]>
Commit | Line | Data |
---|---|---|
1 | #include <net/if.h> | |
2 | #include <errno.h> | |
3 | #include <string.h> | |
4 | #include <ctype.h> | |
5 | #include <stdbool.h> | |
6 | ||
7 | #include <netlink/genl/genl.h> | |
8 | #include <netlink/genl/family.h> | |
9 | #include <netlink/genl/ctrl.h> | |
10 | #include <netlink/msg.h> | |
11 | #include <netlink/attr.h> | |
12 | ||
13 | #include "nl80211.h" | |
14 | #include "iw.h" | |
15 | ||
16 | #define WLAN_CAPABILITY_ESS (1<<0) | |
17 | #define WLAN_CAPABILITY_IBSS (1<<1) | |
18 | #define WLAN_CAPABILITY_CF_POLLABLE (1<<2) | |
19 | #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3) | |
20 | #define WLAN_CAPABILITY_PRIVACY (1<<4) | |
21 | #define WLAN_CAPABILITY_SHORT_PREAMBLE (1<<5) | |
22 | #define WLAN_CAPABILITY_PBCC (1<<6) | |
23 | #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7) | |
24 | #define WLAN_CAPABILITY_SPECTRUM_MGMT (1<<8) | |
25 | #define WLAN_CAPABILITY_QOS (1<<9) | |
26 | #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10) | |
27 | #define WLAN_CAPABILITY_APSD (1<<11) | |
28 | #define WLAN_CAPABILITY_DSSS_OFDM (1<<13) | |
29 | ||
30 | static unsigned char wifi_oui[3] = { 0x00, 0x50, 0xf2 }; | |
31 | static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac }; | |
32 | ||
33 | struct scan_params { | |
34 | bool unknown; | |
35 | enum print_ie_type type; | |
36 | bool show_both_ie_sets; | |
37 | }; | |
38 | ||
39 | #define IEEE80211_COUNTRY_EXTENSION_ID 201 | |
40 | ||
41 | struct ieee80211_country_ie_triplet { | |
42 | union { | |
43 | struct { | |
44 | __u8 first_channel; | |
45 | __u8 num_channels; | |
46 | __s8 max_power; | |
47 | } __attribute__ ((packed)) chans; | |
48 | struct { | |
49 | __u8 reg_extension_id; | |
50 | __u8 reg_class; | |
51 | __u8 coverage_class; | |
52 | } __attribute__ ((packed)) ext; | |
53 | }; | |
54 | } __attribute__ ((packed)); | |
55 | ||
56 | static int handle_scan(struct nl80211_state *state, | |
57 | struct nl_cb *cb, | |
58 | struct nl_msg *msg, | |
59 | int argc, char **argv) | |
60 | { | |
61 | struct nl_msg *ssids = NULL, *freqs = NULL; | |
62 | char *eptr; | |
63 | int err = -ENOBUFS; | |
64 | int i; | |
65 | enum { | |
66 | NONE, | |
67 | FREQ, | |
68 | IES, | |
69 | SSID, | |
70 | DONE, | |
71 | } parse = NONE; | |
72 | int freq; | |
73 | bool passive = false, have_ssids = false, have_freqs = false; | |
74 | size_t tmp; | |
75 | unsigned char *ies; | |
76 | ||
77 | ssids = nlmsg_alloc(); | |
78 | if (!ssids) | |
79 | return -ENOMEM; | |
80 | ||
81 | freqs = nlmsg_alloc(); | |
82 | if (!freqs) { | |
83 | nlmsg_free(ssids); | |
84 | return -ENOMEM; | |
85 | } | |
86 | ||
87 | for (i = 0; i < argc; i++) { | |
88 | switch (parse) { | |
89 | case NONE: | |
90 | if (strcmp(argv[i], "freq") == 0) { | |
91 | parse = FREQ; | |
92 | have_freqs = true; | |
93 | break; | |
94 | } else if (strcmp(argv[i], "ies") == 0) { | |
95 | parse = IES; | |
96 | break; | |
97 | } else if (strcmp(argv[i], "ssid") == 0) { | |
98 | parse = SSID; | |
99 | have_ssids = true; | |
100 | break; | |
101 | } else if (strcmp(argv[i], "passive") == 0) { | |
102 | parse = DONE; | |
103 | passive = true; | |
104 | break; | |
105 | } | |
106 | case DONE: | |
107 | return 1; | |
108 | case FREQ: | |
109 | freq = strtoul(argv[i], &eptr, 10); | |
110 | if (eptr != argv[i] + strlen(argv[i])) | |
111 | return 1; | |
112 | NLA_PUT_U32(freqs, i, freq); | |
113 | parse = NONE; | |
114 | break; | |
115 | case IES: | |
116 | ies = parse_hex(argv[i], &tmp); | |
117 | if (!ies) | |
118 | goto nla_put_failure; | |
119 | NLA_PUT(msg, NL80211_ATTR_IE, tmp, ies); | |
120 | free(ies); | |
121 | parse = NONE; | |
122 | break; | |
123 | case SSID: | |
124 | NLA_PUT(ssids, i, strlen(argv[i]), argv[i]); | |
125 | break; | |
126 | } | |
127 | } | |
128 | ||
129 | if (!have_ssids) | |
130 | NLA_PUT(ssids, 1, 0, ""); | |
131 | if (!passive) | |
132 | nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids); | |
133 | ||
134 | if (have_freqs) | |
135 | nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs); | |
136 | ||
137 | err = 0; | |
138 | nla_put_failure: | |
139 | nlmsg_free(ssids); | |
140 | nlmsg_free(freqs); | |
141 | return err; | |
142 | } | |
143 | ||
144 | static void tab_on_first(bool *first) | |
145 | { | |
146 | if (!*first) | |
147 | printf("\t"); | |
148 | else | |
149 | *first = false; | |
150 | } | |
151 | ||
152 | static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data) | |
153 | { | |
154 | printf(" "); | |
155 | print_ssid_escaped(len, data); | |
156 | printf("\n"); | |
157 | } | |
158 | ||
