scan.c

   1 #include <net/if.h>
   2 #include <errno.h>
   3 #include <string.h>
   4 #include <ctype.h>
   5 #include <stdbool.h>
   6
   7 #include <netlink/genl/genl.h>
   8 #include <netlink/genl/family.h>
   9 #include <netlink/genl/ctrl.h>
  10 #include <netlink/msg.h>
  11 #include <netlink/attr.h>
  12
  13 #include "nl80211.h"
  14 #include "iw.h"
  15
  16 #define WLAN_CAPABILITY_ESS             (1<<0)
  17 #define WLAN_CAPABILITY_IBSS            (1<<1)
  18 #define WLAN_CAPABILITY_CF_POLLABLE     (1<<2)
  19 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
  20 #define WLAN_CAPABILITY_PRIVACY         (1<<4)
  21 #define WLAN_CAPABILITY_SHORT_PREAMBLE  (1<<5)
  22 #define WLAN_CAPABILITY_PBCC            (1<<6)
  23 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
  24 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
  25 #define WLAN_CAPABILITY_QOS             (1<<9)
  26 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
  27 #define WLAN_CAPABILITY_APSD            (1<<11)
  28 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
  29
  30 static unsigned char wifi_oui[3]      = { 0x00, 0x50, 0xf2 };
  31 static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };
  32
  33 struct scan_params {
  34         bool unknown;
  35         enum print_ie_type type;
  36 };
  37
  38 static int handle_scan(struct nl80211_state *state,
  39                        struct nl_cb *cb,
  40                        struct nl_msg *msg,
  41                        int argc, char **argv)
  42 {
  43         struct nl_msg *ssids = NULL, *freqs = NULL;
  44         char *eptr;
  45         int err = -ENOBUFS;
  46         int i;
  47         enum {
  48                 NONE,
  49                 FREQ,
  50                 SSID,
  51                 DONE,
  52         } parse = NONE;
  53         int freq;
  54         bool passive = false, have_ssids = false, have_freqs = false;
  55
  56         ssids = nlmsg_alloc();
  57         if (!ssids)
  58                 return -ENOMEM;
  59
  60         freqs = nlmsg_alloc();
  61         if (!freqs) {
  62                 nlmsg_free(ssids);
  63                 return -ENOMEM;
  64         }
  65
  66         for (i = 0; i < argc; i++) {
  67                 if (parse == NONE && strcmp(argv[i], "freq") == 0) {
  68                         parse = FREQ;
  69                         have_freqs = true;
  70                         continue;
  71                 } else if (parse < SSID && strcmp(argv[i], "ssid") == 0) {
  72                         parse = SSID;
  73                         have_ssids = true;
  74                         continue;
  75                 } else if (parse < SSID && strcmp(argv[i], "passive") == 0) {
  76                         parse = DONE;
  77                         passive = true;
  78                         continue;
  79                 }
  80
  81                 switch (parse) {
  82                 case NONE:
  83                 case DONE:
  84                         return 1;
  85                 case FREQ:
  86                         freq = strtoul(argv[i], &eptr, 10);
  87                         if (eptr != argv[i] + strlen(argv[i]))
  88                                 return 1;
  89                         NLA_PUT_U32(freqs, i, freq);
  90                         break;
  91                 case SSID:
  92                         NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
  93                         break;
  94                 }
  95         }
  96
  97         if (!have_ssids)
  98                 NLA_PUT(ssids, 1, 0, "");
  99         if (!passive)
 100                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
 101
 102         if (have_freqs)
 103                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
 104
 105         err = 0;
 106  nla_put_failure:
 107         nlmsg_free(ssids);
 108         nlmsg_free(freqs);
 109         return err;
 110 }
 111 COMMAND(scan, trigger, "[freq <freq>*] [ssid <ssid>*|passive]",
 112         NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
 113          "Trigger a scan on the given frequencies with probing for the given\n"
 114          "SSIDs (or wildcard if not given) unless passive scanning is requested.");
 115
 116 static void tab_on_first(bool *first)
 117 {
 118         if (!*first)
 119                 printf("\t");
 120         else
 121                 *first = false;
 122 }
 123
 124 static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
 125 {
 126         printf(" ");
 127         print_ssid_escaped(len, data);
 128         printf("\n");
 129 }
 130
 131 static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 132 {
 133         int i;
 134
 135         printf(" ");
 136
 137         for (i = 0; i < len; i++) {
 138                 int r = data[i] & 0x7f;
 139                 printf("%d.%d%s ", r/2, 5*(r&1), data[i] & 0x80 ? "*":"");
 140         }
 141         printf("\n");
 142 }
 143
 144 static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
 145 {
 146         printf(" channel %d\n", data[0]);
