scan.c

   1 #include <net/if.h>
   2 #include <errno.h>
   3 #include <string.h>
   4 #include <ctype.h>
   5 #include <stdbool.h>
   6
   7 #include <netlink/genl/genl.h>
   8 #include <netlink/genl/family.h>
   9 #include <netlink/genl/ctrl.h>
  10 #include <netlink/msg.h>
  11 #include <netlink/attr.h>
  12
  13 #include "nl80211.h"
  14 #include "iw.h"
  15
  16 #define WLAN_CAPABILITY_ESS             (1<<0)
  17 #define WLAN_CAPABILITY_IBSS            (1<<1)
  18 #define WLAN_CAPABILITY_CF_POLLABLE     (1<<2)
  19 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
  20 #define WLAN_CAPABILITY_PRIVACY         (1<<4)
  21 #define WLAN_CAPABILITY_SHORT_PREAMBLE  (1<<5)
  22 #define WLAN_CAPABILITY_PBCC            (1<<6)
  23 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
  24 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
  25 #define WLAN_CAPABILITY_QOS             (1<<9)
  26 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
  27 #define WLAN_CAPABILITY_APSD            (1<<11)
  28 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
  29
  30 static unsigned char wifi_oui[3]      = { 0x00, 0x50, 0xf2 };
  31 static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };
  32
  33 struct scan_params {
  34         bool unknown;
  35 };
  36
  37 static int handle_scan(struct nl80211_state *state,
  38                        struct nl_cb *cb,
  39                        struct nl_msg *msg,
  40                        int argc, char **argv)
  41 {
  42         struct nl_msg *ssids = NULL, *freqs = NULL;
  43         char *eptr;
  44         int err = -ENOBUFS;
  45         int i;
  46         enum {
  47                 NONE,
  48                 FREQ,
  49                 SSID,
  50                 DONE,
  51         } parse = NONE;
  52         int freq;
  53         bool passive = false, have_ssids = false, have_freqs = false;
  54
  55         ssids = nlmsg_alloc();
  56         if (!ssids)
  57                 return -ENOMEM;
  58
  59         freqs = nlmsg_alloc();
  60         if (!freqs) {
  61                 nlmsg_free(ssids);
  62                 return -ENOMEM;
  63         }
  64
  65         for (i = 0; i < argc; i++) {
  66                 if (parse == NONE && strcmp(argv[i], "freq") == 0) {
  67                         parse = FREQ;
  68                         have_freqs = true;
  69                         continue;
  70                 } else if (parse < SSID && strcmp(argv[i], "ssid") == 0) {
  71                         parse = SSID;
  72                         have_ssids = true;
  73                         continue;
  74                 } else if (parse < SSID && strcmp(argv[i], "passive") == 0) {
  75                         parse = DONE;
  76                         passive = true;
  77                         continue;
  78                 }
  79
  80                 switch (parse) {
  81                 case NONE:
  82                 case DONE:
  83                         return 1;
  84                 case FREQ:
  85                         freq = strtoul(argv[i], &eptr, 10);
  86                         if (eptr != argv[i] + strlen(argv[i]))
  87                                 return 1;
  88                         NLA_PUT_U32(freqs, i, freq);
  89                         break;
  90                 case SSID:
  91                         NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
  92                         break;
  93                 }
  94         }
  95
  96         if (!have_ssids)
  97                 NLA_PUT(ssids, 1, 0, "");
  98         if (!passive)
  99                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
 100
 101         if (have_freqs)
 102                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
 103
 104         err = 0;
 105  nla_put_failure:
 106         nlmsg_free(ssids);
 107         nlmsg_free(freqs);
 108         return err;
 109 }
 110 COMMAND(scan, trigger, "[freq <freq>*] [ssid <ssid>*|passive]",
 111         NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
 112          "Trigger a scan on the given frequencies with probing for the given\n"
 113          "SSIDs (or wildcard if not given) unless passive scanning is requested.");
 114
 115 static void tab_on_first(bool *first)
 116 {
 117         if (!*first)
 118                 printf("\t");
 119         else
 120                 *first = false;
 121 }
 122
 123 static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
 124 {
 125         int i;
 126
 127         printf(" ");
 128
 129         for (i = 0; i < len; i++) {
 130                 if (isprint(data[i]))
 131                         printf("%c", data[i]);
 132                 else
 133                         printf("\\x%.2x", data[i]);
 134         }
 135         printf("\n");
 136 }
 137
 138 static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 139 {
 140         int i;
 141
 142         printf(" ");
