scan.c

   1 #include <net/if.h>
   2 #include <errno.h>
   3 #include <string.h>
   4 #include <ctype.h>
   5 #include <stdbool.h>
   6
   7 #include <netlink/genl/genl.h>
   8 #include <netlink/genl/family.h>
   9 #include <netlink/genl/ctrl.h>
  10 #include <netlink/msg.h>
  11 #include <netlink/attr.h>
  12
  13 #include "nl80211.h"
  14 #include "iw.h"
  15
  16 #define WLAN_CAPABILITY_ESS             (1<<0)
  17 #define WLAN_CAPABILITY_IBSS            (1<<1)
  18 #define WLAN_CAPABILITY_CF_POLLABLE     (1<<2)
  19 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
  20 #define WLAN_CAPABILITY_PRIVACY         (1<<4)
  21 #define WLAN_CAPABILITY_SHORT_PREAMBLE  (1<<5)
  22 #define WLAN_CAPABILITY_PBCC            (1<<6)
  23 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
  24 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
  25 #define WLAN_CAPABILITY_QOS             (1<<9)
  26 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
  27 #define WLAN_CAPABILITY_APSD            (1<<11)
  28 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
  29
  30 static unsigned char wifi_oui[3]      = { 0x00, 0x50, 0xf2 };
  31 static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };
  32
  33 struct scan_params {
  34         bool unknown;
  35 };
  36
  37 static int handle_scan(struct nl80211_state *state,
  38                        struct nl_cb *cb,
  39                        struct nl_msg *msg,
  40                        int argc, char **argv)
  41 {
  42         struct nl_msg *ssids = NULL, *freqs = NULL;
  43         char *eptr;
  44         int err = -ENOBUFS;
  45         int i;
  46         enum {
  47                 NONE,
  48                 FREQ,
  49                 SSID,
  50                 DONE,
  51         } parse = NONE;
  52         int freq;
  53         bool passive = false, have_ssids = false, have_freqs = false;
  54
  55         ssids = nlmsg_alloc();
  56         if (!ssids)
  57                 return -ENOMEM;
  58
  59         freqs = nlmsg_alloc();
  60         if (!freqs) {
  61                 nlmsg_free(ssids);
  62                 return -ENOMEM;
  63         }
  64
  65         for (i = 0; i < argc; i++) {
  66                 if (parse == NONE && strcmp(argv[i], "freq") == 0) {
  67                         parse = FREQ;
  68                         have_freqs = true;
  69                         continue;
  70                 } else if (parse < SSID && strcmp(argv[i], "ssid") == 0) {
  71                         parse = SSID;
  72                         have_ssids = true;
  73                         continue;
  74                 } else if (parse < SSID && strcmp(argv[i], "passive") == 0) {
  75                         parse = DONE;
  76                         passive = true;
  77                         continue;
  78                 }
  79
  80                 switch (parse) {
  81                 case NONE:
  82                 case DONE:
  83                         return 1;
  84                 case FREQ:
  85                         freq = strtoul(argv[i], &eptr, 10);
  86                         if (eptr != argv[i] + strlen(argv[i]))
  87                                 return 1;
  88                         NLA_PUT_U32(freqs, i, freq);
  89                         break;
  90                 case SSID:
  91                         NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
  92                         break;
  93                 }
  94         }
  95
  96         if (!have_ssids)
  97                 NLA_PUT(ssids, 1, 0, "");
  98         if (!passive)
  99                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
 100
 101         if (have_freqs)
 102                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
 103
 104         err = 0;
 105  nla_put_failure:
 106         nlmsg_free(ssids);
 107         nlmsg_free(freqs);
 108         return err;
 109 }
 110 COMMAND(scan, trigger, "[freq <freq>*] [ssid <ssid>*|passive]",
 111         NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan);
 112
 113 static void tab_on_first(bool *first)
 114 {
 115         if (!*first)
 116                 printf("\t");
 117         else
 118                 *first = false;
 119 }
 120
 121 static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
 122 {
 123         int i;
 124
 125         printf(" ");
 126
 127         for (i = 0; i < len; i++) {
 128                 if (isprint(data[i]))
 129                         printf("%c", data[i]);
 130                 else
 131                         printf("\\x%.2x", data[i]);
 132         }
 133         printf("\n");
 134 }
 135
 136 static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 137 {
 138         int i;
 139
 140         printf(" ");
 141
 142         for (i = 0; i < len; i++) {
 143                 int r = data[i] & 0x7f;
 144                 printf("%d.%d%s ", r/2, 5*(r&1), data[i] & 0x80 ? "*":"");
 145         }