 147 }
 148
 149 static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
 150 {
 151         int i;
 152
 153         printf(" %.*s", 2, data);
 154         switch (data[2]) {
 155         case 'I':
 156                 printf(" (indoor)");
 157                 break;
 158         case 'O':
 159                 printf(" (outdoor)");
 160                 break;
 161         case ' ':
 162                 printf(" (in/outdoor)");
 163                 break;
 164         default:
 165                 printf(" (invalid environment)");
 166                 break;
 167         }
 168         printf(", data:");
 169         for(i=0; i<len-3; i++)
 170                 printf(" %.02x", data[i + 3]);
 171         printf("\n");
 172 }
 173
 174 static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
 175 {
 176         printf(" %d dB\n", data[0]);
 177 }
 178
 179 static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 180 {
 181         if (data[0] == 0x00)
 182                 printf(" <no flags>");
 183         if (data[0] & 0x01)
 184                 printf(" NonERP_Present");
 185         if (data[0] & 0x02)
 186                 printf(" Use_Protection");
 187         if (data[0] & 0x04)
 188                 printf(" Barker_Preamble_Mode");
 189         printf("\n");
 190 }
 191
 192 static void print_cipher(const uint8_t *data)
 193 {
 194         if (memcmp(data, wifi_oui, 3) == 0) {
 195                 switch (data[3]) {
 196                 case 0:
 197                         printf("Use group cipher suite");
 198                         break;
 199                 case 1:
 200                         printf("WEP-40");
 201                         break;
 202                 case 2:
 203                         printf("TKIP");
 204                         break;
 205                 case 4:
 206                         printf("CCMP");
 207                         break;
 208                 case 5:
 209                         printf("WEP-104");
 210                         break;
 211                 default:
 212                         printf("%.02x-%.02x-%.02x:%d",
 213                                 data[0], data[1] ,data[2], data[3]);
 214                         break;
 215                 }
 216         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 217                 switch (data[3]) {
 218                 case 0:
 219                         printf("Use group cipher suite");
 220                         break;
 221                 case 1:
 222                         printf("WEP-40");
 223                         break;
 224                 case 2:
 225                         printf("TKIP");
 226                         break;
 227                 case 4:
 228                         printf("CCMP");
 229                         break;
 230                 case 5:
 231                         printf("WEP-104");
 232                         break;
 233                 case 6:
 234                         printf("AES-128-CMAC");
 235                         break;
 236                 default:
 237                         printf("%.02x-%.02x-%.02x:%d",
 238                                 data[0], data[1] ,data[2], data[3]);
 239                         break;
 240                 }
 241         } else
 242                 printf("%.02x-%.02x-%.02x:%d",
 243                         data[0], data[1] ,data[2], data[3]);
 244 }
 245
 246 static void print_auth(const uint8_t *data)
 247 {
 248         if (memcmp(data, wifi_oui, 3) == 0) {
 249                 switch (data[3]) {
 250                 case 1:
 251                         printf("IEEE 802.1X");
 252                         break;
 253                 case 2:
 254                         printf("PSK");
 255                         break;
 256                 default:
 257                         printf("%.02x-%.02x-%.02x:%d",
 258                                 data[0], data[1] ,data[2], data[3]);
 259                         break;
 260                 }
 261         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 262                 switch (data[3]) {
 263                 case 1:
 264                         printf("IEEE 802.1X");
 265                         break;
 266                 case 2:
 267                         printf("PSK");
 268                         break;
 269                 case 3:
 270                         printf("FT/IEEE 802.1X");
 271                         break;
 272                 case 4:
 273                         printf("FT/PSK");
 274                         break;
 275                 case 5:
 276                         printf("IEEE 802.1X/SHA-256");
 277                         break;
 278                 case 6:
 279                         printf("PSK/SHA-256");
 280                         break;
 281                 default:
 282                         printf("%.02x-%.02x-%.02x:%d",
 283                                 data[0], data[1] ,data[2], data[3]);
 284                         break;
 285                 }
 286         } else
 287                 printf("%.02x-%.02x-%.02x:%d",
