]> git.ipfire.org Git - thirdparty/iw.git/blobdiff - scan.c
iw: nan: Handle NAN Events
[thirdparty/iw.git] / scan.c
diff --git a/scan.c b/scan.c
index be9eaff482a5af9f018cb221e280759f790f13c8..ca7dbc6d36c95194de99ce0e74038dd494393b18 100644 (file)
--- a/scan.c
+++ b/scan.c
@@ -1,7 +1,6 @@
 #include <net/if.h>
 #include <errno.h>
 #include <string.h>
-#include <ctype.h>
 #include <stdbool.h>
 
 #include <netlink/genl/genl.h>
 #define WLAN_CAPABILITY_QOS            (1<<9)
 #define WLAN_CAPABILITY_SHORT_SLOT_TIME        (1<<10)
 #define WLAN_CAPABILITY_APSD           (1<<11)
+#define WLAN_CAPABILITY_RADIO_MEASURE  (1<<12)
 #define WLAN_CAPABILITY_DSSS_OFDM      (1<<13)
+#define WLAN_CAPABILITY_DEL_BACK       (1<<14)
+#define WLAN_CAPABILITY_IMM_BACK       (1<<15)
+/* DMG (60gHz) 802.11ad */
+/* type - bits 0..1 */
+#define WLAN_CAPABILITY_DMG_TYPE_MASK          (3<<0)
+
+#define WLAN_CAPABILITY_DMG_TYPE_IBSS          (1<<0) /* Tx by: STA */
+#define WLAN_CAPABILITY_DMG_TYPE_PBSS          (2<<0) /* Tx by: PCP */
+#define WLAN_CAPABILITY_DMG_TYPE_AP            (3<<0) /* Tx by: AP */
+
+#define WLAN_CAPABILITY_DMG_CBAP_ONLY          (1<<2)
+#define WLAN_CAPABILITY_DMG_CBAP_SOURCE                (1<<3)
+#define WLAN_CAPABILITY_DMG_PRIVACY            (1<<4)
+#define WLAN_CAPABILITY_DMG_ECPAC              (1<<5)
+
+#define WLAN_CAPABILITY_DMG_SPECTRUM_MGMT      (1<<8)
+#define WLAN_CAPABILITY_DMG_RADIO_MEASURE      (1<<12)
 
 static unsigned char ms_oui[3]         = { 0x00, 0x50, 0xf2 };
 static unsigned char ieee80211_oui[3]  = { 0x00, 0x0f, 0xac };
@@ -52,8 +69,334 @@ union ieee80211_country_ie_triplet {
        } __attribute__ ((packed)) ext;
 } __attribute__ ((packed));
 
+static int parse_random_mac_addr(struct nl_msg *msg, char *arg)
+{
+       char *a_addr, *a_mask, *sep;
+       unsigned char addr[ETH_ALEN], mask[ETH_ALEN];
+       char *addrs = arg + 9;
+
+       if (*addrs != '=')
+               return 0;
+
+       addrs++;
+       sep = strchr(addrs, '/');
+       a_addr = addrs;
+
+       if (!sep)
+               return 1;
+
+       *sep = 0;
+       a_mask = sep + 1;
+       if (mac_addr_a2n(addr, a_addr) || mac_addr_a2n(mask, a_mask))
+               return 1;
+
+       NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+       NLA_PUT(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, mask);
+
+       return 0;
+ nla_put_failure:
+       return -ENOBUFS;
+}
+
+int parse_sched_scan(struct nl_msg *msg, int *argc, char ***argv)
+{
+       struct nl_msg *matchset = NULL, *freqs = NULL, *ssids = NULL;
+       struct nl_msg *scan_plans = NULL;
+       struct nlattr *match = NULL, *plan = NULL;
+       enum {
+               ND_TOPLEVEL,
+               ND_MATCH,
+               ND_FREQS,
+               ND_ACTIVE,
+               ND_PLANS,
+       } parse_state = ND_TOPLEVEL;
+       int c  = *argc;
+       char *end, **v = *argv;
+       int err = 0, i = 0;
+       unsigned int freq, interval = 0, delay = 0, iterations = 0;
+       bool have_matchset = false, have_freqs = false, have_ssids = false;
+       bool have_active = false, have_passive = false, have_plans = false;
+       uint32_t flags = 0;
+
+       matchset = nlmsg_alloc();
+       if (!matchset) {
+               err = -ENOBUFS;
+               goto out;
+       }
+
+       freqs = nlmsg_alloc();
+       if (!freqs) {
+               err = -ENOBUFS;
+               goto out;
+       }
+
+       ssids = nlmsg_alloc();
+       if (!ssids) {
+               err = -ENOMEM;
+               goto out;
+       }
+
+       scan_plans = nlmsg_alloc();
+       if (!scan_plans) {
+               err = -ENOBUFS;
+               goto out;
+       }
+
+       while (c) {
+               switch (parse_state) {
+               case ND_TOPLEVEL:
+                       if (!strcmp(v[0], "interval")) {
+                               c--; v++;
+                               if (c == 0) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               if (interval || have_plans) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+                               interval = strtoul(v[0], &end, 10);
+                               if (*end || !interval) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+                               NLA_PUT_U32(msg,
+                                           NL80211_ATTR_SCHED_SCAN_INTERVAL,
+                                           interval);
+                       } else if (!strcmp(v[0], "scan_plans")) {
+                               parse_state = ND_PLANS;
+                               if (have_plans || interval) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               have_plans = true;
+                               i = 0;
+                       } else if (!strcmp(v[0], "delay")) {
+                               c--; v++;
+                               if (c == 0) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               if (delay) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+                               delay = strtoul(v[0], &end, 10);
+                               if (*end) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+                               NLA_PUT_U32(msg,
+                                           NL80211_ATTR_SCHED_SCAN_DELAY,
+                                           delay);
+                       } else if (!strcmp(v[0], "matches")) {
+                               parse_state = ND_MATCH;
+                               if (have_matchset) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               i = 0;
+                       } else if (!strcmp(v[0], "freqs")) {
+                               parse_state = ND_FREQS;
+                               if (have_freqs) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               have_freqs = true;
+                               i = 0;
+                       } else if (!strcmp(v[0], "active")) {
+                               parse_state = ND_ACTIVE;
+                               if (have_active || have_passive) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               have_active = true;
+                               i = 0;
+                       } else if (!strcmp(v[0], "passive")) {
+                               if (have_active || have_passive) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               have_passive = true;
+                       } else if (!strncmp(v[0], "randomise", 9) ||
+                                  !strncmp(v[0], "randomize", 9)) {
+                               flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
+                               if (c > 0) {
+                                       err = parse_random_mac_addr(msg, v[0]);
+                                       if (err)
+                                               goto nla_put_failure;
+                               }
+                       } else {
+                               /* this element is not for us, so
+                                * return to continue parsing.
+                                */
+                               goto nla_put_failure;
+                       }
+                       c--; v++;
+
+                       break;
+               case ND_MATCH:
+                       if (!strcmp(v[0], "ssid")) {
+                               c--; v++;
+                               if (c == 0) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               /* TODO: for now we can only have an
+                                * SSID in the match, so we can start
+                                * the match nest here.
+                                */
+                               match = nla_nest_start(matchset, i);
+                               if (!match) {
+                                       err = -ENOBUFS;
+                                       goto nla_put_failure;
+                               }
+
+                               NLA_PUT(matchset,
+                                       NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
+                                       strlen(v[0]), v[0]);
+                               nla_nest_end(matchset, match);
+                               match = NULL;
+
+                               have_matchset = true;
+                               i++;
+                               c--; v++;
+                       } else {
+                               /* other element that cannot be part
+                                * of a match indicates the end of the
+                                * match. */
+                               /* need at least one match in the matchset */
+                               if (i == 0) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               parse_state = ND_TOPLEVEL;
+                       }
+
+                       break;
+               case ND_FREQS:
+                       freq = strtoul(v[0], &end, 10);
+                       if (*end) {
+                               if (i == 0) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               parse_state = ND_TOPLEVEL;
+                       } else {
+                               NLA_PUT_U32(freqs, i, freq);
+                               i++;
+                               c--; v++;
+                       }
+                       break;
+               case ND_ACTIVE:
+                       if (!strcmp(v[0], "ssid")) {
+                               c--; v++;
+                               if (c == 0) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               NLA_PUT(ssids,
+                                       NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
+                                       strlen(v[0]), v[0]);
+
+                               have_ssids = true;
+                               i++;
+                               c--; v++;
+                       } else {
+                               /* other element that cannot be part
+                                * of a match indicates the end of the
+                                * active set. */
+                               /* need at least one item in the set */
+                               if (i == 0) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               parse_state = ND_TOPLEVEL;
+                       }
+                       break;
+               case ND_PLANS:
+                       iterations = 0;
+                       interval = strtoul(v[0], &end, 10);
+                       if (*end) {
+                               char *iter;
+
+                               if (*end != ':') {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+
+                               iter = ++end;
+                               iterations = strtoul(iter, &end, 10);
+                               if (*end || !iterations) {
+                                       err = -EINVAL;
+                                       goto nla_put_failure;
+                               }
+                       }
+
+                       plan = nla_nest_start(scan_plans, i + 1);
+                       if (!plan) {
+                               err = -ENOBUFS;
+                               goto nla_put_failure;
+                       }
+
+                       NLA_PUT_U32(scan_plans,
+                                   NL80211_SCHED_SCAN_PLAN_INTERVAL,
+                                   interval);
+
+                       if (iterations)
+                               NLA_PUT_U32(scan_plans,
+                                           NL80211_SCHED_SCAN_PLAN_ITERATIONS,
+                                           iterations);
+                       else
+                               parse_state = ND_TOPLEVEL;
+
+                       nla_nest_end(scan_plans, plan);
+                       plan = NULL;
+                       i++;
+                       c--; v++;
+                       break;
+               }
+       }
+
+       if (!have_ssids)
+               NLA_PUT(ssids, 1, 0, "");
+       if (!have_passive)
+               nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
+       if (have_freqs)
+               nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
+       if (have_matchset)
+               nla_put_nested(msg, NL80211_ATTR_SCHED_SCAN_MATCH, matchset);
+       if (have_plans)
+               nla_put_nested(msg, NL80211_ATTR_SCHED_SCAN_PLANS, scan_plans);
+       if (flags)
+               NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS, flags);
+
+nla_put_failure:
+       if (match)
+               nla_nest_end(msg, match);
+       nlmsg_free(freqs);
+       nlmsg_free(matchset);
+       nlmsg_free(scan_plans);
+
+out:
+       *argc = c;
+       *argv = v;
+       return err;
+}
+
 static int handle_scan(struct nl80211_state *state,
-                      struct nl_cb *cb,
                       struct nl_msg *msg,
                       int argc, char **argv,
                       enum id_input id)
@@ -67,12 +410,17 @@ static int handle_scan(struct nl80211_state *state,
                FREQ,
                IES,
                SSID,
+               MESHID,
+               DURATION,
                DONE,
        } parse = NONE;
        int freq;
+       unsigned int duration = 0;
        bool passive = false, have_ssids = false, have_freqs = false;
-       size_t tmp;
-       unsigned char *ies;
+       bool duration_mandatory = false;
+       size_t ies_len = 0, meshid_len = 0;
+       unsigned char *ies = NULL, *meshid = NULL, *tmpies;
+       unsigned int flags = 0;
 
