 return -1;
9129         pairwise = atoi(pos);
9130         wpa_sm_key_request(wpa_s->wpa, error, pairwise);
9131         return 0;
9132 }
9133
9134
9135 static int wpas_ctrl_resend_assoc(struct wpa_supplicant *wpa_s)
9136 {
9137 #ifdef CONFIG_SME
9138         struct wpa_driver_associate_params params;
9139         int ret;
9140
9141         os_memset(&params, 0, sizeof(params));
9142         params.bssid = wpa_s->bssid;
9143         params.ssid = wpa_s->sme.ssid;
9144         params.ssid_len = wpa_s->sme.ssid_len;
9145         params.freq.freq = wpa_s->sme.freq;
9146         if (wpa_s->last_assoc_req_wpa_ie) {
9147                 params.wpa_ie = wpabuf_head(wpa_s->last_assoc_req_wpa_ie);
9148                 params.wpa_ie_len = wpabuf_len(wpa_s->last_assoc_req_wpa_ie);
9149         }
9150         params.pairwise_suite = wpa_s->pairwise_cipher;
9151         params.group_suite = wpa_s->group_cipher;
9152         params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
9153         params.key_mgmt_suite = wpa_s->key_mgmt;
9154         params.wpa_proto = wpa_s->wpa_proto;
9155         params.mgmt_frame_protection = wpa_s->sme.mfp;
9156         params.rrm_used = wpa_s->rrm.rrm_used;
9157         if (wpa_s->sme.prev_bssid_set)
9158                 params.prev_bssid = wpa_s->sme.prev_bssid;
9159         wpa_printf(MSG_INFO, "TESTING: Resend association request");
9160         ret = wpa_drv_associate(wpa_s, &params);
9161         wpa_s->testing_resend_assoc = 1;
9162         return ret;
9163 #else /* CONFIG_SME */
9164         return -1;
9165 #endif /* CONFIG_SME */
9166 }
9167
9168 #endif /* CONFIG_TESTING_OPTIONS */
9169
9170
9171 static int wpas_ctrl_vendor_elem_add(struct wpa_supplicant *wpa_s, char *cmd)
9172 {
9173         char *pos = cmd;
9174         int frame;
9175         size_t len;
9176         struct wpabuf *buf;
9177         struct ieee802_11_elems elems;
9178
9179         frame = atoi(pos);
9180         if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
9181                 return -1;
9182         wpa_s = wpas_vendor_elem(wpa_s, frame);
9183
9184         pos = os_strchr(pos, ' ');
9185         if (pos == NULL)
9186                 return -1;
9187         pos++;
9188
9189         len = os_strlen(pos);
9190         if (len == 0)
9191                 return 0;
9192         if (len & 1)
9193                 return -1;
9194         len /= 2;
9195
9196         buf = wpabuf_alloc(len);
9197         if (buf == NULL)
9198                 return -1;
9199
9200         if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
9201                 wpabuf_free(buf);
9202                 return -1;
9203         }
9204
9205         if (ieee802_11_parse_elems(wpabuf_head_u8(buf), len, &elems, 0) ==
9206             ParseFailed) {
9207                 wpabuf_free(buf);
9208                 return -1;
9209         }
9210
9211         if (wpa_s->vendor_elem[frame] == NULL) {
9212                 wpa_s->vendor_elem[frame] = buf;
9213                 wpas_vendor_elem_update(wpa_s);
9214                 return 0;
9215         }
9216
9217         if (wpabuf_resize(&wpa_s->vendor_elem[frame], len) < 0) {
9218                 wpabuf_free(buf);
9219                 return -1;
9220         }
9221
9222         wpabuf_put_buf(wpa_s->vendor_elem[frame], buf);
9223         wpabuf_free(buf);
9224         wpas_vendor_elem_update(wpa_s);
9225
9226         return 0;
9227 }
9228
9229
9230 static int wpas_ctrl_vendor_elem_get(struct wpa_supplicant *wpa_s, char *cmd,
9231                                      char *buf, size_t buflen)
9232 {
9233         int frame = atoi(cmd);
9234
9235         if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
9236                 return -1;
9237         wpa_s = wpas_vendor_elem(wpa_s, frame);
9238
9239         if (wpa_s->vendor_elem[frame] == NULL)
9240                 return 0;
9241
9242         return wpa_snprintf_hex(buf, buflen,
9243                                 wpabuf_head_u8(wpa_s->vendor_elem[frame]),
9244                                 wpabuf_len(wpa_s->vendor_elem[frame]));
9245 }
9246
9247
9248 static int wpas_ctrl_vendor_elem_remove(struct wpa_supplicant *wpa_s, char *cmd)
9249 {
9250         char *pos = cmd;
9251         int frame;
9252         size_t len;
9253         u8 *buf;
9254         struct ieee802_11_elems elems;
9255         int res;
9256
9257         frame = atoi(pos);
9258         if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
9259                 return -1;
9260         wpa_s = wpas_vendor_elem(wpa_s, frame);
9261
9262         pos = os_strchr(pos, ' ');
9263         if (pos == NULL)
9264                 return -1;
9265         pos++;
9266
9267         if (*pos == '*') {
9268                 wpabuf_free(wpa_s->vendor_elem[frame]);
9269                 wpa_s->vendor_elem[frame] = NULL;
9270                 wpas_vendor_elem_update(wpa_s);
9271                 return 0;
9272         }
9273
9274         if (wpa_s->vendor_elem[frame] == NULL)
9275                 return -1;
9276
9277         len = os_strlen(pos);
9278         if (len == 0)
9279                 return 0;
9280         if (len & 1)
9281                 return -1;
9282         len /= 2;
9283
9284         buf = os_malloc(len);
9285         if (buf == NULL)
9286                 return -1;
9287
9288         if (hexstr2bin(pos, buf, len) < 0) {
9289                 os_free(buf);
9290                 return -1;
9291         }
9292
9293         if (ieee802_11_parse_elems(buf, len, &elems, 0) == ParseFailed) {
9294                 os_free(buf);
9295                 return -1;
9296         }
9297
9298         res = wpas_vendor_elem_remove(wpa_s, frame, buf, len);
9299         os_free(buf);
9300         return res;
9301 }
9302
9303
9304 static void wpas_ctrl_neighbor_rep_cb(void *ctx, struct wpabuf *neighbor_rep)
9305 {
9306         struct wpa_supplicant *wpa_s = ctx;
9307         size_t len;
9308         const u8 *data;
9309
9310         /*
9311          * Neighbor Report element (IEEE P802.11-REVmc/D5.0)
9312          * BSSID[6]
9313          * BSSID Information[4]
9314          * Operating Class[1]
9315          * Channel Number[1]
9316          * PHY Type[1]
9317          * Optional Subelements[variable]
9318          */
9319 #define NR_IE_MIN_LEN (ETH_ALEN + 4 + 1 + 1 + 1)
9320
9321         if (!neighbor_rep || wpabuf_len(neighbor_rep) == 0) {
9322                 wpa_msg_ctrl(wpa_s, MSG_INFO, RRM_EVENT_NEIGHBOR_REP_FAILED);
9323                 goto out;
9324         }
9325
9326         data = wpabuf_head_u8(neighbor_rep);
9327         len = wpabuf_len(neighbor_rep);
9328
9329         while (len >= 2 + NR_IE_MIN_LEN) {
9330                 const u8 *nr;
9331                 char lci[256 * 2 + 1];
9332                 char civic[256 * 2 + 1];
9333                 u8 nr_len = data[1];
9334                 const u8 *pos = data, *end;
9335
9336                 if (pos[0] != WLAN_EID_NEIGHBOR_REPORT ||
9337                     nr_len < NR_IE_MIN_LEN) {
9338                         wpa_printf(MSG_DEBUG,
9339                                    "CTRL: Invalid Neighbor Report element: id=%u len=%u",
9340                                    data[0], nr_len);
9341                         goto out;
9342                 }
9343
9344                 if (2U + nr_len > len) {
9345                         wpa_printf(MSG_DEBUG,
9346                                    "CTRL: Invalid Neighbor Report element: id=%u len=%zu nr_len=%u",
9347                                    data[0], len, nr_len);
9348                         goto out;
9349                 }
9350                 pos += 2;
9351                 end = pos + nr_len;
9352
9353                 nr = pos;
9354                 pos += NR_IE_MIN_LEN;
9355
9356                 lci[0] = '\0';
9357                 civic[0] = '\0';
9358                 while (end - pos > 2) {
9359                         u8 s_id, s_len;
9360
9361                         s_id = *pos++;
9362                         s_len = *pos++;
9363                         if (s_len > end - pos)
9364                                 goto out;
9365                         if (s_id == WLAN_EID_MEASURE_REPORT && s_len > 3) {
9366                                 /* Measurement Token[1] */
9367                                 /* Measurement Report Mode[1] */
9368                                 /* Measurement Type[1] */
9369                                 /* Measurement Report[variable] */
9370                                 switch (pos[2]) {
9371                                 case MEASURE_TYPE_LCI:
9372                                         if (lci[0])
9373                                                 break;
9374                                         wpa_snprintf_hex(lci, sizeof(lci),
9375                                                          pos, s_len);
9376                                         break;
9377                                 case MEASURE_TYPE_LOCATION_CIVIC:
9378                                         if (civic[0])
9379                                                 break;
9380                                         wpa_snprintf_hex(civic, sizeof(civic),
9381                                                          pos, s_len);
9382                                         break;
9383                                 }
9384                         }
9385
9386                         pos += s_len;
9387                 }
9388
9389                 wpa_msg(wpa_s, MSG_INFO, RRM_EVENT_NEIGHBOR_REP_RXED
9390                         "bssid=" MACSTR
9391                         " info=0x%x op_class=%u chan=%u phy_type=%u%s%s%s%s",
9392                         MAC2STR(nr), WPA_GET_LE32(nr + ETH_ALEN),
9393                         nr[ETH_ALEN + 4], nr[ETH_ALEN + 5],
9394                         nr[ETH_ALEN + 6],
9395                         lci[0] ? " lci=" : "", lci,
9396                         civic[0] ? " civic=" : "", civic);
9397
9398                 data = end;
9399                 len -= 2 + nr_len;
9400         }
9401
9402 out:
9403         wpabuf_free(neighbor_rep);
9404 }
9405
9406
9407 static int wpas_ctrl_iface_send_neighbor_rep(struct wpa_supplicant *wpa_s,
9408                                              char *cmd)
9409 {
9410         struct wpa_ssid_value ssid, *ssid_p = NULL;
9411         int ret, lci = 0, civic = 0;
9412         char *ssid_s;
9413
9414         ssid_s = os_strstr(cmd, "ssid=");
9415         if (ssid_s) {
9416                 if (ssid_parse(ssid_s + 5, &ssid)) {
9417                         wpa_printf(MSG_ERROR,
9418                                    "CTRL: Send Neighbor Report: bad SSID");
9419                         return -1;
9420                 }
9421
9422                 ssid_p = &ssid;
9423
9424                 /*
9425                  * Move cmd after the SSID text that may include "lci" or
9426                  * "civic".
