wpa_supplicant/ctrl_iface.c

   1 /*
   2  * WPA Supplicant / Control interface (shared code for all backends)
   3  * Copyright (c) 2004-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10 #ifdef CONFIG_TESTING_OPTIONS
  11 #include <net/ethernet.h>
  12 #include <netinet/ip.h>
  13 #endif /* CONFIG_TESTING_OPTIONS */
  14
  15 #include "utils/common.h"
  16 #include "utils/eloop.h"
  17 #include "utils/uuid.h"
  18 #include "common/version.h"
  19 #include "common/ieee802_11_defs.h"
  20 #include "common/ieee802_11_common.h"
  21 #include "common/wpa_ctrl.h"
  22 #include "ap/hostapd.h"
  23 #include "eap_peer/eap.h"
  24 #include "eapol_supp/eapol_supp_sm.h"
  25 #include "rsn_supp/wpa.h"
  26 #include "rsn_supp/preauth.h"
  27 #include "rsn_supp/pmksa_cache.h"
  28 #include "l2_packet/l2_packet.h"
  29 #include "wps/wps.h"
  30 #include "config.h"
  31 #include "wpa_supplicant_i.h"
  32 #include "driver_i.h"
  33 #include "wps_supplicant.h"
  34 #include "ibss_rsn.h"
  35 #include "ap.h"
  36 #include "p2p_supplicant.h"
  37 #include "p2p/p2p.h"
  38 #include "hs20_supplicant.h"
  39 #include "wifi_display.h"
  40 #include "notify.h"
  41 #include "bss.h"
  42 #include "scan.h"
  43 #include "ctrl_iface.h"
  44 #include "interworking.h"
  45 #include "blacklist.h"
  46 #include "autoscan.h"
  47 #include "wnm_sta.h"
  48 #include "offchannel.h"
  49 #include "drivers/driver.h"
  50 #include "mesh.h"
  51
  52 static int wpa_supplicant_global_iface_list(struct wpa_global *global,
  53                                             char *buf, int len);
  54 static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
  55                                                   char *buf, int len);
  56 static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s,
  57                                         char *val);
  58
  59 static int set_bssid_filter(struct wpa_supplicant *wpa_s, char *val)
  60 {
  61         char *pos;
  62         u8 addr[ETH_ALEN], *filter = NULL, *n;
  63         size_t count = 0;
  64
  65         pos = val;
  66         while (pos) {
  67                 if (*pos == '\0')
  68                         break;
  69                 if (hwaddr_aton(pos, addr)) {
  70                         os_free(filter);
  71                         return -1;
  72                 }
  73                 n = os_realloc_array(filter, count + 1, ETH_ALEN);
  74                 if (n == NULL) {
  75                         os_free(filter);
  76                         return -1;
  77                 }
  78                 filter = n;
  79                 os_memcpy(filter + count * ETH_ALEN, addr, ETH_ALEN);
  80                 count++;
  81
  82                 pos = os_strchr(pos, ' ');
  83                 if (pos)
  84                         pos++;
  85         }
  86
  87         wpa_hexdump(MSG_DEBUG, "bssid_filter", filter, count * ETH_ALEN);
  88         os_free(wpa_s->bssid_filter);
  89         wpa_s->bssid_filter = filter;
  90         wpa_s->bssid_filter_count = count;
  91
  92         return 0;
  93 }
  94
  95
  96 static int set_disallow_aps(struct wpa_supplicant *wpa_s, char *val)
  97 {
  98         char *pos;
  99         u8 addr[ETH_ALEN], *bssid = NULL, *n;
 100         struct wpa_ssid_value *ssid = NULL, *ns;
 101         size_t count = 0, ssid_count = 0;
 102         struct wpa_ssid *c;
 103
 104         /*
 105          * disallow_list ::= <ssid_spec> | <bssid_spec> | <disallow_list> | ""
 106          * SSID_SPEC ::= ssid <SSID_HEX>
 107          * BSSID_SPEC ::= bssid <BSSID_HEX>
 108          */
 109
 110         pos = val;
 111         while (pos) {
 112                 if (*pos == '\0')
 113                         break;
 114                 if (os_strncmp(pos, "bssid ", 6) == 0) {
 115                         int res;
 116                         pos += 6;
 117                         res = hwaddr_aton2(pos, addr);
 118                         if (res < 0) {
 119                                 os_free(ssid);
 120                                 os_free(bssid);
 121                                 wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
 122                                            "BSSID value '%s'", pos);
 123                                 return -1;
 124                         }
 125                         pos += res;
 126                         n = os_realloc_array(bssid, count + 1, ETH_ALEN);
 127                         if (n == NULL) {
 128                                 os_free(ssid);
 129                                 os_free(bssid);
 130                                 return -1;
 131                         }
 132                         bssid = n;
 133                         os_memcpy(bssid + count * ETH_ALEN, addr, ETH_ALEN);
 134                         count++;
 135                 } else if (os_strncmp(pos, "ssid ", 5) == 0) {
 136                         char *end;
 137                         pos += 5;
 138
 139                         end = pos;
 140                         while (*end) {
 141                                 if (*end == '\0' || *end == ' ')
 142                                         break;
 143                                 end++;
 144                         }
 145
 146                         ns = os_realloc_array(ssid, ssid_count + 1,
 147                                               sizeof(struct wpa_ssid_value));
 148                         if (ns == NULL) {
 149                                 os_free(ssid);
 150                                 os_free(bssid);
 151                                 return -1;
 152                         }
 153                         ssid = ns;
 154
 155                         if ((end - pos) & 0x01 || end - pos > 2 * 32 ||
 156                             hexstr2bin(pos, ssid[ssid_count].ssid,
 157                                        (end - pos) / 2) < 0) {
 158                                 os_free(ssid);
 159                                 os_free(bssid);
 160                                 wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