        ssids = nlmsg_alloc();
        if (!ssids)
@@ -94,6 +442,25 @@ static int handle_scan(struct nl80211_state *state,
                        } else if (strcmp(argv[i], "ies") == 0) {
                                parse = IES;
                                break;
+                       } else if (strcmp(argv[i], "lowpri") == 0) {
+                               flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
+                               break;
+                       } else if (strcmp(argv[i], "flush") == 0) {
+                               flags |= NL80211_SCAN_FLAG_FLUSH;
+                               break;
+                       } else if (strcmp(argv[i], "ap-force") == 0) {
+                               flags |= NL80211_SCAN_FLAG_AP;
+                               break;
+                       } else if (strcmp(argv[i], "duration-mandatory") == 0) {
+                               duration_mandatory = true;
+                               break;
+                       } else if (strncmp(argv[i], "randomise", 9) == 0 ||
+                                  strncmp(argv[i], "randomize", 9) == 0) {
+                               flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
+                               err = parse_random_mac_addr(msg, argv[i]);
+                               if (err)
+                                       goto nla_put_failure;
+                               break;
                        } else if (strcmp(argv[i], "ssid") == 0) {
                                parse = SSID;
                                have_ssids = true;
@@ -102,8 +469,17 @@ static int handle_scan(struct nl80211_state *state,
                                parse = DONE;
                                passive = true;
                                break;
+                       } else if (strcmp(argv[i], "meshid") == 0) {
+                               parse = MESHID;
+                               break;
+                       } else if (strcmp(argv[i], "duration") == 0) {
+                               parse = DURATION;
+                               break;
                        }
+                       /* fall through - this is an error */
                case DONE:
+                       nlmsg_free(ssids);
+                       nlmsg_free(freqs);
                        return 1;
                case FREQ:
                        freq = strtoul(argv[i], &eptr, 10);
@@ -116,19 +492,54 @@ static int handle_scan(struct nl80211_state *state,
                        NLA_PUT_U32(freqs, i, freq);
                        break;
                case IES:
-                       ies = parse_hex(argv[i], &tmp);
+                       ies = parse_hex(argv[i], &ies_len);
                        if (!ies)
                                goto nla_put_failure;
-                       NLA_PUT(msg, NL80211_ATTR_IE, tmp, ies);
-                       free(ies);
                        parse = NONE;
                        break;
                case SSID:
                        NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
                        break;
+               case MESHID:
+                       meshid_len = strlen(argv[i]);
+                       meshid = (unsigned char *) malloc(meshid_len + 2);
+                       if (!meshid)
+                               goto nla_put_failure;
+                       meshid[0] = 114; /* mesh element id */
+                       meshid[1] = meshid_len;
+                       memcpy(&meshid[2], argv[i], meshid_len);
+                       meshid_len += 2;
+                       parse = NONE;
+                       break;
+               case DURATION:
+                       duration = strtoul(argv[i], &eptr, 10);
+                       parse = NONE;
+                       break;
                }
        }
 
+       if (ies || meshid) {
+               tmpies = (unsigned char *) malloc(ies_len + meshid_len);
+               if (!tmpies) {
+                       free(ies);
+                       free(meshid);
+                       goto nla_put_failure;
+               }
+               if (ies) {
+                       memcpy(tmpies, ies, ies_len);
+                       free(ies);
+               }
+               if (meshid) {
+                       memcpy(&tmpies[ies_len], meshid, meshid_len);
+                       free(meshid);
+               }
+               if (nla_put(msg, NL80211_ATTR_IE, ies_len + meshid_len, tmpies) < 0) {
+                       free(tmpies);
+                       goto nla_put_failure;
+               }
+               free(tmpies);
+       }
+
        if (!have_ssids)
                NLA_PUT(ssids, 1, 0, "");
        if (!passive)
@@ -136,6 +547,19 @@ static int handle_scan(struct nl80211_state *state,
 
        if (have_freqs)
                nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
+       if (flags)
+               NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS, flags);
+       if (duration)
+               NLA_PUT_U16(msg, NL80211_ATTR_MEASUREMENT_DURATION, duration);
+       if (duration_mandatory) {
+               if (duration) {
+                       NLA_PUT_FLAG(msg,
+                                    NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY);
+               } else {
+                       err = -EINVAL;
+                       goto nla_put_failure;
+               }
+       }
 
        err = 0;
  nla_put_failure:
@@ -152,16 +576,25 @@ static void tab_on_first(bool *first)
                *first = false;
 }
 