159 | static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data) | |
160 | { | |
161 | int i; | |
162 | ||
163 | printf(" "); | |
164 | ||
165 | for (i = 0; i < len; i++) { | |
166 | int r = data[i] & 0x7f; | |
167 | printf("%d.%d%s ", r/2, 5*(r&1), data[i] & 0x80 ? "*":""); | |
168 | } | |
169 | printf("\n"); | |
170 | } | |
171 | ||
172 | static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data) | |
173 | { | |
174 | printf(" channel %d\n", data[0]); | |
175 | } | |
176 | ||
177 | static const char *country_env_str(char environment) | |
178 | { | |
179 | switch (environment) { | |
180 | case 'I': | |
181 | return "Indoor only"; | |
182 | case 'O': | |
183 | return "Outdoor only"; | |
184 | case ' ': | |
185 | return "Indoor/Outdoor"; | |
186 | default: | |
187 | return "bogus"; | |
188 | } | |
189 | } | |
190 | ||
191 | static void print_country(const uint8_t type, uint8_t len, const uint8_t *data) | |
192 | { | |
193 | printf(" %.*s", 2, data); | |
194 | ||
195 | printf("\tEnvironment: %s\n", country_env_str(data[2])); | |
196 | ||
197 | data += 3; | |
198 | len -= 3; | |
199 | ||
200 | if (len < 3) { | |
201 | printf("\t\tNo country IE triplets present\n"); | |
202 | return; | |
203 | } | |
204 | ||
205 | while (len >= 3) { | |
206 | int end_channel; | |
207 | struct ieee80211_country_ie_triplet *triplet = | |
208 | (struct ieee80211_country_ie_triplet *) data; | |
209 | ||
210 | if (triplet->ext.reg_extension_id >= IEEE80211_COUNTRY_EXTENSION_ID) { | |
211 | printf("\t\tExtension ID: %d Regulatory Class: %d Coverage class: %d (up to %dm)\n", | |
212 | triplet->ext.reg_extension_id, | |
213 | triplet->ext.reg_class, | |
214 | triplet->ext.coverage_class, | |
215 | triplet->ext.coverage_class * 450); | |
216 | ||
217 | data += 3; | |
218 | len -= 3; | |
219 | continue; | |
220 | } | |
221 | ||
222 | /* 2 GHz */ | |
223 | if (triplet->chans.first_channel <= 14) | |
224 | end_channel = triplet->chans.first_channel + (triplet->chans.num_channels - 1); | |
225 | else | |
226 | end_channel = triplet->chans.first_channel + (4 * (triplet->chans.num_channels - 1)); | |
227 | ||
228 | printf("\t\tChannels [%d - %d]\n", triplet->chans.first_channel, end_channel); | |
229 | ||
230 | data += 3; | |
231 | len -= 3; | |
232 | } | |
233 | ||
234 | return; | |
235 | } | |
236 | ||
237 | static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data) | |
238 | { | |
239 | printf(" %d dB\n", data[0]); | |
240 | } | |
241 | ||
242 | static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data) | |
243 | { | |
244 | if (data[0] == 0x00) | |
245 | printf(" <no flags>"); | |
246 | if (data[0] & 0x01) | |
247 | printf(" NonERP_Present"); | |
248 | if (data[0] & 0x02) | |
249 | printf(" Use_Protection"); | |
250 | if (data[0] & 0x04) | |
251 | printf(" Barker_Preamble_Mode"); | |
252 | printf("\n"); | |
253 | } | |
254 | ||
255 | static void print_cipher(const uint8_t *data) | |
256 | { | |
257 | if (memcmp(data, wifi_oui, 3) == 0) { | |
258 | switch (data[3]) { | |
259 | case 0: | |
260 | printf("Use group cipher suite"); | |
261 | break; | |
262 | case 1: | |
263 | printf("WEP-40"); | |
264 | break; | |
265 | case 2: | |
266 | printf("TKIP"); | |
267 | break; | |
268 | case 4: | |
269 | printf("CCMP"); | |
270 | break; | |
271 | case 5: | |
272 | printf("WEP-104"); | |
273 | break; | |
274 | default: | |
275 | printf("%.02x-%.02x-%.02x:%d", | |
276 | data[0], data[1] ,data[2], data[3]); | |
277 | break; | |
278 | } | |
279 | } else if (memcmp(data, ieee80211_oui, 3) == 0) { | |
280 | switch (data[3]) { | |
281 | case 0: | |
282 | printf("Use group cipher suite"); | |
283 | break; | |
284 | case 1: | |
285 | printf("WEP-40"); | |
286 | break; | |
287 | case 2: | |
288 | printf("TKIP"); | |
289 | break; | |
290 | case 4: | |
291 | printf("CCMP"); | |
292 | break; | |
293 | case 5: | |
294 | printf("WEP-104"); | |
295 | break; | |
296 | case 6: | |
297 | printf("AES-128-CMAC"); | |
298 | break; | |
299 | default: | |
300 | printf("%.02x-%.02x-%.02x:%d", | |
301 | data[0], data[1] ,data[2], data[3]); | |
302 | break; | |
303 | } | |
304 | } else | |
305 | printf("%.02x-%.02x-%.02x:%d", | |
306 | data[0], data[1] ,data[2], data[3]); | |
307 | } | |
308 | ||
309 | static void print_auth(const uint8_t *data) | |
310 | { | |
311 | if (memcmp(data, wifi_oui, 3) == 0) { | |
312 | switch (data[3]) { | |
313 | case 1: | |
314 | printf("IEEE 802.1X"); | |
315 | break; | |
316 | case 2: | |
317 | printf("PSK"); | |
318 | break; | |
319 | default: | |
320 | printf("%.02x-%.02x-%.02x:%d", | |
321 | data[0], data[1] ,data[2], data[3]); | |
