scan.c

   1 #include <net/if.h>
   2 #include <errno.h>
   3 #include <string.h>
   4 #include <ctype.h>
   5 #include <stdbool.h>
   6
   7 #include <netlink/genl/genl.h>
   8 #include <netlink/genl/family.h>
   9 #include <netlink/genl/ctrl.h>
  10 #include <netlink/msg.h>
  11 #include <netlink/attr.h>
  12
  13 #include "nl80211.h"
  14 #include "iw.h"
  15
  16 #define WLAN_CAPABILITY_ESS             (1<<0)
  17 #define WLAN_CAPABILITY_IBSS            (1<<1)
  18 #define WLAN_CAPABILITY_CF_POLLABLE     (1<<2)
  19 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
  20 #define WLAN_CAPABILITY_PRIVACY         (1<<4)
  21 #define WLAN_CAPABILITY_SHORT_PREAMBLE  (1<<5)
  22 #define WLAN_CAPABILITY_PBCC            (1<<6)
  23 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
  24 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
  25 #define WLAN_CAPABILITY_QOS             (1<<9)
  26 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
  27 #define WLAN_CAPABILITY_APSD            (1<<11)
  28 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
  29
  30 static unsigned char ms_oui[3]          = { 0x00, 0x50, 0xf2 };
  31 static unsigned char ieee80211_oui[3]   = { 0x00, 0x0f, 0xac };
  32 static unsigned char wfa_oui[3]         = { 0x50, 0x6f, 0x9a };
  33
  34 struct scan_params {
  35         bool unknown;
  36         enum print_ie_type type;
  37         bool show_both_ie_sets;
  38 };
  39
  40 #define IEEE80211_COUNTRY_EXTENSION_ID 201
  41
  42 union ieee80211_country_ie_triplet {
  43         struct {
  44                 __u8 first_channel;
  45                 __u8 num_channels;
  46                 __s8 max_power;
  47         } __attribute__ ((packed)) chans;
  48         struct {
  49                 __u8 reg_extension_id;
  50                 __u8 reg_class;
  51                 __u8 coverage_class;
  52         } __attribute__ ((packed)) ext;
  53 } __attribute__ ((packed));
  54
  55 static int handle_scan(struct nl80211_state *state,
  56                        struct nl_cb *cb,
  57                        struct nl_msg *msg,
  58                        int argc, char **argv,
  59                        enum id_input id)
  60 {
  61         struct nl_msg *ssids = NULL, *freqs = NULL;
  62         char *eptr;
  63         int err = -ENOBUFS;
  64         int i;
  65         enum {
  66                 NONE,
  67                 FREQ,
  68                 IES,
  69                 SSID,
  70                 DONE,
  71         } parse = NONE;
  72         int freq;
  73         bool passive = false, have_ssids = false, have_freqs = false;
  74         size_t tmp;
  75         unsigned char *ies;
  76         int flags = 0;
  77
  78         ssids = nlmsg_alloc();
  79         if (!ssids)
  80                 return -ENOMEM;
  81
  82         freqs = nlmsg_alloc();
  83         if (!freqs) {
  84                 nlmsg_free(ssids);
  85                 return -ENOMEM;
  86         }
  87
  88         for (i = 0; i < argc; i++) {
  89                 switch (parse) {
  90                 case NONE:
  91                         if (strcmp(argv[i], "freq") == 0) {
  92                                 parse = FREQ;
  93                                 have_freqs = true;
  94                                 break;
  95                         } else if (strcmp(argv[i], "ies") == 0) {
  96                                 parse = IES;
  97                                 break;
  98                         } else if (strcmp(argv[i], "lowpri") == 0) {
  99                                 parse = NONE;
 100                                 flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 101                                 break;
 102                         } else if (strcmp(argv[i], "flush") == 0) {
 103                                 parse = NONE;
 104                                 flags |= NL80211_SCAN_FLAG_FLUSH;
 105                                 break;
 106                         } else if (strcmp(argv[i], "ssid") == 0) {
 107                                 parse = SSID;
 108                                 have_ssids = true;
 109                                 break;
 110                         } else if (strcmp(argv[i], "passive") == 0) {
 111                                 parse = DONE;
 112                                 passive = true;
 113                                 break;
 114                         }
 115                 case DONE:
 116                         return 1;
 117                 case FREQ:
 118                         freq = strtoul(argv[i], &eptr, 10);
 119                         if (eptr != argv[i] + strlen(argv[i])) {
 120                                 /* failed to parse as number -- maybe a tag? */
 121                                 i--;
 122                                 parse = NONE;
 123                                 continue;
 124                         }
 125                         NLA_PUT_U32(freqs, i, freq);
 126                         break;
 127                 case IES:
 128                         ies = parse_hex(argv[i], &tmp);
 129                         if (!ies)
 130                                 goto nla_put_failure;
 131                         NLA_PUT(msg, NL80211_ATTR_IE, tmp, ies);
 132                         free(ies);
 133                         parse = NONE;
 134                         break;
 135                 case SSID:
 136                         NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
 137                         break;
 138                 }
 139         }
 140
 141         if (!have_ssids)
 142                 NLA_PUT(ssids, 1, 0, "");
 143         if (!passive)
 144                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
 145
 146         if (have_freqs)
 147                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
 148         if (flags)
 149                 NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS, flags);
 150
 151         err = 0;
 152  nla_put_failure:
 153         nlmsg_free(ssids);
 154         nlmsg_free(freqs);
 155         return err;
 156 }
 157
 158 static void tab_on_first(bool *first)
 159 {
 160         if (!*first)
 161                 printf("\t");
 162         else
 163                 *first = false;
 164 }
 165
 166 static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
 167 {
 168         printf(" ");
 169         print_ssid_escaped(len, data);
 170         printf("\n");
 171 }
 172
 173 #define BSS_MEMBERSHIP_SELECTOR_HT_PHY 127
 174
 175 static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 176 {
 177         int i;
 178
 179         printf(" ");
 180
 181         for (i = 0; i < len; i++) {
 182                 int r = data[i] & 0x7f;
 183
 184                 if (r == BSS_MEMBERSHIP_SELECTOR_HT_PHY && data[i] & 0x80)
 185                         printf("HT");
 186                 else
