scan.c

   1 #include <net/if.h>
   2 #include <errno.h>
   3 #include <string.h>
   4 #include <ctype.h>
   5 #include <stdbool.h>
   6
   7 #include <netlink/genl/genl.h>
   8 #include <netlink/genl/family.h>
   9 #include <netlink/genl/ctrl.h>
  10 #include <netlink/msg.h>
  11 #include <netlink/attr.h>
  12
  13 #include "nl80211.h"
  14 #include "iw.h"
  15
  16 #define WLAN_CAPABILITY_ESS             (1<<0)
  17 #define WLAN_CAPABILITY_IBSS            (1<<1)
  18 #define WLAN_CAPABILITY_CF_POLLABLE     (1<<2)
  19 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
  20 #define WLAN_CAPABILITY_PRIVACY         (1<<4)
  21 #define WLAN_CAPABILITY_SHORT_PREAMBLE  (1<<5)
  22 #define WLAN_CAPABILITY_PBCC            (1<<6)
  23 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
  24 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
  25 #define WLAN_CAPABILITY_QOS             (1<<9)
  26 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
  27 #define WLAN_CAPABILITY_APSD            (1<<11)
  28 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
  29
  30 static unsigned char ms_oui[3]          = { 0x00, 0x50, 0xf2 };
  31 static unsigned char ieee80211_oui[3]   = { 0x00, 0x0f, 0xac };
  32 static unsigned char wfa_oui[3]         = { 0x50, 0x6f, 0x9a };
  33
  34 struct scan_params {
  35         bool unknown;
  36         enum print_ie_type type;
  37         bool show_both_ie_sets;
  38 };
  39
  40 #define IEEE80211_COUNTRY_EXTENSION_ID 201
  41
  42 union ieee80211_country_ie_triplet {
  43         struct {
  44                 __u8 first_channel;
  45                 __u8 num_channels;
  46                 __s8 max_power;
  47         } __attribute__ ((packed)) chans;
  48         struct {
  49                 __u8 reg_extension_id;
  50                 __u8 reg_class;
  51                 __u8 coverage_class;
  52         } __attribute__ ((packed)) ext;
  53 } __attribute__ ((packed));
  54
  55 static int handle_scan(struct nl80211_state *state,
  56                        struct nl_cb *cb,
  57                        struct nl_msg *msg,
  58                        int argc, char **argv,
  59                        enum id_input id)
  60 {
  61         struct nl_msg *ssids = NULL, *freqs = NULL;
  62         char *eptr;
  63         int err = -ENOBUFS;
  64         int i;
  65         enum {
  66                 NONE,
  67                 FREQ,
  68                 IES,
  69                 SSID,
  70                 DONE,
  71         } parse = NONE;
  72         int freq;
  73         bool passive = false, have_ssids = false, have_freqs = false;
  74         size_t tmp;
  75         unsigned char *ies;
  76
  77         ssids = nlmsg_alloc();
  78         if (!ssids)
  79                 return -ENOMEM;
  80
  81         freqs = nlmsg_alloc();
  82         if (!freqs) {
  83                 nlmsg_free(ssids);
  84                 return -ENOMEM;
  85         }
  86
  87         for (i = 0; i < argc; i++) {
  88                 switch (parse) {
  89                 case NONE:
  90                         if (strcmp(argv[i], "freq") == 0) {
  91                                 parse = FREQ;
  92                                 have_freqs = true;
  93                                 break;
  94                         } else if (strcmp(argv[i], "ies") == 0) {
  95                                 parse = IES;
  96                                 break;
  97                         } else if (strcmp(argv[i], "ssid") == 0) {
  98                                 parse = SSID;
  99                                 have_ssids = true;
 100                                 break;
 101                         } else if (strcmp(argv[i], "passive") == 0) {
 102                                 parse = DONE;
 103                                 passive = true;
 104                                 break;
 105                         }
 106                 case DONE:
 107                         return 1;
 108                 case FREQ:
 109                         freq = strtoul(argv[i], &eptr, 10);
 110                         if (eptr != argv[i] + strlen(argv[i])) {
 111                                 /* failed to parse as number -- maybe a tag? */
 112                                 i--;
 113                                 parse = NONE;
 114                                 continue;
 115                         }
 116                         NLA_PUT_U32(freqs, i, freq);
 117                         break;
 118                 case IES:
 119                         ies = parse_hex(argv[i], &tmp);
 120                         if (!ies)
 121                                 goto nla_put_failure;
 122                         NLA_PUT(msg, NL80211_ATTR_IE, tmp, ies);
 123                         free(ies);
 124                         parse = NONE;
 125                         break;
 126                 case SSID:
 127                         NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
 128                         break;
 129                 }
 130         }
 131
 132         if (!have_ssids)
 133                 NLA_PUT(ssids, 1, 0, "");
 134         if (!passive)
 135                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
 136
 137         if (have_freqs)
 138                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
 139
 140         err = 0;
 141  nla_put_failure:
 142         nlmsg_free(ssids);
 143         nlmsg_free(freqs);
 144         return err;
 145 }
 146
 147 static void tab_on_first(bool *first)
 148 {
 149         if (!*first)
 150                 printf("\t");
 151         else
 152                 *first = false;
 153 }
 154
 155 static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
 156 {
 157         printf(" ");
 158         print_ssid_escaped(len, data);
 159         printf("\n");
 160 }
 161
 162 #define BSS_MEMBERSHIP_SELECTOR_HT_PHY 127
 163
 164 static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 165 {
 166         int i;
 167
 168         printf(" ");
 169
 170         for (i = 0; i < len; i++) {
 171                 int r = data[i] & 0x7f;
 172
 173                 if (r == BSS_MEMBERSHIP_SELECTOR_HT_PHY && data[i] & 0x80)
 174                         printf("HT");
 175                 else
 176                         printf("%d.%d", r/2, 5*(r&1));
 177
 178                 printf("%s ", data[i] & 0x80 ? "*" : "");
 179         }
 180         printf("\n");
 181 }
 182
 183 static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
 184 {
 185         printf(" channel %d\n", data[0]);
 186 }
 187
 188 static const char *country_env_str(char environment)
 189 {
 190         switch (environment) {
 191         case 'I':
 192                 return "Indoor only";
 193         case 'O':
 194                 return "Outdoor only";
