]> git.ipfire.org Git - thirdparty/iw.git/blobdiff - scan.c
parse more extended capabilities
[thirdparty/iw.git] / scan.c
diff --git a/scan.c b/scan.c
index 6bafab72d3265e3d4421f3c6355c685e8f3531f1..ec564d715d90a5b9fe247a1b2f7d08f415a801bd 100644 (file)
--- a/scan.c
+++ b/scan.c
 #define WLAN_CAPABILITY_APSD           (1<<11)
 #define WLAN_CAPABILITY_DSSS_OFDM      (1<<13)
 
-static unsigned char wifi_oui[3]      = { 0x00, 0x50, 0xf2 };
-static unsigned char ieee80211_oui[3] = { 0x00, 0x0f, 0xac };
+static unsigned char ms_oui[3]         = { 0x00, 0x50, 0xf2 };
+static unsigned char ieee80211_oui[3]  = { 0x00, 0x0f, 0xac };
+static unsigned char wfa_oui[3]                = { 0x50, 0x6f, 0x9a };
 
 struct scan_params {
        bool unknown;
        enum print_ie_type type;
+       bool show_both_ie_sets;
 };
 
+#define IEEE80211_COUNTRY_EXTENSION_ID 201
+
+union ieee80211_country_ie_triplet {
+       struct {
+               __u8 first_channel;
+               __u8 num_channels;
+               __s8 max_power;
+       } __attribute__ ((packed)) chans;
+       struct {
+               __u8 reg_extension_id;
+               __u8 reg_class;
+               __u8 coverage_class;
+       } __attribute__ ((packed)) ext;
+} __attribute__ ((packed));
+
 static int handle_scan(struct nl80211_state *state,
                       struct nl_cb *cb,
                       struct nl_msg *msg,
-                      int argc, char **argv)
+                      int argc, char **argv,
+                      enum id_input id)
 {
        struct nl_msg *ssids = NULL, *freqs = NULL;
        char *eptr;
@@ -47,11 +65,15 @@ static int handle_scan(struct nl80211_state *state,
        enum {
                NONE,
                FREQ,
+               IES,
                SSID,
                DONE,
        } parse = NONE;
        int freq;
        bool passive = false, have_ssids = false, have_freqs = false;
+       size_t tmp;
+       unsigned char *ies;
+       int flags = 0;
 
        ssids = nlmsg_alloc();
        if (!ssids)
@@ -64,30 +86,56 @@ static int handle_scan(struct nl80211_state *state,
        }
 
        for (i = 0; i < argc; i++) {
-               if (parse == NONE && strcmp(argv[i], "freq") == 0) {
-                       parse = FREQ;
-                       have_freqs = true;
-                       continue;
-               } else if (parse < SSID && strcmp(argv[i], "ssid") == 0) {
-                       parse = SSID;
-                       have_ssids = true;
-                       continue;
-               } else if (parse < SSID && strcmp(argv[i], "passive") == 0) {
-                       parse = DONE;
-                       passive = true;
-                       continue;
-               }
-
                switch (parse) {
                case NONE:
+                       if (strcmp(argv[i], "freq") == 0) {
+                               parse = FREQ;
+                               have_freqs = true;
+                               break;
+                       } else if (strcmp(argv[i], "ies") == 0) {
+                               parse = IES;
+                               break;
+                       } else if (strcmp(argv[i], "lowpri") == 0) {
+                               parse = NONE;
+                               flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
+                               break;
+                       } else if (strcmp(argv[i], "flush") == 0) {
+                               parse = NONE;
+                               flags |= NL80211_SCAN_FLAG_FLUSH;
+                               break;
+                       } else if (strcmp(argv[i], "ap-force") == 0) {
+                               parse = NONE;
+                               flags |= NL80211_SCAN_FLAG_AP;
+                               break;
+                       } else if (strcmp(argv[i], "ssid") == 0) {
+                               parse = SSID;
+                               have_ssids = true;
+                               break;
+                       } else if (strcmp(argv[i], "passive") == 0) {
+                               parse = DONE;
+                               passive = true;
+                               break;
+                       }
                case DONE:
                        return 1;
                case FREQ:
                        freq = strtoul(argv[i], &eptr, 10);
-                       if (eptr != argv[i] + strlen(argv[i]))
-                               return 1;
+                       if (eptr != argv[i] + strlen(argv[i])) {
+                               /* failed to parse as number -- maybe a tag? */
+                               i--;
+                               parse = NONE;
+                               continue;
+                       }
                        NLA_PUT_U32(freqs, i, freq);
                        break;
+               case IES:
+                       ies = parse_hex(argv[i], &tmp);
+                       if (!ies)
+                               goto nla_put_failure;
+                       NLA_PUT(msg, NL80211_ATTR_IE, tmp, ies);
+                       free(ies);
+                       parse = NONE;
+                       break;
                case SSID:
                        NLA_PUT(ssids, i, strlen(argv[i]), argv[i]);
                        break;
@@ -101,6 +149,8 @@ static int handle_scan(struct nl80211_state *state,
 