 187                         printf("%d.%d", r/2, 5*(r&1));
 188
 189                 printf("%s ", data[i] & 0x80 ? "*" : "");
 190         }
 191         printf("\n");
 192 }
 193
 194 static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
 195 {
 196         printf(" channel %d\n", data[0]);
 197 }
 198
 199 static const char *country_env_str(char environment)
 200 {
 201         switch (environment) {
 202         case 'I':
 203                 return "Indoor only";
 204         case 'O':
 205                 return "Outdoor only";
 206         case ' ':
 207                 return "Indoor/Outdoor";
 208         default:
 209                 return "bogus";
 210         }
 211 }
 212
 213 static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
 214 {
 215         printf(" %.*s", 2, data);
 216
 217         printf("\tEnvironment: %s\n", country_env_str(data[2]));
 218
 219         data += 3;
 220         len -= 3;
 221
 222         if (len < 3) {
 223                 printf("\t\tNo country IE triplets present\n");
 224                 return;
 225         }
 226
 227         while (len >= 3) {
 228                 int end_channel;
 229                 union ieee80211_country_ie_triplet *triplet = (void *) data;
 230
 231                 if (triplet->ext.reg_extension_id >= IEEE80211_COUNTRY_EXTENSION_ID) {
 232                         printf("\t\tExtension ID: %d Regulatory Class: %d Coverage class: %d (up to %dm)\n",
 233                                triplet->ext.reg_extension_id,
 234                                triplet->ext.reg_class,
 235                                triplet->ext.coverage_class,
 236                                triplet->ext.coverage_class * 450);
 237
 238                         data += 3;
 239                         len -= 3;
 240                         continue;
 241                 }
 242
 243                 /* 2 GHz */
 244                 if (triplet->chans.first_channel <= 14)
 245                         end_channel = triplet->chans.first_channel + (triplet->chans.num_channels - 1);
 246                 else
 247                         end_channel =  triplet->chans.first_channel + (4 * (triplet->chans.num_channels - 1));
 248
 249                 printf("\t\tChannels [%d - %d] @ %d dBm\n", triplet->chans.first_channel, end_channel, triplet->chans.max_power);
 250
 251                 data += 3;
 252                 len -= 3;
 253         }
 254
 255         return;
 256 }
 257
 258 static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
 259 {
 260         printf(" %d dB\n", data[0]);
 261 }
 262
 263 static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 264 {
 265         if (data[0] == 0x00)
 266                 printf(" <no flags>");
 267         if (data[0] & 0x01)
 268                 printf(" NonERP_Present");
 269         if (data[0] & 0x02)
 270                 printf(" Use_Protection");
 271         if (data[0] & 0x04)
 272                 printf(" Barker_Preamble_Mode");
 273         printf("\n");
 274 }
 275
 276 static void print_cipher(const uint8_t *data)
 277 {
 278         if (memcmp(data, ms_oui, 3) == 0) {
 279                 switch (data[3]) {
 280                 case 0:
 281                         printf("Use group cipher suite");
 282                         break;
 283                 case 1:
 284                         printf("WEP-40");
 285                         break;
 286                 case 2:
 287                         printf("TKIP");
 288                         break;
 289                 case 4:
 290                         printf("CCMP");
 291                         break;
 292                 case 5:
 293                         printf("WEP-104");
 294                         break;
 295                 default:
 296                         printf("%.02x-%.02x-%.02x:%d",
 297                                 data[0], data[1] ,data[2], data[3]);
 298                         break;
 299                 }
 300         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 301                 switch (data[3]) {
 302                 case 0:
 303                         printf("Use group cipher suite");
 304                         break;
 305                 case 1:
 306                         printf("WEP-40");
 307                         break;
 308                 case 2:
 309                         printf("TKIP");
 310                         break;
 311                 case 4:
 312                         printf("CCMP");
 313                         break;
 314                 case 5:
 315                         printf("WEP-104");
 316                         break;
 317                 case 6:
 318                         printf("AES-128-CMAC");
 319                         break;
 320                 case 8:
 321                         printf("GCMP");
 322                         break;
 323                 default:
 324                         printf("%.02x-%.02x-%.02x:%d",
 325                                 data[0], data[1] ,data[2], data[3]);
 326                         break;
 327                 }
 328         } else
 329                 printf("%.02x-%.02x-%.02x:%d",
 330                         data[0], data[1] ,data[2], data[3]);
 331 }
 332
 333 static void print_auth(const uint8_t *data)
 334 {
 335         if (memcmp(data, ms_oui, 3) == 0) {
 336                 switch (data[3]) {
 337                 case 1:
 338                         printf("IEEE 802.1X");
 339                         break;
 340                 case 2:
 341                         printf("PSK");
 342                         break;
 343                 default:
 344                         printf("%.02x-%.02x-%.02x:%d",
 345                                 data[0], data[1] ,data[2], data[3]);
 346                         break;
 347                 }
 348         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 349                 switch (data[3]) {
 350                 case 1:
 351                         printf("IEEE 802.1X");
 352                         break;
 353                 case 2:
 354                         printf("PSK");
 355                         break;
 356                 case 3:
 357                         printf("FT/IEEE 802.1X");
 358                         break;
 359                 case 4:
 360                         printf("FT/PSK");
 361                         break;
 362                 case 5:
 363                         printf("IEEE 802.1X/SHA-256");
 364                         break;
 365                 case 6:
 366                         printf("PSK/SHA-256");
 367                         break;
 368                 default:
 369                         printf("%.02x-%.02x-%.02x:%d",
 370                                 data[0], data[1] ,data[2], data[3]);
 371                         break;
 372                 }
 373         } else
