]> git.ipfire.org Git - thirdparty/iw.git/blame - scan.c
fix number parsing bugs
[thirdparty/iw.git] / scan.c
CommitLineData
3563f4c5
JB
1#include <net/if.h>
2#include <errno.h>
3#include <string.h>
4#include <ctype.h>
764fe753 5#include <stdbool.h>
3563f4c5
JB
6
7#include <netlink/genl/genl.h>
8#include <netlink/genl/family.h>
9#include <netlink/genl/ctrl.h>
10#include <netlink/msg.h>
11#include <netlink/attr.h>
12
13#include "nl80211.h"
14#include "iw.h"
15
92a04ecd
MH
16#define WLAN_CAPABILITY_ESS (1<<0)
17#define WLAN_CAPABILITY_IBSS (1<<1)
18#define WLAN_CAPABILITY_CF_POLLABLE (1<<2)
19#define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
20#define WLAN_CAPABILITY_PRIVACY (1<<4)
21#define WLAN_CAPABILITY_SHORT_PREAMBLE (1<<5)
22#define WLAN_CAPABILITY_PBCC (1<<6)
23#define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
24#define WLAN_CAPABILITY_SPECTRUM_MGMT (1<<8)
25#define WLAN_CAPABILITY_QOS (1<<9)
26#define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
27#define WLAN_CAPABILITY_APSD (1<<11)
28#define WLAN_CAPABILITY_DSSS_OFDM (1<<13)
29
857d966e
MH
30static unsigned char wifi_oui[3] = { 0x00, 0x50, 0xf2 };
31static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };
32
764fe753
JB
33struct scan_params {
34 bool unknown;
febeb0c0 35 enum print_ie_type type;
575280cc 36 bool show_both_ie_sets;
764fe753
JB
37};
38
2b690f0a
LR
39#define IEEE80211_COUNTRY_EXTENSION_ID 201
40
41struct ieee80211_country_ie_triplet {
42 union {
43 struct {
44 __u8 first_channel;
45 __u8 num_channels;
46 __s8 max_power;
47 } __attribute__ ((packed)) chans;
48 struct {
49 __u8 reg_extension_id;
50 __u8 reg_class;
51 __u8 coverage_class;
52 } __attribute__ ((packed)) ext;
53 };
54} __attribute__ ((packed));
55
7c37a24d
JB
56static int handle_scan(struct nl80211_state *state,
57 struct nl_cb *cb,
3563f4c5
JB
58 struct nl_msg *msg,
59 int argc, char **argv)
60{
559a1713
JB
61 struct nl_msg *ssids = NULL, *freqs = NULL;
62 char *eptr;
3563f4c5 63 int err = -ENOBUFS;
559a1713
JB
64 int i;
65 enum {
66 NONE,
67 FREQ,
64797a7f 68 IES,
559a1713
JB
69 SSID,
70 DONE,
71 } parse = NONE;
72 int freq;
73 bool passive = false, have_ssids = false, have_freqs = false;
64797a7f
JB
74 size_t tmp;
75 unsigned char *ies;
3563f4c5
JB
76
77 ssids = nlmsg_alloc();
78 if (!ssids)
79 return -ENOMEM;
559a1713
JB
80
81 freqs = nlmsg_alloc();
82 if (!freqs) {
83 nlmsg_free(ssids);
84 return -ENOMEM;
85 }
86
87 for (i = 0; i < argc; i++) {
559a1713
JB
88 switch (parse) {
89 case NONE:
64797a7f
JB
90 if (strcmp(argv[i], "freq") == 0) {
91 parse = FREQ;
92 have_freqs = true;
93 break;
94 } else if (strcmp(argv[i], "ies") == 0) {
95 parse = IES;
96 break;
97 } else if (strcmp(argv[i], "ssid") == 0) {
98 parse = SSID;
99 have_ssids = true;
100 break;
101 } else if (strcmp(argv[i], "passive") == 0) {
102 parse = DONE;
103 passive = true;
104 break;
105 }
559a1713
JB
106 case DONE:
107 return 1;
108 case FREQ:
109 freq = strtoul(argv[i], &eptr, 10);
110 if (eptr != argv[i] + strlen(argv[i]))
111 return 1;
112 NLA_PUT_U32(freqs, i, freq);
64797a7f
JB
113 parse = NONE;
114 break;
115 case IES:
116 ies = parse_hex(argv[i], &tmp);
117 if (!ies)
118 goto nla_put_failure;
119 NLA_PUT(msg, NL80211_ATTR_IE, tmp, ies);
120 free(ies);
121 parse = NONE;
559a1713
JB
122 break;
123 case SSID:
124 NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
125 break;
126 }
127 }
128
129 if (!have_ssids)
130 NLA_PUT(ssids, 1, 0, "");
131 if (!passive)
132 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
133
134 if (have_freqs)
135 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
3563f4c5
JB
136
137 err = 0;
138 nla_put_failure:
139 nlmsg_free(ssids);
559a1713 140 nlmsg_free(freqs);
3563f4c5
JB
141 return err;
142}
3563f4c5 143
857d966e
MH
144static void tab_on_first(bool *first)
145{
146 if (!*first)
147 printf("\t");
148 else
