]> git.ipfire.org Git - thirdparty/iw.git/blobdiff - util.c
iw: scan: fix buffer over-read in print_wifi_wps
[thirdparty/iw.git] / util.c
diff --git a/util.c b/util.c
index 833b1ce086f17a84e1df844e6c1e9e64dcbc4625..886fef2b5e2c8ecdc9d40b620ea18cef11399167 100644 (file)
--- a/util.c
+++ b/util.c
@@ -5,7 +5,7 @@
 #include "iw.h"
 #include "nl80211.h"
 
-void mac_addr_n2a(char *mac_addr, unsigned char *arg)
+void mac_addr_n2a(char *mac_addr, const unsigned char *arg)
 {
        int i, l;
 
@@ -148,129 +148,7 @@ const char *iftype_name(enum nl80211_iftype iftype)
 }
 
 static const char *commands[NL80211_CMD_MAX + 1] = {
-/*
- * sed 's%^\tNL80211_CMD_%%;t n;d;:n s%^\([^=]*\),.*%\t[NL80211_CMD_\1] = \"\L\1\",%;t;d' nl80211.h | grep -v "reserved"
- */
-       [NL80211_CMD_UNSPEC] = "unspec",
-       [NL80211_CMD_GET_WIPHY] = "get_wiphy",
-       [NL80211_CMD_SET_WIPHY] = "set_wiphy",
-       [NL80211_CMD_NEW_WIPHY] = "new_wiphy",
-       [NL80211_CMD_DEL_WIPHY] = "del_wiphy",
-       [NL80211_CMD_GET_INTERFACE] = "get_interface",
-       [NL80211_CMD_SET_INTERFACE] = "set_interface",
-       [NL80211_CMD_NEW_INTERFACE] = "new_interface",
-       [NL80211_CMD_DEL_INTERFACE] = "del_interface",
-       [NL80211_CMD_GET_KEY] = "get_key",
-       [NL80211_CMD_SET_KEY] = "set_key",
-       [NL80211_CMD_NEW_KEY] = "new_key",
-       [NL80211_CMD_DEL_KEY] = "del_key",
-       [NL80211_CMD_GET_BEACON] = "get_beacon",
-       [NL80211_CMD_SET_BEACON] = "set_beacon",
-       [NL80211_CMD_START_AP] = "start_ap",
-       [NL80211_CMD_STOP_AP] = "stop_ap",
-       [NL80211_CMD_GET_STATION] = "get_station",
-       [NL80211_CMD_SET_STATION] = "set_station",
-       [NL80211_CMD_NEW_STATION] = "new_station",
-       [NL80211_CMD_DEL_STATION] = "del_station",
-       [NL80211_CMD_GET_MPATH] = "get_mpath",
-       [NL80211_CMD_SET_MPATH] = "set_mpath",
-       [NL80211_CMD_NEW_MPATH] = "new_mpath",
-       [NL80211_CMD_DEL_MPATH] = "del_mpath",
-       [NL80211_CMD_SET_BSS] = "set_bss",
-       [NL80211_CMD_SET_REG] = "set_reg",
-       [NL80211_CMD_REQ_SET_REG] = "req_set_reg",
-       [NL80211_CMD_GET_MESH_CONFIG] = "get_mesh_config",
-       [NL80211_CMD_SET_MESH_CONFIG] = "set_mesh_config",
-       [NL80211_CMD_GET_REG] = "get_reg",
-       [NL80211_CMD_GET_SCAN] = "get_scan",
-       [NL80211_CMD_TRIGGER_SCAN] = "trigger_scan",
-       [NL80211_CMD_NEW_SCAN_RESULTS] = "new_scan_results",
-       [NL80211_CMD_SCAN_ABORTED] = "scan_aborted",
-       [NL80211_CMD_REG_CHANGE] = "reg_change",
-       [NL80211_CMD_AUTHENTICATE] = "authenticate",
-       [NL80211_CMD_ASSOCIATE] = "associate",
-       [NL80211_CMD_DEAUTHENTICATE] = "deauthenticate",
-       [NL80211_CMD_DISASSOCIATE] = "disassociate",
-       [NL80211_CMD_MICHAEL_MIC_FAILURE] = "michael_mic_failure",
-       [NL80211_CMD_REG_BEACON_HINT] = "reg_beacon_hint",
-       [NL80211_CMD_JOIN_IBSS] = "join_ibss",
-       [NL80211_CMD_LEAVE_IBSS] = "leave_ibss",
-       [NL80211_CMD_TESTMODE] = "testmode",
-       [NL80211_CMD_CONNECT] = "connect",
-       [NL80211_CMD_ROAM] = "roam",
-       [NL80211_CMD_DISCONNECT] = "disconnect",
-       [NL80211_CMD_SET_WIPHY_NETNS] = "set_wiphy_netns",
-       [NL80211_CMD_GET_SURVEY] = "get_survey",
-       [NL80211_CMD_NEW_SURVEY_RESULTS] = "new_survey_results",
-       [NL80211_CMD_SET_PMKSA] = "set_pmksa",
-       [NL80211_CMD_DEL_PMKSA] = "del_pmksa",
-       [NL80211_CMD_FLUSH_PMKSA] = "flush_pmksa",
-       [NL80211_CMD_REMAIN_ON_CHANNEL] = "remain_on_channel",
-       [NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL] = "cancel_remain_on_channel",