        if (have_freqs)
                nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
+       if (flags)
+               NLA_PUT_U32(msg, NL80211_ATTR_SCAN_FLAGS, flags);
 
        err = 0;
  nla_put_failure:
@@ -108,10 +158,6 @@ static int handle_scan(struct nl80211_state *state,
        nlmsg_free(freqs);
        return err;
 }
-COMMAND(scan, trigger, "[freq <freq>*] [ssid <ssid>*|passive]",
-       NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
-        "Trigger a scan on the given frequencies with probing for the given\n"
-        "SSIDs (or wildcard if not given) unless passive scanning is requested.");
 
 static void tab_on_first(bool *first)
 {
@@ -128,6 +174,8 @@ static void print_ssid(const uint8_t type, uint8_t len, const uint8_t *data)
        printf("\n");
 }
 
+#define BSS_MEMBERSHIP_SELECTOR_HT_PHY 127
+
 static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data)
 {
        int i;
@@ -136,7 +184,13 @@ static void print_supprates(const uint8_t type, uint8_t len, const uint8_t *data
 
        for (i = 0; i < len; i++) {
                int r = data[i] & 0x7f;
-               printf("%d.%d%s ", r/2, 5*(r&1), data[i] & 0x80 ? "*":"");
+
+               if (r == BSS_MEMBERSHIP_SELECTOR_HT_PHY && data[i] & 0x80)
+                       printf("HT");
+               else
+                       printf("%d.%d", r/2, 5*(r&1));
+
+               printf("%s ", data[i] & 0x80 ? "*" : "");
        }
        printf("\n");
 }
@@ -146,29 +200,63 @@ static void print_ds(const uint8_t type, uint8_t len, const uint8_t *data)
        printf(" channel %d\n", data[0]);
 }
 
-static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
+static const char *country_env_str(char environment)
 {
-       int i;
-
-       printf(" %.*s", 2, data);
-       switch (data[2]) {
+       switch (environment) {
        case 'I':
-               printf(" (indoor)");
-               break;
+               return "Indoor only";
        case 'O':
-               printf(" (outdoor)");
-               break;
+               return "Outdoor only";
        case ' ':
-               printf(" (in/outdoor)");
-               break;
+               return "Indoor/Outdoor";
        default:
-               printf(" (invalid environment)");
-               break;
+               return "bogus";
        }
-       printf(", data:");
-       for(i=0; i<len-3; i++)
-               printf(" %.02x", data[i + 3]);
-       printf("\n");
+}
+
+static void print_country(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+       printf(" %.*s", 2, data);
+
+       printf("\tEnvironment: %s\n", country_env_str(data[2]));
+
+       data += 3;
+       len -= 3;
+
+       if (len < 3) {
+               printf("\t\tNo country IE triplets present\n");
+               return;
+       }
+
+       while (len >= 3) {
+               int end_channel;
+               union ieee80211_country_ie_triplet *triplet = (void *) data;
+
+               if (triplet->ext.reg_extension_id >= IEEE80211_COUNTRY_EXTENSION_ID) {
+                       printf("\t\tExtension ID: %d Regulatory Class: %d Coverage class: %d (up to %dm)\n",
+                              triplet->ext.reg_extension_id,
+                              triplet->ext.reg_class,
+                              triplet->ext.coverage_class,
+                              triplet->ext.coverage_class * 450);
+
+                       data += 3;
+                       len -= 3;
+                       continue;
+               }
+
+               /* 2 GHz */
+               if (triplet->chans.first_channel <= 14)
+                       end_channel = triplet->chans.first_channel + (triplet->chans.num_channels - 1);
+               else
+                       end_channel =  triplet->chans.first_channel + (4 * (triplet->chans.num_channels - 1));
+
+               printf("\t\tChannels [%d - %d] @ %d dBm\n", triplet->chans.first_channel, end_channel, triplet->chans.max_power);
+
+               data += 3;
+               len -= 3;
+       }
+
+       return;
 }
 
