scan.c

   1 #include <net/if.h>
   2 #include <errno.h>
   3 #include <string.h>
   4 #include <ctype.h>
   5 #include <stdbool.h>
   6
   7 #include <netlink/genl/genl.h>
   8 #include <netlink/genl/family.h>
   9 #include <netlink/genl/ctrl.h>
  10 #include <netlink/msg.h>
  11 #include <netlink/attr.h>
  12
  13 #include "nl80211.h"
  14 #include "iw.h"
  15
  16 #define WLAN_CAPABILITY_ESS             (1<<0)
  17 #define WLAN_CAPABILITY_IBSS            (1<<1)
  18 #define WLAN_CAPABILITY_CF_POLLABLE     (1<<2)
  19 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
  20 #define WLAN_CAPABILITY_PRIVACY         (1<<4)
  21 #define WLAN_CAPABILITY_SHORT_PREAMBLE  (1<<5)
  22 #define WLAN_CAPABILITY_PBCC            (1<<6)
  23 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
  24 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
  25 #define WLAN_CAPABILITY_QOS             (1<<9)
  26 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
  27 #define WLAN_CAPABILITY_APSD            (1<<11)
  28 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
  29
  30 static unsigned char ms_oui[3]          = { 0x00, 0x50, 0xf2 };
  31 static unsigned char ieee80211_oui[3]   = { 0x00, 0x0f, 0xac };
  32 static unsigned char wfa_oui[3]         = { 0x50, 0x6f, 0x9a };
  33
  34 struct scan_params {
  35         bool unknown;
  36         enum print_ie_type type;
  37         bool show_both_ie_sets;
  38 };
  39
  40 #define IEEE80211_COUNTRY_EXTENSION_ID 201
  41
  42 union ieee80211_country_ie_triplet {
  43         struct {
  44                 __u8 first_channel;
  45                 __u8 num_channels;
  46                 __s8 max_power;
  47         } __attribute__ ((packed)) chans;
  48         struct {
  49                 __u8 reg_extension_id;
  50                 __u8 reg_class;
  51                 __u8 coverage_class;
  52         } __attribute__ ((packed)) ext;
  53 } __attribute__ ((packed));
  54
  55 static int handle_scan(struct nl80211_state *state,
  56                        struct nl_cb *cb,
  57                        struct nl_msg *msg,
  58                        int argc, char **argv,
  59                        enum id_input id)
  60 {
  61         struct nl_msg *ssids = NULL, *freqs = NULL;
  62         char *eptr;
  63         int err = -ENOBUFS;
  64         int i;
  65         enum {
  66                 NONE,
  67                 FREQ,
  68                 IES,
  69                 SSID,
  70                 DONE,
  71         } parse = NONE;
  72         int freq;
  73         bool passive = false, have_ssids = false, have_freqs = false;
  74         size_t tmp;
  75         unsigned char *ies;
  76         int flags = 0;
  77
  78         ssids = nlmsg_alloc();
  79         if (!ssids)
  80                 return -ENOMEM;
  81
  82         freqs = nlmsg_alloc();
  83         if (!freqs) {
  84                 nlmsg_free(ssids);
  85                 return -ENOMEM;
  86         }
  87
  88         for (i = 0; i < argc; i++) {
  89                 switch (parse) {
  90                 case NONE:
  91                         if (strcmp(argv[i], "freq") == 0) {
  92                                 parse = FREQ;
  93                                 have_freqs = true;
  94                                 break;
  95                         } else if (strcmp(argv[i], "ies") == 0) {
  96                                 parse = IES;
  97                                 break;
  98                         } else if (strcmp(argv[i], "lowpri") == 0) {
  99                                 parse = NONE;
 100                                 flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 101                                 break;
 102                         } else if (strcmp(argv[i], "flush") == 0) {
 103                                 parse = NONE;
 104                                 flags |= NL80211_SCAN_FLAG_FLUSH;
 105                                 break;
 106                         } else if (strcmp(argv[i], "ap-force") == 0) {
 107                                 parse = NONE;
 108                                 flags |= NL80211_SCAN_FLAG_AP;
 109                                 break;
 110                         } else if (strcmp(argv[i], "ssid") == 0) {
 111                                 parse = SSID;
 112                                 have_ssids = true;
 113                                 break;
 114                         } else if (strcmp(argv[i], "passive") == 0) {
 115                                 parse = DONE;
 116                                 passive = true;
 117                                 break;
 118                         }
 119                 case DONE:
 120                         return 1;
 121                 case FREQ:
 122                         freq = strtoul(argv[i], &eptr, 10);
 123                         if (eptr != argv[i] + strlen(argv[i])) {
 124                                 /* failed to parse as number -- maybe a tag? */
 125                                 i--;
 126                                 parse = NONE;
 127                                 continue;
 128                         }
 129                         NLA_PUT_U32(freqs, i, freq);
 130                         break;
 131                 case IES:
 132                         ies = parse_hex(argv[i], &tmp);
 133                         if (!ies)
 134                                 goto nla_put_failure;
 135                         NLA_PUT(msg, NL80211_ATTR_IE, tmp, ies);
 136                         free(ies);
 137                         parse = NONE;
 138                         break;
 139                 case SSID:
 140                         NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
 141                         break;
 142                 }
 143         }
 144
 145         if (!have_ssids)
 146                 NLA_PUT(ssids, 1, 0, "");
 147         if (!passive)
 148                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
 149
 150         if (have_freqs)
 151                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
 152         if (flags)
 153                 NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS, flags);
 154
 155         err = 0;
 156  nla_put_failure:
 157         nlmsg_free(ssids);
 158         nlmsg_free(freqs);
 159         return err;
 160 }
 161
 162 static void tab_on_first(bool *first)
 163 {
 164         if (!*first)
 165                 printf("\t");
 166         else
 167                 *first = false;
 168 }
 169
 170 static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
 171 {
 172         printf(" ");
 173         print_ssid_escaped(len, data);
 174         printf("\n");
 175 }
 176
 177 #define BSS_MEMBERSHIP_SELECTOR_VHT_PHY 126
 178 #define BSS_MEMBERSHIP_SELECTOR_HT_PHY 127
 179
 180 static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 181 {
 182         int i;
 183
 184         printf(" ");
 185
 186         for (i = 0; i < len; i++) {
 187                 int r = data[i] & 0x7f;
 188
 189                 if (r == BSS_MEMBERSHIP_SELECTOR_VHT_PHY && data[i] & 0x80)
 190                         printf("VHT");
 191                 else if (r == BSS_MEMBERSHIP_SELECTOR_HT_PHY && data[i] & 0x80)
 192                         printf("HT");
 193                 else
 194                         printf("%d.%d", r/2, 5*(r&1));
 195
 196                 printf("%s ", data[i] & 0x80 ? "*" : "");
 197         }
 198         printf("\n");
 199 }
 200
 201 static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