-       [NL80211_CMD_SET_TX_BITRATE_MASK] = "set_tx_bitrate_mask",
-       [NL80211_CMD_REGISTER_FRAME] = "register_frame",
-       [NL80211_CMD_FRAME] = "frame",
-       [NL80211_CMD_FRAME_TX_STATUS] = "frame_tx_status",
-       [NL80211_CMD_SET_POWER_SAVE] = "set_power_save",
-       [NL80211_CMD_GET_POWER_SAVE] = "get_power_save",
-       [NL80211_CMD_SET_CQM] = "set_cqm",
-       [NL80211_CMD_NOTIFY_CQM] = "notify_cqm",
-       [NL80211_CMD_SET_CHANNEL] = "set_channel",
-       [NL80211_CMD_SET_WDS_PEER] = "set_wds_peer",
-       [NL80211_CMD_FRAME_WAIT_CANCEL] = "frame_wait_cancel",
-       [NL80211_CMD_JOIN_MESH] = "join_mesh",
-       [NL80211_CMD_LEAVE_MESH] = "leave_mesh",
-       [NL80211_CMD_UNPROT_DEAUTHENTICATE] = "unprot_deauthenticate",
-       [NL80211_CMD_UNPROT_DISASSOCIATE] = "unprot_disassociate",
-       [NL80211_CMD_NEW_PEER_CANDIDATE] = "new_peer_candidate",
-       [NL80211_CMD_GET_WOWLAN] = "get_wowlan",
-       [NL80211_CMD_SET_WOWLAN] = "set_wowlan",
-       [NL80211_CMD_START_SCHED_SCAN] = "start_sched_scan",
-       [NL80211_CMD_STOP_SCHED_SCAN] = "stop_sched_scan",
-       [NL80211_CMD_SCHED_SCAN_RESULTS] = "sched_scan_results",
-       [NL80211_CMD_SCHED_SCAN_STOPPED] = "sched_scan_stopped",
-       [NL80211_CMD_SET_REKEY_OFFLOAD] = "set_rekey_offload",
-       [NL80211_CMD_PMKSA_CANDIDATE] = "pmksa_candidate",
-       [NL80211_CMD_TDLS_OPER] = "tdls_oper",
-       [NL80211_CMD_TDLS_MGMT] = "tdls_mgmt",
-       [NL80211_CMD_UNEXPECTED_FRAME] = "unexpected_frame",
-       [NL80211_CMD_PROBE_CLIENT] = "probe_client",
-       [NL80211_CMD_REGISTER_BEACONS] = "register_beacons",
-       [NL80211_CMD_UNEXPECTED_4ADDR_FRAME] = "unexpected_4addr_frame",
-       [NL80211_CMD_SET_NOACK_MAP] = "set_noack_map",
-       [NL80211_CMD_CH_SWITCH_NOTIFY] = "ch_switch_notify",
-       [NL80211_CMD_START_P2P_DEVICE] = "start_p2p_device",
-       [NL80211_CMD_STOP_P2P_DEVICE] = "stop_p2p_device",
-       [NL80211_CMD_CONN_FAILED] = "conn_failed",
-       [NL80211_CMD_SET_MCAST_RATE] = "set_mcast_rate",
-       [NL80211_CMD_SET_MAC_ACL] = "set_mac_acl",
-       [NL80211_CMD_RADAR_DETECT] = "radar_detect",
-       [NL80211_CMD_GET_PROTOCOL_FEATURES] = "get_protocol_features",
-       [NL80211_CMD_UPDATE_FT_IES] = "update_ft_ies",
-       [NL80211_CMD_FT_EVENT] = "ft_event",
-       [NL80211_CMD_CRIT_PROTOCOL_START] = "crit_protocol_start",
-       [NL80211_CMD_CRIT_PROTOCOL_STOP] = "crit_protocol_stop",
-       [NL80211_CMD_GET_COALESCE] = "get_coalesce",
-       [NL80211_CMD_SET_COALESCE] = "set_coalesce",
-       [NL80211_CMD_CHANNEL_SWITCH] = "channel_switch",
-       [NL80211_CMD_VENDOR] = "vendor",
-       [NL80211_CMD_SET_QOS_MAP] = "set_qos_map",
-       [NL80211_CMD_ADD_TX_TS] = "add_tx_ts",
-       [NL80211_CMD_DEL_TX_TS] = "del_tx_ts",
-       [NL80211_CMD_GET_MPP] = "get_mpp",
-       [NL80211_CMD_JOIN_OCB] = "join_ocb",
-       [NL80211_CMD_LEAVE_OCB] = "leave_ocb",
-       [NL80211_CMD_CH_SWITCH_STARTED_NOTIFY] = "ch_switch_started_notify",
-       [NL80211_CMD_TDLS_CHANNEL_SWITCH] = "tdls_channel_switch",
-       [NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH] = "tdls_cancel_channel_switch",
-       [NL80211_CMD_WIPHY_REG_CHANGE] = "wiphy_reg_change",
-       [NL80211_CMD_ABORT_SCAN] = "abort_scan",
-       [NL80211_CMD_START_NAN] = "start_nan",
-       [NL80211_CMD_STOP_NAN] = "stop_nan",
-       [NL80211_CMD_ADD_NAN_FUNCTION] = "add_nan_function",
-       [NL80211_CMD_DEL_NAN_FUNCTION] = "del_nan_function",
-       [NL80211_CMD_CHANGE_NAN_CONFIG] = "change_nan_config",
-       [NL80211_CMD_NAN_MATCH] = "nan_match",
+#include "nl80211-commands.inc"
 };
 
