[thirdparty/iw.git] / scan.c

#include <net/if.h>
#include <errno.h>
#include <string.h>
#include <ctype.h>
#include <stdbool.h>

#include <netlink/genl/genl.h>
#include <netlink/genl/family.h>
#include <netlink/genl/ctrl.h>
#include <netlink/msg.h>
#include <netlink/attr.h>

#include "nl80211.h"
#include "iw.h"

#define WLAN_CAPABILITY_ESS		(1<<0)
#define WLAN_CAPABILITY_IBSS		(1<<1)
#define WLAN_CAPABILITY_CF_POLLABLE	(1<<2)
#define WLAN_CAPABILITY_CF_POLL_REQUEST	(1<<3)
#define WLAN_CAPABILITY_PRIVACY		(1<<4)
#define WLAN_CAPABILITY_SHORT_PREAMBLE	(1<<5)
#define WLAN_CAPABILITY_PBCC		(1<<6)
#define WLAN_CAPABILITY_CHANNEL_AGILITY	(1<<7)
#define WLAN_CAPABILITY_SPECTRUM_MGMT	(1<<8)
#define WLAN_CAPABILITY_QOS		(1<<9)
#define WLAN_CAPABILITY_SHORT_SLOT_TIME	(1<<10)
#define WLAN_CAPABILITY_APSD		(1<<11)
#define WLAN_CAPABILITY_DSSS_OFDM	(1<<13)

static unsigned char wifi_oui[3]      = { 0x00, 0x50, 0xf2 };
static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };

struct scan_params {
	bool unknown;
};

static int handle_scan(struct nl80211_state *state,
		       struct nl_cb *cb,
		       struct nl_msg *msg,
		       int argc, char **argv)
{
	struct nl_msg *ssids = NULL;
	int err = -ENOBUFS;

	ssids = nlmsg_alloc();
	if (!ssids)
		return -ENOMEM;
	NLA_PUT(ssids, 1, 0, "");
	nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);

	err = 0;
 nla_put_failure:
	nlmsg_free(ssids);
	return err;
}
COMMAND(scan, trigger, NULL,
	NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan);

typedef void (*printfn)(unsigned char type, unsigned char len, unsigned char *data);

static void tab_on_first(bool *first)
{
	if (!*first)
		printf("\t");
	else
		*first = false;
}

static void print_ssid(unsigned char type, unsigned char len, unsigned char *data)
{
	int i;
	printf("\tSSID: ");
	for (i=0; i<len; i++) {
		if (isprint(data[i]))
			printf("%c", data[i]);
		else
			printf("\\x%.2x", data[i]);
	}
	printf("\n");
}

static void print_supprates(unsigned char type, unsigned char len, unsigned char *data)
{
	int i;

	if (type == 1)
		printf("\tSupported rates: ");
	else
		printf("\tExtended supported rates: ");

	for (i=0; i<len; i++) {
		int r = data[i] & 0x7f;
		printf("%d.%d%s ", r/2, 5*(r&1), data[i] & 0x80 ? "*":"");
	}
	printf("\n");
}

static void print_ds(unsigned char type, unsigned char len, unsigned char *data)
{
	printf("\tDS Parameter set: channel %d\n", data[0]);
}

static void print_ign(unsigned char type, unsigned char len, unsigned char *data)
{
	/* ignore for now, not too useful */
}

static void print_country(unsigned char type, unsigned char len, unsigned char *data)
{
	int i;

	printf("\tCountry: %.*s", 2, data);
	switch (data[2]) {
	case 'I':
		printf(" (indoor)");
		break;
	case 'O':
		printf(" (outdoor)");
		break;
	case ' ':
		printf(" (in/outdoor)");
		break;
	default:
		printf(" (invalid environment)");
		break;
	}
	printf(", data:");
	for(i=0; i<len-3; i++)
		printf(" %.02x", data[i + 3]);
	printf("\n");
}

static void print_erp(unsigned char type, unsigned char len, unsigned char *data)
{
	if (data[0] == 0x00)
		return;

	printf("\tERP:");
	if (data[0] & 0x01)
		printf(" NonERP_Present");
	if (data[0] & 0x02)
		printf(" Use_Protection");
	if (data[0] & 0x04)
		printf(" Barker_Preamble_Mode");
	printf("\n");
}

static void print_cipher(unsigned char *data)
{
	if (memcmp(data, wifi_oui, 3) == 0) {
		switch (data[3]) {
		case 0x00:
			printf("Use group cipher suite");
			break;
		case 0x01:
			printf("WEP-40");
			break;
		case 0x02:
			printf("TKIP");
			break;
		case 0x04:
			printf("CCMP");
			break;
		case 0x05:
			printf("WEP-104");
			break;
		default:
			printf("Unknown (%.02x-%.02x-%.02x:%d)",
				data[0], data[1] ,data[2], data[3]);
			break;
		}
	} else if (memcmp(data, ieee80211_oui, 3) == 0) {
		switch (data[3]) {
		case 0x00:
			printf("Use group cipher suite");
			break;
		case 0x01:
			printf("WEP-40");
			break;
		case 0x02:
			printf("TKIP");
			break;
		case 0x04:
			printf("CCMP");
			break;
		case 0x05:
			printf("WEP-104");
			break;
		case 0x06:
			printf("AES-128-CMAC");
			break;
		default:
			printf("Unknown (%.02x-%.02x-%.02x:%d)",
				data[0], data[1] ,data[2], data[3]);
			break;
		}
	} else
		printf("Unknown (%.02x-%.02x-%.02x:%d)",
			data[0], data[1] ,data[2], data[3]);
}