 195         case ' ':
 196                 return "Indoor/Outdoor";
 197         default:
 198                 return "bogus";
 199         }
 200 }
 201
 202 static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
 203 {
 204         printf(" %.*s", 2, data);
 205
 206         printf("\tEnvironment: %s\n", country_env_str(data[2]));
 207
 208         data += 3;
 209         len -= 3;
 210
 211         if (len < 3) {
 212                 printf("\t\tNo country IE triplets present\n");
 213                 return;
 214         }
 215
 216         while (len >= 3) {
 217                 int end_channel;
 218                 union ieee80211_country_ie_triplet *triplet = (void *) data;
 219
 220                 if (triplet->ext.reg_extension_id >= IEEE80211_COUNTRY_EXTENSION_ID) {
 221                         printf("\t\tExtension ID: %d Regulatory Class: %d Coverage class: %d (up to %dm)\n",
 222                                triplet->ext.reg_extension_id,
 223                                triplet->ext.reg_class,
 224                                triplet->ext.coverage_class,
 225                                triplet->ext.coverage_class * 450);
 226
 227                         data += 3;
 228                         len -= 3;
 229                         continue;
 230                 }
 231
 232                 /* 2 GHz */
 233                 if (triplet->chans.first_channel <= 14)
 234                         end_channel = triplet->chans.first_channel + (triplet->chans.num_channels - 1);
 235                 else
 236                         end_channel =  triplet->chans.first_channel + (4 * (triplet->chans.num_channels - 1));
 237
 238                 printf("\t\tChannels [%d - %d] @ %d dBm\n", triplet->chans.first_channel, end_channel, triplet->chans.max_power);
 239
 240                 data += 3;
 241                 len -= 3;
 242         }
 243
 244         return;
 245 }
 246
 247 static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
 248 {
 249         printf(" %d dB\n", data[0]);
 250 }
 251
 252 static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 253 {
 254         if (data[0] == 0x00)
 255                 printf(" <no flags>");
 256         if (data[0] & 0x01)
 257                 printf(" NonERP_Present");
 258         if (data[0] & 0x02)
 259                 printf(" Use_Protection");
 260         if (data[0] & 0x04)
 261                 printf(" Barker_Preamble_Mode");
 262         printf("\n");
 263 }
 264
 265 static void print_cipher(const uint8_t *data)
 266 {
 267         if (memcmp(data, ms_oui, 3) == 0) {
 268                 switch (data[3]) {
 269                 case 0:
 270                         printf("Use group cipher suite");
 271                         break;
 272                 case 1:
 273                         printf("WEP-40");
 274                         break;
 275                 case 2:
 276                         printf("TKIP");
 277                         break;
 278                 case 4:
 279                         printf("CCMP");
 280                         break;
 281                 case 5:
 282                         printf("WEP-104");
 283                         break;
 284                 default:
 285                         printf("%.02x-%.02x-%.02x:%d",
 286                                 data[0], data[1] ,data[2], data[3]);
 287                         break;
 288                 }
 289         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 290                 switch (data[3]) {
 291                 case 0:
 292                         printf("Use group cipher suite");
 293                         break;
 294                 case 1:
 295                         printf("WEP-40");
 296                         break;
 297                 case 2:
 298                         printf("TKIP");
 299                         break;
 300                 case 4:
 301                         printf("CCMP");
 302                         break;
 303                 case 5:
 304                         printf("WEP-104");
 305                         break;
 306                 case 6:
 307                         printf("AES-128-CMAC");
 308                         break;
 309                 case 8:
 310                         printf("GCMP");
 311                         break;
 312                 default:
 313                         printf("%.02x-%.02x-%.02x:%d",
 314                                 data[0], data[1] ,data[2], data[3]);
 315                         break;
 316                 }
 317         } else
 318                 printf("%.02x-%.02x-%.02x:%d",
 319                         data[0], data[1] ,data[2], data[3]);
 320 }
 321
 322 static void print_auth(const uint8_t *data)
 323 {
 324         if (memcmp(data, ms_oui, 3) == 0) {
 325                 switch (data[3]) {
 326                 case 1:
 327                         printf("IEEE 802.1X");
 328                         break;
 329                 case 2:
 330                         printf("PSK");
 331                         break;
 332                 default:
 333                         printf("%.02x-%.02x-%.02x:%d",
 334                                 data[0], data[1] ,data[2], data[3]);
 335                         break;
 336                 }
 337         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 338                 switch (data[3]) {
 339                 case 1:
 340                         printf("IEEE 802.1X");
 341                         break;
 342                 case 2:
 343                         printf("PSK");
 344                         break;
 345                 case 3:
 346                         printf("FT/IEEE 802.1X");
 347                         break;
 348                 case 4:
 349                         printf("FT/PSK");
 350                         break;
 351                 case 5:
 352                         printf("IEEE 802.1X/SHA-256");
 353                         break;
 354                 case 6:
 355                         printf("PSK/SHA-256");
 356                         break;
 357                 default:
 358                         printf("%.02x-%.02x-%.02x:%d",
 359                                 data[0], data[1] ,data[2], data[3]);
 360                         break;
 361                 }
 362         } else
 363                 printf("%.02x-%.02x-%.02x:%d",
 364                         data[0], data[1] ,data[2], data[3]);
 365 }
 366
 367 static void print_rsn_ie(const char *defcipher, const char *defauth,
 368                          uint8_t len, const uint8_t *data)
 369 {
 370         bool first = true;
 371         __u16 version, count, capa;
 372         int i;
 373
 374         version = data[0] + (data[1] << 8);
 375         tab_on_first(&first);