 static char cmdbuf[100];
@@ -366,7 +244,7 @@ static int hex2byte(const char *hex)
        return (d1 << 4) | d2;
 }
 
-static char *hex2bin(const char *hex, char *buf)
+char *hex2bin(const char *hex, char *buf)
 {
        char *result = buf;
        int d;
@@ -383,16 +261,103 @@ static char *hex2bin(const char *hex, char *buf)
        return result;
 }
 
-int parse_keys(struct nl_msg *msg, char **argv, int argc)
+static int parse_akm_suite(const char *cipher_str)
+{
+
+       if (!strcmp(cipher_str, "PSK"))
+               return 0x000FAC02;
+       if (!strcmp(cipher_str, "FT/PSK"))
+               return 0x000FAC03;
+       if (!strcmp(cipher_str, "PSK/SHA-256"))
+               return 0x000FAC06;
+       return -EINVAL;
+}
+
+static int parse_cipher_suite(const char *cipher_str)
+{
+
+       if (!strcmp(cipher_str, "TKIP"))
+               return 0x000FAC02;
+       if (!strcmp(cipher_str, "CCMP") || !strcmp(cipher_str, "CCMP-128"))
+               return 0x000FAC04;
+       if (!strcmp(cipher_str, "GCMP") || !strcmp(cipher_str, "GCMP-128"))
+               return 0x000FAC08;
+       if (!strcmp(cipher_str, "GCMP-256"))
+               return 0x000FAC09;
+       if (!strcmp(cipher_str, "CCMP-256"))
+               return 0x000FAC0A;
+       return -EINVAL;
+}
+
+int parse_keys(struct nl_msg *msg, char **argv[], int *argc)
 {
        struct nlattr *keys;
        int i = 0;
        bool have_default = false;
+       char *arg = **argv;
        char keybuf[13];
+       int pos = 0;
 
-       if (!argc)
+       if (!*argc)
                return 1;
 
+       if (!memcmp(&arg[pos], "psk", 3)) {
+               char psk_keybuf[32];
+               int cipher_suite, akm_suite;
+
+               if (*argc < 4)
+                       goto explain;
+
+               pos+=3;
+               if (arg[pos] != ':')
+                       goto explain;
+               pos++;
+
+               NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, NL80211_WPA_VERSION_2);
+
+               if (strlen(&arg[pos]) != (sizeof(psk_keybuf) * 2) || !hex2bin(&arg[pos], psk_keybuf)) {
+                       printf("Bad PSK\n");
+                       return -EINVAL;
+               }
+
+               NLA_PUT(msg, NL80211_ATTR_PMK, 32, psk_keybuf);
+               NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, NL80211_AUTHTYPE_OPEN_SYSTEM);
+
+               *argv += 1;
+               *argc -= 1;
+               arg = **argv;
+
+               akm_suite = parse_akm_suite(arg);
+               if (akm_suite < 0)
+                       goto explain;
+
+               NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, akm_suite);
+
+               *argv += 1;
+               *argc -= 1;
+               arg = **argv;
+
+               cipher_suite = parse_cipher_suite(arg);
+               if (cipher_suite < 0)
+                       goto explain;
+
+               NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher_suite);
+
+               *argv += 1;
+               *argc -= 1;
+               arg = **argv;
+
+               cipher_suite = parse_cipher_suite(arg);
+               if (cipher_suite < 0)
+                       goto explain;
+
+               NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher_suite);
+
+               *argv += 1;
+               *argc -= 1;
+               return 0;
+       }
+
        NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
 
        keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
@@ -400,11 +365,13 @@ int parse_keys(struct nl_msg *msg, char **argv, int argc)
                return -ENOBUFS;
 
        do {
-               char *arg = *argv;
-               int pos = 0, keylen;
+               int keylen;
                struct nlattr *key = nla_nest_start(msg, ++i);
                char *keydata;
 
+               arg = **argv;
+               pos = 0;
+
                if (!key)
                        return -ENOBUFS;
 
@@ -425,12 +392,14 @@ int parse_keys(struct nl_msg *msg, char **argv, int argc)
                switch (strlen(keydata)) {
                case 10:
                        keydata = hex2bin(keydata, keybuf);
+                       /* fall through */
                case 5:
                        NLA_PUT_U32(msg, NL80211_KEY_CIPHER, 0x000FAC01);
                        keylen = 5;
                        break;
                case 26:
                        keydata = hex2bin(keydata, keybuf);
+                       /* fall through */
                case 13:
                        NLA_PUT_U32(msg, NL80211_KEY_CIPHER, 0x000FAC05);
                        keylen = 13;
@@ -444,15 +413,15 @@ int parse_keys(struct nl_msg *msg, char **argv, int argc)
 
                NLA_PUT(msg, NL80211_KEY_DATA, keylen, keydata);
 
-               argv++;
-               argc--;
+               *argv += 1;
+               *argc -= 1;
 
                /* one key should be TX key */
-               if (!have_default && !argc)
+               if (!have_default && !*argc)
                        NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
 
                nla_nest_end(msg, key);
-       } while (argc);
+       } while (*argc);
 
        nla_nest_end(msg, keys);
 
@@ -465,12 +434,16 @@ int parse_keys(struct nl_msg *msg, char **argv, int argc)
                        "  'index:' is a single digit (0-3)\n"
                        "  'data'   must be 5 or 13 ascii chars\n"
                        "           or 10 or 26 hex digits\n"
-                       "for example: d:2:6162636465 is the same as d:2:abcde\n");
+                       "for example: d:2:6162636465 is the same as d:2:abcde\n"
+                       "or psk:data <AKM Suite> <pairwise CIPHER> <groupwise CIPHER> where\n"
+                       "  'data' is the PSK (output of wpa_passphrase and the CIPHER can be CCMP or GCMP\n"
+                       "for example: psk:0123456789abcdef PSK CCMP CCMP\n"
+                       "The allowed AKM suites are PSK, FT/PSK, PSK/SHA-256\n"
+                       "The allowed Cipher suites are TKIP, CCMP, GCMP, GCMP-256, CCMP-256\n");
        return 2;
 }
 
-static int parse_freqs(struct chandef *chandef, int argc, char **argv,
-                      int *parsed)
+enum nl80211_chan_width str_to_bw(const char *str)
 {
        static const struct {
                const char *name;
@@ -484,48 +457,76 @@ static int parse_freqs(struct chandef *chandef, int argc, char **argv,
                { .name = "80+80", .val = NL80211_CHAN_WIDTH_80P80, },
                { .name = "160", .val = NL80211_CHAN_WIDTH_160, },
        };
+       unsigned int i;
+
+       for (i = 0; i < ARRAY_SIZE(bwmap); i++) {
+               if (strcasecmp(bwmap[i].name, str) == 0)
+                       return bwmap[i].val;
+       }
+
+       return NL80211_CHAN_WIDTH_20_NOHT;
+}
+
+static int parse_freqs(struct chandef *chandef, int argc, char **argv,
+                      int *parsed)
+{
        uint32_t freq;
-       unsigned int i, bwval = NL80211_CHAN_WIDTH_20_NOHT;
        char *end;
+       bool need_cf1 = false, need_cf2 = false;
 
        if (argc < 1)
                return 0;
 