 static void print_powerconstraint(const uint8_t type, uint8_t len, const uint8_t *data)
@@ -191,7 +279,7 @@ static void print_erp(const uint8_t type, uint8_t len, const uint8_t *data)
 
 static void print_cipher(const uint8_t *data)
 {
-       if (memcmp(data, wifi_oui, 3) == 0) {
+       if (memcmp(data, ms_oui, 3) == 0) {
                switch (data[3]) {
                case 0:
                        printf("Use group cipher suite");
@@ -233,6 +321,9 @@ static void print_cipher(const uint8_t *data)
                case 6:
                        printf("AES-128-CMAC");
                        break;
+               case 8:
+                       printf("GCMP");
+                       break;
                default:
                        printf("%.02x-%.02x-%.02x:%d",
                                data[0], data[1] ,data[2], data[3]);
@@ -245,7 +336,7 @@ static void print_cipher(const uint8_t *data)
 
 static void print_auth(const uint8_t *data)
 {
-       if (memcmp(data, wifi_oui, 3) == 0) {
+       if (memcmp(data, ms_oui, 3) == 0) {
                switch (data[3]) {
                case 1:
                        printf("IEEE 802.1X");
@@ -408,6 +499,28 @@ static void print_rsn_ie(const char *defcipher, const char *defauth,
                len -= 2;
        }
 
+       if (len >= 2) {
+               int pmkid_count = data[0] | (data[1] << 8);
+
+               if (len >= 2 + 16 * pmkid_count) {
+                       tab_on_first(&first);
+                       printf("\t * %d PMKIDs\n", pmkid_count);
+                       /* not printing PMKID values */
+                       data += 2 + 16 * pmkid_count;
+                       len -= 2 + 16 * pmkid_count;
+               } else
+                       goto invalid;
+       }
+
+       if (len >= 4) {
+               tab_on_first(&first);
+               printf("\t * Group mgmt cipher suite: ");
+               print_cipher(data);
+               printf("\n");
+               data += 4;
+               len -= 4;
+       }
+
  invalid:
        if (len != 0) {
                printf("\t\t * bogus tail data (%d):", len);
@@ -425,6 +538,51 @@ static void print_rsn(const uint8_t type, uint8_t len, const uint8_t *data)
        print_rsn_ie("CCMP", "IEEE 802.1X", len, data);
 }
 
+static void print_ht_capa(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+       printf("\n");
+       print_ht_capability(data[0] | (data[1] << 8));
+       print_ampdu_length(data[2] & 3);
+       print_ampdu_spacing((data[2] >> 2) & 7);
+       print_ht_mcs(data + 3);
+}
+
+static void print_ht_op(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+       static const char *offset[4] = {
+               "no secondary",
+               "above",
+               "[reserved!]",
+               "below",
+       };
+       static const char *protection[4] = {
+               "no",
+               "nonmember",
+               "20 MHz",
+               "non-HT mixed",
+       };
+       static const char *sta_chan_width[2] = {
+               "20 MHz",
+               "any",
+       };
+
+       printf("\n");
+       printf("\t\t * primary channel: %d\n", data[0]);
+       printf("\t\t * secondary channel offset: %s\n",
+               offset[data[1] & 0x3]);
+       printf("\t\t * STA channel width: %s\n", sta_chan_width[(data[1] & 0x4)>>2]);
+       printf("\t\t * RIFS: %d\n", (data[1] & 0x8)>>3);
+       printf("\t\t * HT protection: %s\n", protection[data[2] & 0x3]);
+       printf("\t\t * non-GF present: %d\n", (data[2] & 0x4) >> 2);
+       printf("\t\t * OBSS non-GF present: %d\n", (data[2] & 0x10) >> 4);
+       printf("\t\t * dual beacon: %d\n", (data[4] & 0x40) >> 6);
+       printf("\t\t * dual CTS protection: %d\n", (data[4] & 0x80) >> 7);
+       printf("\t\t * STBC beacon: %d\n", data[5] & 0x1);
+       printf("\t\t * L-SIG TXOP Prot: %d\n", (data[5] & 0x2) >> 1);
+       printf("\t\t * PCO active: %d\n", (data[5] & 0x4) >> 2);
+       printf("\t\t * PCO phase: %d\n", (data[5] & 0x8) >> 3);
+}
+
 static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *data)
 {
        int i, base, bit;
@@ -443,38 +601,76 @@ static void print_capabilities(const uint8_t type, uint8_t len, const uint8_t *d
                        else
                                first = false;
 