 143
 144         for (i = 0; i < len; i++) {
 145                 int r = data[i] & 0x7f;
 146                 printf("%d.%d%s ", r/2, 5*(r&1), data[i] & 0x80 ? "*":"");
 147         }
 148         printf("\n");
 149 }
 150
 151 static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
 152 {
 153         printf(" channel %d\n", data[0]);
 154 }
 155
 156 static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
 157 {
 158         int i;
 159
 160         printf(" %.*s", 2, data);
 161         switch (data[2]) {
 162         case 'I':
 163                 printf(" (indoor)");
 164                 break;
 165         case 'O':
 166                 printf(" (outdoor)");
 167                 break;
 168         case ' ':
 169                 printf(" (in/outdoor)");
 170                 break;
 171         default:
 172                 printf(" (invalid environment)");
 173                 break;
 174         }
 175         printf(", data:");
 176         for(i=0; i<len-3; i++)
 177                 printf(" %.02x", data[i + 3]);
 178         printf("\n");
 179 }
 180
 181 static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
 182 {
 183         printf(" %d dB\n", data[0]);
 184 }
 185
 186 static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 187 {
 188         if (data[0] == 0x00)
 189                 printf(" <no flags>");
 190         if (data[0] & 0x01)
 191                 printf(" NonERP_Present");
 192         if (data[0] & 0x02)
 193                 printf(" Use_Protection");
 194         if (data[0] & 0x04)
 195                 printf(" Barker_Preamble_Mode");
 196         printf("\n");
 197 }
 198
 199 static void print_cipher(const uint8_t *data)
 200 {
 201         if (memcmp(data, wifi_oui, 3) == 0) {
 202                 switch (data[3]) {
 203                 case 0:
 204                         printf("Use group cipher suite");
 205                         break;
 206                 case 1:
 207                         printf("WEP-40");
 208                         break;
 209                 case 2:
 210                         printf("TKIP");
 211                         break;
 212                 case 4:
 213                         printf("CCMP");
 214                         break;
 215                 case 5:
 216                         printf("WEP-104");
 217                         break;
 218                 default:
 219                         printf("%.02x-%.02x-%.02x:%d",
 220                                 data[0], data[1] ,data[2], data[3]);
 221                         break;
 222                 }
 223         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 224                 switch (data[3]) {
 225                 case 0:
 226                         printf("Use group cipher suite");
 227                         break;
 228                 case 1:
 229                         printf("WEP-40");
 230                         break;
 231                 case 2:
 232                         printf("TKIP");
 233                         break;
 234                 case 4:
 235                         printf("CCMP");
 236                         break;
 237                 case 5:
 238                         printf("WEP-104");
 239                         break;
 240                 case 6:
 241                         printf("AES-128-CMAC");
 242                         break;
 243                 default:
 244                         printf("%.02x-%.02x-%.02x:%d",
 245                                 data[0], data[1] ,data[2], data[3]);
 246                         break;
 247                 }
 248         } else
 249                 printf("%.02x-%.02x-%.02x:%d",
 250                         data[0], data[1] ,data[2], data[3]);
 251 }
 252
 253 static void print_auth(const uint8_t *data)
 254 {
 255         if (memcmp(data, wifi_oui, 3) == 0) {
 256                 switch (data[3]) {
 257                 case 1:
 258                         printf("IEEE 802.1X");
 259                         break;
 260                 case 2:
 261                         printf("PSK");
 262                         break;
 263                 default:
 264                         printf("%.02x-%.02x-%.02x:%d",
 265                                 data[0], data[1] ,data[2], data[3]);
 266                         break;
 267                 }
 268         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 269                 switch (data[3]) {
 270                 case 1:
 271                         printf("IEEE 802.1X");
 272                         break;
 273                 case 2:
 274                         printf("PSK");
 275                         break;
 276                 case 3:
 277                         printf("FT/IEEE 802.1X");
 278                         break;
 279                 case 4:
 280                         printf("FT/PSK");
 281                         break;