static void print_auth(unsigned char *data)
{
	if (memcmp(data, wifi_oui, 3) == 0) {
		switch (data[3]) {
		case 0x01:
			printf("IEEE 802.1X");
			break;
		case 0x02:
			printf("PSK");
			break;
		default:
			printf("Unknown (%.02x-%.02x-%.02x:%d)",
				data[0], data[1] ,data[2], data[3]);
			break;
		}
	} else if (memcmp(data, ieee80211_oui, 3) == 0) {
		switch (data[3]) {
		case 0x01:
			printf("IEEE 802.1X");
			break;
		case 0x02:
			printf("PSK");
			break;
		default:
			printf("Unknown (%.02x-%.02x-%.02x:%d)",
				data[0], data[1] ,data[2], data[3]);
			break;
		}
	} else
		printf("Unknown (%.02x-%.02x-%.02x:%d)",
			data[0], data[1] ,data[2], data[3]);
}

static void print_rsn_ie(const char *ie,
			 const char *defcipher, const char *defauth,
			 unsigned char len, unsigned char *data)
{
	bool first = true;
	__u16 version, count, capa;
	int i;

	printf("\t%s:", ie);

	if (len < 2) {
		printf(" <too short> data:");
		for(i = 0; i < len; i++)
			printf(" %.02x", data[i]);
		printf("\n");
		return;
	}

	version = data[0] + (data[1] << 8);
	tab_on_first(&first);
	printf("\t * Version: %d\n", version);

	data += 2;
	len -= 2;

	if (len < 4) {
		tab_on_first(&first);
		printf("\t * Group cipher: %s\n", defcipher);
		printf("\t * Pairwise ciphers: %s\n", defcipher);
		return;
	}

	tab_on_first(&first);
	printf("\t * Group cipher: ");
	print_cipher(data);
	printf("\n");

	data += 4;
	len -= 4;

	if (len < 2) {
		tab_on_first(&first);
		printf("\t * Pairwise ciphers: %s\n", defcipher);
		return;
	}

	count = data[0] | (data[1] << 8);
	tab_on_first(&first);
	printf("\t * Pairwise ciphers:");
	for (i=0; i<count; i++) {
		printf(" ");
		print_cipher(data + 2 + (i * 4));
	}
	printf("\n");

	data += 2 + (count * 4);
	len -= 2 + (count * 4);

	if (len < 2) {
		tab_on_first(&first);
		printf("\t * Authentication suites: %s\n", defauth);
		return;
	}

	count = data[0] | (data[1] << 8);
	tab_on_first(&first);
	printf("\t * Authentication suites:");
	for (i=0; i<count; i++) {
		printf(" ");
		print_auth(data + 2 + (i * 4));
	}
	printf("\n");

	data += 2 + (count * 4);
	len -= 2 + (count * 4);

	if (len < 2)
		return;

	capa = data[0] | (data[1] << 8);
	tab_on_first(&first);
	printf("\t * Capabilities: 0x%.4x\n", capa);
}

static void print_rsn(unsigned char type, unsigned char len, unsigned char *data)
{
	print_rsn_ie("RSN", "CCMP", "IEEE 802.1X", len, data);
}

static void print_capabilities(unsigned char type, unsigned char len, unsigned char *data)
{
	int i;

	printf("\tExtended capabilties:");
	for(i=0; i<len; i++)
		printf(" %.02x", data[i]);
	printf("\n");
}

static const printfn ieprinters[] = {
	[0] = print_ssid,
	[1] = print_supprates,
	[3] = print_ds,
	[5] = print_ign,
	[7] = print_country,
	[42] = print_erp,
	[48] = print_rsn,
	[50] = print_supprates,
	[127] = print_capabilities,
};

static void print_wifi_wpa(unsigned char type, unsigned char len, unsigned char *data)
{
	print_rsn_ie("WPA", "TKIP", "IEEE 802.1X", len, data);
}

static void print_wifi_wmm(unsigned char type, unsigned char len, unsigned char *data)
{
	int i;

	printf("\tWMM ");
	switch (data[0]) {
	case 0x00:
		printf("information:");
		break;
	case 0x01:
		printf("parameter:");
		break;
	default:
		printf("type %d:", data[0]);
		break;
	}

	for(i=0; i<len-1; i++)
		printf(" %.02x", data[i + 1]);
	printf("\n");
}

static void print_wifi_wps(unsigned char type, unsigned char len, unsigned char *data)
{
	bool first = true;
	__u16 subtype, sublen;

	printf("\tWPS:");

	while (len >= 4) {
		subtype = (data[0] << 8) + data[1];
		sublen = (data[2] << 8) + data[3];
		if (sublen > len)
			break;

