scan.c

   1 #include <net/if.h>
   2 #include <errno.h>
   3 #include <string.h>
   4 #include <ctype.h>
   5 #include <stdbool.h>
   6
   7 #include <netlink/genl/genl.h>
   8 #include <netlink/genl/family.h>
   9 #include <netlink/genl/ctrl.h>
  10 #include <netlink/msg.h>
  11 #include <netlink/attr.h>
  12
  13 #include "nl80211.h"
  14 #include "iw.h"
  15
  16 #define WLAN_CAPABILITY_ESS             (1<<0)
  17 #define WLAN_CAPABILITY_IBSS            (1<<1)
  18 #define WLAN_CAPABILITY_CF_POLLABLE     (1<<2)
  19 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
  20 #define WLAN_CAPABILITY_PRIVACY         (1<<4)
  21 #define WLAN_CAPABILITY_SHORT_PREAMBLE  (1<<5)
  22 #define WLAN_CAPABILITY_PBCC            (1<<6)
  23 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
  24 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
  25 #define WLAN_CAPABILITY_QOS             (1<<9)
  26 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
  27 #define WLAN_CAPABILITY_APSD            (1<<11)
  28 #define WLAN_CAPABILITY_RADIO_MEASURE   (1<<12)
  29 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
  30 #define WLAN_CAPABILITY_DEL_BACK        (1<<14)
  31 #define WLAN_CAPABILITY_IMM_BACK        (1<<15)
  32 /* DMG (60gHz) 802.11ad */
  33 /* type - bits 0..1 */
  34 #define WLAN_CAPABILITY_DMG_TYPE_MASK           (3<<0)
  35
  36 #define WLAN_CAPABILITY_DMG_TYPE_IBSS           (1<<0) /* Tx by: STA */
  37 #define WLAN_CAPABILITY_DMG_TYPE_PBSS           (2<<0) /* Tx by: PCP */
  38 #define WLAN_CAPABILITY_DMG_TYPE_AP             (3<<0) /* Tx by: AP */
  39
  40 #define WLAN_CAPABILITY_DMG_CBAP_ONLY           (1<<2)
  41 #define WLAN_CAPABILITY_DMG_CBAP_SOURCE         (1<<3)
  42 #define WLAN_CAPABILITY_DMG_PRIVACY             (1<<4)
  43 #define WLAN_CAPABILITY_DMG_ECPAC               (1<<5)
  44
  45 #define WLAN_CAPABILITY_DMG_SPECTRUM_MGMT       (1<<8)
  46 #define WLAN_CAPABILITY_DMG_RADIO_MEASURE       (1<<12)
  47
  48 static unsigned char ms_oui[3]          = { 0x00, 0x50, 0xf2 };
  49 static unsigned char ieee80211_oui[3]   = { 0x00, 0x0f, 0xac };
  50 static unsigned char wfa_oui[3]         = { 0x50, 0x6f, 0x9a };
  51
  52 struct scan_params {
  53         bool unknown;
  54         enum print_ie_type type;
  55         bool show_both_ie_sets;
  56 };
  57
  58 #define IEEE80211_COUNTRY_EXTENSION_ID 201
  59
  60 union ieee80211_country_ie_triplet {
  61         struct {
  62                 __u8 first_channel;
  63                 __u8 num_channels;
  64                 __s8 max_power;
  65         } __attribute__ ((packed)) chans;
  66         struct {
  67                 __u8 reg_extension_id;
  68                 __u8 reg_class;
  69                 __u8 coverage_class;
  70         } __attribute__ ((packed)) ext;
  71 } __attribute__ ((packed));
  72
  73 static int handle_scan(struct nl80211_state *state,
  74                        struct nl_cb *cb,
  75                        struct nl_msg *msg,
  76                        int argc, char **argv,
  77                        enum id_input id)
  78 {
  79         struct nl_msg *ssids = NULL, *freqs = NULL;
  80         char *eptr;
  81         int err = -ENOBUFS;
  82         int i;
  83         enum {
  84                 NONE,
  85                 FREQ,
  86                 IES,
  87                 SSID,
  88                 MESHID,
  89                 DONE,
  90         } parse = NONE;
  91         int freq;
  92         bool passive = false, have_ssids = false, have_freqs = false;
  93         size_t ies_len = 0, meshid_len = 0;
  94         unsigned char *ies = NULL, *meshid = NULL, *tmpies;
  95         int flags = 0;
  96
  97         ssids = nlmsg_alloc();
  98         if (!ssids)
  99                 return -ENOMEM;
 100
 101         freqs = nlmsg_alloc();
 102         if (!freqs) {
 103                 nlmsg_free(ssids);
 104                 return -ENOMEM;
 105         }
 106
 107         for (i = 0; i < argc; i++) {
 108                 switch (parse) {
 109                 case NONE:
 110                         if (strcmp(argv[i], "freq") == 0) {
 111                                 parse = FREQ;
 112                                 have_freqs = true;
 113                                 break;
 114                         } else if (strcmp(argv[i], "ies") == 0) {
 115                                 parse = IES;
 116                                 break;
 117                         } else if (strcmp(argv[i], "lowpri") == 0) {
 118                                 parse = NONE;
 119                                 flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 120                                 break;
 121                         } else if (strcmp(argv[i], "flush") == 0) {
 122                                 parse = NONE;
 123                                 flags |= NL80211_SCAN_FLAG_FLUSH;
 124                                 break;
 125                         } else if (strcmp(argv[i], "ap-force") == 0) {
 126                                 parse = NONE;
 127                                 flags |= NL80211_SCAN_FLAG_AP;
 128                                 break;
 129                         } else if (strcmp(argv[i], "ssid") == 0) {
 130                                 parse = SSID;
 131                                 have_ssids = true;
 132                                 break;
 133                         } else if (strcmp(argv[i], "passive") == 0) {
 134                                 parse = DONE;
 135                                 passive = true;
 136                                 break;
 137                         } else if (strcmp(argv[i], "meshid") == 0) {
 138                                 parse = MESHID;
 139                                 break;
 140                         }
 141                 case DONE:
 142                         return 1;
 143                 case FREQ:
 144                         freq = strtoul(argv[i], &eptr, 10);
 145                         if (eptr != argv[i] + strlen(argv[i])) {
 146                                 /* failed to parse as number -- maybe a tag? */
 147                                 i--;
 148                                 parse = NONE;
 149                                 continue;
 150                         }
 151                         NLA_PUT_U32(freqs, i, freq);
 152                         break;
 153                 case IES:
 154                         ies = parse_hex(argv[i], &ies_len);
 155                         if (!ies)
 156                                 goto nla_put_failure;
 157                         parse = NONE;
 158                         break;
 159                 case SSID:
 160                         NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
 161                         break;
 162                 case MESHID:
 163                         meshid_len = strlen(argv[i]);
 164                         meshid = (unsigned char *) malloc(meshid_len + 2);
 165                         if (!meshid)
 166                                 goto nla_put_failure;
 167                         meshid[0] = 114; /* mesh element id */
 168                         meshid[1] = meshid_len;
 169                         memcpy(&meshid[2], argv[i], meshid_len);
 170                         meshid_len += 2;
 171                         parse = NONE;
 172                         break;
 173                 }
 174         }
 175
 176         if (ies || meshid) {
 177                 tmpies = (unsigned char *) malloc(ies_len + meshid_len);
 178                 if (!tmpies)
 179                         goto nla_put_failure;
 180                 if (ies) {
 181                         memcpy(tmpies, ies, ies_len);
 182                         free(ies);
 183                 }
 184                 if (meshid) {
 185                         memcpy(&tmpies[ies_len], meshid, meshid_len);
 186                         free(meshid);
 187                 }
 188                 NLA_PUT(msg, NL80211_ATTR_IE, ies_len + meshid_len, tmpies);
 189                 free(tmpies);
 190         }
 191
 192         if (!have_ssids)
 193                 NLA_PUT(ssids, 1, 0, "");
 194         if (!passive)
 195                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
 196
 197         if (have_freqs)
 198                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
 199         if (flags)
 200                 NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS, flags);
 201
 202         err = 0;
 203  nla_put_failure:
 204         nlmsg_free(ssids);
 205         nlmsg_free(freqs);
 206         return err;
 207 }
 208
 209 static void tab_on_first(bool *first)
 210 {
 211         if (!*first)
 212                 printf("\t");
 213         else
 214                 *first = false;
 215 }
 216
 217 static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
 218 {
 219         printf(" ");