 161                                            "SSID value '%s'", pos);
 162                                 return -1;
 163                         }
 164                         ssid[ssid_count].ssid_len = (end - pos) / 2;
 165                         wpa_hexdump_ascii(MSG_DEBUG, "disallow_aps SSID",
 166                                           ssid[ssid_count].ssid,
 167                                           ssid[ssid_count].ssid_len);
 168                         ssid_count++;
 169                         pos = end;
 170                 } else {
 171                         wpa_printf(MSG_DEBUG, "Unexpected disallow_aps value "
 172                                    "'%s'", pos);
 173                         os_free(ssid);
 174                         os_free(bssid);
 175                         return -1;
 176                 }
 177
 178                 pos = os_strchr(pos, ' ');
 179                 if (pos)
 180                         pos++;
 181         }
 182
 183         wpa_hexdump(MSG_DEBUG, "disallow_aps_bssid", bssid, count * ETH_ALEN);
 184         os_free(wpa_s->disallow_aps_bssid);
 185         wpa_s->disallow_aps_bssid = bssid;
 186         wpa_s->disallow_aps_bssid_count = count;
 187
 188         wpa_printf(MSG_DEBUG, "disallow_aps_ssid_count %d", (int) ssid_count);
 189         os_free(wpa_s->disallow_aps_ssid);
 190         wpa_s->disallow_aps_ssid = ssid;
 191         wpa_s->disallow_aps_ssid_count = ssid_count;
 192
 193         if (!wpa_s->current_ssid || wpa_s->wpa_state < WPA_AUTHENTICATING)
 194                 return 0;
 195
 196         c = wpa_s->current_ssid;
 197         if (c->mode != WPAS_MODE_INFRA && c->mode != WPAS_MODE_IBSS)
 198                 return 0;
 199
 200         if (!disallowed_bssid(wpa_s, wpa_s->bssid) &&
 201             !disallowed_ssid(wpa_s, c->ssid, c->ssid_len))
 202                 return 0;
 203
 204         wpa_printf(MSG_DEBUG, "Disconnect and try to find another network "
 205                    "because current AP was marked disallowed");
 206
 207 #ifdef CONFIG_SME
 208         wpa_s->sme.prev_bssid_set = 0;
 209 #endif /* CONFIG_SME */
 210         wpa_s->reassociate = 1;
 211         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 212         wpa_supplicant_req_scan(wpa_s, 0, 0);
 213
 214         return 0;
 215 }
 216
 217
 218 #ifndef CONFIG_NO_CONFIG_BLOBS
 219 static int wpas_ctrl_set_blob(struct wpa_supplicant *wpa_s, char *pos)
 220 {
 221         char *name = pos;
 222         struct wpa_config_blob *blob;
 223         size_t len;
 224
 225         pos = os_strchr(pos, ' ');
 226         if (pos == NULL)
 227                 return -1;
 228         *pos++ = '\0';
 229         len = os_strlen(pos);
 230         if (len & 1)
 231                 return -1;
 232
 233         wpa_printf(MSG_DEBUG, "CTRL: Set blob '%s'", name);
 234         blob = os_zalloc(sizeof(*blob));
 235         if (blob == NULL)
 236                 return -1;
 237         blob->name = os_strdup(name);
 238         blob->data = os_malloc(len / 2);
 239         if (blob->name == NULL || blob->data == NULL) {
 240                 wpa_config_free_blob(blob);
 241                 return -1;
 242         }
 243
 244         if (hexstr2bin(pos, blob->data, len / 2) < 0) {
 245                 wpa_printf(MSG_DEBUG, "CTRL: Invalid blob hex data");
 246                 wpa_config_free_blob(blob);
 247                 return -1;
 248         }
 249         blob->len = len / 2;
 250
 251         wpa_config_set_blob(wpa_s->conf, blob);
 252
 253         return 0;
 254 }
 255 #endif /* CONFIG_NO_CONFIG_BLOBS */
 256
 257
 258 static int wpas_ctrl_pno(struct wpa_supplicant *wpa_s, char *cmd)
 259 {
 260         char *params;
 261         char *pos;
 262         int *freqs = NULL;
 263         int ret;
 264
 265         if (atoi(cmd)) {
 266                 params = os_strchr(cmd, ' ');
 267                 os_free(wpa_s->manual_sched_scan_freqs);
 268                 if (params) {
 269                         params++;
 270                         pos = os_strstr(params, "freq=");
 271                         if (pos)
 272                                 freqs = freq_range_to_channel_list(wpa_s,
 273                                                                    pos + 5);
 274                 }
 275                 wpa_s->manual_sched_scan_freqs = freqs;
 276                 ret = wpas_start_pno(wpa_s);
 277         } else {
 278                 ret = wpas_stop_pno(wpa_s);
 279         }
 280         return ret;
 281 }
 282
 283
 284 static int wpa_supplicant_ctrl_iface_set(struct wpa_supplicant *wpa_s,
 285                                          char *cmd)
 286 {
 287         char *value;
 288         int ret = 0;
 289
 290         value = os_strchr(cmd, ' ');
 291         if (value == NULL)
 292                 return -1;
 293         *value++ = '\0';
 294
 295         wpa_printf(MSG_DEBUG, "CTRL_IFACE SET '%s'='%s'", cmd, value);
 296         if (os_strcasecmp(cmd, "EAPOL::heldPeriod") == 0) {
 297                 eapol_sm_configure(wpa_s->eapol,
 298                                    atoi(value), -1, -1, -1);
 299         } else if (os_strcasecmp(cmd, "EAPOL::authPeriod") == 0) {
 300                 eapol_sm_configure(wpa_s->eapol,
 301                                    -1, atoi(value), -1, -1);
 302         } else if (os_strcasecmp(cmd, "EAPOL::startPeriod") == 0) {
 303                 eapol_sm_configure(wpa_s->eapol,
 304                                    -1, -1, atoi(value), -1);
 305         } else if (os_strcasecmp(cmd, "EAPOL::maxStart") == 0) {
 306                 eapol_sm_configure(wpa_s->eapol,
 307                                    -1, -1, -1, atoi(value));
 308         } else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKLifetime") == 0) {
 309                 if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
 310                                      atoi(value)))
 311                         ret = -1;
 312         } else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKReauthThreshold") ==