		switch (subtype) {
		case 0x104a:
			tab_on_first(&first);
			printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
			break;
		case 0x1011:
			tab_on_first(&first);
			printf("\t * Device name: %.*s\n", sublen, data + 4);
			break;
		case 0x1021:
			tab_on_first(&first);
			printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
			break;
		case 0x1023:
			tab_on_first(&first);
			printf("\t * Model: %.*s\n", sublen, data + 4);
			break;
		case 0x1057: {
			__u16 val = (data[4] << 8) | data[5];
			tab_on_first(&first);
			printf("\t * AP setup locked: 0x%.4x\n", val);
			break;
		}
		case 0x1008: {
			__u16 meth = (data[4] << 8) + data[5];
			bool comma = false;
			tab_on_first(&first);
			printf("\t * Config methods:");
#define T(bit, name) do {		\
	if (meth & (1<<bit)) {		\
		if (comma)		\
			printf(",");	\
		comma = true;		\
		printf(" " name);	\
	} } while (0)
			T(0, "USB");
			T(1, "Ethernet");
			T(2, "Label");
			T(3, "Display");
			T(4, "Ext. NFC");
			T(5, "Int. NFC");
			T(6, "NFC Intf.");
			T(7, "PBC");
			T(8, "Keypad");
			printf("\n");
			break;
#undef T
		}
		default:
			break;
		}

		data += sublen + 4;
		len -= sublen + 4;
	}

	if (len != 0) {
		printf("\t\t * bogus tail data (%d):", len);
		while (len) {
			printf(" %.2x", *data);
			data++;
			len--;
		}
		printf("\n");
	}
}

static const printfn wifiprinters[] = {
	[1] = print_wifi_wpa,
	[2] = print_wifi_wmm,
	[4] = print_wifi_wps,
};

static void print_vendor(unsigned char len, unsigned char *data,
			 struct scan_params *params)
{
	int i;

	if (len < 3) {
		printf("\tVendor specific: <too short> data:");
		for(i = 0; i < len; i++)
			printf(" %.02x", data[i]);
		printf("\n");
		return;
	}

	if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) {
		if (data[3] < ARRAY_SIZE(wifiprinters) && wifiprinters[data[3]])
			return wifiprinters[data[3]](data[3], len - 4, data + 4);
		if (!params->unknown)
			return;
		printf("\tWiFi OUI %#.2x, data:", data[3]);
		for(i = 0; i < len - 4; i++)
			printf(" %.02x", data[i + 4]);
		printf("\n");
		return;
	}

	if (!params->unknown)
		return;

	printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
		data[0], data[1], data[2]);
	for (i = 3; i < len; i++)
		printf(" %.2x", data[i]);
	printf("\n");
}

static void print_ies(unsigned char *ie, int ielen, struct scan_params *params)
{
	while (ielen >= 2 && ielen >= ie[1]) {
		if (ie[0] < ARRAY_SIZE(ieprinters) && ieprinters[ie[0]]) {
			ieprinters[ie[0]](ie[0], ie[1], ie + 2);
		} else if (ie[0] == 221 /* vendor */) {
			print_vendor(ie[1], ie + 2, params);
		} else if (params->unknown) {
			int i;

			printf("\tUnknown IE (%d):", ie[0]);
			for (i=0; i<ie[1]; i++)
				printf(" %.2x", ie[2+i]);
			printf("\n");
		}
		ielen -= ie[1] + 2;
		ie += ie[1] + 2;
	}
}

static int print_bss_handler(struct nl_msg *msg, void *arg)
{
	struct nlattr *tb[NL80211_ATTR_MAX + 1];
	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
	struct nlattr *bss[NL80211_BSS_MAX + 1];
	char mac_addr[20], dev[20];
	static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
		[NL80211_BSS_TSF] = { .type = NLA_U64 },
		[NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
		[NL80211_BSS_BSSID] = { },
		[NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
		[NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
		[NL80211_BSS_INFORMATION_ELEMENTS] = { },
		[NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
		[NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
	};

	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
		  genlmsg_attrlen(gnlh, 0), NULL);

	if (!tb[NL80211_ATTR_BSS]) {
		fprintf(stderr, "bss info missing!");
		return NL_SKIP;
	}
	if (nla_parse_nested(bss, NL80211_BSS_MAX,
			     tb[NL80211_ATTR_BSS],
			     bss_policy)) {
		fprintf(stderr, "failed to parse nested attributes!");
		return NL_SKIP;
	}

	if (!bss[NL80211_BSS_BSSID])
		return NL_SKIP;

	mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
	if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
	printf("BSS %s (on %s)\n", mac_addr, dev);

	if (bss[NL80211_BSS_TSF]) {
		unsigned long long tsf;
		tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
		printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
			tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
			(tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
	}
	if (bss[NL80211_BSS_FREQUENCY])
		printf("\tfreq: %d\n",
			nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
	if (bss[NL80211_BSS_BEACON_INTERVAL])
		printf("\tbeacon interval: %d\n",
			nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
	if (bss[NL80211_BSS_CAPABILITY]) {
		__u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
		printf("\tcapability:");
		if (capa & WLAN_CAPABILITY_ESS)
			printf(" ESS");
		if (capa & WLAN_CAPABILITY_IBSS)
			printf(" IBSS");
		if (capa & WLAN_CAPABILITY_PRIVACY)
			printf(" Privacy");
		if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
			printf(" ShortPreamble");
		if (capa & WLAN_CAPABILITY_PBCC)
			printf(" PBCC");
		if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
			printf(" ChannelAgility");
		if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
			printf(" SpectrumMgmt");
		if (capa & WLAN_CAPABILITY_QOS)
			printf(" QoS");
		if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
			printf(" ShortSlotTime");
		if (capa & WLAN_CAPABILITY_APSD)
			printf(" APSD");
		if (capa & WLAN_CAPABILITY_DSSS_OFDM)
			printf(" DSSS-OFDM");
		printf(" (0x%.4x)\n", capa);
	}
	if (bss[NL80211_BSS_SIGNAL_MBM]) {
		int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
		printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
	}
	if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
		unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
		printf("\tsignal: %d/100\n", s);
	}
	if (bss[NL80211_BSS_INFORMATION_ELEMENTS])
		print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
			  nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
			  arg);