149 *first = false;
150}
151
83b4934c 152static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
3563f4c5 153{
83b4934c 154 printf(" ");
748f8489 155 print_ssid_escaped(len, data);
3563f4c5
JB
156 printf("\n");
157}
158
83b4934c 159static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
3563f4c5
JB
160{
161 int i;
162
83b4934c 163 printf(" ");
3563f4c5 164
83b4934c 165 for (i = 0; i < len; i++) {
3563f4c5
JB
166 int r = data[i] & 0x7f;
167 printf("%d.%d%s ", r/2, 5*(r&1), data[i] & 0x80 ? "*":"");
168 }
169 printf("\n");
170}
171
83b4934c 172static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
3563f4c5 173{
83b4934c 174 printf(" channel %d\n", data[0]);
3563f4c5
JB
175}
176
2b690f0a 177static const char *country_env_str(char environment)
b7e8fa37 178{
2b690f0a 179 switch (environment) {
b7e8fa37 180 case 'I':
2b690f0a 181 return "Indoor only";
b7e8fa37 182 case 'O':
2b690f0a 183 return "Outdoor only";
b6c0d634 184 case ' ':
2b690f0a 185 return "Indoor/Outdoor";
b6c0d634 186 default:
2b690f0a 187 return "bogus";
b7e8fa37 188 }
2b690f0a
LR
189}
190
191static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
192{
193 printf(" %.*s", 2, data);
194
195 printf("\tEnvironment: %s\n", country_env_str(data[2]));
196
197 data += 3;
198 len -= 3;
199
200 if (len < 3) {
201 printf("\t\tNo country IE triplets present\n");
202 return;
203 }
204
205 while (len >= 3) {
206 int end_channel;
207 struct ieee80211_country_ie_triplet *triplet =
208 (struct ieee80211_country_ie_triplet *) data;
209
210 if (triplet->ext.reg_extension_id >= IEEE80211_COUNTRY_EXTENSION_ID) {
211 printf("\t\tExtension ID: %d Regulatory Class: %d Coverage class: %d (up to %dm)\n",
212 triplet->ext.reg_extension_id,
213 triplet->ext.reg_class,
214 triplet->ext.coverage_class,
215 triplet->ext.coverage_class * 450);
216
217 data += 3;
218 len -= 3;
219 continue;
220 }
221
222 /* 2 GHz */
223 if (triplet->chans.first_channel <= 14)
224 end_channel = triplet->chans.first_channel + (triplet->chans.num_channels - 1);
225 else
226 end_channel = triplet->chans.first_channel + (4 * (triplet->chans.num_channels - 1));
227
228 printf("\t\tChannels [%d - %d]\n", triplet->chans.first_channel, end_channel);
229
230 data += 3;
231 len -= 3;
232 }
233
234 return;
b7e8fa37
MH
235}
236
d1563a1b
MH
237static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
238{
239 printf(" %d dB\n", data[0]);
240}
241
83b4934c 242static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
fc4d1484
MH
243{
244 if (data[0] == 0x00)
83b4934c 245 printf(" <no flags>");
fc4d1484
MH
246 if (data[0] & 0x01)
247 printf(" NonERP_Present");
248 if (data[0] & 0x02)
249 printf(" Use_Protection");
250 if (data[0] & 0x04)
251 printf(" Barker_Preamble_Mode");
252 printf("\n");
253}
254
83b4934c 255static void print_cipher(const uint8_t *data)
857d966e
MH
256{
257 if (memcmp(data, wifi_oui, 3) == 0) {
258 switch (data[3]) {
510e0e2f 259 case 0:
857d966e
MH
260 printf("Use group cipher suite");
261 break;
510e0e2f 262 case 1:
857d966e
MH
263 printf("WEP-40");
264 break;
510e0e2f 265 case 2:
857d966e
MH
266 printf("TKIP");
267 break;
510e0e2f 268 case 4:
857d966e
MH
269 printf("CCMP");
270 break;
510e0e2f 271 case 5:
857d966e
MH
272 printf("WEP-104");
273 break;
274 default:
332769c6 275 printf("%.02x-%.02x-%.02x:%d",
5594fd23 276 data[0], data[1] ,data[2], data[3]);
857d966e
MH
277 break;
278 }
279 } else if (memcmp(data, ieee80211_oui, 3) == 0) {
280 switch (data[3]) {
510e0e2f 281 case 0:
857d966e
MH
282 printf("Use group cipher suite");
283 break;
510e0e2f 284 case 1:
857d966e
MH
285 printf("WEP-40");
286 break;
510e0e2f 287 case 2:
857d966e
MH
288 printf("TKIP");
289 break;
510e0e2f 290 case 4:
857d966e
MH
291 printf("CCMP");
292 break;
510e0e2f 293 case 5:
857d966e
MH
294 printf("WEP-104");
295 break;
510e0e2f 296 case 6:
857d966e
MH
297 printf("AES-128-CMAC");