 202 {
 203         printf(" channel %d\n", data[0]);
 204 }
 205
 206 static const char *country_env_str(char environment)
 207 {
 208         switch (environment) {
 209         case 'I':
 210                 return "Indoor only";
 211         case 'O':
 212                 return "Outdoor only";
 213         case ' ':
 214                 return "Indoor/Outdoor";
 215         default:
 216                 return "bogus";
 217         }
 218 }
 219
 220 static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
 221 {
 222         printf(" %.*s", 2, data);
 223
 224         printf("\tEnvironment: %s\n", country_env_str(data[2]));
 225
 226         data += 3;
 227         len -= 3;
 228
 229         if (len < 3) {
 230                 printf("\t\tNo country IE triplets present\n");
 231                 return;
 232         }
 233
 234         while (len >= 3) {
 235                 int end_channel;
 236                 union ieee80211_country_ie_triplet *triplet = (void *) data;
 237
 238                 if (triplet->ext.reg_extension_id >= IEEE80211_COUNTRY_EXTENSION_ID) {
 239                         printf("\t\tExtension ID: %d Regulatory Class: %d Coverage class: %d (up to %dm)\n",
 240                                triplet->ext.reg_extension_id,
 241                                triplet->ext.reg_class,
 242                                triplet->ext.coverage_class,
 243                                triplet->ext.coverage_class * 450);
 244
 245                         data += 3;
 246                         len -= 3;
 247                         continue;
 248                 }
 249
 250                 /* 2 GHz */
 251                 if (triplet->chans.first_channel <= 14)
 252                         end_channel = triplet->chans.first_channel + (triplet->chans.num_channels - 1);
 253                 else
 254                         end_channel =  triplet->chans.first_channel + (4 * (triplet->chans.num_channels - 1));
 255
 256                 printf("\t\tChannels [%d - %d] @ %d dBm\n", triplet->chans.first_channel, end_channel, triplet->chans.max_power);
 257
 258                 data += 3;
 259                 len -= 3;
 260         }
 261
 262         return;
 263 }
 264
 265 static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
 266 {
 267         printf(" %d dB\n", data[0]);
 268 }
 269
 270 static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 271 {
 272         if (data[0] == 0x00)
 273                 printf(" <no flags>");
 274         if (data[0] & 0x01)
 275                 printf(" NonERP_Present");
 276         if (data[0] & 0x02)
 277                 printf(" Use_Protection");
 278         if (data[0] & 0x04)
 279                 printf(" Barker_Preamble_Mode");
 280         printf("\n");
 281 }
 282
 283 static void print_cipher(const uint8_t *data)
 284 {
 285         if (memcmp(data, ms_oui, 3) == 0) {
 286                 switch (data[3]) {
 287                 case 0:
 288                         printf("Use group cipher suite");
 289                         break;
 290                 case 1:
 291                         printf("WEP-40");
 292                         break;
 293                 case 2:
 294                         printf("TKIP");
 295                         break;
 296                 case 4:
 297                         printf("CCMP");
 298                         break;
 299                 case 5:
 300                         printf("WEP-104");
 301                         break;
 302                 default:
 303                         printf("%.02x-%.02x-%.02x:%d",
 304                                 data[0], data[1] ,data[2], data[3]);
 305                         break;
 306                 }
 307         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 308                 switch (data[3]) {
 309                 case 0:
 310                         printf("Use group cipher suite");
 311                         break;
 312                 case 1:
 313                         printf("WEP-40");
 314                         break;
 315                 case 2:
 316                         printf("TKIP");
 317                         break;
 318                 case 4:
 319                         printf("CCMP");
 320                         break;
 321                 case 5:
 322                         printf("WEP-104");
 323                         break;
 324                 case 6:
 325                         printf("AES-128-CMAC");
 326                         break;
 327                 case 8:
 328                         printf("GCMP");
 329                         break;
 330                 default:
 331                         printf("%.02x-%.02x-%.02x:%d",
 332                                 data[0], data[1] ,data[2], data[3]);
 333                         break;
 334                 }
 335         } else
 336                 printf("%.02x-%.02x-%.02x:%d",
 337                         data[0], data[1] ,data[2], data[3]);
 338 }
 339
 340 static void print_auth(const uint8_t *data)
 341 {
 342         if (memcmp(data, ms_oui, 3) == 0) {
 343                 switch (data[3]) {
 344                 case 1:
 345                         printf("IEEE 802.1X");
 346                         break;
 347                 case 2:
 348                         printf("PSK");
 349                         break;
 350                 default:
 351                         printf("%.02x-%.02x-%.02x:%d",
 352                                 data[0], data[1] ,data[2], data[3]);
 353                         break;
 354                 }
 355         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 356                 switch (data[3]) {
 357                 case 1:
 358                         printf("IEEE 802.1X");
 359                         break;
 360                 case 2:
 361                         printf("PSK");
 362                         break;
 363                 case 3:
 364                         printf("FT/IEEE 802.1X");
 365                         break;
 366                 case 4:
 367                         printf("FT/PSK");
 368                         break;
 369                 case 5:
 370                         printf("IEEE 802.1X/SHA-256");
 371                         break;
 372                 case 6:
 373                         printf("PSK/SHA-256");
 374                         break;
 375                 default:
 376                         printf("%.02x-%.02x-%.02x:%d",
 377                                 data[0], data[1] ,data[2], data[3]);
 378                         break;
 379                 }
 380         } else
 381                 printf("%.02x-%.02x-%.02x:%d",
 382                         data[0], data[1] ,data[2], data[3]);
 383 }
 384
 385 static void print_rsn_ie(const char *defcipher, const char *defauth,
 386                          uint8_t len, const uint8_t *data)
 387 {
 388         bool first = true;
 389         __u16 version, count, capa;
 390         int i;
 391
 392         version = data[0] + (data[1] << 8);
 393         tab_on_first(&first);
 394         printf("\t * Version: %d\n", version);
 395
 396         data += 2;
 397         len -= 2;
 398
 399         if (len < 4) {
 400                 tab_on_first(&first);
 401                 printf("\t * Group cipher: %s\n", defcipher);
 402                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 403                 return;
 404         }
 405
 406         tab_on_first(&first);
 407         printf("\t * Group cipher: ");