 374                 printf("%.02x-%.02x-%.02x:%d",
 375                         data[0], data[1] ,data[2], data[3]);
 376 }
 377
 378 static void print_rsn_ie(const char *defcipher, const char *defauth,
 379                          uint8_t len, const uint8_t *data)
 380 {
 381         bool first = true;
 382         __u16 version, count, capa;
 383         int i;
 384
 385         version = data[0] + (data[1] << 8);
 386         tab_on_first(&first);
 387         printf("\t * Version: %d\n", version);
 388
 389         data += 2;
 390         len -= 2;
 391
 392         if (len < 4) {
 393                 tab_on_first(&first);
 394                 printf("\t * Group cipher: %s\n", defcipher);
 395                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 396                 return;
 397         }
 398
 399         tab_on_first(&first);
 400         printf("\t * Group cipher: ");
 401         print_cipher(data);
 402         printf("\n");
 403
 404         data += 4;
 405         len -= 4;
 406
 407         if (len < 2) {
 408                 tab_on_first(&first);
 409                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 410                 return;
 411         }
 412
 413         count = data[0] | (data[1] << 8);
 414         if (2 + (count * 4) > len)
 415                 goto invalid;
 416
 417         tab_on_first(&first);
 418         printf("\t * Pairwise ciphers:");
 419         for (i = 0; i < count; i++) {
 420                 printf(" ");
 421                 print_cipher(data + 2 + (i * 4));
 422         }
 423         printf("\n");
 424
 425         data += 2 + (count * 4);
 426         len -= 2 + (count * 4);
 427
 428         if (len < 2) {
 429                 tab_on_first(&first);
 430                 printf("\t * Authentication suites: %s\n", defauth);
 431                 return;
 432         }
 433
 434         count = data[0] | (data[1] << 8);
 435         if (2 + (count * 4) > len)
 436                 goto invalid;
 437
 438         tab_on_first(&first);
 439         printf("\t * Authentication suites:");
 440         for (i = 0; i < count; i++) {
 441                 printf(" ");
 442                 print_auth(data + 2 + (i * 4));
 443         }
 444         printf("\n");
 445
 446         data += 2 + (count * 4);
 447         len -= 2 + (count * 4);
 448
 449         if (len >= 2) {
 450                 capa = data[0] | (data[1] << 8);
 451                 tab_on_first(&first);
 452                 printf("\t * Capabilities:");
 453                 if (capa & 0x0001)
 454                         printf(" PreAuth");
 455                 if (capa & 0x0002)
 456                         printf(" NoPairwise");
 457                 switch ((capa & 0x000c) >> 2) {
 458                 case 0:
 459                         break;
 460                 case 1:
 461                         printf(" 2-PTKSA-RC");
 462                         break;
 463                 case 2:
 464                         printf(" 4-PTKSA-RC");
 465                         break;
 466                 case 3:
 467                         printf(" 16-PTKSA-RC");
 468                         break;
 469                 }
 470                 switch ((capa & 0x0030) >> 4) {
 471                 case 0:
 472                         break;
 473                 case 1:
 474                         printf(" 2-GTKSA-RC");
 475                         break;
 476                 case 2:
 477                         printf(" 4-GTKSA-RC");
 478                         break;
 479                 case 3:
 480                         printf(" 16-GTKSA-RC");
 481                         break;
 482                 }
 483                 if (capa & 0x0040)
 484                         printf(" MFP-required");
 485                 if (capa & 0x0080)
 486                         printf(" MFP-capable");
 487                 if (capa & 0x0200)
 488                         printf(" Peerkey-enabled");
 489                 if (capa & 0x0400)
 490                         printf(" SPP-AMSDU-capable");
 491                 if (capa & 0x0800)
 492                         printf(" SPP-AMSDU-required");
 493                 printf(" (0x%.4x)\n", capa);
 494                 data += 2;
 495                 len -= 2;
 496         }
 497
 498         if (len >= 2) {
 499                 int pmkid_count = data[0] | (data[1] << 8);
 500
 501                 if (len >= 2 + 16 * pmkid_count) {
 502                         tab_on_first(&first);
 503                         printf("\t * %d PMKIDs\n", pmkid_count);
 504                         /* not printing PMKID values */
 505                         data += 2 + 16 * pmkid_count;
 506                         len -= 2 + 16 * pmkid_count;
 507                 } else
 508                         goto invalid;
 509         }
 510
 511         if (len >= 4) {
 512                 tab_on_first(&first);
 513                 printf("\t * Group mgmt cipher suite: ");
 514                 print_cipher(data);
 515                 printf("\n");
 516                 data += 4;
 517                 len -= 4;
 518         }
 519
 520  invalid:
 521         if (len != 0) {
 522                 printf("\t\t * bogus tail data (%d):", len);
 523                 while (len) {
 524                         printf(" %.2x", *data);
 525                         data++;
 526                         len--;
 527                 }
 528                 printf("\n");
 529         }
 530 }
 531
 532 static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
 533 {
 534         print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 535 }
 536
 537 static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
 538 {
 539         printf("\n");
 540         print_ht_capability(data[0] | (data[1] << 8));
 541         print_ampdu_length(data[2] & 3);
 542         print_ampdu_spacing((data[2] >> 2) & 7);
 543         print_ht_mcs(data + 3);
 544 }
 545
 546 static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
 547 {
 548         static const char *offset[4] = {
 549                 "no secondary",
 550                 "above",
 551                 "[reserved!]",
 552                 "below",
 553         };
 554         static const char *protection[4] = {
 555                 "no",
 556                 "nonmember",
 557                 "20 MHz",
 558                 "non-HT mixed",
 559         };
 560         static const char *sta_chan_width[2] = {
 561                 "20 MHz",
 562                 "any",
 563         };
 564
 565         printf("\n");
 566         printf("\t\t * primary channel: %d\n", data[0]);
 567         printf("\t\t * secondary channel offset: %s\n",
 568                 offset[data[1] & 0x3]);
 569         printf("\t\t * STA channel width: %s\n", sta_chan_width[(data[1] & 0x4)>>2]);
 570         printf("\t\t * RIFS: %d\n", (data[1] & 0x8)>>3);