 313                    0) {
 314                 if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
 315                                      atoi(value)))
 316                         ret = -1;
 317         } else if (os_strcasecmp(cmd, "dot11RSNAConfigSATimeout") == 0) {
 318                 if (wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT, atoi(value)))
 319                         ret = -1;
 320         } else if (os_strcasecmp(cmd, "wps_fragment_size") == 0) {
 321                 wpa_s->wps_fragment_size = atoi(value);
 322 #ifdef CONFIG_WPS_TESTING
 323         } else if (os_strcasecmp(cmd, "wps_version_number") == 0) {
 324                 long int val;
 325                 val = strtol(value, NULL, 0);
 326                 if (val < 0 || val > 0xff) {
 327                         ret = -1;
 328                         wpa_printf(MSG_DEBUG, "WPS: Invalid "
 329                                    "wps_version_number %ld", val);
 330                 } else {
 331                         wps_version_number = val;
 332                         wpa_printf(MSG_DEBUG, "WPS: Testing - force WPS "
 333                                    "version %u.%u",
 334                                    (wps_version_number & 0xf0) >> 4,
 335                                    wps_version_number & 0x0f);
 336                 }
 337         } else if (os_strcasecmp(cmd, "wps_testing_dummy_cred") == 0) {
 338                 wps_testing_dummy_cred = atoi(value);
 339                 wpa_printf(MSG_DEBUG, "WPS: Testing - dummy_cred=%d",
 340                            wps_testing_dummy_cred);
 341         } else if (os_strcasecmp(cmd, "wps_corrupt_pkhash") == 0) {
 342                 wps_corrupt_pkhash = atoi(value);
 343                 wpa_printf(MSG_DEBUG, "WPS: Testing - wps_corrupt_pkhash=%d",
 344                            wps_corrupt_pkhash);
 345 #endif /* CONFIG_WPS_TESTING */
 346         } else if (os_strcasecmp(cmd, "ampdu") == 0) {
 347                 if (wpa_drv_ampdu(wpa_s, atoi(value)) < 0)
 348                         ret = -1;
 349 #ifdef CONFIG_TDLS
 350 #ifdef CONFIG_TDLS_TESTING
 351         } else if (os_strcasecmp(cmd, "tdls_testing") == 0) {
 352                 extern unsigned int tdls_testing;
 353                 tdls_testing = strtol(value, NULL, 0);
 354                 wpa_printf(MSG_DEBUG, "TDLS: tdls_testing=0x%x", tdls_testing);
 355 #endif /* CONFIG_TDLS_TESTING */
 356         } else if (os_strcasecmp(cmd, "tdls_disabled") == 0) {
 357                 int disabled = atoi(value);
 358                 wpa_printf(MSG_DEBUG, "TDLS: tdls_disabled=%d", disabled);
 359                 if (disabled) {
 360                         if (wpa_drv_tdls_oper(wpa_s, TDLS_DISABLE, NULL) < 0)
 361                                 ret = -1;
 362                 } else if (wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL) < 0)
 363                         ret = -1;
 364                 wpa_tdls_enable(wpa_s->wpa, !disabled);
 365 #endif /* CONFIG_TDLS */
 366         } else if (os_strcasecmp(cmd, "pno") == 0) {
 367                 ret = wpas_ctrl_pno(wpa_s, value);
 368         } else if (os_strcasecmp(cmd, "radio_disabled") == 0) {
 369                 int disabled = atoi(value);
 370                 if (wpa_drv_radio_disable(wpa_s, disabled) < 0)
 371                         ret = -1;
 372                 else if (disabled)
 373                         wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
 374         } else if (os_strcasecmp(cmd, "uapsd") == 0) {
 375                 if (os_strcmp(value, "disable") == 0)
 376                         wpa_s->set_sta_uapsd = 0;
 377                 else {
 378                         int be, bk, vi, vo;
 379                         char *pos;
 380                         /* format: BE,BK,VI,VO;max SP Length */
 381                         be = atoi(value);
 382                         pos = os_strchr(value, ',');
 383                         if (pos == NULL)
 384                                 return -1;
 385                         pos++;
 386                         bk = atoi(pos);
 387                         pos = os_strchr(pos, ',');
 388                         if (pos == NULL)
 389                                 return -1;
 390                         pos++;
 391                         vi = atoi(pos);
 392                         pos = os_strchr(pos, ',');
 393                         if (pos == NULL)
 394                                 return -1;
 395                         pos++;
 396                         vo = atoi(pos);
 397                         /* ignore max SP Length for now */
 398
 399                         wpa_s->set_sta_uapsd = 1;
 400                         wpa_s->sta_uapsd = 0;
 401                         if (be)
 402                                 wpa_s->sta_uapsd |= BIT(0);
 403                         if (bk)
 404                                 wpa_s->sta_uapsd |= BIT(1);
 405                         if (vi)
 406                                 wpa_s->sta_uapsd |= BIT(2);
 407                         if (vo)
 408                                 wpa_s->sta_uapsd |= BIT(3);
 409                 }
 410         } else if (os_strcasecmp(cmd, "ps") == 0) {
 411                 ret = wpa_drv_set_p2p_powersave(wpa_s, atoi(value), -1, -1);
 412 #ifdef CONFIG_WIFI_DISPLAY
 413         } else if (os_strcasecmp(cmd, "wifi_display") == 0) {
 414                 int enabled = !!atoi(value);
 415                 if (enabled && !wpa_s->global->p2p)
 416                         ret = -1;
 417                 else
 418                         wifi_display_enable(wpa_s->global, enabled);
 419 #endif /* CONFIG_WIFI_DISPLAY */
 420         } else if (os_strcasecmp(cmd, "bssid_filter") == 0) {
 421                 ret = set_bssid_filter(wpa_s, value);
 422         } else if (os_strcasecmp(cmd, "disallow_aps") == 0) {
 423                 ret = set_disallow_aps(wpa_s, value);
 424         } else if (os_strcasecmp(cmd, "no_keep_alive") == 0) {
 425                 wpa_s->no_keep_alive = !!atoi(value);