	return NL_SKIP;
}

static struct scan_params scan_params;

static int handle_scan_dump(struct nl80211_state *state,
			    struct nl_cb *cb,
			    struct nl_msg *msg,
			    int argc, char **argv)
{
	if (argc > 1)
		return 1;

	scan_params.unknown = false;
	if (argc == 1 && !strcmp(argv[0], "-u"))
		scan_params.unknown = true;

	nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
		  &scan_params);
	return 0;
}
COMMAND(scan, dump, "[-u]",
	NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump);

static int handle_scan_combined(struct nl80211_state *state,
				struct nl_cb *cb,
				struct nl_msg *msg,
				int argc, char **argv)
{
	static char *trig_argv[] = {
		NULL,
		"scan",
		"trigger",
	};
	static char *dump_argv[] = {
		NULL,
		"scan",
		"dump",
		NULL,
	};
	static const __u32 cmds[] = {
		NL80211_CMD_NEW_SCAN_RESULTS,
		NL80211_CMD_SCAN_ABORTED,
	};
	int dump_argc, err;

	trig_argv[0] = argv[0];
	err = handle_cmd(state, II_NETDEV, ARRAY_SIZE(trig_argv), trig_argv);
	if (err)
		return err;

	/*
	 * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
	 *
	 * This code has a bug, which requires creating a separate
	 * nl80211 socket to fix:
	 * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
	 * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
	 * before (!) we listen to it, because we only start listening
	 * after we send our scan request.
	 *
	 * Doing it the other way around has a race condition as well,
	 * if you first open the events socket you may get a notification
	 * for a previous scan.
	 *
	 * The only proper way to fix this would be to listen to events
	 * before sending the command, and for the kernel to send the
	 * scan request along with the event, so that you can match up
	 * whether the scan you requested was finished or aborted (this
	 * may result in processing a scan that another application
	 * requested, but that doesn't seem to be a problem).
	 *
	 * Alas, the kernel doesn't do that (yet).
	 */

	if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
					NL80211_CMD_SCAN_ABORTED) {
		printf("scan aborted!\n");
		return 0;
	}

	if (argc == 3 && !strcmp(argv[2], "-u")) {
		dump_argc = 4;
		dump_argv[3] = "-u";
	} else
		dump_argc = 3;