9427                  */
9428                 cmd = os_strchr(ssid_s + 6, ssid_s[5] == '"' ? '"' : ' ');
9429                 if (cmd)
9430                         cmd++;
9431
9432         }
9433
9434         if (cmd && os_strstr(cmd, "lci"))
9435                 lci = 1;
9436
9437         if (cmd && os_strstr(cmd, "civic"))
9438                 civic = 1;
9439
9440         ret = wpas_rrm_send_neighbor_rep_request(wpa_s, ssid_p, lci, civic,
9441                                                  wpas_ctrl_neighbor_rep_cb,
9442                                                  wpa_s);
9443
9444         return ret;
9445 }
9446
9447
9448 static int wpas_ctrl_iface_erp_flush(struct wpa_supplicant *wpa_s)
9449 {
9450         eapol_sm_erp_flush(wpa_s->eapol);
9451         return 0;
9452 }
9453
9454
9455 static int wpas_ctrl_iface_mac_rand_scan(struct wpa_supplicant *wpa_s,
9456                                          char *cmd)
9457 {
9458         char *token, *context = NULL;
9459         unsigned int enable = ~0, type = 0;
9460         u8 _addr[ETH_ALEN], _mask[ETH_ALEN];
9461         u8 *addr = NULL, *mask = NULL;
9462
9463         while ((token = str_token(cmd, " ", &context))) {
9464                 if (os_strcasecmp(token, "scan") == 0) {
9465                         type |= MAC_ADDR_RAND_SCAN;
9466                 } else if (os_strcasecmp(token, "sched") == 0) {
9467                         type |= MAC_ADDR_RAND_SCHED_SCAN;
9468                 } else if (os_strcasecmp(token, "pno") == 0) {
9469                         type |= MAC_ADDR_RAND_PNO;
9470                 } else if (os_strcasecmp(token, "all") == 0) {
9471                         type = wpa_s->mac_addr_rand_supported;
9472                 } else if (os_strncasecmp(token, "enable=", 7) == 0) {
9473                         enable = atoi(token + 7);
9474                 } else if (os_strncasecmp(token, "addr=", 5) == 0) {
9475                         addr = _addr;
9476                         if (hwaddr_aton(token + 5, addr)) {
9477                                 wpa_printf(MSG_INFO,
9478                                            "CTRL: Invalid MAC address: %s",
9479                                            token);
9480                                 return -1;
9481                         }
9482                 } else if (os_strncasecmp(token, "mask=", 5) == 0) {
9483                         mask = _mask;
9484                         if (hwaddr_aton(token + 5, mask)) {
9485                                 wpa_printf(MSG_INFO,
9486                                            "CTRL: Invalid MAC address mask: %s",
9487                                            token);
9488                                 return -1;
9489                         }
9490                 } else {
9491                         wpa_printf(MSG_INFO,
9492                                    "CTRL: Invalid MAC_RAND_SCAN parameter: %s",
9493                                    token);
9494                         return -1;
9495                 }
9496         }
9497
9498         if (!type) {
9499                 wpa_printf(MSG_INFO, "CTRL: MAC_RAND_SCAN no type specified");
9500                 return -1;
9501         }
9502
9503         if ((wpa_s->mac_addr_rand_supported & type) != type) {
9504                 wpa_printf(MSG_INFO,
9505                            "CTRL: MAC_RAND_SCAN types=%u != supported=%u",
9506                            type, wpa_s->mac_addr_rand_supported);
9507                 return -1;
9508         }
9509
9510         if (enable > 1) {
9511                 wpa_printf(MSG_INFO,
9512                            "CTRL: MAC_RAND_SCAN enable=<0/1> not specified");
9513                 return -1;
9514         }
9515
9516         if (!enable) {
9517                 wpas_mac_addr_rand_scan_clear(wpa_s, type);
9518                 if (wpa_s->pno) {
9519                         if (type & MAC_ADDR_RAND_PNO) {
9520                                 wpas_stop_pno(wpa_s);
9521                                 wpas_start_pno(wpa_s);
9522                         }
9523                 } else if (wpa_s->sched_scanning &&
9524                            (type & MAC_ADDR_RAND_SCHED_SCAN)) {
9525                         wpas_scan_restart_sched_scan(wpa_s);
9526                 }
9527                 return 0;
9528         }
9529
9530         if ((addr && !mask) || (!addr && mask)) {
9531                 wpa_printf(MSG_INFO,
9532                            "CTRL: MAC_RAND_SCAN invalid addr/mask combination");
9533                 return -1;
9534         }
9535
9536         if (addr && mask && (!(mask[0] & 0x01) || (addr[0] & 0x01))) {
9537                 wpa_printf(MSG_INFO,
9538                            "CTRL: MAC_RAND_SCAN cannot allow multicast address");
9539                 return -1;
9540         }
9541
9542         if (type & MAC_ADDR_RAND_SCAN) {
9543                 wpas_mac_addr_rand_scan_set(wpa_s, MAC_ADDR_RAND_SCAN,
9544                                             addr, mask);
9545         }
9546
9547         if (type & MAC_ADDR_RAND_SCHED_SCAN) {
9548                 wpas_mac_addr_rand_scan_set(wpa_s, MAC_ADDR_RAND_SCHED_SCAN,
9549                                             addr, mask);
9550
9551                 if (wpa_s->sched_scanning && !wpa_s->pno)
9552                         wpas_scan_restart_sched_scan(wpa_s);
9553         }
9554
9555         if (type & MAC_ADDR_RAND_PNO) {
9556                 wpas_mac_addr_rand_scan_set(wpa_s, MAC_ADDR_RAND_PNO,
9557                                             addr, mask);
9558                 if (wpa_s->pno) {
9559                         wpas_stop_pno(wpa_s);
9560                         wpas_start_pno(wpa_s);
9561                 }
9562         }
9563
9564         return 0;
9565 }
9566
9567
9568 static int wpas_ctrl_iface_pmksa(struct wpa_supplicant *wpa_s,
9569                                  char *buf, size_t buflen)
9570 {
9571         size_t reply_len;
9572
9573         reply_len = wpa_sm_pmksa_cache_list(wpa_s->wpa, buf, buflen);
9574 #ifdef CONFIG_AP
9575         reply_len += wpas_ap_pmksa_cache_list(wpa_s, &buf[reply_len],
9576                                               buflen - reply_len);
9577 #endif /* CONFIG_AP */
9578         return reply_len;
9579 }
9580
9581
9582 static void wpas_ctrl_iface_pmksa_flush(struct wpa_supplicant *wpa_s)
9583 {
9584         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
9585 #ifdef CONFIG_AP
9586         wpas_ap_pmksa_cache_flush(wpa_s);
9587 #endif /* CONFIG_AP */
9588 }
9589
9590
9591 #ifdef CONFIG_PMKSA_CACHE_EXTERNAL
9592
9593 static int wpas_ctrl_iface_pmksa_get(struct wpa_supplicant *wpa_s,
9594                                      const char *cmd, char *buf, size_t buflen)
9595 {
9596         struct rsn_pmksa_cache_entry *entry;
9597         struct wpa_ssid *ssid;
9598         char *pos, *pos2, *end;
9599         int ret;
9600         struct os_reltime now;
9601
9602         ssid = wpa_config_get_network(wpa_s->conf, atoi(cmd));
9603         if (!ssid)
9604                 return -1;
9605
9606         pos = buf;
9607         end = buf + buflen;
9608
9609         os_get_reltime(&now);
9610
9611         /*
9612          * Entry format:
9613          * <BSSID> <PMKID> <PMK> <reauth_time in seconds>
9614          * <expiration in seconds> <akmp> <opportunistic>
9615          * [FILS Cache Identifier]
9616          */
9617
9618         for (entry = wpa_sm_pmksa_cache_head(wpa_s->wpa); entry;
9619              entry = entry->next) {
9620                 if (entry->network_ctx != ssid)
9621                         continue;
9622
9623                 pos2 = pos;
9624                 ret = os_snprintf(pos2, end - pos2, MACSTR " ",
9625                                   MAC2STR(entry->aa));
9626                 if (os_snprintf_error(end - pos2, ret))
9627                         break;
9628                 pos2 += ret;
9629
9630                 pos2 += wpa_snprintf_hex(pos2, end - pos2, entry->pmkid,
9631                                          PMKID_LEN);
9632
9633                 ret = os_snprintf(pos2, end - pos2, " ");
9634                 if (os_snprintf_error(end - pos2, ret))
9635                         break;
9636                 pos2 += ret;
9637
9638                 pos2 += wpa_snprintf_hex(pos2, end - pos2, entry->pmk,
9639                                          entry->pmk_len);
9640
9641                 ret = os_snprintf(pos2, end - pos2, " %d %d %d %d",
9642                                   (int) (entry->reauth_time - now.sec),
9643                                   (int) (entry->expiration - now.sec),
9644                                   entry->akmp,
9645                                   entry->opportunistic);
9646                 if (os_snprintf_error(end - pos2, ret))
9647                         break;
9648                 pos2 += ret;
9649
9650                 if (entry->fils_cache_id_set) {
9651                         ret = os_snprintf(pos2, end - pos2, " %02x%02x",
9652                                           entry->fils_cache_id[0],
9653                                           entry->fils_cache_id[1]);
9654                         if (os_snprintf_error(end - pos2, ret))
9655                                 break;
9656                         pos2 += ret;
9657                 }
9658
9659                 ret = os_snprintf(pos2, end - pos2, "\n");
9660                 if (os_snprintf_error(end - pos2, ret))
9661                         break;
9662                 pos2 += ret;
9663
9664                 pos = pos2;
9665         }
9666
9667         return pos - buf;
9668 }
9669
9670
9671 static int wpas_ctrl_iface_pmksa_add(struct wpa_supplicant *wpa_s,
9672                                      char *cmd)
9673 {
9674         struct rsn_pmksa_cache_entry *entry;
9675         struct wpa_ssid *ssid;
9676         char *pos, *pos2;
9677         int ret = -1;
9678         struct os_reltime now;
9679         int reauth_time = 0, expiration = 0, i;
9680
9681         /*
9682          * Entry format:
9683          * <network_id> <BSSID> <PMKID> <PMK> <reauth_time in seconds>
9684          * <expiration in seconds> <akmp> <opportunistic>
9685          * [FILS Cache Identifier]
9686          */
9687
9688         ssid = wpa_config_get_network(wpa_s->conf, atoi(cmd));
9689         if (!ssid)
9690                 return -1;
9691
9692         pos = os_strchr(cmd, ' ');
9693         if (!pos)
9694                 return -1;
9695         pos++;
9696
9697         entry = os_zalloc(sizeof(*entry));
9698         if (!entry)
9699                 return -1;
9700
9701         if (hwaddr_aton(pos, entry->aa))
9702                 goto fail;
9703
9704         pos = os_strchr(pos, ' ');
9705         if (!pos)
9706                 goto fail;
9707         pos++;
9708
9709         if (hexstr2bin(pos, entry->pmkid, PMKID_LEN) < 0)
9710                 goto fail;
9711
9712         pos = os_strchr(pos, ' ');
9713         if (!pos)
9714                 goto fail;
9715         pos++;
9716
9717         pos2 = os_strchr(pos, ' ');
9718         if (!pos2)
9719                 goto fail;
9720         entry->pmk_len = (pos2 - pos) / 2;
9721         if (entry->pmk_len < PMK_LEN || entry->pmk_len > PMK_LEN_MAX ||
9722             hexstr2bin(pos, entry->pmk, entry->pmk_len) < 0)
9723                 goto fail;
9724
9725         pos = os_strchr(pos, ' ');
9726         if (!pos)
9727                 goto fail;
9728         pos++;
9729
9730         if (sscanf(pos, "%d %d %d %d", &reauth_time, &expiration,
9731                    &entry->akmp, &entry->opportunistic) != 4)
9732                 goto fail;
9733         for (i = 0; i < 4; i++) {
9734                 pos = os_strchr(pos, ' ');
9735                 if (!pos) {
9736                         if (i < 3)
9737                                 goto fail;
9738                         break;
9739                 }
9740                 pos++;
9741         }
9742         if (pos) {
9743                 if (hexstr2bin(pos, entry->fils_cache_id,
9744                                FILS_CACHE_ID_LEN) < 0)
9745                         goto fail;
9746                 entry->fils_cache_id_set = 1;
9747         }
9748         os_get_reltime(&now);
9749         entry->expiration = now.sec + expiration;
9750         entry->reauth_time = now.sec + reauth_time;
9751
9752         entry->network_ctx = ssid;
9753
9754         wpa_sm_pmksa_cache_add_entry(wpa_s->wpa, entry);
9755         entry = NULL;
9756         ret = 0;
9757 fail:
9758         os_free(entry);
9759         return ret;
9760 }
9761
9762
9763 #ifdef CONFIG_MESH
9764
9765 static int wpas_ctrl_iface_mesh_pmksa_get(struct wpa_supplicant *wpa_s,
9766                                           const char *cmd, char *buf,
9767                                           size_t buflen)
9768 {
9769         u8 spa[ETH_ALEN];
9770
9771         if (!wpa_s->ifmsh)
9772                 return -1;
9773
9774         if (os_strcasecmp(cmd, "any") == 0)
9775                 return wpas_ap_pmksa_cache_list_mesh(wpa_s, NULL, buf, buflen);
9776
9777         if (hwaddr_aton(cmd, spa))
9778                 return -1;
9779
9780         return wpas_ap_pmksa_cache_list_mesh(wpa_s, spa, buf, buflen);
9781 }
9782
9783
9784 static int wpas_ctrl_iface_mesh_pmksa_add(struct wpa_supplicant *wpa_s,
9785                                           char *cmd)
9786 {
9787         /*
9788          * We do not check mesh interface existance because PMKSA should be
9789          * stored before wpa_s->ifmsh creation to suppress commit message
9790          * creation.
9791          */
9792         return wpas_ap_pmksa_cache_add_external(wpa_s, cmd);
9793 }
9794
9795 #endif /* CONFIG_MESH */
9796 #endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
9797
9798
9799 #ifdef CONFIG_FILS
9800 static int wpas_ctrl_iface_fils_hlp_req_add(struct wpa_supplicant *wpa_s,
9801                                             const char *cmd)
9802 {
9803         struct fils_hlp_req *req;
9804         const char *pos;
9805
9806         /* format: <dst> <packet starting from ethertype> */
9807
9808         req = os_zalloc(sizeof(*req));
9809         if (!req)
9810                 return -1;
9811
9812         if (hwaddr_aton(cmd, req->dst))
9813                 goto fail;
9814
9815         pos = os_strchr(cmd, ' ');
9816         if (!pos)
9817                 goto fail;
9818         pos++;
9819         req->pkt = wpabuf_parse_bin(pos);
9820         if (!req->pkt)
9821                 goto fail;
9822
9823         dl_list_add_tail(&wpa_s->fils_hlp_req, &req->list);
9824         return 0;
9825 fail:
9826         wpabuf_free(req->pkt);
9827         os_free(req);
9828         return -1;
9829 }
9830 #endif /* CONFIG_FILS */
9831
9832
9833 static int wpas_ctrl_cmd_debug_level(const char *cmd)
9834 {
9835         if (os_strcmp(cmd, "PING") == 0 ||
9836             os_strncmp(cmd, "BSS ", 4) == 0 ||
9837             os_strncmp(cmd, "GET_NETWORK ", 12) == 0 ||
9838             os_strncmp(cmd, "STATUS", 6) == 0 ||
9839             os_strncmp(cmd, "STA ", 4) == 0 ||
9840             os_strncmp(cmd, "STA-", 4) == 0)
9841                 return MSG_EXCESSIVE;
9842         return MSG_DEBUG;
9843 }
9844
9845
9846 char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
9847                                          char *buf, size_t *resp_len)
9848 {
9849         char *reply;
9850         const int reply_size = 4096;
9851         int reply_len;
9852
9853         if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0 ||
9854             os_strncmp(buf, "SET_NETWORK ", 12) == 0 ||
9855             os_strncmp(buf, "PMKSA_ADD ", 10) == 0 ||
9856             os_strncmp(buf, "MESH_PMKSA_ADD ", 15) == 0) {
9857                 if (wpa_debug_show_keys)
9858                         wpa_dbg(wpa_s, MSG_DEBUG,
9859                                 "Control interface command '%s'", buf);
9860                 else
9861                         wpa_dbg(wpa_s, MSG_DEBUG,
9862                                 "Control interface command '%s [REMOVED]'",
9863                                 os_strncmp(buf, WPA_CTRL_RSP,
9864                                            os_strlen(WPA_CTRL_RSP)) == 0 ?