+#define CAPA(bit, name)                case bit: printf(" " name); break
+
                        switch (bit + base) {
-                       case 0:
-                               printf(" HT Information Exchange Supported");
-                               break;
-                       case 1:
-                               printf(" On-demand Beacon");
-                               break;
-                       case 2:
-                               printf(" Extended Channel Switching");
-                               break;
-                       case 3:
-                               printf(" Wave Indication");
-                               break;
-                       case 4:
-                               printf(" PSMP Capability");
-                               break;
-                       case 5:
-                               printf(" Service Interval Granularity");
-                               break;
-                       case 6:
-                               printf(" S-PSMP Capability");
-                               break;
+                       CAPA(0, "HT Information Exchange Supported");
+                       CAPA(1, "reserved (On-demand Beacon)");
+                       CAPA(2, "Extended Channel Switching");
+                       CAPA(3, "reserved (Wave Indication)");
+                       CAPA(4, "PSMP Capability");
+                       CAPA(5, "reserved (Service Interval Granularity)");
+                       CAPA(6, "S-PSMP Capability");
+                       CAPA(7, "Event");
+                       CAPA(8, "Diagnostics");
+                       CAPA(9, "Multicast Diagnostics");
+                       CAPA(10, "Location Tracking");
+                       CAPA(11, "FMS");
+                       CAPA(12, "Proxy ARP Service");
+                       CAPA(13, "Collocated Interference Reporting");
+                       CAPA(14, "Civic Location");
+                       CAPA(15, "Geospatial Location");
+                       CAPA(16, "TFS");
+                       CAPA(17, "WNM-Sleep Mode");
+                       CAPA(18, "TIM Broadcast");
+                       CAPA(19, "BSS Transition");
+                       CAPA(20, "QoS Traffic Capability");
+                       CAPA(21, "AC Station Count");
+                       CAPA(22, "Multiple BSSID");
+                       CAPA(23, "Timing Measurement");
+                       CAPA(24, "Channel Usage");
+                       CAPA(25, "SSID List");
+                       CAPA(26, "DMS");
+                       CAPA(27, "UTC TSF Offset");
+                       CAPA(28, "TDLS Peer U-APSD Buffer STA Support");
+                       CAPA(29, "TDLS Peer PSM Support");
+                       CAPA(30, "TDLS channel switching");
+                       CAPA(31, "Interworking");
+                       CAPA(32, "QoS Map");
+                       CAPA(33, "EBR");
+                       CAPA(34, "SSPN Interface");
+                       CAPA(35, "Reserved");
+                       CAPA(36, "MSGCF Capability");
+                       CAPA(37, "TDLS Support");
+                       CAPA(38, "TDLS Prohibited");
+                       CAPA(39, "TDLS Channel Switching Prohibited");
+                       CAPA(40, "Reject Unadmitted Frame");
+                       CAPA(44, "Identifier Location");
+                       CAPA(45, "U-APSD Coexistence");
+                       CAPA(46, "WNM-Notification");
+                       CAPA(47, "Reserved");
+                       CAPA(48, "UTF-8 SSID");
                        default:
                                printf(" %d", bit);
                                break;
                        }
+#undef CAPA
                }
        }
 
        printf("\n");
 }
 
+static void print_tim(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+       printf(" DTIM Count %u DTIM Period %u Bitmap Control 0x%x "
+              "Bitmap[0] 0x%x",
+              data[0], data[1], data[2], data[3]);
+       if (len - 4)
+               printf(" (+ %u octet%s)", len - 4, len - 4 == 1 ? "" : "s");
+       printf("\n");
+}
+
 struct ie_print {
        const char *name;
        void (*print)(const uint8_t type, uint8_t len, const uint8_t *data);
@@ -517,13 +713,16 @@ static void print_ie(const struct ie_print *p, const uint8_t type,
 static const struct ie_print ieprinters[] = {
        [0] = { "SSID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
        [1] = { "Supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
-       [3] = { "DS Paramater set", print_ds, 1, 1, BIT(PRINT_SCAN), },
-       [5] = PRINT_IGN,
+       [3] = { "DS Parameter set", print_ds, 1, 1, BIT(PRINT_SCAN), },
+       [5] = { "TIM", print_tim, 4, 255, BIT(PRINT_SCAN), },
        [7] = { "Country", print_country, 3, 255, BIT(PRINT_SCAN), },
        [32] = { "Power constraint", print_powerconstraint, 1, 1, BIT(PRINT_SCAN), },
        [42] = { "ERP", print_erp, 1, 255, BIT(PRINT_SCAN), },
+       [45] = { "HT capabilities", print_ht_capa, 26, 26, BIT(PRINT_SCAN), },
+       [61] = { "HT operation", print_ht_op, 22, 22, BIT(PRINT_SCAN), },
        [48] = { "RSN", print_rsn, 2, 255, BIT(PRINT_SCAN), },
        [50] = { "Extended supported rates", print_supprates, 0, 255, BIT(PRINT_SCAN), },
+       [114] = { "MESH ID", print_ssid, 0, 32, BIT(PRINT_SCAN) | BIT(PRINT_LINK), },
        [127] = { "Extended capabilities", print_capabilities, 0, 255, BIT(PRINT_SCAN), },
 };
 