 571         printf("\t\t * HT protection: %s\n", protection[data[2] & 0x3]);
 572         printf("\t\t * non-GF present: %d\n", (data[2] & 0x4) >> 2);
 573         printf("\t\t * OBSS non-GF present: %d\n", (data[2] & 0x10) >> 4);
 574         printf("\t\t * dual beacon: %d\n", (data[4] & 0x40) >> 6);
 575         printf("\t\t * dual CTS protection: %d\n", (data[4] & 0x80) >> 7);
 576         printf("\t\t * STBC beacon: %d\n", data[5] & 0x1);
 577         printf("\t\t * L-SIG TXOP Prot: %d\n", (data[5] & 0x2) >> 1);
 578         printf("\t\t * PCO active: %d\n", (data[5] & 0x4) >> 2);
 579         printf("\t\t * PCO phase: %d\n", (data[5] & 0x8) >> 3);
 580 }
 581
 582 static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 583 {
 584         int i, base, bit;
 585         bool first = true;
 586
 587
 588         for (i = 0; i < len; i++) {
 589                 base = i * 8;
 590
 591                 for (bit = 0; bit < 8; bit++) {
 592                         if (!(data[i] & (1 << bit)))
 593                                 continue;
 594
 595                         if (!first)
 596                                 printf(",");
 597                         else
 598                                 first = false;
 599
 600                         switch (bit + base) {
 601                         case 0:
 602                                 printf(" HT Information Exchange Supported");
 603                                 break;
 604                         case 1:
 605                                 printf(" On-demand Beacon");
 606                                 break;
 607                         case 2:
 608                                 printf(" Extended Channel Switching");
 609                                 break;
 610                         case 3:
 611                                 printf(" Wave Indication");
 612                                 break;
 613                         case 4:
 614                                 printf(" PSMP Capability");
 615                                 break;
 616                         case 5:
 617                                 printf(" Service Interval Granularity");
 618                                 break;
 619                         case 6:
 620                                 printf(" S-PSMP Capability");
 621                                 break;
 622                         default:
 623                                 printf(" %d", bit);
 624                                 break;
 625                         }
 626                 }
 627         }
 628
 629         printf("\n");
 630 }
 631
 632 static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data)
 633 {
 634         printf(" DTIM Count %u DTIM Period %u Bitmap Control 0x%x "
 635                "Bitmap[0] 0x%x",
 636                data[0], data[1], data[2], data[3]);
 637         if (len - 4)
 638                 printf(" (+ %u octet%s)", len - 4, len - 4 == 1 ? "" : "s");
 639         printf("\n");
 640 }
 641
 642 struct ie_print {
 643         const char *name;
 644         void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
 645         uint8_t minlen, maxlen;
 646         uint8_t flags;
 647 };
 648
 649 static void print_ie(const struct ie_print *p, const uint8_t type,
 650                      uint8_t len, const uint8_t *data)
 651 {
 652         int i;
 653
 654         if (!p->print)
 655                 return;
 656
 657         printf("\t%s:", p->name);
 658         if (len < p->minlen || len > p->maxlen) {
 659                 if (len > 1) {
 660                         printf(" <invalid: %d bytes:", len);
 661                         for (i = 0; i < len; i++)
 662                                 printf(" %.02x", data[i]);
 663                         printf(">\n");
 664                 } else if (len)
 665                         printf(" <invalid: 1 byte: %.02x>\n", data[0]);
 666                 else
 667                         printf(" <invalid: no data>\n");
 668                 return;
 669         }
 670
 671         p->print(type, len, data);
 672 }
 673
 674 #define PRINT_IGN {             \
 675         .name = "IGNORE",       \
 676         .print = NULL,          \
 677         .minlen = 0,            \
 678         .maxlen = 255,          \
 679 }
 680
 681 static const struct ie_print ieprinters[] = {
 682         [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
 683         [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 684         [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
 685         [5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), },
 686         [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
 687         [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
 688         [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
 689         [45] = { "HT capabilities", print_ht_capa, 26, 26, BIT(PRINT_SCAN), },
 690         [61] = { "HT operation", print_ht_op, 22, 22, BIT(PRINT_SCAN), },
 691         [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
 692         [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 693         [114] = { "MESH ID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
 694         [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
 695 };
 696
 697 static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
 698 {
 699         print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
 700 }
 701
 702 static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
 703 {
 704         int i;
 705         static const char *aci_tbl[] = { "BE", "BK", "VI", "VO" };
 706
 707         if (len < 19)
 708                 goto invalid;
 709
 710         if (data[0] != 1) {
 711                 printf("Parameter: not version 1: ");
 712                 return false;
 713         }
 714
 715         printf("\t * Parameter version 1");
 716
 717         data++;
 718
 719         if (data[0] & 0x80)
 720                 printf("\n\t\t * u-APSD");
 721
 722         data += 2;
 723
 724         for (i = 0; i < 4; i++) {
 725                 printf("\n\t\t * %s:", aci_tbl[(data[0] >> 5) & 3]);
 726                 if (data[0] & 0x10)
 727                         printf(" acm");
 728                 printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1,
 729                                     (1 << (data[1] >> 4)) - 1);
 730                 printf(", AIFSN %d", data[0] & 0xf);
 731                 if (data[2] | data[3])
 732                         printf(", TXOP %d usec", (data[2] + (data[3] << 8)) * 32);
 733                 data += 4;
 734         }
 735
 736         printf("\n");
 737         return true;
 738
 739  invalid:
 740         printf("invalid: ");
 741         return false;
 742 }
 743
 744 static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
 745 {
 746         int i;
 747
 748         switch (data[0]) {
 749         case 0x00:
 750                 printf(" information:");