 426 #ifdef CONFIG_TESTING_OPTIONS
 427         } else if (os_strcasecmp(cmd, "ext_mgmt_frame_handling") == 0) {
 428                 wpa_s->ext_mgmt_frame_handling = !!atoi(value);
 429         } else if (os_strcasecmp(cmd, "ext_eapol_frame_io") == 0) {
 430                 wpa_s->ext_eapol_frame_io = !!atoi(value);
 431 #ifdef CONFIG_AP
 432                 if (wpa_s->ap_iface) {
 433                         wpa_s->ap_iface->bss[0]->ext_eapol_frame_io =
 434                                 wpa_s->ext_eapol_frame_io;
 435                 }
 436 #endif /* CONFIG_AP */
 437         } else if (os_strcasecmp(cmd, "extra_roc_dur") == 0) {
 438                 wpa_s->extra_roc_dur = atoi(value);
 439 #endif /* CONFIG_TESTING_OPTIONS */
 440 #ifndef CONFIG_NO_CONFIG_BLOBS
 441         } else if (os_strcmp(cmd, "blob") == 0) {
 442                 ret = wpas_ctrl_set_blob(wpa_s, value);
 443 #endif /* CONFIG_NO_CONFIG_BLOBS */
 444         } else if (os_strcasecmp(cmd, "setband") == 0) {
 445                 if (os_strcmp(value, "AUTO") == 0)
 446                         wpa_s->setband = WPA_SETBAND_AUTO;
 447                 else if (os_strcmp(value, "5G") == 0)
 448                         wpa_s->setband = WPA_SETBAND_5G;
 449                 else if (os_strcmp(value, "2G") == 0)
 450                         wpa_s->setband = WPA_SETBAND_2G;
 451                 else
 452                         ret = -1;
 453         } else {
 454                 value[-1] = '=';
 455                 ret = wpa_config_process_global(wpa_s->conf, cmd, -1);
 456                 if (ret == 0)
 457                         wpa_supplicant_update_config(wpa_s);
 458         }
 459
 460         return ret;
 461 }
 462
 463
 464 static int wpa_supplicant_ctrl_iface_get(struct wpa_supplicant *wpa_s,
 465                                          char *cmd, char *buf, size_t buflen)
 466 {
 467         int res = -1;
 468
 469         wpa_printf(MSG_DEBUG, "CTRL_IFACE GET '%s'", cmd);
 470
 471         if (os_strcmp(cmd, "version") == 0) {
 472                 res = os_snprintf(buf, buflen, "%s", VERSION_STR);
 473         } else if (os_strcasecmp(cmd, "country") == 0) {
 474                 if (wpa_s->conf->country[0] && wpa_s->conf->country[1])
 475                         res = os_snprintf(buf, buflen, "%c%c",
 476                                           wpa_s->conf->country[0],
 477                                           wpa_s->conf->country[1]);
 478 #ifdef CONFIG_WIFI_DISPLAY
 479         } else if (os_strcasecmp(cmd, "wifi_display") == 0) {
 480                 int enabled;
 481                 if (wpa_s->global->p2p == NULL ||
 482                     wpa_s->global->p2p_disabled)
 483                         enabled = 0;
 484                 else
 485                         enabled = wpa_s->global->wifi_display;
 486                 res = os_snprintf(buf, buflen, "%d", enabled);
 487 #endif /* CONFIG_WIFI_DISPLAY */
 488 #ifdef CONFIG_TESTING_GET_GTK
 489         } else if (os_strcmp(cmd, "gtk") == 0) {
 490                 if (wpa_s->last_gtk_len == 0)
 491                         return -1;
 492                 res = wpa_snprintf_hex(buf, buflen, wpa_s->last_gtk,
 493                                        wpa_s->last_gtk_len);
 494                 return res;
 495 #endif /* CONFIG_TESTING_GET_GTK */
 496         }
 497
 498         if (os_snprintf_error(buflen, res))
 499                 return -1;
 500         return res;
 501 }
 502
 503
 504 #ifdef IEEE8021X_EAPOL
 505 static int wpa_supplicant_ctrl_iface_preauth(struct wpa_supplicant *wpa_s,
 506                                              char *addr)
 507 {
 508         u8 bssid[ETH_ALEN];
 509         struct wpa_ssid *ssid = wpa_s->current_ssid;
 510
 511         if (hwaddr_aton(addr, bssid)) {
 512                 wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH: invalid address "
 513                            "'%s'", addr);
 514                 return -1;
 515         }
 516
 517         wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH " MACSTR, MAC2STR(bssid));
 518         rsn_preauth_deinit(wpa_s->wpa);
 519         if (rsn_preauth_init(wpa_s->wpa, bssid, ssid ? &ssid->eap : NULL))
 520                 return -1;
 521
 522         return 0;
 523 }
 524 #endif /* IEEE8021X_EAPOL */
 525
 526
 527 #ifdef CONFIG_PEERKEY
 528 /* MLME-STKSTART.request(peer) */
 529 static int wpa_supplicant_ctrl_iface_stkstart(
 530         struct wpa_supplicant *wpa_s, char *addr)
 531 {
 532         u8 peer[ETH_ALEN];
 533
 534         if (hwaddr_aton(addr, peer)) {
 535                 wpa_printf(MSG_DEBUG, "CTRL_IFACE STKSTART: invalid "
 536                            "address '%s'", addr);
 537                 return -1;
 538         }
 539
 540         wpa_printf(MSG_DEBUG, "CTRL_IFACE STKSTART " MACSTR,
 541                    MAC2STR(peer));
 542
 543         return wpa_sm_stkstart(wpa_s->wpa, peer);
 544 }
 545 #endif /* CONFIG_PEERKEY */
 546
 547
 548 #ifdef CONFIG_TDLS
 549
 550 static int wpa_supplicant_ctrl_iface_tdls_discover(
 551         struct wpa_supplicant *wpa_s, char *addr)
 552 {
 553         u8 peer[ETH_ALEN];
 554         int ret;
 555
 556         if (hwaddr_aton(addr, peer)) {
 557                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER: invalid "
 558                            "address '%s'", addr);
 559                 return -1;
 560         }
 561
 562         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER " MACSTR,
 563                    MAC2STR(peer));
 564
 565         if (wpa_tdls_is_external_setup(wpa_s->wpa))
 566                 ret = wpa_tdls_send_discovery_request(wpa_s->wpa, peer);
 567         else
 568                 ret = wpa_drv_tdls_oper(wpa_s, TDLS_DISCOVERY_REQ, peer);
 569
 570         return ret;
 571 }
 572
 573
 574 static int wpa_supplicant_ctrl_iface_tdls_setup(
 575         struct wpa_supplicant *wpa_s, char *addr)
 576 {
 577         u8 peer[ETH_ALEN];
 578         int ret;
 579
 580         if (hwaddr_aton(addr, peer)) {
