wpa_supplicant/wpa_priv.c

   1 /*
   2  * WPA Supplicant / privileged helper program
   3  * Copyright (c) 2007-2009, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16 #ifdef __linux__
  17 #include <fcntl.h>
  18 #endif /* __linux__ */
  19 #include <sys/un.h>
  20 #include <sys/stat.h>
  21
  22 #include "common.h"
  23 #include "eloop.h"
  24 #include "version.h"
  25 #include "drivers/driver.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "privsep_commands.h"
  28 #include "ieee802_11_defs.h"
  29
  30 #ifndef ETH_P_EAPOL
  31 #define ETH_P_EAPOL 0x888e
  32 #endif
  33
  34 #ifndef ETH_P_RSN_PREAUTH
  35 #define ETH_P_RSN_PREAUTH 0x88c7
  36 #endif
  37
  38
  39 struct wpa_priv_interface {
  40         struct wpa_priv_interface *next;
  41         char *driver_name;
  42         char *ifname;
  43         char *sock_name;
  44         int fd;
  45
  46         struct wpa_driver_ops *driver;
  47         void *drv_priv;
  48         struct sockaddr_un drv_addr;
  49         int wpas_registered;
  50
  51         /* TODO: add support for multiple l2 connections */
  52         struct l2_packet_data *l2;
  53         struct sockaddr_un l2_addr;
  54 };
  55
  56
  57 static void wpa_priv_cmd_register(struct wpa_priv_interface *iface,
  58                                   struct sockaddr_un *from)
  59 {
  60         if (iface->drv_priv) {
  61                 wpa_printf(MSG_DEBUG, "Cleaning up forgotten driver instance");
  62                 if (iface->driver->set_wpa)
  63                         iface->driver->set_wpa(iface->drv_priv, 0);
  64                 if (iface->driver->deinit)
  65                         iface->driver->deinit(iface->drv_priv);
  66                 iface->drv_priv = NULL;
  67                 iface->wpas_registered = 0;
  68         }
  69
  70         if (iface->l2) {
  71                 wpa_printf(MSG_DEBUG, "Cleaning up forgotten l2_packet "
  72                            "instance");
  73                 l2_packet_deinit(iface->l2);
  74                 iface->l2 = NULL;
  75         }
  76
  77         if (iface->driver->init == NULL)
  78                 return;
  79
  80         iface->drv_priv = iface->driver->init(iface, iface->ifname);
  81         if (iface->drv_priv == NULL) {
  82                 wpa_printf(MSG_DEBUG, "Failed to initialize driver wrapper");
  83                 return;
  84         }
  85
  86         wpa_printf(MSG_DEBUG, "Driver wrapper '%s' initialized for interface "
  87                    "'%s'", iface->driver_name, iface->ifname);
  88
  89         os_memcpy(&iface->drv_addr, from, sizeof(iface->drv_addr));
  90         iface->wpas_registered = 1;
  91
  92         if (iface->driver->set_param &&
  93             iface->driver->set_param(iface->drv_priv, NULL) < 0) {
  94                 wpa_printf(MSG_ERROR, "Driver interface rejected param");
  95         }
  96
  97         if (iface->driver->set_wpa)
  98                 iface->driver->set_wpa(iface->drv_priv, 1);
  99 }
 100
 101
 102 static void wpa_priv_cmd_unregister(struct wpa_priv_interface *iface,
 103                                     struct sockaddr_un *from)
 104 {
 105         if (iface->drv_priv) {
 106                 if (iface->driver->set_wpa)
 107                         iface->driver->set_wpa(iface->drv_priv, 0);
 108                 if (iface->driver->deinit)
 109                         iface->driver->deinit(iface->drv_priv);
 110                 iface->drv_priv = NULL;
 111                 iface->wpas_registered = 0;
 112         }
 113 }
 114
 115
 116 static void wpa_priv_cmd_set_wpa(struct wpa_priv_interface *iface,
 117                                  char *buf, size_t len)
 118 {
 119         if (iface->drv_priv == NULL || len != sizeof(int))
 120                 return;
 121
 122         if (iface->driver->set_wpa)
 123                 iface->driver->set_wpa(iface->drv_priv, *((int *) buf));
 124 }
 125
 126
 127 static void wpa_priv_cmd_scan(struct wpa_priv_interface *iface,
 128                               char *buf, size_t len)
 129 {
 130         if (iface->drv_priv == NULL)
 131                 return;
 132
 133         if (iface->driver->scan)
 134                 iface->driver->scan(iface->drv_priv, len ? (u8 *) buf : NULL,
 135                                     len);
 136 }
 137
 138
 139 static void wpa_priv_get_scan_results2(struct wpa_priv_interface *iface,
 140                                        struct sockaddr_un *from)
 141 {
 142         struct wpa_scan_results *res;
 143         u8 *buf = NULL, *pos, *end;
 144         int val;
 145         size_t i;
 146
 147         res = iface->driver->get_scan_results2(iface->drv_priv);
 148         if (res == NULL)
 149                 goto fail;
 150
 151         buf = os_malloc(60000);
 152         if (buf == NULL)
 153                 goto fail;
 154         pos = buf;
 155         end = buf + 60000;
 156         val = res->num;
 157         os_memcpy(pos, &val, sizeof(int));
 158         pos += sizeof(int);
 159
 160         for (i = 0; i < res->num; i++) {
 161                 struct wpa_scan_res *r = res->res[i];
 162                 val = sizeof(*r) + r->ie_len;
 163                 if (end - pos < (int) sizeof(int) + val)
 164                         break;
 165                 os_memcpy(pos, &val, sizeof(int));
 166                 pos += sizeof(int);
 167                 os_memcpy(pos, r, val);