 376         printf("\t * Version: %d\n", version);
 377
 378         data += 2;
 379         len -= 2;
 380
 381         if (len < 4) {
 382                 tab_on_first(&first);
 383                 printf("\t * Group cipher: %s\n", defcipher);
 384                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 385                 return;
 386         }
 387
 388         tab_on_first(&first);
 389         printf("\t * Group cipher: ");
 390         print_cipher(data);
 391         printf("\n");
 392
 393         data += 4;
 394         len -= 4;
 395
 396         if (len < 2) {
 397                 tab_on_first(&first);
 398                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 399                 return;
 400         }
 401
 402         count = data[0] | (data[1] << 8);
 403         if (2 + (count * 4) > len)
 404                 goto invalid;
 405
 406         tab_on_first(&first);
 407         printf("\t * Pairwise ciphers:");
 408         for (i = 0; i < count; i++) {
 409                 printf(" ");
 410                 print_cipher(data + 2 + (i * 4));
 411         }
 412         printf("\n");
 413
 414         data += 2 + (count * 4);
 415         len -= 2 + (count * 4);
 416
 417         if (len < 2) {
 418                 tab_on_first(&first);
 419                 printf("\t * Authentication suites: %s\n", defauth);
 420                 return;
 421         }
 422
 423         count = data[0] | (data[1] << 8);
 424         if (2 + (count * 4) > len)
 425                 goto invalid;
 426
 427         tab_on_first(&first);
 428         printf("\t * Authentication suites:");
 429         for (i = 0; i < count; i++) {
 430                 printf(" ");
 431                 print_auth(data + 2 + (i * 4));
 432         }
 433         printf("\n");
 434
 435         data += 2 + (count * 4);
 436         len -= 2 + (count * 4);
 437
 438         if (len >= 2) {
 439                 capa = data[0] | (data[1] << 8);
 440                 tab_on_first(&first);
 441                 printf("\t * Capabilities:");
 442                 if (capa & 0x0001)
 443                         printf(" PreAuth");
 444                 if (capa & 0x0002)
 445                         printf(" NoPairwise");
 446                 switch ((capa & 0x000c) >> 2) {
 447                 case 0:
 448                         break;
 449                 case 1:
 450                         printf(" 2-PTKSA-RC");
 451                         break;
 452                 case 2:
 453                         printf(" 4-PTKSA-RC");
 454                         break;
 455                 case 3:
 456                         printf(" 16-PTKSA-RC");
 457                         break;
 458                 }
 459                 switch ((capa & 0x0030) >> 4) {
 460                 case 0:
 461                         break;
 462                 case 1:
 463                         printf(" 2-GTKSA-RC");
 464                         break;
 465                 case 2:
 466                         printf(" 4-GTKSA-RC");
 467                         break;
 468                 case 3:
 469                         printf(" 16-GTKSA-RC");
 470                         break;
 471                 }
 472                 if (capa & 0x0040)
 473                         printf(" MFP-required");
 474                 if (capa & 0x0080)
 475                         printf(" MFP-capable");
 476                 if (capa & 0x0200)
 477                         printf(" Peerkey-enabled");
 478                 if (capa & 0x0400)
 479                         printf(" SPP-AMSDU-capable");
 480                 if (capa & 0x0800)
 481                         printf(" SPP-AMSDU-required");
 482                 printf(" (0x%.4x)\n", capa);
 483                 data += 2;
 484                 len -= 2;
 485         }
 486
 487         if (len >= 2) {
 488                 int pmkid_count = data[0] | (data[1] << 8);
 489
 490                 if (len >= 2 + 16 * pmkid_count) {
 491                         tab_on_first(&first);
 492                         printf("\t * %d PMKIDs\n", pmkid_count);
 493                         /* not printing PMKID values */
 494                         data += 2 + 16 * pmkid_count;
 495                         len -= 2 + 16 * pmkid_count;
 496                 } else
 497                         goto invalid;
 498         }
 499
 500         if (len >= 4) {
 501                 tab_on_first(&first);
 502                 printf("\t * Group mgmt cipher suite: ");
 503                 print_cipher(data);
 504                 printf("\n");
 505                 data += 4;
 506                 len -= 4;
 507         }
 508
 509  invalid:
 510         if (len != 0) {
 511                 printf("\t\t * bogus tail data (%d):", len);
 512                 while (len) {
 513                         printf(" %.2x", *data);
 514                         data++;
 515                         len--;
 516                 }
 517                 printf("\n");
 518         }
 519 }
 520
 521 static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
 522 {
 523         print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 524 }
 525
 526 static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
 527 {
 528         printf("\n");
 529         print_ht_capability(data[0] | (data[1] << 8));
 530         print_ampdu_length(data[2] & 3);
 531         print_ampdu_spacing((data[2] >> 2) & 7);
 532         print_ht_mcs(data + 3);
 533 }
 534
 535 static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
 536 {
 537         static const char *offset[4] = {
 538                 "no secondary",
 539                 "above",
 540                 "[reserved!]",
 541                 "below",
 542         };
 543         static const char *protection[4] = {
 544                 "no",
 545                 "nonmember",
 546                 "20 MHz",
 547                 "non-HT mixed",
 548         };
 549         static const char *sta_chan_width[2] = {
 550                 "20 MHz",
 551                 "any",
 552         };
 553
 554         printf("\n");
 555         printf("\t\t * primary channel: %d\n", data[0]);
 556         printf("\t\t * secondary channel offset: %s\n",
 557                 offset[data[1] & 0x3]);
 558         printf("\t\t * STA channel width: %s\n", sta_chan_width[(data[1] & 0x4)>>2]);
 559         printf("\t\t * RIFS: %d\n", (data[1] & 0x8)>>3);
 560         printf("\t\t * HT protection: %s\n", protection[data[2] & 0x3]);
 561         printf("\t\t * non-GF present: %d\n", (data[2] & 0x4) >> 2);
 562         printf("\t\t * OBSS non-GF present: %d\n", (data[2] & 0x10) >> 4);
 563         printf("\t\t * dual beacon: %d\n", (data[4] & 0x40) >> 6);
 564         printf("\t\t * dual CTS protection: %d\n", (data[4] & 0x80) >> 7);
