]> git.ipfire.org Git - thirdparty/iw.git/blobdiff - scan.c
iw: fix 'iw list' MCS set print
[thirdparty/iw.git] / scan.c
diff --git a/scan.c b/scan.c
index 48f803aea98db6b6893698fc72b2b90ae2af6f6d..973d6906378a8936dfb27a47ab86169f71f61989 100644 (file)
--- a/scan.c
+++ b/scan.c
 #include "nl80211.h"
 #include "iw.h"
 
+#define WLAN_CAPABILITY_ESS            (1<<0)
+#define WLAN_CAPABILITY_IBSS           (1<<1)
+#define WLAN_CAPABILITY_CF_POLLABLE    (1<<2)
+#define WLAN_CAPABILITY_CF_POLL_REQUEST        (1<<3)
+#define WLAN_CAPABILITY_PRIVACY                (1<<4)
+#define WLAN_CAPABILITY_SHORT_PREAMBLE (1<<5)
+#define WLAN_CAPABILITY_PBCC           (1<<6)
+#define WLAN_CAPABILITY_CHANNEL_AGILITY        (1<<7)
+#define WLAN_CAPABILITY_SPECTRUM_MGMT  (1<<8)
+#define WLAN_CAPABILITY_QOS            (1<<9)
+#define WLAN_CAPABILITY_SHORT_SLOT_TIME        (1<<10)
+#define WLAN_CAPABILITY_APSD           (1<<11)
+#define WLAN_CAPABILITY_DSSS_OFDM      (1<<13)
+
+static unsigned char wifi_oui[3]      = { 0x00, 0x50, 0xf2 };
+static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };
+
 struct scan_params {
        bool unknown;
+       enum print_ie_type type;
 };
 
 static int handle_scan(struct nl80211_state *state,
@@ -22,86 +40,735 @@ static int handle_scan(struct nl80211_state *state,
                       struct nl_msg *msg,
                       int argc, char **argv)
 {
-       struct nl_msg *ssids = NULL;
+       struct nl_msg *ssids = NULL, *freqs = NULL;
+       char *eptr;
        int err = -ENOBUFS;
+       int i;
+       enum {
+               NONE,
+               FREQ,
+               SSID,
+               DONE,
+       } parse = NONE;
+       int freq;
+       bool passive = false, have_ssids = false, have_freqs = false;
 
        ssids = nlmsg_alloc();
        if (!ssids)
                return -ENOMEM;
-       NLA_PUT(ssids, 1, 0, "");
-       nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
+
+       freqs = nlmsg_alloc();
+       if (!freqs) {
+               nlmsg_free(ssids);
+               return -ENOMEM;
+       }
+
+       for (i = 0; i < argc; i++) {
+               if (parse == NONE && strcmp(argv[i], "freq") == 0) {
+                       parse = FREQ;
+                       have_freqs = true;
+                       continue;
+               } else if (parse < SSID && strcmp(argv[i], "ssid") == 0) {
+                       parse = SSID;
+                       have_ssids = true;
+                       continue;
+               } else if (parse < SSID && strcmp(argv[i], "passive") == 0) {
+                       parse = DONE;
+                       passive = true;
+                       continue;
+               }
+
+               switch (parse) {
+               case NONE:
+               case DONE:
+                       return 1;
+               case FREQ:
+                       freq = strtoul(argv[i], &eptr, 10);
+                       if (eptr != argv[i] + strlen(argv[i]))
+                               return 1;
+                       NLA_PUT_U32(freqs, i, freq);
+                       break;
+               case SSID:
+                       NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
+                       break;
+               }
+       }
+
+       if (!have_ssids)
+               NLA_PUT(ssids, 1, 0, "");
+       if (!passive)
+               nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
+
+       if (have_freqs)
+               nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
 
        err = 0;
  nla_put_failure:
        nlmsg_free(ssids);
+       nlmsg_free(freqs);
        return err;
 }
-COMMAND(scan, trigger, NULL,
-       NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan);
 
-typedef void (*printfn)(unsigned char type, unsigned char len, unsigned char *data);
+static void tab_on_first(bool *first)
+{
+       if (!*first)
+               printf("\t");
+       else
+               *first = false;
+}
 
-static void print_ssid(unsigned char type, unsigned char len, unsigned char *data)
+static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
 {
-       int i;
-       printf("\tSSID: ");
-       for (i=0; i<len; i++) {
-               if (isprint(data[i]))
-                       printf("%c", data[i]);
-               else
-                       printf("\\x%.2x", data[i]);
-       }
+       printf(" ");
+       print_ssid_escaped(len, data);
        printf("\n");
 }
 
