#define WLAN_CAPABILITY_APSD (1<<11)
#define WLAN_CAPABILITY_DSSS_OFDM (1<<13)
-static unsigned char wifi_oui[3] = { 0x00, 0x50, 0xf2 };
-static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };
+static unsigned char ms_oui[3] = { 0x00, 0x50, 0xf2 };
+static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };
+static unsigned char wfa_oui[3] = { 0x50, 0x6f, 0x9a };
struct scan_params {
bool unknown;
#define IEEE80211_COUNTRY_EXTENSION_ID 201
-struct ieee80211_country_ie_triplet {
- union {
- struct {
- __u8 first_channel;
- __u8 num_channels;
- __s8 max_power;
- } __attribute__ ((packed)) chans;
- struct {
- __u8 reg_extension_id;
- __u8 reg_class;
- __u8 coverage_class;
- } __attribute__ ((packed)) ext;
- };
+union ieee80211_country_ie_triplet {
+ struct {
+ __u8 first_channel;
+ __u8 num_channels;
+ __s8 max_power;
+ } __attribute__ ((packed)) chans;
+ struct {
+ __u8 reg_extension_id;
+ __u8 reg_class;
+ __u8 coverage_class;
+ } __attribute__ ((packed)) ext;
} __attribute__ ((packed));
static int handle_scan(struct nl80211_state *state,
struct nl_cb *cb,
struct nl_msg *msg,
- int argc, char **argv)
+ int argc, char **argv,
+ enum id_input id)
{
struct nl_msg *ssids = NULL, *freqs = NULL;
char *eptr;
enum {
NONE,
FREQ,
+ IES,
SSID,
DONE,
} parse = NONE;
int freq;
bool passive = false, have_ssids = false, have_freqs = false;
+ size_t tmp;
+ unsigned char *ies;
ssids = nlmsg_alloc();
if (!ssids)
}
for (i = 0; i < argc; i++) {
- if (parse == NONE && strcmp(argv[i], "freq") == 0) {
- parse = FREQ;
- have_freqs = true;
- continue;
- } else if (parse < SSID && strcmp(argv[i], "ssid") == 0) {
- parse = SSID;
- have_ssids = true;
- continue;
- } else if (parse < SSID && strcmp(argv[i], "passive") == 0) {
- parse = DONE;
- passive = true;
- continue;
- }
-
switch (parse) {
case NONE:
+ if (strcmp(argv[i], "freq") == 0) {
+ parse = FREQ;
+ have_freqs = true;
+ break;
+ } else if (strcmp(argv[i], "ies") == 0) {
+ parse = IES;
+ break;
+ } else if (strcmp(argv[i], "ssid") == 0) {
+ parse = SSID;
+ have_ssids = true;
+ break;
+ } else if (strcmp(argv[i], "passive") == 0) {
+ parse = DONE;
+ passive = true;
+ break;
+ }
case DONE:
return 1;
case FREQ:
freq = strtoul(argv[i], &eptr, 10);
- if (eptr != argv[i] + strlen(argv[i]))
- return 1;
+ if (eptr != argv[i] + strlen(argv[i])) {
+ /* failed to parse as number -- maybe a tag? */
+ i--;
+ parse = NONE;
+ continue;
+ }
NLA_PUT_U32(freqs, i, freq);
break;
+ case IES:
+ ies = parse_hex(argv[i], &tmp);
+ if (!ies)
+ goto nla_put_failure;
+ NLA_PUT(msg, NL80211_ATTR_IE, tmp, ies);
+ free(ies);
+ parse = NONE;
+ break;
case SSID:
NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
break;
printf("\n");
}
+#define BSS_MEMBERSHIP_SELECTOR_HT_PHY 127
+
static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
{
int i;
for (i = 0; i < len; i++) {
int r = data[i] & 0x7f;
- printf("%d.%d%s ", r/2, 5*(r&1), data[i] & 0x80 ? "*":"");
+
+ if (r == BSS_MEMBERSHIP_SELECTOR_HT_PHY && data[i] & 0x80)
+ printf("HT");
+ else
+ printf("%d.%d", r/2, 5*(r&1));
+
+ printf("%s ", data[i] & 0x80 ? "*" : "");
}
printf("\n");
}
while (len >= 3) {
int end_channel;
- struct ieee80211_country_ie_triplet *triplet =
- (struct ieee80211_country_ie_triplet *) data;
+ union ieee80211_country_ie_triplet *triplet = (void *) data;
if (triplet->ext.reg_extension_id >= IEEE80211_COUNTRY_EXTENSION_ID) {
printf("\t\tExtension ID: %d Regulatory Class: %d Coverage class: %d (up to %dm)\n",
else
end_channel = triplet->chans.first_channel + (4 * (triplet->chans.num_channels - 1));
- printf("\t\tChannels [%d - %d]\n", triplet->chans.first_channel, end_channel);
+ printf("\t\tChannels [%d - %d] @ %d dBm\n", triplet->chans.first_channel, end_channel, triplet->chans.max_power);
data += 3;
len -= 3;