9865                                 WPA_CTRL_RSP :
9866                                 (os_strncmp(buf, "SET_NETWORK ", 12) == 0 ?
9867                                  "SET_NETWORK" : "key-add"));
9868         } else if (os_strncmp(buf, "WPS_NFC_TAG_READ", 16) == 0 ||
9869                    os_strncmp(buf, "NFC_REPORT_HANDOVER", 19) == 0) {
9870                 wpa_hexdump_ascii_key(MSG_DEBUG, "RX ctrl_iface",
9871                                       (const u8 *) buf, os_strlen(buf));
9872         } else {
9873                 int level = wpas_ctrl_cmd_debug_level(buf);
9874                 wpa_dbg(wpa_s, level, "Control interface command '%s'", buf);
9875         }
9876
9877         reply = os_malloc(reply_size);
9878         if (reply == NULL) {
9879                 *resp_len = 1;
9880                 return NULL;
9881         }
9882
9883         os_memcpy(reply, "OK\n", 3);
9884         reply_len = 3;
9885
9886         if (os_strcmp(buf, "PING") == 0) {
9887                 os_memcpy(reply, "PONG\n", 5);
9888                 reply_len = 5;
9889         } else if (os_strcmp(buf, "IFNAME") == 0) {
9890                 reply_len = os_strlen(wpa_s->ifname);
9891                 os_memcpy(reply, wpa_s->ifname, reply_len);
9892         } else if (os_strncmp(buf, "RELOG", 5) == 0) {
9893                 if (wpa_debug_reopen_file() < 0)
9894                         reply_len = -1;
9895         } else if (os_strncmp(buf, "NOTE ", 5) == 0) {
9896                 wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
9897         } else if (os_strcmp(buf, "MIB") == 0) {
9898                 reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
9899                 if (reply_len >= 0) {
9900                         reply_len += eapol_sm_get_mib(wpa_s->eapol,
9901                                                       reply + reply_len,
9902                                                       reply_size - reply_len);
9903 #ifdef CONFIG_MACSEC
9904                         reply_len += ieee802_1x_kay_get_mib(
9905                                 wpa_s->kay, reply + reply_len,
9906                                 reply_size - reply_len);
9907 #endif /* CONFIG_MACSEC */
9908                 }
9909         } else if (os_strncmp(buf, "STATUS", 6) == 0) {
9910                 reply_len = wpa_supplicant_ctrl_iface_status(
9911                         wpa_s, buf + 6, reply, reply_size);
9912         } else if (os_strcmp(buf, "PMKSA") == 0) {
9913                 reply_len = wpas_ctrl_iface_pmksa(wpa_s, reply, reply_size);
9914         } else if (os_strcmp(buf, "PMKSA_FLUSH") == 0) {
9915                 wpas_ctrl_iface_pmksa_flush(wpa_s);
9916 #ifdef CONFIG_PMKSA_CACHE_EXTERNAL
9917         } else if (os_strncmp(buf, "PMKSA_GET ", 10) == 0) {
9918                 reply_len = wpas_ctrl_iface_pmksa_get(wpa_s, buf + 10,
9919                                                       reply, reply_size);
9920         } else if (os_strncmp(buf, "PMKSA_ADD ", 10) == 0) {
9921                 if (wpas_ctrl_iface_pmksa_add(wpa_s, buf + 10) < 0)
9922                         reply_len = -1;
9923 #ifdef CONFIG_MESH
9924         } else if (os_strncmp(buf, "MESH_PMKSA_GET ", 15) == 0) {
9925                 reply_len = wpas_ctrl_iface_mesh_pmksa_get(wpa_s, buf + 15,
9926                                                            reply, reply_size);
9927         } else if (os_strncmp(buf, "MESH_PMKSA_ADD ", 15) == 0) {
9928                 if (wpas_ctrl_iface_mesh_pmksa_add(wpa_s, buf + 15) < 0)
9929                         reply_len = -1;
9930 #endif /* CONFIG_MESH */
9931 #endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
9932         } else if (os_strncmp(buf, "SET ", 4) == 0) {
9933                 if (wpa_supplicant_ctrl_iface_set(wpa_s, buf + 4))
9934                         reply_len = -1;
9935         } else if (os_strncmp(buf, "DUMP", 4) == 0) {
9936                 reply_len = wpa_config_dump_values(wpa_s->conf,
9937                                                    reply, reply_size);
9938         } else if (os_strncmp(buf, "GET ", 4) == 0) {
9939                 reply_len = wpa_supplicant_ctrl_iface_get(wpa_s, buf + 4,
9940                                                           reply, reply_size);
9941         } else if (os_strcmp(buf, "LOGON") == 0) {
9942                 eapol_sm_notify_logoff(wpa_s->eapol, FALSE);
9943         } else if (os_strcmp(buf, "LOGOFF") == 0) {
9944                 eapol_sm_notify_logoff(wpa_s->eapol, TRUE);
9945         } else if (os_strcmp(buf, "REASSOCIATE") == 0) {
9946                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
9947                         reply_len = -1;
9948                 else
9949                         wpas_request_connection(wpa_s);
9950         } else if (os_strcmp(buf, "REATTACH") == 0) {
9951                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED ||
9952                     !wpa_s->current_ssid)
9953                         reply_len = -1;
9954                 else {
9955                         wpa_s->reattach = 1;
9956                         wpas_request_connection(wpa_s);
9957                 }
9958         } else if (os_strcmp(buf, "RECONNECT") == 0) {
9959                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
9960                         reply_len = -1;
9961                 else if (wpa_s->disconnected)
9962                         wpas_request_connection(wpa_s);
9963 #ifdef IEEE8021X_EAPOL
9964         } else if (os_strncmp(buf, "PREAUTH ", 8) == 0) {
9965                 if (wpa_supplicant_ctrl_iface_preauth(wpa_s, buf + 8))
9966                         reply_len = -1;
9967 #endif /* IEEE8021X_EAPOL */
9968 #ifdef CONFIG_IEEE80211R
9969         } else if (os_strncmp(buf, "FT_DS ", 6) == 0) {
9970                 if (wpa_supplicant_ctrl_iface_ft_ds(wpa_s, buf + 6))
9971                         reply_len = -1;
9972 #endif /* CONFIG_IEEE80211R */
9973 #ifdef CONFIG_WPS
9974         } else if (os_strcmp(buf, "WPS_PBC") == 0) {
9975                 int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, NULL);
9976                 if (res == -2) {
9977                         os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
9978                         reply_len = 17;
9979                 } else if (res)
9980                         reply_len = -1;
9981         } else if (os_strncmp(buf, "WPS_PBC ", 8) == 0) {
9982                 int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, buf + 8);
9983                 if (res == -2) {
9984                         os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
9985                         reply_len = 17;
9986                 } else if (res)
9987                         reply_len = -1;
9988         } else if (os_strncmp(buf, "WPS_PIN ", 8) == 0) {
9989                 reply_len = wpa_supplicant_ctrl_iface_wps_pin(wpa_s, buf + 8,
9990                                                               reply,
9991                                                               reply_size);
9992         } else if (os_strncmp(buf, "WPS_CHECK_PIN ", 14) == 0) {
9993                 reply_len = wpa_supplicant_ctrl_iface_wps_check_pin(
9994                         wpa_s, buf + 14, reply, reply_size);
9995         } else if (os_strcmp(buf, "WPS_CANCEL") == 0) {
9996                 if (wpas_wps_cancel(wpa_s))
9997                         reply_len = -1;
9998 #ifdef CONFIG_WPS_NFC
9999         } else if (os_strcmp(buf, "WPS_NFC") == 0) {
10000                 if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, NULL))
10001                         reply_len = -1;
10002         } else if (os_strncmp(buf, "WPS_NFC ", 8) == 0) {
10003                 if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, buf + 8))
10004                         reply_len = -1;
10005         } else if (os_strncmp(buf, "WPS_NFC_CONFIG_TOKEN ", 21) == 0) {
10006                 reply_len = wpa_supplicant_ctrl_iface_wps_nfc_config_token(
10007                         wpa_s, buf + 21, reply, reply_size);
10008         } else if (os_strncmp(buf, "WPS_NFC_TOKEN ", 14) == 0) {
10009                 reply_len = wpa_supplicant_ctrl_iface_wps_nfc_token(
10010                         wpa_s, buf + 14, reply, reply_size);
10011         } else if (os_strncmp(buf, "WPS_NFC_TAG_READ ", 17) == 0) {
10012                 if (wpa_supplicant_ctrl_iface_wps_nfc_tag_read(wpa_s,
10013                                                                buf + 17))
10014                         reply_len = -1;
10015         } else if (os_strncmp(buf, "NFC_GET_HANDOVER_REQ ", 21) == 0) {
10016                 reply_len = wpas_ctrl_nfc_get_handover_req(
10017                         wpa_s, buf + 21, reply, reply_size);
10018         } else if (os_strncmp(buf, "NFC_GET_HANDOVER_SEL ", 21) == 0) {
10019                 reply_len = wpas_ctrl_nfc_get_handover_sel(
10020                         wpa_s, buf + 21, reply, reply_size);
10021         } else if (os_strncmp(buf, "NFC_REPORT_HANDOVER ", 20) == 0) {
10022                 if (wpas_ctrl_nfc_report_handover(wpa_s, buf + 20))
10023                         reply_len = -1;
10024 #endif /* CONFIG_WPS_NFC */
10025         } else if (os_strncmp(buf, "WPS_REG ", 8) == 0) {
10026                 if (wpa_supplicant_ctrl_iface_wps_reg(wpa_s, buf + 8))
10027                         reply_len = -1;
10028 #ifdef CONFIG_AP
10029         } else if (os_strncmp(buf, "WPS_AP_PIN ", 11) == 0) {
10030                 reply_len = wpa_supplicant_ctrl_iface_wps_ap_pin(
10031                         wpa_s, buf + 11, reply, reply_size);
10032 #endif /* CONFIG_AP */
10033 #ifdef CONFIG_WPS_ER
10034         } else if (os_strcmp(buf, "WPS_ER_START") == 0) {
10035                 if (wpas_wps_er_start(wpa_s, NULL))
10036                         reply_len = -1;
10037         } else if (os_strncmp(buf, "WPS_ER_START ", 13) == 0) {
10038                 if (wpas_wps_er_start(wpa_s, buf + 13))
10039                         reply_len = -1;
10040         } else if (os_strcmp(buf, "WPS_ER_STOP") == 0) {
10041                 wpas_wps_er_stop(wpa_s);
10042         } else if (os_strncmp(buf, "WPS_ER_PIN ", 11) == 0) {
10043                 if (wpa_supplicant_ctrl_iface_wps_er_pin(wpa_s, buf + 11))
10044                         reply_len = -1;
10045         } else if (os_strncmp(buf, "WPS_ER_PBC ", 11) == 0) {
10046                 int ret = wpas_wps_er_pbc(wpa_s, buf + 11);
10047                 if (ret == -2) {
10048                         os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
10049                         reply_len = 17;
10050                 } else if (ret == -3) {
10051                         os_memcpy(reply, "FAIL-UNKNOWN-UUID\n", 18);
10052                         reply_len = 18;
10053                 } else if (ret == -4) {
10054                         os_memcpy(reply, "FAIL-NO-AP-SETTINGS\n", 20);
10055                         reply_len = 20;
10056                 } else if (ret)
10057                         reply_len = -1;
10058         } else if (os_strncmp(buf, "WPS_ER_LEARN ", 13) == 0) {
10059                 if (wpa_supplicant_ctrl_iface_wps_er_learn(wpa_s, buf + 13))
10060                         reply_len = -1;
10061         } else if (os_strncmp(buf, "WPS_ER_SET_CONFIG ", 18) == 0) {
10062                 if (wpa_supplicant_ctrl_iface_wps_er_set_config(wpa_s,
10063                                                                 buf + 18))
10064                         reply_len = -1;
10065         } else if (os_strncmp(buf, "WPS_ER_CONFIG ", 14) == 0) {
10066                 if (wpa_supplicant_ctrl_iface_wps_er_config(wpa_s, buf + 14))
10067                         reply_len = -1;
10068 #ifdef CONFIG_WPS_NFC
10069         } else if (os_strncmp(buf, "WPS_ER_NFC_CONFIG_TOKEN ", 24) == 0) {
10070                 reply_len = wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
10071                         wpa_s, buf + 24, reply, reply_size);
10072 #endif /* CONFIG_WPS_NFC */
10073 #endif /* CONFIG_WPS_ER */
10074 #endif /* CONFIG_WPS */
10075 #ifdef CONFIG_IBSS_RSN
10076         } else if (os_strncmp(buf, "IBSS_RSN ", 9) == 0) {
10077                 if (wpa_supplicant_ctrl_iface_ibss_rsn(wpa_s, buf + 9))
10078                         reply_len = -1;
10079 #endif /* CONFIG_IBSS_RSN */
10080 #ifdef CONFIG_MESH
10081         } else if (os_strncmp(buf, "MESH_INTERFACE_ADD ", 19) == 0) {
10082                 reply_len = wpa_supplicant_ctrl_iface_mesh_interface_add(