@@ -541,27 +740,28 @@ static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
                goto invalid;
 
        if (data[0] != 1) {
-               printf("not version 1: ");
+               printf("Parameter: not version 1: ");
                return false;
        }
 
-       printf("\t* Version 1");
+       printf("\t * Parameter version 1");
 
        data++;
 
        if (data[0] & 0x80)
-               printf("\n\t\t* u-APSD");
+               printf("\n\t\t * u-APSD");
 
        data += 2;
 
        for (i = 0; i < 4; i++) {
-               printf("\n\t\t* %s:", aci_tbl[(data[0] >> 5) & 3]);
-               if (data[4] & 0x10)
+               printf("\n\t\t * %s:", aci_tbl[(data[0] >> 5) & 3]);
+               if (data[0] & 0x10)
                        printf(" acm");
                printf(" CW %d-%d", (1 << (data[1] & 0xf)) - 1,
                                    (1 << (data[1] >> 4)) - 1);
+               printf(", AIFSN %d", data[0] & 0xf);
                if (data[2] | data[3])
-                       printf(", TXOP %d", (data[2] + (data[3] << 8)) * 32);
+                       printf(", TXOP %d usec", (data[2] + (data[3] << 8)) * 32);
                data += 4;
        }
 
@@ -595,6 +795,26 @@ static void print_wifi_wmm(const uint8_t type, uint8_t len, const uint8_t *data)
        printf("\n");
 }
 