 282                 case 5:
 283                         printf("IEEE 802.1X/SHA-256");
 284                         break;
 285                 case 6:
 286                         printf("PSK/SHA-256");
 287                         break;
 288                 default:
 289                         printf("%.02x-%.02x-%.02x:%d",
 290                                 data[0], data[1] ,data[2], data[3]);
 291                         break;
 292                 }
 293         } else
 294                 printf("%.02x-%.02x-%.02x:%d",
 295                         data[0], data[1] ,data[2], data[3]);
 296 }
 297
 298 static void print_rsn_ie(const char *defcipher, const char *defauth,
 299                          uint8_t len, const uint8_t *data)
 300 {
 301         bool first = true;
 302         __u16 version, count, capa;
 303         int i;
 304
 305         version = data[0] + (data[1] << 8);
 306         tab_on_first(&first);
 307         printf("\t * Version: %d\n", version);
 308
 309         data += 2;
 310         len -= 2;
 311
 312         if (len < 4) {
 313                 tab_on_first(&first);
 314                 printf("\t * Group cipher: %s\n", defcipher);
 315                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 316                 return;
 317         }
 318
 319         tab_on_first(&first);
 320         printf("\t * Group cipher: ");
 321         print_cipher(data);
 322         printf("\n");
 323
 324         data += 4;
 325         len -= 4;
 326
 327         if (len < 2) {
 328                 tab_on_first(&first);
 329                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 330                 return;
 331         }
 332
 333         count = data[0] | (data[1] << 8);
 334         if (2 + (count * 4) > len)
 335                 goto invalid;
 336
 337         tab_on_first(&first);
 338         printf("\t * Pairwise ciphers:");
 339         for (i = 0; i < count; i++) {
 340                 printf(" ");
 341                 print_cipher(data + 2 + (i * 4));
 342         }
 343         printf("\n");
 344
 345         data += 2 + (count * 4);
 346         len -= 2 + (count * 4);
 347
 348         if (len < 2) {
 349                 tab_on_first(&first);
 350                 printf("\t * Authentication suites: %s\n", defauth);
 351                 return;
 352         }
 353
 354         count = data[0] | (data[1] << 8);
 355         if (2 + (count * 4) > len)
 356                 goto invalid;
 357
 358         tab_on_first(&first);
 359         printf("\t * Authentication suites:");
 360         for (i = 0; i < count; i++) {
 361                 printf(" ");
 362                 print_auth(data + 2 + (i * 4));
 363         }
 364         printf("\n");
 365
 366         data += 2 + (count * 4);
 367         len -= 2 + (count * 4);
 368
 369         if (len >= 2) {
 370                 capa = data[0] | (data[1] << 8);
 371                 tab_on_first(&first);
 372                 printf("\t * Capabilities:");
 373                 if (capa & 0x0001)
 374                         printf(" PreAuth");
 375                 if (capa & 0x0002)
 376                         printf(" NoPairwise");
 377                 switch ((capa & 0x000c) >> 2) {
 378                 case 0:
 379                         break;
 380                 case 1:
 381                         printf(" 2-PTKSA-RC");
 382                         break;
 383                 case 2:
 384                         printf(" 4-PTKSA-RC");
 385                         break;
 386                 case 3:
 387                         printf(" 16-PTKSA-RC");
 388                         break;
 389                 }
 390                 switch ((capa & 0x0030) >> 4) {
 391                 case 0:
 392                         break;
 393                 case 1:
 394                         printf(" 2-GTKSA-RC");
 395                         break;
 396                 case 2:
 397                         printf(" 4-GTKSA-RC");
 398                         break;
 399                 case 3:
 400                         printf(" 16-GTKSA-RC");
 401                         break;
 402                 }
 403                 if (capa & 0x0040)
 404                         printf(" MFP-required");
 405                 if (capa & 0x0080)
 406                         printf(" MFP-capable");
 407                 if (capa & 0x0200)
 408                         printf(" Peerkey-enabled");
 409                 if (capa & 0x0400)
 410                         printf(" SPP-AMSDU-capable");
 411                 if (capa & 0x0800)
 412                         printf(" SPP-AMSDU-required");
 413                 printf(" (0x%.4x)\n", capa);
 414                 data += 2;
 415                 len -= 2;
 416         }
 417
 418  invalid:
 419         if (len != 0) {
 420                 printf("\t\t * bogus tail data (%d):", len);
 421                 while (len) {