 168                 pos += val;
 169         }
 170
 171         sendto(iface->fd, buf, pos - buf, 0, (struct sockaddr *) from,
 172                sizeof(*from));
 173
 174         os_free(buf);
 175         os_free(res);
 176         return;
 177
 178 fail:
 179         os_free(buf);
 180         os_free(res);
 181         sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, sizeof(*from));
 182 }
 183
 184
 185 static void wpa_priv_send_old_scan_results(struct wpa_priv_interface *iface,
 186                                            struct sockaddr_un *from)
 187 {
 188 #define SCAN_AP_LIMIT 128
 189         int i, res, val;
 190         struct wpa_scan_result *results = NULL;
 191         u8 *buf = NULL, *pos, *end;
 192         struct wpa_scan_res nres;
 193
 194         results = os_malloc(SCAN_AP_LIMIT * sizeof(*results));
 195         if (results == NULL)
 196                 goto fail;
 197
 198         res = iface->driver->get_scan_results(iface->drv_priv, results,
 199                                               SCAN_AP_LIMIT);
 200         if (res < 0 || res > SCAN_AP_LIMIT)
 201                 goto fail;
 202
 203         buf = os_malloc(60000);
 204         if (buf == NULL)
 205                 goto fail;
 206         pos = buf;
 207         end = buf + 60000;
 208         os_memcpy(pos, &res, sizeof(int));
 209         pos += sizeof(int);
 210
 211         os_memset(&nres, 0, sizeof(nres));
 212         for (i = 0; i < res; i++) {
 213                 struct wpa_scan_result *r = &results[i];
 214                 size_t ie_len;
 215
 216                 ie_len = 2 + r->ssid_len + r->rsn_ie_len + r->wpa_ie_len;
 217                 if (r->maxrate)
 218                         ie_len += 3;
 219                 if (r->mdie_present)
 220                         ie_len += 5;
 221
 222                 val = sizeof(nres) + ie_len;
 223                 if (end - pos < (int) sizeof(int) + val)
 224                         break;
 225                 os_memcpy(pos, &val, sizeof(int));
 226                 pos += sizeof(int);
 227
 228                 os_memcpy(nres.bssid, r->bssid, ETH_ALEN);
 229                 nres.freq = r->freq;
 230                 nres.caps = r->caps;
 231                 nres.qual = r->qual;
 232                 nres.noise = r->noise;
 233                 nres.level = r->level;
 234                 nres.tsf = r->tsf;
 235                 nres.ie_len = ie_len;
 236
 237                 os_memcpy(pos, &nres, sizeof(nres));
 238                 pos += sizeof(nres);
 239
 240                 /* SSID IE */
 241                 *pos++ = WLAN_EID_SSID;
 242                 *pos++ = r->ssid_len;
 243                 os_memcpy(pos, r->ssid, r->ssid_len);
 244                 pos += r->ssid_len;
 245
 246                 if (r->maxrate) {
 247                         /* Fake Supported Rate IE to include max rate */
 248                         *pos++ = WLAN_EID_SUPP_RATES;
 249                         *pos++ = 1;
 250                         *pos++ = r->maxrate;
 251                 }
 252
 253                 if (r->rsn_ie_len) {
 254                         os_memcpy(pos, r->rsn_ie, r->rsn_ie_len);
 255                         pos += r->rsn_ie_len;
 256                 }
 257
 258                 if (r->mdie_present) {
 259                         os_memcpy(pos, r->mdie, 5);
 260                         pos += 5;
 261                 }
 262
 263                 if (r->wpa_ie_len) {
 264                         os_memcpy(pos, r->wpa_ie, r->wpa_ie_len);
 265                         pos += r->wpa_ie_len;
 266                 }
 267         }
 268
 269         sendto(iface->fd, buf, pos - buf, 0, (struct sockaddr *) from,
 270                sizeof(*from));
 271
 272         os_free(buf);
 273         os_free(results);
 274         return;
 275
 276 fail:
 277         os_free(buf);
 278         os_free(results);
 279         sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, sizeof(*from));
 280 }
 281
 282
 283 static void wpa_priv_cmd_get_scan_results(struct wpa_priv_interface *iface,
 284                                           struct sockaddr_un *from)
 285 {
 286         if (iface->drv_priv == NULL)
 287                 return;
 288
 289         if (iface->driver->get_scan_results2)
 290                 wpa_priv_get_scan_results2(iface, from);
 291         else if (iface->driver->get_scan_results)
 292                 wpa_priv_send_old_scan_results(iface, from);
 293         else
 294                 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from,
 295                        sizeof(*from));
 296 }
 297
 298
 299 static void wpa_priv_cmd_associate(struct wpa_priv_interface *iface,
 300                                    void *buf, size_t len)
 301 {
 302         struct wpa_driver_associate_params params;
 303         struct privsep_cmd_associate *assoc;
 304         u8 *bssid;
 305         int res;
 306
 307         if (iface->drv_priv == NULL || iface->driver->associate == NULL)
 308                 return;
 309
 310         if (len < sizeof(*assoc)) {
 311                 wpa_printf(MSG_DEBUG, "Invalid association request");
 312                 return;
 313         }
 314
 315         assoc = buf;
 316         if (sizeof(*assoc) + assoc->wpa_ie_len > len) {
 317                 wpa_printf(MSG_DEBUG, "Association request overflow");
 318                 return;
 319         }
 320
 321         os_memset(&params, 0, sizeof(params));