322 | break; | |
323 | } | |
324 | } else if (memcmp(data, ieee80211_oui, 3) == 0) { | |
325 | switch (data[3]) { | |
326 | case 1: | |
327 | printf("IEEE 802.1X"); | |
328 | break; | |
329 | case 2: | |
330 | printf("PSK"); | |
331 | break; | |
332 | case 3: | |
333 | printf("FT/IEEE 802.1X"); | |
334 | break; | |
335 | case 4: | |
336 | printf("FT/PSK"); | |
337 | break; | |
338 | case 5: | |
339 | printf("IEEE 802.1X/SHA-256"); | |
340 | break; | |
341 | case 6: | |
342 | printf("PSK/SHA-256"); | |
343 | break; | |
344 | default: | |
345 | printf("%.02x-%.02x-%.02x:%d", | |
346 | data[0], data[1] ,data[2], data[3]); | |
347 | break; | |
348 | } | |
349 | } else | |
350 | printf("%.02x-%.02x-%.02x:%d", | |
351 | data[0], data[1] ,data[2], data[3]); | |
352 | } | |
353 | ||
354 | static void print_rsn_ie(const char *defcipher, const char *defauth, | |
355 | uint8_t len, const uint8_t *data) | |
356 | { | |
357 | bool first = true; | |
358 | __u16 version, count, capa; | |
359 | int i; | |
360 | ||
361 | version = data[0] + (data[1] << 8); | |
362 | tab_on_first(&first); | |
363 | printf("\t * Version: %d\n", version); | |
364 | ||
365 | data += 2; | |
366 | len -= 2; | |
367 | ||
368 | if (len < 4) { | |
369 | tab_on_first(&first); | |
370 | printf("\t * Group cipher: %s\n", defcipher); | |
371 | printf("\t * Pairwise ciphers: %s\n", defcipher); | |
372 | return; | |
373 | } | |
374 | ||
375 | tab_on_first(&first); | |
376 | printf("\t * Group cipher: "); | |
377 | print_cipher(data); | |
378 | printf("\n"); | |
379 | ||
380 | data += 4; | |
381 | len -= 4; | |
382 | ||
383 | if (len < 2) { | |
384 | tab_on_first(&first); | |
385 | printf("\t * Pairwise ciphers: %s\n", defcipher); | |
386 | return; | |
387 | } | |
388 | ||
389 | count = data[0] | (data[1] << 8); | |
390 | if (2 + (count * 4) > len) | |
391 | goto invalid; | |
392 | ||
393 | tab_on_first(&first); | |
394 | printf("\t * Pairwise ciphers:"); | |
395 | for (i = 0; i < count; i++) { | |
396 | printf(" "); | |
397 | print_cipher(data + 2 + (i * 4)); | |
398 | } | |
399 | printf("\n"); | |
400 | ||
401 | data += 2 + (count * 4); | |
402 | len -= 2 + (count * 4); | |
403 | ||
404 | if (len < 2) { | |
405 | tab_on_first(&first); | |
406 | printf("\t * Authentication suites: %s\n", defauth); | |
407 | return; | |
408 | } | |
409 | ||
410 | count = data[0] | (data[1] << 8); | |
411 | if (2 + (count * 4) > len) | |
412 | goto invalid; | |
413 | ||
414 | tab_on_first(&first); | |
415 | printf("\t * Authentication suites:"); | |
416 | for (i = 0; i < count; i++) { | |
417 | printf(" "); | |
418 | print_auth(data + 2 + (i * 4)); | |
419 | } | |
420 | printf("\n"); | |
421 | ||
422 | data += 2 + (count * 4); | |
423 | len -= 2 + (count * 4); | |
424 | ||
425 | if (len >= 2) { | |
426 | capa = data[0] | (data[1] << 8); | |
427 | tab_on_first(&first); | |
428 | printf("\t * Capabilities:"); | |
429 | if (capa & 0x0001) | |
430 | printf(" PreAuth"); | |
431 | if (capa & 0x0002) | |
432 | printf(" NoPairwise"); | |
433 | switch ((capa & 0x000c) >> 2) { | |
434 | case 0: | |
435 | break; | |
436 | case 1: | |
437 | printf(" 2-PTKSA-RC"); | |
438 | break; | |
439 | case 2: | |
440 | printf(" 4-PTKSA-RC"); | |
441 | break; | |
442 | case 3: | |
443 | printf(" 16-PTKSA-RC"); | |
444 | break; | |
445 | } | |
446 | switch ((capa & 0x0030) >> 4) { | |
447 | case 0: | |
448 | break; | |
449 | case 1: | |
450 | printf(" 2-GTKSA-RC"); | |
451 | break; | |
452 | case 2: | |
453 | printf(" 4-GTKSA-RC"); | |
454 | break; | |
455 | case 3: | |
456 | printf(" 16-GTKSA-RC"); | |
457 | break; | |
458 | } | |
459 | if (capa & 0x0040) | |
460 | printf(" MFP-required"); | |
461 | if (capa & 0x0080) | |
462 | printf(" MFP-capable"); | |
463 | if (capa & 0x0200) | |
464 | printf(" Peerkey-enabled"); | |
465 | if (capa & 0x0400) | |
466 | printf(" SPP-AMSDU-capable"); | |
467 | if (capa & 0x0800) | |
468 | printf(" SPP-AMSDU-required"); | |
469 | printf(" (0x%.4x)\n", capa); | |
470 | data += 2; | |
471 | len -= 2; | |
472 | } | |
473 | ||
474 | invalid: | |
475 | if (len != 0) { | |
476 | printf("\t\t * bogus tail data (%d):", len); | |
477 | while (len) { | |
478 | printf(" %.2x", *data); | |
479 | data++; | |
480 | len--; | |
481 | } | |
482 | printf("\n"); | |
483 | } | |
484 | } | |
485 | ||
486 | static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data) | |
487 | { | |
488 | print_rsn_ie("CCMP", "IEEE 802.1X", len, data); | |
489 | } | |
490 | ||
491 | static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data) | |
492 | { | |
493 | printf("\n"); | |