static void print_cipher(const uint8_t *data)
{
- if (memcmp(data, wifi_oui, 3) == 0) {
+ if (memcmp(data, ms_oui, 3) == 0) {
switch (data[3]) {
case 0:
printf("Use group cipher suite");
case 6:
printf("AES-128-CMAC");
break;
+ case 8:
+ printf("GCMP");
+ break;
default:
printf("%.02x-%.02x-%.02x:%d",
data[0], data[1] ,data[2], data[3]);
static void print_auth(const uint8_t *data)
{
- if (memcmp(data, wifi_oui, 3) == 0) {
+ if (memcmp(data, ms_oui, 3) == 0) {
switch (data[3]) {
case 1:
printf("IEEE 802.1X");
len -= 2;
}
+ if (len >= 2) {
+ int pmkid_count = data[0] | (data[1] << 8);
+
+ if (len >= 2 + 16 * pmkid_count) {
+ tab_on_first(&first);
+ printf("\t * %d PMKIDs\n", pmkid_count);
+ /* not printing PMKID values */
+ data += 2 + 16 * pmkid_count;
+ len -= 2 + 16 * pmkid_count;
+ } else
+ goto invalid;
+ }
+
+ if (len >= 4) {
+ tab_on_first(&first);
+ printf("\t * Group mgmt cipher suite: ");
+ print_cipher(data);
+ printf("\n");
+ data += 4;
+ len -= 4;
+ }
+
invalid:
if (len != 0) {
printf("\t\t * bogus tail data (%d):", len);
static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
{
- if (len != 26) {
- printf("\n\t\tHT Capability IE len != expected 26 bytes, skipping parse\n");
- return;
- }
printf("\n");
print_ht_capability(data[0] | (data[1] << 8));
print_ampdu_length(data[2] & 3);
- print_ampdu_spacing((data[2] >> 2) & 3);
+ print_ampdu_spacing((data[2] >> 2) & 7);
print_ht_mcs(data + 3);
}
+static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+ static const char *offset[4] = {
+ "no secondary",
+ "above",
+ "[reserved!]",
+ "below",
+ };
+ static const char *protection[4] = {
+ "no",
+ "nonmember",
+ "20 MHz",
+ "non-HT mixed",
+ };
+ static const char *sta_chan_width[2] = {
+ "20 MHz",
+ "any",
+ };
+
+ printf("\n");
+ printf("\t\t * primary channel: %d\n", data[0]);
+ printf("\t\t * secondary channel offset: %s\n",
+ offset[data[1] & 0x3]);
+ printf("\t\t * STA channel width: %s\n", sta_chan_width[(data[1] & 0x4)>>2]);
+ printf("\t\t * RIFS: %d\n", (data[1] & 0x8)>>3);
+ printf("\t\t * HT protection: %s\n", protection[data[2] & 0x3]);
+ printf("\t\t * non-GF present: %d\n", (data[2] & 0x4) >> 2);
+ printf("\t\t * OBSS non-GF present: %d\n", (data[2] & 0x10) >> 4);
+ printf("\t\t * dual beacon: %d\n", (data[4] & 0x40) >> 6);
+ printf("\t\t * dual CTS protection: %d\n", (data[4] & 0x80) >> 7);
+ printf("\t\t * STBC beacon: %d\n", data[5] & 0x1);
+ printf("\t\t * L-SIG TXOP Prot: %d\n", (data[5] & 0x2) >> 1);
+ printf("\t\t * PCO active: %d\n", (data[5] & 0x4) >> 2);
+ printf("\t\t * PCO phase: %d\n", (data[5] & 0x8) >> 3);
+}
+
static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
{
int i, base, bit;
[7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
[32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
[42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
- [45] = { "HT capabilities", print_ht_capa, 1, 255, BIT(PRINT_SCAN), },
+ [45] = { "HT capabilities", print_ht_capa, 26, 26, BIT(PRINT_SCAN), },
+ [61] = { "HT operation", print_ht_op, 22, 22, BIT(PRINT_SCAN), },
[48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
[50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
+ [114] = { "MESH ID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
[127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
};
for (i = 0; i < 4; i++) {
printf("\n\t\t * %s:", aci_tbl[(data[0] >> 5) & 3]);
- if (data[4] & 0x10)
+ if (data[0] & 0x10)
printf(" acm");
printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1,
(1 << (data[1] >> 4)) - 1);
printf("\n");
}
+static const char * wifi_wps_dev_passwd_id(uint16_t id)
+{
+ switch (id) {
+ case 0:
+ return "Default (PIN)";
+ case 1:
+ return "User-specified";
+ case 2:
+ return "Machine-specified";
+ case 3:
+ return "Rekey";
+ case 4:
+ return "PushButton";
+ case 5:
+ return "Registrar-specified";
+ default:
+ return "??";
+ }
+}
+
static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
{
bool first = true;
tab_on_first(&first);
printf("\t * Device name: %.*s\n", sublen, data + 4);
break;
+ case 0x1012: {
+ uint16_t id;
+ tab_on_first(&first);
+ if (sublen != 2) {
+ printf("\t * Device Password ID: (invalid "
+ "length %d)\n", sublen);
+ break;
+ }
+ id = data[4] << 8 | data[5];
+ printf("\t * Device Password ID: %u (%s)\n",
+ id, wifi_wps_dev_passwd_id(id));
+ break;
+ }
case 0x1021:
tab_on_first(&first);
printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
tab_on_first(&first);
printf("\t * Model: %.*s\n", sublen, data + 4);
break;
+ case 0x1024:
+ tab_on_first(&first);
+ printf("\t * Model Number: %.*s\n", sublen, data + 4);
+ break;
+ case 0x103b: {
+ __u8 val = data[4];
+ tab_on_first(&first);
+ printf("\t * Response Type: %d%s\n",
+ val, val == 3 ? " (AP)" : "");
+ break;
+ }
+ case 0x103c: {
+ __u8 val = data[4];
+ tab_on_first(&first);
+ printf("\t * RF Bands: 0x%x\n", val);
+ break;
+ }
+ case 0x1041: {
+ __u8 val = data[4];
+ tab_on_first(&first);
+ printf("\t * Selected Registrar: 0x%x\n", val);
+ break;
+ }
+ case 0x1042:
+ tab_on_first(&first);
+ printf("\t * Serial Number: %.*s\n", sublen, data + 4);
+ break;
+ case 0x1044: {
+ __u8 val = data[4];
+ tab_on_first(&first);
+ printf("\t * Wi-Fi Protected Setup State: %d%s%s\n",
+ val,
+ val == 1 ? " (Unconfigured)" : "",
+ val == 2 ? " (Configured)" : "");
+ break;
+ }
+ case 0x1047:
+ tab_on_first(&first);
+ printf("\t * UUID: ");
+ if (sublen != 16) {
+ printf("(invalid, length=%d)\n", sublen);
+ break;
+ }
+ printf("%02x%02x%02x%02x-%02x%02x-%02x%02x-"
+ "%02x%02x-%02x%02x%02x%02x%02x%02x\n",
+ data[4], data[5], data[6], data[7],
+ data[8], data[9], data[10], data[11],
+ data[12], data[13], data[14], data[15],
+ data[16], data[17], data[18], data[19]);
+ break;
+ case 0x1054: {
+ tab_on_first(&first);
+ if (sublen != 8) {
+ printf("\t * Primary Device Type: (invalid "
+ "length %d)\n", sublen);
+ break;
+ }
+ printf("\t * Primary Device Type: "
+ "%u-%02x%02x%02x%02x-%u\n",
+ data[4] << 8 | data[5],
+ data[6], data[7], data[8], data[9],
+ data[10] << 8 | data[11]);
+ break;
+ }
case 0x1057: {
__u8 val = data[4];
tab_on_first(&first);
printf("\t * AP setup locked: 0x%.2x\n", val);
break;
}
- case 0x1008: {
+ case 0x1008:
+ case 0x1053: {
__u16 meth = (data[4] << 8) + data[5];
bool comma = false;
tab_on_first(&first);
- printf("\t * Config methods:");
+ printf("\t * %sConfig methods:",
+ subtype == 0x1053 ? "Selected Registrar ": "");
#define T(bit, name) do { \
if (meth & (1<<bit)) { \
if (comma) \
[4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
};
+static inline void print_p2p(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+ bool first = true;
+ __u8 subtype;
+ __u16 sublen;
+
+ while (len >= 3) {
+ subtype = data[0];
+ sublen = (data[2] << 8) + data[1];
+
+ if (sublen > len - 3)
+ break;
+
+ switch (subtype) {
+ case 0x02: /* capability */
+ tab_on_first(&first);
+ if (sublen < 2) {
+ printf("\t * malformed capability\n");
+ break;
+ }
+ printf("\t * Group capa: 0x%.2x, Device capa: 0x%.2x\n",
+ data[3], data[4]);
+ break;
+ case 0x0d: /* device info */
+ if (sublen < 6 + 2 + 8 + 1) {
+ printf("\t * malformed device info\n");
+ break;
+ }
+ /* fall through for now */
+ case 0x00: /* status */
+ case 0x01: /* minor reason */
+ case 0x03: /* device ID */
+ case 0x04: /* GO intent */
+ case 0x05: /* configuration timeout */
+ case 0x06: /* listen channel */
+ case 0x07: /* group BSSID */
+ case 0x08: /* ext listen timing */
+ case 0x09: /* intended interface address */
+ case 0x0a: /* manageability */
+ case 0x0b: /* channel list */