-static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
+struct print_ies_data {
+       unsigned char *ie;
+       int ielen;
+};
+
+static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data,
+                      const struct print_ies_data *ie_buffer)
 {
        printf(" ");
        print_ssid_escaped(len, data);
        printf("\n");
 }
 
+#define BSS_MEMBERSHIP_SELECTOR_VHT_PHY 126
 #define BSS_MEMBERSHIP_SELECTOR_HT_PHY 127
 
-static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_supprates(const uint8_t type, uint8_t len,
+                           const uint8_t *data,
+                           const struct print_ies_data *ie_buffer)
 {
        int i;
 
@@ -170,7 +603,9 @@ static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data
        for (i = 0; i < len; i++) {
                int r = data[i] & 0x7f;
 
-               if (r == BSS_MEMBERSHIP_SELECTOR_HT_PHY && data[i] & 0x80)
+               if (r == BSS_MEMBERSHIP_SELECTOR_VHT_PHY && data[i] & 0x80)
+                       printf("VHT");
+               else if (r == BSS_MEMBERSHIP_SELECTOR_HT_PHY && data[i] & 0x80)
                        printf("HT");
                else
                        printf("%d.%d", r/2, 5*(r&1));
@@ -180,7 +615,8 @@ static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data
        printf("\n");
 }
 
-static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data,
+                    const struct print_ies_data *ie_buffer)
 {
        printf(" channel %d\n", data[0]);
 }
@@ -199,7 +635,8 @@ static const char *country_env_str(char environment)
        }
 }
 
-static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_country(const uint8_t type, uint8_t len, const uint8_t *data,
+                         const struct print_ies_data *ie_buffer)
 {
        printf(" %.*s", 2, data);
 
@@ -244,12 +681,23 @@ static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
        return;
 }
 
-static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_powerconstraint(const uint8_t type, uint8_t len,
+                                 const uint8_t *data,
+                                 const struct print_ies_data *ie_buffer)
 {
        printf(" %d dB\n", data[0]);
 }
 
-static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_tpcreport(const uint8_t type, uint8_t len,
+                           const uint8_t *data,
+                           const struct print_ies_data *ie_buffer)
+{
+       printf(" TX power: %d dBm\n", data[0]);
+       /* printf(" Link Margin (%d dB) is reserved in Beacons\n", data[1]); */
+}
+
+static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data,
+                     const struct print_ies_data *ie_buffer)
 {
        if (data[0] == 0x00)
                printf(" <no flags>");
@@ -306,6 +754,9 @@ static void print_cipher(const uint8_t *data)
                case 6:
                        printf("AES-128-CMAC");
                        break;
+               case 7:
+                       printf("NO-GROUP");
+                       break;
                case 8:
                        printf("GCMP");
                        break;
@@ -354,6 +805,52 @@ static void print_auth(const uint8_t *data)
                case 6:
                        printf("PSK/SHA-256");
                        break;
+               case 7:
+                       printf("TDLS/TPK");
+                       break;
+               case 8:
+                       printf("SAE");
+                       break;
+               case 9:
+                       printf("FT/SAE");
+                       break;
+               case 11:
+                       printf("IEEE 802.1X/SUITE-B");
+                       break;
+               case 12:
+                       printf("IEEE 802.1X/SUITE-B-192");
+                       break;
+               case 13:
+                       printf("FT/IEEE 802.1X/SHA-384");
+                       break;
+               case 14:
+                       printf("FILS/SHA-256");
+                       break;
+               case 15:
+                       printf("FILS/SHA-384");
+                       break;
+               case 16:
+                       printf("FT/FILS/SHA-256");
+                       break;
+               case 17:
+                       printf("FT/FILS/SHA-384");
+                       break;
+               case 18:
+                       printf("OWE");
+                       break;
+               default:
+                       printf("%.02x-%.02x-%.02x:%d",
+                               data[0], data[1] ,data[2], data[3]);
+                       break;
+               }
+       } else if (memcmp(data, wfa_oui, 3) == 0) {
+               switch (data[3]) {
+               case 1:
+                       printf("OSEN");
+                       break;
+               case 2:
+                       printf("DPP");
+                       break;
                default:
                        printf("%.02x-%.02x-%.02x:%d",
                                data[0], data[1] ,data[2], data[3]);
@@ -364,19 +861,22 @@ static void print_auth(const uint8_t *data)
                        data[0], data[1] ,data[2], data[3]);
 }
 
-static void print_rsn_ie(const char *defcipher, const char *defauth,
-                        uint8_t len, const uint8_t *data)
+static void _print_rsn_ie(const char *defcipher, const char *defauth,
+                         uint8_t len, const uint8_t *data, int is_osen)
 {
        bool first = true;
-       __u16 version, count, capa;
+       __u16 count, capa;
        int i;
 
-       version = data[0] + (data[1] << 8);
-       tab_on_first(&first);
-       printf("\t * Version: %d\n", version);
+       if (!is_osen) {
+               __u16 version;
+               version = data[0] + (data[1] << 8);
+               tab_on_first(&first);
+               printf("\t * Version: %d\n", version);
 
-       data += 2;
-       len -= 2;
+               data += 2;
+               len -= 2;
+       }
 
        if (len < 4) {
                tab_on_first(&first);
@@ -445,6 +945,7 @@ static void print_rsn_ie(const char *defcipher, const char *defauth,
                        printf(" NoPairwise");
                switch ((capa & 0x000c) >> 2) {
                case 0:
+                       printf(" 1-PTKSA-RC");
                        break;
                case 1:
                        printf(" 2-PTKSA-RC");
@@ -458,6 +959,7 @@ static void print_rsn_ie(const char *defcipher, const char *defauth,
                }
                switch ((capa & 0x0030) >> 4) {
                case 0:
+                       printf(" 1-GTKSA-RC");
                        break;
                case 1:
                        printf(" 2-GTKSA-RC");
@@ -518,12 +1020,27 @@ static void print_rsn_ie(const char *defcipher, const char *defauth,
        }
 }
 
-static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_rsn_ie(const char *defcipher, const char *defauth,
+                        uint8_t len, const uint8_t *data)
+{
+       _print_rsn_ie(defcipher, defauth, len, data, 0);
+}
+
+static void print_osen_ie(const char *defcipher, const char *defauth,
+                         uint8_t len, const uint8_t *data)
+{
+       printf("\n\t");
+       _print_rsn_ie(defcipher, defauth, len, data, 1);
+}
+
+static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data,
+                     const struct print_ies_data *ie_buffer)
 {
        print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 }
 
-static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data,
+                         const struct print_ies_data *ie_buffer)
 {
        printf("\n");
        print_ht_capability(data[0] | (data[1] << 8));
@@ -532,14 +1049,169 @@ static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
        print_ht_mcs(data + 3);
 }
 