-       for (i = 0; i < ARRAY_SIZE(bwmap); i++) {
-               if (strcasecmp(bwmap[i].name, argv[0]) == 0) {
-                       bwval = bwmap[i].val;
-                       *parsed += 1;
-                       break;
-               }
+       chandef->width = str_to_bw(argv[0]);
+
+       switch (chandef->width) {
+       case NL80211_CHAN_WIDTH_20_NOHT:
+               /* First argument was not understood, give up gracefully. */
+               return 0;
+       case NL80211_CHAN_WIDTH_20:
+       case NL80211_CHAN_WIDTH_5:
+       case NL80211_CHAN_WIDTH_10:
+               break;
+       case NL80211_CHAN_WIDTH_80P80:
+               need_cf2 = true;
+               /* fall through */
+       case NL80211_CHAN_WIDTH_40:
+       case NL80211_CHAN_WIDTH_80:
+       case NL80211_CHAN_WIDTH_160:
+               need_cf1 = true;
+               break;
        }
-       chandef->width = bwval;
 
-       /* First argument was not understood, give up gracefully. */
-       if (bwval == NL80211_CHAN_WIDTH_20_NOHT)
+       *parsed += 1;
+
+       if (!need_cf1)
                return 0;
 
        if (argc < 2)
-               return 0;
+               return 1;
 
        /* center freq 1 */
        if (!*argv[1])
-               return 0;
+               return 1;
        freq = strtoul(argv[1], &end, 10);
        if (*end)
-               return 0;
+               return 1;
        *parsed += 1;
 
        chandef->center_freq1 = freq;
 
-       if (argc < 3)
+       if (!need_cf2)
                return 0;
 
+       if (argc < 3)
+               return 1;
+
        /* center freq 2 */
        if (!*argv[2])
-               return 0;
+               return 1;
        freq = strtoul(argv[2], &end, 10);
        if (*end)
-               return 0;
+               return 1;
        chandef->center_freq2 = freq;
 
        *parsed += 1;
@@ -548,8 +549,11 @@ static int parse_freqs(struct chandef *chandef, int argc, char **argv,
  * arguments. argc/argv will be updated so that further arguments from the
  * command line can be parsed.
  *
- * Note that no integer argument may follow a frequency definition to allow the
- * user to skip the center frequency definition(s).
+ * Note that despite the fact that the function knows how many center freqs
+ * are needed, there's an ambiguity if the next argument after this is an
+ * integer argument, since the valid channel width values are interpreted
+ * as such, rather than a following argument. This can be avoided by the
+ * user by giving "NOHT" instead.
  *
  * The working specifier if chan is set are:
  *   <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]
@@ -961,6 +965,237 @@ void print_vht_info(__u32 capa, const __u8 *mcs)
        printf("\t\tVHT TX highest supported: %d Mbps\n", tmp & 0x1fff);
 }
 