-static void print_supprates(unsigned char type, unsigned char len, unsigned char *data)
+static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 {
        int i;
 
-       if (type == 1)
-               printf("\tSupported rates: ");
-       else
-               printf("\tExtended supported rates: ");
+       printf(" ");
 
-       for (i=0; i<len; i++) {
+       for (i = 0; i < len; i++) {
                int r = data[i] & 0x7f;
                printf("%d.%d%s ", r/2, 5*(r&1), data[i] & 0x80 ? "*":"");
        }
        printf("\n");
 }
 
-static void print_ds(unsigned char type, unsigned char len, unsigned char *data)
+static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
 {
-       printf("\tDS Parameter set: channel %d\n", data[0]);
+       printf(" channel %d\n", data[0]);
 }
 
-static void print_ign(unsigned char type, unsigned char len, unsigned char *data)
+static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
 {
-       /* ignore for now, not too useful */
+       int i;
+
+       printf(" %.*s", 2, data);
+       switch (data[2]) {
+       case 'I':
+               printf(" (indoor)");
+               break;
+       case 'O':
+               printf(" (outdoor)");
+               break;
+       case ' ':
+               printf(" (in/outdoor)");
+               break;
+       default:
+               printf(" (invalid environment)");
+               break;
+       }
+       printf(", data:");
+       for(i=0; i<len-3; i++)
+               printf(" %.02x", data[i + 3]);
+       printf("\n");
 }
 
-static const printfn ieprinters[] = {
-       [0] = print_ssid,
-       [1] = print_supprates,
-       [3] = print_ds,
-       [5] = print_ign,
-       [50] = print_supprates,
-};
+static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+       printf(" %d dB\n", data[0]);
+}
 