 146         printf("\n");
 147 }
 148
 149 static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
 150 {
 151         printf(" channel %d\n", data[0]);
 152 }
 153
 154 static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
 155 {
 156         int i;
 157
 158         printf(" %.*s", 2, data);
 159         switch (data[2]) {
 160         case 'I':
 161                 printf(" (indoor)");
 162                 break;
 163         case 'O':
 164                 printf(" (outdoor)");
 165                 break;
 166         case ' ':
 167                 printf(" (in/outdoor)");
 168                 break;
 169         default:
 170                 printf(" (invalid environment)");
 171                 break;
 172         }
 173         printf(", data:");
 174         for(i=0; i<len-3; i++)
 175                 printf(" %.02x", data[i + 3]);
 176         printf("\n");
 177 }
 178
 179 static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
 180 {
 181         printf(" %d dB\n", data[0]);
 182 }
 183
 184 static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 185 {
 186         if (data[0] == 0x00)
 187                 printf(" <no flags>");
 188         if (data[0] & 0x01)
 189                 printf(" NonERP_Present");
 190         if (data[0] & 0x02)
 191                 printf(" Use_Protection");
 192         if (data[0] & 0x04)
 193                 printf(" Barker_Preamble_Mode");
 194         printf("\n");
 195 }
 196
 197 static void print_cipher(const uint8_t *data)
 198 {
 199         if (memcmp(data, wifi_oui, 3) == 0) {
 200                 switch (data[3]) {
 201                 case 0x00:
 202                         printf("Use group cipher suite");
 203                         break;
 204                 case 0x01:
 205                         printf("WEP-40");
 206                         break;
 207                 case 0x02:
 208                         printf("TKIP");
 209                         break;
 210                 case 0x04:
 211                         printf("CCMP");
 212                         break;
 213                 case 0x05:
 214                         printf("WEP-104");
 215                         break;
 216                 default:
 217                         printf("Unknown (%.02x-%.02x-%.02x:%d)",
 218                                 data[0], data[1] ,data[2], data[3]);
 219                         break;
 220                 }
 221         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 222                 switch (data[3]) {
 223                 case 0x00:
 224                         printf("Use group cipher suite");
 225                         break;
 226                 case 0x01:
 227                         printf("WEP-40");
 228                         break;
 229                 case 0x02:
 230                         printf("TKIP");
 231                         break;
 232                 case 0x04:
 233                         printf("CCMP");
 234                         break;
 235                 case 0x05:
 236                         printf("WEP-104");
 237                         break;
 238                 case 0x06:
 239                         printf("AES-128-CMAC");
 240                         break;
 241                 default:
 242                         printf("Unknown (%.02x-%.02x-%.02x:%d)",
 243                                 data[0], data[1] ,data[2], data[3]);
 244                         break;
 245                 }
 246         } else
 247                 printf("Unknown (%.02x-%.02x-%.02x:%d)",
 248                         data[0], data[1] ,data[2], data[3]);
 249 }
 250
 251 static void print_auth(const uint8_t *data)
 252 {
 253         if (memcmp(data, wifi_oui, 3) == 0) {
 254                 switch (data[3]) {
 255                 case 0x01:
 256                         printf("IEEE 802.1X");
 257                         break;
 258                 case 0x02:
 259                         printf("PSK");
 260                         break;
 261                 default:
 262                         printf("Unknown (%.02x-%.02x-%.02x:%d)",
 263                                 data[0], data[1] ,data[2], data[3]);
 264                         break;
 265                 }
 266         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 267                 switch (data[3]) {
 268                 case 0x01:
 269                         printf("IEEE 802.1X");
 270                         break;
 271                 case 0x02:
 272                         printf("PSK");
 273                         break;
 274                 default:
 275                         printf("Unknown (%.02x-%.02x-%.02x:%d)",
 276                                 data[0], data[1] ,data[2], data[3]);
 277                         break;
 278                 }
 279         } else
 280                 printf("Unknown (%.02x-%.02x-%.02x:%d)",
 281                         data[0], data[1] ,data[2], data[3]);
 282 }