+void print_he_info(struct nlattr *nl_iftype)
+{
+       struct nlattr *tb[NL80211_BAND_IFTYPE_ATTR_MAX + 1];
+       struct nlattr *tb_flags[NL80211_IFTYPE_MAX + 1];
+       char *iftypes[NUM_NL80211_IFTYPES] = {
+               "Unspec", "Adhoc", "Station", "AP", "AP/VLAN", "WDS", "Monitor",
+               "Mesh", "P2P/Client", "P2P/Go", "P2P/Device", "OCB", "NAN",
+       };
+       __u16 mac_cap[3] = { 0 };
+       __u16 phy_cap[6] = { 0 };
+       __u16 mcs_set[6] = { 0 };
+       __u8 ppet[25] = { 0 };
+       size_t len;
+       int i;
+
+       #define PRINT_HE_CAP(_var, _idx, _bit, _str) \
+       do { \
+               if (_var[_idx] & BIT(_bit)) \
+                       printf("\t\t\t\t" _str "\n"); \
+       } while (0)
+
+       #define PRINT_HE_CAP_MASK(_var, _idx, _shift, _mask, _str) \
+       do { \
+               if ((_var[_idx] >> _shift) & _mask) \
+                       printf("\t\t\t\t" _str ": %d\n", (_var[_idx] >> _shift) & _mask); \
+       } while (0)
+
+       #define PRINT_HE_MAC_CAP(...) PRINT_HE_CAP(mac_cap, __VA_ARGS__)
+       #define PRINT_HE_MAC_CAP_MASK(...) PRINT_HE_CAP_MASK(mac_cap, __VA_ARGS__)
+       #define PRINT_HE_PHY_CAP(...) PRINT_HE_CAP(phy_cap, __VA_ARGS__)
+       #define PRINT_HE_PHY_CAP0(_idx, _bit, ...) PRINT_HE_CAP(phy_cap, _idx, _bit + 8, __VA_ARGS__)
+       #define PRINT_HE_PHY_CAP_MASK(...) PRINT_HE_CAP_MASK(phy_cap, __VA_ARGS__)
+
+       nla_parse(tb, NL80211_BAND_IFTYPE_ATTR_MAX,
+                 nla_data(nl_iftype), nla_len(nl_iftype), NULL);
+
+       if (!tb[NL80211_BAND_IFTYPE_ATTR_IFTYPES])
+               return;
+
+       if (nla_parse_nested(tb_flags, NL80211_IFTYPE_MAX,
+                            tb[NL80211_BAND_IFTYPE_ATTR_IFTYPES], NULL))
+               return;
+
+       printf("\t\tHE Iftypes:");
+       for (i = 0; i < NUM_NL80211_IFTYPES; i++)
+               if (nla_get_flag(tb_flags[i]) && iftypes[i])
+                       printf(" %s", iftypes[i]);
+       printf("\n");
+
+       if (tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC]) {
+               len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC]);
+               if (len > sizeof(mac_cap))
+                       len = sizeof(mac_cap);
+               memcpy(mac_cap,
+                      nla_data(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC]),
+                      len);
+       }
+       printf("\t\t\tHE MAC Capabilities (0x");
+       for (i = 0; i < 3; i++)
+               printf("%04x", mac_cap[i]);
+       printf("):\n");
+
+       PRINT_HE_MAC_CAP(0, 0, "+HTC HE Supported");
+       PRINT_HE_MAC_CAP(0, 1, "TWT Requester");
+       PRINT_HE_MAC_CAP(0, 2, "TWT Responder");
+       PRINT_HE_MAC_CAP_MASK(0, 3, 0x3, "Dynamic BA Fragementation Level");
+       PRINT_HE_MAC_CAP_MASK(0, 5, 0x7, "Maximum number of MSDUS Fragments");
+       PRINT_HE_MAC_CAP_MASK(0, 8, 0x3, "Minimum Payload size of 128 bytes");
+       PRINT_HE_MAC_CAP_MASK(0, 10, 0x3, "Trigger Frame MAC Padding Duration");
+       PRINT_HE_MAC_CAP_MASK(0, 12, 0x7, "Multi-TID Aggregation Support");
+
+       PRINT_HE_MAC_CAP(1, 1, "All Ack");
+       PRINT_HE_MAC_CAP(1, 2, "TRS");
+       PRINT_HE_MAC_CAP(1, 3, "BSR");
+       PRINT_HE_MAC_CAP(1, 4, "Broadcast TWT");
+       PRINT_HE_MAC_CAP(1, 5, "32-bit BA Bitmap");
+       PRINT_HE_MAC_CAP(1, 6, "MU Cascading");
+       PRINT_HE_MAC_CAP(1, 7, "Ack-Enabled Aggregation");
+       PRINT_HE_MAC_CAP(1, 9, "OM Control");
+       PRINT_HE_MAC_CAP(1, 10, "OFDMA RA");
+       PRINT_HE_MAC_CAP_MASK(1, 11, 0x3, "Maximum A-MPDU Length Exponent");
+       PRINT_HE_MAC_CAP(1, 13, "A-MSDU Fragmentation");
+       PRINT_HE_MAC_CAP(1, 14, "Flexible TWT Scheduling");
+       PRINT_HE_MAC_CAP(1, 15, "RX Control Frame to MultiBSS");
+
+       PRINT_HE_MAC_CAP(2, 0, "BSRP BQRP A-MPDU Aggregation");
+       PRINT_HE_MAC_CAP(2, 1, "QTP");
+       PRINT_HE_MAC_CAP(2, 2, "BQR");
+       PRINT_HE_MAC_CAP(2, 3, "SRP Responder Role");
+       PRINT_HE_MAC_CAP(2, 4, "NDP Feedback Report");