10083                         wpa_s, buf + 19, reply, reply_size);
10084         } else if (os_strcmp(buf, "MESH_INTERFACE_ADD") == 0) {
10085                 reply_len = wpa_supplicant_ctrl_iface_mesh_interface_add(
10086                         wpa_s, "", reply, reply_size);
10087         } else if (os_strncmp(buf, "MESH_GROUP_ADD ", 15) == 0) {
10088                 if (wpa_supplicant_ctrl_iface_mesh_group_add(wpa_s, buf + 15))
10089                         reply_len = -1;
10090         } else if (os_strncmp(buf, "MESH_GROUP_REMOVE ", 18) == 0) {
10091                 if (wpa_supplicant_ctrl_iface_mesh_group_remove(wpa_s,
10092                                                                 buf + 18))
10093                         reply_len = -1;
10094         } else if (os_strncmp(buf, "MESH_PEER_REMOVE ", 17) == 0) {
10095                 if (wpa_supplicant_ctrl_iface_mesh_peer_remove(wpa_s, buf + 17))
10096                         reply_len = -1;
10097         } else if (os_strncmp(buf, "MESH_PEER_ADD ", 14) == 0) {
10098                 if (wpa_supplicant_ctrl_iface_mesh_peer_add(wpa_s, buf + 14))
10099                         reply_len = -1;
10100 #endif /* CONFIG_MESH */
10101 #ifdef CONFIG_P2P
10102         } else if (os_strncmp(buf, "P2P_FIND ", 9) == 0) {
10103                 if (p2p_ctrl_find(wpa_s, buf + 8))
10104                         reply_len = -1;
10105         } else if (os_strcmp(buf, "P2P_FIND") == 0) {
10106                 if (p2p_ctrl_find(wpa_s, ""))
10107                         reply_len = -1;
10108         } else if (os_strcmp(buf, "P2P_STOP_FIND") == 0) {
10109                 wpas_p2p_stop_find(wpa_s);
10110         } else if (os_strncmp(buf, "P2P_ASP_PROVISION ", 18) == 0) {
10111                 if (p2p_ctrl_asp_provision(wpa_s, buf + 18))
10112                         reply_len = -1;
10113         } else if (os_strncmp(buf, "P2P_ASP_PROVISION_RESP ", 23) == 0) {
10114                 if (p2p_ctrl_asp_provision_resp(wpa_s, buf + 23))
10115                         reply_len = -1;
10116         } else if (os_strncmp(buf, "P2P_CONNECT ", 12) == 0) {
10117                 reply_len = p2p_ctrl_connect(wpa_s, buf + 12, reply,
10118                                              reply_size);
10119         } else if (os_strncmp(buf, "P2P_LISTEN ", 11) == 0) {
10120                 if (p2p_ctrl_listen(wpa_s, buf + 11))
10121                         reply_len = -1;
10122         } else if (os_strcmp(buf, "P2P_LISTEN") == 0) {
10123                 if (p2p_ctrl_listen(wpa_s, ""))
10124                         reply_len = -1;
10125         } else if (os_strncmp(buf, "P2P_GROUP_REMOVE ", 17) == 0) {
10126                 if (wpas_p2p_group_remove(wpa_s, buf + 17))
10127                         reply_len = -1;
10128         } else if (os_strcmp(buf, "P2P_GROUP_ADD") == 0) {
10129                 if (p2p_ctrl_group_add(wpa_s, ""))
10130                         reply_len = -1;
10131         } else if (os_strncmp(buf, "P2P_GROUP_ADD ", 14) == 0) {
10132                 if (p2p_ctrl_group_add(wpa_s, buf + 14))
10133                         reply_len = -1;
10134         } else if (os_strncmp(buf, "P2P_GROUP_MEMBER ", 17) == 0) {
10135                 reply_len = p2p_ctrl_group_member(wpa_s, buf + 17, reply,
10136                                                   reply_size);
10137         } else if (os_strncmp(buf, "P2P_PROV_DISC ", 14) == 0) {
10138                 if (p2p_ctrl_prov_disc(wpa_s, buf + 14))
10139                         reply_len = -1;
10140         } else if (os_strcmp(buf, "P2P_GET_PASSPHRASE") == 0) {
10141                 reply_len = p2p_get_passphrase(wpa_s, reply, reply_size);
10142         } else if (os_strncmp(buf, "P2P_SERV_DISC_REQ ", 18) == 0) {
10143                 reply_len = p2p_ctrl_serv_disc_req(wpa_s, buf + 18, reply,
10144                                                    reply_size);
10145         } else if (os_strncmp(buf, "P2P_SERV_DISC_CANCEL_REQ ", 25) == 0) {
10146                 if (p2p_ctrl_serv_disc_cancel_req(wpa_s, buf + 25) < 0)
10147                         reply_len = -1;
10148         } else if (os_strncmp(buf, "P2P_SERV_DISC_RESP ", 19) == 0) {
10149                 if (p2p_ctrl_serv_disc_resp(wpa_s, buf + 19) < 0)
10150                         reply_len = -1;
10151         } else if (os_strcmp(buf, "P2P_SERVICE_UPDATE") == 0) {
10152                 wpas_p2p_sd_service_update(wpa_s);
10153         } else if (os_strncmp(buf, "P2P_SERV_DISC_EXTERNAL ", 23) == 0) {
10154                 if (p2p_ctrl_serv_disc_external(wpa_s, buf + 23) < 0)
10155                         reply_len = -1;
10156         } else if (os_strcmp(buf, "P2P_SERVICE_FLUSH") == 0) {
10157                 wpas_p2p_service_flush(wpa_s);
10158         } else if (os_strncmp(buf, "P2P_SERVICE_ADD ", 16) == 0) {
10159                 if (p2p_ctrl_service_add(wpa_s, buf + 16) < 0)
10160                         reply_len = -1;
10161         } else if (os_strncmp(buf, "P2P_SERVICE_DEL ", 16) == 0) {
10162                 if (p2p_ctrl_service_del(wpa_s, buf + 16) < 0)
10163                         reply_len = -1;
10164         } else if (os_strncmp(buf, "P2P_SERVICE_REP ", 16) == 0) {
10165                 if (p2p_ctrl_service_replace(wpa_s, buf + 16) < 0)
10166                         reply_len = -1;
10167         } else if (os_strncmp(buf, "P2P_REJECT ", 11) == 0) {
10168                 if (p2p_ctrl_reject(wpa_s, buf + 11) < 0)
10169                         reply_len = -1;
10170         } else if (os_strncmp(buf, "P2P_INVITE ", 11) == 0) {
10171                 if (p2p_ctrl_invite(wpa_s, buf + 11) < 0)
10172                         reply_len = -1;
10173         } else if (os_strncmp(buf, "P2P_PEER ", 9) == 0) {
10174                 reply_len = p2p_ctrl_peer(wpa_s, buf + 9, reply,
10175                                               reply_size);
10176         } else if (os_strncmp(buf, "P2P_SET ", 8) == 0) {
10177                 if (p2p_ctrl_set(wpa_s, buf + 8) < 0)
10178                         reply_len = -1;
10179         } else if (os_strcmp(buf, "P2P_FLUSH") == 0) {
10180                 p2p_ctrl_flush(wpa_s);
10181         } else if (os_strncmp(buf, "P2P_UNAUTHORIZE ", 16) == 0) {
10182                 if (wpas_p2p_unauthorize(wpa_s, buf + 16) < 0)
10183                         reply_len = -1;
10184         } else if (os_strcmp(buf, "P2P_CANCEL") == 0) {
10185                 if (wpas_p2p_cancel(wpa_s))
10186                         reply_len = -1;
10187         } else if (os_strncmp(buf, "P2P_PRESENCE_REQ ", 17) == 0) {
10188                 if (p2p_ctrl_presence_req(wpa_s, buf + 17) < 0)
10189                         reply_len = -1;
10190         } else if (os_strcmp(buf, "P2P_PRESENCE_REQ") == 0) {
10191                 if (p2p_ctrl_presence_req(wpa_s, "") < 0)
10192                         reply_len = -1;
10193         } else if (os_strncmp(buf, "P2P_EXT_LISTEN ", 15) == 0) {
10194                 if (p2p_ctrl_ext_listen(wpa_s, buf + 15) < 0)
10195                         reply_len = -1;
10196         } else if (os_strcmp(buf, "P2P_EXT_LISTEN") == 0) {
10197                 if (p2p_ctrl_ext_listen(wpa_s, "") < 0)
10198                         reply_len = -1;
10199         } else if (os_strncmp(buf, "P2P_REMOVE_CLIENT ", 18) == 0) {
10200                 if (p2p_ctrl_remove_client(wpa_s, buf + 18) < 0)
10201                         reply_len = -1;
10202         } else if (os_strncmp(buf, "P2P_LO_START ", 13) == 0) {
10203                 if (p2p_ctrl_iface_p2p_lo_start(wpa_s, buf + 13))
10204                         reply_len = -1;
10205         } else if (os_strcmp(buf, "P2P_LO_STOP") == 0) {
10206                 if (wpas_p2p_lo_stop(wpa_s))
10207                         reply_len = -1;
10208 #endif /* CONFIG_P2P */
10209 #ifdef CONFIG_WIFI_DISPLAY
10210         } else if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0) {
10211                 if (wifi_display_subelem_set(wpa_s->global, buf + 16) < 0)
10212                         reply_len = -1;
10213         } else if (os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0) {
10214                 reply_len = wifi_display_subelem_get(wpa_s->global, buf + 16,
10215                                                      reply, reply_size);
10216 #endif /* CONFIG_WIFI_DISPLAY */
10217 #ifdef CONFIG_INTERWORKING
10218         } else if (os_strcmp(buf, "FETCH_ANQP") == 0) {
10219                 if (interworking_fetch_anqp(wpa_s) < 0)
10220                         reply_len = -1;
10221         } else if (os_strcmp(buf, "STOP_FETCH_ANQP") == 0) {
10222                 interworking_stop_fetch_anqp(wpa_s);
10223         } else if (os_strcmp(buf, "INTERWORKING_SELECT") == 0) {
10224                 if (ctrl_interworking_select(wpa_s, NULL) < 0)
10225                         reply_len = -1;
10226         } else if (os_strncmp(buf, "INTERWORKING_SELECT ", 20) == 0) {
10227                 if (ctrl_interworking_select(wpa_s, buf + 20) < 0)
10228                         reply_len = -1;
10229         } else if (os_strncmp(buf, "INTERWORKING_CONNECT ", 21) == 0) {
10230                 if (ctrl_interworking_connect(wpa_s, buf + 21, 0) < 0)
10231                         reply_len = -1;
10232         } else if (os_strncmp(buf, "INTERWORKING_ADD_NETWORK ", 25) == 0) {
10233                 int id;
10234
10235                 id = ctrl_interworking_connect(wpa_s, buf + 25, 1);
10236                 if (id < 0)
10237                         reply_len = -1;
10238                 else {
10239                         reply_len = os_snprintf(reply, reply_size, "%d\n", id);
10240                         if (os_snprintf_error(reply_size, reply_len))
10241                                 reply_len = -1;
10242                 }
10243         } else if (os_strncmp(buf, "ANQP_GET ", 9) == 0) {
10244                 if (get_anqp(wpa_s, buf + 9) < 0)
10245                         reply_len = -1;
10246         } else if (os_strncmp(buf, "GAS_REQUEST ", 12) == 0) {
10247                 if (gas_request(wpa_s, buf + 12) < 0)
10248                         reply_len = -1;
10249         } else if (os_strncmp(buf, "GAS_RESPONSE_GET ", 17) == 0) {
10250                 reply_len = gas_response_get(wpa_s, buf + 17, reply,
10251                                              reply_size);
10252 #endif /* CONFIG_INTERWORKING */
10253 #ifdef CONFIG_HS20
10254         } else if (os_strncmp(buf, "HS20_ANQP_GET ", 14) == 0) {
10255                 if (get_hs20_anqp(wpa_s, buf + 14) < 0)
10256                         reply_len = -1;
10257         } else if (os_strncmp(buf, "HS20_GET_NAI_HOME_REALM_LIST ", 29) == 0) {
10258                 if (hs20_get_nai_home_realm_list(wpa_s, buf + 29) < 0)
10259                         reply_len = -1;
10260         } else if (os_strncmp(buf, "HS20_ICON_REQUEST ", 18) == 0) {
10261                 if (hs20_icon_request(wpa_s, buf + 18, 0) < 0)
10262                         reply_len = -1;
10263         } else if (os_strncmp(buf, "REQ_HS20_ICON ", 14) == 0) {
10264                 if (hs20_icon_request(wpa_s, buf + 14, 1) < 0)
10265                         reply_len = -1;
10266         } else if (os_strncmp(buf, "GET_HS20_ICON ", 14) == 0) {
10267                 reply_len = get_hs20_icon(wpa_s, buf + 14, reply, reply_size);
10268         } else if (os_strncmp(buf, "DEL_HS20_ICON ", 14) == 0) {
10269                 if (del_hs20_icon(wpa_s, buf + 14) < 0)
10270                         reply_len = -1;
10271         } else if (os_strcmp(buf, "FETCH_OSU") == 0) {
10272                 if (hs20_fetch_osu(wpa_s, 0) < 0)
10273                         reply_len = -1;
10274         } else if (os_strcmp(buf, "FETCH_OSU no-scan") == 0) {
10275                 if (hs20_fetch_osu(wpa_s, 1) < 0)
10276                         reply_len = -1;
10277         } else if (os_strcmp(buf, "CANCEL_FETCH_OSU") == 0) {
10278                 hs20_cancel_fetch_osu(wpa_s);
10279 #endif /* CONFIG_HS20 */
10280         } else if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0)
10281         {
10282                 if (wpa_supplicant_ctrl_iface_ctrl_rsp(
10283                             wpa_s, buf + os_strlen(WPA_CTRL_RSP)))
10284                         reply_len = -1;
10285                 else {
10286                         /*
10287                          * Notify response from timeout to allow the control
10288                          * interface response to be sent first.