 220         print_ssid_escaped(len, data);
 221         printf("\n");
 222 }
 223
 224 #define BSS_MEMBERSHIP_SELECTOR_VHT_PHY 126
 225 #define BSS_MEMBERSHIP_SELECTOR_HT_PHY 127
 226
 227 static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 228 {
 229         int i;
 230
 231         printf(" ");
 232
 233         for (i = 0; i < len; i++) {
 234                 int r = data[i] & 0x7f;
 235
 236                 if (r == BSS_MEMBERSHIP_SELECTOR_VHT_PHY && data[i] & 0x80)
 237                         printf("VHT");
 238                 else if (r == BSS_MEMBERSHIP_SELECTOR_HT_PHY && data[i] & 0x80)
 239                         printf("HT");
 240                 else
 241                         printf("%d.%d", r/2, 5*(r&1));
 242
 243                 printf("%s ", data[i] & 0x80 ? "*" : "");
 244         }
 245         printf("\n");
 246 }
 247
 248 static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
 249 {
 250         printf(" channel %d\n", data[0]);
 251 }
 252
 253 static const char *country_env_str(char environment)
 254 {
 255         switch (environment) {
 256         case 'I':
 257                 return "Indoor only";
 258         case 'O':
 259                 return "Outdoor only";
 260         case ' ':
 261                 return "Indoor/Outdoor";
 262         default:
 263                 return "bogus";
 264         }
 265 }
 266
 267 static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
 268 {
 269         printf(" %.*s", 2, data);
 270
 271         printf("\tEnvironment: %s\n", country_env_str(data[2]));
 272
 273         data += 3;
 274         len -= 3;
 275
 276         if (len < 3) {
 277                 printf("\t\tNo country IE triplets present\n");
 278                 return;
 279         }
 280
 281         while (len >= 3) {
 282                 int end_channel;
 283                 union ieee80211_country_ie_triplet *triplet = (void *) data;
 284
 285                 if (triplet->ext.reg_extension_id >= IEEE80211_COUNTRY_EXTENSION_ID) {
 286                         printf("\t\tExtension ID: %d Regulatory Class: %d Coverage class: %d (up to %dm)\n",
 287                                triplet->ext.reg_extension_id,
 288                                triplet->ext.reg_class,
 289                                triplet->ext.coverage_class,
 290                                triplet->ext.coverage_class * 450);
 291
 292                         data += 3;
 293                         len -= 3;
 294                         continue;
 295                 }
 296
 297                 /* 2 GHz */
 298                 if (triplet->chans.first_channel <= 14)
 299                         end_channel = triplet->chans.first_channel + (triplet->chans.num_channels - 1);
 300                 else
 301                         end_channel =  triplet->chans.first_channel + (4 * (triplet->chans.num_channels - 1));
 302
 303                 printf("\t\tChannels [%d - %d] @ %d dBm\n", triplet->chans.first_channel, end_channel, triplet->chans.max_power);
 304
 305                 data += 3;
 306                 len -= 3;
 307         }
 308
 309         return;
 310 }
 311
 312 static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
 313 {
 314         printf(" %d dB\n", data[0]);
 315 }
 316
 317 static void print_tpcreport(const uint8_t type, uint8_t len, const uint8_t *data)
 318 {
 319         printf(" TX power: %d dBm\n", data[0]);
 320         /* printf(" Link Margin (%d dB) is reserved in Beacons\n", data[1]); */
 321 }
 322
 323 static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 324 {
 325         if (data[0] == 0x00)
 326                 printf(" <no flags>");
 327         if (data[0] & 0x01)
 328                 printf(" NonERP_Present");
 329         if (data[0] & 0x02)
 330                 printf(" Use_Protection");
 331         if (data[0] & 0x04)
 332                 printf(" Barker_Preamble_Mode");
 333         printf("\n");
 334 }
 335
 336 static void print_cipher(const uint8_t *data)
 337 {
 338         if (memcmp(data, ms_oui, 3) == 0) {
 339                 switch (data[3]) {
 340                 case 0:
 341                         printf("Use group cipher suite");
 342                         break;
 343                 case 1:
 344                         printf("WEP-40");
 345                         break;
 346                 case 2:
 347                         printf("TKIP");
 348                         break;
 349                 case 4:
 350                         printf("CCMP");
 351                         break;
 352                 case 5:
 353                         printf("WEP-104");
 354                         break;
 355                 default:
 356                         printf("%.02x-%.02x-%.02x:%d",
 357                                 data[0], data[1] ,data[2], data[3]);
 358                         break;
 359                 }
 360         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 361                 switch (data[3]) {
 362                 case 0:
 363                         printf("Use group cipher suite");
 364                         break;
 365                 case 1:
 366                         printf("WEP-40");
 367                         break;
 368                 case 2:
 369                         printf("TKIP");
 370                         break;
 371                 case 4:
 372                         printf("CCMP");
 373                         break;
 374                 case 5:
 375                         printf("WEP-104");
 376                         break;
 377                 case 6:
 378                         printf("AES-128-CMAC");
 379                         break;
 380                 case 8:
 381                         printf("GCMP");
 382                         break;
 383                 default:
 384                         printf("%.02x-%.02x-%.02x:%d",
 385                                 data[0], data[1] ,data[2], data[3]);
 386                         break;
 387                 }
 388         } else
 389                 printf("%.02x-%.02x-%.02x:%d",
 390                         data[0], data[1] ,data[2], data[3]);
 391 }
 392
 393 static void print_auth(const uint8_t *data)
 394 {
 395         if (memcmp(data, ms_oui, 3) == 0) {
 396                 switch (data[3]) {
 397                 case 1:
 398                         printf("IEEE 802.1X");
 399                         break;
 400                 case 2:
 401                         printf("PSK");
 402                         break;
 403                 default:
 404                         printf("%.02x-%.02x-%.02x:%d",
 405                                 data[0], data[1] ,data[2], data[3]);
 406                         break;
 407                 }
 408         } else if (memcmp(data, ieee80211_oui, 3) == 0) {
 409                 switch (data[3]) {
 410                 case 1:
 411                         printf("IEEE 802.1X");
 412                         break;
 413                 case 2:
 414                         printf("PSK");
 415                         break;
 416                 case 3:
 417                         printf("FT/IEEE 802.1X");
 418                         break;
 419                 case 4:
 420                         printf("FT/PSK");
 421                         break;
 422                 case 5:
 423                         printf("IEEE 802.1X/SHA-256");
 424                         break;
 425                 case 6:
 426                         printf("PSK/SHA-256");
 427                         break;
 428                 case 7:
 429                         printf("TDLS/TPK");
 430                         break;
 431                 default:
 432                         printf("%.02x-%.02x-%.02x:%d",
 433                                 data[0], data[1] ,data[2], data[3]);
 434                         break;
 435                 }
 436         } else
 437                 printf("%.02x-%.02x-%.02x:%d",
 438                         data[0], data[1] ,data[2], data[3]);
 439 }
 440
 441 static void print_rsn_ie(const char *defcipher, const char *defauth,
 442                          uint8_t len, const uint8_t *data)
 443 {
 444         bool first = true;
 445         __u16 version, count, capa;
 446         int i;
 447
 448         version = data[0] + (data[1] << 8);
 449         tab_on_first(&first);
 450         printf("\t * Version: %d\n", version);
 451
 452         data += 2;
 453         len -= 2;
 454
 455         if (len < 4) {
 456                 tab_on_first(&first);
 457                 printf("\t * Group cipher: %s\n", defcipher);
 458                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 459                 return;
 460         }
 461
 462         tab_on_first(&first);
 463         printf("\t * Group cipher: ");
 464         print_cipher(data);
 465         printf("\n");
 466
 467         data += 4;
 468         len -= 4;
 469