 283
 284 static void print_rsn_ie(const char *defcipher, const char *defauth,
 285                          uint8_t len, const uint8_t *data)
 286 {
 287         bool first = true;
 288         __u16 version, count, capa;
 289         int i;
 290
 291         version = data[0] + (data[1] << 8);
 292         tab_on_first(&first);
 293         printf("\t * Version: %d\n", version);
 294
 295         data += 2;
 296         len -= 2;
 297
 298         if (len < 4) {
 299                 tab_on_first(&first);
 300                 printf("\t * Group cipher: %s\n", defcipher);
 301                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 302                 return;
 303         }
 304
 305         tab_on_first(&first);
 306         printf("\t * Group cipher: ");
 307         print_cipher(data);
 308         printf("\n");
 309
 310         data += 4;
 311         len -= 4;
 312
 313         if (len < 2) {
 314                 tab_on_first(&first);
 315                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 316                 return;
 317         }
 318
 319         count = data[0] | (data[1] << 8);
 320         tab_on_first(&first);
 321         printf("\t * Pairwise ciphers:");
 322         for (i=0; i<count; i++) {
 323                 printf(" ");
 324                 print_cipher(data + 2 + (i * 4));
 325         }
 326         printf("\n");
 327
 328         data += 2 + (count * 4);
 329         len -= 2 + (count * 4);
 330
 331         if (len < 2) {
 332                 tab_on_first(&first);
 333                 printf("\t * Authentication suites: %s\n", defauth);
 334                 return;
 335         }
 336
 337         count = data[0] | (data[1] << 8);
 338         tab_on_first(&first);
 339         printf("\t * Authentication suites:");
 340         for (i = 0; i < count; i++) {
 341                 printf(" ");
 342                 print_auth(data + 2 + (i * 4));
 343         }
 344         printf("\n");
 345
 346         data += 2 + (count * 4);
 347         len -= 2 + (count * 4);
 348
 349         if (len < 2)
 350                 return;
 351
 352         capa = data[0] | (data[1] << 8);
 353         tab_on_first(&first);
 354         printf("\t * Capabilities: 0x%.4x\n", capa);
 355 }
 356
 357 static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
 358 {
 359         print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 360 }
 361
 362 static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 363 {
 364         int i;
 365
 366         for(i = 0; i < len; i++)
 367                 printf(" %.02x", data[i]);
 368         printf("\n");
 369 }
 370
 371 struct ie_print {
 372         const char *name;
 373         void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
 374         uint8_t minlen, maxlen;
 375 };
 376
 377 static void print_ie(const struct ie_print *p, const uint8_t type,
 378                      uint8_t len, const uint8_t *data)
 379 {
 380         int i;
 381
 382         if (!p->print)
 383                 return;
 384
 385         printf("\t%s:", p->name);
 386         if (len < p->minlen || len > p->maxlen) {
 387                 if (len > 1) {
 388                         printf(" <invalid: %d bytes:", len);
 389                         for (i = 0; i < len; i++)
 390                                 printf(" %.02x", data[i]);
 391                         printf(">\n");
 392                 } else if (len)
 393                         printf(" <invalid: 1 byte: %.02x>\n", data[0]);
 394                 else
 395                         printf(" <invalid: no data>\n");
 396                 return;
 397         }
 398
 399         p->print(type, len, data);
 400 }
 401
 402 #define PRINT_IGN {             \
 403         .name = "IGNORE",       \
 404         .print = NULL,          \
 405         .minlen = 0,            \
 406         .maxlen = 255,          \
 407 }
 408
 409 static const struct ie_print ieprinters[] = {
 410         [0] = { "SSID", print_ssid, 0, 32, },
 411         [1] = { "Supported rates", print_supprates, 0, 255, },
 412         [3] = { "DS Paramater set", print_ds, 1, 1, },
 413         [5] = PRINT_IGN,
 414         [7] = { "Country", print_country, 3, 255, },
 415         [32] = { "Power constraint", print_powerconstraint, 1, 1, },
 416         [42] = { "ERP", print_erp, 1, 255, },
 417         [48] = { "RSN", print_rsn, 2, 255, },
 418         [50] = { "Extended supported rates", print_supprates, 0, 255, },
 419         [127] = { "Extended capabilities", print_capabilities, 0, 255, },
 420 };
 421
 422 static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
 423 {
 424         print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
 425 }
 426
 427 static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
 428 {
 429         int i;
 430
 431         switch (data[0]) {
 432         case 0x00:
 433                 printf(" information:");
 434                 break;