10289                          */
10290                         eloop_register_timeout(0, 0, wpas_ctrl_eapol_response,
10291                                                wpa_s, NULL);
10292                 }
10293         } else if (os_strcmp(buf, "RECONFIGURE") == 0) {
10294                 if (wpa_supplicant_reload_configuration(wpa_s))
10295                         reply_len = -1;
10296         } else if (os_strcmp(buf, "TERMINATE") == 0) {
10297                 wpa_supplicant_terminate_proc(wpa_s->global);
10298         } else if (os_strncmp(buf, "BSSID ", 6) == 0) {
10299                 if (wpa_supplicant_ctrl_iface_bssid(wpa_s, buf + 6))
10300                         reply_len = -1;
10301         } else if (os_strncmp(buf, "BLACKLIST", 9) == 0) {
10302                 reply_len = wpa_supplicant_ctrl_iface_blacklist(
10303                         wpa_s, buf + 9, reply, reply_size);
10304         } else if (os_strncmp(buf, "LOG_LEVEL", 9) == 0) {
10305                 reply_len = wpa_supplicant_ctrl_iface_log_level(
10306                         wpa_s, buf + 9, reply, reply_size);
10307         } else if (os_strncmp(buf, "LIST_NETWORKS ", 14) == 0) {
10308                 reply_len = wpa_supplicant_ctrl_iface_list_networks(
10309                         wpa_s, buf + 14, reply, reply_size);
10310         } else if (os_strcmp(buf, "LIST_NETWORKS") == 0) {
10311                 reply_len = wpa_supplicant_ctrl_iface_list_networks(
10312                         wpa_s, NULL, reply, reply_size);
10313         } else if (os_strcmp(buf, "DISCONNECT") == 0) {
10314                 wpas_request_disconnection(wpa_s);
10315         } else if (os_strcmp(buf, "SCAN") == 0) {
10316                 wpas_ctrl_scan(wpa_s, NULL, reply, reply_size, &reply_len);
10317         } else if (os_strncmp(buf, "SCAN ", 5) == 0) {
10318                 wpas_ctrl_scan(wpa_s, buf + 5, reply, reply_size, &reply_len);
10319         } else if (os_strcmp(buf, "SCAN_RESULTS") == 0) {
10320                 reply_len = wpa_supplicant_ctrl_iface_scan_results(
10321                         wpa_s, reply, reply_size);
10322         } else if (os_strcmp(buf, "ABORT_SCAN") == 0) {
10323                 if (wpas_abort_ongoing_scan(wpa_s) < 0)
10324                         reply_len = -1;
10325         } else if (os_strncmp(buf, "SELECT_NETWORK ", 15) == 0) {
10326                 if (wpa_supplicant_ctrl_iface_select_network(wpa_s, buf + 15))
10327                         reply_len = -1;
10328         } else if (os_strncmp(buf, "ENABLE_NETWORK ", 15) == 0) {
10329                 if (wpa_supplicant_ctrl_iface_enable_network(wpa_s, buf + 15))
10330                         reply_len = -1;
10331         } else if (os_strncmp(buf, "DISABLE_NETWORK ", 16) == 0) {
10332                 if (wpa_supplicant_ctrl_iface_disable_network(wpa_s, buf + 16))
10333                         reply_len = -1;
10334         } else if (os_strcmp(buf, "ADD_NETWORK") == 0) {
10335                 reply_len = wpa_supplicant_ctrl_iface_add_network(
10336                         wpa_s, reply, reply_size);
10337         } else if (os_strncmp(buf, "REMOVE_NETWORK ", 15) == 0) {
10338                 if (wpa_supplicant_ctrl_iface_remove_network(wpa_s, buf + 15))
10339                         reply_len = -1;
10340         } else if (os_strncmp(buf, "SET_NETWORK ", 12) == 0) {
10341                 if (wpa_supplicant_ctrl_iface_set_network(wpa_s, buf + 12))
10342                         reply_len = -1;
10343         } else if (os_strncmp(buf, "GET_NETWORK ", 12) == 0) {
10344                 reply_len = wpa_supplicant_ctrl_iface_get_network(
10345                         wpa_s, buf + 12, reply, reply_size);
10346         } else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
10347                 if (wpa_supplicant_ctrl_iface_dup_network(wpa_s, buf + 12,
10348                                                           wpa_s))
10349                         reply_len = -1;
10350         } else if (os_strcmp(buf, "LIST_CREDS") == 0) {
10351                 reply_len = wpa_supplicant_ctrl_iface_list_creds(
10352                         wpa_s, reply, reply_size);
10353         } else if (os_strcmp(buf, "ADD_CRED") == 0) {
10354                 reply_len = wpa_supplicant_ctrl_iface_add_cred(
10355                         wpa_s, reply, reply_size);
10356         } else if (os_strncmp(buf, "REMOVE_CRED ", 12) == 0) {
10357                 if (wpa_supplicant_ctrl_iface_remove_cred(wpa_s, buf + 12))
10358                         reply_len = -1;
10359         } else if (os_strncmp(buf, "SET_CRED ", 9) == 0) {
10360                 if (wpa_supplicant_ctrl_iface_set_cred(wpa_s, buf + 9))
10361                         reply_len = -1;
10362         } else if (os_strncmp(buf, "GET_CRED ", 9) == 0) {
10363                 reply_len = wpa_supplicant_ctrl_iface_get_cred(wpa_s, buf + 9,
10364                                                                reply,
10365                                                                reply_size);
10366 #ifndef CONFIG_NO_CONFIG_WRITE
10367         } else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
10368                 if (wpa_supplicant_ctrl_iface_save_config(wpa_s))
10369                         reply_len = -1;
10370 #endif /* CONFIG_NO_CONFIG_WRITE */
10371         } else if (os_strncmp(buf, "GET_CAPABILITY ", 15) == 0) {
10372                 reply_len = wpa_supplicant_ctrl_iface_get_capability(
10373                         wpa_s, buf + 15, reply, reply_size);
10374         } else if (os_strncmp(buf, "AP_SCAN ", 8) == 0) {
10375                 if (wpa_supplicant_ctrl_iface_ap_scan(wpa_s, buf + 8))
10376                         reply_len = -1;
10377         } else if (os_strncmp(buf, "SCAN_INTERVAL ", 14) == 0) {
10378                 if (wpa_supplicant_ctrl_iface_scan_interval(wpa_s, buf + 14))
10379                         reply_len = -1;
10380         } else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
10381                 reply_len = wpa_supplicant_global_iface_list(
10382                         wpa_s->global, reply, reply_size);
10383         } else if (os_strncmp(buf, "INTERFACES", 10) == 0) {
10384                 reply_len = wpa_supplicant_global_iface_interfaces(
10385                         wpa_s->global, buf + 10, reply, reply_size);
10386         } else if (os_strncmp(buf, "BSS ", 4) == 0) {
10387                 reply_len = wpa_supplicant_ctrl_iface_bss(
10388                         wpa_s, buf + 4, reply, reply_size);
10389 #ifdef CONFIG_AP
10390         } else if (os_strcmp(buf, "STA-FIRST") == 0) {
10391                 reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
10392         } else if (os_strncmp(buf, "STA ", 4) == 0) {
10393                 reply_len = ap_ctrl_iface_sta(wpa_s, buf + 4, reply,
10394                                               reply_size);
10395         } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
10396                 reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
10397                                                    reply_size);
10398         } else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
10399                 if (ap_ctrl_iface_sta_deauthenticate(wpa_s, buf + 15))
10400                         reply_len = -1;
10401         } else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
10402                 if (ap_ctrl_iface_sta_disassociate(wpa_s, buf + 13))
10403                         reply_len = -1;
10404         } else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
10405                 if (ap_ctrl_iface_chanswitch(wpa_s, buf + 12))
10406                         reply_len = -1;
10407         } else if (os_strcmp(buf, "STOP_AP") == 0) {
10408                 if (wpas_ap_stop_ap(wpa_s))
10409                         reply_len = -1;
10410 #endif /* CONFIG_AP */
10411         } else if (os_strcmp(buf, "SUSPEND") == 0) {
10412                 wpas_notify_suspend(wpa_s->global);
10413         } else if (os_strcmp(buf, "RESUME") == 0) {
10414                 wpas_notify_resume(wpa_s->global);
10415 #ifdef CONFIG_TESTING_OPTIONS
10416         } else if (os_strcmp(buf, "DROP_SA") == 0) {
10417                 wpa_supplicant_ctrl_iface_drop_sa(wpa_s);
10418 #endif /* CONFIG_TESTING_OPTIONS */
10419         } else if (os_strncmp(buf, "ROAM ", 5) == 0) {
10420                 if (wpa_supplicant_ctrl_iface_roam(wpa_s, buf + 5))
10421                         reply_len = -1;
10422         } else if (os_strncmp(buf, "STA_AUTOCONNECT ", 16) == 0) {
10423                 wpa_s->auto_reconnect_disabled = atoi(buf + 16) == 0;
10424         } else if (os_strncmp(buf, "BSS_EXPIRE_AGE ", 15) == 0) {
10425                 if (wpa_supplicant_ctrl_iface_bss_expire_age(wpa_s, buf + 15))
10426                         reply_len = -1;
10427         } else if (os_strncmp(buf, "BSS_EXPIRE_COUNT ", 17) == 0) {
10428                 if (wpa_supplicant_ctrl_iface_bss_expire_count(wpa_s,
10429                                                                buf + 17))
10430                         reply_len = -1;
10431         } else if (os_strncmp(buf, "BSS_FLUSH ", 10) == 0) {
10432                 wpa_supplicant_ctrl_iface_bss_flush(wpa_s, buf + 10);
10433 #ifdef CONFIG_TDLS
10434         } else if (os_strncmp(buf, "TDLS_DISCOVER ", 14) == 0) {
10435                 if (wpa_supplicant_ctrl_iface_tdls_discover(wpa_s, buf + 14))
10436                         reply_len = -1;
10437         } else if (os_strncmp(buf, "TDLS_SETUP ", 11) == 0) {
10438                 if (wpa_supplicant_ctrl_iface_tdls_setup(wpa_s, buf + 11))
10439                         reply_len = -1;
10440         } else if (os_strncmp(buf, "TDLS_TEARDOWN ", 14) == 0) {
10441                 if (wpa_supplicant_ctrl_iface_tdls_teardown(wpa_s, buf + 14))
10442                         reply_len = -1;
10443         } else if (os_strncmp(buf, "TDLS_CHAN_SWITCH ", 17) == 0) {
10444                 if (wpa_supplicant_ctrl_iface_tdls_chan_switch(wpa_s,
10445                                                                buf + 17))
10446                         reply_len = -1;
10447         } else if (os_strncmp(buf, "TDLS_CANCEL_CHAN_SWITCH ", 24) == 0) {
10448                 if (wpa_supplicant_ctrl_iface_tdls_cancel_chan_switch(wpa_s,
10449                                                                       buf + 24))
10450                         reply_len = -1;
10451         } else if (os_strncmp(buf, "TDLS_LINK_STATUS ", 17) == 0) {
10452                 reply_len = wpa_supplicant_ctrl_iface_tdls_link_status(
10453                         wpa_s, buf + 17, reply, reply_size);
10454 #endif /* CONFIG_TDLS */
10455         } else if (os_strcmp(buf, "WMM_AC_STATUS") == 0) {
10456                 reply_len = wpas_wmm_ac_status(wpa_s, reply, reply_size);
10457         } else if (os_strncmp(buf, "WMM_AC_ADDTS ", 13) == 0) {
10458                 if (wmm_ac_ctrl_addts(wpa_s, buf + 13))
10459                         reply_len = -1;
10460         } else if (os_strncmp(buf, "WMM_AC_DELTS ", 13) == 0) {
10461                 if (wmm_ac_ctrl_delts(wpa_s, buf + 13))
10462                         reply_len = -1;
10463         } else if (os_strncmp(buf, "SIGNAL_POLL", 11) == 0) {
10464                 reply_len = wpa_supplicant_signal_poll(wpa_s, reply,
10465                                                        reply_size);
10466         } else if (os_strncmp(buf, "SIGNAL_MONITOR", 14) == 0) {
10467                 if (wpas_ctrl_iface_signal_monitor(wpa_s, buf + 14))
10468                         reply_len = -1;
10469         } else if (os_strncmp(buf, "PKTCNT_POLL", 11) == 0) {
10470                 reply_len = wpa_supplicant_pktcnt_poll(wpa_s, reply,
10471                                                        reply_size);
10472 #ifdef CONFIG_AUTOSCAN
10473         } else if (os_strncmp(buf, "AUTOSCAN ", 9) == 0) {
10474                 if (wpa_supplicant_ctrl_iface_autoscan(wpa_s, buf + 9))
10475                         reply_len = -1;
10476 #endif /* CONFIG_AUTOSCAN */
10477         } else if (os_strcmp(buf, "DRIVER_FLAGS") == 0) {
10478                 reply_len = wpas_ctrl_iface_driver_flags(wpa_s, reply,
10479                                                          reply_size);
10480 #ifdef ANDROID
10481         } else if (os_strncmp(buf, "DRIVER ", 7) == 0) {
10482                 reply_len = wpa_supplicant_driver_cmd(wpa_s, buf + 7, reply,
10483                                                       reply_size);
10484 #endif /* ANDROID */
10485         } else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
10486                 reply_len = wpa_supplicant_vendor_cmd(wpa_s, buf + 7, reply,
10487                                                       reply_size);
10488         } else if (os_strcmp(buf, "REAUTHENTICATE") == 0) {
10489                 pmksa_cache_clear_current(wpa_s->wpa);
10490                 eapol_sm_request_reauth(wpa_s->eapol);
10491 #ifdef CONFIG_WNM
10492         } else if (os_strncmp(buf, "WNM_SLEEP ", 10) == 0) {
10493                 if (wpas_ctrl_iface_wnm_sleep(wpa_s, buf + 10))