 470         if (len < 2) {
 471                 tab_on_first(&first);
 472                 printf("\t * Pairwise ciphers: %s\n", defcipher);
 473                 return;
 474         }
 475
 476         count = data[0] | (data[1] << 8);
 477         if (2 + (count * 4) > len)
 478                 goto invalid;
 479
 480         tab_on_first(&first);
 481         printf("\t * Pairwise ciphers:");
 482         for (i = 0; i < count; i++) {
 483                 printf(" ");
 484                 print_cipher(data + 2 + (i * 4));
 485         }
 486         printf("\n");
 487
 488         data += 2 + (count * 4);
 489         len -= 2 + (count * 4);
 490
 491         if (len < 2) {
 492                 tab_on_first(&first);
 493                 printf("\t * Authentication suites: %s\n", defauth);
 494                 return;
 495         }
 496
 497         count = data[0] | (data[1] << 8);
 498         if (2 + (count * 4) > len)
 499                 goto invalid;
 500
 501         tab_on_first(&first);
 502         printf("\t * Authentication suites:");
 503         for (i = 0; i < count; i++) {
 504                 printf(" ");
 505                 print_auth(data + 2 + (i * 4));
 506         }
 507         printf("\n");
 508
 509         data += 2 + (count * 4);
 510         len -= 2 + (count * 4);
 511
 512         if (len >= 2) {
 513                 capa = data[0] | (data[1] << 8);
 514                 tab_on_first(&first);
 515                 printf("\t * Capabilities:");
 516                 if (capa & 0x0001)
 517                         printf(" PreAuth");
 518                 if (capa & 0x0002)
 519                         printf(" NoPairwise");
 520                 switch ((capa & 0x000c) >> 2) {
 521                 case 0:
 522                         printf(" 1-PTKSA-RC");
 523                         break;
 524                 case 1:
 525                         printf(" 2-PTKSA-RC");
 526                         break;
 527                 case 2:
 528                         printf(" 4-PTKSA-RC");
 529                         break;
 530                 case 3:
 531                         printf(" 16-PTKSA-RC");
 532                         break;
 533                 }
 534                 switch ((capa & 0x0030) >> 4) {
 535                 case 0:
 536                         printf(" 1-GTKSA-RC");
 537                         break;
 538                 case 1:
 539                         printf(" 2-GTKSA-RC");
 540                         break;
 541                 case 2:
 542                         printf(" 4-GTKSA-RC");
 543                         break;
 544                 case 3:
 545                         printf(" 16-GTKSA-RC");
 546                         break;
 547                 }
 548                 if (capa & 0x0040)
 549                         printf(" MFP-required");
 550                 if (capa & 0x0080)
 551                         printf(" MFP-capable");
 552                 if (capa & 0x0200)
 553                         printf(" Peerkey-enabled");
 554                 if (capa & 0x0400)
 555                         printf(" SPP-AMSDU-capable");
 556                 if (capa & 0x0800)
 557                         printf(" SPP-AMSDU-required");
 558                 printf(" (0x%.4x)\n", capa);
 559                 data += 2;
 560                 len -= 2;
 561         }
 562
 563         if (len >= 2) {
 564                 int pmkid_count = data[0] | (data[1] << 8);
 565
 566                 if (len >= 2 + 16 * pmkid_count) {
 567                         tab_on_first(&first);
 568                         printf("\t * %d PMKIDs\n", pmkid_count);
 569                         /* not printing PMKID values */
 570                         data += 2 + 16 * pmkid_count;
 571                         len -= 2 + 16 * pmkid_count;
 572                 } else
 573                         goto invalid;
 574         }
 575
 576         if (len >= 4) {
 577                 tab_on_first(&first);
 578                 printf("\t * Group mgmt cipher suite: ");
 579                 print_cipher(data);
 580                 printf("\n");
 581                 data += 4;
 582                 len -= 4;
 583         }
 584
 585  invalid:
 586         if (len != 0) {
 587                 printf("\t\t * bogus tail data (%d):", len);
 588                 while (len) {
 589                         printf(" %.2x", *data);
 590                         data++;
 591                         len--;
 592                 }
 593                 printf("\n");
 594         }
 595 }
 596
 597 static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
 598 {
 599         print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 600 }
 601
 602 static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
 603 {
 604         printf("\n");
 605         print_ht_capability(data[0] | (data[1] << 8));
 606         print_ampdu_length(data[2] & 3);
 607         print_ampdu_spacing((data[2] >> 2) & 7);
 608         print_ht_mcs(data + 3);
 609 }
 610
 611 static const char* ntype_11u(uint8_t t)
 612 {
 613         switch (t) {
 614         case 0: return "Private";
 615         case 1: return "Private with Guest";
 616         case 2: return "Chargeable Public";
 617         case 3: return "Free Public";
 618         case 4: return "Personal Device";
 619         case 5: return "Emergency Services Only";
 620         case 14: return "Test or Experimental";
 621         case 15: return "Wildcard";
 622         default: return "Reserved";
 623         }
 624 }
 625
 626 static const char* vgroup_11u(uint8_t t)
 627 {
 628         switch (t) {
 629         case 0: return "Unspecified";
 630         case 1: return "Assembly";
 631         case 2: return "Business";
 632         case 3: return "Educational";
 633         case 4: return "Factory and Industrial";
 634         case 5: return "Institutional";
 635         case 6: return "Mercantile";
 636         case 7: return "Residential";
 637         case 8: return "Storage";
 638         case 9: return "Utility and Miscellaneous";
 639         case 10: return "Vehicular";
 640         case 11: return "Outdoor";
 641         default: return "Reserved";
 642         }
 643 }
 644
 645 static void print_interworking(const uint8_t type, uint8_t len, const uint8_t *data)
 646 {
 647         /* See Section 7.3.2.92 in the 802.11u spec. */
 648         printf("\n");
 649         if (len >= 1) {
 650                 uint8_t ano = data[0];
 651                 printf("\t\tNetwork Options: 0x%hx\n", (unsigned short)(ano));
 652                 printf("\t\t\tNetwork Type: %i (%s)\n",
 653                        (int)(ano & 0xf), ntype_11u(ano & 0xf));
 654                 if (ano & (1<<4))
 655                         printf("\t\t\tInternet\n");
 656                 if (ano & (1<<5))
 657                         printf("\t\t\tASRA\n");
 658                 if (ano & (1<<6))
 659                         printf("\t\t\tESR\n");
 660                 if (ano & (1<<7))
 661                         printf("\t\t\tUESA\n");
 662         }
 663         if ((len == 3) || (len == 9)) {
 664                 printf("\t\tVenue Group: %i (%s)\n",
 665                        (int)(data[1]), vgroup_11u(data[1]));
 666                 printf("\t\tVenue Type: %i\n", (int)(data[2]));
 667         }
 668         if (len == 9)
 669                 printf("\t\tHESSID: %02hx:%02hx:%02hx:%02hx:%02hx:%02hx\n",
 670                        data[3], data[4], data[5], data[6], data[7], data[8]);
 671         else if (len == 7)
 672                 printf("\t\tHESSID: %02hx:%02hx:%02hx:%02hx:%02hx:%02hx\n",
 673                        data[1], data[2], data[3], data[4], data[5], data[6]);
 674 }
 675
 676 static void print_11u_advert(const uint8_t type, uint8_t len, const uint8_t *data)
 677 {
 678         /* See Section 7.3.2.93 in the 802.11u spec. */
 679         /* TODO: This code below does not decode private protocol IDs */
 680         int idx = 0;
 681         printf("\n");
 682         while (idx < (len - 1)) {
 683                 uint8_t qri = data[idx];
 684                 uint8_t proto_id = data[idx + 1];
 685                 printf("\t\tQuery Response Info: 0x%hx\n", (unsigned short)(qri));
 686                 printf("\t\t\tQuery Response Length Limit: %i\n",
 687                        (qri & 0x7f));
 688                 if (qri & (1<<7))
 689                         printf("\t\t\tPAME-BI\n");
 690                 switch(proto_id) {
 691                 case 0:
 692                         printf("\t\t\tANQP\n"); break;
 693                 case 1:
 694                         printf("\t\t\tMIH Information Service\n"); break;
 695                 case 2:
 696                         printf("\t\t\tMIH Command and Event Services Capability Discovery\n"); break;
 697                 case 3:
 698                         printf("\t\t\tEmergency Alert System (EAS)\n"); break;