 322         bssid = assoc->bssid;
 323         if (bssid[0] | bssid[1] | bssid[2] | bssid[3] | bssid[4] | bssid[5])
 324                 params.bssid = bssid;
 325         params.ssid = assoc->ssid;
 326         if (assoc->ssid_len > 32)
 327                 return;
 328         params.ssid_len = assoc->ssid_len;
 329         params.freq = assoc->freq;
 330         if (assoc->wpa_ie_len) {
 331                 params.wpa_ie = (u8 *) (assoc + 1);
 332                 params.wpa_ie_len = assoc->wpa_ie_len;
 333         }
 334         params.pairwise_suite = assoc->pairwise_suite;
 335         params.group_suite = assoc->group_suite;
 336         params.key_mgmt_suite = assoc->key_mgmt_suite;
 337         params.auth_alg = assoc->auth_alg;
 338         params.mode = assoc->mode;
 339
 340         res = iface->driver->associate(iface->drv_priv, &params);
 341         wpa_printf(MSG_DEBUG, "drv->associate: res=%d", res);
 342 }
 343
 344
 345 static void wpa_priv_cmd_get_bssid(struct wpa_priv_interface *iface,
 346                                    struct sockaddr_un *from)
 347 {
 348         u8 bssid[ETH_ALEN];
 349
 350         if (iface->drv_priv == NULL)
 351                 goto fail;
 352
 353         if (iface->driver->get_bssid == NULL ||
 354             iface->driver->get_bssid(iface->drv_priv, bssid) < 0)
 355                 goto fail;
 356
 357         sendto(iface->fd, bssid, ETH_ALEN, 0, (struct sockaddr *) from,
 358                sizeof(*from));
 359         return;
 360
 361 fail:
 362         sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, sizeof(*from));
 363 }
 364
 365
 366 static void wpa_priv_cmd_get_ssid(struct wpa_priv_interface *iface,
 367                                   struct sockaddr_un *from)
 368 {
 369         u8 ssid[sizeof(int) + 32];
 370         int res;
 371
 372         if (iface->drv_priv == NULL)
 373                 goto fail;
 374
 375         if (iface->driver->get_ssid == NULL)
 376                 goto fail;
 377
 378         res = iface->driver->get_ssid(iface->drv_priv, &ssid[sizeof(int)]);
 379         if (res < 0 || res > 32)
 380                 goto fail;
 381         os_memcpy(ssid, &res, sizeof(int));
 382
 383         sendto(iface->fd, ssid, sizeof(ssid), 0, (struct sockaddr *) from,
 384                sizeof(*from));
 385         return;
 386
 387 fail:
 388         sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, sizeof(*from));
 389 }
 390
 391
 392 static void wpa_priv_cmd_set_key(struct wpa_priv_interface *iface,
 393                                  void *buf, size_t len)
 394 {
 395         struct privsep_cmd_set_key *params;
 396         int res;
 397
 398         if (iface->drv_priv == NULL || iface->driver->set_key == NULL)
 399                 return;
 400
 401         if (len != sizeof(*params)) {
 402                 wpa_printf(MSG_DEBUG, "Invalid set_key request");
 403                 return;
 404         }
 405
 406         params = buf;
 407
 408         res = iface->driver->set_key(iface->drv_priv, params->alg,
 409                                      params->addr, params->key_idx,
 410                                      params->set_tx,
 411                                      params->seq_len ? params->seq : NULL,
 412                                      params->seq_len,
 413                                      params->key_len ? params->key : NULL,
 414                                      params->key_len);
 415         wpa_printf(MSG_DEBUG, "drv->set_key: res=%d", res);
 416 }
 417
 418
 419 static void wpa_priv_cmd_get_capa(struct wpa_priv_interface *iface,
 420                                   struct sockaddr_un *from)
 421 {
 422         struct wpa_driver_capa capa;
 423
 424         if (iface->drv_priv == NULL)
 425                 goto fail;
 426
 427         if (iface->driver->get_capa == NULL ||
 428             iface->driver->get_capa(iface->drv_priv, &capa) < 0)
 429                 goto fail;
 430
 431         sendto(iface->fd, &capa, sizeof(capa), 0, (struct sockaddr *) from,
 432                sizeof(*from));
 433         return;
 434
 435 fail:
 436         sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, sizeof(*from));
 437 }
 438
 439
 440 static void wpa_priv_l2_rx(void *ctx, const u8 *src_addr, const u8 *buf,
 441                            size_t len)
 442 {
 443         struct wpa_priv_interface *iface = ctx;
 444         struct msghdr msg;
 445         struct iovec io[2];
 446
 447         io[0].iov_base = (u8 *) src_addr;
 448         io[0].iov_len = ETH_ALEN;
 449         io[1].iov_base = (u8 *) buf;
 450         io[1].iov_len = len;
 451
 452         os_memset(&msg, 0, sizeof(msg));
 453         msg.msg_iov = io;
 454         msg.msg_iovlen = 2;
 455         msg.msg_name = &iface->l2_addr;
 456         msg.msg_namelen = sizeof(iface->l2_addr);
 457
 458         if (sendmsg(iface->fd, &msg, 0) < 0) {
 459                 perror("sendmsg(l2 rx)");
 460         }
 461 }
 462
 463
 464 static void wpa_priv_cmd_l2_register(struct wpa_priv_interface *iface,
 465                                      struct sockaddr_un *from,
 466                                      void *buf, size_t len)
 467 {
 468         int *reg_cmd = buf;
 469         u8 own_addr[ETH_ALEN];
 470         int res;
 471         u16 proto;
 472
 473         if (len != 2 * sizeof(int)) {
 474                 wpa_printf(MSG_DEBUG, "Invalid l2_register length %lu",