 435         case 0x01:
 436                 printf(" parameter:");
 437                 break;
 438         default:
 439                 printf(" type %d:", data[0]);
 440                 break;
 441         }
 442
 443         for(i = 0; i < len - 1; i++)
 444                 printf(" %.02x", data[i + 1]);
 445         printf("\n");
 446 }
 447
 448 static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
 449 {
 450         bool first = true;
 451         __u16 subtype, sublen;
 452
 453         while (len >= 4) {
 454                 subtype = (data[0] << 8) + data[1];
 455                 sublen = (data[2] << 8) + data[3];
 456                 if (sublen > len)
 457                         break;
 458
 459                 switch (subtype) {
 460                 case 0x104a:
 461                         tab_on_first(&first);
 462                         printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
 463                         break;
 464                 case 0x1011:
 465                         tab_on_first(&first);
 466                         printf("\t * Device name: %.*s\n", sublen, data + 4);
 467                         break;
 468                 case 0x1021:
 469                         tab_on_first(&first);
 470                         printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
 471                         break;
 472                 case 0x1023:
 473                         tab_on_first(&first);
 474                         printf("\t * Model: %.*s\n", sublen, data + 4);
 475                         break;
 476                 case 0x1057: {
 477                         __u16 val = (data[4] << 8) | data[5];
 478                         tab_on_first(&first);
 479                         printf("\t * AP setup locked: 0x%.4x\n", val);
 480                         break;
 481                 }
 482                 case 0x1008: {
 483                         __u16 meth = (data[4] << 8) + data[5];
 484                         bool comma = false;
 485                         tab_on_first(&first);
 486                         printf("\t * Config methods:");
 487 #define T(bit, name) do {               \
 488         if (meth & (1<<bit)) {          \
 489                 if (comma)              \
 490                         printf(",");    \
 491                 comma = true;           \
 492                 printf(" " name);       \
 493         } } while (0)
 494                         T(0, "USB");
 495                         T(1, "Ethernet");
 496                         T(2, "Label");
 497                         T(3, "Display");
 498                         T(4, "Ext. NFC");
 499                         T(5, "Int. NFC");
 500                         T(6, "NFC Intf.");
 501                         T(7, "PBC");
 502                         T(8, "Keypad");
 503                         printf("\n");
 504                         break;
 505 #undef T
 506                 }
 507                 default:
 508                         break;
 509                 }
 510
 511                 data += sublen + 4;
 512                 len -= sublen + 4;
 513         }
 514
 515         if (len != 0) {
 516                 printf("\t\t * bogus tail data (%d):", len);
 517                 while (len) {
 518                         printf(" %.2x", *data);
 519                         data++;
 520                         len--;
 521                 }
 522                 printf("\n");
 523         }
 524 }
 525
 526 static const struct ie_print wifiprinters[] = {
 527         [1] = { "WPA", print_wifi_wpa, 2, 255, },
 528         [2] = { "WMM", print_wifi_wmm, 1, 255, },
 529         [4] = { "WPS", print_wifi_wps, 0, 255, },
 530 };
 531
 532 static void print_vendor(unsigned char len, unsigned char *data,
 533                          struct scan_params *params)
 534 {
 535         int i;
 536
 537         if (len < 3) {
 538                 printf("\tVendor specific: <too short> data:");
 539                 for(i = 0; i < len; i++)
 540                         printf(" %.02x", data[i]);
 541                 printf("\n");
 542                 return;
 543         }
 544
 545         if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) {
 546                 if (data[3] < ARRAY_SIZE(wifiprinters) && wifiprinters[data[3]].name) {
 547                         print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
 548                         return;
 549                 }
 550                 if (!params->unknown)
 551                         return;
 552                 printf("\tWiFi OUI %#.2x, data:", data[3]);
 553                 for(i = 0; i < len - 4; i++)
 554                         printf(" %.02x", data[i + 4]);
 555                 printf("\n");
 556                 return;
 557         }
 558
 559         if (!params->unknown)
 560                 return;
 561
 562         printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