 699                 case 221:
 700                         printf("\t\t\tVendor Specific\n"); break;
 701                 default:
 702                         printf("\t\t\tReserved: %i\n", proto_id); break;
 703                 }
 704                 idx += 2;
 705         }
 706 }
 707
 708 static const char *ht_secondary_offset[4] = {
 709         "no secondary",
 710         "above",
 711         "[reserved!]",
 712         "below",
 713 };
 714
 715 static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
 716 {
 717         static const char *protection[4] = {
 718                 "no",
 719                 "nonmember",
 720                 "20 MHz",
 721                 "non-HT mixed",
 722         };
 723         static const char *sta_chan_width[2] = {
 724                 "20 MHz",
 725                 "any",
 726         };
 727
 728         printf("\n");
 729         printf("\t\t * primary channel: %d\n", data[0]);
 730         printf("\t\t * secondary channel offset: %s\n",
 731                 ht_secondary_offset[data[1] & 0x3]);
 732         printf("\t\t * STA channel width: %s\n", sta_chan_width[(data[1] & 0x4)>>2]);
 733         printf("\t\t * RIFS: %d\n", (data[1] & 0x8)>>3);
 734         printf("\t\t * HT protection: %s\n", protection[data[2] & 0x3]);
 735         printf("\t\t * non-GF present: %d\n", (data[2] & 0x4) >> 2);
 736         printf("\t\t * OBSS non-GF present: %d\n", (data[2] & 0x10) >> 4);
 737         printf("\t\t * dual beacon: %d\n", (data[4] & 0x40) >> 6);
 738         printf("\t\t * dual CTS protection: %d\n", (data[4] & 0x80) >> 7);
 739         printf("\t\t * STBC beacon: %d\n", data[5] & 0x1);
 740         printf("\t\t * L-SIG TXOP Prot: %d\n", (data[5] & 0x2) >> 1);
 741         printf("\t\t * PCO active: %d\n", (data[5] & 0x4) >> 2);
 742         printf("\t\t * PCO phase: %d\n", (data[5] & 0x8) >> 3);
 743 }
 744
 745 static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 746 {
 747         int i, base, bit;
 748         bool first = true;
 749
 750
 751         for (i = 0; i < len; i++) {
 752                 base = i * 8;
 753
 754                 for (bit = 0; bit < 8; bit++) {
 755                         if (!(data[i] & (1 << bit)))
 756                                 continue;
 757
 758                         if (!first)
 759                                 printf(",");
 760                         else
 761                                 first = false;
 762
 763 #define CAPA(bit, name)         case bit: printf(" " name); break
 764
 765                         switch (bit + base) {
 766                         CAPA(0, "HT Information Exchange Supported");
 767                         CAPA(1, "reserved (On-demand Beacon)");
 768                         CAPA(2, "Extended Channel Switching");
 769                         CAPA(3, "reserved (Wave Indication)");
 770                         CAPA(4, "PSMP Capability");
 771                         CAPA(5, "reserved (Service Interval Granularity)");
 772                         CAPA(6, "S-PSMP Capability");
 773                         CAPA(7, "Event");
 774                         CAPA(8, "Diagnostics");
 775                         CAPA(9, "Multicast Diagnostics");
 776                         CAPA(10, "Location Tracking");
 777                         CAPA(11, "FMS");
 778                         CAPA(12, "Proxy ARP Service");
 779                         CAPA(13, "Collocated Interference Reporting");
 780                         CAPA(14, "Civic Location");
 781                         CAPA(15, "Geospatial Location");
 782                         CAPA(16, "TFS");
 783                         CAPA(17, "WNM-Sleep Mode");
 784                         CAPA(18, "TIM Broadcast");
 785                         CAPA(19, "BSS Transition");
 786                         CAPA(20, "QoS Traffic Capability");
 787                         CAPA(21, "AC Station Count");
 788                         CAPA(22, "Multiple BSSID");
 789                         CAPA(23, "Timing Measurement");
 790                         CAPA(24, "Channel Usage");
 791                         CAPA(25, "SSID List");
 792                         CAPA(26, "DMS");
 793                         CAPA(27, "UTC TSF Offset");
 794                         CAPA(28, "TDLS Peer U-APSD Buffer STA Support");
 795                         CAPA(29, "TDLS Peer PSM Support");
 796                         CAPA(30, "TDLS channel switching");
 797                         CAPA(31, "Interworking");
 798                         CAPA(32, "QoS Map");
 799                         CAPA(33, "EBR");
 800                         CAPA(34, "SSPN Interface");
 801                         CAPA(35, "Reserved");
 802                         CAPA(36, "MSGCF Capability");
 803                         CAPA(37, "TDLS Support");
 804                         CAPA(38, "TDLS Prohibited");
 805                         CAPA(39, "TDLS Channel Switching Prohibited");
 806                         CAPA(40, "Reject Unadmitted Frame");
 807                         CAPA(44, "Identifier Location");
 808                         CAPA(45, "U-APSD Coexistence");
 809                         CAPA(46, "WNM-Notification");
 810                         CAPA(47, "Reserved");
 811                         CAPA(48, "UTF-8 SSID");
 812                         default:
 813                                 printf(" %d", bit);
 814                                 break;
 815                         }
 816 #undef CAPA
 817                 }
 818         }
 819
 820         printf("\n");
 821 }
 822
 823 static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data)
 824 {
 825         printf(" DTIM Count %u DTIM Period %u Bitmap Control 0x%x "
 826                "Bitmap[0] 0x%x",
 827                data[0], data[1], data[2], data[3]);
 828         if (len - 4)
 829                 printf(" (+ %u octet%s)", len - 4, len - 4 == 1 ? "" : "s");
 830         printf("\n");
 831 }
 832
 833 static void print_ibssatim(const uint8_t type, uint8_t len, const uint8_t *data)
 834 {
 835         printf(" %d TUs", (data[1] << 8) + data[0]);
 836 }
 837
 838 static void print_vht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
 839 {
 840         printf("\n");
 841         print_vht_info(data[0] | (data[1] << 8) |
 842                        (data[2] << 16) | (data[3] << 24),
 843                        data + 4);
 844 }
 845
 846 static void print_vht_oper(const uint8_t type, uint8_t len, const uint8_t *data)
 847 {
 848         const char *chandwidths[] = {
 849                 [0] = "20 or 40 MHz",
 850                 [1] = "80 MHz",
 851                 [3] = "80+80 MHz",
 852                 [2] = "160 MHz",
 853         };
 854
 855         printf("\n");
 856         printf("\t\t * channel width: %d (%s)\n", data[0],
 857                 data[0] < ARRAY_SIZE(chandwidths) ? chandwidths[data[0]] : "unknown");
 858         printf("\t\t * center freq segment 1: %d\n", data[1]);
 859         printf("\t\t * center freq segment 2: %d\n", data[2]);
 860         printf("\t\t * VHT basic MCS set: 0x%.2x%.2x\n", data[4], data[3]);
 861 }
 862
 863 static void print_obss_scan_params(const uint8_t type, uint8_t len, const uint8_t *data)
 864 {
 865         printf("\n");
 866         printf("\t\t * passive dwell: %d TUs\n", (data[1] << 8) | data[0]);
 867         printf("\t\t * active dwell: %d TUs\n", (data[3] << 8) | data[2]);
 868         printf("\t\t * channel width trigger scan interval: %d s\n", (data[5] << 8) | data[4]);
 869         printf("\t\t * scan passive total per channel: %d TUs\n", (data[7] << 8) | data[6]);
 870         printf("\t\t * scan active total per channel: %d TUs\n", (data[9] << 8) | data[8]);
 871         printf("\t\t * BSS width channel transition delay factor: %d\n", (data[11] << 8) | data[10]);
 872         printf("\t\t * OBSS Scan Activity Threshold: %d.%02d %%\n",
 873                 ((data[13] << 8) | data[12]) / 100, ((data[13] << 8) | data[12]) % 100);
 874 }
 875
 876 static void print_secchan_offs(const uint8_t type, uint8_t len, const uint8_t *data)
 877 {
 878         if (data[0] < ARRAY_SIZE(ht_secondary_offset))
 879                 printf(" %s (%d)\n", ht_secondary_offset[data[0]], data[0]);
 880         else
 881                 printf(" %d\n", data[0]);
 882 }
 883
 884 static void print_bss_load(const uint8_t type, uint8_t len, const uint8_t *data)
 885 {
 886         printf("\n");
 887         printf("\t\t * station count: %d\n", (data[1] << 8) | data[0]);
 888         printf("\t\t * channel utilisation: %d/255\n", data[2]);
 889         printf("\t\t * available admission capacity: %d [*32us]\n", (data[4] << 8) | data[3]);
 890 }
 891
 892 static void print_mesh_conf(const uint8_t type, uint8_t len, const uint8_t *data)
 893 {
 894         printf("\n");
 895         printf("\t\t * Active Path Selection Protocol ID: %d\n", data[0]);