-static void tab_on_first(bool *first)
+static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 {
-       if (!*first)
-               printf("\t");
+       if (data[0] == 0x00)
+               printf(" <no flags>");
+       if (data[0] & 0x01)
+               printf(" NonERP_Present");
+       if (data[0] & 0x02)
+               printf(" Use_Protection");
+       if (data[0] & 0x04)
+               printf(" Barker_Preamble_Mode");
+       printf("\n");
+}
+
+static void print_cipher(const uint8_t *data)
+{
+       if (memcmp(data, wifi_oui, 3) == 0) {
+               switch (data[3]) {
+               case 0:
+                       printf("Use group cipher suite");
+                       break;
+               case 1:
+                       printf("WEP-40");
+                       break;
+               case 2:
+                       printf("TKIP");
+                       break;
+               case 4:
+                       printf("CCMP");
+                       break;
+               case 5:
+                       printf("WEP-104");
+                       break;
+               default:
+                       printf("%.02x-%.02x-%.02x:%d",
+                               data[0], data[1] ,data[2], data[3]);
+                       break;
+               }
+       } else if (memcmp(data, ieee80211_oui, 3) == 0) {
+               switch (data[3]) {
+               case 0:
+                       printf("Use group cipher suite");
+                       break;
+               case 1:
+                       printf("WEP-40");
+                       break;
+               case 2:
+                       printf("TKIP");
+                       break;
+               case 4:
+                       printf("CCMP");
+                       break;
+               case 5:
+                       printf("WEP-104");
+                       break;
+               case 6:
+                       printf("AES-128-CMAC");
+                       break;
+               default:
+                       printf("%.02x-%.02x-%.02x:%d",
+                               data[0], data[1] ,data[2], data[3]);
+                       break;
+               }
+       } else
+               printf("%.02x-%.02x-%.02x:%d",
+                       data[0], data[1] ,data[2], data[3]);
+}
+
+static void print_auth(const uint8_t *data)
+{
+       if (memcmp(data, wifi_oui, 3) == 0) {
+               switch (data[3]) {
+               case 1:
+                       printf("IEEE 802.1X");
+                       break;
+               case 2:
+                       printf("PSK");
+                       break;
+               default:
+                       printf("%.02x-%.02x-%.02x:%d",
+                               data[0], data[1] ,data[2], data[3]);
+                       break;
+               }
+       } else if (memcmp(data, ieee80211_oui, 3) == 0) {
+               switch (data[3]) {
+               case 1:
+                       printf("IEEE 802.1X");
+                       break;
+               case 2:
+                       printf("PSK");
+                       break;
+               case 3:
+                       printf("FT/IEEE 802.1X");
+                       break;
+               case 4:
+                       printf("FT/PSK");
+                       break;
+               case 5:
+                       printf("IEEE 802.1X/SHA-256");
+                       break;
+               case 6:
+                       printf("PSK/SHA-256");
+                       break;
+               default:
+                       printf("%.02x-%.02x-%.02x:%d",
+                               data[0], data[1] ,data[2], data[3]);
+                       break;
+               }
+       } else
+               printf("%.02x-%.02x-%.02x:%d",
+                       data[0], data[1] ,data[2], data[3]);
+}
+
+static void print_rsn_ie(const char *defcipher, const char *defauth,
+                        uint8_t len, const uint8_t *data)
+{
+       bool first = true;
+       __u16 version, count, capa;
+       int i;
+
+       version = data[0] + (data[1] << 8);
+       tab_on_first(&first);
+       printf("\t * Version: %d\n", version);
+
+       data += 2;
+       len -= 2;
+
+       if (len < 4) {
+               tab_on_first(&first);
+               printf("\t * Group cipher: %s\n", defcipher);
+               printf("\t * Pairwise ciphers: %s\n", defcipher);
+               return;
+       }
+
+       tab_on_first(&first);
+       printf("\t * Group cipher: ");
+       print_cipher(data);
+       printf("\n");
+
+       data += 4;
+       len -= 4;
+
+       if (len < 2) {
+               tab_on_first(&first);
+               printf("\t * Pairwise ciphers: %s\n", defcipher);
+               return;
+       }
+
+       count = data[0] | (data[1] << 8);
+       if (2 + (count * 4) > len)
+               goto invalid;
+
+       tab_on_first(&first);
+       printf("\t * Pairwise ciphers:");
+       for (i = 0; i < count; i++) {
+               printf(" ");
+               print_cipher(data + 2 + (i * 4));
+       }
+       printf("\n");
+
+       data += 2 + (count * 4);
+       len -= 2 + (count * 4);
+
+       if (len < 2) {
+               tab_on_first(&first);
+               printf("\t * Authentication suites: %s\n", defauth);
+               return;
+       }
+
+       count = data[0] | (data[1] << 8);
+       if (2 + (count * 4) > len)
+               goto invalid;
+
+       tab_on_first(&first);
+       printf("\t * Authentication suites:");
+       for (i = 0; i < count; i++) {
+               printf(" ");
+               print_auth(data + 2 + (i * 4));
+       }
+       printf("\n");
+
+       data += 2 + (count * 4);
+       len -= 2 + (count * 4);
+
+       if (len >= 2) {
+               capa = data[0] | (data[1] << 8);
+               tab_on_first(&first);
+               printf("\t * Capabilities:");
+               if (capa & 0x0001)
+                       printf(" PreAuth");
+               if (capa & 0x0002)
+                       printf(" NoPairwise");
+               switch ((capa & 0x000c) >> 2) {
+               case 0:
+                       break;
+               case 1:
+                       printf(" 2-PTKSA-RC");
+                       break;
+               case 2:
+                       printf(" 4-PTKSA-RC");
+                       break;
+               case 3:
+                       printf(" 16-PTKSA-RC");
+                       break;
+               }
+               switch ((capa & 0x0030) >> 4) {
+               case 0:
+                       break;
+               case 1:
+                       printf(" 2-GTKSA-RC");
+                       break;
+               case 2:
+                       printf(" 4-GTKSA-RC");
+                       break;
+               case 3:
+                       printf(" 16-GTKSA-RC");
+                       break;
+               }
+               if (capa & 0x0040)
+                       printf(" MFP-required");
+               if (capa & 0x0080)
+                       printf(" MFP-capable");
+               if (capa & 0x0200)
+                       printf(" Peerkey-enabled");
+               if (capa & 0x0400)