 408         print_cipher(data);
 409         printf("\n");
 410
 411         data += 4;
 412         len -= 4;
 413
 414         if (len < 2) {
 415                 tab_on_first(&first);
 416                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 417                 return;
 418         }
 419
 420         count = data[0] | (data[1] << 8);
 421         if (2 + (count * 4) > len)
 422                 goto invalid;
 423
 424         tab_on_first(&first);
 425         printf("\t * Pairwise ciphers:");
 426         for (i = 0; i < count; i++) {
 427                 printf(" ");
 428                 print_cipher(data + 2 + (i * 4));
 429         }
 430         printf("\n");
 431
 432         data += 2 + (count * 4);
 433         len -= 2 + (count * 4);
 434
 435         if (len < 2) {
 436                 tab_on_first(&first);
 437                 printf("\t * Authentication suites: %s\n", defauth);
 438                 return;
 439         }
 440
 441         count = data[0] | (data[1] << 8);
 442         if (2 + (count * 4) > len)
 443                 goto invalid;
 444
 445         tab_on_first(&first);
 446         printf("\t * Authentication suites:");
 447         for (i = 0; i < count; i++) {
 448                 printf(" ");
 449                 print_auth(data + 2 + (i * 4));
 450         }
 451         printf("\n");
 452
 453         data += 2 + (count * 4);
 454         len -= 2 + (count * 4);
 455
 456         if (len >= 2) {
 457                 capa = data[0] | (data[1] << 8);
 458                 tab_on_first(&first);
 459                 printf("\t * Capabilities:");
 460                 if (capa & 0x0001)
 461                         printf(" PreAuth");
 462                 if (capa & 0x0002)
 463                         printf(" NoPairwise");
 464                 switch ((capa & 0x000c) >> 2) {
 465                 case 0:
 466                         break;
 467                 case 1:
 468                         printf(" 2-PTKSA-RC");
 469                         break;
 470                 case 2:
 471                         printf(" 4-PTKSA-RC");
 472                         break;
 473                 case 3:
 474                         printf(" 16-PTKSA-RC");
 475                         break;
 476                 }
 477                 switch ((capa & 0x0030) >> 4) {
 478                 case 0:
 479                         break;
 480                 case 1:
 481                         printf(" 2-GTKSA-RC");
 482                         break;
 483                 case 2:
 484                         printf(" 4-GTKSA-RC");
 485                         break;
 486                 case 3:
 487                         printf(" 16-GTKSA-RC");
 488                         break;
 489                 }
 490                 if (capa & 0x0040)
 491                         printf(" MFP-required");
 492                 if (capa & 0x0080)
 493                         printf(" MFP-capable");
 494                 if (capa & 0x0200)
 495                         printf(" Peerkey-enabled");
 496                 if (capa & 0x0400)
 497                         printf(" SPP-AMSDU-capable");
 498                 if (capa & 0x0800)
 499                         printf(" SPP-AMSDU-required");
 500                 printf(" (0x%.4x)\n", capa);
 501                 data += 2;
 502                 len -= 2;
 503         }
 504
 505         if (len >= 2) {
 506                 int pmkid_count = data[0] | (data[1] << 8);
 507
 508                 if (len >= 2 + 16 * pmkid_count) {
 509                         tab_on_first(&first);
 510                         printf("\t * %d PMKIDs\n", pmkid_count);
 511                         /* not printing PMKID values */
 512                         data += 2 + 16 * pmkid_count;
 513                         len -= 2 + 16 * pmkid_count;
 514                 } else
 515                         goto invalid;
 516         }
 517
 518         if (len >= 4) {
 519                 tab_on_first(&first);
 520                 printf("\t * Group mgmt cipher suite: ");
 521                 print_cipher(data);
 522                 printf("\n");
 523                 data += 4;
 524                 len -= 4;
 525         }
 526
 527  invalid:
 528         if (len != 0) {
 529                 printf("\t\t * bogus tail data (%d):", len);
 530                 while (len) {
 531                         printf(" %.2x", *data);
 532                         data++;
 533                         len--;
 534                 }
 535                 printf("\n");
 536         }
 537 }
 538
 539 static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
 540 {
 541         print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 542 }
 543
 544 static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
 545 {
 546         printf("\n");
 547         print_ht_capability(data[0] | (data[1] << 8));
 548         print_ampdu_length(data[2] & 3);
 549         print_ampdu_spacing((data[2] >> 2) & 7);
 550         print_ht_mcs(data + 3);
 551 }
 552
 553 static const char *ht_secondary_offset[4] = {
 554         "no secondary",
 555         "above",
 556         "[reserved!]",
 557         "below",
 558 };
 559
 560 static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
 561 {
 562         static const char *protection[4] = {
 563                 "no",
 564                 "nonmember",
 565                 "20 MHz",
 566                 "non-HT mixed",
 567         };
 568         static const char *sta_chan_width[2] = {
 569                 "20 MHz",
 570                 "any",
 571         };
 572
 573         printf("\n");
 574         printf("\t\t * primary channel: %d\n", data[0]);
 575         printf("\t\t * secondary channel offset: %s\n",
 576                 ht_secondary_offset[data[1] & 0x3]);
 577         printf("\t\t * STA channel width: %s\n", sta_chan_width[(data[1] & 0x4)>>2]);
 578         printf("\t\t * RIFS: %d\n", (data[1] & 0x8)>>3);
 579         printf("\t\t * HT protection: %s\n", protection[data[2] & 0x3]);
 580         printf("\t\t * non-GF present: %d\n", (data[2] & 0x4) >> 2);
 581         printf("\t\t * OBSS non-GF present: %d\n", (data[2] & 0x10) >> 4);
 582         printf("\t\t * dual beacon: %d\n", (data[4] & 0x40) >> 6);
 583         printf("\t\t * dual CTS protection: %d\n", (data[4] & 0x80) >> 7);
 584         printf("\t\t * STBC beacon: %d\n", data[5] & 0x1);
 585         printf("\t\t * L-SIG TXOP Prot: %d\n", (data[5] & 0x2) >> 1);
 586         printf("\t\t * PCO active: %d\n", (data[5] & 0x4) >> 2);
 587         printf("\t\t * PCO phase: %d\n", (data[5] & 0x8) >> 3);
 588 }
 589
 590 static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 591 {
 592         int i, base, bit;
 593         bool first = true;
 594
 595
 596         for (i = 0; i < len; i++) {
 597                 base = i * 8;
 598
 599                 for (bit = 0; bit < 8; bit++) {
 600                         if (!(data[i] & (1 << bit)))
 601                                 continue;
 602
 603                         if (!first)
 604                                 printf(",");
 605                         else
 606                                 first = false;
 607
 608 #define CAPA(bit, name)         case bit: printf(" " name); break
 609
 610                         switch (bit + base) {
 611                         CAPA(0, "HT Information Exchange Supported");
 612                         CAPA(1, "reserved (On-demand Beacon)");
 613                         CAPA(2, "Extended Channel Switching");