+static const char * wifi_wps_dev_passwd_id(uint16_t id)
+{
+       switch (id) {
+       case 0:
+               return "Default (PIN)";
+       case 1:
+               return "User-specified";
+       case 2:
+               return "Machine-specified";
+       case 3:
+               return "Rekey";
+       case 4:
+               return "PushButton";
+       case 5:
+               return "Registrar-specified";
+       default:
+               return "??";
+       }
+}
+
 static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
 {
        bool first = true;
@@ -615,6 +835,19 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
                        tab_on_first(&first);
                        printf("\t * Device name: %.*s\n", sublen, data + 4);
                        break;
+               case 0x1012: {
+                       uint16_t id;
+                       tab_on_first(&first);
+                       if (sublen != 2) {
+                               printf("\t * Device Password ID: (invalid "
+                                      "length %d)\n", sublen);
+                               break;
+                       }
+                       id = data[4] << 8 | data[5];
+                       printf("\t * Device Password ID: %u (%s)\n",
+                              id, wifi_wps_dev_passwd_id(id));
+                       break;
+               }
                case 0x1021:
                        tab_on_first(&first);
                        printf("\t * Manufacturer: %.*s\n", sublen, data + 4);
@@ -623,17 +856,83 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
                        tab_on_first(&first);
                        printf("\t * Model: %.*s\n", sublen, data + 4);
                        break;
+               case 0x1024:
+                       tab_on_first(&first);
+                       printf("\t * Model Number: %.*s\n", sublen, data + 4);
+                       break;
+               case 0x103b: {
+                       __u8 val = data[4];
+                       tab_on_first(&first);
+                       printf("\t * Response Type: %d%s\n",
+                              val, val == 3 ? " (AP)" : "");
+                       break;
+               }
+               case 0x103c: {
+                       __u8 val = data[4];
+                       tab_on_first(&first);
+                       printf("\t * RF Bands: 0x%x\n", val);
+                       break;
+               }
+               case 0x1041: {
+                       __u8 val = data[4];
+                       tab_on_first(&first);
+                       printf("\t * Selected Registrar: 0x%x\n", val);
+                       break;
+               }
+               case 0x1042:
+                       tab_on_first(&first);
+                       printf("\t * Serial Number: %.*s\n", sublen, data + 4);
+                       break;
+               case 0x1044: {
+                       __u8 val = data[4];
+                       tab_on_first(&first);
+                       printf("\t * Wi-Fi Protected Setup State: %d%s%s\n",
+                              val,
+                              val == 1 ? " (Unconfigured)" : "",
+                              val == 2 ? " (Configured)" : "");
+                       break;
+               }
+               case 0x1047:
+                       tab_on_first(&first);
+                       printf("\t * UUID: ");
+                       if (sublen != 16) {
+                               printf("(invalid, length=%d)\n", sublen);
+                               break;
+                       }
+                       printf("%02x%02x%02x%02x-%02x%02x-%02x%02x-"
+                               "%02x%02x-%02x%02x%02x%02x%02x%02x\n",
+                               data[4], data[5], data[6], data[7],
+                               data[8], data[9], data[10], data[11],
+                               data[12], data[13], data[14], data[15],
+                               data[16], data[17], data[18], data[19]);
+                       break;
+               case 0x1054: {
+                       tab_on_first(&first);
+                       if (sublen != 8) {
+                               printf("\t * Primary Device Type: (invalid "
+                                      "length %d)\n", sublen);
+                               break;
+                       }
+                       printf("\t * Primary Device Type: "
+                              "%u-%02x%02x%02x%02x-%u\n",
+                              data[4] << 8 | data[5],
+                              data[6], data[7], data[8], data[9],
+                              data[10] << 8 | data[11]);
+                       break;
+               }
                case 0x1057: {
                        __u8 val = data[4];
                        tab_on_first(&first);
                        printf("\t * AP setup locked: 0x%.2x\n", val);
                        break;
                }
-               case 0x1008: {
+               case 0x1008:
+               case 0x1053: {
                        __u16 meth = (data[4] << 8) + data[5];
                        bool comma = false;
                        tab_on_first(&first);
-                       printf("\t * Config methods:");
+                       printf("\t * %sConfig methods:",
+                              subtype == 0x1053 ? "Selected Registrar ": "");
 #define T(bit, name) do {              \
        if (meth & (1<<bit)) {          \
                if (comma)              \
@@ -654,9 +953,22 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data)
                        break;
 #undef T
                }
-               default:
+               default: {
+                       const __u8 *subdata = data + 4;
+                       __u16 tmplen = sublen;
+
+                       tab_on_first(&first);
+                       printf("\t * Unknown TLV (%#.4x, %d bytes):",
+                              subtype, tmplen);
+                       while (tmplen) {
+                               printf(" %.2x", *subdata);
+                               subdata++;
+                               tmplen--;
+                       }
+                       printf("\n");
                        break;
                }
+               }
 
                data += sublen + 4;
                len -= sublen + 4;
@@ -679,6 +991,90 @@ static const struct ie_print wifiprinters[] = {
        [4] = { "WPS", print_wifi_wps, 0, 255, BIT(PRINT_SCAN), },
 };
 