+       PRINT_HE_MAC_CAP(2, 5, "OPS");
+       PRINT_HE_MAC_CAP(2, 6, "A-MSDU in A-MPDU");
+       PRINT_HE_MAC_CAP_MASK(2, 7, 7, "Multi-TID Aggregation TX");
+       PRINT_HE_MAC_CAP(2, 10, "HE Subchannel Selective Transmission");
+       PRINT_HE_MAC_CAP(2, 11, "UL 2x996-Tone RU");
+       PRINT_HE_MAC_CAP(2, 12, "OM Control UL MU Data Disable RX");
+
+       if (tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY]) {
+               len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY]);
+
+               if (len > sizeof(phy_cap) - 1)
+                       len = sizeof(phy_cap) - 1;
+               memcpy(&((__u8 *)phy_cap)[1],
+                      nla_data(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY]),
+                      len);
+       }
+       printf("\t\t\tHE PHY Capabilities: (0x");
+       for (i = 0; i < 11; i++)
+               printf("%02x", ((__u8 *)phy_cap)[i + 1]);
+       printf("):\n");
+
+       PRINT_HE_PHY_CAP0(0, 1, "HE40/2.4GHz");
+       PRINT_HE_PHY_CAP0(0, 2, "HE40/HE80/5GHz");
+       PRINT_HE_PHY_CAP0(0, 3, "HE160/5GHz");
+       PRINT_HE_PHY_CAP0(0, 4, "HE160/HE80+80/5GHz");
+       PRINT_HE_PHY_CAP0(0, 5, "242 tone RUs/2.4GHz");
+       PRINT_HE_PHY_CAP0(0, 6, "242 tone RUs/5GHz");
+
+       PRINT_HE_PHY_CAP_MASK(1, 0, 0xf, "Punctured Preamble RX");
+       PRINT_HE_PHY_CAP_MASK(1, 4, 0x1, "Device Class");
+       PRINT_HE_PHY_CAP(1, 5, "LDPC Coding in Payload");
+       PRINT_HE_PHY_CAP(1, 6, "HE SU PPDU with 1x HE-LTF and 0.8us GI");
+       PRINT_HE_PHY_CAP_MASK(1, 7, 0x3, "Midamble Rx Max NSTS");
+       PRINT_HE_PHY_CAP(1, 9, "NDP with 4x HE-LTF and 3.2us GI");
+       PRINT_HE_PHY_CAP(1, 10, "STBC Tx <= 80MHz");
+       PRINT_HE_PHY_CAP(1, 11, "STBC Rx <= 80MHz");
+       PRINT_HE_PHY_CAP(1, 12, "Doppler Tx");
+       PRINT_HE_PHY_CAP(1, 13, "Doppler Rx");
+       PRINT_HE_PHY_CAP(1, 14, "Full Bandwidth UL MU-MIMO");
+       PRINT_HE_PHY_CAP(1, 15, "Partial Bandwidth UL MU-MIMO");
+
+       PRINT_HE_PHY_CAP_MASK(2, 0, 0x3, "DCM Max Constellation");
+       PRINT_HE_PHY_CAP_MASK(2, 2, 0x1, "DCM Max NSS Tx");
+       PRINT_HE_PHY_CAP_MASK(2, 3, 0x3, "DCM Max Constellation Rx");
+       PRINT_HE_PHY_CAP_MASK(2, 5, 0x1, "DCM Max NSS Rx");
+       PRINT_HE_PHY_CAP(2, 6, "Rx HE MU PPDU from Non-AP STA");
+       PRINT_HE_PHY_CAP(2, 7, "SU Beamformer");
+       PRINT_HE_PHY_CAP(2, 8, "SU Beamformee");
+       PRINT_HE_PHY_CAP(2, 9, "MU Beamformer");
+       PRINT_HE_PHY_CAP_MASK(2, 10, 0x7, "Beamformee STS <= 80Mhz");
+       PRINT_HE_PHY_CAP_MASK(2, 13, 0x7, "Beamformee STS > 80Mhz");
+
+       PRINT_HE_PHY_CAP_MASK(3, 0, 0x7, "Sounding Dimensions <= 80Mhz");
+       PRINT_HE_PHY_CAP_MASK(3, 3, 0x7, "Sounding Dimensions > 80Mhz");
+       PRINT_HE_PHY_CAP(3, 6, "Ng = 16 SU Feedback");
+       PRINT_HE_PHY_CAP(3, 7, "Ng = 16 MU Feedback");
+       PRINT_HE_PHY_CAP(3, 8, "Codebook Size SU Feedback");
+       PRINT_HE_PHY_CAP(3, 9, "Codebook Size MU Feedback");
+       PRINT_HE_PHY_CAP(3, 10, "Triggered SU Beamforming Feedback");
+       PRINT_HE_PHY_CAP(3, 11, "Triggered MU Beamforming Feedback");
+       PRINT_HE_PHY_CAP(3, 12, "Triggered CQI Feedback");
+       PRINT_HE_PHY_CAP(3, 13, "Partial Bandwidth Extended Range");
+       PRINT_HE_PHY_CAP(3, 14, "Partial Bandwidth DL MU-MIMO");
+       PRINT_HE_PHY_CAP(3, 15, "PPE Threshold Present");
+
+       PRINT_HE_PHY_CAP(4, 0, "SRP-based SR");
+       PRINT_HE_PHY_CAP(4, 1, "Power Boost Factor ar");
+       PRINT_HE_PHY_CAP(4, 2, "HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI");
+       PRINT_HE_PHY_CAP_MASK(4, 3, 0x7, "Max NC");
+       PRINT_HE_PHY_CAP(4, 6, "STBC Tx > 80MHz");
+       PRINT_HE_PHY_CAP(4, 7, "STBC Rx > 80MHz");
+       PRINT_HE_PHY_CAP(4, 8, "HE ER SU PPDU 4x HE-LTF 0.8us GI");
+       PRINT_HE_PHY_CAP(4, 9, "20MHz in 40MHz HE PPDU 2.4GHz");
+       PRINT_HE_PHY_CAP(4, 10, "20MHz in 160/80+80MHz HE PPDU");
+       PRINT_HE_PHY_CAP(4, 11, "80MHz in 160/80+80MHz HE PPDU");