 751                 break;
 752         case 0x01:
 753                 if (print_wifi_wmm_param(data + 1, len - 1))
 754                         return;
 755                 break;
 756         default:
 757                 printf(" type %d:", data[0]);
 758                 break;
 759         }
 760
 761         for(i = 1; i < len; i++)
 762                 printf(" %.02x", data[i]);
 763         printf("\n");
 764 }
 765
 766 static const char * wifi_wps_dev_passwd_id(uint16_t id)
 767 {
 768         switch (id) {
 769         case 0:
 770                 return "Default (PIN)";
 771         case 1:
 772                 return "User-specified";
 773         case 2:
 774                 return "Machine-specified";
 775         case 3:
 776                 return "Rekey";
 777         case 4:
 778                 return "PushButton";
 779         case 5:
 780                 return "Registrar-specified";
 781         default:
 782                 return "??";
 783         }
 784 }
 785
 786 static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
 787 {
 788         bool first = true;
 789         __u16 subtype, sublen;
 790
 791         while (len >= 4) {
 792                 subtype = (data[0] << 8) + data[1];
 793                 sublen = (data[2] << 8) + data[3];
 794                 if (sublen > len)
 795                         break;
 796
 797                 switch (subtype) {
 798                 case 0x104a:
 799                         tab_on_first(&first);
 800                         printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
 801                         break;
 802                 case 0x1011:
 803                         tab_on_first(&first);
 804                         printf("\t * Device name: %.*s\n", sublen, data + 4);
 805                         break;
 806                 case 0x1012: {
 807                         uint16_t id;
 808                         tab_on_first(&first);
 809                         if (sublen != 2) {
 810                                 printf("\t * Device Password ID: (invalid "
 811                                        "length %d)\n", sublen);
 812                                 break;
 813                         }
 814                         id = data[4] << 8 | data[5];
 815                         printf("\t * Device Password ID: %u (%s)\n",
 816                                id, wifi_wps_dev_passwd_id(id));
 817                         break;
 818                 }
 819                 case 0x1021:
 820                         tab_on_first(&first);
 821                         printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
 822                         break;
 823                 case 0x1023:
 824                         tab_on_first(&first);
 825                         printf("\t * Model: %.*s\n", sublen, data + 4);
 826                         break;
 827                 case 0x1024:
 828                         tab_on_first(&first);
 829                         printf("\t * Model Number: %.*s\n", sublen, data + 4);
 830                         break;
 831                 case 0x103b: {
 832                         __u8 val = data[4];
 833                         tab_on_first(&first);
 834                         printf("\t * Response Type: %d%s\n",
 835                                val, val == 3 ? " (AP)" : "");
 836                         break;
 837                 }
 838                 case 0x103c: {
 839                         __u8 val = data[4];
 840                         tab_on_first(&first);
 841                         printf("\t * RF Bands: 0x%x\n", val);
 842                         break;
 843                 }
 844                 case 0x1041: {
 845                         __u8 val = data[4];
 846                         tab_on_first(&first);
 847                         printf("\t * Selected Registrar: 0x%x\n", val);
 848                         break;
 849                 }
 850                 case 0x1042:
 851                         tab_on_first(&first);
 852                         printf("\t * Serial Number: %.*s\n", sublen, data + 4);
 853                         break;
 854                 case 0x1044: {
 855                         __u8 val = data[4];
 856                         tab_on_first(&first);
 857                         printf("\t * Wi-Fi Protected Setup State: %d%s%s\n",
 858                                val,
 859                                val == 1 ? " (Unconfigured)" : "",
 860                                val == 2 ? " (Configured)" : "");
 861                         break;
 862                 }
 863                 case 0x1047:
 864                         tab_on_first(&first);
 865                         printf("\t * UUID: ");
 866                         if (sublen != 16) {
 867                                 printf("(invalid, length=%d)\n", sublen);
 868                                 break;
 869                         }
 870                         printf("%02x%02x%02x%02x-%02x%02x-%02x%02x-"
 871                                 "%02x%02x-%02x%02x%02x%02x%02x%02x\n",
 872                                 data[4], data[5], data[6], data[7],
 873                                 data[8], data[9], data[10], data[11],
 874                                 data[12], data[13], data[14], data[15],
 875                                 data[16], data[17], data[18], data[19]);
 876                         break;
 877                 case 0x1054: {
 878                         tab_on_first(&first);
 879                         if (sublen != 8) {
 880                                 printf("\t * Primary Device Type: (invalid "
 881                                        "length %d)\n", sublen);
 882                                 break;
 883                         }
 884                         printf("\t * Primary Device Type: "
 885                                "%u-%02x%02x%02x%02x-%u\n",
 886                                data[4] << 8 | data[5],
 887                                data[6], data[7], data[8], data[9],
 888                                data[10] << 8 | data[11]);
 889                         break;
 890                 }
 891                 case 0x1057: {
 892                         __u8 val = data[4];
 893                         tab_on_first(&first);
 894                         printf("\t * AP setup locked: 0x%.2x\n", val);
 895                         break;
 896                 }
 897                 case 0x1008:
 898                 case 0x1053: {
 899                         __u16 meth = (data[4] << 8) + data[5];
 900                         bool comma = false;
 901                         tab_on_first(&first);
 902                         printf("\t * %sConfig methods:",
 903                                subtype == 0x1053 ? "Selected Registrar ": "");
 904 #define T(bit, name) do {               \