 614                         CAPA(3, "reserved (Wave Indication)");
 615                         CAPA(4, "PSMP Capability");
 616                         CAPA(5, "reserved (Service Interval Granularity)");
 617                         CAPA(6, "S-PSMP Capability");
 618                         CAPA(7, "Event");
 619                         CAPA(8, "Diagnostics");
 620                         CAPA(9, "Multicast Diagnostics");
 621                         CAPA(10, "Location Tracking");
 622                         CAPA(11, "FMS");
 623                         CAPA(12, "Proxy ARP Service");
 624                         CAPA(13, "Collocated Interference Reporting");
 625                         CAPA(14, "Civic Location");
 626                         CAPA(15, "Geospatial Location");
 627                         CAPA(16, "TFS");
 628                         CAPA(17, "WNM-Sleep Mode");
 629                         CAPA(18, "TIM Broadcast");
 630                         CAPA(19, "BSS Transition");
 631                         CAPA(20, "QoS Traffic Capability");
 632                         CAPA(21, "AC Station Count");
 633                         CAPA(22, "Multiple BSSID");
 634                         CAPA(23, "Timing Measurement");
 635                         CAPA(24, "Channel Usage");
 636                         CAPA(25, "SSID List");
 637                         CAPA(26, "DMS");
 638                         CAPA(27, "UTC TSF Offset");
 639                         CAPA(28, "TDLS Peer U-APSD Buffer STA Support");
 640                         CAPA(29, "TDLS Peer PSM Support");
 641                         CAPA(30, "TDLS channel switching");
 642                         CAPA(31, "Interworking");
 643                         CAPA(32, "QoS Map");
 644                         CAPA(33, "EBR");
 645                         CAPA(34, "SSPN Interface");
 646                         CAPA(35, "Reserved");
 647                         CAPA(36, "MSGCF Capability");
 648                         CAPA(37, "TDLS Support");
 649                         CAPA(38, "TDLS Prohibited");
 650                         CAPA(39, "TDLS Channel Switching Prohibited");
 651                         CAPA(40, "Reject Unadmitted Frame");
 652                         CAPA(44, "Identifier Location");
 653                         CAPA(45, "U-APSD Coexistence");
 654                         CAPA(46, "WNM-Notification");
 655                         CAPA(47, "Reserved");
 656                         CAPA(48, "UTF-8 SSID");
 657                         default:
 658                                 printf(" %d", bit);
 659                                 break;
 660                         }
 661 #undef CAPA
 662                 }
 663         }
 664
 665         printf("\n");
 666 }
 667
 668 static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data)
 669 {
 670         printf(" DTIM Count %u DTIM Period %u Bitmap Control 0x%x "
 671                "Bitmap[0] 0x%x",
 672                data[0], data[1], data[2], data[3]);
 673         if (len - 4)
 674                 printf(" (+ %u octet%s)", len - 4, len - 4 == 1 ? "" : "s");
 675         printf("\n");
 676 }
 677
 678 static void print_vht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
 679 {
 680         printf("\n");
 681         print_vht_info(data[0] | (data[1] << 8) |
 682                        (data[2] << 16) | (data[3] << 24),
 683                        data + 4);
 684 }
 685
 686 static void print_vht_oper(const uint8_t type, uint8_t len, const uint8_t *data)
 687 {
 688         const char *chandwidths[] = {
 689                 [0] = "20 or 40 MHz",
 690                 [1] = "80 MHz",
 691                 [3] = "80+80 MHz",
 692                 [2] = "160 MHz",
 693         };
 694
 695         printf("\n");
 696         printf("\t\t * channel width: %d (%s)\n", data[0],
 697                 data[0] < ARRAY_SIZE(chandwidths) ? chandwidths[data[0]] : "unknown");
 698         printf("\t\t * center freq segment 1: %d\n", data[1]);
 699         printf("\t\t * center freq segment 2: %d\n", data[2]);
 700         printf("\t\t * VHT basic MCS set: 0x%.2x%.2x\n", data[4], data[3]);
 701 }
 702
 703 static void print_obss_scan_params(const uint8_t type, uint8_t len, const uint8_t *data)
 704 {
 705         printf("\n");
 706         printf("\t\t * passive dwell: %d TUs\n", (data[1] << 8) | data[0]);
 707         printf("\t\t * active dwell: %d TUs\n", (data[3] << 8) | data[2]);
 708         printf("\t\t * channel width trigger scan interval: %d s\n", (data[5] << 8) | data[4]);
 709         printf("\t\t * scan passive total per channel: %d TUs\n", (data[7] << 8) | data[6]);
 710         printf("\t\t * scan active total per channel: %d TUs\n", (data[9] << 8) | data[8]);
 711         printf("\t\t * BSS width channel transition delay factor: %d\n", (data[11] << 8) | data[10]);
 712         printf("\t\t * OBSS Scan Activity Threshold: %d.%02d %%\n",
 713                 ((data[13] << 8) | data[12]) / 100, ((data[13] << 8) | data[12]) % 100);
 714 }
 715
 716 static void print_secchan_offs(const uint8_t type, uint8_t len, const uint8_t *data)
 717 {
 718         if (data[0] < ARRAY_SIZE(ht_secondary_offset))
 719                 printf(" %s (%d)\n", ht_secondary_offset[data[0]], data[0]);
 720         else
 721                 printf(" %d\n", data[0]);
 722 }
 723
 724 static void print_bss_load(const uint8_t type, uint8_t len, const uint8_t *data)
 725 {
 726         printf("\n");
 727         printf("\t\t * station count: %d\n", (data[1] << 8) | data[0]);
 728         printf("\t\t * channel utilisation: %d/255\n", data[2]);
 729         printf("\t\t * available admission capacity: %d [*32us]\n", (data[4] << 8) | data[3]);
 730 }
 731
 732 struct ie_print {
 733         const char *name;
 734         void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
 735         uint8_t minlen, maxlen;
 736         uint8_t flags;
 737 };
 738
 739 static void print_ie(const struct ie_print *p, const uint8_t type,
 740                      uint8_t len, const uint8_t *data)
 741 {
 742         int i;
 743
 744         if (!p->print)
 745                 return;
 746
 747         printf("\t%s:", p->name);
 748         if (len < p->minlen || len > p->maxlen) {
 749                 if (len > 1) {
 750                         printf(" <invalid: %d bytes:", len);
 751                         for (i = 0; i < len; i++)
 752                                 printf(" %.02x", data[i]);
 753                         printf(">\n");
 754                 } else if (len)
 755                         printf(" <invalid: 1 byte: %.02x>\n", data[0]);
 756                 else
 757                         printf(" <invalid: no data>\n");
 758                 return;
 759         }
 760
 761         p->print(type, len, data);
 762 }
 763
 764 #define PRINT_IGN {             \
 765         .name = "IGNORE",       \
 766         .print = NULL,          \
 767         .minlen = 0,            \
 768         .maxlen = 255,          \
 769 }
 770
 771 static const struct ie_print ieprinters[] = {
 772         [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
 773         [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 774         [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
 775         [5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), },
 776         [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
 777         [11] = { "BSS Load", print_bss_load, 5, 5, BIT(PRINT_SCAN), },
 778         [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