+       PRINT_HE_PHY_CAP(4, 12, "HE ER SU PPDU 1x HE-LTF 0.8us GI");
+       PRINT_HE_PHY_CAP(4, 13, "Midamble Rx 2x & 1x HE-LTF");
+       PRINT_HE_PHY_CAP_MASK(4, 14, 0x3, "DCM Max BW");
+
+       PRINT_HE_PHY_CAP(5, 0, "Longer Than 16HE SIG-B OFDM Symbols");
+       PRINT_HE_PHY_CAP(5, 1, "Non-Triggered CQI Feedback");
+       PRINT_HE_PHY_CAP(5, 2, "TX 1024-QAM");
+       PRINT_HE_PHY_CAP(5, 3, "RX 1024-QAM");
+       PRINT_HE_PHY_CAP(5, 4, "RX Full BW SU Using HE MU PPDU with Compression SIGB");
+       PRINT_HE_PHY_CAP(5, 5, "RX Full BW SU Using HE MU PPDU with Non-Compression SIGB");
+
+       if (tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET]) {
+               len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET]);
+               if (len > sizeof(mcs_set))
+                       len = sizeof(mcs_set);
+               memcpy(mcs_set,
+                      nla_data(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET]),
+                      len);
+       }
+
+       for (i = 0; i < 3; i++) {
+               __u8 phy_cap_support[] = { BIT(1) | BIT(2), BIT(3), BIT(4) };
+               char *bw[] = { "<= 80", "160", "80+80" };
+               int j;
+
+               if ((phy_cap[0] & (phy_cap_support[i] << 8)) == 0)
+                       continue;
+
+               for (j = 0; j < 2; j++) {
+                       int k;
+                       printf("\t\t\tHE %s MCS and NSS set %s MHz\n", j ? "TX" : "RX", bw[i]);
+                       for (k = 0; k < 8; k++) {
+                               __u16 mcs = mcs_set[(i * 2) + j];
+                               mcs >>= k * 2;
+                               mcs &= 0x3;
+                               printf("\t\t\t\t\t %d streams: ", k + 1);
+                               if (mcs == 3)
+                                       printf("not supported\n");
+                               else
+                                       printf("MCS 0-%d\n", 7 + (mcs * 2));
+                       }
+
+               }
+       }
+
+       len = 0;
+       if (tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE]) {
+               len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE]);
+               if (len > sizeof(ppet))
+                       len = sizeof(ppet);
+               memcpy(ppet,
+                      nla_data(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE]),
+                      len);
+       }
+
+       if (len && (phy_cap[3] & BIT(15))) {
+               size_t i;
+
+               printf("\t\t\tPPE Threshold ");
+               for (i = 0; i < len; i++)
+                       if (ppet[i])
+                               printf("0x%02x ", ppet[i]);
+               printf("\n");
+       }
+}
+
 void iw_hexdump(const char *prefix, const __u8 *buf, size_t size)
 {
        size_t i;
@@ -999,3 +1234,40 @@ int get_cf1(const struct chanmode *chanmode, unsigned long freq)
 
        return cf1;
 }
+
+int parse_random_mac_addr(struct nl_msg *msg, char *addrs)
+{
+       char *a_addr, *a_mask, *sep;
+       unsigned char addr[ETH_ALEN], mask[ETH_ALEN];
+
+       if (!*addrs) {
+               /* randomise all but the multicast bit */
+               NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN,
+                       "\x00\x00\x00\x00\x00\x00");
+               NLA_PUT(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
+                       "\x01\x00\x00\x00\x00\x00");
+               return 0;
+       }
+
+       if (*addrs != '=')
+               return 1;
+
+       addrs++;
+       sep = strchr(addrs, '/');
+       a_addr = addrs;
+
+       if (!sep)
+               return 1;
+
+       *sep = 0;
+       a_mask = sep + 1;
+       if (mac_addr_a2n(addr, a_addr) || mac_addr_a2n(mask, a_mask))
+               return 1;
+
+       NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+       NLA_PUT(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, mask);
+
+       return 0;
+ nla_put_failure:
+       return -ENOBUFS;
+}