 896         printf("\t\t * Active Path Selection Metric ID: %d\n", data[1]);
 897         printf("\t\t * Congestion Control Mode ID: %d\n", data[2]);
 898         printf("\t\t * Synchronization Method ID: %d\n", data[3]);
 899         printf("\t\t * Authentication Protocol ID: %d\n", data[4]);
 900         printf("\t\t * Mesh Formation Info:\n");
 901         printf("\t\t\t Number of Peerings: %d\n", (data[5] & 0x7E) >> 1);
 902         if (data[5] & 0x01)
 903                 printf("\t\t\t Connected to Mesh Gate\n");
 904         if (data[5] & 0x80)
 905                 printf("\t\t\t Connected to AS\n");
 906         printf("\t\t * Mesh Capability\n");
 907         if (data[6] & 0x01)
 908                 printf("\t\t\t Accepting Additional Mesh Peerings\n");
 909         if (data[6] & 0x02)
 910                 printf("\t\t\t MCCA Supported\n");
 911         if (data[6] & 0x04)
 912                 printf("\t\t\t MCCA Enabled\n");
 913         if (data[6] & 0x08)
 914                 printf("\t\t\t Forwarding\n");
 915         if (data[6] & 0x10)
 916                 printf("\t\t\t MBCA Supported\n");
 917         if (data[6] & 0x20)
 918                 printf("\t\t\t TBTT Adjusting\n");
 919         if (data[6] & 0x40)
 920                 printf("\t\t\t Mesh Power Save Level\n");
 921 }
 922
 923 struct ie_print {
 924         const char *name;
 925         void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
 926         uint8_t minlen, maxlen;
 927         uint8_t flags;
 928 };
 929
 930 static void print_ie(const struct ie_print *p, const uint8_t type,
 931                      uint8_t len, const uint8_t *data)
 932 {
 933         int i;
 934
 935         if (!p->print)
 936                 return;
 937
 938         printf("\t%s:", p->name);
 939         if (len < p->minlen || len > p->maxlen) {
 940                 if (len > 1) {
 941                         printf(" <invalid: %d bytes:", len);
 942                         for (i = 0; i < len; i++)
 943                                 printf(" %.02x", data[i]);
 944                         printf(">\n");
 945                 } else if (len)
 946                         printf(" <invalid: 1 byte: %.02x>\n", data[0]);
 947                 else
 948                         printf(" <invalid: no data>\n");
 949                 return;
 950         }
 951
 952         p->print(type, len, data);
 953 }
 954
 955 #define PRINT_IGN {             \
 956         .name = "IGNORE",       \
 957         .print = NULL,          \
 958         .minlen = 0,            \
 959         .maxlen = 255,          \
 960 }
 961
 962 static const struct ie_print ieprinters[] = {
 963         [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
 964         [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 965         [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
 966         [5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), },
 967         [6] = { "IBSS ATIM window", print_ibssatim, 2, 2, BIT(PRINT_SCAN), },
 968         [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
 969         [11] = { "BSS Load", print_bss_load, 5, 5, BIT(PRINT_SCAN), },
 970         [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
 971         [35] = { "TPC report", print_tpcreport, 2, 2, BIT(PRINT_SCAN), },
 972         [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
 973         [45] = { "HT capabilities", print_ht_capa, 26, 26, BIT(PRINT_SCAN), },
 974         [47] = { "ERP D4.0", print_erp, 1, 255, BIT(PRINT_SCAN), },
 975         [74] = { "Overlapping BSS scan params", print_obss_scan_params, 14, 255, BIT(PRINT_SCAN), },
 976         [61] = { "HT operation", print_ht_op, 22, 22, BIT(PRINT_SCAN), },
 977         [62] = { "Secondary Channel Offset", print_secchan_offs, 1, 1, BIT(PRINT_SCAN), },
 978         [191] = { "VHT capabilities", print_vht_capa, 12, 255, BIT(PRINT_SCAN), },
 979         [192] = { "VHT operation", print_vht_oper, 5, 255, BIT(PRINT_SCAN), },
 980         [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
 981         [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
 982         [113] = { "MESH Configuration", print_mesh_conf, 7, 7, BIT(PRINT_SCAN), },
 983         [114] = { "MESH ID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
 984         [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
 985         [107] = { "802.11u Interworking", print_interworking, 0, 255, BIT(PRINT_SCAN), },
 986         [108] = { "802.11u Advertisement", print_11u_advert, 0, 255, BIT(PRINT_SCAN), },
 987 };
 988
 989 static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
 990 {
 991         print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
 992 }
 993
 994 static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
 995 {
 996         int i;
 997         static const char *aci_tbl[] = { "BE", "BK", "VI", "VO" };
 998
 999         if (len < 19)
1000                 goto invalid;
1001
1002         if (data[0] != 1) {
1003                 printf("Parameter: not version 1: ");
1004                 return false;
1005         }
1006
1007         printf("\t * Parameter version 1");
1008
1009         data++;
1010
1011         if (data[0] & 0x80)
1012                 printf("\n\t\t * u-APSD");
1013
1014         data += 2;
1015
1016         for (i = 0; i < 4; i++) {
1017                 printf("\n\t\t * %s:", aci_tbl[(data[0] >> 5) & 3]);
1018                 if (data[0] & 0x10)
1019                         printf(" acm");
1020                 printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1,
1021                                     (1 << (data[1] >> 4)) - 1);
1022                 printf(", AIFSN %d", data[0] & 0xf);
1023                 if (data[2] | data[3])
1024                         printf(", TXOP %d usec", (data[2] + (data[3] << 8)) * 32);
1025                 data += 4;
1026         }
1027
1028         printf("\n");
1029         return true;
1030
1031  invalid:
1032         printf("invalid: ");
1033         return false;
1034 }
1035
1036 static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
1037 {
1038         int i;
1039
1040         switch (data[0]) {
1041         case 0x00:
1042                 printf(" information:");
1043                 break;
1044         case 0x01:
1045                 if (print_wifi_wmm_param(data + 1, len - 1))
1046                         return;
1047                 break;
1048         default:
1049                 printf(" type %d:", data[0]);
1050                 break;
1051         }
1052
1053         for(i = 1; i < len; i++)
1054                 printf(" %.02x", data[i]);
1055         printf("\n");
1056 }
1057
1058 static const char * wifi_wps_dev_passwd_id(uint16_t id)
1059 {
1060         switch (id) {
1061         case 0:
1062                 return "Default (PIN)";
1063         case 1:
1064                 return "User-specified";
1065         case 2:
1066                 return "Machine-specified";
1067         case 3:
1068                 return "Rekey";
1069         case 4:
1070                 return "PushButton";
1071         case 5:
1072                 return "Registrar-specified";
1073         default:
1074                 return "??";
1075         }
1076 }
1077
1078 static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
1079 {
1080         bool first = true;
1081         __u16 subtype, sublen;
1082
1083         while (len >= 4) {
1084                 subtype = (data[0] << 8) + data[1];
1085                 sublen = (data[2] << 8) + data[3];
1086                 if (sublen > len)
1087                         break;
1088
1089                 switch (subtype) {
1090                 case 0x104a:
1091                         tab_on_first(&first);
1092                         printf("\t * Version: %d.%d\n", data[4] >> 4, data[4] & 0xF);
1093                         break;
1094                 case 0x1011:
1095                         tab_on_first(&first);
1096                         printf("\t * Device name: %.*s\n", sublen, data + 4);
1097                         break;
1098                 case 0x1012: {
1099                         uint16_t id;
1100                         tab_on_first(&first);
1101                         if (sublen != 2) {
1102                                 printf("\t * Device Password ID: (invalid "
1103                                        "length %d)\n", sublen);
1104                                 break;
1105                         }
1106                         id = data[4] << 8 | data[5];
1107                         printf("\t * Device Password ID: %u (%s)\n",
1108                                id, wifi_wps_dev_passwd_id(id));
1109                         break;
1110                 }
1111                 case 0x1021:
1112                         tab_on_first(&first);
1113                         printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
1114                         break;
1115                 case 0x1023:
1116                         tab_on_first(&first);
1117                         printf("\t * Model: %.*s\n", sublen, data + 4);
1118                         break;
1119                 case 0x1024:
1120                         tab_on_first(&first);
1121                         printf("\t * Model Number: %.*s\n", sublen, data + 4);
1122                         break;
1123                 case 0x103b: {
1124                         __u8 val = data[4];
1125                         tab_on_first(&first);
1126                         printf("\t * Response Type: %d%s\n",
1127                                val, val == 3 ? " (AP)" : "");
1128                         break;
1129                 }
1130                 case 0x103c: {
1131                         __u8 val = data[4];
1132                         tab_on_first(&first);
1133                         printf("\t * RF Bands: 0x%x\n", val);
1134                         break;
1135                 }
1136                 case 0x1041: {
1137                         __u8 val = data[4];
1138                         tab_on_first(&first);
1139                         printf("\t * Selected Registrar: 0x%x\n", val);
1140                         break;
1141                 }
1142                 case 0x1042:
1143                         tab_on_first(&first);
1144                         printf("\t * Serial Number: %.*s\n", sublen, data + 4);
1145                         break;
1146                 case 0x1044: {
1147                         __u8 val = data[4];
1148                         tab_on_first(&first);
1149                         printf("\t * Wi-Fi Protected Setup State: %d%s%s\n",
1150                                val,
1151                                val == 1 ? " (Unconfigured)" : "",
1152                                val == 2 ? " (Configured)" : "");
1153                         break;
1154                 }
1155                 case 0x1047:
1156                         tab_on_first(&first);
1157                         printf("\t * UUID: ");
1158                         if (sublen != 16) {
1159                                 printf("(invalid, length=%d)\n", sublen);
1160                                 break;
1161                         }
1162                         printf("%02x%02x%02x%02x-%02x%02x-%02x%02x-"
1163                                 "%02x%02x-%02x%02x%02x%02x%02x%02x\n",
1164                                 data[4], data[5], data[6], data[7],
1165                                 data[8], data[9], data[10], data[11],
1166                                 data[12], data[13], data[14], data[15],
1167                                 data[16], data[17], data[18], data[19]);
1168                         break;
1169                 case 0x1054: {
1170                         tab_on_first(&first);
1171                         if (sublen != 8) {
1172                                 printf("\t * Primary Device Type: (invalid "
1173                                        "length %d)\n", sublen);
1174                                 break;
1175                         }
1176                         printf("\t * Primary Device Type: "
1177                                "%u-%02x%02x%02x%02x-%u\n",
1178                                data[4] << 8 | data[5],
1179                                data[6], data[7], data[8], data[9],
1180                                data[10] << 8 | data[11]);
1181                         break;
1182                 }
1183                 case 0x1057: {
1184                         __u8 val = data[4];
1185                         tab_on_first(&first);
1186                         printf("\t * AP setup locked: 0x%.2x\n", val);
1187                         break;
1188                 }
1189                 case 0x1008:
1190                 case 0x1053: {
1191                         __u16 meth = (data[4] << 8) + data[5];
1192                         bool comma = false;
1193                         tab_on_first(&first);
1194                         printf("\t * %sConfig methods:",
1195                                subtype == 0x1053 ? "Selected Registrar ": "");
1196 #define T(bit, name) do {               \
1197         if (meth & (1<<bit)) {          \
1198                 if (comma)              \
1199                         printf(",");    \
1200                 comma = true;           \
1201                 printf(" " name);       \
1202         } } while (0)
1203                         T(0, "USB");
1204                         T(1, "Ethernet");
1205                         T(2, "Label");
1206                         T(3, "Display");
1207                         T(4, "Ext. NFC");
1208                         T(5, "Int. NFC");
1209                         T(6, "NFC Intf.");
1210                         T(7, "PBC");
1211                         T(8, "Keypad");
1212                         printf("\n");
1213                         break;
1214 #undef T
1215                 }
1216                 default: {
1217                         const __u8 *subdata = data + 4;
1218                         __u16 tmplen = sublen;
1219
1220                         tab_on_first(&first);
1221                         printf("\t * Unknown TLV (%#.4x, %d bytes):",
1222                                subtype, tmplen);
1223                         while (tmplen) {
1224                                 printf(" %.2x", *subdata);
1225                                 subdata++;
1226                                 tmplen--;
1227                         }
1228                         printf("\n");
1229                         break;
1230                 }
1231                 }
1232
1233                 data += sublen + 4;
1234                 len -= sublen + 4;
1235         }
1236
1237         if (len != 0) {
1238                 printf("\t\t * bogus tail data (%d):", len);
1239                 while (len) {
1240                         printf(" %.2x", *data);
1241                         data++;
1242                         len--;
1243                 }
1244                 printf("\n");
1245         }
1246 }
1247
1248 static const struct ie_print wifiprinters[] = {
1249         [1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
1250         [2] = { "WMM", print_wifi_wmm, 1, 255, BIT(PRINT_SCAN), },
1251         [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
1252 };
1253
1254 static inline void print_p2p(const uint8_t type, uint8_t len, const uint8_t *data)
1255 {
1256         bool first = true;
1257         __u8 subtype;
1258         __u16 sublen;
1259
1260         while (len >= 3) {
1261                 subtype = data[0];
1262                 sublen = (data[2] << 8) + data[1];
1263
1264                 if (sublen > len - 3)
1265                         break;
1266
1267                 switch (subtype) {
1268                 case 0x02: /* capability */
1269                         tab_on_first(&first);
1270                         if (sublen < 2) {
1271                                 printf("\t * malformed capability\n");
1272                                 break;
1273                         }
1274                         printf("\t * Group capa: 0x%.2x, Device capa: 0x%.2x\n",
1275                                 data[3], data[4]);
1276                         break;
1277                 case 0x0d: /* device info */
1278                         if (sublen < 6 + 2 + 8 + 1) {
1279                                 printf("\t * malformed device info\n");
1280                                 break;
1281                         }
1282                         /* fall through for now */
1283                 case 0x00: /* status */
1284                 case 0x01: /* minor reason */
1285                 case 0x03: /* device ID */
1286                 case 0x04: /* GO intent */
1287                 case 0x05: /* configuration timeout */
1288                 case 0x06: /* listen channel */
1289                 case 0x07: /* group BSSID */
1290                 case 0x08: /* ext listen timing */
1291                 case 0x09: /* intended interface address */
1292                 case 0x0a: /* manageability */
1293                 case 0x0b: /* channel list */
1294                 case 0x0c: /* NoA */
1295                 case 0x0e: /* group info */
1296                 case 0x0f: /* group ID */
1297                 case 0x10: /* interface */
1298                 case 0x11: /* operating channel */
1299                 case 0x12: /* invitation flags */
1300                 case 0xdd: /* vendor specific */
1301                 default: {
1302                         const __u8 *subdata = data + 4;
1303                         __u16 tmplen = sublen;
1304
1305                         tab_on_first(&first);
1306                         printf("\t * Unknown TLV (%#.2x, %d bytes):",
1307                                subtype, tmplen);
1308                         while (tmplen) {
1309                                 printf(" %.2x", *subdata);