 581                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP: invalid "
 582                            "address '%s'", addr);
 583                 return -1;
 584         }
 585
 586         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP " MACSTR,
 587                    MAC2STR(peer));
 588
 589         if ((wpa_s->conf->tdls_external_control) &&
 590             wpa_tdls_is_external_setup(wpa_s->wpa))
 591                 return wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
 592
 593         wpa_tdls_remove(wpa_s->wpa, peer);
 594
 595         if (wpa_tdls_is_external_setup(wpa_s->wpa))
 596                 ret = wpa_tdls_start(wpa_s->wpa, peer);
 597         else
 598                 ret = wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
 599
 600         return ret;
 601 }
 602
 603
 604 static int wpa_supplicant_ctrl_iface_tdls_teardown(
 605         struct wpa_supplicant *wpa_s, char *addr)
 606 {
 607         u8 peer[ETH_ALEN];
 608         int ret;
 609
 610         if (os_strcmp(addr, "*") == 0) {
 611                 /* remove everyone */
 612                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN *");
 613                 wpa_tdls_teardown_peers(wpa_s->wpa);
 614                 return 0;
 615         }
 616
 617         if (hwaddr_aton(addr, peer)) {
 618                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN: invalid "
 619                            "address '%s'", addr);
 620                 return -1;
 621         }
 622
 623         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN " MACSTR,
 624                    MAC2STR(peer));
 625
 626         if ((wpa_s->conf->tdls_external_control) &&
 627             wpa_tdls_is_external_setup(wpa_s->wpa))
 628                 return wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
 629
 630         if (wpa_tdls_is_external_setup(wpa_s->wpa))
 631                 ret = wpa_tdls_teardown_link(
 632                         wpa_s->wpa, peer,
 633                         WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
 634         else
 635                 ret = wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
 636
 637         return ret;
 638 }
 639
 640
 641 static int ctrl_iface_get_capability_tdls(
 642         struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
 643 {
 644         int ret;
 645
 646         ret = os_snprintf(buf, buflen, "%s\n",
 647                           wpa_s->drv_flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT ?
 648                           (wpa_s->drv_flags &
 649                            WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP ?
 650                            "EXTERNAL" : "INTERNAL") : "UNSUPPORTED");
 651         if (os_snprintf_error(buflen, ret))
 652                 return -1;
 653         return ret;
 654 }
 655
 656 #endif /* CONFIG_TDLS */
 657
 658
 659 static int wmm_ac_ctrl_addts(struct wpa_supplicant *wpa_s, char *cmd)
 660 {
 661         char *token, *context = NULL;
 662         struct wmm_ac_ts_setup_params params = {
 663                 .tsid = 0xff,
 664                 .direction = 0xff,
 665         };
 666
 667         while ((token = str_token(cmd, " ", &context))) {
 668                 if (sscanf(token, "tsid=%i", &params.tsid) == 1 ||
 669                     sscanf(token, "up=%i", &params.user_priority) == 1 ||
 670                     sscanf(token, "nominal_msdu_size=%i",
 671                            &params.nominal_msdu_size) == 1 ||
 672                     sscanf(token, "mean_data_rate=%i",
 673                            &params.mean_data_rate) == 1 ||
 674                     sscanf(token, "min_phy_rate=%i",
 675                            &params.minimum_phy_rate) == 1 ||
 676                     sscanf(token, "sba=%i",
 677                            &params.surplus_bandwidth_allowance) == 1)
 678                         continue;
 679
 680                 if (os_strcasecmp(token, "downlink") == 0) {
 681                         params.direction = WMM_TSPEC_DIRECTION_DOWNLINK;
 682                 } else if (os_strcasecmp(token, "uplink") == 0) {
 683                         params.direction = WMM_TSPEC_DIRECTION_UPLINK;
 684                 } else if (os_strcasecmp(token, "bidi") == 0) {
 685                         params.direction = WMM_TSPEC_DIRECTION_BI_DIRECTIONAL;
 686                 } else if (os_strcasecmp(token, "fixed_nominal_msdu") == 0) {
 687                         params.fixed_nominal_msdu = 1;
 688                 } else {
 689                         wpa_printf(MSG_DEBUG,
 690                                    "CTRL: Invalid WMM_AC_ADDTS parameter: '%s'",
 691                                    token);
 692                         return -1;
 693                 }
 694
 695         }
 696
 697         return wpas_wmm_ac_addts(wpa_s, &params);
 698 }
 699
 700
 701 static int wmm_ac_ctrl_delts(struct wpa_supplicant *wpa_s, char *cmd)
 702 {
 703         u8 tsid = atoi(cmd);
 704
 705         return wpas_wmm_ac_delts(wpa_s, tsid);
 706 }
 707
 708
 709 #ifdef CONFIG_IEEE80211R
 710 static int wpa_supplicant_ctrl_iface_ft_ds(
 711         struct wpa_supplicant *wpa_s, char *addr)
 712 {
 713         u8 target_ap[ETH_ALEN];
 714         struct wpa_bss *bss;
 715         const u8 *mdie;
 716
 717         if (hwaddr_aton(addr, target_ap)) {
 718                 wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS: invalid "
 719                            "address '%s'", addr);
 720                 return -1;
 721         }
 722
 723         wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS " MACSTR, MAC2STR(target_ap));
 724
 725         bss = wpa_bss_get_bssid(wpa_s, target_ap);
 726         if (bss)
 727                 mdie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
 728         else
 729                 mdie = NULL;
 730
 731         return wpa_ft_start_over_ds(wpa_s->wpa, target_ap, mdie);
 732 }
 733 #endif /* CONFIG_IEEE80211R */
 734
 735
 736 #ifdef CONFIG_WPS
 737 static int wpa_supplicant_ctrl_iface_wps_pbc(struct wpa_supplicant *wpa_s,