298 break;
299 default:
332769c6 300 printf("%.02x-%.02x-%.02x:%d",
5594fd23 301 data[0], data[1] ,data[2], data[3]);
857d966e
MH
302 break;
303 }
304 } else
332769c6 305 printf("%.02x-%.02x-%.02x:%d",
5594fd23 306 data[0], data[1] ,data[2], data[3]);
857d966e
MH
307}
308
83b4934c 309static void print_auth(const uint8_t *data)
857d966e
MH
310{
311 if (memcmp(data, wifi_oui, 3) == 0) {
312 switch (data[3]) {
510e0e2f 313 case 1:
857d966e
MH
314 printf("IEEE 802.1X");
315 break;
510e0e2f 316 case 2:
857d966e
MH
317 printf("PSK");
318 break;
319 default:
332769c6 320 printf("%.02x-%.02x-%.02x:%d",
5594fd23 321 data[0], data[1] ,data[2], data[3]);
857d966e
MH
322 break;
323 }
324 } else if (memcmp(data, ieee80211_oui, 3) == 0) {
325 switch (data[3]) {
510e0e2f 326 case 1:
857d966e
MH
327 printf("IEEE 802.1X");
328 break;
510e0e2f 329 case 2:
857d966e
MH
330 printf("PSK");
331 break;
0fe1c415
JB
332 case 3:
333 printf("FT/IEEE 802.1X");
334 break;
335 case 4:
336 printf("FT/PSK");
337 break;
338 case 5:
339 printf("IEEE 802.1X/SHA-256");
340 break;
341 case 6:
342 printf("PSK/SHA-256");
343 break;
857d966e 344 default:
332769c6 345 printf("%.02x-%.02x-%.02x:%d",
5594fd23 346 data[0], data[1] ,data[2], data[3]);
857d966e
MH
347 break;
348 }
349 } else
332769c6 350 printf("%.02x-%.02x-%.02x:%d",
5594fd23 351 data[0], data[1] ,data[2], data[3]);
857d966e
MH
352}
353
83b4934c
JB
354static void print_rsn_ie(const char *defcipher, const char *defauth,
355 uint8_t len, const uint8_t *data)
857d966e
MH
356{
357 bool first = true;
358 __u16 version, count, capa;
359 int i;
360
857d966e
MH
361 version = data[0] + (data[1] << 8);
362 tab_on_first(&first);
363 printf("\t * Version: %d\n", version);
364
365 data += 2;
366 len -= 2;
367
368 if (len < 4) {
369 tab_on_first(&first);
370 printf("\t * Group cipher: %s\n", defcipher);
371 printf("\t * Pairwise ciphers: %s\n", defcipher);
372 return;
373 }
374
375 tab_on_first(&first);
376 printf("\t * Group cipher: ");
377 print_cipher(data);
378 printf("\n");
379
380 data += 4;
381 len -= 4;
382
383 if (len < 2) {
384 tab_on_first(&first);
385 printf("\t * Pairwise ciphers: %s\n", defcipher);
386 return;
387 }
388
389 count = data[0] | (data[1] << 8);
31d477fb
MH
390 if (2 + (count * 4) > len)
391 goto invalid;
392
857d966e
MH
393 tab_on_first(&first);
394 printf("\t * Pairwise ciphers:");
31d477fb 395 for (i = 0; i < count; i++) {
857d966e
MH
396 printf(" ");
397 print_cipher(data + 2 + (i * 4));
398 }
399 printf("\n");
400
401 data += 2 + (count * 4);
402 len -= 2 + (count * 4);
403
404 if (len < 2) {
405 tab_on_first(&first);
406 printf("\t * Authentication suites: %s\n", defauth);
407 return;
408 }
409
410 count = data[0] | (data[1] << 8);
31d477fb
MH
411 if (2 + (count * 4) > len)
412 goto invalid;
413
857d966e
MH
414 tab_on_first(&first);
415 printf("\t * Authentication suites:");
83b4934c 416 for (i = 0; i < count; i++) {
857d966e
MH
417 printf(" ");
418 print_auth(data + 2 + (i * 4));
419 }
420 printf("\n");
421
422 data += 2 + (count * 4);
423 len -= 2 + (count * 4);
424
6a4f24e8
JB
425 if (len >= 2) {
426 capa = data[0] | (data[1] << 8);
427 tab_on_first(&first);
cadbe89a
JB
428 printf("\t * Capabilities:");
429 if (capa & 0x0001)
430 printf(" PreAuth");
431 if (capa & 0x0002)
432 printf(" NoPairwise");
433 switch ((capa & 0x000c) >> 2) {
434 case 0:
435 break;
436 case 1:
437 printf(" 2-PTKSA-RC");
438 break;
439 case 2:
440 printf(" 4-PTKSA-RC");
441 break;
442 case 3:
443 printf(" 16-PTKSA-RC");
444 break;
445 }
446 switch ((capa & 0x0030) >> 4) {
447 case 0:
448 break;
449 case 1:
450 printf(" 2-GTKSA-RC");
451 break;
452 case 2:
453 printf(" 4-GTKSA-RC");
454 break;
455 case 3:
456 printf(" 16-GTKSA-RC");
457 break;
458 }
459 if (capa & 0x0040)
460 printf(" MFP-required");
461 if (capa & 0x0080)
462 printf(" MFP-capable");
463 if (capa & 0x0200)