 475                            (unsigned long) len);
 476                 return;
 477         }
 478
 479         proto = reg_cmd[0];
 480         if (proto != ETH_P_EAPOL && proto != ETH_P_RSN_PREAUTH) {
 481                 wpa_printf(MSG_DEBUG, "Refused l2_packet connection for "
 482                            "ethertype 0x%x", proto);
 483                 return;
 484         }
 485
 486         if (iface->l2) {
 487                 wpa_printf(MSG_DEBUG, "Cleaning up forgotten l2_packet "
 488                            "instance");
 489                 l2_packet_deinit(iface->l2);
 490                 iface->l2 = NULL;
 491         }
 492
 493         os_memcpy(&iface->l2_addr, from, sizeof(iface->l2_addr));
 494
 495         iface->l2 = l2_packet_init(iface->ifname, NULL, proto,
 496                                    wpa_priv_l2_rx, iface, reg_cmd[1]);
 497         if (iface->l2 == NULL) {
 498                 wpa_printf(MSG_DEBUG, "Failed to initialize l2_packet "
 499                            "instance for protocol %d", proto);
 500                 return;
 501         }
 502
 503         if (l2_packet_get_own_addr(iface->l2, own_addr) < 0) {
 504                 wpa_printf(MSG_DEBUG, "Failed to get own address from "
 505                            "l2_packet");
 506                 l2_packet_deinit(iface->l2);
 507                 iface->l2 = NULL;
 508                 return;
 509         }
 510
 511         res = sendto(iface->fd, own_addr, ETH_ALEN, 0,
 512                      (struct sockaddr *) from, sizeof(*from));
 513         wpa_printf(MSG_DEBUG, "L2 registration: res=%d", res);
 514 }
 515
 516
 517 static void wpa_priv_cmd_l2_unregister(struct wpa_priv_interface *iface,
 518                                        struct sockaddr_un *from)
 519 {
 520         if (iface->l2) {
 521                 l2_packet_deinit(iface->l2);
 522                 iface->l2 = NULL;
 523         }
 524 }
 525
 526
 527 static void wpa_priv_cmd_l2_notify_auth_start(struct wpa_priv_interface *iface,
 528                                               struct sockaddr_un *from)
 529 {
 530         if (iface->l2)
 531                 l2_packet_notify_auth_start(iface->l2);
 532 }
 533
 534
 535 static void wpa_priv_cmd_l2_send(struct wpa_priv_interface *iface,
 536                                  struct sockaddr_un *from,
 537                                  void *buf, size_t len)
 538 {
 539         u8 *dst_addr;
 540         u16 proto;
 541         int res;
 542
 543         if (iface->l2 == NULL)
 544                 return;
 545
 546         if (len < ETH_ALEN + 2) {
 547                 wpa_printf(MSG_DEBUG, "Too short L2 send packet (len=%lu)",
 548                            (unsigned long) len);
 549                 return;
 550         }
 551
 552         dst_addr = buf;
 553         os_memcpy(&proto, buf + ETH_ALEN, 2);
 554
 555         if (proto != ETH_P_EAPOL && proto != ETH_P_RSN_PREAUTH) {
 556                 wpa_printf(MSG_DEBUG, "Refused l2_packet send for ethertype "
 557                            "0x%x", proto);
 558                 return;
 559         }
 560
 561         res = l2_packet_send(iface->l2, dst_addr, proto, buf + ETH_ALEN + 2,
 562                              len - ETH_ALEN - 2);
 563         wpa_printf(MSG_DEBUG, "L2 send: res=%d", res);
 564 }
 565
 566
 567 static void wpa_priv_cmd_set_mode(struct wpa_priv_interface *iface,
 568                                   void *buf, size_t len)
 569 {
 570         if (iface->drv_priv == NULL || iface->driver->set_mode == NULL ||
 571             len != sizeof(int))
 572                 return;
 573
 574         iface->driver->set_mode(iface->drv_priv, *((int *) buf));
 575 }
 576
 577
 578 static void wpa_priv_cmd_set_country(struct wpa_priv_interface *iface,
 579                                      char *buf)
 580 {
 581         if (iface->drv_priv == NULL || iface->driver->set_country == NULL ||
 582             *buf == '\0')
 583                 return;
 584
 585         iface->driver->set_country(iface->drv_priv, buf);
 586 }
 587
 588
 589 static void wpa_priv_receive(int sock, void *eloop_ctx, void *sock_ctx)
 590 {
 591         struct wpa_priv_interface *iface = eloop_ctx;
 592         char buf[2000], *pos;
 593         void *cmd_buf;
 594         size_t cmd_len;
 595         int res, cmd;
 596         struct sockaddr_un from;
 597         socklen_t fromlen = sizeof(from);
 598
 599         res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &from,
 600                        &fromlen);
 601         if (res < 0) {
 602                 perror("recvfrom");
 603                 return;
 604         }
 605
 606         if (res < (int) sizeof(int)) {
 607                 wpa_printf(MSG_DEBUG, "Too short command (len=%d)", res);
 608                 return;
 609         }
 610
 611         os_memcpy(&cmd, buf, sizeof(int));
 612         wpa_printf(MSG_DEBUG, "Command %d for interface %s",
 613                    cmd, iface->ifname);
 614         cmd_buf = &buf[sizeof(int)];
 615         cmd_len = res - sizeof(int);
 616
 617         switch (cmd) {
 618         case PRIVSEP_CMD_REGISTER:
 619                 wpa_priv_cmd_register(iface, &from);
 620                 break;
 621         case PRIVSEP_CMD_UNREGISTER:
 622                 wpa_priv_cmd_unregister(iface, &from);
 623                 break;
 624         case PRIVSEP_CMD_SET_WPA:
 625                 wpa_priv_cmd_set_wpa(iface, cmd_buf, cmd_len);
 626                 break;
 627         case PRIVSEP_CMD_SCAN:
 628                 wpa_priv_cmd_scan(iface, cmd_buf, cmd_len);
 629                 break;
 630         case PRIVSEP_CMD_GET_SCAN_RESULTS:
 631                 wpa_priv_cmd_get_scan_results(iface, &from);
 632                 break;
 633         case PRIVSEP_CMD_ASSOCIATE:
 634                 wpa_priv_cmd_associate(iface, cmd_buf, cmd_len);
 635                 break;
 636         case PRIVSEP_CMD_GET_BSSID:
 637                 wpa_priv_cmd_get_bssid(iface, &from);
 638                 break;
 639         case PRIVSEP_CMD_GET_SSID:
 640                 wpa_priv_cmd_get_ssid(iface, &from);
 641                 break;
 642         case PRIVSEP_CMD_SET_KEY:
 643                 wpa_priv_cmd_set_key(iface, cmd_buf, cmd_len);
 644                 break;
 645         case PRIVSEP_CMD_GET_CAPA:
 646                 wpa_priv_cmd_get_capa(iface, &from);
 647                 break;
 648         case PRIVSEP_CMD_L2_REGISTER:
 649                 wpa_priv_cmd_l2_register(iface, &from, cmd_buf, cmd_len);
 650                 break;
 651         case PRIVSEP_CMD_L2_UNREGISTER:
 652                 wpa_priv_cmd_l2_unregister(iface, &from);
 653                 break;
 654         case PRIVSEP_CMD_L2_NOTIFY_AUTH_START:
 655                 wpa_priv_cmd_l2_notify_auth_start(iface, &from);
 656                 break;
 657         case PRIVSEP_CMD_L2_SEND:
 658                 wpa_priv_cmd_l2_send(iface, &from, cmd_buf, cmd_len);
 659                 break;
 660         case PRIVSEP_CMD_SET_MODE:
 661                 wpa_priv_cmd_set_mode(iface, cmd_buf, cmd_len);
 662                 break;
 663         case PRIVSEP_CMD_SET_COUNTRY:
 664                 pos = cmd_buf;
 665                 if (pos + cmd_len >= buf + sizeof(buf))
 666                         break;
 667                 pos[cmd_len] = '\0';
 668                 wpa_priv_cmd_set_country(iface, pos);
 669                 break;
 670         }
 671 }
 672
 673
 674 static void wpa_priv_interface_deinit(struct wpa_priv_interface *iface)
 675 {
 676         if (iface->drv_priv && iface->driver->deinit)
 677                 iface->driver->deinit(iface->drv_priv);
 678
 679         if (iface->fd >= 0) {
 680                 eloop_unregister_read_sock(iface->fd);
 681                 close(iface->fd);
 682                 unlink(iface->sock_name);
 683         }
 684
 685         if (iface->l2)
 686                 l2_packet_deinit(iface->l2);
 687
 688         os_free(iface->ifname);
 689         os_free(iface->driver_name);
 690         os_free(iface->sock_name);
 691         os_free(iface);
 692 }
 693
 694
 695 extern struct wpa_driver_ops *wpa_supplicant_drivers[];
 696
 697 static struct wpa_priv_interface *
 698 wpa_priv_interface_init(const char *dir, const char *params)
 699 {
 700         struct wpa_priv_interface *iface;
 701         char *pos;
 702         size_t len;
 703         struct sockaddr_un addr;
 704         int i;
 705
 706         pos = os_strchr(params, ':');
 707         if (pos == NULL)
 708                 return NULL;
 709
 710         iface = os_zalloc(sizeof(*iface));
 711         if (iface == NULL)
 712                 return NULL;
 713         iface->fd = -1;
 714
 715         len = pos - params;
 716         iface->driver_name = os_malloc(len + 1);
 717         if (iface->driver_name == NULL) {
 718                 wpa_priv_interface_deinit(iface);
 719                 return NULL;
 720         }
 721         os_memcpy(iface->driver_name, params, len);
 722         iface->driver_name[len] = '\0';
 723
 724         for (i = 0; wpa_supplicant_drivers[i]; i++) {
 725                 if (os_strcmp(iface->driver_name,
 726                               wpa_supplicant_drivers[i]->name) == 0) {
 727                         iface->driver = wpa_supplicant_drivers[i];
 728                         break;
 729                 }
 730         }
 731         if (iface->driver == NULL) {
 732                 wpa_printf(MSG_ERROR, "Unsupported driver '%s'",
 733                            iface->driver_name);
 734                 wpa_priv_interface_deinit(iface);
 735                 return NULL;
 736         }
 737
 738         pos++;
 739         iface->ifname = os_strdup(pos);
 740         if (iface->ifname == NULL) {
 741                 wpa_priv_interface_deinit(iface);
 742                 return NULL;
 743         }
 744
 745         len = os_strlen(dir) + 1 + os_strlen(iface->ifname);
 746         iface->sock_name = os_malloc(len + 1);
 747         if (iface->sock_name == NULL) {
 748                 wpa_priv_interface_deinit(iface);
 749                 return NULL;
 750         }
 751
 752         os_snprintf(iface->sock_name, len + 1, "%s/%s", dir, iface->ifname);
 753         if (os_strlen(iface->sock_name) >= sizeof(addr.sun_path)) {
 754                 wpa_priv_interface_deinit(iface);
 755                 return NULL;
 756         }
 757
 758         iface->fd = socket(PF_UNIX, SOCK_DGRAM, 0);
 759         if (iface->fd < 0) {
 760                 perror("socket(PF_UNIX)");
 761                 wpa_priv_interface_deinit(iface);
 762                 return NULL;
 763         }
 764
 765         os_memset(&addr, 0, sizeof(addr));
 766         addr.sun_family = AF_UNIX;
 767         os_strlcpy(addr.sun_path, iface->sock_name, sizeof(addr.sun_path));