+                       printf(" SPP-AMSDU-capable");
+               if (capa & 0x0800)
+                       printf(" SPP-AMSDU-required");
+               printf(" (0x%.4x)\n", capa);
+               data += 2;
+               len -= 2;
+       }
+
+ invalid:
+       if (len != 0) {
+               printf("\t\t * bogus tail data (%d):", len);
+               while (len) {
+                       printf(" %.2x", *data);
+                       data++;
+                       len--;
+               }
+               printf("\n");
+       }
+}
+
+static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+       print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
+}
+
+/*
+ * There are only 4 possible values, we just use a case instead of computing it,
+ * but technically this can also be computed through the formula:
+ *
+ * Max AMPDU length = (2 ^ (13 + exponent)) - 1 bytes
+ */
+__u32 compute_ampdu_length(__u8 exponent)
+{
+       switch (exponent) {
+       case 0: return 8191;  /* (2 ^(13 + 0)) -1 */
+       case 1: return 16383; /* (2 ^(13 + 1)) -1 */
+       case 2: return 32767; /* (2 ^(13 + 2)) -1 */
+       case 3: return 65535; /* (2 ^(13 + 3)) -1 */
+       default: return 0;
+       }
+}
+
+const char *print_ampdu_space(__u8 space)
+{
+       switch (space) {
+       case 0: return "No restriction";
+       case 1: return "1/4 usec";
+       case 2: return "1/2 usec";
+       case 3: return "1 usec";
+       case 4: return "2 usec";
+       case 5: return "4 usec";
+       case 6: return "8 usec";
+       case 7: return "16 usec";
+       default:
+               return "Uknown";
+       }
+}
+
+static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+#define PRINT_HT_CAP(_cond, _str) \
+       do { \
+               if (_cond) \
+                       printf("\t\t\t" _str "\n"); \
+       } while (0)
+       struct ht_cap_data {
+               __u16 cap;
+               __u8 ampdu_params;
+               struct {
+                       __u8 rx_mcs_bitmask[10]; /* last 3 bits reserved */
+                       __u16 max_rx_rate_1mbps: 10,
+                             reserved_0: 6;
+                       __u8 tx_rx_mcs_defined:1,
+                            tx_rx_mcs_not_equal:1,
+                            tx_max_streams:2,
+                            tx_unequal_modulation:1,
+                            reserved_1:3; /* 3 reserved bits here */
+                       __u8 reserved_2[3]; /* 24 reserved bits here = 27 */
+               } mcs_set;
+               __u16 ht_extend_cap;
+               __u32 tx_beamform_cap;
+               __u8 asel_cap;
+       } __attribute__((packed)) ht_cap;
+       struct ht_cap_data *htc = &ht_cap;
+       __u8 ampdu_exponent, ampdu_spacing, bit;
+       __u32 max_ampdu_length, i;
+       bool tx_rx_mcs_equal = false;
+
+       if (len != 26) {
+               printf("\n\t\tHT Capability IE len != expected 26 bytes, skipping parse\n");
+               return;
+       }
+
+       memcpy(&ht_cap, data, 26);
+
+       printf("\n\t\tCapabilities: %#.4x\n", htc->cap);
+
+       PRINT_HT_CAP((htc->cap & BIT(0)), "RX LDCP");
+       PRINT_HT_CAP((htc->cap & BIT(1)), "HT20/HT40");
+       PRINT_HT_CAP(!(htc->cap & BIT(1)), "HT20");
+
+       PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 0, "Static SM Power Save");
+       PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 1, "Dynamic SM Power Save");
+       PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 3, "SM Power Save disabled");
+
+       PRINT_HT_CAP((htc->cap & BIT(4)), "RX Greenfield");
+       PRINT_HT_CAP((htc->cap & BIT(5)), "RX HT20 SGI");
+       PRINT_HT_CAP((htc->cap & BIT(6)), "RX HT40 SGI");
+       PRINT_HT_CAP((htc->cap & BIT(7)), "TX STBC");
+
+       PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 0, "No RX STBC");
+       PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 1, "RX STBC 1-stream");
+       PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 2, "RX STBC 2-streams");
+       PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 3, "RX STBC 3-streams");
+
+       PRINT_HT_CAP((htc->cap & BIT(10)), "HT Delayed Block Ack");
+
+       PRINT_HT_CAP((htc->cap & BIT(11)), "Max AMSDU length: 3839 bytes");
+        PRINT_HT_CAP(!(htc->cap & BIT(11)), "Max AMSDU length: 7935 bytes");
+
+       /*
+        * For beacons and probe response this would mean the BSS
+        * does or does not allow the usage of DSSS/CCK HT40.
+        * Otherwise it means the STA does or does not use
+        * DSSS/CCK HT40.
+        */
+       PRINT_HT_CAP((htc->cap & BIT(12)), "DSSS/CCK HT40");
+       PRINT_HT_CAP(!(htc->cap & BIT(12)), "No DSSS/CCK HT40");
+
+       /* BIT(13) is reserved */
+
+       PRINT_HT_CAP((htc->cap & BIT(14)), "40 MHz Intolerant");
+
+       PRINT_HT_CAP((htc->cap & BIT(15)), "L-SIG TXOP protection");
+
+       ampdu_exponent = htc->ampdu_params & 0x3;
+       max_ampdu_length = compute_ampdu_length(ampdu_exponent);
+       if (max_ampdu_length) {
+               printf("\t\tMaximum RX AMPDU length %d bytes (exponent: 0x0%02x)\n",
+                      compute_ampdu_length(ampdu_exponent), ampdu_exponent);
+       }
        else
-               *first = false;
+               printf("\t\tMaximum RX AMPDU length: unrecognized bytes "
+                      "(exponent: %d)\n", ampdu_exponent);
+
+
+       ampdu_spacing = (htc->ampdu_params >> 2) & 0x3 ;
+       printf("\t\tMinimum RX AMPDU time spacing: %s (0x%02x)\n",
+              print_ampdu_space(ampdu_spacing), ampdu_spacing);
+
+       /* This is the whole MCS set, which is 16 bytes */
+       printf("\t\tMCS set:");
+       data+=2;
+       print_mcs_set(data);
+       printf("\n");
+
+       if (htc->mcs_set.tx_rx_mcs_defined && htc->mcs_set.tx_rx_mcs_not_equal)
+               tx_rx_mcs_equal = true;
+       if (tx_rx_mcs_equal)
+               printf("\t\tSupported TX/RX MCS Indexes:\n");
+       else
+               printf("\t\tSupported RX MCS Indexes:\n");
+       /*
+        * Parses the RX MCS rates. Only 10 bits correspond to actual MCS rates
+        * MCS [0-76]
+        */
+       for (i = 0; i < 10; i++) {
+               for (bit = 0; bit < 8; bit++) {
+                       /* Only bits 0-76 are valid, bits 76-79 are reserved */
+                       if (((i * 8) + bit) > 76)
+                               break;
+                       if (htc->mcs_set.rx_mcs_bitmask[i] & BIT(bit))
+                               printf("\t\t\tMCS Index %d\n",
+                                      (i * 8) + bit);
+               }
+       }
+
+       if (!htc->mcs_set.tx_rx_mcs_defined) {
+               /* This is actually quite common */
+               printf("\t\tNo TX MCS set defined\n");
+               goto out;
+       }
+
+       if (htc->mcs_set.tx_rx_mcs_not_equal) {
+               printf("\t\tMaximum supported TX spatial streams: %d\n",
+                      htc->mcs_set.tx_max_streams);
+               printf("\t\tTX unequal modulation ");
+               if (htc->mcs_set.tx_unequal_modulation)
+                       printf("supported\n");
+               else
+                       printf("unsupported\n");
+       }
+
+out:
+       return;
 }
 