464 printf(" Peerkey-enabled");
465 if (capa & 0x0400)
466 printf(" SPP-AMSDU-capable");
467 if (capa & 0x0800)
468 printf(" SPP-AMSDU-required");
469 printf(" (0x%.4x)\n", capa);
6a4f24e8
JB
470 data += 2;
471 len -= 2;
472 }
31d477fb 473
cadbe89a 474 invalid:
31d477fb
MH
475 if (len != 0) {
476 printf("\t\t * bogus tail data (%d):", len);
477 while (len) {
478 printf(" %.2x", *data);
479 data++;
480 len--;
481 }
482 printf("\n");
483 }
857d966e
MH
484}
485
83b4934c 486static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
857d966e 487{
83b4934c 488 print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
857d966e
MH
489}
490
0c445c24
LR
491static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
492{
0c445c24
LR
493 if (len != 26) {
494 printf("\n\t\tHT Capability IE len != expected 26 bytes, skipping parse\n");
495 return;
496 }
357c1a5d 497 printf("\n");
7ddfb679
JB
498 print_ht_capability(data[0] | (data[1] << 8));
499 print_ampdu_length(data[2] & 3);
500 print_ampdu_spacing((data[2] >> 2) & 3);
501 print_ht_mcs(data + 3);
0c445c24
LR
502}
503
83b4934c 504static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
9b880b00 505{
31d2d259
JB
506 int i, base, bit;
507 bool first = true;
508
509
510 for (i = 0; i < len; i++) {
511 base = i * 8;
512
513 for (bit = 0; bit < 8; bit++) {
514 if (!(data[i] & (1 << bit)))
515 continue;
516
517 if (!first)
518 printf(",");
519 else
520 first = false;
521
522 switch (bit + base) {
523 case 0:
524 printf(" HT Information Exchange Supported");
525 break;
526 case 1:
527 printf(" On-demand Beacon");
528 break;
529 case 2:
530 printf(" Extended Channel Switching");
531 break;
532 case 3:
533 printf(" Wave Indication");
534 break;
535 case 4:
536 printf(" PSMP Capability");
537 break;
538 case 5:
539 printf(" Service Interval Granularity");
540 break;
541 case 6:
542 printf(" S-PSMP Capability");
543 break;
544 default:
545 printf(" %d", bit);
546 break;
547 }
548 }
549 }
9b880b00 550
9b880b00
MH
551 printf("\n");
552}
553
575280cc
JM
554static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data)
555{
556 printf(" DTIM Count %u DTIM Period %u Bitmap Control 0x%x "
557 "Bitmap[0] 0x%x",
558 data[0], data[1], data[2], data[3]);
559 if (len - 4)
560 printf(" (+ %u octet%s)", len - 4, len - 4 == 1 ? "" : "s");
561 printf("\n");
562}
563
83b4934c
JB
564struct ie_print {
565 const char *name;
566 void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
567 uint8_t minlen, maxlen;
febeb0c0 568 uint8_t flags;
764fe753
JB
569};
570
83b4934c
JB
571static void print_ie(const struct ie_print *p, const uint8_t type,
572 uint8_t len, const uint8_t *data)
4673a894 573{
83b4934c
JB
574 int i;
575
576 if (!p->print)
577 return;
578
579 printf("\t%s:", p->name);
580 if (len < p->minlen || len > p->maxlen) {
581 if (len > 1) {
582 printf(" <invalid: %d bytes:", len);
583 for (i = 0; i < len; i++)
584 printf(" %.02x", data[i]);
585 printf(">\n");
586 } else if (len)
587 printf(" <invalid: 1 byte: %.02x>\n", data[0]);
588 else
589 printf(" <invalid: no data>\n");
590 return;
591 }
592
593 p->print(type, len, data);
594}
595
596#define PRINT_IGN { \
597 .name = "IGNORE", \
598 .print = NULL, \
599 .minlen = 0, \
600 .maxlen = 255, \
4673a894
JB
601}
602
83b4934c 603static const struct ie_print ieprinters[] = {
febeb0c0
JB
604 [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
605 [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
014d581a 606 [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
575280cc 607 [5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), },
febeb0c0
JB
608 [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
609 [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
610 [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
0c445c24 611 [45] = { "HT capabilities", print_ht_capa, 1, 255, BIT(PRINT_SCAN), },