 779         [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
 780         [45] = { "HT capabilities", print_ht_capa, 26, 26, BIT(PRINT_SCAN), },
 781         [74] = { "Overlapping BSS scan params", print_obss_scan_params, 14, 255, BIT(PRINT_SCAN), },
 782         [61] = { "HT operation", print_ht_op, 22, 22, BIT(PRINT_SCAN), },
 783         [62] = { "Secondary Channel Offset", print_secchan_offs, 1, 1, BIT(PRINT_SCAN), },
 784         [191] = { "VHT capabilities", print_vht_capa, 12, 255, BIT(PRINT_SCAN), },
 785         [192] = { "VHT operation", print_vht_oper, 5, 255, BIT(PRINT_SCAN), },
 786         [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
 787         [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 788         [114] = { "MESH ID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
 789         [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
 790 };
 791
 792 static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
 793 {
 794         print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
 795 }
 796
 797 static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
 798 {
 799         int i;
 800         static const char *aci_tbl[] = { "BE", "BK", "VI", "VO" };
 801
 802         if (len < 19)
 803                 goto invalid;
 804
 805         if (data[0] != 1) {
 806                 printf("Parameter: not version 1: ");
 807                 return false;
 808         }
 809
 810         printf("\t * Parameter version 1");
 811
 812         data++;
 813
 814         if (data[0] & 0x80)
 815                 printf("\n\t\t * u-APSD");
 816
 817         data += 2;
 818
 819         for (i = 0; i < 4; i++) {
 820                 printf("\n\t\t * %s:", aci_tbl[(data[0] >> 5) & 3]);
 821                 if (data[0] & 0x10)
 822                         printf(" acm");
 823                 printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1,
 824                                     (1 << (data[1] >> 4)) - 1);
 825                 printf(", AIFSN %d", data[0] & 0xf);
 826                 if (data[2] | data[3])
 827                         printf(", TXOP %d usec", (data[2] + (data[3] << 8)) * 32);
 828                 data += 4;
 829         }
 830
 831         printf("\n");
 832         return true;
 833
 834  invalid:
 835         printf("invalid: ");
 836         return false;
 837 }
 838
 839 static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
 840 {
 841         int i;
 842
 843         switch (data[0]) {
 844         case 0x00:
 845                 printf(" information:");
 846                 break;
 847         case 0x01:
 848                 if (print_wifi_wmm_param(data + 1, len - 1))
 849                         return;
 850                 break;
 851         default:
 852                 printf(" type %d:", data[0]);
 853                 break;
 854         }
 855
 856         for(i = 1; i < len; i++)
 857                 printf(" %.02x", data[i]);
 858         printf("\n");
 859 }
 860
 861 static const char * wifi_wps_dev_passwd_id(uint16_t id)
 862 {
 863         switch (id) {
 864         case 0:
 865                 return "Default (PIN)";
 866         case 1:
 867                 return "User-specified";
 868         case 2:
 869                 return "Machine-specified";
 870         case 3:
 871                 return "Rekey";
 872         case 4:
 873                 return "PushButton";
 874         case 5:
 875                 return "Registrar-specified";
 876         default:
 877                 return "??";
 878         }
 879 }
 880
 881 static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
 882 {
 883         bool first = true;
 884         __u16 subtype, sublen;
 885
 886         while (len >= 4) {
 887                 subtype = (data[0] << 8) + data[1];
 888                 sublen = (data[2] << 8) + data[3];
 889                 if (sublen > len)
 890                         break;
 891
 892                 switch (subtype) {
 893                 case 0x104a:
 894                         tab_on_first(&first);
 895                         printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
 896                         break;
 897                 case 0x1011:
 898                         tab_on_first(&first);
 899                         printf("\t * Device name: %.*s\n", sublen, data + 4);
 900                         break;
 901                 case 0x1012: {
 902                         uint16_t id;
 903                         tab_on_first(&first);
 904                         if (sublen != 2) {
 905                                 printf("\t * Device Password ID: (invalid "
 906                                        "length %d)\n", sublen);
 907                                 break;
 908                         }
 909                         id = data[4] << 8 | data[5];
 910                         printf("\t * Device Password ID: %u (%s)\n",
 911                                id, wifi_wps_dev_passwd_id(id));
 912                         break;
 913                 }
 914                 case 0x1021:
 915                         tab_on_first(&first);
 916                         printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
 917                         break;
 918                 case 0x1023:
 919                         tab_on_first(&first);
 920                         printf("\t * Model: %.*s\n", sublen, data + 4);
 921                         break;
 922                 case 0x1024:
 923                         tab_on_first(&first);
 924                         printf("\t * Model Number: %.*s\n", sublen, data + 4);
 925                         break;
 926                 case 0x103b: {
 927                         __u8 val = data[4];
 928                         tab_on_first(&first);
 929                         printf("\t * Response Type: %d%s\n",
 930                                val, val == 3 ? " (AP)" : "");
 931                         break;
 932                 }
 933                 case 0x103c: {
 934                         __u8 val = data[4];
 935                         tab_on_first(&first);
 936                         printf("\t * RF Bands: 0x%x\n", val);
 937                         break;
 938                 }
 939                 case 0x1041: {
 940                         __u8 val = data[4];
 941                         tab_on_first(&first);
 942                         printf("\t * Selected Registrar: 0x%x\n", val);
 943                         break;
 944                 }
 945                 case 0x1042:
 946                         tab_on_first(&first);
 947                         printf("\t * Serial Number: %.*s\n", sublen, data + 4);
 948                         break;
 949                 case 0x1044: {
 950                         __u8 val = data[4];
 951                         tab_on_first(&first);
 952                         printf("\t * Wi-Fi Protected Setup State: %d%s%s\n",
 953                                val,
 954                                val == 1 ? " (Unconfigured)" : "",
 955                                val == 2 ? " (Configured)" : "");
 956                         break;
 957                 }
 958                 case 0x1047:
 959                         tab_on_first(&first);
 960                         printf("\t * UUID: ");
 961                         if (sublen != 16) {
 962                                 printf("(invalid, length=%d)\n", sublen);
 963                                 break;
 964                         }