 565         printf("\t\t * STBC beacon: %d\n", data[5] & 0x1);
 566         printf("\t\t * L-SIG TXOP Prot: %d\n", (data[5] & 0x2) >> 1);
 567         printf("\t\t * PCO active: %d\n", (data[5] & 0x4) >> 2);
 568         printf("\t\t * PCO phase: %d\n", (data[5] & 0x8) >> 3);
 569 }
 570
 571 static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 572 {
 573         int i, base, bit;
 574         bool first = true;
 575
 576
 577         for (i = 0; i < len; i++) {
 578                 base = i * 8;
 579
 580                 for (bit = 0; bit < 8; bit++) {
 581                         if (!(data[i] & (1 << bit)))
 582                                 continue;
 583
 584                         if (!first)
 585                                 printf(",");
 586                         else
 587                                 first = false;
 588
 589                         switch (bit + base) {
 590                         case 0:
 591                                 printf(" HT Information Exchange Supported");
 592                                 break;
 593                         case 1:
 594                                 printf(" On-demand Beacon");
 595                                 break;
 596                         case 2:
 597                                 printf(" Extended Channel Switching");
 598                                 break;
 599                         case 3:
 600                                 printf(" Wave Indication");
 601                                 break;
 602                         case 4:
 603                                 printf(" PSMP Capability");
 604                                 break;
 605                         case 5:
 606                                 printf(" Service Interval Granularity");
 607                                 break;
 608                         case 6:
 609                                 printf(" S-PSMP Capability");
 610                                 break;
 611                         default:
 612                                 printf(" %d", bit);
 613                                 break;
 614                         }
 615                 }
 616         }
 617
 618         printf("\n");
 619 }
 620
 621 static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data)
 622 {
 623         printf(" DTIM Count %u DTIM Period %u Bitmap Control 0x%x "
 624                "Bitmap[0] 0x%x",
 625                data[0], data[1], data[2], data[3]);
 626         if (len - 4)
 627                 printf(" (+ %u octet%s)", len - 4, len - 4 == 1 ? "" : "s");
 628         printf("\n");
 629 }
 630
 631 struct ie_print {
 632         const char *name;
 633         void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
 634         uint8_t minlen, maxlen;
 635         uint8_t flags;
 636 };
 637
 638 static void print_ie(const struct ie_print *p, const uint8_t type,
 639                      uint8_t len, const uint8_t *data)
 640 {
 641         int i;
 642
 643         if (!p->print)
 644                 return;
 645
 646         printf("\t%s:", p->name);
 647         if (len < p->minlen || len > p->maxlen) {
 648                 if (len > 1) {
 649                         printf(" <invalid: %d bytes:", len);
 650                         for (i = 0; i < len; i++)
 651                                 printf(" %.02x", data[i]);
 652                         printf(">\n");
 653                 } else if (len)
 654                         printf(" <invalid: 1 byte: %.02x>\n", data[0]);
 655                 else
 656                         printf(" <invalid: no data>\n");
 657                 return;
 658         }
 659
 660         p->print(type, len, data);
 661 }
 662
 663 #define PRINT_IGN {             \
 664         .name = "IGNORE",       \
 665         .print = NULL,          \
 666         .minlen = 0,            \
 667         .maxlen = 255,          \
 668 }
 669
 670 static const struct ie_print ieprinters[] = {
 671         [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
 672         [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 673         [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
 674         [5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), },
 675         [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
 676         [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
 677         [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
 678         [45] = { "HT capabilities", print_ht_capa, 26, 26, BIT(PRINT_SCAN), },
 679         [61] = { "HT operation", print_ht_op, 22, 22, BIT(PRINT_SCAN), },
 680         [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
 681         [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 682         [114] = { "MESH ID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
 683         [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
 684 };
 685
 686 static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
 687 {
 688         print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
 689 }
 690
 691 static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
 692 {
 693         int i;
 694         static const char *aci_tbl[] = { "BE", "BK", "VI", "VO" };
 695
 696         if (len < 19)
 697                 goto invalid;
 698
 699         if (data[0] != 1) {
 700                 printf("Parameter: not version 1: ");
 701                 return false;
 702         }
 703
 704         printf("\t * Parameter version 1");
 705
 706         data++;
 707
 708         if (data[0] & 0x80)
 709                 printf("\n\t\t * u-APSD");
 710
 711         data += 2;
 712
 713         for (i = 0; i < 4; i++) {
 714                 printf("\n\t\t * %s:", aci_tbl[(data[0] >> 5) & 3]);
 715                 if (data[0] & 0x10)
 716                         printf(" acm");
 717                 printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1,
 718                                     (1 << (data[1] >> 4)) - 1);
 719                 printf(", AIFSN %d", data[0] & 0xf);
 720                 if (data[2] | data[3])
 721                         printf(", TXOP %d usec", (data[2] + (data[3] << 8)) * 32);
 722                 data += 4;
 723         }
 724
 725         printf("\n");
 726         return true;
 727
 728  invalid:
 729         printf("invalid: ");
 730         return false;
 731 }
 732
 733 static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
 734 {
 735         int i;
 736
 737         switch (data[0]) {
 738         case 0x00:
 739                 printf(" information:");
 740                 break;
 741         case 0x01:
 742                 if (print_wifi_wmm_param(data + 1, len - 1))
 743                         return;
 744                 break;
 745         default:
 746                 printf(" type %d:", data[0]);
 747                 break;