	dump_argv[0] = argv[0];
	return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
}
TOPLEVEL(scan, "[-u]", 0, 0, CIB_NETDEV, handle_scan_combined);
Commit	Line	Data
3563f4c5 JB	1	#include <net/if.h>
	2	#include <errno.h>
	3	#include <string.h>
	4	#include <ctype.h>
764fe753	5	#include <stdbool.h>
3563f4c5 JB	6
	7	#include <netlink/genl/genl.h>
	8	#include <netlink/genl/family.h>
	9	#include <netlink/genl/ctrl.h>
	10	#include <netlink/msg.h>
	11	#include <netlink/attr.h>
	12
	13	#include "nl80211.h"
	14	#include "iw.h"
	15
92a04ecd MH	16	#define WLAN_CAPABILITY_ESS (1<<0)
	17	#define WLAN_CAPABILITY_IBSS (1<<1)
	18	#define WLAN_CAPABILITY_CF_POLLABLE (1<<2)
	19	#define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
	20	#define WLAN_CAPABILITY_PRIVACY (1<<4)
	21	#define WLAN_CAPABILITY_SHORT_PREAMBLE (1<<5)
	22	#define WLAN_CAPABILITY_PBCC (1<<6)
	23	#define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
	24	#define WLAN_CAPABILITY_SPECTRUM_MGMT (1<<8)
	25	#define WLAN_CAPABILITY_QOS (1<<9)
	26	#define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
	27	#define WLAN_CAPABILITY_APSD (1<<11)
	28	#define WLAN_CAPABILITY_DSSS_OFDM (1<<13)
	29
857d966e MH	30	static unsigned char wifi_oui[3] = { 0x00, 0x50, 0xf2 };
	31	static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };
	32
764fe753 JB	33	struct scan_params {
	34	bool unknown;
	35	};
	36
7c37a24d JB	37	static int handle_scan(struct nl80211_state *state,
7c37a24d JB	38	struct nl_cb *cb,
3563f4c5 JB	39	struct nl_msg *msg,
	40	int argc, char **argv)
	41	{
	42	struct nl_msg *ssids = NULL;
	43	int err = -ENOBUFS;
	44
	45	ssids = nlmsg_alloc();
	46	if (!ssids)
	47	return -ENOMEM;
	48	NLA_PUT(ssids, 1, 0, "");
	49	nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
	50
	51	err = 0;
	52	nla_put_failure:
	53	nlmsg_free(ssids);
	54	return err;
	55	}
	56	COMMAND(scan, trigger, NULL,
	57	NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan);
	58
	59	typedef void (printfn)(unsigned char type, unsigned char len, unsigned char data);
	60
857d966e MH	61	static void tab_on_first(bool *first)
	62	{
	63	if (!*first)
	64	printf("\t");
	65	else
	66	*first = false;
	67	}
	68
3563f4c5 JB	69	static void print_ssid(unsigned char type, unsigned char len, unsigned char *data)
	70	{
	71	int i;
	72	printf("\tSSID: ");
	73	for (i=0; i<len; i++) {
	74	if (isprint(data[i]))
	75	printf("%c", data[i]);
	76	else
	77	printf("\\x%.2x", data[i]);
	78	}
	79	printf("\n");
	80	}
	81
	82	static void print_supprates(unsigned char type, unsigned char len, unsigned char *data)
	83	{
	84	int i;
	85
	86	if (type == 1)
	87	printf("\tSupported rates: ");
	88	else
	89	printf("\tExtended supported rates: ");
	90
	91	for (i=0; i<len; i++) {
	92	int r = data[i] & 0x7f;
	93	printf("%d.%d%s ", r/2, 5(r&1), data[i] & 0x80 ? "":"");
	94	}
	95	printf("\n");
	96	}
	97
	98	static void print_ds(unsigned char type, unsigned char len, unsigned char *data)
	99	{
	100	printf("\tDS Parameter set: channel %d\n", data[0]);
	101	}
	102
	103	static void print_ign(unsigned char type, unsigned char len, unsigned char *data)
	104	{
	105	/* ignore for now, not too useful */
	106	}
	107
b7e8fa37 MH	108	static void print_country(unsigned char type, unsigned char len, unsigned char *data)
	109	{
	110	int i;
	111
	112	printf("\tCountry: %.*s", 2, data);
	113	switch (data[2]) {
	114	case 'I':
	115	printf(" (indoor)");
	116	break;
	117	case 'O':
	118	printf(" (outdoor)");
	119	break;
b6c0d634 JB	120	case ' ':
	121	printf(" (in/outdoor)");
	122	break;
	123	default:
	124	printf(" (invalid environment)");
	125	break;
b7e8fa37 MH	126	}
	127	printf(", data:");
	128	for(i=0; i<len-3; i++)
	129	printf(" %.02x", data[i + 3]);
	130	printf("\n");
	131	}
	132
fc4d1484 MH	133	static void print_erp(unsigned char type, unsigned char len, unsigned char *data)
	134	{
	135	if (data[0] == 0x00)
	136	return;
	137
	138	printf("\tERP:");
	139	if (data[0] & 0x01)
	140	printf(" NonERP_Present");
	141	if (data[0] & 0x02)
	142	printf(" Use_Protection");
	143	if (data[0] & 0x04)
	144	printf(" Barker_Preamble_Mode");
	145	printf("\n");
	146	}
	147
857d966e MH	148	static void print_cipher(unsigned char *data)
	149	{
	150	if (memcmp(data, wifi_oui, 3) == 0) {
	151	switch (data[3]) {
	152	case 0x00:
	153	printf("Use group cipher suite");
	154	break;
	155	case 0x01:
	156	printf("WEP-40");
	157	break;
	158	case 0x02:
	159	printf("TKIP");
	160	break;
	161	case 0x04:
	162	printf("CCMP");
	163	break;
	164	case 0x05:
	165	printf("WEP-104");
	166	break;
	167	default:
5594fd23 JB	168	printf("Unknown (%.02x-%.02x-%.02x:%d)",
5594fd23 JB	169	data[0], data[1] ,data[2], data[3]);
857d966e MH	170	break;
	171	}
	172	} else if (memcmp(data, ieee80211_oui, 3) == 0) {
	173	switch (data[3]) {
	174	case 0x00:
	175	printf("Use group cipher suite");
	176	break;
	177	case 0x01:
	178	printf("WEP-40");
	179	break;
	180	case 0x02:
	181	printf("TKIP");
	182	break;
	183	case 0x04:
	184	printf("CCMP");
	185	break;
	186	case 0x05:
	187	printf("WEP-104");