 965                         printf("%02x%02x%02x%02x-%02x%02x-%02x%02x-"
 966                                 "%02x%02x-%02x%02x%02x%02x%02x%02x\n",
 967                                 data[4], data[5], data[6], data[7],
 968                                 data[8], data[9], data[10], data[11],
 969                                 data[12], data[13], data[14], data[15],
 970                                 data[16], data[17], data[18], data[19]);
 971                         break;
 972                 case 0x1054: {
 973                         tab_on_first(&first);
 974                         if (sublen != 8) {
 975                                 printf("\t * Primary Device Type: (invalid "
 976                                        "length %d)\n", sublen);
 977                                 break;
 978                         }
 979                         printf("\t * Primary Device Type: "
 980                                "%u-%02x%02x%02x%02x-%u\n",
 981                                data[4] << 8 | data[5],
 982                                data[6], data[7], data[8], data[9],
 983                                data[10] << 8 | data[11]);
 984                         break;
 985                 }
 986                 case 0x1057: {
 987                         __u8 val = data[4];
 988                         tab_on_first(&first);
 989                         printf("\t * AP setup locked: 0x%.2x\n", val);
 990                         break;
 991                 }
 992                 case 0x1008:
 993                 case 0x1053: {
 994                         __u16 meth = (data[4] << 8) + data[5];
 995                         bool comma = false;
 996                         tab_on_first(&first);
 997                         printf("\t * %sConfig methods:",
 998                                subtype == 0x1053 ? "Selected Registrar ": "");
 999 #define T(bit, name) do {               \
1000         if (meth & (1<<bit)) {          \
1001                 if (comma)              \
1002                         printf(",");    \
1003                 comma = true;           \
1004                 printf(" " name);       \
1005         } } while (0)
1006                         T(0, "USB");
1007                         T(1, "Ethernet");
1008                         T(2, "Label");
1009                         T(3, "Display");
1010                         T(4, "Ext. NFC");
1011                         T(5, "Int. NFC");
1012                         T(6, "NFC Intf.");
1013                         T(7, "PBC");
1014                         T(8, "Keypad");
1015                         printf("\n");
1016                         break;
1017 #undef T
1018                 }
1019                 default: {
1020                         const __u8 *subdata = data + 4;
1021                         __u16 tmplen = sublen;
1022
1023                         tab_on_first(&first);
1024                         printf("\t * Unknown TLV (%#.4x, %d bytes):",
1025                                subtype, tmplen);
1026                         while (tmplen) {
1027                                 printf(" %.2x", *subdata);
1028                                 subdata++;
1029                                 tmplen--;
1030                         }
1031                         printf("\n");
1032                         break;
1033                 }
1034                 }
1035
1036                 data += sublen + 4;
1037                 len -= sublen + 4;
1038         }
1039
1040         if (len != 0) {
1041                 printf("\t\t * bogus tail data (%d):", len);
1042                 while (len) {
1043                         printf(" %.2x", *data);
1044                         data++;
1045                         len--;
1046                 }
1047                 printf("\n");
1048         }
1049 }
1050
1051 static const struct ie_print wifiprinters[] = {
1052         [1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
1053         [2] = { "WMM", print_wifi_wmm, 1, 255, BIT(PRINT_SCAN), },
1054         [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
1055 };
1056
1057 static inline void print_p2p(const uint8_t type, uint8_t len, const uint8_t *data)
1058 {
1059         bool first = true;
1060         __u8 subtype;
1061         __u16 sublen;
1062
1063         while (len >= 3) {
1064                 subtype = data[0];
1065                 sublen = (data[2] << 8) + data[1];
1066
1067                 if (sublen > len - 3)
1068                         break;
1069
1070                 switch (subtype) {
1071                 case 0x02: /* capability */
1072                         tab_on_first(&first);
1073                         if (sublen < 2) {
1074                                 printf("\t * malformed capability\n");
1075                                 break;
1076                         }
1077                         printf("\t * Group capa: 0x%.2x, Device capa: 0x%.2x\n",
1078                                 data[3], data[4]);
1079                         break;
1080                 case 0x0d: /* device info */
1081                         if (sublen < 6 + 2 + 8 + 1) {
1082                                 printf("\t * malformed device info\n");
1083                                 break;
1084                         }
1085                         /* fall through for now */
1086                 case 0x00: /* status */
1087                 case 0x01: /* minor reason */
1088                 case 0x03: /* device ID */
1089                 case 0x04: /* GO intent */
1090                 case 0x05: /* configuration timeout */
1091                 case 0x06: /* listen channel */
1092                 case 0x07: /* group BSSID */
1093                 case 0x08: /* ext listen timing */
1094                 case 0x09: /* intended interface address */
1095                 case 0x0a: /* manageability */
1096                 case 0x0b: /* channel list */
1097                 case 0x0c: /* NoA */
1098                 case 0x0e: /* group info */
1099                 case 0x0f: /* group ID */
1100                 case 0x10: /* interface */
1101                 case 0x11: /* operating channel */
1102                 case 0x12: /* invitation flags */
1103                 case 0xdd: /* vendor specific */
1104                 default: {
1105                         const __u8 *subdata = data + 4;
1106                         __u16 tmplen = sublen;
1107
1108                         tab_on_first(&first);
1109                         printf("\t * Unknown TLV (%#.2x, %d bytes):",
1110                                subtype, tmplen);
1111                         while (tmplen) {
1112                                 printf(" %.2x", *subdata);
1113                                 subdata++;
1114                                 tmplen--;
1115                         }
1116                         printf("\n");
1117                         break;
1118                 }
1119                 }
1120
1121                 data += sublen + 3;
1122                 len -= sublen + 3;
1123         }
1124
1125         if (len != 0) {
1126                 tab_on_first(&first);
1127                 printf("\t * bogus tail data (%d):", len);
1128                 while (len) {
1129                         printf(" %.2x", *data);
1130                         data++;
1131                         len--;
1132                 }
1133                 printf("\n");
1134         }
1135 }
1136
1137 static const struct ie_print wfa_printers[] = {
1138         [9] = { "P2P", print_p2p, 2, 255, BIT(PRINT_SCAN), },