 748         }
 749
 750         for(i = 1; i < len; i++)
 751                 printf(" %.02x", data[i]);
 752         printf("\n");
 753 }
 754
 755 static const char * wifi_wps_dev_passwd_id(uint16_t id)
 756 {
 757         switch (id) {
 758         case 0:
 759                 return "Default (PIN)";
 760         case 1:
 761                 return "User-specified";
 762         case 2:
 763                 return "Machine-specified";
 764         case 3:
 765                 return "Rekey";
 766         case 4:
 767                 return "PushButton";
 768         case 5:
 769                 return "Registrar-specified";
 770         default:
 771                 return "??";
 772         }
 773 }
 774
 775 static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
 776 {
 777         bool first = true;
 778         __u16 subtype, sublen;
 779
 780         while (len >= 4) {
 781                 subtype = (data[0] << 8) + data[1];
 782                 sublen = (data[2] << 8) + data[3];
 783                 if (sublen > len)
 784                         break;
 785
 786                 switch (subtype) {
 787                 case 0x104a:
 788                         tab_on_first(&first);
 789                         printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
 790                         break;
 791                 case 0x1011:
 792                         tab_on_first(&first);
 793                         printf("\t * Device name: %.*s\n", sublen, data + 4);
 794                         break;
 795                 case 0x1012: {
 796                         uint16_t id;
 797                         tab_on_first(&first);
 798                         if (sublen != 2) {
 799                                 printf("\t * Device Password ID: (invalid "
 800                                        "length %d)\n", sublen);
 801                                 break;
 802                         }
 803                         id = data[4] << 8 | data[5];
 804                         printf("\t * Device Password ID: %u (%s)\n",
 805                                id, wifi_wps_dev_passwd_id(id));
 806                         break;
 807                 }
 808                 case 0x1021:
 809                         tab_on_first(&first);
 810                         printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
 811                         break;
 812                 case 0x1023:
 813                         tab_on_first(&first);
 814                         printf("\t * Model: %.*s\n", sublen, data + 4);
 815                         break;
 816                 case 0x1024:
 817                         tab_on_first(&first);
 818                         printf("\t * Model Number: %.*s\n", sublen, data + 4);
 819                         break;
 820                 case 0x103b: {
 821                         __u8 val = data[4];
 822                         tab_on_first(&first);
 823                         printf("\t * Response Type: %d%s\n",
 824                                val, val == 3 ? " (AP)" : "");
 825                         break;
 826                 }
 827                 case 0x103c: {
 828                         __u8 val = data[4];
 829                         tab_on_first(&first);
 830                         printf("\t * RF Bands: 0x%x\n", val);
 831                         break;
 832                 }
 833                 case 0x1041: {
 834                         __u8 val = data[4];
 835                         tab_on_first(&first);
 836                         printf("\t * Selected Registrar: 0x%x\n", val);
 837                         break;
 838                 }
 839                 case 0x1042:
 840                         tab_on_first(&first);
 841                         printf("\t * Serial Number: %.*s\n", sublen, data + 4);
 842                         break;
 843                 case 0x1044: {
 844                         __u8 val = data[4];
 845                         tab_on_first(&first);
 846                         printf("\t * Wi-Fi Protected Setup State: %d%s%s\n",
 847                                val,
 848                                val == 1 ? " (Unconfigured)" : "",
 849                                val == 2 ? " (Configured)" : "");
 850                         break;
 851                 }
 852                 case 0x1047:
 853                         tab_on_first(&first);
 854                         printf("\t * UUID: ");
 855                         if (sublen != 16) {
 856                                 printf("(invalid, length=%d)\n", sublen);
 857                                 break;
 858                         }
 859                         printf("%02x%02x%02x%02x-%02x%02x-%02x%02x-"
 860                                 "%02x%02x-%02x%02x%02x%02x%02x%02x\n",
 861                                 data[4], data[5], data[6], data[7],
 862                                 data[8], data[9], data[10], data[11],
 863                                 data[12], data[13], data[14], data[15],
 864                                 data[16], data[17], data[18], data[19]);
 865                         break;
 866                 case 0x1054: {
 867                         tab_on_first(&first);
 868                         if (sublen != 8) {
 869                                 printf("\t * Primary Device Type: (invalid "
 870                                        "length %d)\n", sublen);
 871                                 break;
 872                         }
 873                         printf("\t * Primary Device Type: "
 874                                "%u-%02x%02x%02x%02x-%u\n",
 875                                data[4] << 8 | data[5],
 876                                data[6], data[7], data[8], data[9],
 877                                data[10] << 8 | data[11]);
 878                         break;
 879                 }
 880                 case 0x1057: {
 881                         __u8 val = data[4];
 882                         tab_on_first(&first);
 883                         printf("\t * AP setup locked: 0x%.2x\n", val);
 884                         break;
 885                 }
 886                 case 0x1008:
 887                 case 0x1053: {
 888                         __u16 meth = (data[4] << 8) + data[5];
 889                         bool comma = false;
 890                         tab_on_first(&first);
 891                         printf("\t * %sConfig methods:",
 892                                subtype == 0x1053 ? "Selected Registrar ": "");
 893 #define T(bit, name) do {               \
 894         if (meth & (1<<bit)) {          \
 895                 if (comma)              \
 896                         printf(",");    \
 897                 comma = true;           \