febeb0c0
JB
612 [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
613 [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
614 [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
83b4934c
JB
615};
616
617static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
618{
619 print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
620}
621
1cab57eb
JB
622static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
623{
624 int i;
625 static const char *aci_tbl[] = { "BE", "BK", "VI", "VO" };
626
627 if (len < 19)
628 goto invalid;
629
630 if (data[0] != 1) {
cee4fe20 631 printf("Parameter: not version 1: ");
1cab57eb
JB
632 return false;
633 }
634
89ea706f 635 printf("\t * Parameter version 1");
1cab57eb
JB
636
637 data++;
638
639 if (data[0] & 0x80)
89ea706f 640 printf("\n\t\t * u-APSD");
1cab57eb
JB
641
642 data += 2;
643
644 for (i = 0; i < 4; i++) {
89ea706f 645 printf("\n\t\t * %s:", aci_tbl[(data[0] >> 5) & 3]);
1cab57eb
JB
646 if (data[4] & 0x10)
647 printf(" acm");
648 printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1,
649 (1 << (data[1] >> 4)) - 1);
a2a4c265 650 printf(", AIFSN %d", data[0] & 0xf);
1cab57eb 651 if (data[2] | data[3])
cee4fe20 652 printf(", TXOP %d usec", (data[2] + (data[3] << 8)) * 32);
1cab57eb
JB
653 data += 4;
654 }
655
656 printf("\n");
657 return true;
658
659 invalid:
660 printf("invalid: ");
661 return false;
662}
663
83b4934c 664static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
6ff0c93a
MH
665{
666 int i;
667
6ff0c93a
MH
668 switch (data[0]) {
669 case 0x00:
83b4934c 670 printf(" information:");
6ff0c93a
MH
671 break;
672 case 0x01:
1cab57eb
JB
673 if (print_wifi_wmm_param(data + 1, len - 1))
674 return;
6ff0c93a
MH
675 break;
676 default:
83b4934c 677 printf(" type %d:", data[0]);
6ff0c93a
MH
678 break;
679 }
680
1cab57eb
JB
681 for(i = 1; i < len; i++)
682 printf(" %.02x", data[i]);
6ff0c93a
MH
683 printf("\n");
684}
685
83b4934c 686static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
4673a894
JB
687{
688 bool first = true;
689 __u16 subtype, sublen;
690
4673a894
JB
691 while (len >= 4) {
692 subtype = (data[0] << 8) + data[1];
693 sublen = (data[2] << 8) + data[3];
694 if (sublen > len)
695 break;
696
697 switch (subtype) {
698 case 0x104a:
699 tab_on_first(&first);
dffc6750 700 printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
4673a894
JB
701 break;
702 case 0x1011:
703 tab_on_first(&first);
704 printf("\t * Device name: %.*s\n", sublen, data + 4);
705 break;
706 case 0x1021:
707 tab_on_first(&first);
708 printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
709 break;
710 case 0x1023:
711 tab_on_first(&first);
712 printf("\t * Model: %.*s\n", sublen, data + 4);
713 break;
7ee5a865 714 case 0x1057: {
fe31a22e 715 __u8 val = data[4];
7ee5a865 716 tab_on_first(&first);
fe31a22e 717 printf("\t * AP setup locked: 0x%.2x\n", val);
7ee5a865
JB
718 break;
719 }
4673a894
JB
720 case 0x1008: {
721 __u16 meth = (data[4] << 8) + data[5];
722 bool comma = false;
723 tab_on_first(&first);
724 printf("\t * Config methods:");
725#define T(bit, name) do { \
726 if (meth & (1<<bit)) { \
727 if (comma) \
728 printf(","); \
729 comma = true; \
730 printf(" " name); \
731 } } while (0)
732 T(0, "USB");
733 T(1, "Ethernet");
734 T(2, "Label");
735 T(3, "Display");
736 T(4, "Ext. NFC");
737 T(5, "Int. NFC");
738 T(6, "NFC Intf.");
739 T(7, "PBC");
740 T(8, "Keypad");
741 printf("\n");
742 break;
743#undef T
744 }
2650d46b
JB
745 default: {
746 const __u8 *subdata = data + 4;
747 __u16 tmplen = sublen;
748
749 tab_on_first(&first);
750 printf("\t * Unknown TLV (%#.4x, %d bytes):",
751 subtype, tmplen);
752 while (tmplen) {
753 printf(" %.2x", *subdata);
754 subdata++;
755 tmplen--;
756 }
757 printf("\n");
4673a894
JB
758 break;
759 }
2650d46b 760 }
4673a894
JB
761
762 data += sublen + 4;
763 len -= sublen + 4;
764 }
765