-static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
+static const char* ntype_11u(uint8_t t)
+{
+       switch (t) {
+       case 0: return "Private";
+       case 1: return "Private with Guest";
+       case 2: return "Chargeable Public";
+       case 3: return "Free Public";
+       case 4: return "Personal Device";
+       case 5: return "Emergency Services Only";
+       case 14: return "Test or Experimental";
+       case 15: return "Wildcard";
+       default: return "Reserved";
+       }
+}
+
+static const char* vgroup_11u(uint8_t t)
+{
+       switch (t) {
+       case 0: return "Unspecified";
+       case 1: return "Assembly";
+       case 2: return "Business";
+       case 3: return "Educational";
+       case 4: return "Factory and Industrial";
+       case 5: return "Institutional";
+       case 6: return "Mercantile";
+       case 7: return "Residential";
+       case 8: return "Storage";
+       case 9: return "Utility and Miscellaneous";
+       case 10: return "Vehicular";
+       case 11: return "Outdoor";
+       default: return "Reserved";
+       }
+}
+
+static void print_interworking(const uint8_t type, uint8_t len,
+                              const uint8_t *data,
+                              const struct print_ies_data *ie_buffer)
+{
+       /* See Section 7.3.2.92 in the 802.11u spec. */
+       printf("\n");
+       if (len >= 1) {
+               uint8_t ano = data[0];
+               printf("\t\tNetwork Options: 0x%hx\n", (unsigned short)(ano));
+               printf("\t\t\tNetwork Type: %i (%s)\n",
+                      (int)(ano & 0xf), ntype_11u(ano & 0xf));
+               if (ano & (1<<4))
+                       printf("\t\t\tInternet\n");
+               if (ano & (1<<5))
+                       printf("\t\t\tASRA\n");
+               if (ano & (1<<6))
+                       printf("\t\t\tESR\n");
+               if (ano & (1<<7))
+                       printf("\t\t\tUESA\n");
+       }
+       if ((len == 3) || (len == 9)) {
+               printf("\t\tVenue Group: %i (%s)\n",
+                      (int)(data[1]), vgroup_11u(data[1]));
+               printf("\t\tVenue Type: %i\n", (int)(data[2]));
+       }
+       if (len == 9)
+               printf("\t\tHESSID: %02hx:%02hx:%02hx:%02hx:%02hx:%02hx\n",
+                      data[3], data[4], data[5], data[6], data[7], data[8]);
+       else if (len == 7)
+               printf("\t\tHESSID: %02hx:%02hx:%02hx:%02hx:%02hx:%02hx\n",
+                      data[1], data[2], data[3], data[4], data[5], data[6]);
+}
+
+static void print_11u_advert(const uint8_t type, uint8_t len,
+                            const uint8_t *data,
+                            const struct print_ies_data *ie_buffer)
+{
+       /* See Section 7.3.2.93 in the 802.11u spec. */
+       /* TODO: This code below does not decode private protocol IDs */
+       int idx = 0;
+       printf("\n");
+       while (idx < (len - 1)) {
+               uint8_t qri = data[idx];
+               uint8_t proto_id = data[idx + 1];
+               printf("\t\tQuery Response Info: 0x%hx\n", (unsigned short)(qri));
+               printf("\t\t\tQuery Response Length Limit: %i\n",
+                      (qri & 0x7f));
+               if (qri & (1<<7))
+                       printf("\t\t\tPAME-BI\n");
+               switch(proto_id) {
+               case 0:
+                       printf("\t\t\tANQP\n"); break;
+               case 1:
+                       printf("\t\t\tMIH Information Service\n"); break;
+               case 2:
+                       printf("\t\t\tMIH Command and Event Services Capability Discovery\n"); break;
+               case 3:
+                       printf("\t\t\tEmergency Alert System (EAS)\n"); break;
+               case 221:
+                       printf("\t\t\tVendor Specific\n"); break;
+               default:
+                       printf("\t\t\tReserved: %i\n", proto_id); break;
+               }
+               idx += 2;
+       }
+}
+
+static void print_11u_rcon(const uint8_t type, uint8_t len, const uint8_t *data,
+                          const struct print_ies_data *ie_buffer)
+{
+       /* See Section 7.3.2.96 in the 802.11u spec. */
+       int idx = 0;
+       int ln0 = data[1] & 0xf;
+       int ln1 = ((data[1] & 0xf0) >> 4);
+       int ln2 = 0;
+       printf("\n");
+
+       if (ln1)
+               ln2 = len - 2 - ln0 - ln1;
+
+       printf("\t\tANQP OIs: %i\n", data[0]);
+
+       if (ln0 > 0) {
+               printf("\t\tOI 1: ");
+               if (2 + ln0 > len) {
+                       printf("Invalid IE length.\n");
+               } else {
+                       for (idx = 0; idx < ln0; idx++) {
+                               printf("%02hx", data[2 + idx]);
+                       }
+                       printf("\n");
+               }
+       }
+
+       if (ln1 > 0) {
+               printf("\t\tOI 2: ");
+               if (2 + ln0 + ln1 > len) {
+                       printf("Invalid IE length.\n");
+               } else {
+                       for (idx = 0; idx < ln1; idx++) {
+                               printf("%02hx", data[2 + ln0 + idx]);
+                       }
+                       printf("\n");
+               }
+       }
+
+       if (ln2 > 0) {
+               printf("\t\tOI 3: ");
+               if (2 + ln0 + ln1 + ln2 > len) {
+                       printf("Invalid IE length.\n");
+               } else {
+                       for (idx = 0; idx < ln2; idx++) {
+                               printf("%02hx", data[2 + ln0 + ln1 + idx]);
+                       }
+                       printf("\n");
+               }
+       }
+}
+
+static const char *ht_secondary_offset[4] = {
+       "no secondary",
+       "above",
+       "[reserved!]",
+       "below",
+};
+
+static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data,
+                       const struct print_ies_data *ie_buffer)
 {
-       static const char *offset[4] = {
-               "no secondary",
-               "above",
-               "[reserved!]",
-               "below",
-       };
        static const char *protection[4] = {
                "no",
                "nonmember",
@@ -554,7 +1226,7 @@ static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
        printf("\n");
        printf("\t\t * primary channel: %d\n", data[0]);
        printf("\t\t * secondary channel offset: %s\n",
-               offset[data[1] & 0x3]);
+               ht_secondary_offset[data[1] & 0x3]);
        printf("\t\t * STA channel width: %s\n", sta_chan_width[(data[1] & 0x4)>>2]);
        printf("\t\t * RIFS: %d\n", (data[1] & 0x8)>>3);
        printf("\t\t * HT protection: %s\n", protection[data[2] & 0x3]);
@@ -568,11 +1240,23 @@ static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
        printf("\t\t * PCO phase: %d\n", (data[5] & 0x8) >> 3);
 }
 
-static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_capabilities(const uint8_t type, uint8_t len,
+                              const uint8_t *data,
+                              const struct print_ies_data *ie_buffer)
 {
-       int i, base, bit;
-       bool first = true;
+       int i, base, bit, si_duration = 0, max_amsdu = 0;
+       bool s_psmp_support = false, is_vht_cap = false;
+       unsigned char *ie = ie_buffer->ie;
+       int ielen = ie_buffer->ielen;
 
+       while (ielen >= 2 && ielen >= ie[1]) {
+               if (ie[0] == 191) {
+                       is_vht_cap = true;
+                       break;
+               }
+               ielen -= ie[1] + 2;
+               ie += ie[1] + 2;
+       }
 
        for (i = 0; i < len; i++) {
                base = i * 8;
@@ -581,44 +1265,144 @@ static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *d
                        if (!(data[i] & (1 << bit)))
                                continue;
 
-                       if (!first)
-                               printf(",");
-                       else
-                               first = false;
+                       printf("\n\t\t *");
+
+#define CAPA(bit, name)                case bit: printf(" " name); break
+
+/* if the capability 'cap' exists add 'val' to 'sum'
+ * otherwise print 'Reserved' */
+#define ADD_BIT_VAL(bit, cap, sum, val)        case (bit): do {        \
+       if (!(cap)) {                                           \
+               printf(" Reserved");                            \
+               break;                                          \
+       }                                                       \
+       sum += val;                                             \
+       break;                                                  \
+} while (0)
 