+static inline void print_p2p(const uint8_t type, uint8_t len, const uint8_t *data)
+{
+       bool first = true;
+       __u8 subtype;
+       __u16 sublen;
+
+       while (len >= 3) {
+               subtype = data[0];
+               sublen = (data[2] << 8) + data[1];
+
+               if (sublen > len - 3)
+                       break;
+
+               switch (subtype) {
+               case 0x02: /* capability */
+                       tab_on_first(&first);
+                       if (sublen < 2) {
+                               printf("\t * malformed capability\n");
+                               break;
+                       }
+                       printf("\t * Group capa: 0x%.2x, Device capa: 0x%.2x\n",
+                               data[3], data[4]);
+                       break;
+               case 0x0d: /* device info */
+                       if (sublen < 6 + 2 + 8 + 1) {
+                               printf("\t * malformed device info\n");
+                               break;
+                       }
+                       /* fall through for now */
+               case 0x00: /* status */
+               case 0x01: /* minor reason */
+               case 0x03: /* device ID */
+               case 0x04: /* GO intent */
+               case 0x05: /* configuration timeout */
+               case 0x06: /* listen channel */
+               case 0x07: /* group BSSID */
+               case 0x08: /* ext listen timing */
+               case 0x09: /* intended interface address */
+               case 0x0a: /* manageability */
+               case 0x0b: /* channel list */
+               case 0x0c: /* NoA */
+               case 0x0e: /* group info */
+               case 0x0f: /* group ID */
+               case 0x10: /* interface */
+               case 0x11: /* operating channel */
+               case 0x12: /* invitation flags */
+               case 0xdd: /* vendor specific */
+               default: {
+                       const __u8 *subdata = data + 4;
+                       __u16 tmplen = sublen;
+
+                       tab_on_first(&first);
+                       printf("\t * Unknown TLV (%#.2x, %d bytes):",
+                              subtype, tmplen);
+                       while (tmplen) {
+                               printf(" %.2x", *subdata);
+                               subdata++;
+                               tmplen--;
+                       }
+                       printf("\n");
+                       break;
+               }
+               }
+
+               data += sublen + 3;
+               len -= sublen + 3;
+       }
+
+       if (len != 0) {
+               tab_on_first(&first);
+               printf("\t * bogus tail data (%d):", len);
+               while (len) {
+                       printf(" %.2x", *data);
+                       data++;
+                       len--;
+               }
+               printf("\n");
+       }
+}
+
+static const struct ie_print wfa_printers[] = {
+       [9] = { "P2P", print_p2p, 2, 255, BIT(PRINT_SCAN), },
+};
+
 static void print_vendor(unsigned char len, unsigned char *data,
                         bool unknown, enum print_ie_type ptype)
 {
@@ -692,7 +1088,7 @@ static void print_vendor(unsigned char len, unsigned char *data,
                return;
        }
 
-       if (len >= 4 && memcmp(data, wifi_oui, 3) == 0) {
+       if (len >= 4 && memcmp(data, ms_oui, 3) == 0) {
                if (data[3] < ARRAY_SIZE(wifiprinters) &&
                    wifiprinters[data[3]].name &&
                    wifiprinters[data[3]].flags & BIT(ptype)) {
@@ -701,7 +1097,23 @@ static void print_vendor(unsigned char len, unsigned char *data,
                }
                if (!unknown)
                        return;
-               printf("\tWiFi OUI %#.2x, data:", data[3]);
+               printf("\tMS/WiFi %#.2x, data:", data[3]);
+               for(i = 0; i < len - 4; i++)
+                       printf(" %.02x", data[i + 4]);
+               printf("\n");
+               return;
+       }
+
+       if (len >= 4 && memcmp(data, wfa_oui, 3) == 0) {
+               if (data[3] < ARRAY_SIZE(wfa_printers) &&
+                   wfa_printers[data[3]].name &&
+                   wfa_printers[data[3]].flags & BIT(ptype)) {
+                       print_ie(&wfa_printers[data[3]], data[3], len - 4, data + 4);
+                       return;
+               }
+               if (!unknown)
+                       return;
+               printf("\tWFA %#.2x, data:", data[3]);
                for(i = 0; i < len - 4; i++)
                        printf(" %.02x", data[i + 4]);
                printf("\n");
@@ -757,20 +1169,23 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
                [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
                [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
                [NL80211_BSS_STATUS] = { .type = NLA_U32 },
+               [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
+               [NL80211_BSS_BEACON_IES] = { },
        };
        struct scan_params *params = arg;
+       int show = params->show_both_ie_sets ? 2 : 1;
 
        nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
                  genlmsg_attrlen(gnlh, 0), NULL);
 
        if (!tb[NL80211_ATTR_BSS]) {
-               fprintf(stderr, "bss info missing!");
+               fprintf(stderr, "bss info missing!\n");
                return NL_SKIP;
        }
        if (nla_parse_nested(bss, NL80211_BSS_MAX,
                             tb[NL80211_ATTR_BSS],
                             bss_policy)) {
-               fprintf(stderr, "failed to parse nested attributes!");
+               fprintf(stderr, "failed to parse nested attributes!\n");
                return NL_SKIP;
        }
 