-static void print_wifi_wps(unsigned char type, unsigned char len, unsigned char *data)
+static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 {
+       int i, base, bit;
        bool first = true;
-       __u16 subtype, sublen;
 
-       printf("\tWPS:");
+
+       for (i = 0; i < len; i++) {
+               base = i * 8;
+
+               for (bit = 0; bit < 8; bit++) {
+                       if (!(data[i] & (1 << bit)))
+                               continue;
+
+                       if (!first)
+                               printf(",");
+                       else
+                               first = false;
+
+                       switch (bit + base) {
+                       case 0:
+                               printf(" HT Information Exchange Supported");
+                               break;
+                       case 1:
+                               printf(" On-demand Beacon");
+                               break;
+                       case 2:
+                               printf(" Extended Channel Switching");
+                               break;
+                       case 3:
+                               printf(" Wave Indication");
+                               break;
+                       case 4:
+                               printf(" PSMP Capability");
+                               break;
+                       case 5:
+                               printf(" Service Interval Granularity");
+                               break;
+                       case 6:
+                               printf(" S-PSMP Capability");
+                               break;
+                       default:
+                               printf(" %d", bit);
+                               break;
+                       }
+               }
+       }
+
+       printf("\n");
+}
+
+struct ie_print {
+       const char *name;
+       void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
+       uint8_t minlen, maxlen;
+       uint8_t flags;
+};
+
+static void print_ie(const struct ie_print *p, const uint8_t type,
+                    uint8_t len, const uint8_t *data)
+{
+       int i;
+
+       if (!p->print)
+               return;
+
+       printf("\t%s:", p->name);
+       if (len < p->minlen || len > p->maxlen) {
+               if (len > 1) {
+                       printf(" <invalid: %d bytes:", len);
+                       for (i = 0; i < len; i++)
+                               printf(" %.02x", data[i]);
+                       printf(">\n");
+               } else if (len)
+                       printf(" <invalid: 1 byte: %.02x>\n", data[0]);
+               else
+                       printf(" <invalid: no data>\n");
+               return;
+       }
+
+       p->print(type, len, data);
+}
+
+#define PRINT_IGN {            \
+       .name = "IGNORE",       \
+       .print = NULL,          \
+       .minlen = 0,            \
+       .maxlen = 255,          \
+}
+
+static const struct ie_print ieprinters[] = {
+       [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
+       [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
+       [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
+       [5] = PRINT_IGN,
+       [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
+       [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
+       [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
+       [45] = { "HT capabilities", print_ht_capa, 1, 255, BIT(PRINT_SCAN), },
+       [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
+       [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
+       [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
+};
+
+static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+       print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
+}
+
+static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
+{
+       int i;
+       static const char *aci_tbl[] = { "BE", "BK", "VI", "VO" };
+
+       if (len < 19)
+               goto invalid;
+
+       if (data[0] != 1) {
+               printf("Parameter: not version 1: ");
+               return false;
+       }
+
+       printf("\t* Parameter version 1");
+
+       data++;
+
+       if (data[0] & 0x80)
+               printf("\n\t\t* u-APSD");
+
+       data += 2;
+
+       for (i = 0; i < 4; i++) {
+               printf("\n\t\t* %s:", aci_tbl[(data[0] >> 5) & 3]);
+               if (data[4] & 0x10)
+                       printf(" acm");
+               printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1,
+                                   (1 << (data[1] >> 4)) - 1);
+               printf(", AIFSN %d", data[0] & 0xf);
+               if (data[2] | data[3])
+                       printf(", TXOP %d usec", (data[2] + (data[3] << 8)) * 32);
+               data += 4;
+       }
+
+       printf("\n");
+       return true;
+
+ invalid:
+       printf("invalid: ");
+       return false;
+}
+
+static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+       int i;
+
+       switch (data[0]) {
+       case 0x00:
+               printf(" information:");
+               break;
+       case 0x01:
+               if (print_wifi_wmm_param(data + 1, len - 1))
+                       return;
+               break;
+       default:
+               printf(" type %d:", data[0]);
+               break;
+       }
+
+       for(i = 1; i < len; i++)
+               printf(" %.02x", data[i]);
+       printf("\n");
+}
+
+static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+       bool first = true;
+       __u16 subtype, sublen;
 