 738                                              char *cmd)
 739 {
 740         u8 bssid[ETH_ALEN], *_bssid = bssid;
 741 #ifdef CONFIG_P2P
 742         u8 p2p_dev_addr[ETH_ALEN];
 743 #endif /* CONFIG_P2P */
 744 #ifdef CONFIG_AP
 745         u8 *_p2p_dev_addr = NULL;
 746 #endif /* CONFIG_AP */
 747
 748         if (cmd == NULL || os_strcmp(cmd, "any") == 0) {
 749                 _bssid = NULL;
 750 #ifdef CONFIG_P2P
 751         } else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
 752                 if (hwaddr_aton(cmd + 13, p2p_dev_addr)) {
 753                         wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid "
 754                                    "P2P Device Address '%s'",
 755                                    cmd + 13);
 756                         return -1;
 757                 }
 758                 _p2p_dev_addr = p2p_dev_addr;
 759 #endif /* CONFIG_P2P */
 760         } else if (hwaddr_aton(cmd, bssid)) {
 761                 wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid BSSID '%s'",
 762                            cmd);
 763                 return -1;
 764         }
 765
 766 #ifdef CONFIG_AP
 767         if (wpa_s->ap_iface)
 768                 return wpa_supplicant_ap_wps_pbc(wpa_s, _bssid, _p2p_dev_addr);
 769 #endif /* CONFIG_AP */
 770
 771         return wpas_wps_start_pbc(wpa_s, _bssid, 0);
 772 }
 773
 774
 775 static int wpa_supplicant_ctrl_iface_wps_pin(struct wpa_supplicant *wpa_s,
 776                                              char *cmd, char *buf,
 777                                              size_t buflen)
 778 {
 779         u8 bssid[ETH_ALEN], *_bssid = bssid;
 780         char *pin;
 781         int ret;
 782
 783         pin = os_strchr(cmd, ' ');
 784         if (pin)
 785                 *pin++ = '\0';
 786
 787         if (os_strcmp(cmd, "any") == 0)
 788                 _bssid = NULL;
 789         else if (os_strcmp(cmd, "get") == 0) {
 790                 ret = wps_generate_pin();
 791                 goto done;
 792         } else if (hwaddr_aton(cmd, bssid)) {
 793                 wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PIN: invalid BSSID '%s'",
 794                            cmd);
 795                 return -1;
 796         }
 797
 798 #ifdef CONFIG_AP
 799         if (wpa_s->ap_iface) {
 800                 int timeout = 0;
 801                 char *pos;
 802
 803                 if (pin) {
 804                         pos = os_strchr(pin, ' ');
 805                         if (pos) {
 806                                 *pos++ = '\0';
 807                                 timeout = atoi(pos);
 808                         }
 809                 }
 810
 811                 return wpa_supplicant_ap_wps_pin(wpa_s, _bssid, pin,
 812                                                  buf, buflen, timeout);
 813         }
 814 #endif /* CONFIG_AP */
 815
 816         if (pin) {
 817                 ret = wpas_wps_start_pin(wpa_s, _bssid, pin, 0,
 818                                          DEV_PW_DEFAULT);
 819                 if (ret < 0)
 820                         return -1;
 821                 ret = os_snprintf(buf, buflen, "%s", pin);
 822                 if (os_snprintf_error(buflen, ret))
 823                         return -1;
 824                 return ret;
 825         }
 826
 827         ret = wpas_wps_start_pin(wpa_s, _bssid, NULL, 0, DEV_PW_DEFAULT);
 828         if (ret < 0)
 829                 return -1;
 830
 831 done:
 832         /* Return the generated PIN */
 833         ret = os_snprintf(buf, buflen, "%08d", ret);
 834         if (os_snprintf_error(buflen, ret))
 835                 return -1;
 836         return ret;
 837 }
 838
 839
 840 static int wpa_supplicant_ctrl_iface_wps_check_pin(
 841         struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
 842 {
 843         char pin[9];
 844         size_t len;
 845         char *pos;
 846         int ret;
 847
 848         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS_CHECK_PIN",
 849                               (u8 *) cmd, os_strlen(cmd));
 850         for (pos = cmd, len = 0; *pos != '\0'; pos++) {
 851                 if (*pos < '0' || *pos > '9')
 852                         continue;
 853                 pin[len++] = *pos;
 854                 if (len == 9) {
 855                         wpa_printf(MSG_DEBUG, "WPS: Too long PIN");
 856                         return -1;
 857                 }
 858         }
 859         if (len != 4 && len != 8) {
 860                 wpa_printf(MSG_DEBUG, "WPS: Invalid PIN length %d", (int) len);
 861                 return -1;
 862         }
 863         pin[len] = '\0';
 864
 865         if (len == 8) {
 866                 unsigned int pin_val;
 867                 pin_val = atoi(pin);
 868                 if (!wps_pin_valid(pin_val)) {
 869                         wpa_printf(MSG_DEBUG, "WPS: Invalid checksum digit");
 870                         ret = os_snprintf(buf, buflen, "FAIL-CHECKSUM\n");
 871                         if (os_snprintf_error(buflen, ret))
 872                                 return -1;
 873                         return ret;
 874                 }
 875         }
 876
 877         ret = os_snprintf(buf, buflen, "%s", pin);
 878         if (os_snprintf_error(buflen, ret))
 879                 return -1;
 880
 881         return ret;
 882 }
 883
 884
 885 #ifdef CONFIG_WPS_NFC
 886
 887 static int wpa_supplicant_ctrl_iface_wps_nfc(struct wpa_supplicant *wpa_s,
 888                                              char *cmd)
 889 {
 890         u8 bssid[ETH_ALEN], *_bssid = bssid;
 891
 892         if (cmd == NULL || cmd[0] == '\0')
 893                 _bssid = NULL;
 894         else if (hwaddr_aton(cmd, bssid))
 895                 return -1;
 896
 897         return wpas_wps_start_nfc(wpa_s, NULL, _bssid, NULL, 0, 0, NULL, NULL,
 898                                   0, 0);
 899 }
 900
 901
 902 static int wpa_supplicant_ctrl_iface_wps_nfc_config_token(
 903         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