494 | print_ht_capability(data[0] | (data[1] << 8)); | |
495 | print_ampdu_length(data[2] & 3); | |
496 | print_ampdu_spacing((data[2] >> 2) & 7); | |
497 | print_ht_mcs(data + 3); | |
498 | } | |
499 | ||
500 | static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data) | |
501 | { | |
502 | int i, base, bit; | |
503 | bool first = true; | |
504 | ||
505 | ||
506 | for (i = 0; i < len; i++) { | |
507 | base = i * 8; | |
508 | ||
509 | for (bit = 0; bit < 8; bit++) { | |
510 | if (!(data[i] & (1 << bit))) | |
511 | continue; | |
512 | ||
513 | if (!first) | |
514 | printf(","); | |
515 | else | |
516 | first = false; | |
517 | ||
518 | switch (bit + base) { | |
519 | case 0: | |
520 | printf(" HT Information Exchange Supported"); | |
521 | break; | |
522 | case 1: | |
523 | printf(" On-demand Beacon"); | |
524 | break; | |
525 | case 2: | |
526 | printf(" Extended Channel Switching"); | |
527 | break; | |
528 | case 3: | |
529 | printf(" Wave Indication"); | |
530 | break; | |
531 | case 4: | |
532 | printf(" PSMP Capability"); | |
533 | break; | |
534 | case 5: | |
535 | printf(" Service Interval Granularity"); | |
536 | break; | |
537 | case 6: | |
538 | printf(" S-PSMP Capability"); | |
539 | break; | |
540 | default: | |
541 | printf(" %d", bit); | |
542 | break; | |
543 | } | |
544 | } | |
545 | } | |
546 | ||
547 | printf("\n"); | |
548 | } | |
549 | ||
550 | static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data) | |
551 | { | |
552 | printf(" DTIM Count %u DTIM Period %u Bitmap Control 0x%x " | |
553 | "Bitmap[0] 0x%x", | |
554 | data[0], data[1], data[2], data[3]); | |
555 | if (len - 4) | |
556 | printf(" (+ %u octet%s)", len - 4, len - 4 == 1 ? "" : "s"); | |
557 | printf("\n"); | |
558 | } | |
559 | ||
560 | struct ie_print { | |
561 | const char *name; | |
562 | void (*print)(const uint8_t type, uint8_t len, const uint8_t *data); | |
563 | uint8_t minlen, maxlen; | |
564 | uint8_t flags; | |
565 | }; | |
566 | ||
567 | static void print_ie(const struct ie_print *p, const uint8_t type, | |
568 | uint8_t len, const uint8_t *data) | |
569 | { | |
570 | int i; | |
571 | ||
572 | if (!p->print) | |
573 | return; | |
574 | ||
575 | printf("\t%s:", p->name); | |
576 | if (len < p->minlen || len > p->maxlen) { | |
577 | if (len > 1) { | |
578 | printf(" <invalid: %d bytes:", len); | |
579 | for (i = 0; i < len; i++) | |
580 | printf(" %.02x", data[i]); | |
581 | printf(">\n"); | |
582 | } else if (len) | |
583 | printf(" <invalid: 1 byte: %.02x>\n", data[0]); | |
584 | else | |
585 | printf(" <invalid: no data>\n"); | |
586 | return; | |
587 | } | |
588 | ||
589 | p->print(type, len, data); | |
590 | } | |
591 | ||
592 | #define PRINT_IGN { \ | |
593 | .name = "IGNORE", \ | |
594 | .print = NULL, \ | |
595 | .minlen = 0, \ | |
596 | .maxlen = 255, \ | |
597 | } | |
598 | ||
599 | static const struct ie_print ieprinters[] = { | |
600 | [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), }, | |
601 | [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), }, | |
602 | [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), }, | |
603 | [5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), }, | |
604 | [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), }, | |
605 | [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), }, | |
606 | [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), }, | |
607 | [45] = { "HT capabilities", print_ht_capa, 26, 26, BIT(PRINT_SCAN), }, | |
608 | [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), }, | |
609 | [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), }, | |
610 | [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), }, | |
611 | }; | |
612 | ||
613 | static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data) | |
614 | { | |
615 | print_rsn_ie("TKIP", "IEEE 802.1X", len, data); | |
616 | } | |
617 | ||
618 | static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len) | |
619 | { | |
620 | int i; | |
621 | static const char *aci_tbl[] = { "BE", "BK", "VI", "VO" }; | |
622 | ||
623 | if (len < 19) | |
624 | goto invalid; | |
625 | ||
626 | if (data[0] != 1) { | |
627 | printf("Parameter: not version 1: "); | |
628 | return false; | |
629 | } | |
630 | ||
631 | printf("\t * Parameter version 1"); | |
632 | ||
633 | data++; | |
634 | ||
635 | if (data[0] & 0x80) | |
636 | printf("\n\t\t * u-APSD"); | |
637 | ||
638 | data += 2; | |
639 | ||
640 | for (i = 0; i < 4; i++) { | |
641 | printf("\n\t\t * %s:", aci_tbl[(data[0] >> 5) & 3]); | |
642 | if (data[4] & 0x10) | |
643 | printf(" acm"); | |