 768
 769         if (bind(iface->fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
 770                 wpa_printf(MSG_DEBUG, "bind(PF_UNIX) failed: %s",
 771                            strerror(errno));
 772                 if (connect(iface->fd, (struct sockaddr *) &addr,
 773                             sizeof(addr)) < 0) {
 774                         wpa_printf(MSG_DEBUG, "Socket exists, but does not "
 775                                    "allow connections - assuming it was "
 776                                    "leftover from forced program termination");
 777                         if (unlink(iface->sock_name) < 0) {
 778                                 perror("unlink[ctrl_iface]");
 779                                 wpa_printf(MSG_ERROR, "Could not unlink "
 780                                            "existing ctrl_iface socket '%s'",
 781                                            iface->sock_name);
 782                                 goto fail;
 783                         }
 784                         if (bind(iface->fd, (struct sockaddr *) &addr,
 785                                  sizeof(addr)) < 0) {
 786                                 perror("bind(PF_UNIX)");
 787                                 goto fail;
 788                         }
 789                         wpa_printf(MSG_DEBUG, "Successfully replaced leftover "
 790                                    "socket '%s'", iface->sock_name);
 791                 } else {
 792                         wpa_printf(MSG_INFO, "Socket exists and seems to be "
 793                                    "in use - cannot override it");
 794                         wpa_printf(MSG_INFO, "Delete '%s' manually if it is "
 795                                    "not used anymore", iface->sock_name);
 796                         goto fail;
 797                 }
 798         }
 799
 800         if (chmod(iface->sock_name, S_IRWXU | S_IRWXG | S_IRWXO) < 0) {
 801                 perror("chmod");
 802                 goto fail;
 803         }
 804
 805         eloop_register_read_sock(iface->fd, wpa_priv_receive, iface, NULL);
 806
 807         return iface;
 808
 809 fail:
 810         wpa_priv_interface_deinit(iface);
 811         return NULL;
 812 }
 813
 814
 815 static int wpa_priv_send_event(struct wpa_priv_interface *iface, int event,
 816                                const void *data, size_t data_len)
 817 {
 818         struct msghdr msg;
 819         struct iovec io[2];
 820
 821         io[0].iov_base = &event;
 822         io[0].iov_len = sizeof(event);
 823         io[1].iov_base = (u8 *) data;
 824         io[1].iov_len = data_len;
 825
 826         os_memset(&msg, 0, sizeof(msg));
 827         msg.msg_iov = io;
 828         msg.msg_iovlen = data ? 2 : 1;
 829         msg.msg_name = &iface->drv_addr;
 830         msg.msg_namelen = sizeof(iface->drv_addr);
 831
 832         if (sendmsg(iface->fd, &msg, 0) < 0) {
 833                 perror("sendmsg(wpas_socket)");
 834                 return -1;
 835         }
 836
 837         return 0;
 838 }
 839
 840
 841 static void wpa_priv_send_assoc(struct wpa_priv_interface *iface, int event,
 842                                 union wpa_event_data *data)
 843 {
 844         size_t buflen = 3 * sizeof(int);
 845         u8 *buf, *pos;
 846         int len;
 847
 848         if (data) {
 849                 buflen += data->assoc_info.req_ies_len +
 850                         data->assoc_info.resp_ies_len +
 851                         data->assoc_info.beacon_ies_len;
 852         }
 853
 854         buf = os_malloc(buflen);
 855         if (buf == NULL)
 856                 return;
 857
 858         pos = buf;
 859
 860         if (data && data->assoc_info.req_ies) {
 861                 len = data->assoc_info.req_ies_len;
 862                 os_memcpy(pos, &len, sizeof(int));
 863                 pos += sizeof(int);
 864                 os_memcpy(pos, data->assoc_info.req_ies, len);
 865                 pos += len;
 866         } else {
 867                 len = 0;
 868                 os_memcpy(pos, &len, sizeof(int));
 869                 pos += sizeof(int);
 870         }
 871
 872         if (data && data->assoc_info.resp_ies) {
 873                 len = data->assoc_info.resp_ies_len;
 874                 os_memcpy(pos, &len, sizeof(int));
 875                 pos += sizeof(int);
 876                 os_memcpy(pos, data->assoc_info.resp_ies, len);
 877                 pos += len;
 878         } else {
 879                 len = 0;
 880                 os_memcpy(pos, &len, sizeof(int));
 881                 pos += sizeof(int);
 882         }
 883
 884         if (data && data->assoc_info.beacon_ies) {
 885                 len = data->assoc_info.beacon_ies_len;
 886                 os_memcpy(pos, &len, sizeof(int));
 887                 pos += sizeof(int);
 888                 os_memcpy(pos, data->assoc_info.beacon_ies, len);
 889                 pos += len;
 890         } else {
 891                 len = 0;
 892                 os_memcpy(pos, &len, sizeof(int));
 893                 pos += sizeof(int);
 894         }
 895
 896         wpa_priv_send_event(iface, event, buf, buflen);
 897
 898         os_free(buf);
 899 }
 900
 901
 902 static void wpa_priv_send_interface_status(struct wpa_priv_interface *iface,
 903                                            union wpa_event_data *data)
 904 {