        while (len >= 4) {
                subtype = (data[0] << 8) + data[1];
@@ -112,7 +779,7 @@ static void print_wifi_wps(unsigned char type, unsigned char len, unsigned char
                switch (subtype) {
                case 0x104a:
                        tab_on_first(&first);
-                       printf("\t * Version: %#.2x\n", data[4]);
+                       printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
                        break;
                case 0x1011:
                        tab_on_first(&first);
@@ -127,9 +794,9 @@ static void print_wifi_wps(unsigned char type, unsigned char len, unsigned char
                        printf("\t * Model: %.*s\n", sublen, data + 4);
                        break;
                case 0x1057: {
-                       __u16 val = (data[4] << 8) | data[5];
+                       __u8 val = data[4];
                        tab_on_first(&first);
-                       printf("\t * AP setup locked: 0x%.4x\n", val);
+                       printf("\t * AP setup locked: 0x%.2x\n", val);
                        break;
                }
                case 0x1008: {
@@ -176,12 +843,14 @@ static void print_wifi_wps(unsigned char type, unsigned char len, unsigned char
        }
 }
 
-static const printfn wifiprinters[] = {
-       [4] = print_wifi_wps,
+static const struct ie_print wifiprinters[] = {
+       [1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
+       [2] = { "WMM", print_wifi_wmm, 1, 255, BIT(PRINT_SCAN), },
+       [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
 };
 
 static void print_vendor(unsigned char len, unsigned char *data,
-                        struct scan_params *params)
+                        bool unknown, enum print_ie_type ptype)
 {
        int i;
 
@@ -193,19 +862,23 @@ static void print_vendor(unsigned char len, unsigned char *data,
                return;
        }
 