766 if (len != 0) {
767 printf("\t\t * bogus tail data (%d):", len);
768 while (len) {
769 printf(" %.2x", *data);
770 data++;
771 len--;
772 }
773 printf("\n");
774 }
775}
776
83b4934c 777static const struct ie_print wifiprinters[] = {
febeb0c0
JB
778 [1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
779 [2] = { "WMM", print_wifi_wmm, 1, 255, BIT(PRINT_SCAN), },
780 [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
4673a894
JB
781};
782
764fe753 783static void print_vendor(unsigned char len, unsigned char *data,
febeb0c0 784 bool unknown, enum print_ie_type ptype)
3563f4c5
JB
785{
786 int i;
787
fbf80af5 788 if (len < 3) {
4673a894 789 printf("\tVendor specific: <too short> data:");
fbf80af5
JB
790 for(i = 0; i < len; i++)
791 printf(" %.02x", data[i]);
792 printf("\n");
793 return;
794 }
795
857d966e 796 if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) {
febeb0c0
JB
797 if (data[3] < ARRAY_SIZE(wifiprinters) &&
798 wifiprinters[data[3]].name &&
799 wifiprinters[data[3]].flags & BIT(ptype)) {
83b4934c
JB
800 print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
801 return;
802 }
febeb0c0 803 if (!unknown)
4673a894 804 return;
857d966e 805 printf("\tWiFi OUI %#.2x, data:", data[3]);
4673a894
JB
806 for(i = 0; i < len - 4; i++)
807 printf(" %.02x", data[i + 4]);
808 printf("\n");
809 return;
810 }
811
febeb0c0 812 if (!unknown)
764fe753
JB
813 return;
814
fbf80af5 815 printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
3563f4c5 816 data[0], data[1], data[2]);
fbf80af5
JB
817 for (i = 3; i < len; i++)
818 printf(" %.2x", data[i]);
3563f4c5
JB
819 printf("\n");
820}
821
febeb0c0
JB
822void print_ies(unsigned char *ie, int ielen, bool unknown,
823 enum print_ie_type ptype)
3563f4c5
JB
824{
825 while (ielen >= 2 && ielen >= ie[1]) {
febeb0c0
JB
826 if (ie[0] < ARRAY_SIZE(ieprinters) &&
827 ieprinters[ie[0]].name &&
828 ieprinters[ie[0]].flags & BIT(ptype)) {
83b4934c 829 print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
764fe753 830 } else if (ie[0] == 221 /* vendor */) {
febeb0c0
JB
831 print_vendor(ie[1], ie + 2, unknown, ptype);
832 } else if (unknown) {
3563f4c5
JB
833 int i;
834
8086b700 835 printf("\tUnknown IE (%d):", ie[0]);
3563f4c5 836 for (i=0; i<ie[1]; i++)
8086b700 837 printf(" %.2x", ie[2+i]);
3563f4c5
JB
838 printf("\n");
839 }
840 ielen -= ie[1] + 2;
841 ie += ie[1] + 2;
842 }
843}
844
845static int print_bss_handler(struct nl_msg *msg, void *arg)
846{
847 struct nlattr *tb[NL80211_ATTR_MAX + 1];
848 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
849 struct nlattr *bss[NL80211_BSS_MAX + 1];
850 char mac_addr[20], dev[20];
851 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
852 [NL80211_BSS_TSF] = { .type = NLA_U64 },
853 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
854 [NL80211_BSS_BSSID] = { },
855 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
856 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
857 [NL80211_BSS_INFORMATION_ELEMENTS] = { },
f2e17e1f
JB
858 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
859 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
a56117a6 860 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
c04a78df 861 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
575280cc 862 [NL80211_BSS_BEACON_IES] = { },
3563f4c5 863 };
febeb0c0 864 struct scan_params *params = arg;
1c5bcd9c 865 int show = params->show_both_ie_sets ? 2 : 1;
3563f4c5
JB
866
867 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
868 genlmsg_attrlen(gnlh, 0), NULL);
869
870 if (!tb[NL80211_ATTR_BSS]) {
5fe70c0e 871 fprintf(stderr, "bss info missing!\n");
3563f4c5
JB
872 return NL_SKIP;
873 }
874 if (nla_parse_nested(bss, NL80211_BSS_MAX,
875 tb[NL80211_ATTR_BSS],
876 bss_policy)) {
5fe70c0e 877 fprintf(stderr, "failed to parse nested attributes!\n");
3563f4c5
JB
878 return NL_SKIP;
879 }
880