 288                         data[0], data[1] ,data[2], data[3]);
 289 }
 290
 291 static void print_rsn_ie(const char *defcipher, const char *defauth,
 292                          uint8_t len, const uint8_t *data)
 293 {
 294         bool first = true;
 295         __u16 version, count, capa;
 296         int i;
 297
 298         version = data[0] + (data[1] << 8);
 299         tab_on_first(&first);
 300         printf("\t * Version: %d\n", version);
 301
 302         data += 2;
 303         len -= 2;
 304
 305         if (len < 4) {
 306                 tab_on_first(&first);
 307                 printf("\t * Group cipher: %s\n", defcipher);
 308                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 309                 return;
 310         }
 311
 312         tab_on_first(&first);
 313         printf("\t * Group cipher: ");
 314         print_cipher(data);
 315         printf("\n");
 316
 317         data += 4;
 318         len -= 4;
 319
 320         if (len < 2) {
 321                 tab_on_first(&first);
 322                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 323                 return;
 324         }
 325
 326         count = data[0] | (data[1] << 8);
 327         if (2 + (count * 4) > len)
 328                 goto invalid;
 329
 330         tab_on_first(&first);
 331         printf("\t * Pairwise ciphers:");
 332         for (i = 0; i < count; i++) {
 333                 printf(" ");
 334                 print_cipher(data + 2 + (i * 4));
 335         }
 336         printf("\n");
 337
 338         data += 2 + (count * 4);
 339         len -= 2 + (count * 4);
 340
 341         if (len < 2) {
 342                 tab_on_first(&first);
 343                 printf("\t * Authentication suites: %s\n", defauth);
 344                 return;
 345         }
 346
 347         count = data[0] | (data[1] << 8);
 348         if (2 + (count * 4) > len)
 349                 goto invalid;
 350
 351         tab_on_first(&first);
 352         printf("\t * Authentication suites:");
 353         for (i = 0; i < count; i++) {
 354                 printf(" ");
 355                 print_auth(data + 2 + (i * 4));
 356         }
 357         printf("\n");
 358
 359         data += 2 + (count * 4);
 360         len -= 2 + (count * 4);
 361
 362         if (len >= 2) {
 363                 capa = data[0] | (data[1] << 8);
 364                 tab_on_first(&first);
 365                 printf("\t * Capabilities:");
 366                 if (capa & 0x0001)
 367                         printf(" PreAuth");
 368                 if (capa & 0x0002)
 369                         printf(" NoPairwise");
 370                 switch ((capa & 0x000c) >> 2) {
 371                 case 0:
 372                         break;
 373                 case 1:
 374                         printf(" 2-PTKSA-RC");
 375                         break;
 376                 case 2:
 377                         printf(" 4-PTKSA-RC");
 378                         break;
 379                 case 3:
 380                         printf(" 16-PTKSA-RC");
 381                         break;
 382                 }
 383                 switch ((capa & 0x0030) >> 4) {
 384                 case 0:
 385                         break;
 386                 case 1:
 387                         printf(" 2-GTKSA-RC");
 388                         break;
 389                 case 2:
 390                         printf(" 4-GTKSA-RC");
 391                         break;
 392                 case 3:
 393                         printf(" 16-GTKSA-RC");
 394                         break;
 395                 }
 396                 if (capa & 0x0040)
 397                         printf(" MFP-required");
 398                 if (capa & 0x0080)
 399                         printf(" MFP-capable");
 400                 if (capa & 0x0200)
 401                         printf(" Peerkey-enabled");
 402                 if (capa & 0x0400)
 403                         printf(" SPP-AMSDU-capable");
 404                 if (capa & 0x0800)
 405                         printf(" SPP-AMSDU-required");
 406                 printf(" (0x%.4x)\n", capa);
 407                 data += 2;
 408                 len -= 2;
 409         }
 410
 411  invalid:
 412         if (len != 0) {
 413                 printf("\t\t * bogus tail data (%d):", len);
 414                 while (len) {
 415                         printf(" %.2x", *data);
 416                         data++;
 417                         len--;
 418                 }
 419                 printf("\n");
 420         }
 421 }
 422
 423 static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
 424 {
 425         print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 426 }
 427
 428 static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 429 {
 430         int i, base, bit;
 431         bool first = true;
 432
 433
 434         for (i = 0; i < len; i++) {
 435                 base = i * 8;
 436
 437                 for (bit = 0; bit < 8; bit++) {
 438                         if (!(data[i] & (1 << bit)))