10494                         reply_len = -1;
10495         } else if (os_strncmp(buf, "WNM_BSS_QUERY ", 14) == 0) {
10496                 if (wpas_ctrl_iface_wnm_bss_query(wpa_s, buf + 14))
10497                                 reply_len = -1;
10498         } else if (os_strncmp(buf, "COLOC_INTF_REPORT ", 18) == 0) {
10499                 if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
10500                         reply_len = -1;
10501 #endif /* CONFIG_WNM */
10502         } else if (os_strcmp(buf, "FLUSH") == 0) {
10503                 wpa_supplicant_ctrl_iface_flush(wpa_s);
10504         } else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
10505                 reply_len = wpas_ctrl_radio_work(wpa_s, buf + 11, reply,
10506                                                  reply_size);
10507 #ifdef CONFIG_TESTING_OPTIONS
10508         } else if (os_strncmp(buf, "MGMT_TX ", 8) == 0) {
10509                 if (wpas_ctrl_iface_mgmt_tx(wpa_s, buf + 8) < 0)
10510                         reply_len = -1;
10511         } else if (os_strcmp(buf, "MGMT_TX_DONE") == 0) {
10512                 wpas_ctrl_iface_mgmt_tx_done(wpa_s);
10513         } else if (os_strncmp(buf, "MGMT_RX_PROCESS ", 16) == 0) {
10514                 if (wpas_ctrl_iface_mgmt_rx_process(wpa_s, buf + 16) < 0)
10515                         reply_len = -1;
10516         } else if (os_strncmp(buf, "DRIVER_EVENT ", 13) == 0) {
10517                 if (wpas_ctrl_iface_driver_event(wpa_s, buf + 13) < 0)
10518                         reply_len = -1;
10519         } else if (os_strncmp(buf, "EAPOL_RX ", 9) == 0) {
10520                 if (wpas_ctrl_iface_eapol_rx(wpa_s, buf + 9) < 0)
10521                         reply_len = -1;
10522         } else if (os_strncmp(buf, "DATA_TEST_CONFIG ", 17) == 0) {
10523                 if (wpas_ctrl_iface_data_test_config(wpa_s, buf + 17) < 0)
10524                         reply_len = -1;
10525         } else if (os_strncmp(buf, "DATA_TEST_TX ", 13) == 0) {
10526                 if (wpas_ctrl_iface_data_test_tx(wpa_s, buf + 13) < 0)
10527                         reply_len = -1;
10528         } else if (os_strncmp(buf, "DATA_TEST_FRAME ", 16) == 0) {
10529                 if (wpas_ctrl_iface_data_test_frame(wpa_s, buf + 16) < 0)
10530                         reply_len = -1;
10531         } else if (os_strncmp(buf, "TEST_ALLOC_FAIL ", 16) == 0) {
10532                 if (wpas_ctrl_test_alloc_fail(wpa_s, buf + 16) < 0)
10533                         reply_len = -1;
10534         } else if (os_strcmp(buf, "GET_ALLOC_FAIL") == 0) {
10535                 reply_len = wpas_ctrl_get_alloc_fail(wpa_s, reply, reply_size);
10536         } else if (os_strncmp(buf, "TEST_FAIL ", 10) == 0) {
10537                 if (wpas_ctrl_test_fail(wpa_s, buf + 10) < 0)
10538                         reply_len = -1;
10539         } else if (os_strcmp(buf, "GET_FAIL") == 0) {
10540                 reply_len = wpas_ctrl_get_fail(wpa_s, reply, reply_size);
10541         } else if (os_strncmp(buf, "EVENT_TEST ", 11) == 0) {
10542                 if (wpas_ctrl_event_test(wpa_s, buf + 11) < 0)
10543                         reply_len = -1;
10544         } else if (os_strncmp(buf, "TEST_ASSOC_IE ", 14) == 0) {
10545                 if (wpas_ctrl_test_assoc_ie(wpa_s, buf + 14) < 0)
10546                         reply_len = -1;
10547         } else if (os_strcmp(buf, "RESET_PN") == 0) {
10548                 if (wpas_ctrl_reset_pn(wpa_s) < 0)
10549                         reply_len = -1;
10550         } else if (os_strncmp(buf, "KEY_REQUEST ", 12) == 0) {
10551                 if (wpas_ctrl_key_request(wpa_s, buf + 12) < 0)
10552                         reply_len = -1;
10553         } else if (os_strcmp(buf, "RESEND_ASSOC") == 0) {
10554                 if (wpas_ctrl_resend_assoc(wpa_s) < 0)
10555                         reply_len = -1;
10556         } else if (os_strcmp(buf, "UNPROT_DEAUTH") == 0) {
10557                 sme_event_unprot_disconnect(
10558                         wpa_s, wpa_s->bssid, NULL,
10559                         WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
10560 #endif /* CONFIG_TESTING_OPTIONS */
10561         } else if (os_strncmp(buf, "VENDOR_ELEM_ADD ", 16) == 0) {
10562                 if (wpas_ctrl_vendor_elem_add(wpa_s, buf + 16) < 0)
10563                         reply_len = -1;
10564         } else if (os_strncmp(buf, "VENDOR_ELEM_GET ", 16) == 0) {
10565                 reply_len = wpas_ctrl_vendor_elem_get(wpa_s, buf + 16, reply,
10566                                                       reply_size);
10567         } else if (os_strncmp(buf, "VENDOR_ELEM_REMOVE ", 19) == 0) {
10568                 if (wpas_ctrl_vendor_elem_remove(wpa_s, buf + 19) < 0)
10569                         reply_len = -1;
10570         } else if (os_strncmp(buf, "NEIGHBOR_REP_REQUEST", 20) == 0) {
10571                 if (wpas_ctrl_iface_send_neighbor_rep(wpa_s, buf + 20))
10572                         reply_len = -1;
10573         } else if (os_strcmp(buf, "ERP_FLUSH") == 0) {
10574                 wpas_ctrl_iface_erp_flush(wpa_s);
10575         } else if (os_strncmp(buf, "MAC_RAND_SCAN ", 14) == 0) {
10576                 if (wpas_ctrl_iface_mac_rand_scan(wpa_s, buf + 14))
10577                         reply_len = -1;
10578         } else if (os_strncmp(buf, "GET_PREF_FREQ_LIST ", 19) == 0) {
10579                 reply_len = wpas_ctrl_iface_get_pref_freq_list(
10580                         wpa_s, buf + 19, reply, reply_size);
10581 #ifdef CONFIG_FILS
10582         } else if (os_strncmp(buf, "FILS_HLP_REQ_ADD ", 17) == 0) {
10583                 if (wpas_ctrl_iface_fils_hlp_req_add(wpa_s, buf + 17))
10584                         reply_len = -1;
10585         } else if (os_strcmp(buf, "FILS_HLP_REQ_FLUSH") == 0) {
10586                 wpas_flush_fils_hlp_req(wpa_s);
10587 #endif /* CONFIG_FILS */
10588 #ifdef CONFIG_DPP
10589         } else if (os_strncmp(buf, "DPP_QR_CODE ", 12) == 0) {
10590                 int res;
10591
10592                 res = wpas_dpp_qr_code(wpa_s, buf + 12);
10593                 if (res < 0) {
10594                         reply_len = -1;
10595                 } else {
10596                         reply_len = os_snprintf(reply, reply_size, "%d", res);
10597                         if (os_snprintf_error(reply_size, reply_len))
10598                                 reply_len = -1;
10599                 }
10600         } else if (os_strncmp(buf, "DPP_BOOTSTRAP_GEN ", 18) == 0) {
10601                 int res;
10602
10603                 res = wpas_dpp_bootstrap_gen(wpa_s, buf + 18);
10604                 if (res < 0) {
10605                         reply_len = -1;
10606                 } else {
10607                         reply_len = os_snprintf(reply, reply_size, "%d", res);
10608                         if (os_snprintf_error(reply_size, reply_len))
10609                                 reply_len = -1;
10610                 }
10611         } else if (os_strncmp(buf, "DPP_BOOTSTRAP_REMOVE ", 21) == 0) {
10612                 if (wpas_dpp_bootstrap_remove(wpa_s, buf + 21) < 0)
10613                         reply_len = -1;
10614         } else if (os_strncmp(buf, "DPP_BOOTSTRAP_GET_URI ", 22) == 0) {
10615                 const char *uri;
10616
10617                 uri = wpas_dpp_bootstrap_get_uri(wpa_s, atoi(buf + 22));
10618                 if (!uri) {
10619                         reply_len = -1;
10620                 } else {
10621                         reply_len = os_snprintf(reply, reply_size, "%s", uri);
10622                         if (os_snprintf_error(reply_size, reply_len))
10623                                 reply_len = -1;
10624                 }
10625         } else if (os_strncmp(buf, "DPP_BOOTSTRAP_INFO ", 19) == 0) {
10626                 reply_len = wpas_dpp_bootstrap_info(wpa_s, atoi(buf + 19),
10627                                                     reply, reply_size);
10628         } else if (os_strncmp(buf, "DPP_AUTH_INIT ", 14) == 0) {
10629                 if (wpas_dpp_auth_init(wpa_s, buf + 13) < 0)
10630                         reply_len = -1;
10631         } else if (os_strncmp(buf, "DPP_LISTEN ", 11) == 0) {
10632                 if (wpas_dpp_listen(wpa_s, buf + 11) < 0)
10633                         reply_len = -1;
10634         } else if (os_strcmp(buf, "DPP_STOP_LISTEN") == 0) {
10635                 wpas_dpp_stop(wpa_s);
10636                 wpas_dpp_listen_stop(wpa_s);
10637         } else if (os_strncmp(buf, "DPP_CONFIGURATOR_ADD", 20) == 0) {
10638                 int res;
10639
10640                 res = wpas_dpp_configurator_add(wpa_s, buf + 20);
10641                 if (res < 0) {
10642                         reply_len = -1;
10643                 } else {
10644                         reply_len = os_snprintf(reply, reply_size, "%d", res);
10645                         if (os_snprintf_error(reply_size, reply_len))
10646                                 reply_len = -1;
10647                 }
10648         } else if (os_strncmp(buf, "DPP_CONFIGURATOR_REMOVE ", 24) == 0) {
10649                 if (wpas_dpp_configurator_remove(wpa_s, buf + 24) < 0)
10650                         reply_len = -1;
10651         } else if (os_strncmp(buf, "DPP_CONFIGURATOR_SIGN ", 22) == 0) {
10652                 if (wpas_dpp_configurator_sign(wpa_s, buf + 21) < 0)
10653                         reply_len = -1;
10654         } else if (os_strncmp(buf, "DPP_CONFIGURATOR_GET_KEY ", 25) == 0) {
10655                 reply_len = wpas_dpp_configurator_get_key(wpa_s, atoi(buf + 25),
10656                                                           reply, reply_size);
10657         } else if (os_strncmp(buf, "DPP_PKEX_ADD ", 13) == 0) {
10658                 int res;
10659
10660                 res = wpas_dpp_pkex_add(wpa_s, buf + 12);
10661                 if (res < 0) {
10662                         reply_len = -1;
10663                 } else {
10664                         reply_len = os_snprintf(reply, reply_size, "%d", res);
10665                         if (os_snprintf_error(reply_size, reply_len))
10666                                 reply_len = -1;
10667                 }
10668         } else if (os_strncmp(buf, "DPP_PKEX_REMOVE ", 16) == 0) {
10669                 if (wpas_dpp_pkex_remove(wpa_s, buf + 16) < 0)
10670                         reply_len = -1;
10671 #endif /* CONFIG_DPP */
10672         } else {
10673                 os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
10674                 reply_len = 16;
10675         }
10676
10677         if (reply_len < 0) {
10678                 os_memcpy(reply, "FAIL\n", 5);
10679                 reply_len = 5;
10680         }
10681
10682         *resp_len = reply_len;
10683         return reply;
10684 }
10685
10686
10687 static int wpa_supplicant_global_iface_add(struct wpa_global *global,
10688                                            char *cmd)
10689 {
10690         struct wpa_interface iface;
10691         char *pos, *extra;
10692         struct wpa_supplicant *wpa_s;
10693         unsigned int create_iface = 0;
10694         u8 mac_addr[ETH_ALEN];
10695         enum wpa_driver_if_type type = WPA_IF_STATION;
10696
10697         /*
10698          * <ifname>TAB<confname>TAB<driver>TAB<ctrl_interface>TAB<driver_param>
10699          * TAB<bridge_ifname>[TAB<create>[TAB<interface_type>]]
10700          */
10701         wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_ADD '%s'", cmd);
10702
10703         os_memset(&iface, 0, sizeof(iface));
10704
10705         do {
10706                 iface.ifname = pos = cmd;
10707                 pos = os_strchr(pos, '\t');
10708                 if (pos)
10709                         *pos++ = '\0';
10710                 if (iface.ifname[0] == '\0')
10711                         return -1;
10712                 if (pos == NULL)
10713                         break;
10714
10715                 iface.confname = pos;
10716                 pos = os_strchr(pos, '\t');
10717                 if (pos)
10718                         *pos++ = '\0';
10719                 if (iface.confname[0] == '\0')
10720                         iface.confname = NULL;
10721                 if (pos == NULL)
10722                         break;
10723
10724                 iface.driver = pos;
10725                 pos = os_strchr(pos, '\t');
10726                 if (pos)
10727                         *pos++ = '\0';
10728                 if (iface.driver[0] == '\0')
10729                         iface.driver = NULL;
10730                 if (pos == NULL)
10731                         break;
10732
10733                 iface.ctrl_interface = pos;
10734                 pos = os_strchr(pos, '\t');
10735                 if (pos)
10736                         *pos++ = '\0';
10737                 if (iface.ctrl_interface[0] == '\0')
10738                         iface.ctrl_interface = NULL;
10739                 if (pos == NULL)
10740                         break;
10741
10742                 iface.driver_param = pos;
10743                 pos = os_strchr(pos, '\t');