@@ -848,10 +1263,25 @@ static int print_bss_handler(struct nl_msg *msg, void *arg)
                unsigned char s = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
                printf("\tsignal: %d/100\n", s);
        }
-       if (bss[NL80211_BSS_INFORMATION_ELEMENTS])
+       if (bss[NL80211_BSS_SEEN_MS_AGO]) {
+               int age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
+               printf("\tlast seen: %d ms ago\n", age);
+       }
+
+       if (bss[NL80211_BSS_INFORMATION_ELEMENTS] && show--) {
+               if (bss[NL80211_BSS_BEACON_IES])
+                       printf("\tInformation elements from Probe Response "
+                              "frame:\n");
                print_ies(nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
                          nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]),
                          params->unknown, params->type);
+       }
+       if (bss[NL80211_BSS_BEACON_IES] && show--) {
+               printf("\tInformation elements from Beacon frame:\n");
+               print_ies(nla_data(bss[NL80211_BSS_BEACON_IES]),
+                         nla_len(bss[NL80211_BSS_BEACON_IES]),
+                         params->unknown, params->type);
+       }
 
        return NL_SKIP;
 }
@@ -861,14 +1291,18 @@ static struct scan_params scan_params;
 static int handle_scan_dump(struct nl80211_state *state,
                            struct nl_cb *cb,
                            struct nl_msg *msg,
-                           int argc, char **argv)
+                           int argc, char **argv,
+                           enum id_input id)
 {
        if (argc > 1)
                return 1;
 
-       scan_params.unknown = false;
+       memset(&scan_params, 0, sizeof(scan_params));
+
        if (argc == 1 && !strcmp(argv[0], "-u"))
                scan_params.unknown = true;
+       else if (argc == 1 && !strcmp(argv[0], "-b"))
+               scan_params.show_both_ie_sets = true;
 
        scan_params.type = PRINT_SCAN;
 
@@ -876,15 +1310,12 @@ static int handle_scan_dump(struct nl80211_state *state,
                  &scan_params);
        return 0;
 }
-COMMAND(scan, dump, "[-u]",
-       NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
-       "Dump the current scan results. If -u is specified, print unknown\n"
-       "data in scan results.");
 
 static int handle_scan_combined(struct nl80211_state *state,
                                struct nl_cb *cb,
                                struct nl_msg *msg,
-                               int argc, char **argv)
+                               int argc, char **argv,
+                               enum id_input id)
 {
        char **trig_argv;
        static char *dump_argv[] = {
@@ -902,6 +1333,9 @@ static int handle_scan_combined(struct nl80211_state *state,
        if (argc >= 3 && !strcmp(argv[2], "-u")) {
                dump_argc = 4;
                dump_argv[3] = "-u";
+       } else if (argc >= 3 && !strcmp(argv[2], "-b")) {
+               dump_argc = 4;
+               dump_argv[3] = "-b";
        } else
                dump_argc = 3;
 
@@ -915,7 +1349,7 @@ static int handle_scan_combined(struct nl80211_state *state,
        int i;
        for (i = 0; i < argc - 2 - (dump_argc - 3); i++)
                trig_argv[i + 3] = argv[i + 2 + (dump_argc - 3)];
-       err = handle_cmd(state, II_NETDEV, trig_argc, trig_argv);
+       err = handle_cmd(state, id, trig_argc, trig_argv);
        free(trig_argv);
        if (err)
                return err;
@@ -951,10 +1385,19 @@ static int handle_scan_combined(struct nl80211_state *state,
        }
 
        dump_argv[0] = argv[0];
-       return handle_cmd(state, II_NETDEV, dump_argc, dump_argv);
+       return handle_cmd(state, id, dump_argc, dump_argv);
 }
-TOPLEVEL(scan, "[-u] [freq <freq>*] [ssid <ssid>*|passive]", 0, 0,
+TOPLEVEL(scan, "[-u] [freq <freq>*] [ies <hex as 00:11:..>] [lowpri,flush,ap-force] [ssid <ssid>*|passive]", 0, 0,
         CIB_NETDEV, handle_scan_combined,
         "Scan on the given frequencies and probe for the given SSIDs\n"
         "(or wildcard if not given) unless passive scanning is requested.\n"
-        "If -u is specified print unknown data in the scan results.");
+        "If -u is specified print unknown data in the scan results.\n"
+        "Specified (vendor) IEs must be well-formed.");
+COMMAND(scan, dump, "[-u]",
+       NL80211_CMD_GET_SCAN, NLM_F_DUMP, CIB_NETDEV, handle_scan_dump,
+       "Dump the current scan results. If -u is specified, print unknown\n"
+       "data in scan results.");
+COMMAND(scan, trigger, "[freq <freq>*] [ies <hex as 00:11:..>] [lowpri,flush,ap-force] [ssid <ssid>*|passive]",
+       NL80211_CMD_TRIGGER_SCAN, 0, CIB_NETDEV, handle_scan,
+        "Trigger a scan on the given frequencies with probing for the given\n"
+        "SSIDs (or wildcard if not given) unless passive scanning is requested.");