-       if (len >= 4 && data[0] == 0x00 && data[1] == 0x50 && data[2] == 0xF2) {
-               if (data[3] < ARRAY_SIZE(wifiprinters) && wifiprinters[data[3]])
-                       return wifiprinters[data[3]](data[3], len - 4, data + 4);
-               if (!params->unknown)
+       if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) {
+               if (data[3] < ARRAY_SIZE(wifiprinters) &&
+                   wifiprinters[data[3]].name &&
+                   wifiprinters[data[3]].flags & BIT(ptype)) {
+                       print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
+                       return;
+               }
+               if (!unknown)
                        return;
-               printf("\tWiFi OUI %#.2x data:", data[3]);
+               printf("\tWiFi OUI %#.2x, data:", data[3]);
                for(i = 0; i < len - 4; i++)
                        printf(" %.02x", data[i + 4]);
                printf("\n");
                return;
        }
 
-       if (!params->unknown)
+       if (!unknown)
                return;
 
        printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
@@ -215,14 +888,17 @@ static void print_vendor(unsigned char len, unsigned char *data,
        printf("\n");
 }
 
-static void print_ies(unsigned char *ie, int ielen, struct scan_params *params)
+void print_ies(unsigned char *ie, int ielen, bool unknown,
+              enum print_ie_type ptype)
 {
        while (ielen >= 2 && ielen >= ie[1]) {
-               if (ie[0] < ARRAY_SIZE(ieprinters) && ieprinters[ie[0]]) {
-                       ieprinters[ie[0]](ie[0], ie[1], ie + 2);
+               if (ie[0] < ARRAY_SIZE(ieprinters) &&
+                   ieprinters[ie[0]].name &&
+                   ieprinters[ie[0]].flags & BIT(ptype)) {
+                       print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
                } else if (ie[0] == 221 /* vendor */) {
-                       print_vendor(ie[1], ie + 2, params);
-               } else if (params->unknown) {
+                       print_vendor(ie[1], ie + 2, unknown, ptype);
+               } else if (unknown) {
                        int i;
 
                        printf("\tUnknown IE (%d):", ie[0]);
@@ -250,19 +926,22 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
                [NL80211_BSS_INFORMATION_ELEMENTS] = { },
                [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
                [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
+               [NL80211_BSS_STATUS] = { .type = NLA_U32 },
+               [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
        };
+       struct scan_params *params = arg;
 
        nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
                  genlmsg_attrlen(gnlh, 0), NULL);
 
        if (!tb[NL80211_ATTR_BSS]) {
-               fprintf(stderr, "bss info missing!");
+               fprintf(stderr, "bss info missing!\n");
                return NL_SKIP;
        }
        if (nla_parse_nested(bss, NL80211_BSS_MAX,
                             tb[NL80211_ATTR_BSS],
                             bss_policy)) {
-               fprintf(stderr, "failed to parse nested attributes!");
+               fprintf(stderr, "failed to parse nested attributes!\n");
                return NL_SKIP;
        }
 
@@ -271,7 +950,26 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
 
        mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
        if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
-       printf("BSS %s (on %s)\n", mac_addr, dev);
+       printf("BSS %s (on %s)", mac_addr, dev);
+
+       if (bss[NL80211_BSS_STATUS]) {
+               switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
+               case NL80211_BSS_STATUS_AUTHENTICATED:
+                       printf(" -- authenticated");
+                       break;
+               case NL80211_BSS_STATUS_ASSOCIATED:
+                       printf(" -- associated");
+                       break;
+               case NL80211_BSS_STATUS_IBSS_JOINED:
+                       printf(" -- joined");
+                       break;
+               default:
+                       printf(" -- unknown status: %d",
+                               nla_get_u32(bss[NL80211_BSS_STATUS]));
+                       break;
+               }
+       }
+       printf("\n");
 