                        switch (bit + base) {
-                       case 0:
-                               printf(" HT Information Exchange Supported");
-                               break;
-                       case 1:
-                               printf(" On-demand Beacon");
-                               break;
-                       case 2:
-                               printf(" Extended Channel Switching");
-                               break;
-                       case 3:
-                               printf(" Wave Indication");
-                               break;
-                       case 4:
-                               printf(" PSMP Capability");
-                               break;
-                       case 5:
-                               printf(" Service Interval Granularity");
-                               break;
+                       CAPA(0, "HT Information Exchange Supported");
+                       CAPA(1, "reserved (On-demand Beacon)");
+                       CAPA(2, "Extended Channel Switching");
+                       CAPA(3, "reserved (Wave Indication)");
+                       CAPA(4, "PSMP Capability");
+                       CAPA(5, "reserved (Service Interval Granularity)");
+
                        case 6:
+                               s_psmp_support = true;
                                printf(" S-PSMP Capability");
                                break;
+
+                       CAPA(7, "Event");
+                       CAPA(8, "Diagnostics");
+                       CAPA(9, "Multicast Diagnostics");
+                       CAPA(10, "Location Tracking");
+                       CAPA(11, "FMS");
+                       CAPA(12, "Proxy ARP Service");
+                       CAPA(13, "Collocated Interference Reporting");
+                       CAPA(14, "Civic Location");
+                       CAPA(15, "Geospatial Location");
+                       CAPA(16, "TFS");
+                       CAPA(17, "WNM-Sleep Mode");
+                       CAPA(18, "TIM Broadcast");
+                       CAPA(19, "BSS Transition");
+                       CAPA(20, "QoS Traffic Capability");
+                       CAPA(21, "AC Station Count");
+                       CAPA(22, "Multiple BSSID");
+                       CAPA(23, "Timing Measurement");
+                       CAPA(24, "Channel Usage");
+                       CAPA(25, "SSID List");
+                       CAPA(26, "DMS");
+                       CAPA(27, "UTC TSF Offset");
+                       CAPA(28, "TDLS Peer U-APSD Buffer STA Support");
+                       CAPA(29, "TDLS Peer PSM Support");
+                       CAPA(30, "TDLS channel switching");
+                       CAPA(31, "Interworking");
+                       CAPA(32, "QoS Map");
+                       CAPA(33, "EBR");
+                       CAPA(34, "SSPN Interface");
+                       CAPA(35, "Reserved");
+                       CAPA(36, "MSGCF Capability");
+                       CAPA(37, "TDLS Support");
+                       CAPA(38, "TDLS Prohibited");
+                       CAPA(39, "TDLS Channel Switching Prohibited");
+                       CAPA(40, "Reject Unadmitted Frame");
+
+                       ADD_BIT_VAL(41, s_psmp_support, si_duration, 1);
+                       ADD_BIT_VAL(42, s_psmp_support, si_duration, 2);
+                       ADD_BIT_VAL(43, s_psmp_support, si_duration, 4);
+
+                       CAPA(44, "Identifier Location");
+                       CAPA(45, "U-APSD Coexistence");
+                       CAPA(46, "WNM-Notification");
+                       CAPA(47, "Reserved");
+                       CAPA(48, "UTF-8 SSID");
+                       CAPA(49, "QMFActivated");
+                       CAPA(50, "QMFReconfigurationActivated");
+                       CAPA(51, "Robust AV Streaming");
+                       CAPA(52, "Advanced GCR");
+                       CAPA(53, "Mesh GCR");
+                       CAPA(54, "SCS");
+                       CAPA(55, "QLoad Report");
+                       CAPA(56, "Alternate EDCA");
+                       CAPA(57, "Unprotected TXOP Negotiation");
+                       CAPA(58, "Protected TXOP egotiation");
+                       CAPA(59, "Reserved");
+                       CAPA(60, "Protected QLoad Report");
+                       CAPA(61, "TDLS Wider Bandwidth");
+                       CAPA(62, "Operating Mode Notification");
+
+                       ADD_BIT_VAL(63, is_vht_cap, max_amsdu, 1);
+                       ADD_BIT_VAL(64, is_vht_cap, max_amsdu, 2);
+
+                       CAPA(65, "Channel Schedule Management");
+                       CAPA(66, "Geodatabase Inband Enabling Signal");
+                       CAPA(67, "Network Channel Control");
+                       CAPA(68, "White Space Map");
+                       CAPA(69, "Channel Availability Query");
+                       CAPA(70, "FTM Responder");
+                       CAPA(71, "FTM Initiator");
+                       CAPA(72, "Reserved");
+                       CAPA(73, "Extended Spectrum Management Capable");
+                       CAPA(74, "Reserved");
                        default:
                                printf(" %d", bit);
                                break;
                        }
+#undef ADD_BIT_VAL
+#undef CAPA
+               }
+       }
+
+       if (s_psmp_support)
+               printf("\n\t\t * Service Interval Granularity is %d ms",
+                      (si_duration + 1) * 5);
+
+       if (is_vht_cap) {
+               printf("\n\t\t * Max Number Of MSDUs In A-MSDU is ");
+               switch (max_amsdu) {
+               case 0:
+                       printf("unlimited");
+                       break;
+               case 1:
+                       printf("32");
+                       break;
+               case 2:
+                       printf("16");
+                       break;
+               case 3:
+                       printf("8");
+                       break;
+               default:
+                       break;
                }
        }
 
        printf("\n");
 }
 
-static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data,
+                     const struct print_ies_data *ie_buffer)
 {
        printf(" DTIM Count %u DTIM Period %u Bitmap Control 0x%x "
               "Bitmap[0] 0x%x",
@@ -628,15 +1412,117 @@ static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data)
        printf("\n");
 }
 