 439                                 continue;
 440
 441                         if (!first)
 442                                 printf(",");
 443                         else
 444                                 first = false;
 445
 446                         switch (bit + base) {
 447                         case 0:
 448                                 printf(" HT Information Exchange Supported");
 449                                 break;
 450                         case 1:
 451                                 printf(" On-demand Beacon");
 452                                 break;
 453                         case 2:
 454                                 printf(" Extended Channel Switching");
 455                                 break;
 456                         case 3:
 457                                 printf(" Wave Indication");
 458                                 break;
 459                         case 4:
 460                                 printf(" PSMP Capability");
 461                                 break;
 462                         case 5:
 463                                 printf(" Service Interval Granularity");
 464                                 break;
 465                         case 6:
 466                                 printf(" S-PSMP Capability");
 467                                 break;
 468                         default:
 469                                 printf(" %d", bit);
 470                                 break;
 471                         }
 472                 }
 473         }
 474
 475         printf("\n");
 476 }
 477
 478 struct ie_print {
 479         const char *name;
 480         void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
 481         uint8_t minlen, maxlen;
 482         uint8_t flags;
 483 };
 484
 485 static void print_ie(const struct ie_print *p, const uint8_t type,
 486                      uint8_t len, const uint8_t *data)
 487 {
 488         int i;
 489
 490         if (!p->print)
 491                 return;
 492
 493         printf("\t%s:", p->name);
 494         if (len < p->minlen || len > p->maxlen) {
 495                 if (len > 1) {
 496                         printf(" <invalid: %d bytes:", len);
 497                         for (i = 0; i < len; i++)
 498                                 printf(" %.02x", data[i]);
 499                         printf(">\n");
 500                 } else if (len)
 501                         printf(" <invalid: 1 byte: %.02x>\n", data[0]);
 502                 else
 503                         printf(" <invalid: no data>\n");
 504                 return;
 505         }
 506
 507         p->print(type, len, data);
 508 }
 509
 510 #define PRINT_IGN {             \
 511         .name = "IGNORE",       \
 512         .print = NULL,          \
 513         .minlen = 0,            \
 514         .maxlen = 255,          \
 515 }
 516
 517 static const struct ie_print ieprinters[] = {
 518         [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
 519         [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 520         [3] = { "DS Paramater set", print_ds, 1, 1, BIT(PRINT_SCAN), },
 521         [5] = PRINT_IGN,
 522         [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
 523         [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
 524         [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
 525         [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
 526         [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 527         [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
 528 };
 529
 530 static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
 531 {
 532         print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
 533 }
 534
 535 static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
 536 {
 537         int i;
 538
 539         switch (data[0]) {
 540         case 0x00:
 541                 printf(" information:");
 542                 break;
 543         case 0x01:
 544                 printf(" parameter:");
 545                 break;
 546         default:
 547                 printf(" type %d:", data[0]);
 548                 break;
 549         }
 550
 551         for(i = 0; i < len - 1; i++)
 552                 printf(" %.02x", data[i + 1]);
 553         printf("\n");
 554 }
 555
 556 static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
 557 {
 558         bool first = true;
 559         __u16 subtype, sublen;
 560
 561         while (len >= 4) {
 562                 subtype = (data[0] << 8) + data[1];
 563                 sublen = (data[2] << 8) + data[3];
 564                 if (sublen > len)
 565                         break;
 566
 567                 switch (subtype) {
 568                 case 0x104a:
 569                         tab_on_first(&first);
 570                         printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
 571                         break;
 572                 case 0x1011:
 573                         tab_on_first(&first);