        if (bss[NL80211_BSS_TSF]) {
                unsigned long long tsf;
@@ -286,9 +984,33 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
        if (bss[NL80211_BSS_BEACON_INTERVAL])
                printf("\tbeacon interval: %d\n",
                        nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
-       if (bss[NL80211_BSS_CAPABILITY])
-               printf("\tcapability: 0x%.4x\n",
-                       nla_get_u16(bss[NL80211_BSS_CAPABILITY]));
+       if (bss[NL80211_BSS_CAPABILITY]) {
+               __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
+               printf("\tcapability:");
+               if (capa & WLAN_CAPABILITY_ESS)
+                       printf(" ESS");
+               if (capa & WLAN_CAPABILITY_IBSS)
+                       printf(" IBSS");
+               if (capa & WLAN_CAPABILITY_PRIVACY)
+                       printf(" Privacy");
+               if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
+                       printf(" ShortPreamble");
+               if (capa & WLAN_CAPABILITY_PBCC)
+                       printf(" PBCC");
+               if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
+                       printf(" ChannelAgility");
+               if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
+                       printf(" SpectrumMgmt");
+               if (capa & WLAN_CAPABILITY_QOS)
+                       printf(" QoS");
+               if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
+                       printf(" ShortSlotTime");
+               if (capa & WLAN_CAPABILITY_APSD)
+                       printf(" APSD");
+               if (capa & WLAN_CAPABILITY_DSSS_OFDM)
+                       printf(" DSSS-OFDM");
+               printf(" (0x%.4x)\n", capa);
+       }
        if (bss[NL80211_BSS_SIGNAL_MBM]) {
                int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
                printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
@@ -297,10 +1019,14 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
                unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
                printf("\tsignal: %d/100\n", s);
        }
+       if (bss[NL80211_BSS_SEEN_MS_AGO]) {
+               int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
+               printf("\tlast seen: %d ms ago\n", age);
+       }
        if (bss[NL80211_BSS_INFORMATION_ELEMENTS])
                print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
                          nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
-                         arg);
+                         params->unknown, params->type);
 
        return NL_SKIP;
 }
@@ -319,36 +1045,49 @@ static int handle_scan_dump(struct nl80211_state *state,
        if (argc == 1 && !strcmp(argv[0], "-u"))
                scan_params.unknown = true;
 
+       scan_params.type = PRINT_SCAN;
+
        nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
                  &scan_params);
        return 0;
 }
-COMMAND(scan, dump, "[-u]",
-       NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump);
 
 static int handle_scan_combined(struct nl80211_state *state,
                                struct nl_cb *cb,
                                struct nl_msg *msg,
                                int argc, char **argv)
 {
-       static char *trig_argv[] = {
-               NULL,
-               "scan",
-               "trigger",
-       };
+       char **trig_argv;
        static char *dump_argv[] = {
                NULL,
                "scan",
                "dump",
+               NULL,
        };
        static const __u32 cmds[] = {
                NL80211_CMD_NEW_SCAN_RESULTS,
                NL80211_CMD_SCAN_ABORTED,
        };
-       int err;
+       int trig_argc, dump_argc, err;
 
+       if (argc >= 3 && !strcmp(argv[2], "-u")) {
+               dump_argc = 4;
+               dump_argv[3] = "-u";
+       } else
+               dump_argc = 3;
+
+       trig_argc = 3 + (argc - 2) + (3 - dump_argc);
+       trig_argv = calloc(trig_argc, sizeof(*trig_argv));
+       if (!trig_argv)
+               return -ENOMEM;
        trig_argv[0] = argv[0];
-       err = handle_cmd(state, II_NETDEV, ARRAY_SIZE(trig_argv), trig_argv);
+       trig_argv[1] = "scan";
+       trig_argv[2] = "trigger";
+       int i;
+       for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
+               trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
+       err = handle_cmd(state, II_NETDEV, trig_argc, trig_argv);
+       free(trig_argv);
        if (err)
                return err;
 
@@ -383,6 +1122,18 @@ static int handle_scan_combined(struct nl80211_state *state,
        }
 
        dump_argv[0] = argv[0];
-       return handle_cmd(state, II_NETDEV, ARRAY_SIZE(dump_argv), dump_argv);
+       return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
 }
-TOPLEVEL(scan, NULL, 0, 0, CIB_NETDEV, handle_scan_combined);
+TOPLEVEL(scan, "[-u] [freq <freq>*] [ssid <ssid>*|passive]", 0, 0,
+        CIB_NETDEV, handle_scan_combined,
+        "Scan on the given frequencies and probe for the given SSIDs\n"
+        "(or wildcard if not given) unless passive scanning is requested.\n"
+        "If -u is specified print unknown data in the scan results.");
+COMMAND(scan, dump, "[-u]",
+       NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
+       "Dump the current scan results. If -u is specified, print unknown\n"
+       "data in scan results.");
+COMMAND(scan, trigger, "[freq <freq>*] [ssid <ssid>*|passive]",
+       NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
+        "Trigger a scan on the given frequencies with probing for the given\n"
+        "SSIDs (or wildcard if not given) unless passive scanning is requested.");