+static void print_ibssatim(const uint8_t type, uint8_t len, const uint8_t *data,
+                          const struct print_ies_data *ie_buffer)
+{
+       printf(" %d TUs", (data[1] << 8) + data[0]);
+}
+
+static void print_vht_capa(const uint8_t type, uint8_t len, const uint8_t *data,
+                          const struct print_ies_data *ie_buffer)
+{
+       printf("\n");
+       print_vht_info(data[0] | (data[1] << 8) |
+                      (data[2] << 16) | (data[3] << 24),
+                      data + 4);
+}
+
+static void print_vht_oper(const uint8_t type, uint8_t len, const uint8_t *data,
+                          const struct print_ies_data *ie_buffer)
+{
+       const char *chandwidths[] = {
+               [0] = "20 or 40 MHz",
+               [1] = "80 MHz",
+               [3] = "80+80 MHz",
+               [2] = "160 MHz",
+       };
+
+       printf("\n");
+       printf("\t\t * channel width: %d (%s)\n", data[0],
+               data[0] < ARRAY_SIZE(chandwidths) ? chandwidths[data[0]] : "unknown");
+       printf("\t\t * center freq segment 1: %d\n", data[1]);
+       printf("\t\t * center freq segment 2: %d\n", data[2]);
+       printf("\t\t * VHT basic MCS set: 0x%.2x%.2x\n", data[4], data[3]);
+}
+
+static void print_obss_scan_params(const uint8_t type, uint8_t len,
+                                  const uint8_t *data,
+                                  const struct print_ies_data *ie_buffer)
+{
+       printf("\n");
+       printf("\t\t * passive dwell: %d TUs\n", (data[1] << 8) | data[0]);
+       printf("\t\t * active dwell: %d TUs\n", (data[3] << 8) | data[2]);
+       printf("\t\t * channel width trigger scan interval: %d s\n", (data[5] << 8) | data[4]);
+       printf("\t\t * scan passive total per channel: %d TUs\n", (data[7] << 8) | data[6]);
+       printf("\t\t * scan active total per channel: %d TUs\n", (data[9] << 8) | data[8]);
+       printf("\t\t * BSS width channel transition delay factor: %d\n", (data[11] << 8) | data[10]);
+       printf("\t\t * OBSS Scan Activity Threshold: %d.%02d %%\n",
+               ((data[13] << 8) | data[12]) / 100, ((data[13] << 8) | data[12]) % 100);
+}
+
+static void print_secchan_offs(const uint8_t type, uint8_t len,
+                              const uint8_t *data,
+                              const struct print_ies_data *ie_buffer)
+{
+       if (data[0] < ARRAY_SIZE(ht_secondary_offset))
+               printf(" %s (%d)\n", ht_secondary_offset[data[0]], data[0]);
+       else
+               printf(" %d\n", data[0]);
+}
+
+static void print_bss_load(const uint8_t type, uint8_t len, const uint8_t *data,
+                          const struct print_ies_data *ie_buffer)
+{
+       printf("\n");
+       printf("\t\t * station count: %d\n", (data[1] << 8) | data[0]);
+       printf("\t\t * channel utilisation: %d/255\n", data[2]);
+       printf("\t\t * available admission capacity: %d [*32us]\n", (data[4] << 8) | data[3]);
+}
+
+static void print_mesh_conf(const uint8_t type, uint8_t len,
+                           const uint8_t *data,
+                           const struct print_ies_data *ie_buffer)
+{
+       printf("\n");
+       printf("\t\t * Active Path Selection Protocol ID: %d\n", data[0]);
+       printf("\t\t * Active Path Selection Metric ID: %d\n", data[1]);
+       printf("\t\t * Congestion Control Mode ID: %d\n", data[2]);
+       printf("\t\t * Synchronization Method ID: %d\n", data[3]);
+       printf("\t\t * Authentication Protocol ID: %d\n", data[4]);
+       printf("\t\t * Mesh Formation Info:\n");
+       printf("\t\t\t Number of Peerings: %d\n", (data[5] & 0x7E) >> 1);
+       if (data[5] & 0x01)
+               printf("\t\t\t Connected to Mesh Gate\n");
+       if (data[5] & 0x80)
+               printf("\t\t\t Connected to AS\n");
+       printf("\t\t * Mesh Capability\n");
+       if (data[6] & 0x01)
+               printf("\t\t\t Accepting Additional Mesh Peerings\n");
+       if (data[6] & 0x02)
+               printf("\t\t\t MCCA Supported\n");
+       if (data[6] & 0x04)
+               printf("\t\t\t MCCA Enabled\n");
+       if (data[6] & 0x08)
+               printf("\t\t\t Forwarding\n");
+       if (data[6] & 0x10)
+               printf("\t\t\t MBCA Supported\n");
+       if (data[6] & 0x20)
+               printf("\t\t\t TBTT Adjusting\n");
+       if (data[6] & 0x40)
+               printf("\t\t\t Mesh Power Save Level\n");
+}
+
 struct ie_print {
        const char *name;
-       void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
+       void (*print)(const uint8_t type, uint8_t len, const uint8_t *data,
+                     const struct print_ies_data *ie_buffer);
        uint8_t minlen, maxlen;
        uint8_t flags;
 };
 
-static void print_ie(const struct ie_print *p, const uint8_t type,
-                    uint8_t len, const uint8_t *data)
+static void print_ie(const struct ie_print *p, const uint8_t type, uint8_t len,
+                    const uint8_t *data,
+                    const struct print_ies_data *ie_buffer)
 {
        int i;
 
@@ -657,7 +1543,7 @@ static void print_ie(const struct ie_print *p, const uint8_t type,
                return;
        }
 
-       p->print(type, len, data);
+       p->print(type, len, data, ie_buffer);
 }
 
 #define PRINT_IGN {            \
@@ -672,22 +1558,42 @@ static const struct ie_print ieprinters[] = {
        [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
        [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
        [5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), },
+       [6] = { "IBSS ATIM window", print_ibssatim, 2, 2, BIT(PRINT_SCAN), },
        [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
+       [11] = { "BSS Load", print_bss_load, 5, 5, BIT(PRINT_SCAN), },
        [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
+       [35] = { "TPC report", print_tpcreport, 2, 2, BIT(PRINT_SCAN), },
        [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
        [45] = { "HT capabilities", print_ht_capa, 26, 26, BIT(PRINT_SCAN), },
+       [47] = { "ERP D4.0", print_erp, 1, 255, BIT(PRINT_SCAN), },
+       [74] = { "Overlapping BSS scan params", print_obss_scan_params, 14, 255, BIT(PRINT_SCAN), },
        [61] = { "HT operation", print_ht_op, 22, 22, BIT(PRINT_SCAN), },
+       [62] = { "Secondary Channel Offset", print_secchan_offs, 1, 1, BIT(PRINT_SCAN), },
+       [191] = { "VHT capabilities", print_vht_capa, 12, 255, BIT(PRINT_SCAN), },
+       [192] = { "VHT operation", print_vht_oper, 5, 255, BIT(PRINT_SCAN), },
        [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
        [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
+       [113] = { "MESH Configuration", print_mesh_conf, 7, 7, BIT(PRINT_SCAN), },
        [114] = { "MESH ID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
        [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
+       [107] = { "802.11u Interworking", print_interworking, 0, 255, BIT(PRINT_SCAN), },
+       [108] = { "802.11u Advertisement", print_11u_advert, 0, 255, BIT(PRINT_SCAN), },
+       [111] = { "802.11u Roaming Consortium", print_11u_rcon, 0, 255, BIT(PRINT_SCAN), },
 };
 
-static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data,
+                          const struct print_ies_data *ie_buffer)
 {
        print_rsn_ie("TKIP", "IEEE 802.1X", len, data);
 }
 
+static void print_wifi_osen(const uint8_t type, uint8_t len,
+                           const uint8_t *data,
+                           const struct print_ies_data *ie_buffer)
+{
+       print_osen_ie("OSEN", "OSEN", len, data);
+}
+
 static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
 {
        int i;
@@ -730,7 +1636,8 @@ static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
        return false;
 }
 
-static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data,
+                          const struct print_ies_data *ie_buffer)
 {
        int i;
 
@@ -772,7 +1679,8 @@ static const char * wifi_wps_dev_passwd_id(uint16_t id)
        }
 }
 
-static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
+static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
+                          const struct print_ies_data *ie_buffer)
 {
        bool first = true;
        __u16 subtype, sublen;
@@ -948,7 +1856,9 @@ static const struct ie_print wifiprinters[] = {
        [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
 };
 
-static inline void print_p2p(const uint8_t type, uint8_t len, const uint8_t *data)
+static inline void print_p2p(const uint8_t type, uint8_t len,
+                            const uint8_t *data,
+                            const struct print_ies_data *ie_buffer)
 {
        bool first = true;
        __u8 subtype;
@@ -976,7 +1886,7 @@ static inline void print_p2p(const uint8_t type, uint8_t len, const uint8_t *dat
                                printf("\t * malformed device info\n");
                                break;
                        }
-                       /* fall through for now */
+                       /* fall through */
                case 0x00: /* status */
                case 0x01: /* minor reason */
                case 0x03: /* device ID */
@@ -1028,8 +1938,51 @@ static inline void print_p2p(const uint8_t type, uint8_t len, const uint8_t *dat
        }
 }
 