 904 {
 905         int ndef;
 906         struct wpabuf *buf;
 907         int res;
 908         char *pos;
 909
 910         pos = os_strchr(cmd, ' ');
 911         if (pos)
 912                 *pos++ = '\0';
 913         if (os_strcmp(cmd, "WPS") == 0)
 914                 ndef = 0;
 915         else if (os_strcmp(cmd, "NDEF") == 0)
 916                 ndef = 1;
 917         else
 918                 return -1;
 919
 920         buf = wpas_wps_nfc_config_token(wpa_s, ndef, pos);
 921         if (buf == NULL)
 922                 return -1;
 923
 924         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
 925                                          wpabuf_len(buf));
 926         reply[res++] = '\n';
 927         reply[res] = '\0';
 928
 929         wpabuf_free(buf);
 930
 931         return res;
 932 }
 933
 934
 935 static int wpa_supplicant_ctrl_iface_wps_nfc_token(
 936         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
 937 {
 938         int ndef;
 939         struct wpabuf *buf;
 940         int res;
 941
 942         if (os_strcmp(cmd, "WPS") == 0)
 943                 ndef = 0;
 944         else if (os_strcmp(cmd, "NDEF") == 0)
 945                 ndef = 1;
 946         else
 947                 return -1;
 948
 949         buf = wpas_wps_nfc_token(wpa_s, ndef);
 950         if (buf == NULL)
 951                 return -1;
 952
 953         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
 954                                          wpabuf_len(buf));
 955         reply[res++] = '\n';
 956         reply[res] = '\0';
 957
 958         wpabuf_free(buf);
 959
 960         return res;
 961 }
 962
 963
 964 static int wpa_supplicant_ctrl_iface_wps_nfc_tag_read(
 965         struct wpa_supplicant *wpa_s, char *pos)
 966 {
 967         size_t len;
 968         struct wpabuf *buf;
 969         int ret;
 970         char *freq;
 971         int forced_freq = 0;
 972
 973         freq = strstr(pos, " freq=");
 974         if (freq) {
 975                 *freq = '\0';
 976                 freq += 6;
 977                 forced_freq = atoi(freq);
 978         }
 979
 980         len = os_strlen(pos);
 981         if (len & 0x01)
 982                 return -1;
 983         len /= 2;
 984
 985         buf = wpabuf_alloc(len);
 986         if (buf == NULL)
 987                 return -1;
 988         if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
 989                 wpabuf_free(buf);
 990                 return -1;
 991         }
 992
 993         ret = wpas_wps_nfc_tag_read(wpa_s, buf, forced_freq);
 994         wpabuf_free(buf);
 995
 996         return ret;
 997 }
 998
 999
1000 static int wpas_ctrl_nfc_get_handover_req_wps(struct wpa_supplicant *wpa_s,
1001                                               char *reply, size_t max_len,
1002                                               int ndef)
1003 {
1004         struct wpabuf *buf;
1005         int res;
1006
1007         buf = wpas_wps_nfc_handover_req(wpa_s, ndef);
1008         if (buf == NULL)
1009                 return -1;
1010
1011         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1012                                          wpabuf_len(buf));
1013         reply[res++] = '\n';
1014         reply[res] = '\0';
1015
1016         wpabuf_free(buf);
1017
1018         return res;
1019 }
1020
1021
1022 #ifdef CONFIG_P2P
1023 static int wpas_ctrl_nfc_get_handover_req_p2p(struct wpa_supplicant *wpa_s,
1024                                               char *reply, size_t max_len,
1025                                               int ndef)
1026 {
1027         struct wpabuf *buf;
1028         int res;
1029
1030         buf = wpas_p2p_nfc_handover_req(wpa_s, ndef);
1031         if (buf == NULL) {
1032                 wpa_printf(MSG_DEBUG, "P2P: Could not generate NFC handover request");
1033                 return -1;
1034         }
1035
1036         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1037                                          wpabuf_len(buf));
1038         reply[res++] = '\n';
1039         reply[res] = '\0';
1040
1041         wpabuf_free(buf);
1042
1043         return res;
1044 }
1045 #endif /* CONFIG_P2P */
1046
1047
1048 static int wpas_ctrl_nfc_get_handover_req(struct wpa_supplicant *wpa_s,
1049                                           char *cmd, char *reply,
1050                                           size_t max_len)
1051 {
1052         char *pos;
1053         int ndef;
1054
1055         pos = os_strchr(cmd, ' ');
1056         if (pos == NULL)
1057                 return -1;
1058         *pos++ = '\0';
1059
1060         if (os_strcmp(cmd, "WPS") == 0)
1061                 ndef = 0;
1062         else if (os_strcmp(cmd, "NDEF") == 0)
1063                 ndef = 1;
1064         else
1065                 return -1;
1066
1067         if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1068                 if (!ndef)
1069                         return -1;
1070                 return wpas_ctrl_nfc_get_handover_req_wps(
1071                         wpa_s, reply, max_len, ndef);
1072         }
1073
1074 #ifdef CONFIG_P2P
1075         if (os_strcmp(pos, "P2P-CR") == 0) {
1076                 return wpas_ctrl_nfc_get_handover_req_p2p(
1077                         wpa_s, reply, max_len, ndef);
1078         }
1079 #endif /* CONFIG_P2P */
1080
1081         return -1;
1082 }
1083
1084
1085 static int wpas_ctrl_nfc_get_handover_sel_wps(struct wpa_supplicant *wpa_s,
1086                                               char *reply, size_t max_len,
1087                                               int ndef, int cr, char *uuid)
1088 {
1089         struct wpabuf *buf;
1090         int res;
1091
1092         buf = wpas_wps_nfc_handover_sel(wpa_s, ndef, cr, uuid);
1093         if (buf == NULL)
1094                 return -1;
1095
1096         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1097                                          wpabuf_len(buf));
1098         reply[res++] = '\n';
1099         reply[res] = '\0';
1100
1101         wpabuf_free(buf);
1102
1103         return res;