 422                         printf(" %.2x", *data);
 423                         data++;
 424                         len--;
 425                 }
 426                 printf("\n");
 427         }
 428 }
 429
 430 static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
 431 {
 432         print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 433 }
 434
 435 static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 436 {
 437         int i, base, bit;
 438         bool first = true;
 439
 440
 441         for (i = 0; i < len; i++) {
 442                 base = i * 8;
 443
 444                 for (bit = 0; bit < 8; bit++) {
 445                         if (!(data[i] & (1 << bit)))
 446                                 continue;
 447
 448                         if (!first)
 449                                 printf(",");
 450                         else
 451                                 first = false;
 452
 453                         switch (bit + base) {
 454                         case 0:
 455                                 printf(" HT Information Exchange Supported");
 456                                 break;
 457                         case 1:
 458                                 printf(" On-demand Beacon");
 459                                 break;
 460                         case 2:
 461                                 printf(" Extended Channel Switching");
 462                                 break;
 463                         case 3:
 464                                 printf(" Wave Indication");
 465                                 break;
 466                         case 4:
 467                                 printf(" PSMP Capability");
 468                                 break;
 469                         case 5:
 470                                 printf(" Service Interval Granularity");
 471                                 break;
 472                         case 6:
 473                                 printf(" S-PSMP Capability");
 474                                 break;
 475                         default:
 476                                 printf(" %d", bit);
 477                                 break;
 478                         }
 479                 }
 480         }
 481
 482         printf("\n");
 483 }
 484
 485 struct ie_print {
 486         const char *name;
 487         void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
 488         uint8_t minlen, maxlen;
 489 };
 490
 491 static void print_ie(const struct ie_print *p, const uint8_t type,
 492                      uint8_t len, const uint8_t *data)
 493 {
 494         int i;
 495
 496         if (!p->print)
 497                 return;
 498
 499         printf("\t%s:", p->name);
 500         if (len < p->minlen || len > p->maxlen) {
 501                 if (len > 1) {
 502                         printf(" <invalid: %d bytes:", len);
 503                         for (i = 0; i < len; i++)
 504                                 printf(" %.02x", data[i]);
 505                         printf(">\n");
 506                 } else if (len)
 507                         printf(" <invalid: 1 byte: %.02x>\n", data[0]);
 508                 else
 509                         printf(" <invalid: no data>\n");
 510                 return;
 511         }
 512
 513         p->print(type, len, data);
 514 }
 515
 516 #define PRINT_IGN {             \
 517         .name = "IGNORE",       \
 518         .print = NULL,          \
 519         .minlen = 0,            \
 520         .maxlen = 255,          \
 521 }
 522
 523 static const struct ie_print ieprinters[] = {
 524         [0] = { "SSID", print_ssid, 0, 32, },
 525         [1] = { "Supported rates", print_supprates, 0, 255, },
 526         [3] = { "DS Paramater set", print_ds, 1, 1, },
 527         [5] = PRINT_IGN,
 528         [7] = { "Country", print_country, 3, 255, },
 529         [32] = { "Power constraint", print_powerconstraint, 1, 1, },
 530         [42] = { "ERP", print_erp, 1, 255, },
 531         [48] = { "RSN", print_rsn, 2, 255, },
 532         [50] = { "Extended supported rates", print_supprates, 0, 255, },
 533         [127] = { "Extended capabilities", print_capabilities, 0, 255, },
 534 };
 535
 536 static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
 537 {
 538         print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
 539 }
 540
 541 static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
 542 {
 543         int i;
 544
 545         switch (data[0]) {
 546         case 0x00:
 547                 printf(" information:");
 548                 break;
 549         case 0x01:
 550                 printf(" parameter:");
 551                 break;
 552         default:
 553                 printf(" type %d:", data[0]);
 554                 break;
 555         }
 556
 557         for(i = 0; i < len - 1; i++)
 558                 printf(" %.02x", data[i + 1]);