 574                         printf("\t * Device name: %.*s\n", sublen, data + 4);
 575                         break;
 576                 case 0x1021:
 577                         tab_on_first(&first);
 578                         printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
 579                         break;
 580                 case 0x1023:
 581                         tab_on_first(&first);
 582                         printf("\t * Model: %.*s\n", sublen, data + 4);
 583                         break;
 584                 case 0x1057: {
 585                         __u8 val = data[4];
 586                         tab_on_first(&first);
 587                         printf("\t * AP setup locked: 0x%.2x\n", val);
 588                         break;
 589                 }
 590                 case 0x1008: {
 591                         __u16 meth = (data[4] << 8) + data[5];
 592                         bool comma = false;
 593                         tab_on_first(&first);
 594                         printf("\t * Config methods:");
 595 #define T(bit, name) do {               \
 596         if (meth & (1<<bit)) {          \
 597                 if (comma)              \
 598                         printf(",");    \
 599                 comma = true;           \
 600                 printf(" " name);       \
 601         } } while (0)
 602                         T(0, "USB");
 603                         T(1, "Ethernet");
 604                         T(2, "Label");
 605                         T(3, "Display");
 606                         T(4, "Ext. NFC");
 607                         T(5, "Int. NFC");
 608                         T(6, "NFC Intf.");
 609                         T(7, "PBC");
 610                         T(8, "Keypad");
 611                         printf("\n");
 612                         break;
 613 #undef T
 614                 }
 615                 default:
 616                         break;
 617                 }
 618
 619                 data += sublen + 4;
 620                 len -= sublen + 4;
 621         }
 622
 623         if (len != 0) {
 624                 printf("\t\t * bogus tail data (%d):", len);
 625                 while (len) {
 626                         printf(" %.2x", *data);
 627                         data++;
 628                         len--;
 629                 }
 630                 printf("\n");
 631         }
 632 }
 633
 634 static const struct ie_print wifiprinters[] = {
 635         [1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
 636         [2] = { "WMM", print_wifi_wmm, 1, 255, BIT(PRINT_SCAN), },
 637         [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
 638 };
 639
 640 static void print_vendor(unsigned char len, unsigned char *data,
 641                          bool unknown, enum print_ie_type ptype)
 642 {
 643         int i;
 644
 645         if (len < 3) {
 646                 printf("\tVendor specific: <too short> data:");
 647                 for(i = 0; i < len; i++)
 648                         printf(" %.02x", data[i]);
 649                 printf("\n");
 650                 return;
 651         }
 652
 653         if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) {
 654                 if (data[3] < ARRAY_SIZE(wifiprinters) &&
 655                     wifiprinters[data[3]].name &&
 656                     wifiprinters[data[3]].flags & BIT(ptype)) {
 657                         print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
 658                         return;
 659                 }
 660                 if (!unknown)
 661                         return;
 662                 printf("\tWiFi OUI %#.2x, data:", data[3]);
 663                 for(i = 0; i < len - 4; i++)
 664                         printf(" %.02x", data[i + 4]);
 665                 printf("\n");
 666                 return;
 667         }
 668
 669         if (!unknown)
 670                 return;
 671
 672         printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
 673                 data[0], data[1], data[2]);
 674         for (i = 3; i < len; i++)
 675                 printf(" %.2x", data[i]);
 676         printf("\n");
 677 }
 678
 679 void print_ies(unsigned char *ie, int ielen, bool unknown,
 680                enum print_ie_type ptype)
 681 {
 682         while (ielen >= 2 && ielen >= ie[1]) {
 683                 if (ie[0] < ARRAY_SIZE(ieprinters) &&
 684                     ieprinters[ie[0]].name &&
 685                     ieprinters[ie[0]].flags & BIT(ptype)) {
 686                         print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
 687                 } else if (ie[0] == 221 /* vendor */) {
 688                         print_vendor(ie[1], ie + 2, unknown, ptype);
 689                 } else if (unknown) {
 690                         int i;
 691
 692                         printf("\tUnknown IE (%d):", ie[0]);
 693                         for (i=0; i<ie[1]; i++)
 694                                 printf(" %.2x", ie[2+i]);
 695                         printf("\n");
 696                 }
 697                 ielen -= ie[1] + 2;