644 | printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1, | |
645 | (1 << (data[1] >> 4)) - 1); | |
646 | printf(", AIFSN %d", data[0] & 0xf); | |
647 | if (data[2] | data[3]) | |
648 | printf(", TXOP %d usec", (data[2] + (data[3] << 8)) * 32); | |
649 | data += 4; | |
650 | } | |
651 | ||
652 | printf("\n"); | |
653 | return true; | |
654 | ||
655 | invalid: | |
656 | printf("invalid: "); | |
657 | return false; | |
658 | } | |
659 | ||
660 | static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data) | |
661 | { | |
662 | int i; | |
663 | ||
664 | switch (data[0]) { | |
665 | case 0x00: | |
666 | printf(" information:"); | |
667 | break; | |
668 | case 0x01: | |
669 | if (print_wifi_wmm_param(data + 1, len - 1)) | |
670 | return; | |
671 | break; | |
672 | default: | |
673 | printf(" type %d:", data[0]); | |
674 | break; | |
675 | } | |
676 | ||
677 | for(i = 1; i < len; i++) | |
678 | printf(" %.02x", data[i]); | |
679 | printf("\n"); | |
680 | } | |
681 | ||
682 | static const char * wifi_wps_dev_passwd_id(uint16_t id) | |
683 | { | |
684 | switch (id) { | |
685 | case 0: | |
686 | return "Default (PIN)"; | |
687 | case 1: | |
688 | return "User-specified"; | |
689 | case 2: | |
690 | return "Machine-specified"; | |
691 | case 3: | |
692 | return "Rekey"; | |
693 | case 4: | |
694 | return "PushButton"; | |
695 | case 5: | |
696 | return "Registrar-specified"; | |
697 | default: | |
698 | return "??"; | |
699 | } | |
700 | } | |
701 | ||
702 | static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data) | |
703 | { | |
704 | bool first = true; | |
705 | __u16 subtype, sublen; | |
706 | ||
707 | while (len >= 4) { | |
708 | subtype = (data[0] << 8) + data[1]; | |
709 | sublen = (data[2] << 8) + data[3]; | |
710 | if (sublen > len) | |
711 | break; | |
712 | ||
713 | switch (subtype) { | |
714 | case 0x104a: | |
715 | tab_on_first(&first); | |
716 | printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF); | |
717 | break; | |
718 | case 0x1011: | |
719 | tab_on_first(&first); | |
720 | printf("\t * Device name: %.*s\n", sublen, data + 4); | |
721 | break; | |
722 | case 0x1012: { | |
723 | uint16_t id; | |
724 | tab_on_first(&first); | |
725 | if (sublen != 2) { | |
726 | printf("\t * Device Password ID: (invalid " | |
727 | "length %d)\n", sublen); | |
728 | break; | |
729 | } | |
730 | id = data[4] << 8 | data[5]; | |
731 | printf("\t * Device Password ID: %u (%s)\n", | |
732 | id, wifi_wps_dev_passwd_id(id)); | |
733 | break; | |
734 | } | |
735 | case 0x1021: | |
736 | tab_on_first(&first); | |
737 | printf("\t * Manufacturer: %.*s\n", sublen, data + 4); | |
738 | break; | |
739 | case 0x1023: | |
740 | tab_on_first(&first); | |
741 | printf("\t * Model: %.*s\n", sublen, data + 4); | |
742 | break; | |
743 | case 0x1024: | |
744 | tab_on_first(&first); | |
745 | printf("\t * Model Number: %.*s\n", sublen, data + 4); | |
746 | break; | |
747 | case 0x103b: { | |
748 | __u8 val = data[4]; | |
749 | tab_on_first(&first); | |
750 | printf("\t * Response Type: %d%s\n", | |
751 | val, val == 3 ? " (AP)" : ""); | |
752 | break; | |
753 | } | |
754 | case 0x103c: { | |
755 | __u8 val = data[4]; | |
756 | tab_on_first(&first); | |
757 | printf("\t * RF Bands: 0x%x\n", val); | |
758 | break; | |
759 | } | |
760 | case 0x1041: { | |
761 | __u8 val = data[4]; | |
762 | tab_on_first(&first); | |
763 | printf("\t * Selected Registrar: 0x%x\n", val); | |
764 | break; | |
765 | } | |
766 | case 0x1042: | |
767 | tab_on_first(&first); | |
768 | printf("\t * Serial Number: %.*s\n", sublen, data + 4); | |
769 | break; | |
770 | case 0x1044: { | |
771 | __u8 val = data[4]; | |
772 | tab_on_first(&first); | |
773 | printf("\t * Wi-Fi Protected Setup State: %d%s%s\n", | |
774 | val, | |
775 | val == 1 ? " (Unconfigured)" : "", | |
776 | val == 2 ? " (Configured)" : ""); | |
777 | break; | |
778 | } | |
779 | case 0x1054: { | |
780 | tab_on_first(&first); | |
781 | if (sublen != 8) { | |
782 | printf("\t * Primary Device Type: (invalid " | |
783 | "length %d)\n", sublen); | |
784 | break; | |
785 | } | |
786 | printf("\t * Primary Device Type: " | |
787 | "%u-%02x%02x%02x%02x-%u\n", | |
788 | data[4] << 8 | data[5], | |
789 | data[6], data[7], data[8], data[9], | |
790 | data[10] << 8 | data[11]); | |
791 | break; | |
792 | } | |
793 | case 0x1057: { | |
794 | __u8 val = data[4]; | |
795 | tab_on_first(&first); | |
796 | printf("\t * AP setup locked: 0x%.2x\n", val); | |
797 | break; | |
798 | } | |
799 | case 0x1008: | |
800 | case 0x1053: { | |
801 | __u16 meth = (data[4] << 8) + data[5]; | |
802 | bool comma = false; | |