 905         if (meth & (1<<bit)) {          \
 906                 if (comma)              \
 907                         printf(",");    \
 908                 comma = true;           \
 909                 printf(" " name);       \
 910         } } while (0)
 911                         T(0, "USB");
 912                         T(1, "Ethernet");
 913                         T(2, "Label");
 914                         T(3, "Display");
 915                         T(4, "Ext. NFC");
 916                         T(5, "Int. NFC");
 917                         T(6, "NFC Intf.");
 918                         T(7, "PBC");
 919                         T(8, "Keypad");
 920                         printf("\n");
 921                         break;
 922 #undef T
 923                 }
 924                 default: {
 925                         const __u8 *subdata = data + 4;
 926                         __u16 tmplen = sublen;
 927
 928                         tab_on_first(&first);
 929                         printf("\t * Unknown TLV (%#.4x, %d bytes):",
 930                                subtype, tmplen);
 931                         while (tmplen) {
 932                                 printf(" %.2x", *subdata);
 933                                 subdata++;
 934                                 tmplen--;
 935                         }
 936                         printf("\n");
 937                         break;
 938                 }
 939                 }
 940
 941                 data += sublen + 4;
 942                 len -= sublen + 4;
 943         }
 944
 945         if (len != 0) {
 946                 printf("\t\t * bogus tail data (%d):", len);
 947                 while (len) {
 948                         printf(" %.2x", *data);
 949                         data++;
 950                         len--;
 951                 }
 952                 printf("\n");
 953         }
 954 }
 955
 956 static const struct ie_print wifiprinters[] = {
 957         [1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
 958         [2] = { "WMM", print_wifi_wmm, 1, 255, BIT(PRINT_SCAN), },
 959         [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
 960 };
 961
 962 static inline void print_p2p(const uint8_t type, uint8_t len, const uint8_t *data)
 963 {
 964         bool first = true;
 965         __u8 subtype;
 966         __u16 sublen;
 967
 968         while (len >= 3) {
 969                 subtype = data[0];
 970                 sublen = (data[2] << 8) + data[1];
 971
 972                 if (sublen > len - 3)
 973                         break;
 974
 975                 switch (subtype) {
 976                 case 0x02: /* capability */
 977                         tab_on_first(&first);
 978                         if (sublen < 2) {
 979                                 printf("\t * malformed capability\n");
 980                                 break;
 981                         }
 982                         printf("\t * Group capa: 0x%.2x, Device capa: 0x%.2x\n",
 983                                 data[3], data[4]);
 984                         break;
 985                 case 0x0d: /* device info */
 986                         if (sublen < 6 + 2 + 8 + 1) {
 987                                 printf("\t * malformed device info\n");
 988                                 break;
 989                         }
 990                         /* fall through for now */
 991                 case 0x00: /* status */
 992                 case 0x01: /* minor reason */
 993                 case 0x03: /* device ID */
 994                 case 0x04: /* GO intent */
 995                 case 0x05: /* configuration timeout */
 996                 case 0x06: /* listen channel */
 997                 case 0x07: /* group BSSID */
 998                 case 0x08: /* ext listen timing */
 999                 case 0x09: /* intended interface address */
1000                 case 0x0a: /* manageability */
1001                 case 0x0b: /* channel list */
1002                 case 0x0c: /* NoA */
1003                 case 0x0e: /* group info */
1004                 case 0x0f: /* group ID */
1005                 case 0x10: /* interface */
1006                 case 0x11: /* operating channel */
1007                 case 0x12: /* invitation flags */
1008                 case 0xdd: /* vendor specific */
1009                 default: {
1010                         const __u8 *subdata = data + 4;
1011                         __u16 tmplen = sublen;
1012
1013                         tab_on_first(&first);
1014                         printf("\t * Unknown TLV (%#.2x, %d bytes):",
1015                                subtype, tmplen);
1016                         while (tmplen) {
1017                                 printf(" %.2x", *subdata);
1018                                 subdata++;
1019                                 tmplen--;
1020                         }
1021                         printf("\n");
1022                         break;
1023                 }
1024                 }
1025
1026                 data += sublen + 3;
1027                 len -= sublen + 3;
1028         }
1029
1030         if (len != 0) {
1031                 tab_on_first(&first);
1032                 printf("\t * bogus tail data (%d):", len);
1033                 while (len) {
1034                         printf(" %.2x", *data);
1035                         data++;
1036                         len--;
1037                 }
1038                 printf("\n");
1039         }
1040 }
1041
1042 static const struct ie_print wfa_printers[] = {
1043         [9] = { "P2P", print_p2p, 2, 255, BIT(PRINT_SCAN), },
1044 };
1045
1046 static void print_vendor(unsigned char len, unsigned char *data,
1047                          bool unknown, enum print_ie_type ptype)
1048 {
1049         int i;
1050
1051         if (len < 3) {
1052                 printf("\tVendor specific: <too short> data:");
1053                 for(i = 0; i < len; i++)
1054                         printf(" %.02x", data[i]);
1055                 printf("\n");
1056                 return;
1057         }
1058
1059         if (len >= 4 && memcmp(data, ms_oui, 3) == 0) {
1060                 if (data[3] < ARRAY_SIZE(wifiprinters) &&
1061                     wifiprinters[data[3]].name &&
1062                     wifiprinters[data[3]].flags & BIT(ptype)) {
1063                         print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
1064                         return;
1065                 }
1066                 if (!unknown)
1067                         return;
1068                 printf("\tMS/WiFi %#.2x, data:", data[3]);
1069                 for(i = 0; i < len - 4; i++)
1070                         printf(" %.02x", data[i + 4]);
1071                 printf("\n");
1072                 return;
1073         }
1074
1075         if (len >= 4 && memcmp(data, wfa_oui, 3) == 0) {