	188	break;
	189	case 0x06:
	190	printf("AES-128-CMAC");
	191	break;
	192	default:
5594fd23 JB	193	printf("Unknown (%.02x-%.02x-%.02x:%d)",
5594fd23 JB	194	data[0], data[1] ,data[2], data[3]);
857d966e MH	195	break;
	196	}
	197	} else
5594fd23 JB	198	printf("Unknown (%.02x-%.02x-%.02x:%d)",
5594fd23 JB	199	data[0], data[1] ,data[2], data[3]);
857d966e MH	200	}
	201
	202	static void print_auth(unsigned char *data)
	203	{
	204	if (memcmp(data, wifi_oui, 3) == 0) {
	205	switch (data[3]) {
	206	case 0x01:
	207	printf("IEEE 802.1X");
	208	break;
	209	case 0x02:
	210	printf("PSK");
	211	break;
	212	default:
5594fd23 JB	213	printf("Unknown (%.02x-%.02x-%.02x:%d)",
5594fd23 JB	214	data[0], data[1] ,data[2], data[3]);
857d966e MH	215	break;
	216	}
	217	} else if (memcmp(data, ieee80211_oui, 3) == 0) {
	218	switch (data[3]) {
	219	case 0x01:
	220	printf("IEEE 802.1X");
	221	break;
	222	case 0x02:
	223	printf("PSK");
	224	break;
	225	default:
5594fd23 JB	226	printf("Unknown (%.02x-%.02x-%.02x:%d)",
5594fd23 JB	227	data[0], data[1] ,data[2], data[3]);
857d966e MH	228	break;
	229	}
	230	} else
5594fd23 JB	231	printf("Unknown (%.02x-%.02x-%.02x:%d)",
5594fd23 JB	232	data[0], data[1] ,data[2], data[3]);
857d966e MH	233	}
857d966e MH	234
5594fd23 JB	235	static void print_rsn_ie(const char *ie,
	236	const char defcipher, const char defauth,
	237	unsigned char len, unsigned char *data)
857d966e MH	238	{
	239	bool first = true;
	240	__u16 version, count, capa;
	241	int i;
	242
	243	printf("\t%s:", ie);
	244
	245	if (len < 2) {
	246	printf(" <too short> data:");
	247	for(i = 0; i < len; i++)
	248	printf(" %.02x", data[i]);
	249	printf("\n");
	250	return;
	251	}
	252
	253	version = data[0] + (data[1] << 8);
	254	tab_on_first(&first);
	255	printf("\t * Version: %d\n", version);
	256
	257	data += 2;
	258	len -= 2;
	259
	260	if (len < 4) {
	261	tab_on_first(&first);
	262	printf("\t * Group cipher: %s\n", defcipher);
	263	printf("\t * Pairwise ciphers: %s\n", defcipher);
	264	return;
	265	}
	266
	267	tab_on_first(&first);
	268	printf("\t * Group cipher: ");
	269	print_cipher(data);
	270	printf("\n");
	271
	272	data += 4;
	273	len -= 4;
	274
	275	if (len < 2) {
	276	tab_on_first(&first);
	277	printf("\t * Pairwise ciphers: %s\n", defcipher);
	278	return;
	279	}
	280
	281	count = data[0] \| (data[1] << 8);
	282	tab_on_first(&first);
	283	printf("\t * Pairwise ciphers:");
	284	for (i=0; i<count; i++) {
	285	printf(" ");
	286	print_cipher(data + 2 + (i * 4));
	287	}
	288	printf("\n");
	289
	290	data += 2 + (count * 4);
	291	len -= 2 + (count * 4);
	292
	293	if (len < 2) {
	294	tab_on_first(&first);
	295	printf("\t * Authentication suites: %s\n", defauth);
	296	return;
	297	}
	298
	299	count = data[0] \| (data[1] << 8);
	300	tab_on_first(&first);
	301	printf("\t * Authentication suites:");
302	for (i=0; i<count; i++) {
303	printf(" ");
304	print_auth(data + 2 + (i * 4));
305	}
306	printf("\n");
307
308	data += 2 + (count * 4);
309	len -= 2 + (count * 4);
310
311	if (len < 2)
312	return;
313
314	capa = data[0] \| (data[1] << 8);
315	tab_on_first(&first);
316	printf("\t * Capabilities: 0x%.4x\n", capa);
317	}
318
319	static void print_rsn(unsigned char type, unsigned char len, unsigned char *data)
320	{
5594fd23	321	print_rsn_ie("RSN", "CCMP", "IEEE 802.1X", len, data);
857d966e MH	322	}
857d966e MH	323
9b880b00 MH	324	static void print_capabilities(unsigned char type, unsigned char len, unsigned char *data)
	325	{
	326	int i;
	327
	328	printf("\tExtended capabilties:");
	329	for(i=0; i<len; i++)
	330	printf(" %.02x", data[i]);
	331	printf("\n");
	332	}
	333
764fe753 JB	334	static const printfn ieprinters[] = {
	335	[0] = print_ssid,
	336	[1] = print_supprates,
	337	[3] = print_ds,
	338	[5] = print_ign,
b7e8fa37	339	[7] = print_country,
fc4d1484	340	[42] = print_erp,
857d966e	341	[48] = print_rsn,
764fe753	342	[50] = print_supprates,
9b880b00	343	[127] = print_capabilities,
764fe753 JB	344	};
764fe753 JB	345
857d966e	346	static void print_wifi_wpa(unsigned char type, unsigned char len, unsigned char *data)
4673a894	347	{
5594fd23	348	print_rsn_ie("WPA", "TKIP", "IEEE 802.1X", len, data);
4673a894 JB	349	}
4673a894 JB	350
6ff0c93a MH	351	static void print_wifi_wmm(unsigned char type, unsigned char len, unsigned char *data)
	352	{
	353	int i;
	354
	355	printf("\tWMM ");
	356	switch (data[0]) {
	357	case 0x00:
	358	printf("information:");
	359	break;
	360	case 0x01:
	361	printf("parameter:");
	362	break;
	363	default:
	364	printf("type %d:", data[0]);
	365	break;
	366	}
	367
	368	for(i=0; i<len-1; i++)
	369	printf(" %.02x", data[i + 1]);
	370	printf("\n");
	371	}
	372
4673a894 JB	373	static void print_wifi_wps(unsigned char type, unsigned char len, unsigned char *data)
	374	{
	375	bool first = true;
	376	__u16 subtype, sublen;
	377
	378	printf("\tWPS:");
	379
	380	while (len >= 4) {
	381	subtype = (data[0] << 8) + data[1];
	382	sublen = (data[2] << 8) + data[3];
	383	if (sublen > len)
	384	break;
	385
	386	switch (subtype) {