803 | tab_on_first(&first); | |
804 | printf("\t * %sConfig methods:", | |
805 | subtype == 0x1053 ? "Selected Registrar ": ""); | |
806 | #define T(bit, name) do { \ | |
807 | if (meth & (1<<bit)) { \ | |
808 | if (comma) \ | |
809 | printf(","); \ | |
810 | comma = true; \ | |
811 | printf(" " name); \ | |
812 | } } while (0) | |
813 | T(0, "USB"); | |
814 | T(1, "Ethernet"); | |
815 | T(2, "Label"); | |
816 | T(3, "Display"); | |
817 | T(4, "Ext. NFC"); | |
818 | T(5, "Int. NFC"); | |
819 | T(6, "NFC Intf."); | |
820 | T(7, "PBC"); | |
821 | T(8, "Keypad"); | |
822 | printf("\n"); | |
823 | break; | |
824 | #undef T | |
825 | } | |
826 | default: { | |
827 | const __u8 *subdata = data + 4; | |
828 | __u16 tmplen = sublen; | |
829 | ||
830 | tab_on_first(&first); | |
831 | printf("\t * Unknown TLV (%#.4x, %d bytes):", | |
832 | subtype, tmplen); | |
833 | while (tmplen) { | |
834 | printf(" %.2x", *subdata); | |
835 | subdata++; | |
836 | tmplen--; | |
837 | } | |
838 | printf("\n"); | |
839 | break; | |
840 | } | |
841 | } | |
842 | ||
843 | data += sublen + 4; | |
844 | len -= sublen + 4; | |
845 | } | |
846 | ||
847 | if (len != 0) { | |
848 | printf("\t\t * bogus tail data (%d):", len); | |
849 | while (len) { | |
850 | printf(" %.2x", *data); | |
851 | data++; | |
852 | len--; | |
853 | } | |
854 | printf("\n"); | |
855 | } | |
856 | } | |
857 | ||
858 | static const struct ie_print wifiprinters[] = { | |
859 | [1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), }, | |
860 | [2] = { "WMM", print_wifi_wmm, 1, 255, BIT(PRINT_SCAN), }, | |
861 | [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), }, | |
862 | }; | |
863 | ||
864 | static void print_vendor(unsigned char len, unsigned char *data, | |
865 | bool unknown, enum print_ie_type ptype) | |
866 | { | |
867 | int i; | |
868 | ||
869 | if (len < 3) { | |
870 | printf("\tVendor specific: <too short> data:"); | |
871 | for(i = 0; i < len; i++) | |
872 | printf(" %.02x", data[i]); | |
873 | printf("\n"); | |
874 | return; | |
875 | } | |
876 | ||
877 | if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) { | |
878 | if (data[3] < ARRAY_SIZE(wifiprinters) && | |
879 | wifiprinters[data[3]].name && | |
880 | wifiprinters[data[3]].flags & BIT(ptype)) { | |
881 | print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4); | |
882 | return; | |
883 | } | |
884 | if (!unknown) | |
885 | return; | |
886 | printf("\tWiFi OUI %#.2x, data:", data[3]); | |
887 | for(i = 0; i < len - 4; i++) | |
888 | printf(" %.02x", data[i + 4]); | |
889 | printf("\n"); | |
890 | return; | |
891 | } | |
892 | ||
893 | if (!unknown) | |
894 | return; | |
895 | ||
896 | printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:", | |
897 | data[0], data[1], data[2]); | |
898 | for (i = 3; i < len; i++) | |
899 | printf(" %.2x", data[i]); | |
900 | printf("\n"); | |
901 | } | |
902 | ||
903 | void print_ies(unsigned char *ie, int ielen, bool unknown, | |
904 | enum print_ie_type ptype) | |
905 | { | |
906 | while (ielen >= 2 && ielen >= ie[1]) { | |
907 | if (ie[0] < ARRAY_SIZE(ieprinters) && | |
908 | ieprinters[ie[0]].name && | |
909 | ieprinters[ie[0]].flags & BIT(ptype)) { | |
910 | print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2); | |
911 | } else if (ie[0] == 221 /* vendor */) { | |
912 | print_vendor(ie[1], ie + 2, unknown, ptype); | |
913 | } else if (unknown) { | |
914 | int i; | |
915 | ||
916 | printf("\tUnknown IE (%d):", ie[0]); | |
917 | for (i=0; i<ie[1]; i++) | |
918 | printf(" %.2x", ie[2+i]); | |
919 | printf("\n"); | |
920 | } | |
921 | ielen -= ie[1] + 2; | |
922 | ie += ie[1] + 2; | |
923 | } | |
924 | } | |
925 | ||
926 | static int print_bss_handler(struct nl_msg *msg, void *arg) | |
927 | { | |
928 | struct nlattr *tb[NL80211_ATTR_MAX + 1]; | |
929 | struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); | |
930 | struct nlattr *bss[NL80211_BSS_MAX + 1]; | |
931 | char mac_addr[20], dev[20]; | |
932 | static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = { | |
933 | [NL80211_BSS_TSF] = { .type = NLA_U64 }, | |
934 | [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 }, | |
935 | [NL80211_BSS_BSSID] = { }, | |
936 | [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 }, | |
937 | [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 }, | |
938 | [NL80211_BSS_INFORMATION_ELEMENTS] = { }, | |
939 | [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 }, | |
940 | [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 }, | |
941 | [NL80211_BSS_STATUS] = { .type = NLA_U32 }, | |
942 | [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 }, | |