 563                 data[0], data[1], data[2]);
 564         for (i = 3; i < len; i++)
 565                 printf(" %.2x", data[i]);
 566         printf("\n");
 567 }
 568
 569 static void print_ies(unsigned char *ie, int ielen, struct scan_params *params)
 570 {
 571         while (ielen >= 2 && ielen >= ie[1]) {
 572                 if (ie[0] < ARRAY_SIZE(ieprinters) && ieprinters[ie[0]].name) {
 573                         print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
 574                 } else if (ie[0] == 221 /* vendor */) {
 575                         print_vendor(ie[1], ie + 2, params);
 576                 } else if (params->unknown) {
 577                         int i;
 578
 579                         printf("\tUnknown IE (%d):", ie[0]);
 580                         for (i=0; i<ie[1]; i++)
 581                                 printf(" %.2x", ie[2+i]);
 582                         printf("\n");
 583                 }
 584                 ielen -= ie[1] + 2;
 585                 ie += ie[1] + 2;
 586         }
 587 }
 588
 589 static int print_bss_handler(struct nl_msg *msg, void *arg)
 590 {
 591         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 592         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 593         struct nlattr *bss[NL80211_BSS_MAX + 1];
 594         char mac_addr[20], dev[20];
 595         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
 596                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
 597                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
 598                 [NL80211_BSS_BSSID] = { },
 599                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
 600                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
 601                 [NL80211_BSS_INFORMATION_ELEMENTS] = { },
 602                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
 603                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
 604         };
 605
 606         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 607                   genlmsg_attrlen(gnlh, 0), NULL);
 608
 609         if (!tb[NL80211_ATTR_BSS]) {
 610                 fprintf(stderr, "bss info missing!");
 611                 return NL_SKIP;
 612         }
 613         if (nla_parse_nested(bss, NL80211_BSS_MAX,
 614                              tb[NL80211_ATTR_BSS],
 615                              bss_policy)) {
 616                 fprintf(stderr, "failed to parse nested attributes!");
 617                 return NL_SKIP;
 618         }
 619
 620         if (!bss[NL80211_BSS_BSSID])
 621                 return NL_SKIP;
 622
 623         mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
 624         if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
 625         printf("BSS %s (on %s)\n", mac_addr, dev);
 626
 627         if (bss[NL80211_BSS_TSF]) {
 628                 unsigned long long tsf;
 629                 tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
 630                 printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
 631                         tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
 632                         (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
 633         }
 634         if (bss[NL80211_BSS_FREQUENCY])
 635                 printf("\tfreq: %d\n",
 636                         nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
 637         if (bss[NL80211_BSS_BEACON_INTERVAL])
 638                 printf("\tbeacon interval: %d\n",
 639                         nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
 640         if (bss[NL80211_BSS_CAPABILITY]) {
 641                 __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
 642                 printf("\tcapability:");
 643                 if (capa & WLAN_CAPABILITY_ESS)
 644                         printf(" ESS");
 645                 if (capa & WLAN_CAPABILITY_IBSS)
 646                         printf(" IBSS");
 647                 if (capa & WLAN_CAPABILITY_PRIVACY)
 648                         printf(" Privacy");
 649                 if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
 650                         printf(" ShortPreamble");
 651                 if (capa & WLAN_CAPABILITY_PBCC)
 652                         printf(" PBCC");
 653                 if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
 654                         printf(" ChannelAgility");
 655                 if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
 656                         printf(" SpectrumMgmt");
 657                 if (capa & WLAN_CAPABILITY_QOS)
 658                         printf(" QoS");
 659                 if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
 660                         printf(" ShortSlotTime");
 661                 if (capa & WLAN_CAPABILITY_APSD)
 662                         printf(" APSD");