 559         printf("\n");
 560 }
 561
 562 static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
 563 {
 564         bool first = true;
 565         __u16 subtype, sublen;
 566
 567         while (len >= 4) {
 568                 subtype = (data[0] << 8) + data[1];
 569                 sublen = (data[2] << 8) + data[3];
 570                 if (sublen > len)
 571                         break;
 572
 573                 switch (subtype) {
 574                 case 0x104a:
 575                         tab_on_first(&first);
 576                         printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
 577                         break;
 578                 case 0x1011:
 579                         tab_on_first(&first);
 580                         printf("\t * Device name: %.*s\n", sublen, data + 4);
 581                         break;
 582                 case 0x1021:
 583                         tab_on_first(&first);
 584                         printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
 585                         break;
 586                 case 0x1023:
 587                         tab_on_first(&first);
 588                         printf("\t * Model: %.*s\n", sublen, data + 4);
 589                         break;
 590                 case 0x1057: {
 591                         __u16 val = (data[4] << 8) | data[5];
 592                         tab_on_first(&first);
 593                         printf("\t * AP setup locked: 0x%.4x\n", val);
 594                         break;
 595                 }
 596                 case 0x1008: {
 597                         __u16 meth = (data[4] << 8) + data[5];
 598                         bool comma = false;
 599                         tab_on_first(&first);
 600                         printf("\t * Config methods:");
 601 #define T(bit, name) do {               \
 602         if (meth & (1<<bit)) {          \
 603                 if (comma)              \
 604                         printf(",");    \
 605                 comma = true;           \
 606                 printf(" " name);       \
 607         } } while (0)
 608                         T(0, "USB");
 609                         T(1, "Ethernet");
 610                         T(2, "Label");
 611                         T(3, "Display");
 612                         T(4, "Ext. NFC");
 613                         T(5, "Int. NFC");
 614                         T(6, "NFC Intf.");
 615                         T(7, "PBC");
 616                         T(8, "Keypad");
 617                         printf("\n");
 618                         break;
 619 #undef T
 620                 }
 621                 default:
 622                         break;
 623                 }
 624
 625                 data += sublen + 4;
 626                 len -= sublen + 4;
 627         }
 628
 629         if (len != 0) {
 630                 printf("\t\t * bogus tail data (%d):", len);
 631                 while (len) {
 632                         printf(" %.2x", *data);
 633                         data++;
 634                         len--;
 635                 }
 636                 printf("\n");
 637         }
 638 }
 639
 640 static const struct ie_print wifiprinters[] = {
 641         [1] = { "WPA", print_wifi_wpa, 2, 255, },
 642         [2] = { "WMM", print_wifi_wmm, 1, 255, },
 643         [4] = { "WPS", print_wifi_wps, 0, 255, },
 644 };
 645
 646 static void print_vendor(unsigned char len, unsigned char *data,
 647                          struct scan_params *params)
 648 {
 649         int i;
 650
 651         if (len < 3) {
 652                 printf("\tVendor specific: <too short> data:");
 653                 for(i = 0; i < len; i++)
 654                         printf(" %.02x", data[i]);
 655                 printf("\n");
 656                 return;
 657         }
 658
 659         if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) {
 660                 if (data[3] < ARRAY_SIZE(wifiprinters) && wifiprinters[data[3]].name) {
 661                         print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
 662                         return;
 663                 }
 664                 if (!params->unknown)
 665                         return;
 666                 printf("\tWiFi OUI %#.2x, data:", data[3]);
 667                 for(i = 0; i < len - 4; i++)
 668                         printf(" %.02x", data[i + 4]);
 669                 printf("\n");
 670                 return;
 671         }
 672
 673         if (!params->unknown)
 674                 return;
 675
 676         printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
 677                 data[0], data[1], data[2]);
 678         for (i = 3; i < len; i++)
 679                 printf(" %.2x", data[i]);
 680         printf("\n");
 681 }
 682
 683 static void print_ies(unsigned char *ie, int ielen, struct scan_params *params)
 684 {