943 | [NL80211_BSS_BEACON_IES] = { }, | |
944 | }; | |
945 | struct scan_params *params = arg; | |
946 | int show = params->show_both_ie_sets ? 2 : 1; | |
947 | ||
948 | nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), | |
949 | genlmsg_attrlen(gnlh, 0), NULL); | |
950 | ||
951 | if (!tb[NL80211_ATTR_BSS]) { | |
952 | fprintf(stderr, "bss info missing!\n"); | |
953 | return NL_SKIP; | |
954 | } | |
955 | if (nla_parse_nested(bss, NL80211_BSS_MAX, | |
956 | tb[NL80211_ATTR_BSS], | |
957 | bss_policy)) { | |
958 | fprintf(stderr, "failed to parse nested attributes!\n"); | |
959 | return NL_SKIP; | |
960 | } | |
961 | ||
962 | if (!bss[NL80211_BSS_BSSID]) | |
963 | return NL_SKIP; | |
964 | ||
965 | mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID])); | |
966 | if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev); | |
967 | printf("BSS %s (on %s)", mac_addr, dev); | |
968 | ||
969 | if (bss[NL80211_BSS_STATUS]) { | |
970 | switch (nla_get_u32(bss[NL80211_BSS_STATUS])) { | |
971 | case NL80211_BSS_STATUS_AUTHENTICATED: | |
972 | printf(" -- authenticated"); | |
973 | break; | |
974 | case NL80211_BSS_STATUS_ASSOCIATED: | |
975 | printf(" -- associated"); | |
976 | break; | |
977 | case NL80211_BSS_STATUS_IBSS_JOINED: | |
978 | printf(" -- joined"); | |
979 | break; | |
980 | default: | |
981 | printf(" -- unknown status: %d", | |
982 | nla_get_u32(bss[NL80211_BSS_STATUS])); | |
983 | break; | |
984 | } | |
985 | } | |
986 | printf("\n"); | |
987 | ||
988 | if (bss[NL80211_BSS_TSF]) { | |
989 | unsigned long long tsf; | |
990 | tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]); | |
991 | printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n", | |
992 | tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24, | |
993 | (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60); | |
994 | } | |
995 | if (bss[NL80211_BSS_FREQUENCY]) | |
996 | printf("\tfreq: %d\n", | |
997 | nla_get_u32(bss[NL80211_BSS_FREQUENCY])); | |
998 | if (bss[NL80211_BSS_BEACON_INTERVAL]) | |
999 | printf("\tbeacon interval: %d\n", | |
1000 | nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL])); | |
1001 | if (bss[NL80211_BSS_CAPABILITY]) { | |
1002 | __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]); | |
1003 | printf("\tcapability:"); | |
1004 | if (capa & WLAN_CAPABILITY_ESS) | |
1005 | printf(" ESS"); | |
1006 | if (capa & WLAN_CAPABILITY_IBSS) | |
1007 | printf(" IBSS"); | |
1008 | if (capa & WLAN_CAPABILITY_PRIVACY) | |
1009 | printf(" Privacy"); | |
1010 | if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE) | |
1011 | printf(" ShortPreamble"); | |
1012 | if (capa & WLAN_CAPABILITY_PBCC) | |
1013 | printf(" PBCC"); | |
1014 | if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY) | |
1015 | printf(" ChannelAgility"); | |
1016 | if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT) | |
1017 | printf(" SpectrumMgmt"); | |
1018 | if (capa & WLAN_CAPABILITY_QOS) | |
1019 | printf(" QoS"); | |
1020 | if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME) | |
1021 | printf(" ShortSlotTime"); | |
1022 | if (capa & WLAN_CAPABILITY_APSD) | |
1023 | printf(" APSD"); | |
1024 | if (capa & WLAN_CAPABILITY_DSSS_OFDM) | |
1025 | printf(" DSSS-OFDM"); | |
1026 | printf(" (0x%.4x)\n", capa); | |
1027 | } | |
1028 | if (bss[NL80211_BSS_SIGNAL_MBM]) { | |
1029 | int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]); | |
1030 | printf("\tsignal: %d.%.2d dBm\n", s/100, s%100); | |
1031 | } | |
1032 | if (bss[NL80211_BSS_SIGNAL_UNSPEC]) { | |
1033 | unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]); | |
1034 | printf("\tsignal: %d/100\n", s); | |
1035 | } | |
1036 | if (bss[NL80211_BSS_SEEN_MS_AGO]) { | |
1037 | int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]); | |
1038 | printf("\tlast seen: %d ms ago\n", age); | |
1039 | } | |
1040 | ||
1041 | if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) { | |
1042 | if (bss[NL80211_BSS_BEACON_IES]) | |
1043 | printf("\tInformation elements from Probe Response " | |
1044 | "frame:\n"); | |
1045 | print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]), | |
1046 | nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]), | |
1047 | params->unknown, params->type); | |
1048 | } | |
1049 | if (bss[NL80211_BSS_BEACON_IES] && show--) { | |
1050 | printf("\tInformation elements from Beacon frame:\n"); | |
1051 | print_ies(nla_data(bss[NL80211_BSS_BEACON_IES]), | |
1052 | nla_len(bss[NL80211_BSS_BEACON_IES]), | |
1053 | params->unknown, params->type); | |
1054 | } | |
1055 | ||
1056 | return NL_SKIP; | |