1139 };
1140
1141 static void print_vendor(unsigned char len, unsigned char *data,
1142                          bool unknown, enum print_ie_type ptype)
1143 {
1144         int i;
1145
1146         if (len < 3) {
1147                 printf("\tVendor specific: <too short> data:");
1148                 for(i = 0; i < len; i++)
1149                         printf(" %.02x", data[i]);
1150                 printf("\n");
1151                 return;
1152         }
1153
1154         if (len >= 4 && memcmp(data, ms_oui, 3) == 0) {
1155                 if (data[3] < ARRAY_SIZE(wifiprinters) &&
1156                     wifiprinters[data[3]].name &&
1157                     wifiprinters[data[3]].flags & BIT(ptype)) {
1158                         print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
1159                         return;
1160                 }
1161                 if (!unknown)
1162                         return;
1163                 printf("\tMS/WiFi %#.2x, data:", data[3]);
1164                 for(i = 0; i < len - 4; i++)
1165                         printf(" %.02x", data[i + 4]);
1166                 printf("\n");
1167                 return;
1168         }
1169
1170         if (len >= 4 && memcmp(data, wfa_oui, 3) == 0) {
1171                 if (data[3] < ARRAY_SIZE(wfa_printers) &&
1172                     wfa_printers[data[3]].name &&
1173                     wfa_printers[data[3]].flags & BIT(ptype)) {
1174                         print_ie(&wfa_printers[data[3]], data[3], len - 4, data + 4);
1175                         return;
1176                 }
1177                 if (!unknown)
1178                         return;
1179                 printf("\tWFA %#.2x, data:", data[3]);
1180                 for(i = 0; i < len - 4; i++)
1181                         printf(" %.02x", data[i + 4]);
1182                 printf("\n");
1183                 return;
1184         }
1185
1186         if (!unknown)
1187                 return;
1188
1189         printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
1190                 data[0], data[1], data[2]);
1191         for (i = 3; i < len; i++)
1192                 printf(" %.2x", data[i]);
1193         printf("\n");
1194 }
1195
1196 void print_ies(unsigned char *ie, int ielen, bool unknown,
1197                enum print_ie_type ptype)
1198 {
1199         while (ielen >= 2 && ielen >= ie[1]) {
1200                 if (ie[0] < ARRAY_SIZE(ieprinters) &&
1201                     ieprinters[ie[0]].name &&
1202                     ieprinters[ie[0]].flags & BIT(ptype)) {
1203                         print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
1204                 } else if (ie[0] == 221 /* vendor */) {
1205                         print_vendor(ie[1], ie + 2, unknown, ptype);
1206                 } else if (unknown) {
1207                         int i;
1208
1209                         printf("\tUnknown IE (%d):", ie[0]);
1210                         for (i=0; i<ie[1]; i++)
1211                                 printf(" %.2x", ie[2+i]);
1212                         printf("\n");
1213                 }
1214                 ielen -= ie[1] + 2;
1215                 ie += ie[1] + 2;
1216         }
1217 }
1218
1219 static int print_bss_handler(struct nl_msg *msg, void *arg)
1220 {
1221         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1222         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1223         struct nlattr *bss[NL80211_BSS_MAX + 1];
1224         char mac_addr[20], dev[20];
1225         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
1226                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
1227                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
1228                 [NL80211_BSS_BSSID] = { },
1229                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
1230                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
1231                 [NL80211_BSS_INFORMATION_ELEMENTS] = { },
1232                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
1233                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
1234                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
1235                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
1236                 [NL80211_BSS_BEACON_IES] = { },
1237         };
1238         struct scan_params *params = arg;
1239         int show = params->show_both_ie_sets ? 2 : 1;
1240
1241         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1242                   genlmsg_attrlen(gnlh, 0), NULL);
1243
1244         if (!tb[NL80211_ATTR_BSS]) {
1245                 fprintf(stderr, "bss info missing!\n");
1246                 return NL_SKIP;
1247         }
1248         if (nla_parse_nested(bss, NL80211_BSS_MAX,
1249                              tb[NL80211_ATTR_BSS],
1250                              bss_policy)) {
1251                 fprintf(stderr, "failed to parse nested attributes!\n");
1252                 return NL_SKIP;
1253         }
1254
1255         if (!bss[NL80211_BSS_BSSID])
1256                 return NL_SKIP;
1257
1258         mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
1259         if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
1260         printf("BSS %s (on %s)", mac_addr, dev);
1261
1262         if (bss[NL80211_BSS_STATUS]) {
1263                 switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
1264                 case NL80211_BSS_STATUS_AUTHENTICATED:
1265                         printf(" -- authenticated");
1266                         break;
1267                 case NL80211_BSS_STATUS_ASSOCIATED:
1268                         printf(" -- associated");
1269                         break;
1270                 case NL80211_BSS_STATUS_IBSS_JOINED:
1271                         printf(" -- joined");
1272                         break;
1273                 default:
1274                         printf(" -- unknown status: %d",
1275                                 nla_get_u32(bss[NL80211_BSS_STATUS]));
1276                         break;
1277                 }
1278         }
1279         printf("\n");
1280
1281         if (bss[NL80211_BSS_TSF]) {
1282                 unsigned long long tsf;
1283                 tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
1284                 printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
1285                         tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
1286                         (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
1287         }
1288         if (bss[NL80211_BSS_FREQUENCY])
1289                 printf("\tfreq: %d\n",
1290                         nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
1291         if (bss[NL80211_BSS_BEACON_INTERVAL])
1292                 printf("\tbeacon interval: %d\n",
1293                         nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
1294         if (bss[NL80211_BSS_CAPABILITY]) {
1295                 __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1296                 printf("\tcapability:");
1297                 if (capa & WLAN_CAPABILITY_ESS)
1298                         printf(" ESS");
1299                 if (capa & WLAN_CAPABILITY_IBSS)
1300                         printf(" IBSS");
1301                 if (capa & WLAN_CAPABILITY_PRIVACY)
1302                         printf(" Privacy");
1303                 if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
1304                         printf(" ShortPreamble");