1310                                 subdata++;
1311                                 tmplen--;
1312                         }
1313                         printf("\n");
1314                         break;
1315                 }
1316                 }
1317
1318                 data += sublen + 3;
1319                 len -= sublen + 3;
1320         }
1321
1322         if (len != 0) {
1323                 tab_on_first(&first);
1324                 printf("\t * bogus tail data (%d):", len);
1325                 while (len) {
1326                         printf(" %.2x", *data);
1327                         data++;
1328                         len--;
1329                 }
1330                 printf("\n");
1331         }
1332 }
1333
1334 static const struct ie_print wfa_printers[] = {
1335         [9] = { "P2P", print_p2p, 2, 255, BIT(PRINT_SCAN), },
1336 };
1337
1338 static void print_vendor(unsigned char len, unsigned char *data,
1339                          bool unknown, enum print_ie_type ptype)
1340 {
1341         int i;
1342
1343         if (len < 3) {
1344                 printf("\tVendor specific: <too short> data:");
1345                 for(i = 0; i < len; i++)
1346                         printf(" %.02x", data[i]);
1347                 printf("\n");
1348                 return;
1349         }
1350
1351         if (len >= 4 && memcmp(data, ms_oui, 3) == 0) {
1352                 if (data[3] < ARRAY_SIZE(wifiprinters) &&
1353                     wifiprinters[data[3]].name &&
1354                     wifiprinters[data[3]].flags & BIT(ptype)) {
1355                         print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
1356                         return;
1357                 }
1358                 if (!unknown)
1359                         return;
1360                 printf("\tMS/WiFi %#.2x, data:", data[3]);
1361                 for(i = 0; i < len - 4; i++)
1362                         printf(" %.02x", data[i + 4]);
1363                 printf("\n");
1364                 return;
1365         }
1366
1367         if (len >= 4 && memcmp(data, wfa_oui, 3) == 0) {
1368                 if (data[3] < ARRAY_SIZE(wfa_printers) &&
1369                     wfa_printers[data[3]].name &&
1370                     wfa_printers[data[3]].flags & BIT(ptype)) {
1371                         print_ie(&wfa_printers[data[3]], data[3], len - 4, data + 4);
1372                         return;
1373                 }
1374                 if (!unknown)
1375                         return;
1376                 printf("\tWFA %#.2x, data:", data[3]);
1377                 for(i = 0; i < len - 4; i++)
1378                         printf(" %.02x", data[i + 4]);
1379                 printf("\n");
1380                 return;
1381         }
1382
1383         if (!unknown)
1384                 return;
1385
1386         printf("\tVendor specific: OUI %.2x:%.2x:%.2x, data:",
1387                 data[0], data[1], data[2]);
1388         for (i = 3; i < len; i++)
1389                 printf(" %.2x", data[i]);
1390         printf("\n");
1391 }
1392
1393 void print_ies(unsigned char *ie, int ielen, bool unknown,
1394                enum print_ie_type ptype)
1395 {
1396         while (ielen >= 2 && ielen >= ie[1]) {
1397                 if (ie[0] < ARRAY_SIZE(ieprinters) &&
1398                     ieprinters[ie[0]].name &&
1399                     ieprinters[ie[0]].flags & BIT(ptype)) {
1400                         print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
1401                 } else if (ie[0] == 221 /* vendor */) {
1402                         print_vendor(ie[1], ie + 2, unknown, ptype);
1403                 } else if (unknown) {
1404                         int i;
1405
1406                         printf("\tUnknown IE (%d):", ie[0]);
1407                         for (i=0; i<ie[1]; i++)
1408                                 printf(" %.2x", ie[2+i]);
1409                         printf("\n");
1410                 }
1411                 ielen -= ie[1] + 2;
1412                 ie += ie[1] + 2;
1413         }
1414 }
1415
1416 static void print_capa_dmg(__u16 capa)
1417 {
1418         switch (capa & WLAN_CAPABILITY_DMG_TYPE_MASK) {
1419         case WLAN_CAPABILITY_DMG_TYPE_AP:
1420                 printf(" DMG_ESS");
1421                 break;
1422         case WLAN_CAPABILITY_DMG_TYPE_PBSS:
1423                 printf(" DMG_PCP");
1424                 break;
1425         case WLAN_CAPABILITY_DMG_TYPE_IBSS:
1426                 printf(" DMG_IBSS");
1427                 break;
1428         }
1429
1430         if (capa & WLAN_CAPABILITY_DMG_CBAP_ONLY)
1431                 printf(" CBAP_Only");
1432         if (capa & WLAN_CAPABILITY_DMG_CBAP_SOURCE)
1433                 printf(" CBAP_Src");
1434         if (capa & WLAN_CAPABILITY_DMG_PRIVACY)
1435                 printf(" Privacy");
1436         if (capa & WLAN_CAPABILITY_DMG_ECPAC)
1437                 printf(" ECPAC");
1438         if (capa & WLAN_CAPABILITY_DMG_SPECTRUM_MGMT)
1439                 printf(" SpectrumMgmt");
1440         if (capa & WLAN_CAPABILITY_DMG_RADIO_MEASURE)
1441                 printf(" RadioMeasure");
1442 }
1443
1444 static void print_capa_non_dmg(__u16 capa)
1445 {
1446         if (capa & WLAN_CAPABILITY_ESS)
1447                 printf(" ESS");
1448         if (capa & WLAN_CAPABILITY_IBSS)
1449                 printf(" IBSS");
1450         if (capa & WLAN_CAPABILITY_CF_POLLABLE)
1451                 printf(" CfPollable");
1452         if (capa & WLAN_CAPABILITY_CF_POLL_REQUEST)
1453                 printf(" CfPollReq");
1454         if (capa & WLAN_CAPABILITY_PRIVACY)
1455                 printf(" Privacy");
1456         if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
1457                 printf(" ShortPreamble");
1458         if (capa & WLAN_CAPABILITY_PBCC)
1459                 printf(" PBCC");
1460         if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
1461                 printf(" ChannelAgility");
1462         if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
1463                 printf(" SpectrumMgmt");
1464         if (capa & WLAN_CAPABILITY_QOS)
1465                 printf(" QoS");
1466         if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
1467                 printf(" ShortSlotTime");
1468         if (capa & WLAN_CAPABILITY_APSD)
1469                 printf(" APSD");
1470         if (capa & WLAN_CAPABILITY_RADIO_MEASURE)
1471                 printf(" RadioMeasure");
1472         if (capa & WLAN_CAPABILITY_DSSS_OFDM)
1473                 printf(" DSSS-OFDM");
1474         if (capa & WLAN_CAPABILITY_DEL_BACK)
1475                 printf(" DelayedBACK");
1476         if (capa & WLAN_CAPABILITY_IMM_BACK)
1477                 printf(" ImmediateBACK");
1478 }
1479
1480 static int print_bss_handler(struct nl_msg *msg, void *arg)
1481 {
1482         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1483         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1484         struct nlattr *bss[NL80211_BSS_MAX + 1];
1485         char mac_addr[20], dev[20];
1486         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
1487                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
1488                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
1489                 [NL80211_BSS_BSSID] = { },
1490                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
1491                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
1492                 [NL80211_BSS_INFORMATION_ELEMENTS] = { },
1493                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
1494                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
1495                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
1496                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
1497                 [NL80211_BSS_BEACON_IES] = { },
1498         };
1499         struct scan_params *params = arg;
1500         int show = params->show_both_ie_sets ? 2 : 1;
1501         bool is_dmg = false;
1502
1503         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1504                   genlmsg_attrlen(gnlh, 0), NULL);
1505
1506         if (!tb[NL80211_ATTR_BSS]) {
1507                 fprintf(stderr, "bss info missing!\n");
1508                 return NL_SKIP;
1509         }
1510         if (nla_parse_nested(bss, NL80211_BSS_MAX,
1511                              tb[NL80211_ATTR_BSS],
1512                              bss_policy)) {
1513                 fprintf(stderr, "failed to parse nested attributes!\n");
1514                 return NL_SKIP;
1515         }
1516
1517         if (!bss[NL80211_BSS_BSSID])
1518                 return NL_SKIP;
1519
1520         mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
1521         printf("BSS %s", mac_addr);
1522         if (tb[NL80211_ATTR_IFINDEX]) {
1523                 if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