	387	case 0x104a:
	388	tab_on_first(&first);
dffc6750	389	printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
4673a894 JB	390	break;
	391	case 0x1011:
	392	tab_on_first(&first);
	393	printf("\t * Device name: %.*s\n", sublen, data + 4);
	394	break;
	395	case 0x1021:
	396	tab_on_first(&first);
	397	printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
	398	break;
	399	case 0x1023:
	400	tab_on_first(&first);
	401	printf("\t * Model: %.*s\n", sublen, data + 4);
	402	break;
7ee5a865 JB	403	case 0x1057: {
	404	__u16 val = (data[4] << 8) \| data[5];
	405	tab_on_first(&first);
	406	printf("\t * AP setup locked: 0x%.4x\n", val);
	407	break;
	408	}
4673a894 JB	409	case 0x1008: {
	410	__u16 meth = (data[4] << 8) + data[5];
	411	bool comma = false;
	412	tab_on_first(&first);
	413	printf("\t * Config methods:");
	414	#define T(bit, name) do { \
	415	if (meth & (1<<bit)) { \
	416	if (comma) \
	417	printf(","); \
	418	comma = true; \
	419	printf(" " name); \
	420	} } while (0)
	421	T(0, "USB");
	422	T(1, "Ethernet");
	423	T(2, "Label");
	424	T(3, "Display");
	425	T(4, "Ext. NFC");
	426	T(5, "Int. NFC");
	427	T(6, "NFC Intf.");
	428	T(7, "PBC");
	429	T(8, "Keypad");
	430	printf("\n");
	431	break;
	432	#undef T
	433	}
	434	default:
	435	break;
	436	}
	437
	438	data += sublen + 4;
	439	len -= sublen + 4;
	440	}
	441
	442	if (len != 0) {
	443	printf("\t\t * bogus tail data (%d):", len);
	444	while (len) {
	445	printf(" %.2x", *data);
	446	data++;
	447	len--;
	448	}
	449	printf("\n");
	450	}
	451	}
	452
	453	static const printfn wifiprinters[] = {
857d966e	454	[1] = print_wifi_wpa,
6ff0c93a	455	[2] = print_wifi_wmm,
4673a894 JB	456	[4] = print_wifi_wps,
	457	};
	458
764fe753 JB	459	static void print_vendor(unsigned char len, unsigned char *data,
764fe753 JB	460	struct scan_params *params)
3563f4c5 JB	461	{
	462	int i;
	463
fbf80af5	464	if (len < 3) {
4673a894	465	printf("\tVendor specific: <too short> data:");
fbf80af5 JB	466	for(i = 0; i < len; i++)
	467	printf(" %.02x", data[i]);
	468	printf("\n");
	469	return;
	470	}
	471
857d966e	472	if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) {
4673a894 JB	473	if (data[3] < ARRAY_SIZE(wifiprinters) && wifiprinters[data[3]])
	474	return wifiprinters[data[3]](data[3], len - 4, data + 4);
	475	if (!params->unknown)
	476	return;
857d966e	477	printf("\tWiFi OUI %#.2x, data:", data[3]);
4673a894 JB	478	for(i = 0; i < len - 4; i++)
	479	printf(" %.02x", data[i + 4]);
	480	printf("\n");
	481	return;
	482	}
	483
764fe753 JB	484	if (!params->unknown)
	485	return;
	486
fbf80af5	487	printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
3563f4c5	488	data[0], data[1], data[2]);
fbf80af5 JB	489	for (i = 3; i < len; i++)
fbf80af5 JB	490	printf(" %.2x", data[i]);
3563f4c5 JB	491	printf("\n");
	492	}
	493
764fe753	494	static void print_ies(unsigned char ie, int ielen, struct scan_params params)
3563f4c5 JB	495	{
3563f4c5 JB	496	while (ielen >= 2 && ielen >= ie[1]) {
97ebbaf5	497	if (ie[0] < ARRAY_SIZE(ieprinters) && ieprinters[ie[0]]) {
3563f4c5	498	ieprinters[ie[0]](ie[0], ie[1], ie + 2);
764fe753 JB	499	} else if (ie[0] == 221 /* vendor */) {
	500	print_vendor(ie[1], ie + 2, params);
	501	} else if (params->unknown) {
3563f4c5 JB	502	int i;
3563f4c5 JB	503
8086b700	504	printf("\tUnknown IE (%d):", ie[0]);
3563f4c5	505	for (i=0; i<ie[1]; i++)
8086b700	506	printf(" %.2x", ie[2+i]);
3563f4c5 JB	507	printf("\n");
	508	}
	509	ielen -= ie[1] + 2;
	510	ie += ie[1] + 2;
	511	}
	512	}
	513
	514	static int print_bss_handler(struct nl_msg msg, void arg)
	515	{
	516	struct nlattr *tb[NL80211_ATTR_MAX + 1];
	517	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
	518	struct nlattr *bss[NL80211_BSS_MAX + 1];
	519	char mac_addr[20], dev[20];
	520	static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
	521	[NL80211_BSS_TSF] = { .type = NLA_U64 },
	522	[NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
	523	[NL80211_BSS_BSSID] = { },
	524	[NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
	525	[NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
	526	[NL80211_BSS_INFORMATION_ELEMENTS] = { },
f2e17e1f JB	527	[NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
f2e17e1f JB	528	[NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
3563f4c5 JB	529	};
	530
	531	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
	532	genlmsg_attrlen(gnlh, 0), NULL);
	533
	534	if (!tb[NL80211_ATTR_BSS]) {
	535	fprintf(stderr, "bss info missing!");
	536	return NL_SKIP;
	537	}
	538	if (nla_parse_nested(bss, NL80211_BSS_MAX,
	539	tb[NL80211_ATTR_BSS],
	540	bss_policy)) {
	541	fprintf(stderr, "failed to parse nested attributes!");
	542	return NL_SKIP;
	543	}
	544
	545	if (!bss[NL80211_BSS_BSSID])
	546	return NL_SKIP;
	547
	548	mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
	549	if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
	550	printf("BSS %s (on %s)\n", mac_addr, dev);
	551
e7109a8a JB	552	if (bss[NL80211_BSS_TSF]) {
	553	unsigned long long tsf;