 698                 ie += ie[1] + 2;
 699         }
 700 }
 701
 702 static int print_bss_handler(struct nl_msg *msg, void *arg)
 703 {
 704         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 705         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 706         struct nlattr *bss[NL80211_BSS_MAX + 1];
 707         char mac_addr[20], dev[20];
 708         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
 709                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
 710                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
 711                 [NL80211_BSS_BSSID] = { },
 712                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
 713                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
 714                 [NL80211_BSS_INFORMATION_ELEMENTS] = { },
 715                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
 716                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
 717                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
 718         };
 719         struct scan_params *params = arg;
 720
 721         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 722                   genlmsg_attrlen(gnlh, 0), NULL);
 723
 724         if (!tb[NL80211_ATTR_BSS]) {
 725                 fprintf(stderr, "bss info missing!");
 726                 return NL_SKIP;
 727         }
 728         if (nla_parse_nested(bss, NL80211_BSS_MAX,
 729                              tb[NL80211_ATTR_BSS],
 730                              bss_policy)) {
 731                 fprintf(stderr, "failed to parse nested attributes!");
 732                 return NL_SKIP;
 733         }
 734
 735         if (!bss[NL80211_BSS_BSSID])
 736                 return NL_SKIP;
 737
 738         mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
 739         if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
 740         printf("BSS %s (on %s)", mac_addr, dev);
 741
 742         if (bss[NL80211_BSS_STATUS]) {
 743                 switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
 744                 case NL80211_BSS_STATUS_AUTHENTICATED:
 745                         printf(" -- authenticated");
 746                         break;
 747                 case NL80211_BSS_STATUS_ASSOCIATED:
 748                         printf(" -- associated");
 749                         break;
 750                 case NL80211_BSS_STATUS_IBSS_JOINED:
 751                         printf(" -- joined");
 752                         break;
 753                 default:
 754                         printf(" -- unknown status: %d",
 755                                 nla_get_u32(bss[NL80211_BSS_STATUS]));
 756                         break;
 757                 }
 758         }
 759         printf("\n");
 760
 761         if (bss[NL80211_BSS_TSF]) {
 762                 unsigned long long tsf;
 763                 tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
 764                 printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
 765                         tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
 766                         (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
 767         }
 768         if (bss[NL80211_BSS_FREQUENCY])
 769                 printf("\tfreq: %d\n",
 770                         nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
 771         if (bss[NL80211_BSS_BEACON_INTERVAL])
 772                 printf("\tbeacon interval: %d\n",
 773                         nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
 774         if (bss[NL80211_BSS_CAPABILITY]) {
 775                 __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
 776                 printf("\tcapability:");
 777                 if (capa & WLAN_CAPABILITY_ESS)
 778                         printf(" ESS");
 779                 if (capa & WLAN_CAPABILITY_IBSS)
 780                         printf(" IBSS");
 781                 if (capa & WLAN_CAPABILITY_PRIVACY)
 782                         printf(" Privacy");
 783                 if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
 784                         printf(" ShortPreamble");
 785                 if (capa & WLAN_CAPABILITY_PBCC)
 786                         printf(" PBCC");
 787                 if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
 788                         printf(" ChannelAgility");
 789                 if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
 790                         printf(" SpectrumMgmt");
 791                 if (capa & WLAN_CAPABILITY_QOS)
 792                         printf(" QoS");
 793                 if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
 794                         printf(" ShortSlotTime");
 795                 if (capa & WLAN_CAPABILITY_APSD)
 796                         printf(" APSD");
 797                 if (capa & WLAN_CAPABILITY_DSSS_OFDM)
 798                         printf(" DSSS-OFDM");
 799                 printf(" (0x%.4x)\n", capa);
 800         }