10744                 if (pos)
10745                         *pos++ = '\0';
10746                 if (iface.driver_param[0] == '\0')
10747                         iface.driver_param = NULL;
10748                 if (pos == NULL)
10749                         break;
10750
10751                 iface.bridge_ifname = pos;
10752                 pos = os_strchr(pos, '\t');
10753                 if (pos)
10754                         *pos++ = '\0';
10755                 if (iface.bridge_ifname[0] == '\0')
10756                         iface.bridge_ifname = NULL;
10757                 if (pos == NULL)
10758                         break;
10759
10760                 extra = pos;
10761                 pos = os_strchr(pos, '\t');
10762                 if (pos)
10763                         *pos++ = '\0';
10764                 if (!extra[0])
10765                         break;
10766
10767                 if (os_strcmp(extra, "create") == 0) {
10768                         create_iface = 1;
10769                         if (!pos)
10770                                 break;
10771
10772                         if (os_strcmp(pos, "sta") == 0) {
10773                                 type = WPA_IF_STATION;
10774                         } else if (os_strcmp(pos, "ap") == 0) {
10775                                 type = WPA_IF_AP_BSS;
10776                         } else {
10777                                 wpa_printf(MSG_DEBUG,
10778                                            "INTERFACE_ADD unsupported interface type: '%s'",
10779                                            pos);
10780                                 return -1;
10781                         }
10782                 } else {
10783                         wpa_printf(MSG_DEBUG,
10784                                    "INTERFACE_ADD unsupported extra parameter: '%s'",
10785                                    extra);
10786                         return -1;
10787                 }
10788         } while (0);
10789
10790         if (create_iface) {
10791                 wpa_printf(MSG_DEBUG, "CTRL_IFACE creating interface '%s'",
10792                            iface.ifname);
10793                 if (!global->ifaces)
10794                         return -1;
10795                 if (wpa_drv_if_add(global->ifaces, type, iface.ifname,
10796                                    NULL, NULL, NULL, mac_addr, NULL) < 0) {
10797                         wpa_printf(MSG_ERROR,
10798                                    "CTRL_IFACE interface creation failed");
10799                         return -1;
10800                 }
10801
10802                 wpa_printf(MSG_DEBUG,
10803                            "CTRL_IFACE interface '%s' created with MAC addr: "
10804                            MACSTR, iface.ifname, MAC2STR(mac_addr));
10805         }
10806
10807         if (wpa_supplicant_get_iface(global, iface.ifname))
10808                 goto fail;
10809
10810         wpa_s = wpa_supplicant_add_iface(global, &iface, NULL);
10811         if (!wpa_s)
10812                 goto fail;
10813         wpa_s->added_vif = create_iface;
10814         return 0;
10815
10816 fail:
10817         if (create_iface)
10818                 wpa_drv_if_remove(global->ifaces, WPA_IF_STATION, iface.ifname);
10819         return -1;
10820 }
10821
10822
10823 static int wpa_supplicant_global_iface_remove(struct wpa_global *global,
10824                                               char *cmd)
10825 {
10826         struct wpa_supplicant *wpa_s;
10827         int ret;
10828         unsigned int delete_iface;
10829
10830         wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_REMOVE '%s'", cmd);
10831
10832         wpa_s = wpa_supplicant_get_iface(global, cmd);
10833         if (wpa_s == NULL)
10834                 return -1;
10835         delete_iface = wpa_s->added_vif;
10836         ret = wpa_supplicant_remove_iface(global, wpa_s, 0);
10837         if (!ret && delete_iface) {
10838                 wpa_printf(MSG_DEBUG, "CTRL_IFACE deleting the interface '%s'",
10839                            cmd);
10840                 ret = wpa_drv_if_remove(global->ifaces, WPA_IF_STATION, cmd);
10841         }
10842         return ret;
10843 }
10844
10845
10846 static void wpa_free_iface_info(struct wpa_interface_info *iface)
10847 {
10848         struct wpa_interface_info *prev;
10849
10850         while (iface) {
10851                 prev = iface;
10852                 iface = iface->next;
10853
10854                 os_free(prev->ifname);
10855                 os_free(prev->desc);
10856                 os_free(prev);
10857         }
10858 }
10859
10860
10861 static int wpa_supplicant_global_iface_list(struct wpa_global *global,
10862                                             char *buf, int len)
10863 {
10864         int i, res;
10865         struct wpa_interface_info *iface = NULL, *last = NULL, *tmp;
10866         char *pos, *end;
10867
10868         for (i = 0; wpa_drivers[i]; i++) {
10869                 const struct wpa_driver_ops *drv = wpa_drivers[i];
10870                 if (drv->get_interfaces == NULL)
10871                         continue;
10872                 tmp = drv->get_interfaces(global->drv_priv[i]);
10873                 if (tmp == NULL)
10874                         continue;
10875
10876                 if (last == NULL)
10877                         iface = last = tmp;
10878                 else
10879                         last->next = tmp;
10880                 while (last->next)
10881                         last = last->next;
10882         }
10883
10884         pos = buf;
10885         end = buf + len;
10886         for (tmp = iface; tmp; tmp = tmp->next) {
10887                 res = os_snprintf(pos, end - pos, "%s\t%s\t%s\n",
10888                                   tmp->drv_name, tmp->ifname,
10889                                   tmp->desc ? tmp->desc : "");
10890                 if (os_snprintf_error(end - pos, res)) {
10891                         *pos = '\0';
10892                         break;
10893                 }
10894                 pos += res;
10895         }
10896
10897         wpa_free_iface_info(iface);
10898
10899         return pos - buf;
10900 }
10901
10902
10903 static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
10904                                                   const char *input,
10905                                                   char *buf, int len)
10906 {
10907         int res;
10908         char *pos, *end;
10909         struct wpa_supplicant *wpa_s;
10910         int show_ctrl = 0;
10911
10912         if (input)
10913                 show_ctrl = !!os_strstr(input, "ctrl");
10914
10915         wpa_s = global->ifaces;
10916         pos = buf;
10917         end = buf + len;
10918
10919         while (wpa_s) {
10920                 if (show_ctrl)
10921                         res = os_snprintf(pos, end - pos, "%s ctrl_iface=%s\n",
10922                                           wpa_s->ifname,
10923                                           wpa_s->conf->ctrl_interface ?
10924                                           wpa_s->conf->ctrl_interface : "N/A");
10925                 else
10926                         res = os_snprintf(pos, end - pos, "%s\n",
10927                                           wpa_s->ifname);
10928
10929                 if (os_snprintf_error(end - pos, res)) {
10930                         *pos = '\0';
10931                         break;
10932                 }
10933                 pos += res;
10934                 wpa_s = wpa_s->next;
10935         }
10936         return pos - buf;
10937 }
10938
10939
10940 static char * wpas_global_ctrl_iface_ifname(struct wpa_global *global,
10941                                             const char *ifname,
10942                                             char *cmd, size_t *resp_len)
10943 {
10944         struct wpa_supplicant *wpa_s;
10945
10946         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
10947                 if (os_strcmp(ifname, wpa_s->ifname) == 0)
10948                         break;
10949         }
10950
10951         if (wpa_s == NULL) {
10952                 char *resp = os_strdup("FAIL-NO-IFNAME-MATCH\n");
10953                 if (resp)
10954                         *resp_len = os_strlen(resp);
10955                 else
10956                         *resp_len = 1;
10957                 return resp;
10958         }
10959
10960         return wpa_supplicant_ctrl_iface_process(wpa_s, cmd, resp_len);
10961 }
10962
10963
10964 static char * wpas_global_ctrl_iface_redir_p2p(struct wpa_global *global,
10965                                                char *buf, size_t *resp_len)
10966 {
10967 #ifdef CONFIG_P2P
10968         static const char * cmd[] = {
10969                 "LIST_NETWORKS",
10970                 "P2P_FIND",
10971                 "P2P_STOP_FIND",
10972                 "P2P_LISTEN",
10973                 "P2P_GROUP_ADD",
10974                 "P2P_GET_PASSPHRASE",
10975                 "P2P_SERVICE_UPDATE",
10976                 "P2P_SERVICE_FLUSH",
10977                 "P2P_FLUSH",
10978                 "P2P_CANCEL",
10979                 "P2P_PRESENCE_REQ",
10980                 "P2P_EXT_LISTEN",
10981 #ifdef CONFIG_AP
10982                 "STA-FIRST",
10983 #endif /* CONFIG_AP */
10984                 NULL
10985         };
10986         static const char * prefix[] = {
10987 #ifdef ANDROID
10988                 "DRIVER ",
10989 #endif /* ANDROID */
10990                 "GET_CAPABILITY ",
10991                 "GET_NETWORK ",
10992                 "REMOVE_NETWORK ",
10993                 "P2P_FIND ",
10994                 "P2P_CONNECT ",
10995                 "P2P_LISTEN ",
10996                 "P2P_GROUP_REMOVE ",
10997                 "P2P_GROUP_ADD ",
10998                 "P2P_GROUP_MEMBER ",
10999                 "P2P_PROV_DISC ",
11000                 "P2P_SERV_DISC_REQ ",
11001                 "P2P_SERV_DISC_CANCEL_REQ ",
11002                 "P2P_SERV_DISC_RESP ",
11003                 "P2P_SERV_DISC_EXTERNAL ",
11004                 "P2P_SERVICE_ADD ",
11005                 "P2P_SERVICE_DEL ",
11006                 "P2P_SERVICE_REP ",
11007                 "P2P_REJECT ",
11008                 "P2P_INVITE ",
11009                 "P2P_PEER ",
11010                 "P2P_SET ",
11011                 "P2P_UNAUTHORIZE ",
11012                 "P2P_PRESENCE_REQ ",
11013                 "P2P_EXT_LISTEN ",
11014                 "P2P_REMOVE_CLIENT ",
11015                 "WPS_NFC_TOKEN ",
11016                 "WPS_NFC_TAG_READ ",
11017                 "NFC_GET_HANDOVER_SEL ",
11018                 "NFC_GET_HANDOVER_REQ ",
11019                 "NFC_REPORT_HANDOVER ",
11020                 "P2P_ASP_PROVISION ",
11021                 "P2P_ASP_PROVISION_RESP ",
11022 #ifdef CONFIG_AP
11023                 "STA ",
11024                 "STA-NEXT ",
11025 #endif /* CONFIG_AP */
11026                 NULL
11027         };
11028         int found = 0;
11029         int i;
11030
11031         if (global->p2p_init_wpa_s == NULL)
11032                 return NULL;
11033
11034         for (i = 0; !found && cmd[i]; i++) {
11035                 if (os_strcmp(buf, cmd[i]) == 0)
11036                         found = 1;
11037         }
11038
11039         for (i = 0; !found && prefix[i]; i++) {
11040                 if (os_strncmp(buf, prefix[i], os_strlen(prefix[i])) == 0)
11041                         found = 1;
11042         }
11043
11044         if (found)
11045                 return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
11046                                                          buf, resp_len);
11047 #endif /* CONFIG_P2P */
11048         return NULL;
11049 }
11050
11051
11052 static char * wpas_global_ctrl_iface_redir_wfd(struct wpa_global *global,
11053                                                char *buf, size_t *resp_len)
11054 {
11055 #ifdef CONFIG_WIFI_DISPLAY
11056         if (global->p2p_init_wpa_s == NULL)
11057                 return NULL;
11058         if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0 ||
11059             os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0)
11060                 return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
11061                                                          buf, resp_len);
11062 #endif /* CONFIG_WIFI_DISPLAY */
11063         return NULL;
11064 }
11065
11066
11067 static char * wpas_global_ctrl_iface_redir(struct wpa_global *global,
11068                                            char *buf, size_t *resp_len)
11069 {
11070         char *ret;
11071
11072         ret = wpas_global_ctrl_iface_redir_p2p(global, buf, resp_len);
11073         if (ret)
11074                 return ret;
11075
11076         ret = wpas_global_ctrl_iface_redir_wfd(global, buf, resp_len);
11077         if (ret)
11078                 return ret;
11079
11080         return NULL;
11081 }
11082
11083
11084 static int wpas_global_ctrl_iface_set(struct wpa_global *global, char *cmd)
11085 {
11086         char *value;
11087