+static inline void print_hs20_ind(const uint8_t type, uint8_t len,
+                                 const uint8_t *data,
+                                 const struct print_ies_data *ie_buffer)
+{
+       /* I can't find the spec for this...just going off what wireshark uses. */
+       printf("\n");
+       if (len > 0)
+               printf("\t\tDGAF: %i\n", (int)(data[0] & 0x1));
+       else
+               printf("\t\tUnexpected length: %i\n", len);
+}
+
+static void print_wifi_owe_tarns(const uint8_t type, uint8_t len,
+                                const uint8_t *data,
+                                const struct print_ies_data *ie_buffer)
+{
+       char mac_addr[20];
+       int ssid_len;
+
+       printf("\n");
+       if (len < 7)
+               return;
+
+       mac_addr_n2a(mac_addr, data);
+       printf("\t\tBSSID: %s\n", mac_addr);
+
+       ssid_len = data[6];
+       if (ssid_len > len - 7)
+               return;
+       printf("\t\tSSID: ");
+       print_ssid_escaped(ssid_len, data + 7);
+       printf("\n");
+
+       /* optional elements */
+       if (len >= ssid_len + 9) {
+               printf("\t\tBand Info: %u\n", data[ssid_len + 7]);
+               printf("\t\tChannel Info: %u\n", data[ssid_len + 8]);
+       }
+}
+
 static const struct ie_print wfa_printers[] = {
        [9] = { "P2P", print_p2p, 2, 255, BIT(PRINT_SCAN), },
+       [16] = { "HotSpot 2.0 Indication", print_hs20_ind, 1, 255, BIT(PRINT_SCAN), },
+       [18] = { "HotSpot 2.0 OSEN", print_wifi_osen, 1, 255, BIT(PRINT_SCAN), },
+       [28] = { "OWE Transition Mode", print_wifi_owe_tarns, 7, 255, BIT(PRINT_SCAN), },
 };
 
 static void print_vendor(unsigned char len, unsigned char *data,
@@ -1049,7 +2002,9 @@ static void print_vendor(unsigned char len, unsigned char *data,
                if (data[3] < ARRAY_SIZE(wifiprinters) &&
                    wifiprinters[data[3]].name &&
                    wifiprinters[data[3]].flags & BIT(ptype)) {
-                       print_ie(&wifiprinters[data[3]], data[3], len - 4, data + 4);
+                       print_ie(&wifiprinters[data[3]],
+                                data[3], len - 4, data + 4,
+                                NULL);
                        return;
                }
                if (!unknown)
@@ -1065,7 +2020,9 @@ static void print_vendor(unsigned char len, unsigned char *data,
                if (data[3] < ARRAY_SIZE(wfa_printers) &&
                    wfa_printers[data[3]].name &&
                    wfa_printers[data[3]].flags & BIT(ptype)) {
-                       print_ie(&wfa_printers[data[3]], data[3], len - 4, data + 4);
+                       print_ie(&wfa_printers[data[3]],
+                                data[3], len - 4, data + 4,
+                                NULL);
                        return;
                }
                if (!unknown)
@@ -1090,11 +2047,16 @@ static void print_vendor(unsigned char len, unsigned char *data,
 void print_ies(unsigned char *ie, int ielen, bool unknown,
               enum print_ie_type ptype)
 {
+       struct print_ies_data ie_buffer = {
+               .ie = ie,
+               .ielen = ielen };
+
        while (ielen >= 2 && ielen >= ie[1]) {
                if (ie[0] < ARRAY_SIZE(ieprinters) &&
                    ieprinters[ie[0]].name &&
                    ieprinters[ie[0]].flags & BIT(ptype)) {
-                       print_ie(&ieprinters[ie[0]], ie[0], ie[1], ie + 2);
+                       print_ie(&ieprinters[ie[0]],
+                                ie[0], ie[1], ie + 2, &ie_buffer);
                } else if (ie[0] == 221 /* vendor */) {
                        print_vendor(ie[1], ie + 2, unknown, ptype);
                } else if (unknown) {
@@ -1110,6 +2072,70 @@ void print_ies(unsigned char *ie, int ielen, bool unknown,
        }
 }
 
+static void print_capa_dmg(__u16 capa)
+{
+       switch (capa & WLAN_CAPABILITY_DMG_TYPE_MASK) {
+       case WLAN_CAPABILITY_DMG_TYPE_AP:
+               printf(" DMG_ESS");
+               break;
+       case WLAN_CAPABILITY_DMG_TYPE_PBSS:
+               printf(" DMG_PCP");
+               break;
+       case WLAN_CAPABILITY_DMG_TYPE_IBSS:
+               printf(" DMG_IBSS");
+               break;
+       }
+
+       if (capa & WLAN_CAPABILITY_DMG_CBAP_ONLY)
+               printf(" CBAP_Only");
+       if (capa & WLAN_CAPABILITY_DMG_CBAP_SOURCE)
+               printf(" CBAP_Src");
+       if (capa & WLAN_CAPABILITY_DMG_PRIVACY)
+               printf(" Privacy");
+       if (capa & WLAN_CAPABILITY_DMG_ECPAC)
+               printf(" ECPAC");
+       if (capa & WLAN_CAPABILITY_DMG_SPECTRUM_MGMT)
+               printf(" SpectrumMgmt");
+       if (capa & WLAN_CAPABILITY_DMG_RADIO_MEASURE)
+               printf(" RadioMeasure");
+}
+
+static void print_capa_non_dmg(__u16 capa)
+{
+       if (capa & WLAN_CAPABILITY_ESS)
+               printf(" ESS");
+       if (capa & WLAN_CAPABILITY_IBSS)
+               printf(" IBSS");
+       if (capa & WLAN_CAPABILITY_CF_POLLABLE)
+               printf(" CfPollable");
+       if (capa & WLAN_CAPABILITY_CF_POLL_REQUEST)
+               printf(" CfPollReq");
+       if (capa & WLAN_CAPABILITY_PRIVACY)
+               printf(" Privacy");
+       if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
+               printf(" ShortPreamble");
+       if (capa & WLAN_CAPABILITY_PBCC)
+               printf(" PBCC");
+       if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
+               printf(" ChannelAgility");
+       if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
+               printf(" SpectrumMgmt");
+       if (capa & WLAN_CAPABILITY_QOS)
+               printf(" QoS");
+       if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
+               printf(" ShortSlotTime");
+       if (capa & WLAN_CAPABILITY_APSD)
+               printf(" APSD");
+       if (capa & WLAN_CAPABILITY_RADIO_MEASURE)
+               printf(" RadioMeasure");
+       if (capa & WLAN_CAPABILITY_DSSS_OFDM)
+               printf(" DSSS-OFDM");
+       if (capa & WLAN_CAPABILITY_DEL_BACK)
+               printf(" DelayedBACK");
+       if (capa & WLAN_CAPABILITY_IMM_BACK)
+               printf(" ImmediateBACK");
+}
+
 static int print_bss_handler(struct nl_msg *msg, void *arg)
 {
        struct nlattr *tb[NL80211_ATTR_MAX + 1];
@@ -1131,6 +2157,7 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
        };
        struct scan_params *params = arg;
        int show = params->show_both_ie_sets ? 2 : 1;
+       bool is_dmg = false;
 
        nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
                  genlmsg_attrlen(gnlh, 0), NULL);
@@ -1150,8 +2177,11 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
                return NL_SKIP;
 
        mac_addr_n2a(mac_addr, nla_data(bss[NL80211_BSS_BSSID]));
-       if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
-       printf("BSS %s (on %s)", mac_addr, dev);
+       printf("BSS %s", mac_addr);
+       if (tb[NL80211_ATTR_IFINDEX]) {
+               if_indextoname(nla_get_u32(tb[NL80211_ATTR_IFINDEX]), dev);
+               printf("(on %s)", dev);
+       }
 
        if (bss[NL80211_BSS_STATUS]) {
                switch (nla_get_u32(bss[NL80211_BSS_STATUS])) {
@@ -1172,6 +2202,12 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
        }
        printf("\n");
 