 801         if (bss[NL80211_BSS_SIGNAL_MBM]) {
 802                 int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
 803                 printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
 804         }
 805         if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
 806                 unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
 807                 printf("\tsignal: %d/100\n", s);
 808         }
 809         if (bss[NL80211_BSS_INFORMATION_ELEMENTS])
 810                 print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
 811                           nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
 812                           params->unknown, params->type);
 813
 814         return NL_SKIP;
 815 }
 816
 817 static struct scan_params scan_params;
 818
 819 static int handle_scan_dump(struct nl80211_state *state,
 820                             struct nl_cb *cb,
 821                             struct nl_msg *msg,
 822                             int argc, char **argv)
 823 {
 824         if (argc > 1)
 825                 return 1;
 826
 827         scan_params.unknown = false;
 828         if (argc == 1 && !strcmp(argv[0], "-u"))
 829                 scan_params.unknown = true;
 830
 831         scan_params.type = PRINT_SCAN;
 832
 833         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
 834                   &scan_params);
 835         return 0;
 836 }
 837 COMMAND(scan, dump, "[-u]",
 838         NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
 839         "Dump the current scan results. If -u is specified, print unknown\n"
 840         "data in scan results.");
 841
 842 static int handle_scan_combined(struct nl80211_state *state,
 843                                 struct nl_cb *cb,
 844                                 struct nl_msg *msg,
 845                                 int argc, char **argv)
 846 {
 847         char **trig_argv;
 848         static char *dump_argv[] = {
 849                 NULL,
 850                 "scan",
 851                 "dump",
 852                 NULL,
 853         };
 854         static const __u32 cmds[] = {
 855                 NL80211_CMD_NEW_SCAN_RESULTS,
 856                 NL80211_CMD_SCAN_ABORTED,
 857         };
 858         int trig_argc, dump_argc, err;
 859
 860         if (argc >= 3 && !strcmp(argv[2], "-u")) {
 861                 dump_argc = 4;
 862                 dump_argv[3] = "-u";
 863         } else
 864                 dump_argc = 3;
 865
 866         trig_argc = 3 + (argc - 2) + (3 - dump_argc);
 867         trig_argv = calloc(trig_argc, sizeof(*trig_argv));
 868         if (!trig_argv)
 869                 return -ENOMEM;
 870         trig_argv[0] = argv[0];
 871         trig_argv[1] = "scan";
 872         trig_argv[2] = "trigger";
 873         int i;
 874         for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
 875                 trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
 876         err = handle_cmd(state, II_NETDEV, trig_argc, trig_argv);
 877         free(trig_argv);
 878         if (err)
 879                 return err;
 880
 881         /*
 882          * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
 883          *
 884          * This code has a bug, which requires creating a separate
 885          * nl80211 socket to fix:
 886          * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
 887          * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
 888          * before (!) we listen to it, because we only start listening
 889          * after we send our scan request.
 890          *
 891          * Doing it the other way around has a race condition as well,
 892          * if you first open the events socket you may get a notification
 893          * for a previous scan.
 894          *
 895          * The only proper way to fix this would be to listen to events
 896          * before sending the command, and for the kernel to send the
 897          * scan request along with the event, so that you can match up
 898          * whether the scan you requested was finished or aborted (this
 899          * may result in processing a scan that another application
 900          * requested, but that doesn't seem to be a problem).
 901          *
 902          * Alas, the kernel doesn't do that (yet).
 903          */
 904
 905         if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
 906                                         NL80211_CMD_SCAN_ABORTED) {
 907                 printf("scan aborted!\n");
 908                 return 0;
 909         }
 910
 911         dump_argv[0] = argv[0];
 912         return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
 913 }
 914 TOPLEVEL(scan, "[-u] [freq <freq>*] [ssid <ssid>*|passive]", 0, 0,
 915          CIB_NETDEV, handle_scan_combined,
 916          "Scan on the given frequencies and probe for the given SSIDs\n"
 917          "(or wildcard if not given) unless passive scanning is requested.\n"
 918          "If -u is specified print unknown data in the scan results.");