+ case 0x0c: /* NoA */
+ case 0x0e: /* group info */
+ case 0x0f: /* group ID */
+ case 0x10: /* interface */
+ case 0x11: /* operating channel */
+ case 0x12: /* invitation flags */
+ case 0xdd: /* vendor specific */
+ default: {
+ const __u8 *subdata = data + 4;
+ __u16 tmplen = sublen;
+
+ tab_on_first(&first);
+ printf("\t * Unknown TLV (%#.2x, %d bytes):",
+ subtype, tmplen);
+ while (tmplen) {
+ printf(" %.2x", *subdata);
+ subdata++;
+ tmplen--;
+ }
+ printf("\n");
+ break;
+ }
+ }
+
+ data += sublen + 3;
+ len -= sublen + 3;
+ }
+
+ if (len != 0) {
+ tab_on_first(&first);
+ printf("\t * bogus tail data (%d):", len);
+ while (len) {
+ printf(" %.2x", *data);
+ data++;
+ len--;
+ }
+ printf("\n");
+ }
+}
+
+static const struct ie_print wfa_printers[] = {
+ [9] = { "P2P", print_p2p, 2, 255, BIT(PRINT_SCAN), },
+};
+
static void print_vendor(unsigned char len, unsigned char *data,
bool unknown, enum print_ie_type ptype)
{
return;
}
- if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) {
+ if (len >= 4 && memcmp(data, ms_oui, 3) == 0) {
if (data[3] < ARRAY_SIZE(wifiprinters) &&
wifiprinters[data[3]].name &&
wifiprinters[data[3]].flags & BIT(ptype)) {
}
if (!unknown)
return;
- printf("\tWiFi OUI %#.2x, data:", data[3]);
+ printf("\tMS/WiFi %#.2x, data:", data[3]);
+ for(i = 0; i < len - 4; i++)
+ printf(" %.02x", data[i + 4]);
+ printf("\n");
+ return;
+ }
+
+ if (len >= 4 && memcmp(data, wfa_oui, 3) == 0) {
+ if (data[3] < ARRAY_SIZE(wfa_printers) &&
+ wfa_printers[data[3]].name &&
+ wfa_printers[data[3]].flags & BIT(ptype)) {
+ print_ie(&wfa_printers[data[3]], data[3], len - 4, data + 4);
+ return;
+ }
+ if (!unknown)
+ return;
+ printf("\tWFA %#.2x, data:", data[3]);
for(i = 0; i < len - 4; i++)
printf(" %.02x", data[i + 4]);
printf("\n");
int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
printf("\tlast seen: %d ms ago\n", age);
}
-
+
if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) {
if (bss[NL80211_BSS_BEACON_IES])
printf("\tInformation elements from Probe Response "
static int handle_scan_dump(struct nl80211_state *state,
struct nl_cb *cb,
struct nl_msg *msg,
- int argc, char **argv)
+ int argc, char **argv,
+ enum id_input id)
{
if (argc > 1)
return 1;
static int handle_scan_combined(struct nl80211_state *state,
struct nl_cb *cb,
struct nl_msg *msg,
- int argc, char **argv)
+ int argc, char **argv,
+ enum id_input id)
{
char **trig_argv;
static char *dump_argv[] = {
int i;
for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
- err = handle_cmd(state, II_NETDEV, trig_argc, trig_argv);
+ err = handle_cmd(state, id, trig_argc, trig_argv);
free(trig_argv);
if (err)
return err;
}
dump_argv[0] = argv[0];
- return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
+ return handle_cmd(state, id, dump_argc, dump_argv);
}
-TOPLEVEL(scan, "[-u] [freq <freq>*] [ssid <ssid>*|passive]", 0, 0,
+TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]", 0, 0,
CIB_NETDEV, handle_scan_combined,
"Scan on the given frequencies and probe for the given SSIDs\n"
"(or wildcard if not given) unless passive scanning is requested.\n"
- "If -u is specified print unknown data in the scan results.");
+ "If -u is specified print unknown data in the scan results.\n"
+ "Specified (vendor) IEs must be well-formed.");
COMMAND(scan, dump, "[-u]",
NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
"Dump the current scan results. If -u is specified, print unknown\n"
"data in scan results.");
-COMMAND(scan, trigger, "[freq <freq>*] [ssid <ssid>*|passive]",
+COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]",
NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
"Trigger a scan on the given frequencies with probing for the given\n"
"SSIDs (or wildcard if not given) unless passive scanning is requested.");