11088         value = os_strchr(cmd, ' ');
11089         if (value == NULL)
11090                 return -1;
11091         *value++ = '\0';
11092
11093         wpa_printf(MSG_DEBUG, "GLOBAL_CTRL_IFACE SET '%s'='%s'", cmd, value);
11094
11095 #ifdef CONFIG_WIFI_DISPLAY
11096         if (os_strcasecmp(cmd, "wifi_display") == 0) {
11097                 wifi_display_enable(global, !!atoi(value));
11098                 return 0;
11099         }
11100 #endif /* CONFIG_WIFI_DISPLAY */
11101
11102         /* Restore cmd to its original value to allow redirection */
11103         value[-1] = ' ';
11104
11105         return -1;
11106 }
11107
11108
11109 static int wpas_global_ctrl_iface_dup_network(struct wpa_global *global,
11110                                               char *cmd)
11111 {
11112         struct wpa_supplicant *wpa_s[2]; /* src, dst */
11113         char *p;
11114         unsigned int i;
11115
11116         /* cmd: "<src ifname> <dst ifname> <src network id> <dst network id>
11117          * <variable name> */
11118
11119         for (i = 0; i < ARRAY_SIZE(wpa_s) ; i++) {
11120                 p = os_strchr(cmd, ' ');
11121                 if (p == NULL)
11122                         return -1;
11123                 *p = '\0';
11124
11125                 wpa_s[i] = global->ifaces;
11126                 for (; wpa_s[i]; wpa_s[i] = wpa_s[i]->next) {
11127                         if (os_strcmp(cmd, wpa_s[i]->ifname) == 0)
11128                                 break;
11129                 }
11130
11131                 if (!wpa_s[i]) {
11132                         wpa_printf(MSG_DEBUG,
11133                                    "CTRL_IFACE: Could not find iface=%s", cmd);
11134                         return -1;
11135                 }
11136
11137                 cmd = p + 1;
11138         }
11139
11140         return wpa_supplicant_ctrl_iface_dup_network(wpa_s[0], cmd, wpa_s[1]);
11141 }
11142
11143
11144 #ifndef CONFIG_NO_CONFIG_WRITE
11145 static int wpas_global_ctrl_iface_save_config(struct wpa_global *global)
11146 {
11147         int ret = 0, saved = 0;
11148         struct wpa_supplicant *wpa_s;
11149
11150         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
11151                 if (!wpa_s->conf->update_config) {
11152                         wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed to update configuration (update_config=0)");
11153                         continue;
11154                 }
11155
11156                 if (wpa_config_write(wpa_s->confname, wpa_s->conf)) {
11157                         wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to update configuration");
11158                         ret = 1;
11159                 } else {
11160                         wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration updated");
11161                         saved++;
11162                 }
11163         }
11164
11165         if (!saved && !ret) {
11166                 wpa_dbg(wpa_s, MSG_DEBUG,
11167                         "CTRL_IFACE: SAVE_CONFIG - No configuration files could be updated");
11168                 ret = 1;
11169         }
11170
11171         return ret;
11172 }
11173 #endif /* CONFIG_NO_CONFIG_WRITE */
11174
11175
11176 static int wpas_global_ctrl_iface_status(struct wpa_global *global,
11177                                          char *buf, size_t buflen)
11178 {
11179         char *pos, *end;
11180         int ret;
11181         struct wpa_supplicant *wpa_s;
11182
11183         pos = buf;
11184         end = buf + buflen;
11185
11186 #ifdef CONFIG_P2P
11187         if (global->p2p && !global->p2p_disabled) {
11188                 ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
11189                                   "\n"
11190                                   "p2p_state=%s\n",
11191                                   MAC2STR(global->p2p_dev_addr),
11192                                   p2p_get_state_txt(global->p2p));
11193                 if (os_snprintf_error(end - pos, ret))
11194                         return pos - buf;
11195                 pos += ret;
11196         } else if (global->p2p) {
11197                 ret = os_snprintf(pos, end - pos, "p2p_state=DISABLED\n");
11198                 if (os_snprintf_error(end - pos, ret))
11199                         return pos - buf;
11200                 pos += ret;
11201         }
11202 #endif /* CONFIG_P2P */
11203
11204 #ifdef CONFIG_WIFI_DISPLAY
11205         ret = os_snprintf(pos, end - pos, "wifi_display=%d\n",
11206                           !!global->wifi_display);
11207         if (os_snprintf_error(end - pos, ret))
11208                 return pos - buf;
11209         pos += ret;
11210 #endif /* CONFIG_WIFI_DISPLAY */
11211
11212         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
11213                 ret = os_snprintf(pos, end - pos, "ifname=%s\n"
11214                                   "address=" MACSTR "\n",
11215                                   wpa_s->ifname, MAC2STR(wpa_s->own_addr));
11216                 if (os_snprintf_error(end - pos, ret))
11217                         return pos - buf;
11218                 pos += ret;
11219         }
11220
11221         return pos - buf;
11222 }
11223
11224
11225 #ifdef CONFIG_FST
11226
11227 static int wpas_global_ctrl_iface_fst_attach(struct wpa_global *global,
11228                                              char *cmd, char *buf,
11229                                              size_t reply_size)
11230 {
11231         char ifname[IFNAMSIZ + 1];
11232         struct fst_iface_cfg cfg;
11233         struct wpa_supplicant *wpa_s;
11234         struct fst_wpa_obj iface_obj;
11235
11236         if (!fst_parse_attach_command(cmd, ifname, sizeof(ifname), &cfg)) {
11237                 wpa_s = wpa_supplicant_get_iface(global, ifname);
11238                 if (wpa_s) {
11239                         if (wpa_s->fst) {
11240                                 wpa_printf(MSG_INFO, "FST: Already attached");
11241                                 return -1;
11242                         }
11243                         fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
11244                         wpa_s->fst = fst_attach(ifname, wpa_s->own_addr,
11245                                                 &iface_obj, &cfg);
11246                         if (wpa_s->fst)
11247                                 return os_snprintf(buf, reply_size, "OK\n");
11248                 }
11249         }
11250
11251         return -1;
11252 }
11253
11254
11255 static int wpas_global_ctrl_iface_fst_detach(struct wpa_global *global,
11256                                              char *cmd, char *buf,
11257                                              size_t reply_size)
11258 {
11259         char ifname[IFNAMSIZ + 1];
11260         struct wpa_supplicant *wpa_s;
11261
11262         if (!fst_parse_detach_command(cmd, ifname, sizeof(ifname))) {
11263                 wpa_s = wpa_supplicant_get_iface(global, ifname);
11264                 if (wpa_s) {
11265                         if (!fst_iface_detach(ifname)) {
11266                                 wpa_s->fst = NULL;
11267                                 return os_snprintf(buf, reply_size, "OK\n");
11268                         }
11269                 }
11270         }
11271
11272         return -1;
11273 }
11274
11275 #endif /* CONFIG_FST */
11276
11277
11278 char * wpa_supplicant_global_ctrl_iface_process(struct wpa_global *global,
11279                                                 char *buf, size_t *resp_len)
11280 {
11281         char *reply;
11282         const int reply_size = 2048;
11283         int reply_len;
11284         int level = MSG_DEBUG;
11285
11286         if (os_strncmp(buf, "IFNAME=", 7) == 0) {
11287                 char *pos = os_strchr(buf + 7, ' ');
11288                 if (pos) {
11289                         *pos++ = '\0';
11290                         return wpas_global_ctrl_iface_ifname(global,
11291                                                              buf + 7, pos,
11292                                                              resp_len);
11293                 }
11294         }
11295
11296         reply = wpas_global_ctrl_iface_redir(global, buf, resp_len);
11297         if (reply)
11298                 return reply;
11299
11300         if (os_strcmp(buf, "PING") == 0)
11301                 level = MSG_EXCESSIVE;
11302         wpa_hexdump_ascii(level, "RX global ctrl_iface",
11303                           (const u8 *) buf, os_strlen(buf));
11304
11305         reply = os_malloc(reply_size);
11306         if (reply == NULL) {
11307                 *resp_len = 1;
11308                 return NULL;
11309         }
11310
11311         os_memcpy(reply, "OK\n", 3);
11312         reply_len = 3;
11313
11314         if (os_strcmp(buf, "PING") == 0) {
11315                 os_memcpy(reply, "PONG\n", 5);
11316                 reply_len = 5;
11317         } else if (os_strncmp(buf, "INTERFACE_ADD ", 14) == 0) {
11318                 if (wpa_supplicant_global_iface_add(global, buf + 14))
11319                         reply_len = -1;
11320         } else if (os_strncmp(buf, "INTERFACE_REMOVE ", 17) == 0) {
11321                 if (wpa_supplicant_global_iface_remove(global, buf + 17))
11322                         reply_len = -1;
11323         } else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
11324                 reply_len = wpa_supplicant_global_iface_list(
11325                         global, reply, reply_size);
11326         } else if (os_strncmp(buf, "INTERFACES", 10) == 0) {
11327                 reply_len = wpa_supplicant_global_iface_interfaces(
11328                         global, buf + 10, reply, reply_size);
11329 #ifdef CONFIG_FST
11330         } else if (os_strncmp(buf, "FST-ATTACH ", 11) == 0) {
11331                 reply_len = wpas_global_ctrl_iface_fst_attach(global, buf + 11,
11332                                                               reply,
11333                                                               reply_size);
11334         } else if (os_strncmp(buf, "FST-DETACH ", 11) == 0) {
11335                 reply_len = wpas_global_ctrl_iface_fst_detach(global, buf + 11,
11336                                                               reply,
11337                                                               reply_size);
11338         } else if (os_strncmp(buf, "FST-MANAGER ", 12) == 0) {
11339                 reply_len = fst_ctrl_iface_receive(buf + 12, reply, reply_size);
11340 #endif /* CONFIG_FST */
11341         } else if (os_strcmp(buf, "TERMINATE") == 0) {
11342                 wpa_supplicant_terminate_proc(global);
11343         } else if (os_strcmp(buf, "SUSPEND") == 0) {
11344                 wpas_notify_suspend(global);
11345         } else if (os_strcmp(buf, "RESUME") == 0) {
11346                 wpas_notify_resume(global);
11347         } else if (os_strncmp(buf, "SET ", 4) == 0) {
11348                 if (wpas_global_ctrl_iface_set(global, buf + 4)) {
11349 #ifdef CONFIG_P2P
11350                         if (global->p2p_init_wpa_s) {
11351                                 os_free(reply);
11352                                 /* Check if P2P redirection would work for this
11353                                  * command. */
11354                                 return wpa_supplicant_ctrl_iface_process(
11355                                         global->p2p_init_wpa_s,
11356                                         buf, resp_len);
11357                         }
11358 #endif /* CONFIG_P2P */
11359                         reply_len = -1;
11360                 }
11361         } else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
11362                 if (wpas_global_ctrl_iface_dup_network(global, buf + 12))
11363                         reply_len = -1;
11364 #ifndef CONFIG_NO_CONFIG_WRITE
11365         } else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
11366                 if (wpas_global_ctrl_iface_save_config(global))
11367                         reply_len = -1;
11368 #endif /* CONFIG_NO_CONFIG_WRITE */
11369         } else if (os_strcmp(buf, "STATUS") == 0) {
11370                 reply_len = wpas_global_ctrl_iface_status(global, reply,
11371                                                           reply_size);
11372 #ifdef CONFIG_MODULE_TESTS
11373         } else if (os_strcmp(buf, "MODULE_TESTS") == 0) {
11374                 if (wpas_module_tests() < 0)
11375                         reply_len = -1;
11376 #endif /* CONFIG_MODULE_TESTS */
11377         } else if (os_strncmp(buf, "RELOG", 5) == 0) {
11378                 if (wpa_debug_reopen_file() < 0)
11379                         reply_len = -1;
11380         } else {
11381                 os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
11382                 reply_len = 16;
11383         }
11384
11385         if (reply_len < 0) {
11386                 os_memcpy(reply, "FAIL\n", 5);
11387                 reply_len = 5;
11388         }
11389
11390         *resp_len = reply_len;
11391         return reply;
11392 }