 663                 if (capa & WLAN_CAPABILITY_DSSS_OFDM)
 664                         printf(" DSSS-OFDM");
 665                 printf(" (0x%.4x)\n", capa);
 666         }
 667         if (bss[NL80211_BSS_SIGNAL_MBM]) {
 668                 int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
 669                 printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
 670         }
 671         if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
 672                 unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
 673                 printf("\tsignal: %d/100\n", s);
 674         }
 675         if (bss[NL80211_BSS_INFORMATION_ELEMENTS])
 676                 print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
 677                           nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
 678                           arg);
 679
 680         return NL_SKIP;
 681 }
 682
 683 static struct scan_params scan_params;
 684
 685 static int handle_scan_dump(struct nl80211_state *state,
 686                             struct nl_cb *cb,
 687                             struct nl_msg *msg,
 688                             int argc, char **argv)
 689 {
 690         if (argc > 1)
 691                 return 1;
 692
 693         scan_params.unknown = false;
 694         if (argc == 1 && !strcmp(argv[0], "-u"))
 695                 scan_params.unknown = true;
 696
 697         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
 698                   &scan_params);
 699         return 0;
 700 }
 701 COMMAND(scan, dump, "[-u]",
 702         NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump);
 703
 704 static int handle_scan_combined(struct nl80211_state *state,
 705                                 struct nl_cb *cb,
 706                                 struct nl_msg *msg,
 707                                 int argc, char **argv)
 708 {
 709         char **trig_argv;
 710 /*      static char *trig_argv[] = {
 711                 NULL,
 712                 "scan",
 713                 "trigger",
 714         };*/
 715         static char *dump_argv[] = {
 716                 NULL,
 717                 "scan",
 718                 "dump",
 719                 NULL,
 720         };
 721         static const __u32 cmds[] = {
 722                 NL80211_CMD_NEW_SCAN_RESULTS,
 723                 NL80211_CMD_SCAN_ABORTED,
 724         };
 725         int trig_argc, dump_argc, err;
 726
 727         if (argc >= 3 && !strcmp(argv[2], "-u")) {
 728                 dump_argc = 4;
 729                 dump_argv[3] = "-u";
 730         } else
 731                 dump_argc = 3;
 732
 733         trig_argc = 3 + (argc - 2) + (3 - dump_argc);
 734         trig_argv = calloc(trig_argc, sizeof(*trig_argv));
 735         if (!trig_argv)
 736                 return -ENOMEM;
 737         trig_argv[0] = argv[0];
 738         trig_argv[1] = "scan";
 739         trig_argv[2] = "trigger";
 740         int i;
 741         for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
 742                 trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
 743         err = handle_cmd(state, II_NETDEV, trig_argc, trig_argv);
 744         free(trig_argv);
 745         if (err)
 746                 return err;
 747
 748         /*
 749          * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
 750          *
 751          * This code has a bug, which requires creating a separate
 752          * nl80211 socket to fix:
 753          * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
 754          * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
 755          * before (!) we listen to it, because we only start listening
 756          * after we send our scan request.
 757          *
 758          * Doing it the other way around has a race condition as well,
 759          * if you first open the events socket you may get a notification
 760          * for a previous scan.
 761          *
 762          * The only proper way to fix this would be to listen to events
 763          * before sending the command, and for the kernel to send the
 764          * scan request along with the event, so that you can match up
 765          * whether the scan you requested was finished or aborted (this
 766          * may result in processing a scan that another application
 767          * requested, but that doesn't seem to be a problem).
 768          *
 769          * Alas, the kernel doesn't do that (yet).
 770          */
 771
 772         if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
 773                                         NL80211_CMD_SCAN_ABORTED) {
 774                 printf("scan aborted!\n");
 775                 return 0;
 776         }
 777
 778         dump_argv[0] = argv[0];
 779         return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
 780 }
 781 TOPLEVEL(scan, "[-u] [freq <freq>*] [ssid <ssid>*|passive]", 0, 0, CIB_NETDEV, handle_scan_combined);