1076                 if (data[3] < ARRAY_SIZE(wfa_printers) &&
1077                     wfa_printers[data[3]].name &&
1078                     wfa_printers[data[3]].flags & BIT(ptype)) {
1079                         print_ie(&wfa_printers[data[3]], data[3], len - 4, data + 4);
1080                         return;
1081                 }
1082                 if (!unknown)
1083                         return;
1084                 printf("\tWFA %#.2x, data:", data[3]);
1085                 for(i = 0; i < len - 4; i++)
1086                         printf(" %.02x", data[i + 4]);
1087                 printf("\n");
1088                 return;
1089         }
1090
1091         if (!unknown)
1092                 return;
1093
1094         printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
1095                 data[0], data[1], data[2]);
1096         for (i = 3; i < len; i++)
1097                 printf(" %.2x", data[i]);
1098         printf("\n");
1099 }
1100
1101 void print_ies(unsigned char *ie, int ielen, bool unknown,
1102                enum print_ie_type ptype)
1103 {
1104         while (ielen >= 2 && ielen >= ie[1]) {
1105                 if (ie[0] < ARRAY_SIZE(ieprinters) &&
1106                     ieprinters[ie[0]].name &&
1107                     ieprinters[ie[0]].flags & BIT(ptype)) {
1108                         print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
1109                 } else if (ie[0] == 221 /* vendor */) {
1110                         print_vendor(ie[1], ie + 2, unknown, ptype);
1111                 } else if (unknown) {
1112                         int i;
1113
1114                         printf("\tUnknown IE (%d):", ie[0]);
1115                         for (i=0; i<ie[1]; i++)
1116                                 printf(" %.2x", ie[2+i]);
1117                         printf("\n");
1118                 }
1119                 ielen -= ie[1] + 2;
1120                 ie += ie[1] + 2;
1121         }
1122 }
1123
1124 static int print_bss_handler(struct nl_msg *msg, void *arg)
1125 {
1126         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1127         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1128         struct nlattr *bss[NL80211_BSS_MAX + 1];
1129         char mac_addr[20], dev[20];
1130         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
1131                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
1132                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
1133                 [NL80211_BSS_BSSID] = { },
1134                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
1135                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
1136                 [NL80211_BSS_INFORMATION_ELEMENTS] = { },
1137                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
1138                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
1139                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
1140                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
1141                 [NL80211_BSS_BEACON_IES] = { },
1142         };
1143         struct scan_params *params = arg;
1144         int show = params->show_both_ie_sets ? 2 : 1;
1145
1146         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1147                   genlmsg_attrlen(gnlh, 0), NULL);
1148
1149         if (!tb[NL80211_ATTR_BSS]) {
1150                 fprintf(stderr, "bss info missing!\n");
1151                 return NL_SKIP;
1152         }
1153         if (nla_parse_nested(bss, NL80211_BSS_MAX,
1154                              tb[NL80211_ATTR_BSS],
1155                              bss_policy)) {
1156                 fprintf(stderr, "failed to parse nested attributes!\n");
1157                 return NL_SKIP;
1158         }
1159
1160         if (!bss[NL80211_BSS_BSSID])
1161                 return NL_SKIP;
1162
1163         mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
1164         if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
1165         printf("BSS %s (on %s)", mac_addr, dev);
1166
1167         if (bss[NL80211_BSS_STATUS]) {
1168                 switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
1169                 case NL80211_BSS_STATUS_AUTHENTICATED:
1170                         printf(" -- authenticated");
1171                         break;
1172                 case NL80211_BSS_STATUS_ASSOCIATED:
1173                         printf(" -- associated");
1174                         break;
1175                 case NL80211_BSS_STATUS_IBSS_JOINED:
1176                         printf(" -- joined");
1177                         break;
1178                 default:
1179                         printf(" -- unknown status: %d",
1180                                 nla_get_u32(bss[NL80211_BSS_STATUS]));
1181                         break;
1182                 }
1183         }
1184         printf("\n");
1185
1186         if (bss[NL80211_BSS_TSF]) {
1187                 unsigned long long tsf;
1188                 tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
1189                 printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
1190                         tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
1191                         (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
1192         }
1193         if (bss[NL80211_BSS_FREQUENCY])
1194                 printf("\tfreq: %d\n",
1195                         nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
1196         if (bss[NL80211_BSS_BEACON_INTERVAL])
1197                 printf("\tbeacon interval: %d\n",
1198                         nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
1199         if (bss[NL80211_BSS_CAPABILITY]) {
1200                 __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1201                 printf("\tcapability:");
1202                 if (capa & WLAN_CAPABILITY_ESS)
1203                         printf(" ESS");
1204                 if (capa & WLAN_CAPABILITY_IBSS)
1205                         printf(" IBSS");
1206                 if (capa & WLAN_CAPABILITY_PRIVACY)
1207                         printf(" Privacy");
1208                 if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
1209                         printf(" ShortPreamble");
1210                 if (capa & WLAN_CAPABILITY_PBCC)
1211                         printf(" PBCC");
1212                 if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
1213                         printf(" ChannelAgility");
1214                 if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
1215                         printf(" SpectrumMgmt");
1216                 if (capa & WLAN_CAPABILITY_QOS)
1217                         printf(" QoS");
1218                 if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
1219                         printf(" ShortSlotTime");
1220                 if (capa & WLAN_CAPABILITY_APSD)