 905         int ievent;
 906         size_t len, maxlen;
 907         u8 *buf;
 908         char *ifname;
 909
 910         if (data == NULL)
 911                 return;
 912
 913         ievent = data->interface_status.ievent;
 914         maxlen = sizeof(data->interface_status.ifname);
 915         ifname = data->interface_status.ifname;
 916         for (len = 0; len < maxlen && ifname[len]; len++)
 917                 ;
 918
 919         buf = os_malloc(sizeof(int) + len);
 920         if (buf == NULL)
 921                 return;
 922
 923         os_memcpy(buf, &ievent, sizeof(int));
 924         os_memcpy(buf + sizeof(int), ifname, len);
 925
 926         wpa_priv_send_event(iface, PRIVSEP_EVENT_INTERFACE_STATUS,
 927                             buf, sizeof(int) + len);
 928
 929         os_free(buf);
 930
 931 }
 932
 933
 934 static void wpa_priv_send_ft_response(struct wpa_priv_interface *iface,
 935                                       union wpa_event_data *data)
 936 {
 937         size_t len;
 938         u8 *buf, *pos;
 939
 940         if (data == NULL || data->ft_ies.ies == NULL)
 941                 return;
 942
 943         len = sizeof(int) + ETH_ALEN + data->ft_ies.ies_len;
 944         buf = os_malloc(len);
 945         if (buf == NULL)
 946                 return;
 947
 948         pos = buf;
 949         os_memcpy(pos, &data->ft_ies.ft_action, sizeof(int));
 950         pos += sizeof(int);
 951         os_memcpy(pos, data->ft_ies.target_ap, ETH_ALEN);
 952         pos += ETH_ALEN;
 953         os_memcpy(pos, data->ft_ies.ies, data->ft_ies.ies_len);
 954
 955         wpa_priv_send_event(iface, PRIVSEP_EVENT_FT_RESPONSE, buf, len);
 956
 957         os_free(buf);
 958
 959 }
 960
 961
 962 void wpa_supplicant_event(void *ctx, wpa_event_type event,
 963                           union wpa_event_data *data)
 964 {
 965         struct wpa_priv_interface *iface = ctx;
 966
 967         wpa_printf(MSG_DEBUG, "%s - event=%d", __func__, event);
 968
 969         if (!iface->wpas_registered) {
 970                 wpa_printf(MSG_DEBUG, "Driver event received, but "
 971                            "wpa_supplicant not registered");
 972                 return;
 973         }
 974
 975         switch (event) {
 976         case EVENT_ASSOC:
 977                 wpa_priv_send_assoc(iface, PRIVSEP_EVENT_ASSOC, data);
 978                 break;
 979         case EVENT_DISASSOC:
 980                 wpa_priv_send_event(iface, PRIVSEP_EVENT_DISASSOC, NULL, 0);
 981                 break;
 982         case EVENT_ASSOCINFO:
 983                 if (data == NULL)
 984                         return;
 985                 wpa_priv_send_assoc(iface, PRIVSEP_EVENT_ASSOCINFO, data);
 986                 break;
 987         case EVENT_MICHAEL_MIC_FAILURE:
 988                 if (data == NULL)
 989                         return;
 990                 wpa_priv_send_event(iface, PRIVSEP_EVENT_MICHAEL_MIC_FAILURE,
 991                                     &data->michael_mic_failure.unicast,
 992                                     sizeof(int));
 993                 break;
 994         case EVENT_SCAN_RESULTS:
 995                 wpa_priv_send_event(iface, PRIVSEP_EVENT_SCAN_RESULTS, NULL,
 996                                     0);
 997                 break;
 998         case EVENT_INTERFACE_STATUS:
 999                 wpa_priv_send_interface_status(iface, data);
1000                 break;
1001         case EVENT_PMKID_CANDIDATE:
1002                 if (data == NULL)
1003                         return;
1004                 wpa_priv_send_event(iface, PRIVSEP_EVENT_PMKID_CANDIDATE,
1005                                     &data->pmkid_candidate,
1006                                     sizeof(struct pmkid_candidate));
1007                 break;
1008         case EVENT_STKSTART:
1009                 if (data == NULL)
1010                         return;
1011                 wpa_priv_send_event(iface, PRIVSEP_EVENT_STKSTART,
1012                                     &data->stkstart.peer, ETH_ALEN);
1013                 break;
1014         case EVENT_FT_RESPONSE:
1015                 wpa_priv_send_ft_response(iface, data);
1016                 break;
1017         default:
1018                 wpa_printf(MSG_DEBUG, "Unsupported driver event %d - TODO",
1019                            event);
1020                 break;
1021         }
1022 }
1023
1024
1025 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
1026                              const u8 *buf, size_t len)
1027 {
1028         struct wpa_priv_interface *iface = ctx;
1029         struct msghdr msg;
1030         struct iovec io[3];
1031         int event = PRIVSEP_EVENT_RX_EAPOL;
1032
1033         wpa_printf(MSG_DEBUG, "RX EAPOL from driver");
1034         io[0].iov_base = &event;
1035         io[0].iov_len = sizeof(event);
1036         io[1].iov_base = (u8 *) src_addr;
1037         io[1].iov_len = ETH_ALEN;
1038         io[2].iov_base = (u8 *) buf;
1039         io[2].iov_len = len;
1040
1041         os_memset(&msg, 0, sizeof(msg));
1042         msg.msg_iov = io;
1043         msg.msg_iovlen = 3;
1044         msg.msg_name = &iface->drv_addr;
1045         msg.msg_namelen = sizeof(iface->drv_addr);
1046
1047         if (sendmsg(iface->fd, &msg, 0) < 0)
1048                 perror("sendmsg(wpas_socket)");
1049 }
1050
1051
1052 #ifdef CONFIG_CLIENT_MLME