 685         while (ielen >= 2 && ielen >= ie[1]) {
 686                 if (ie[0] < ARRAY_SIZE(ieprinters) && ieprinters[ie[0]].name) {
 687                         print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
 688                 } else if (ie[0] == 221 /* vendor */) {
 689                         print_vendor(ie[1], ie + 2, params);
 690                 } else if (params->unknown) {
 691                         int i;
 692
 693                         printf("\tUnknown IE (%d):", ie[0]);
 694                         for (i=0; i<ie[1]; i++)
 695                                 printf(" %.2x", ie[2+i]);
 696                         printf("\n");
 697                 }
 698                 ielen -= ie[1] + 2;
 699                 ie += ie[1] + 2;
 700         }
 701 }
 702
 703 static int print_bss_handler(struct nl_msg *msg, void *arg)
 704 {
 705         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 706         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 707         struct nlattr *bss[NL80211_BSS_MAX + 1];
 708         char mac_addr[20], dev[20];
 709         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
 710                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
 711                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
 712                 [NL80211_BSS_BSSID] = { },
 713                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
 714                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
 715                 [NL80211_BSS_INFORMATION_ELEMENTS] = { },
 716                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
 717                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
 718         };
 719
 720         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 721                   genlmsg_attrlen(gnlh, 0), NULL);
 722
 723         if (!tb[NL80211_ATTR_BSS]) {
 724                 fprintf(stderr, "bss info missing!");
 725                 return NL_SKIP;
 726         }
 727         if (nla_parse_nested(bss, NL80211_BSS_MAX,
 728                              tb[NL80211_ATTR_BSS],
 729                              bss_policy)) {
 730                 fprintf(stderr, "failed to parse nested attributes!");
 731                 return NL_SKIP;
 732         }
 733
 734         if (!bss[NL80211_BSS_BSSID])
 735                 return NL_SKIP;
 736
 737         mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
 738         if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
 739         printf("BSS %s (on %s)\n", mac_addr, dev);
 740
 741         if (bss[NL80211_BSS_TSF]) {
 742                 unsigned long long tsf;
 743                 tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
 744                 printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
 745                         tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
 746                         (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
 747         }
 748         if (bss[NL80211_BSS_FREQUENCY])
 749                 printf("\tfreq: %d\n",
 750                         nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
 751         if (bss[NL80211_BSS_BEACON_INTERVAL])
 752                 printf("\tbeacon interval: %d\n",
 753                         nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
 754         if (bss[NL80211_BSS_CAPABILITY]) {
 755                 __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
 756                 printf("\tcapability:");
 757                 if (capa & WLAN_CAPABILITY_ESS)
 758                         printf(" ESS");
 759                 if (capa & WLAN_CAPABILITY_IBSS)
 760                         printf(" IBSS");
 761                 if (capa & WLAN_CAPABILITY_PRIVACY)
 762                         printf(" Privacy");
 763                 if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
 764                         printf(" ShortPreamble");
 765                 if (capa & WLAN_CAPABILITY_PBCC)
 766                         printf(" PBCC");
 767                 if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
 768                         printf(" ChannelAgility");
 769                 if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
 770                         printf(" SpectrumMgmt");
 771                 if (capa & WLAN_CAPABILITY_QOS)
 772                         printf(" QoS");
 773                 if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
 774                         printf(" ShortSlotTime");
 775                 if (capa & WLAN_CAPABILITY_APSD)
 776                         printf(" APSD");
 777                 if (capa & WLAN_CAPABILITY_DSSS_OFDM)
 778                         printf(" DSSS-OFDM");
 779                 printf(" (0x%.4x)\n", capa);
 780         }
 781         if (bss[NL80211_BSS_SIGNAL_MBM]) {
 782                 int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