1057 | } | |
1058 | ||
1059 | static struct scan_params scan_params; | |
1060 | ||
1061 | static int handle_scan_dump(struct nl80211_state *state, | |
1062 | struct nl_cb *cb, | |
1063 | struct nl_msg *msg, | |
1064 | int argc, char **argv) | |
1065 | { | |
1066 | if (argc > 1) | |
1067 | return 1; | |
1068 | ||
1069 | memset(&scan_params, 0, sizeof(scan_params)); | |
1070 | ||
1071 | if (argc == 1 && !strcmp(argv[0], "-u")) | |
1072 | scan_params.unknown = true; | |
1073 | else if (argc == 1 && !strcmp(argv[0], "-b")) | |
1074 | scan_params.show_both_ie_sets = true; | |
1075 | ||
1076 | scan_params.type = PRINT_SCAN; | |
1077 | ||
1078 | nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler, | |
1079 | &scan_params); | |
1080 | return 0; | |
1081 | } | |
1082 | ||
1083 | static int handle_scan_combined(struct nl80211_state *state, | |
1084 | struct nl_cb *cb, | |
1085 | struct nl_msg *msg, | |
1086 | int argc, char **argv) | |
1087 | { | |
1088 | char **trig_argv; | |
1089 | static char *dump_argv[] = { | |
1090 | NULL, | |
1091 | "scan", | |
1092 | "dump", | |
1093 | NULL, | |
1094 | }; | |
1095 | static const __u32 cmds[] = { | |
1096 | NL80211_CMD_NEW_SCAN_RESULTS, | |
1097 | NL80211_CMD_SCAN_ABORTED, | |
1098 | }; | |
1099 | int trig_argc, dump_argc, err; | |
1100 | ||
1101 | if (argc >= 3 && !strcmp(argv[2], "-u")) { | |
1102 | dump_argc = 4; | |
1103 | dump_argv[3] = "-u"; | |
1104 | } else if (argc >= 3 && !strcmp(argv[2], "-b")) { | |
1105 | dump_argc = 4; | |
1106 | dump_argv[3] = "-b"; | |
1107 | } else | |
1108 | dump_argc = 3; | |
1109 | ||
1110 | trig_argc = 3 + (argc - 2) + (3 - dump_argc); | |
1111 | trig_argv = calloc(trig_argc, sizeof(*trig_argv)); | |
1112 | if (!trig_argv) | |
1113 | return -ENOMEM; | |
1114 | trig_argv[0] = argv[0]; | |
1115 | trig_argv[1] = "scan"; | |
1116 | trig_argv[2] = "trigger"; | |
1117 | int i; | |
1118 | for (i = 0; i < argc - 2 - (dump_argc - 3); i++) | |
1119 | trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)]; | |
1120 | err = handle_cmd(state, II_NETDEV, trig_argc, trig_argv); | |
1121 | free(trig_argv); | |
1122 | if (err) | |
1123 | return err; | |
1124 | ||
1125 | /* | |
1126 | * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION | |
1127 | * | |
1128 | * This code has a bug, which requires creating a separate | |
1129 | * nl80211 socket to fix: | |
1130 | * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or | |
1131 | * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel | |
1132 | * before (!) we listen to it, because we only start listening | |
1133 | * after we send our scan request. | |
1134 | * | |
1135 | * Doing it the other way around has a race condition as well, | |
1136 | * if you first open the events socket you may get a notification | |
1137 | * for a previous scan. | |
1138 | * | |
1139 | * The only proper way to fix this would be to listen to events | |
1140 | * before sending the command, and for the kernel to send the | |
1141 | * scan request along with the event, so that you can match up | |
1142 | * whether the scan you requested was finished or aborted (this | |
1143 | * may result in processing a scan that another application | |
1144 | * requested, but that doesn't seem to be a problem). | |
1145 | * | |
1146 | * Alas, the kernel doesn't do that (yet). | |
1147 | */ | |
1148 | ||
1149 | if (listen_events(state, ARRAY_SIZE(cmds), cmds) == | |
1150 | NL80211_CMD_SCAN_ABORTED) { | |
1151 | printf("scan aborted!\n"); | |
1152 | return 0; | |
1153 | } | |
1154 | ||
1155 | dump_argv[0] = argv[0]; | |
1156 | return handle_cmd(state, II_NETDEV, dump_argc, dump_argv); | |
1157 | } | |
1158 | TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]", 0, 0, | |
1159 | CIB_NETDEV, handle_scan_combined, | |
1160 | "Scan on the given frequencies and probe for the given SSIDs\n" | |
1161 | "(or wildcard if not given) unless passive scanning is requested.\n" | |
1162 | "If -u is specified print unknown data in the scan results.\n" | |
1163 | "Specified (vendor) IEs must be well-formed."); | |
1164 | COMMAND(scan, dump, "[-u]", | |
1165 | NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump, | |
1166 | "Dump the current scan results. If -u is specified, print unknown\n" | |
1167 | "data in scan results."); | |
1168 | COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]", | |
1169 | NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan, | |
1170 | "Trigger a scan on the given frequencies with probing for the given\n" | |
1171 | "SSIDs (or wildcard if not given) unless passive scanning is requested."); |