1053 void wpa_supplicant_sta_free_hw_features(struct hostapd_hw_modes *hw_features,
1054                                          size_t num_hw_features)
1055 {
1056         size_t i;
1057
1058         if (hw_features == NULL)
1059                 return;
1060
1061         for (i = 0; i < num_hw_features; i++) {
1062                 os_free(hw_features[i].channels);
1063                 os_free(hw_features[i].rates);
1064         }
1065
1066         os_free(hw_features);
1067 }
1068
1069
1070 void wpa_supplicant_sta_rx(void *ctx, const u8 *buf, size_t len,
1071                            struct ieee80211_rx_status *rx_status)
1072 {
1073         struct wpa_priv_interface *iface = ctx;
1074         struct msghdr msg;
1075         struct iovec io[3];
1076         int event = PRIVSEP_EVENT_STA_RX;
1077
1078         wpa_printf(MSG_DEBUG, "STA RX from driver");
1079         io[0].iov_base = &event;
1080         io[0].iov_len = sizeof(event);
1081         io[1].iov_base = (u8 *) rx_status;
1082         io[1].iov_len = sizeof(*rx_status);
1083         io[2].iov_base = (u8 *) buf;
1084         io[2].iov_len = len;
1085
1086         os_memset(&msg, 0, sizeof(msg));
1087         msg.msg_iov = io;
1088         msg.msg_iovlen = 3;
1089         msg.msg_name = &iface->drv_addr;
1090         msg.msg_namelen = sizeof(iface->drv_addr);
1091
1092         if (sendmsg(iface->fd, &msg, 0) < 0)
1093                 perror("sendmsg(wpas_socket)");
1094 }
1095 #endif /* CONFIG_CLIENT_MLME */
1096
1097
1098 static void wpa_priv_terminate(int sig, void *eloop_ctx, void *signal_ctx)
1099 {
1100         wpa_printf(MSG_DEBUG, "wpa_priv termination requested");
1101         eloop_terminate();
1102 }
1103
1104
1105 static void wpa_priv_fd_workaround(void)
1106 {
1107 #ifdef __linux__
1108         int s, i;
1109         /* When started from pcmcia-cs scripts, wpa_supplicant might start with
1110          * fd 0, 1, and 2 closed. This will cause some issues because many
1111          * places in wpa_supplicant are still printing out to stdout. As a
1112          * workaround, make sure that fd's 0, 1, and 2 are not used for other
1113          * sockets. */
1114         for (i = 0; i < 3; i++) {
1115                 s = open("/dev/null", O_RDWR);
1116                 if (s > 2) {
1117                         close(s);
1118                         break;
1119                 }
1120         }
1121 #endif /* __linux__ */
1122 }
1123
1124
1125 static void usage(void)
1126 {
1127         printf("wpa_priv v" VERSION_STR "\n"
1128                "Copyright (c) 2007-2009, Jouni Malinen <j@w1.fi> and "
1129                "contributors\n"
1130                "\n"
1131                "usage:\n"
1132                "  wpa_priv [-Bdd] [-P<pid file>] <driver:ifname> "
1133                "[driver:ifname ...]\n");
1134 }
1135
1136
1137 extern int wpa_debug_level;
1138
1139 int main(int argc, char *argv[])
1140 {
1141         int c, i;
1142         int ret = -1;
1143         char *pid_file = NULL;
1144         int daemonize = 0;
1145         char *ctrl_dir = "/var/run/wpa_priv";
1146         struct wpa_priv_interface *interfaces = NULL, *iface;
1147
1148         if (os_program_init())
1149                 return -1;
1150
1151         wpa_priv_fd_workaround();
1152
1153         for (;;) {
1154                 c = getopt(argc, argv, "Bc:dP:");
1155                 if (c < 0)
1156                         break;
1157                 switch (c) {
1158                 case 'B':
1159                         daemonize++;
1160                         break;
1161                 case 'c':
1162                         ctrl_dir = optarg;
1163                         break;
1164                 case 'd':
1165                         wpa_debug_level--;
1166                         break;
1167                 case 'P':
1168                         pid_file = os_rel2abs_path(optarg);
1169                         break;
1170                 default:
1171                         usage();
1172                         goto out;
1173                 }
1174         }
1175
1176         if (optind >= argc) {
1177                 usage();
1178                 goto out;
1179         }
1180
1181         wpa_printf(MSG_DEBUG, "wpa_priv control directory: '%s'", ctrl_dir);
1182
1183         if (eloop_init(NULL)) {
1184                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
1185                 goto out;
1186         }
1187
1188         for (i = optind; i < argc; i++) {
1189                 wpa_printf(MSG_DEBUG, "Adding driver:interface %s", argv[i]);
1190                 iface = wpa_priv_interface_init(ctrl_dir, argv[i]);
1191                 if (iface == NULL)
1192                         goto out;
1193                 iface->next = interfaces;
1194                 interfaces = iface;
1195         }
1196
1197         if (daemonize && os_daemonize(pid_file))
1198                 goto out;
1199
1200         eloop_register_signal_terminate(wpa_priv_terminate, NULL);
1201         eloop_run();
1202
1203         ret = 0;
1204
1205 out:
1206         iface = interfaces;
1207         while (iface) {
1208                 struct wpa_priv_interface *prev = iface;
1209                 iface = iface->next;
1210                 wpa_priv_interface_deinit(prev);
1211         }
1212
1213         eloop_destroy();
1214
1215         os_daemonize_terminate(pid_file);
1216         os_free(pid_file);
1217         os_program_deinit();
1218
1219         return ret;
1220 }