881 if (!bss[NL80211_BSS_BSSID])
882 return NL_SKIP;
883
884 mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
885 if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
a56117a6
JB
886 printf("BSS %s (on %s)", mac_addr, dev);
887
888 if (bss[NL80211_BSS_STATUS]) {
889 switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
890 case NL80211_BSS_STATUS_AUTHENTICATED:
891 printf(" -- authenticated");
892 break;
893 case NL80211_BSS_STATUS_ASSOCIATED:
894 printf(" -- associated");
895 break;
896 case NL80211_BSS_STATUS_IBSS_JOINED:
897 printf(" -- joined");
898 break;
899 default:
900 printf(" -- unknown status: %d",
901 nla_get_u32(bss[NL80211_BSS_STATUS]));
902 break;
903 }
904 }
905 printf("\n");
3563f4c5 906
e7109a8a
JB
907 if (bss[NL80211_BSS_TSF]) {
908 unsigned long long tsf;
909 tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
910 printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
911 tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
912 (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
913 }
3563f4c5
JB
914 if (bss[NL80211_BSS_FREQUENCY])
915 printf("\tfreq: %d\n",
916 nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
917 if (bss[NL80211_BSS_BEACON_INTERVAL])
918 printf("\tbeacon interval: %d\n",
919 nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
92a04ecd
MH
920 if (bss[NL80211_BSS_CAPABILITY]) {
921 __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
922 printf("\tcapability:");
923 if (capa & WLAN_CAPABILITY_ESS)
924 printf(" ESS");
925 if (capa & WLAN_CAPABILITY_IBSS)
926 printf(" IBSS");
927 if (capa & WLAN_CAPABILITY_PRIVACY)
928 printf(" Privacy");
929 if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
930 printf(" ShortPreamble");
931 if (capa & WLAN_CAPABILITY_PBCC)
932 printf(" PBCC");
933 if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
934 printf(" ChannelAgility");
935 if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
936 printf(" SpectrumMgmt");
937 if (capa & WLAN_CAPABILITY_QOS)
938 printf(" QoS");
939 if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
940 printf(" ShortSlotTime");
941 if (capa & WLAN_CAPABILITY_APSD)
942 printf(" APSD");
943 if (capa & WLAN_CAPABILITY_DSSS_OFDM)
944 printf(" DSSS-OFDM");
945 printf(" (0x%.4x)\n", capa);
946 }
f2e17e1f
JB
947 if (bss[NL80211_BSS_SIGNAL_MBM]) {
948 int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
949 printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
950 }
951 if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
952 unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
953 printf("\tsignal: %d/100\n", s);
954 }
c04a78df
HS
955 if (bss[NL80211_BSS_SEEN_MS_AGO]) {
956 int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
957 printf("\tlast seen: %d ms ago\n", age);
958 }
1c5bcd9c
JB
959
960 if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) {
575280cc
JM
961 if (bss[NL80211_BSS_BEACON_IES])
962 printf("\tInformation elements from Probe Response "
963 "frame:\n");
3563f4c5 964 print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
764fe753 965 nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
febeb0c0 966 params->unknown, params->type);
575280cc 967 }
1c5bcd9c 968 if (bss[NL80211_BSS_BEACON_IES] && show--) {
575280cc
JM
969 printf("\tInformation elements from Beacon frame:\n");
970 print_ies(nla_data(bss[NL80211_BSS_BEACON_IES]),
971 nla_len(bss[NL80211_BSS_BEACON_IES]),
972 params->unknown, params->type);
973 }
3563f4c5
JB
974
975 return NL_SKIP;
976}
977
764fe753 978static struct scan_params scan_params;
3563f4c5 979
7c37a24d
JB
980static int handle_scan_dump(struct nl80211_state *state,
981 struct nl_cb *cb,
3563f4c5
JB
982 struct nl_msg *msg,
983 int argc, char **argv)
984{
764fe753
JB
985 if (argc > 1)
986 return 1;
987
1c5bcd9c
JB
988 memset(&scan_params, 0, sizeof(scan_params));
989
764fe753
JB
990 if (argc == 1 && !strcmp(argv[0], "-u"))