1524                 printf("(on %s)", dev);
1525         }
1526
1527         if (bss[NL80211_BSS_STATUS]) {
1528                 switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
1529                 case NL80211_BSS_STATUS_AUTHENTICATED:
1530                         printf(" -- authenticated");
1531                         break;
1532                 case NL80211_BSS_STATUS_ASSOCIATED:
1533                         printf(" -- associated");
1534                         break;
1535                 case NL80211_BSS_STATUS_IBSS_JOINED:
1536                         printf(" -- joined");
1537                         break;
1538                 default:
1539                         printf(" -- unknown status: %d",
1540                                 nla_get_u32(bss[NL80211_BSS_STATUS]));
1541                         break;
1542                 }
1543         }
1544         printf("\n");
1545
1546         if (bss[NL80211_BSS_TSF]) {
1547                 unsigned long long tsf;
1548                 tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
1549                 printf("\tTSF: %llu usec (%llud, %.2lld:%.2llu:%.2llu)\n",
1550                         tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
1551                         (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
1552         }
1553         if (bss[NL80211_BSS_FREQUENCY]) {
1554                 int freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
1555                 printf("\tfreq: %d\n", freq);
1556                 if (freq > 45000)
1557                         is_dmg = true;
1558         }
1559         if (bss[NL80211_BSS_BEACON_INTERVAL])
1560                 printf("\tbeacon interval: %d TUs\n",
1561                         nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
1562         if (bss[NL80211_BSS_CAPABILITY]) {
1563                 __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1564                 printf("\tcapability:");
1565                 if (is_dmg)
1566                         print_capa_dmg(capa);
1567                 else
1568                         print_capa_non_dmg(capa);
1569                 printf(" (0x%.4x)\n", capa);
1570         }
1571         if (bss[NL80211_BSS_SIGNAL_MBM]) {
1572                 int s = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
1573                 printf("\tsignal: %d.%.2d dBm\n", s/100, s%100);
1574         }
1575         if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
1576                 unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
1577                 printf("\tsignal: %d/100\n", s);
1578         }
1579         if (bss[NL80211_BSS_SEEN_MS_AGO]) {
1580                 int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
1581                 printf("\tlast seen: %d ms ago\n", age);
1582         }
1583
1584         if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) {
1585                 if (bss[NL80211_BSS_BEACON_IES])
1586                         printf("\tInformation elements from Probe Response "
1587                                "frame:\n");
1588                 print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1589                           nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
1590                           params->unknown, params->type);
1591         }
1592         if (bss[NL80211_BSS_BEACON_IES] && show--) {
1593                 printf("\tInformation elements from Beacon frame:\n");
1594                 print_ies(nla_data(bss[NL80211_BSS_BEACON_IES]),
1595                           nla_len(bss[NL80211_BSS_BEACON_IES]),
1596                           params->unknown, params->type);
1597         }
1598
1599         return NL_SKIP;
1600 }
1601
1602 static struct scan_params scan_params;
1603
1604 static int handle_scan_dump(struct nl80211_state *state,
1605                             struct nl_cb *cb,
1606                             struct nl_msg *msg,
1607                             int argc, char **argv,
1608                             enum id_input id)
1609 {
1610         if (argc > 1)
1611                 return 1;
1612
1613         memset(&scan_params, 0, sizeof(scan_params));
1614
1615         if (argc == 1 && !strcmp(argv[0], "-u"))
1616                 scan_params.unknown = true;
1617         else if (argc == 1 && !strcmp(argv[0], "-b"))
1618                 scan_params.show_both_ie_sets = true;
1619
1620         scan_params.type = PRINT_SCAN;
1621
1622         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
1623                   &scan_params);
1624         return 0;
1625 }
1626
1627 static int handle_scan_combined(struct nl80211_state *state,
1628                                 struct nl_cb *cb,
1629                                 struct nl_msg *msg,
1630                                 int argc, char **argv,
1631                                 enum id_input id)
1632 {
1633         char **trig_argv;
1634         static char *dump_argv[] = {
1635                 NULL,
1636                 "scan",
1637                 "dump",
1638                 NULL,
1639         };
1640         static const __u32 cmds[] = {
1641                 NL80211_CMD_NEW_SCAN_RESULTS,
1642                 NL80211_CMD_SCAN_ABORTED,
1643         };
1644         int trig_argc, dump_argc, err;
1645
1646         if (argc >= 3 && !strcmp(argv[2], "-u")) {
1647                 dump_argc = 4;
1648                 dump_argv[3] = "-u";
1649         } else if (argc >= 3 && !strcmp(argv[2], "-b")) {
1650                 dump_argc = 4;
1651                 dump_argv[3] = "-b";
1652         } else
1653                 dump_argc = 3;
1654
1655         trig_argc = 3 + (argc - 2) + (3 - dump_argc);
1656         trig_argv = calloc(trig_argc, sizeof(*trig_argv));
1657         if (!trig_argv)
1658                 return -ENOMEM;
1659         trig_argv[0] = argv[0];
1660         trig_argv[1] = "scan";
1661         trig_argv[2] = "trigger";
1662         int i;
1663         for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
1664                 trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
1665         err = handle_cmd(state, id, trig_argc, trig_argv);
1666         free(trig_argv);
1667         if (err)
1668                 return err;
1669
1670         /*
1671          * WARNING: DO NOT COPY THIS CODE INTO YOUR APPLICATION
1672          *
1673          * This code has a bug, which requires creating a separate
1674          * nl80211 socket to fix:
1675          * It is possible for a NL80211_CMD_NEW_SCAN_RESULTS or
1676          * NL80211_CMD_SCAN_ABORTED message to be sent by the kernel
1677          * before (!) we listen to it, because we only start listening
1678          * after we send our scan request.
1679          *
1680          * Doing it the other way around has a race condition as well,
1681          * if you first open the events socket you may get a notification
1682          * for a previous scan.
1683          *
1684          * The only proper way to fix this would be to listen to events
1685          * before sending the command, and for the kernel to send the
1686          * scan request along with the event, so that you can match up
1687          * whether the scan you requested was finished or aborted (this
1688          * may result in processing a scan that another application
1689          * requested, but that doesn't seem to be a problem).
1690          *
1691          * Alas, the kernel doesn't do that (yet).
1692          */
1693
1694         if (listen_events(state, ARRAY_SIZE(cmds), cmds) ==
1695                                         NL80211_CMD_SCAN_ABORTED) {
1696                 printf("scan aborted!\n");
1697                 return 0;
1698         }
1699
1700         dump_argv[0] = argv[0];
1701         return handle_cmd(state, id, dump_argc, dump_argv);
1702 }
1703 TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [meshid <meshid>] [lowpri,flush,ap-force] [ssid <ssid>*|passive]", 0, 0,
1704          CIB_NETDEV, handle_scan_combined,
1705          "Scan on the given frequencies and probe for the given SSIDs\n"
1706          "(or wildcard if not given) unless passive scanning is requested.\n"
1707          "If -u is specified print unknown data in the scan results.\n"
1708          "Specified (vendor) IEs must be well-formed.");
1709 COMMAND(scan, dump, "[-u]",
1710         NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
1711         "Dump the current scan results. If -u is specified, print unknown\n"
1712         "data in scan results.");
1713 COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [meshid <meshid>] [lowpri,flush,ap-force] [ssid <ssid>*|passive]",
1714         NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
1715          "Trigger a scan on the given frequencies with probing for the given\n"
1716          "SSIDs (or wildcard if not given) unless passive scanning is requested.");