 783                 printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
 784         }
 785         if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
 786                 unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
 787                 printf("\tsignal: %d/100\n", s);
 788         }
 789         if (bss[NL80211_BSS_INFORMATION_ELEMENTS])
 790                 print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
 791                           nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
 792                           arg);
 793
 794         return NL_SKIP;
 795 }
 796
 797 static struct scan_params scan_params;
 798
 799 static int handle_scan_dump(struct nl80211_state *state,
 800                             struct nl_cb *cb,
 801                             struct nl_msg *msg,
 802                             int argc, char **argv)
 803 {
 804         if (argc > 1)
 805                 return 1;
 806
 807         scan_params.unknown = false;
 808         if (argc == 1 && !strcmp(argv[0], "-u"))
 809                 scan_params.unknown = true;
 810
 811         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
 812                   &scan_params);
 813         return 0;
 814 }
 815 COMMAND(scan, dump, "[-u]",
 816         NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
 817         "Dump the current scan results. If -u is specified, print unknown\n"
 818         "data in scan results.");
 819
 820 static int handle_scan_combined(struct nl80211_state *state,
 821                                 struct nl_cb *cb,
 822                                 struct nl_msg *msg,
 823                                 int argc, char **argv)
 824 {
 825         char **trig_argv;
 826         static char *dump_argv[] = {
 827                 NULL,
 828                 "scan",
 829                 "dump",
 830                 NULL,
 831         };
 832         static const __u32 cmds[] = {
 833                 NL80211_CMD_NEW_SCAN_RESULTS,
 834                 NL80211_CMD_SCAN_ABORTED,
 835         };
 836         int trig_argc, dump_argc, err;
 837
 838         if (argc >= 3 && !strcmp(argv[2], "-u")) {
 839                 dump_argc = 4;
 840                 dump_argv[3] = "-u";
 841         } else
 842                 dump_argc = 3;
 843
 844         trig_argc = 3 + (argc - 2) + (3 - dump_argc);
 845         trig_argv = calloc(trig_argc, sizeof(*trig_argv));
 846         if (!trig_argv)
 847                 return -ENOMEM;
 848         trig_argv[0] = argv[0];
 849         trig_argv[1] = "scan";
 850         trig_argv[2] = "trigger";
 851         int i;
 852         for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
 853                 trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
 854         err = handle_cmd(state, II_NETDEV, trig_argc, trig_argv);
 855         free(trig_argv);
 856         if (err)
 857                 return err;
 858
 859         /*
 860          * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
 861          *
 862          * This code has a bug, which requires creating a separate
 863          * nl80211 socket to fix:
 864          * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
 865          * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
 866          * before (!) we listen to it, because we only start listening
 867          * after we send our scan request.
 868          *
 869          * Doing it the other way around has a race condition as well,
 870          * if you first open the events socket you may get a notification
 871          * for a previous scan.
 872          *
 873          * The only proper way to fix this would be to listen to events
 874          * before sending the command, and for the kernel to send the
 875          * scan request along with the event, so that you can match up
 876          * whether the scan you requested was finished or aborted (this
 877          * may result in processing a scan that another application
 878          * requested, but that doesn't seem to be a problem).
 879          *
 880          * Alas, the kernel doesn't do that (yet).
 881          */
 882
 883         if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
 884                                         NL80211_CMD_SCAN_ABORTED) {
 885                 printf("scan aborted!\n");
 886                 return 0;
 887         }
 888
 889         dump_argv[0] = argv[0];
 890         return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
 891 }
 892 TOPLEVEL(scan, "[-u] [freq <freq>*] [ssid <ssid>*|passive]", 0, 0,
 893          CIB_NETDEV, handle_scan_combined,
 894          "Scan on the given frequencies and probe for the given SSIDs\n"
 895          "(or wildcard if not given) unless passive scanning is requested.\n"
 896          "If -u is specified print unknown data in the scan results.");