+       if (bss[NL80211_BSS_LAST_SEEN_BOOTTIME]) {
+               unsigned long long bt;
+               bt = (unsigned long long)nla_get_u64(bss[NL80211_BSS_LAST_SEEN_BOOTTIME]);
+               printf("\tlast seen: %llu.%.3llus [boottime]\n", bt/1000000000, (bt%1000000000)/1000000);
+       }
+
        if (bss[NL80211_BSS_TSF]) {
                unsigned long long tsf;
                tsf = (unsigned long long)nla_get_u64(bss[NL80211_BSS_TSF]);
@@ -1179,37 +2215,22 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
                        tsf, tsf/1000/1000/60/60/24, (tsf/1000/1000/60/60) % 24,
                        (tsf/1000/1000/60) % 60, (tsf/1000/1000) % 60);
        }
-       if (bss[NL80211_BSS_FREQUENCY])
-               printf("\tfreq: %d\n",
-                       nla_get_u32(bss[NL80211_BSS_FREQUENCY]));
+       if (bss[NL80211_BSS_FREQUENCY]) {
+               int freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
+               printf("\tfreq: %d\n", freq);
+               if (freq > 45000)
+                       is_dmg = true;
+       }
        if (bss[NL80211_BSS_BEACON_INTERVAL])
-               printf("\tbeacon interval: %d\n",
+               printf("\tbeacon interval: %d TUs\n",
                        nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]));
        if (bss[NL80211_BSS_CAPABILITY]) {
                __u16 capa = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
                printf("\tcapability:");
-               if (capa & WLAN_CAPABILITY_ESS)
-                       printf(" ESS");
-               if (capa & WLAN_CAPABILITY_IBSS)
-                       printf(" IBSS");
-               if (capa & WLAN_CAPABILITY_PRIVACY)
-                       printf(" Privacy");
-               if (capa & WLAN_CAPABILITY_SHORT_PREAMBLE)
-                       printf(" ShortPreamble");
-               if (capa & WLAN_CAPABILITY_PBCC)
-                       printf(" PBCC");
-               if (capa & WLAN_CAPABILITY_CHANNEL_AGILITY)
-                       printf(" ChannelAgility");
-               if (capa & WLAN_CAPABILITY_SPECTRUM_MGMT)
-                       printf(" SpectrumMgmt");
-               if (capa & WLAN_CAPABILITY_QOS)
-                       printf(" QoS");
-               if (capa & WLAN_CAPABILITY_SHORT_SLOT_TIME)
-                       printf(" ShortSlotTime");
-               if (capa & WLAN_CAPABILITY_APSD)
-                       printf(" APSD");
-               if (capa & WLAN_CAPABILITY_DSSS_OFDM)
-                       printf(" DSSS-OFDM");
+               if (is_dmg)
+                       print_capa_dmg(capa);
+               else
+                       print_capa_non_dmg(capa);
                printf(" (0x%.4x)\n", capa);
        }
        if (bss[NL80211_BSS_SIGNAL_MBM]) {
@@ -1226,11 +2247,16 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
        }
 
        if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) {
-               if (bss[NL80211_BSS_BEACON_IES])
+               struct nlattr *ies = bss[NL80211_BSS_INFORMATION_ELEMENTS];
+               struct nlattr *bcnies = bss[NL80211_BSS_BEACON_IES];
+
+               if (bss[NL80211_BSS_PRESP_DATA] ||
+                   (bcnies && (nla_len(ies) != nla_len(bcnies) ||
+                               memcmp(nla_data(ies), nla_data(bcnies),
+                                      nla_len(ies)))))
                        printf("\tInformation elements from Probe Response "
                               "frame:\n");
-               print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
-                         nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
+               print_ies(nla_data(ies), nla_len(ies),
                          params->unknown, params->type);
        }
        if (bss[NL80211_BSS_BEACON_IES] && show--) {
@@ -1246,7 +2272,6 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
 static struct scan_params scan_params;
 
 static int handle_scan_dump(struct nl80211_state *state,
-                           struct nl_cb *cb,
                            struct nl_msg *msg,
                            int argc, char **argv,
                            enum id_input id)
@@ -1263,13 +2288,11 @@ static int handle_scan_dump(struct nl80211_state *state,
 
        scan_params.type = PRINT_SCAN;
 
-       nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, print_bss_handler,
-                 &scan_params);
+       register_handler(print_bss_handler, &scan_params);
        return 0;
 }
 
 static int handle_scan_combined(struct nl80211_state *state,
-                               struct nl_cb *cb,
                                struct nl_msg *msg,
                                int argc, char **argv,
                                enum id_input id)
@@ -1286,6 +2309,7 @@ static int handle_scan_combined(struct nl80211_state *state,
                NL80211_CMD_SCAN_ABORTED,
        };
        int trig_argc, dump_argc, err;
+       int i;
 
        if (argc >= 3 && !strcmp(argv[2], "-u")) {
                dump_argc = 4;
@@ -1303,10 +2327,10 @@ static int handle_scan_combined(struct nl80211_state *state,
        trig_argv[0] = argv[0];
        trig_argv[1] = "scan";
        trig_argv[2] = "trigger";
-       int i;
+
        for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
                trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
-       err = handle_cmd(state, II_NETDEV, trig_argc, trig_argv);
+       err = handle_cmd(state, id, trig_argc, trig_argv);
        free(trig_argv);
        if (err)
                return err;
@@ -1342,9 +2366,9 @@ static int handle_scan_combined(struct nl80211_state *state,
        }
 
        dump_argv[0] = argv[0];
-       return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
+       return handle_cmd(state, id, dump_argc, dump_argv);
 }
-TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]", 0, 0,
+TOPLEVEL(scan, "[-u] [freq <freq>*] [duration <dur>] [ies <hex as 00:11:..>] [meshid <meshid>] [lowpri,flush,ap-force,duration-mandatory] [randomise[=<addr>/<mask>]] [ssid <ssid>*|passive]", 0, 0,
         CIB_NETDEV, handle_scan_combined,
         "Scan on the given frequencies and probe for the given SSIDs\n"
         "(or wildcard if not given) unless passive scanning is requested.\n"
@@ -1354,7 +2378,48 @@ COMMAND(scan, dump, "[-u]",
        NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
        "Dump the current scan results. If -u is specified, print unknown\n"
        "data in scan results.");
-COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [ssid <ssid>*|passive]",
+COMMAND(scan, trigger, "[freq <freq>*] [duration <dur>] [ies <hex as 00:11:..>] [meshid <meshid>] [lowpri,flush,ap-force,duration-mandatory] [randomise[=<addr>/<mask>]] [ssid <ssid>*|passive]",
        NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
         "Trigger a scan on the given frequencies with probing for the given\n"
-        "SSIDs (or wildcard if not given) unless passive scanning is requested.");
+        "SSIDs (or wildcard if not given) unless passive scanning is requested.\n"
+        "Duration(in TUs), if specified, will be used to set dwell times.\n");
+
+
+static int handle_scan_abort(struct nl80211_state *state,
+                            struct nl_msg *msg,
+                            int argc, char **argv,
+                            enum id_input id)
+{
+       return 0;
+}
+COMMAND(scan, abort, "",
+       NL80211_CMD_ABORT_SCAN, 0, CIB_NETDEV, handle_scan_abort,
+       "Abort ongoing scan");
+
+static int handle_start_sched_scan(struct nl80211_state *state,
+                                  struct nl_msg *msg,
+                                  int argc, char **argv, enum id_input id)
+{
+       return parse_sched_scan(msg, &argc, &argv);
+}
+
+static int handle_stop_sched_scan(struct nl80211_state *state,
+                                 struct nl_msg *msg, int argc, char **argv,
+                                 enum id_input id)
+{
+       if (argc != 0)
+               return 1;
+
+       return 0;
+}
+
+COMMAND(scan, sched_start,
+       SCHED_SCAN_OPTIONS,
+       NL80211_CMD_START_SCHED_SCAN, 0, CIB_NETDEV, handle_start_sched_scan,
+       "Start a scheduled scan at the specified interval on the given frequencies\n"
+       "with probing for the given SSIDs (or wildcard if not given) unless passive\n"
+       "scanning is requested.  If matches are specified, only matching results\n"
+       "will be returned.");
+COMMAND(scan, sched_stop, "",
+       NL80211_CMD_STOP_SCHED_SCAN, 0, CIB_NETDEV, handle_stop_sched_scan,
+       "Stop an ongoing scheduled scan.");