 898                 printf(" " name);       \
 899         } } while (0)
 900                         T(0, "USB");
 901                         T(1, "Ethernet");
 902                         T(2, "Label");
 903                         T(3, "Display");
 904                         T(4, "Ext. NFC");
 905                         T(5, "Int. NFC");
 906                         T(6, "NFC Intf.");
 907                         T(7, "PBC");
 908                         T(8, "Keypad");
 909                         printf("\n");
 910                         break;
 911 #undef T
 912                 }
 913                 default: {
 914                         const __u8 *subdata = data + 4;
 915                         __u16 tmplen = sublen;
 916
 917                         tab_on_first(&first);
 918                         printf("\t * Unknown TLV (%#.4x, %d bytes):",
 919                                subtype, tmplen);
 920                         while (tmplen) {
 921                                 printf(" %.2x", *subdata);
 922                                 subdata++;
 923                                 tmplen--;
 924                         }
 925                         printf("\n");
 926                         break;
 927                 }
 928                 }
 929
 930                 data += sublen + 4;
 931                 len -= sublen + 4;
 932         }
 933
 934         if (len != 0) {
 935                 printf("\t\t * bogus tail data (%d):", len);
 936                 while (len) {
 937                         printf(" %.2x", *data);
 938                         data++;
 939                         len--;
 940                 }
 941                 printf("\n");
 942         }
 943 }
 944
 945 static const struct ie_print wifiprinters[] = {
 946         [1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
 947         [2] = { "WMM", print_wifi_wmm, 1, 255, BIT(PRINT_SCAN), },
 948         [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
 949 };
 950
 951 static inline void print_p2p(const uint8_t type, uint8_t len, const uint8_t *data)
 952 {
 953         bool first = true;
 954         __u8 subtype;
 955         __u16 sublen;
 956
 957         while (len >= 3) {
 958                 subtype = data[0];
 959                 sublen = (data[2] << 8) + data[1];
 960
 961                 if (sublen > len - 3)
 962                         break;
 963
 964                 switch (subtype) {
 965                 case 0x02: /* capability */
 966                         tab_on_first(&first);
 967                         if (sublen < 2) {
 968                                 printf("\t * malformed capability\n");
 969                                 break;
 970                         }
 971                         printf("\t * Group capa: 0x%.2x, Device capa: 0x%.2x\n",
 972                                 data[3], data[4]);
 973                         break;
 974                 case 0x0d: /* device info */
 975                         if (sublen < 6 + 2 + 8 + 1) {
 976                                 printf("\t * malformed device info\n");
 977                                 break;
 978                         }
 979                         /* fall through for now */
 980                 case 0x00: /* status */
 981                 case 0x01: /* minor reason */
 982                 case 0x03: /* device ID */
 983                 case 0x04: /* GO intent */
 984                 case 0x05: /* configuration timeout */
 985                 case 0x06: /* listen channel */
 986                 case 0x07: /* group BSSID */
 987                 case 0x08: /* ext listen timing */
 988                 case 0x09: /* intended interface address */
 989                 case 0x0a: /* manageability */
 990                 case 0x0b: /* channel list */
 991                 case 0x0c: /* NoA */
 992                 case 0x0e: /* group info */
 993                 case 0x0f: /* group ID */
 994                 case 0x10: /* interface */
 995                 case 0x11: /* operating channel */
 996                 case 0x12: /* invitation flags */
 997                 case 0xdd: /* vendor specific */
 998                 default: {
 999                         const __u8 *subdata = data + 4;
1000                         __u16 tmplen = sublen;
1001
1002                         tab_on_first(&first);
1003                         printf("\t * Unknown TLV (%#.2x, %d bytes):",
1004                                subtype, tmplen);
1005                         while (tmplen) {
1006                                 printf(" %.2x", *subdata);
1007                                 subdata++;
1008                                 tmplen--;
1009                         }
1010                         printf("\n");
1011                         break;
1012                 }
1013                 }
1014
1015                 data += sublen + 3;
1016                 len -= sublen + 3;
1017         }
1018
1019         if (len != 0) {
1020                 tab_on_first(&first);
1021                 printf("\t * bogus tail data (%d):", len);
1022                 while (len) {
1023                         printf(" %.2x", *data);
1024                         data++;
1025                         len--;
1026                 }
1027                 printf("\n");
1028         }
1029 }
1030
1031 static const struct ie_print wfa_printers[] = {
1032         [9] = { "P2P", print_p2p, 2, 255, BIT(PRINT_SCAN), },
1033 };
1034
1035 static void print_vendor(unsigned char len, unsigned char *data,
1036                          bool unknown, enum print_ie_type ptype)
1037 {
1038         int i;
1039
1040         if (len < 3) {
1041                 printf("\tVendor specific: <too short> data:");
1042                 for(i = 0; i < len; i++)
1043                         printf(" %.02x", data[i]);
1044                 printf("\n");
1045                 return;
1046         }
1047
1048         if (len >= 4 && memcmp(data, ms_oui, 3) == 0) {
1049                 if (data[3] < ARRAY_SIZE(wifiprinters) &&
1050                     wifiprinters[data[3]].name &&
1051                     wifiprinters[data[3]].flags & BIT(ptype)) {
1052                         print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
1053                         return;
1054                 }
1055                 if (!unknown)
1056                         return;
1057                 printf("\tMS/WiFi %#.2x, data:", data[3]);
1058                 for(i = 0; i < len - 4; i++)
1059                         printf(" %.02x", data[i + 4]);
1060                 printf("\n");
1061                 return;
1062         }
1063
1064         if (len >= 4 && memcmp(data, wfa_oui, 3) == 0) {
1065                 if (data[3] < ARRAY_SIZE(wfa_printers) &&
1066                     wfa_printers[data[3]].name &&