1221                         printf(" APSD");
1222                 if (capa & WLAN_CAPABILITY_DSSS_OFDM)
1223                         printf(" DSSS-OFDM");
1224                 printf(" (0x%.4x)\n", capa);
1225         }
1226         if (bss[NL80211_BSS_SIGNAL_MBM]) {
1227                 int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
1228                 printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
1229         }
1230         if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
1231                 unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
1232                 printf("\tsignal: %d/100\n", s);
1233         }
1234         if (bss[NL80211_BSS_SEEN_MS_AGO]) {
1235                 int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
1236                 printf("\tlast seen: %d ms ago\n", age);
1237         }
1238
1239         if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) {
1240                 if (bss[NL80211_BSS_BEACON_IES])
1241                         printf("\tInformation elements from Probe Response "
1242                                "frame:\n");
1243                 print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1244                           nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1245                           params->unknown, params->type);
1246         }
1247         if (bss[NL80211_BSS_BEACON_IES] && show--) {
1248                 printf("\tInformation elements from Beacon frame:\n");
1249                 print_ies(nla_data(bss[NL80211_BSS_BEACON_IES]),
1250                           nla_len(bss[NL80211_BSS_BEACON_IES]),
1251                           params->unknown, params->type);
1252         }
1253
1254         return NL_SKIP;
1255 }
1256
1257 static struct scan_params scan_params;
1258
1259 static int handle_scan_dump(struct nl80211_state *state,
1260                             struct nl_cb *cb,
1261                             struct nl_msg *msg,
1262                             int argc, char **argv,
1263                             enum id_input id)
1264 {
1265         if (argc > 1)
1266                 return 1;
1267
1268         memset(&scan_params, 0, sizeof(scan_params));
1269
1270         if (argc == 1 && !strcmp(argv[0], "-u"))
1271                 scan_params.unknown = true;
1272         else if (argc == 1 && !strcmp(argv[0], "-b"))
1273                 scan_params.show_both_ie_sets = true;
1274
1275         scan_params.type = PRINT_SCAN;
1276
1277         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
1278                   &scan_params);
1279         return 0;
1280 }
1281
1282 static int handle_scan_combined(struct nl80211_state *state,
1283                                 struct nl_cb *cb,
1284                                 struct nl_msg *msg,
1285                                 int argc, char **argv,
1286                                 enum id_input id)
1287 {
1288         char **trig_argv;
1289         static char *dump_argv[] = {
1290                 NULL,
1291                 "scan",
1292                 "dump",
1293                 NULL,
1294         };
1295         static const __u32 cmds[] = {
1296                 NL80211_CMD_NEW_SCAN_RESULTS,
1297                 NL80211_CMD_SCAN_ABORTED,
1298         };
1299         int trig_argc, dump_argc, err;
1300
1301         if (argc >= 3 && !strcmp(argv[2], "-u")) {
1302                 dump_argc = 4;
1303                 dump_argv[3] = "-u";
1304         } else if (argc >= 3 && !strcmp(argv[2], "-b")) {
1305                 dump_argc = 4;
1306                 dump_argv[3] = "-b";
1307         } else
1308                 dump_argc = 3;
1309
1310         trig_argc = 3 + (argc - 2) + (3 - dump_argc);
1311         trig_argv = calloc(trig_argc, sizeof(*trig_argv));
1312         if (!trig_argv)
1313                 return -ENOMEM;
1314         trig_argv[0] = argv[0];
1315         trig_argv[1] = "scan";
1316         trig_argv[2] = "trigger";
1317         int i;
1318         for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
1319                 trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
1320         err = handle_cmd(state, id, trig_argc, trig_argv);
1321         free(trig_argv);
1322         if (err)
1323                 return err;
1324
1325         /*
1326          * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
1327          *
1328          * This code has a bug, which requires creating a separate
1329          * nl80211 socket to fix:
1330          * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
1331          * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
1332          * before (!) we listen to it, because we only start listening
1333          * after we send our scan request.
1334          *
1335          * Doing it the other way around has a race condition as well,
1336          * if you first open the events socket you may get a notification
1337          * for a previous scan.
1338          *
1339          * The only proper way to fix this would be to listen to events
1340          * before sending the command, and for the kernel to send the
1341          * scan request along with the event, so that you can match up
1342          * whether the scan you requested was finished or aborted (this
1343          * may result in processing a scan that another application
1344          * requested, but that doesn't seem to be a problem).
1345          *
1346          * Alas, the kernel doesn't do that (yet).
1347          */
1348
1349         if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
1350                                         NL80211_CMD_SCAN_ABORTED) {
1351                 printf("scan aborted!\n");
1352                 return 0;
1353         }
1354
1355         dump_argv[0] = argv[0];
1356         return handle_cmd(state, id, dump_argc, dump_argv);
1357 }
1358 TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [lowpri,flush] [ssid <ssid>*|passive]", 0, 0,
1359          CIB_NETDEV, handle_scan_combined,
1360          "Scan on the given frequencies and probe for the given SSIDs\n"
1361          "(or wildcard if not given) unless passive scanning is requested.\n"
1362          "If -u is specified print unknown data in the scan results.\n"
1363          "Specified (vendor) IEs must be well-formed.");
1364 COMMAND(scan, dump, "[-u]",
1365         NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
1366         "Dump the current scan results. If -u is specified, print unknown\n"
1367         "data in scan results.");
1368 COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [lowpri,flush] [ssid <ssid>*|passive]",
1369         NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
1370          "Trigger a scan on the given frequencies with probing for the given\n"
1371          "SSIDs (or wildcard if not given) unless passive scanning is requested.");