	554	tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
	555	printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
	556	tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
	557	(tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
	558	}
3563f4c5 JB	559	if (bss[NL80211_BSS_FREQUENCY])
	560	printf("\tfreq: %d\n",
	561	nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
	562	if (bss[NL80211_BSS_BEACON_INTERVAL])
	563	printf("\tbeacon interval: %d\n",
	564	nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
92a04ecd MH	565	if (bss[NL80211_BSS_CAPABILITY]) {
	566	__u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
	567	printf("\tcapability:");
	568	if (capa & WLAN_CAPABILITY_ESS)
	569	printf(" ESS");
	570	if (capa & WLAN_CAPABILITY_IBSS)
	571	printf(" IBSS");
	572	if (capa & WLAN_CAPABILITY_PRIVACY)
	573	printf(" Privacy");
	574	if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
	575	printf(" ShortPreamble");
	576	if (capa & WLAN_CAPABILITY_PBCC)
	577	printf(" PBCC");
	578	if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
	579	printf(" ChannelAgility");
	580	if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
	581	printf(" SpectrumMgmt");
	582	if (capa & WLAN_CAPABILITY_QOS)
	583	printf(" QoS");
	584	if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
	585	printf(" ShortSlotTime");
	586	if (capa & WLAN_CAPABILITY_APSD)
	587	printf(" APSD");
	588	if (capa & WLAN_CAPABILITY_DSSS_OFDM)
	589	printf(" DSSS-OFDM");
	590	printf(" (0x%.4x)\n", capa);
	591	}
f2e17e1f JB	592	if (bss[NL80211_BSS_SIGNAL_MBM]) {
	593	int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
	594	printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
	595	}
	596	if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
	597	unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
	598	printf("\tsignal: %d/100\n", s);
	599	}
3563f4c5 JB	600	if (bss[NL80211_BSS_INFORMATION_ELEMENTS])
3563f4c5 JB	601	print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
764fe753 JB	602	nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
764fe753 JB	603	arg);
3563f4c5 JB	604
	605	return NL_SKIP;
	606	}
	607
764fe753	608	static struct scan_params scan_params;
3563f4c5	609
7c37a24d JB	610	static int handle_scan_dump(struct nl80211_state *state,
7c37a24d JB	611	struct nl_cb *cb,
3563f4c5 JB	612	struct nl_msg *msg,
	613	int argc, char **argv)
	614	{
764fe753 JB	615	if (argc > 1)
	616	return 1;
	617
	618	scan_params.unknown = false;
	619	if (argc == 1 && !strcmp(argv[0], "-u"))
	620	scan_params.unknown = true;
	621
	622	nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
	623	&scan_params);
3563f4c5 JB	624	return 0;
3563f4c5 JB	625	}
764fe753	626	COMMAND(scan, dump, "[-u]",
3563f4c5	627	NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump);
a5fe4ef2 JB	628
	629	static int handle_scan_combined(struct nl80211_state *state,
	630	struct nl_cb *cb,
	631	struct nl_msg *msg,
	632	int argc, char **argv)
	633	{
	634	static char *trig_argv[] = {
	635	NULL,
	636	"scan",
	637	"trigger",
	638	};
	639	static char *dump_argv[] = {
	640	NULL,
	641	"scan",
	642	"dump",
92649eab	643	NULL,
a5fe4ef2 JB	644	};
	645	static const __u32 cmds[] = {
	646	NL80211_CMD_NEW_SCAN_RESULTS,
	647	NL80211_CMD_SCAN_ABORTED,
	648	};
92649eab	649	int dump_argc, err;
a5fe4ef2 JB	650
	651	trig_argv[0] = argv[0];
	652	err = handle_cmd(state, II_NETDEV, ARRAY_SIZE(trig_argv), trig_argv);
	653	if (err)
	654	return err;
	655
61725dbe JB	656	/*
	657	* WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
	658	*
	659	* This code has a bug, which requires creating a separate
	660	* nl80211 socket to fix:
	661	* It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
	662	* NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
	663	* before (!) we listen to it, because we only start listening
	664	* after we send our scan request.
	665	*
	666	* Doing it the other way around has a race condition as well,
	667	* if you first open the events socket you may get a notification
	668	* for a previous scan.
	669	*
	670	* The only proper way to fix this would be to listen to events
	671	* before sending the command, and for the kernel to send the
	672	* scan request along with the event, so that you can match up
	673	* whether the scan you requested was finished or aborted (this
	674	* may result in processing a scan that another application
	675	* requested, but that doesn't seem to be a problem).
	676	*
	677	* Alas, the kernel doesn't do that (yet).
	678	*/
	679
a5fe4ef2 JB	680	if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
	681	NL80211_CMD_SCAN_ABORTED) {
	682	printf("scan aborted!\n");
	683	return 0;
	684	}
	685
92649eab MH	686	if (argc == 3 && !strcmp(argv[2], "-u")) {
	687	dump_argc = 4;
	688	dump_argv[3] = "-u";
	689	} else
	690	dump_argc = 3;
	691
a5fe4ef2	692	dump_argv[0] = argv[0];
92649eab	693	return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
a5fe4ef2	694	}
92649eab	695	TOPLEVEL(scan, "[-u]", 0, 0, CIB_NETDEV, handle_scan_combined);