1067                     wfa_printers[data[3]].flags & BIT(ptype)) {
1068                         print_ie(&wfa_printers[data[3]], data[3], len - 4, data + 4);
1069                         return;
1070                 }
1071                 if (!unknown)
1072                         return;
1073                 printf("\tWFA %#.2x, data:", data[3]);
1074                 for(i = 0; i < len - 4; i++)
1075                         printf(" %.02x", data[i + 4]);
1076                 printf("\n");
1077                 return;
1078         }
1079
1080         if (!unknown)
1081                 return;
1082
1083         printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
1084                 data[0], data[1], data[2]);
1085         for (i = 3; i < len; i++)
1086                 printf(" %.2x", data[i]);
1087         printf("\n");
1088 }
1089
1090 void print_ies(unsigned char *ie, int ielen, bool unknown,
1091                enum print_ie_type ptype)
1092 {
1093         while (ielen >= 2 && ielen >= ie[1]) {
1094                 if (ie[0] < ARRAY_SIZE(ieprinters) &&
1095                     ieprinters[ie[0]].name &&
1096                     ieprinters[ie[0]].flags & BIT(ptype)) {
1097                         print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
1098                 } else if (ie[0] == 221 /* vendor */) {
1099                         print_vendor(ie[1], ie + 2, unknown, ptype);
1100                 } else if (unknown) {
1101                         int i;
1102
1103                         printf("\tUnknown IE (%d):", ie[0]);
1104                         for (i=0; i<ie[1]; i++)
1105                                 printf(" %.2x", ie[2+i]);
1106                         printf("\n");
1107                 }
1108                 ielen -= ie[1] + 2;
1109                 ie += ie[1] + 2;
1110         }
1111 }
1112
1113 static int print_bss_handler(struct nl_msg *msg, void *arg)
1114 {
1115         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1116         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1117         struct nlattr *bss[NL80211_BSS_MAX + 1];
1118         char mac_addr[20], dev[20];
1119         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
1120                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
1121                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
1122                 [NL80211_BSS_BSSID] = { },
1123                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
1124                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
1125                 [NL80211_BSS_INFORMATION_ELEMENTS] = { },
1126                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
1127                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
1128                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
1129                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
1130                 [NL80211_BSS_BEACON_IES] = { },
1131         };
1132         struct scan_params *params = arg;
1133         int show = params->show_both_ie_sets ? 2 : 1;
1134
1135         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1136                   genlmsg_attrlen(gnlh, 0), NULL);
1137
1138         if (!tb[NL80211_ATTR_BSS]) {
1139                 fprintf(stderr, "bss info missing!\n");
1140                 return NL_SKIP;
1141         }
1142         if (nla_parse_nested(bss, NL80211_BSS_MAX,
1143                              tb[NL80211_ATTR_BSS],
1144                              bss_policy)) {
1145                 fprintf(stderr, "failed to parse nested attributes!\n");
1146                 return NL_SKIP;
1147         }
1148
1149         if (!bss[NL80211_BSS_BSSID])
1150                 return NL_SKIP;
1151
1152         mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
1153         if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
1154         printf("BSS %s (on %s)", mac_addr, dev);
1155
1156         if (bss[NL80211_BSS_STATUS]) {
1157                 switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
1158                 case NL80211_BSS_STATUS_AUTHENTICATED:
1159                         printf(" -- authenticated");
1160                         break;
1161                 case NL80211_BSS_STATUS_ASSOCIATED:
1162                         printf(" -- associated");
1163                         break;
1164                 case NL80211_BSS_STATUS_IBSS_JOINED:
1165                         printf(" -- joined");
1166                         break;
1167                 default:
1168                         printf(" -- unknown status: %d",
1169                                 nla_get_u32(bss[NL80211_BSS_STATUS]));
1170                         break;
1171                 }
1172         }
1173         printf("\n");
1174
1175         if (bss[NL80211_BSS_TSF]) {
1176                 unsigned long long tsf;
1177                 tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
1178                 printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
1179                         tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
1180                         (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
1181         }
1182         if (bss[NL80211_BSS_FREQUENCY])
1183                 printf("\tfreq: %d\n",
1184                         nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
1185         if (bss[NL80211_BSS_BEACON_INTERVAL])
1186                 printf("\tbeacon interval: %d\n",
1187                         nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
1188         if (bss[NL80211_BSS_CAPABILITY]) {
1189                 __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1190                 printf("\tcapability:");
1191                 if (capa & WLAN_CAPABILITY_ESS)
1192                         printf(" ESS");
1193                 if (capa & WLAN_CAPABILITY_IBSS)
1194                         printf(" IBSS");
1195                 if (capa & WLAN_CAPABILITY_PRIVACY)
1196                         printf(" Privacy");
1197                 if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
1198                         printf(" ShortPreamble");
1199                 if (capa & WLAN_CAPABILITY_PBCC)
1200                         printf(" PBCC");
1201                 if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
1202                         printf(" ChannelAgility");
1203                 if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
1204                         printf(" SpectrumMgmt");
1205                 if (capa & WLAN_CAPABILITY_QOS)
1206                         printf(" QoS");
1207                 if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
1208                         printf(" ShortSlotTime");
1209                 if (capa & WLAN_CAPABILITY_APSD)