1305                 if (capa & WLAN_CAPABILITY_PBCC)
1306                         printf(" PBCC");
1307                 if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
1308                         printf(" ChannelAgility");
1309                 if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
1310                         printf(" SpectrumMgmt");
1311                 if (capa & WLAN_CAPABILITY_QOS)
1312                         printf(" QoS");
1313                 if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
1314                         printf(" ShortSlotTime");
1315                 if (capa & WLAN_CAPABILITY_APSD)
1316                         printf(" APSD");
1317                 if (capa & WLAN_CAPABILITY_DSSS_OFDM)
1318                         printf(" DSSS-OFDM");
1319                 printf(" (0x%.4x)\n", capa);
1320         }
1321         if (bss[NL80211_BSS_SIGNAL_MBM]) {
1322                 int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
1323                 printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
1324         }
1325         if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
1326                 unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
1327                 printf("\tsignal: %d/100\n", s);
1328         }
1329         if (bss[NL80211_BSS_SEEN_MS_AGO]) {
1330                 int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
1331                 printf("\tlast seen: %d ms ago\n", age);
1332         }
1333
1334         if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) {
1335                 if (bss[NL80211_BSS_BEACON_IES])
1336                         printf("\tInformation elements from Probe Response "
1337                                "frame:\n");
1338                 print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1339                           nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1340                           params->unknown, params->type);
1341         }
1342         if (bss[NL80211_BSS_BEACON_IES] && show--) {
1343                 printf("\tInformation elements from Beacon frame:\n");
1344                 print_ies(nla_data(bss[NL80211_BSS_BEACON_IES]),
1345                           nla_len(bss[NL80211_BSS_BEACON_IES]),
1346                           params->unknown, params->type);
1347         }
1348
1349         return NL_SKIP;
1350 }
1351
1352 static struct scan_params scan_params;
1353
1354 static int handle_scan_dump(struct nl80211_state *state,
1355                             struct nl_cb *cb,
1356                             struct nl_msg *msg,
1357                             int argc, char **argv,
1358                             enum id_input id)
1359 {
1360         if (argc > 1)
1361                 return 1;
1362
1363         memset(&scan_params, 0, sizeof(scan_params));
1364
1365         if (argc == 1 && !strcmp(argv[0], "-u"))
1366                 scan_params.unknown = true;
1367         else if (argc == 1 && !strcmp(argv[0], "-b"))
1368                 scan_params.show_both_ie_sets = true;
1369
1370         scan_params.type = PRINT_SCAN;
1371
1372         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
1373                   &scan_params);
1374         return 0;
1375 }
1376
1377 static int handle_scan_combined(struct nl80211_state *state,
1378                                 struct nl_cb *cb,
1379                                 struct nl_msg *msg,
1380                                 int argc, char **argv,
1381                                 enum id_input id)
1382 {
1383         char **trig_argv;
1384         static char *dump_argv[] = {
1385                 NULL,
1386                 "scan",
1387                 "dump",
1388                 NULL,
1389         };
1390         static const __u32 cmds[] = {
1391                 NL80211_CMD_NEW_SCAN_RESULTS,
1392                 NL80211_CMD_SCAN_ABORTED,
1393         };
1394         int trig_argc, dump_argc, err;
1395
1396         if (argc >= 3 && !strcmp(argv[2], "-u")) {
1397                 dump_argc = 4;
1398                 dump_argv[3] = "-u";
1399         } else if (argc >= 3 && !strcmp(argv[2], "-b")) {
1400                 dump_argc = 4;
1401                 dump_argv[3] = "-b";
1402         } else
1403                 dump_argc = 3;
1404
1405         trig_argc = 3 + (argc - 2) + (3 - dump_argc);
1406         trig_argv = calloc(trig_argc, sizeof(*trig_argv));
1407         if (!trig_argv)
1408                 return -ENOMEM;
1409         trig_argv[0] = argv[0];
1410         trig_argv[1] = "scan";
1411         trig_argv[2] = "trigger";
1412         int i;
1413         for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
1414                 trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
1415         err = handle_cmd(state, id, trig_argc, trig_argv);
1416         free(trig_argv);
1417         if (err)
1418                 return err;
1419
1420         /*
1421          * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
1422          *
1423          * This code has a bug, which requires creating a separate
1424          * nl80211 socket to fix:
1425          * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
1426          * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
1427          * before (!) we listen to it, because we only start listening
1428          * after we send our scan request.
1429          *
1430          * Doing it the other way around has a race condition as well,
1431          * if you first open the events socket you may get a notification
1432          * for a previous scan.
1433          *
1434          * The only proper way to fix this would be to listen to events
1435          * before sending the command, and for the kernel to send the
1436          * scan request along with the event, so that you can match up
1437          * whether the scan you requested was finished or aborted (this
1438          * may result in processing a scan that another application
1439          * requested, but that doesn't seem to be a problem).
1440          *
1441          * Alas, the kernel doesn't do that (yet).
1442          */
1443
1444         if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
1445                                         NL80211_CMD_SCAN_ABORTED) {
1446                 printf("scan aborted!\n");
1447                 return 0;
1448         }
1449
1450         dump_argv[0] = argv[0];
1451         return handle_cmd(state, id, dump_argc, dump_argv);
1452 }
1453 TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [lowpri,flush,ap-force] [ssid <ssid>*|passive]", 0, 0,
1454          CIB_NETDEV, handle_scan_combined,
1455          "Scan on the given frequencies and probe for the given SSIDs\n"
1456          "(or wildcard if not given) unless passive scanning is requested.\n"
1457          "If -u is specified print unknown data in the scan results.\n"
1458          "Specified (vendor) IEs must be well-formed.");
1459 COMMAND(scan, dump, "[-u]",
1460         NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
1461         "Dump the current scan results. If -u is specified, print unknown\n"
1462         "data in scan results.");
1463 COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [lowpri,flush,ap-force] [ssid <ssid>*|passive]",
1464         NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
1465          "Trigger a scan on the given frequencies with probing for the given\n"
1466          "SSIDs (or wildcard if not given) unless passive scanning is requested.");