991 scan_params.unknown = true;
575280cc
JM
992 else if (argc == 1 && !strcmp(argv[0], "-b"))
993 scan_params.show_both_ie_sets = true;
764fe753 994
febeb0c0
JB
995 scan_params.type = PRINT_SCAN;
996
764fe753
JB
997 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
998 &scan_params);
3563f4c5
JB
999 return 0;
1000}
a5fe4ef2
JB
1001
1002static int handle_scan_combined(struct nl80211_state *state,
1003 struct nl_cb *cb,
1004 struct nl_msg *msg,
1005 int argc, char **argv)
1006{
559a1713 1007 char **trig_argv;
a5fe4ef2
JB
1008 static char *dump_argv[] = {
1009 NULL,
1010 "scan",
1011 "dump",
92649eab 1012 NULL,
a5fe4ef2
JB
1013 };
1014 static const __u32 cmds[] = {
1015 NL80211_CMD_NEW_SCAN_RESULTS,
1016 NL80211_CMD_SCAN_ABORTED,
1017 };
559a1713 1018 int trig_argc, dump_argc, err;
a5fe4ef2 1019
559a1713
JB
1020 if (argc >= 3 && !strcmp(argv[2], "-u")) {
1021 dump_argc = 4;
1022 dump_argv[3] = "-u";
575280cc
JM
1023 } else if (argc >= 3 && !strcmp(argv[2], "-b")) {
1024 dump_argc = 4;
1025 dump_argv[3] = "-b";
559a1713
JB
1026 } else
1027 dump_argc = 3;
1028
1029 trig_argc = 3 + (argc - 2) + (3 - dump_argc);
1030 trig_argv = calloc(trig_argc, sizeof(*trig_argv));
1031 if (!trig_argv)
1032 return -ENOMEM;
a5fe4ef2 1033 trig_argv[0] = argv[0];
559a1713
JB
1034 trig_argv[1] = "scan";
1035 trig_argv[2] = "trigger";
1036 int i;
1037 for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
1038 trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
1039 err = handle_cmd(state, II_NETDEV, trig_argc, trig_argv);
1040 free(trig_argv);
a5fe4ef2
JB
1041 if (err)
1042 return err;
1043
61725dbe
JB
1044 /*
1045 * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
1046 *
1047 * This code has a bug, which requires creating a separate
1048 * nl80211 socket to fix:
1049 * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
1050 * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
1051 * before (!) we listen to it, because we only start listening
1052 * after we send our scan request.
1053 *
1054 * Doing it the other way around has a race condition as well,
1055 * if you first open the events socket you may get a notification
1056 * for a previous scan.
1057 *
1058 * The only proper way to fix this would be to listen to events
1059 * before sending the command, and for the kernel to send the
1060 * scan request along with the event, so that you can match up
1061 * whether the scan you requested was finished or aborted (this
1062 * may result in processing a scan that another application
1063 * requested, but that doesn't seem to be a problem).
1064 *
1065 * Alas, the kernel doesn't do that (yet).
1066 */
1067
a5fe4ef2
JB
1068 if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
1069 NL80211_CMD_SCAN_ABORTED) {
1070 printf("scan aborted!\n");
1071 return 0;
1072 }
1073
1074 dump_argv[0] = argv[0];
92649eab 1075 return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
a5fe4ef2 1076}
64797a7f 1077TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]", 0, 0,
6ca98d28
JB
1078 CIB_NETDEV, handle_scan_combined,
1079 "Scan on the given frequencies and probe for the given SSIDs\n"
1080 "(or wildcard if not given) unless passive scanning is requested.\n"
64797a7f
JB
1081 "If -u is specified print unknown data in the scan results.\n"
1082 "Specified (vendor) IEs must be well-formed.");
4698bfc2
JB
1083COMMAND(scan, dump, "[-u]",
1084 NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
1085 "Dump the current scan results. If -u is specified, print unknown\n"
1086 "data in scan results.");
64797a7f 1087COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]",
4698bfc2
JB
1088 NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
1089 "Trigger a scan on the given frequencies with probing for the given\n"
1090 "SSIDs (or wildcard if not given) unless passive scanning is requested.");