1210                         printf(" APSD");
1211                 if (capa & WLAN_CAPABILITY_DSSS_OFDM)
1212                         printf(" DSSS-OFDM");
1213                 printf(" (0x%.4x)\n", capa);
1214         }
1215         if (bss[NL80211_BSS_SIGNAL_MBM]) {
1216                 int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
1217                 printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
1218         }
1219         if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
1220                 unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
1221                 printf("\tsignal: %d/100\n", s);
1222         }
1223         if (bss[NL80211_BSS_SEEN_MS_AGO]) {
1224                 int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
1225                 printf("\tlast seen: %d ms ago\n", age);
1226         }
1227
1228         if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) {
1229                 if (bss[NL80211_BSS_BEACON_IES])
1230                         printf("\tInformation elements from Probe Response "
1231                                "frame:\n");
1232                 print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1233                           nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1234                           params->unknown, params->type);
1235         }
1236         if (bss[NL80211_BSS_BEACON_IES] && show--) {
1237                 printf("\tInformation elements from Beacon frame:\n");
1238                 print_ies(nla_data(bss[NL80211_BSS_BEACON_IES]),
1239                           nla_len(bss[NL80211_BSS_BEACON_IES]),
1240                           params->unknown, params->type);
1241         }
1242
1243         return NL_SKIP;
1244 }
1245
1246 static struct scan_params scan_params;
1247
1248 static int handle_scan_dump(struct nl80211_state *state,
1249                             struct nl_cb *cb,
1250                             struct nl_msg *msg,
1251                             int argc, char **argv,
1252                             enum id_input id)
1253 {
1254         if (argc > 1)
1255                 return 1;
1256
1257         memset(&scan_params, 0, sizeof(scan_params));
1258
1259         if (argc == 1 && !strcmp(argv[0], "-u"))
1260                 scan_params.unknown = true;
1261         else if (argc == 1 && !strcmp(argv[0], "-b"))
1262                 scan_params.show_both_ie_sets = true;
1263
1264         scan_params.type = PRINT_SCAN;
1265
1266         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
1267                   &scan_params);
1268         return 0;
1269 }
1270
1271 static int handle_scan_combined(struct nl80211_state *state,
1272                                 struct nl_cb *cb,
1273                                 struct nl_msg *msg,
1274                                 int argc, char **argv,
1275                                 enum id_input id)
1276 {
1277         char **trig_argv;
1278         static char *dump_argv[] = {
1279                 NULL,
1280                 "scan",
1281                 "dump",
1282                 NULL,
1283         };
1284         static const __u32 cmds[] = {
1285                 NL80211_CMD_NEW_SCAN_RESULTS,
1286                 NL80211_CMD_SCAN_ABORTED,
1287         };
1288         int trig_argc, dump_argc, err;
1289
1290         if (argc >= 3 && !strcmp(argv[2], "-u")) {
1291                 dump_argc = 4;
1292                 dump_argv[3] = "-u";
1293         } else if (argc >= 3 && !strcmp(argv[2], "-b")) {
1294                 dump_argc = 4;
1295                 dump_argv[3] = "-b";
1296         } else
1297                 dump_argc = 3;
1298
1299         trig_argc = 3 + (argc - 2) + (3 - dump_argc);
1300         trig_argv = calloc(trig_argc, sizeof(*trig_argv));
1301         if (!trig_argv)
1302                 return -ENOMEM;
1303         trig_argv[0] = argv[0];
1304         trig_argv[1] = "scan";
1305         trig_argv[2] = "trigger";
1306         int i;
1307         for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
1308                 trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
1309         err = handle_cmd(state, id, trig_argc, trig_argv);
1310         free(trig_argv);
1311         if (err)
1312                 return err;
1313
1314         /*
1315          * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
1316          *
1317          * This code has a bug, which requires creating a separate
1318          * nl80211 socket to fix:
1319          * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
1320          * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
1321          * before (!) we listen to it, because we only start listening
1322          * after we send our scan request.
1323          *
1324          * Doing it the other way around has a race condition as well,
1325          * if you first open the events socket you may get a notification
1326          * for a previous scan.
1327          *
1328          * The only proper way to fix this would be to listen to events
1329          * before sending the command, and for the kernel to send the
1330          * scan request along with the event, so that you can match up
1331          * whether the scan you requested was finished or aborted (this
1332          * may result in processing a scan that another application
1333          * requested, but that doesn't seem to be a problem).
1334          *
1335          * Alas, the kernel doesn't do that (yet).
1336          */
1337
1338         if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
1339                                         NL80211_CMD_SCAN_ABORTED) {
1340                 printf("scan aborted!\n");
1341                 return 0;
1342         }
1343
1344         dump_argv[0] = argv[0];
1345         return handle_cmd(state, id, dump_argc, dump_argv);
1346 }
1347 TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]", 0, 0,
1348          CIB_NETDEV, handle_scan_combined,
1349          "Scan on the given frequencies and probe for the given SSIDs\n"
1350          "(or wildcard if not given) unless passive scanning is requested.\n"
1351          "If -u is specified print unknown data in the scan results.\n"
1352          "Specified (vendor) IEs must be well-formed.");
1353 COMMAND(scan, dump, "[-u]",
1354         NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
1355         "Dump the current scan results. If -u is specified, print unknown\n"
1356         "data in scan results.");
1357 COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]",
1358         NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
1359          "Trigger a scan on the given frequencies with probing for the given\n"
1360          "SSIDs (or wildcard if not given) unless passive scanning is requested.");