1104 }
1105
1106
1107 #ifdef CONFIG_P2P
1108 static int wpas_ctrl_nfc_get_handover_sel_p2p(struct wpa_supplicant *wpa_s,
1109                                               char *reply, size_t max_len,
1110                                               int ndef, int tag)
1111 {
1112         struct wpabuf *buf;
1113         int res;
1114
1115         buf = wpas_p2p_nfc_handover_sel(wpa_s, ndef, tag);
1116         if (buf == NULL)
1117                 return -1;
1118
1119         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1120                                          wpabuf_len(buf));
1121         reply[res++] = '\n';
1122         reply[res] = '\0';
1123
1124         wpabuf_free(buf);
1125
1126         return res;
1127 }
1128 #endif /* CONFIG_P2P */
1129
1130
1131 static int wpas_ctrl_nfc_get_handover_sel(struct wpa_supplicant *wpa_s,
1132                                           char *cmd, char *reply,
1133                                           size_t max_len)
1134 {
1135         char *pos, *pos2;
1136         int ndef;
1137
1138         pos = os_strchr(cmd, ' ');
1139         if (pos == NULL)
1140                 return -1;
1141         *pos++ = '\0';
1142
1143         if (os_strcmp(cmd, "WPS") == 0)
1144                 ndef = 0;
1145         else if (os_strcmp(cmd, "NDEF") == 0)
1146                 ndef = 1;
1147         else
1148                 return -1;
1149
1150         pos2 = os_strchr(pos, ' ');
1151         if (pos2)
1152                 *pos2++ = '\0';
1153         if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1154                 if (!ndef)
1155                         return -1;
1156                 return wpas_ctrl_nfc_get_handover_sel_wps(
1157                         wpa_s, reply, max_len, ndef,
1158                         os_strcmp(pos, "WPS-CR") == 0, pos2);
1159         }
1160
1161 #ifdef CONFIG_P2P
1162         if (os_strcmp(pos, "P2P-CR") == 0) {
1163                 return wpas_ctrl_nfc_get_handover_sel_p2p(
1164                         wpa_s, reply, max_len, ndef, 0);
1165         }
1166
1167         if (os_strcmp(pos, "P2P-CR-TAG") == 0) {
1168                 return wpas_ctrl_nfc_get_handover_sel_p2p(
1169                         wpa_s, reply, max_len, ndef, 1);
1170         }
1171 #endif /* CONFIG_P2P */
1172
1173         return -1;
1174 }
1175
1176
1177 static int wpas_ctrl_nfc_report_handover(struct wpa_supplicant *wpa_s,
1178                                          char *cmd)
1179 {
1180         size_t len;
1181         struct wpabuf *req, *sel;
1182         int ret;
1183         char *pos, *role, *type, *pos2;
1184 #ifdef CONFIG_P2P
1185         char *freq;
1186         int forced_freq = 0;
1187
1188         freq = strstr(cmd, " freq=");
1189         if (freq) {
1190                 *freq = '\0';
1191                 freq += 6;
1192                 forced_freq = atoi(freq);
1193         }
1194 #endif /* CONFIG_P2P */
1195
1196         role = cmd;
1197         pos = os_strchr(role, ' ');
1198         if (pos == NULL) {
1199                 wpa_printf(MSG_DEBUG, "NFC: Missing type in handover report");
1200                 return -1;
1201         }
1202         *pos++ = '\0';
1203
1204         type = pos;
1205         pos = os_strchr(type, ' ');
1206         if (pos == NULL) {
1207                 wpa_printf(MSG_DEBUG, "NFC: Missing request message in handover report");
1208                 return -1;
1209         }
1210         *pos++ = '\0';
1211
1212         pos2 = os_strchr(pos, ' ');
1213         if (pos2 == NULL) {
1214                 wpa_printf(MSG_DEBUG, "NFC: Missing select message in handover report");
1215                 return -1;
1216         }
1217         *pos2++ = '\0';
1218
1219         len = os_strlen(pos);
1220         if (len & 0x01) {
1221                 wpa_printf(MSG_DEBUG, "NFC: Invalid request message length in handover report");
1222                 return -1;
1223         }
1224         len /= 2;
1225
1226         req = wpabuf_alloc(len);
1227         if (req == NULL) {
1228                 wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for request message");
1229                 return -1;
1230         }
1231         if (hexstr2bin(pos, wpabuf_put(req, len), len) < 0) {
1232                 wpa_printf(MSG_DEBUG, "NFC: Invalid request message hexdump in handover report");
1233                 wpabuf_free(req);
1234                 return -1;
1235         }
1236
1237         len = os_strlen(pos2);
1238         if (len & 0x01) {
1239                 wpa_printf(MSG_DEBUG, "NFC: Invalid select message length in handover report");
1240                 wpabuf_free(req);
1241                 return -1;
1242         }
1243         len /= 2;
1244
1245         sel = wpabuf_alloc(len);
1246         if (sel == NULL) {
1247                 wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for select message");
1248                 wpabuf_free(req);
1249                 return -1;
1250         }
1251         if (hexstr2bin(pos2, wpabuf_put(sel, len), len) < 0) {
1252                 wpa_printf(MSG_DEBUG, "NFC: Invalid select message hexdump in handover report");
1253                 wpabuf_free(req);
1254                 wpabuf_free(sel);
1255                 return -1;
1256         }
1257
1258         wpa_printf(MSG_DEBUG, "NFC: Connection handover reported - role=%s type=%s req_len=%d sel_len=%d",
1259                    role, type, (int) wpabuf_len(req), (int) wpabuf_len(sel));
1260
1261         if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "WPS") == 0) {
1262                 ret = wpas_wps_nfc_report_handover(wpa_s, req, sel);
1263 #ifdef CONFIG_AP
1264         } else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "WPS") == 0)
1265         {
1266                 ret = wpas_ap_wps_nfc_report_handover(wpa_s, req, sel);
1267                 if (ret < 0)
1268                         ret = wpas_er_wps_nfc_report_handover(wpa_s, req, sel);
1269 #endif /* CONFIG_AP */
1270 #ifdef CONFIG_P2P
1271         } else if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "P2P") == 0)
1272         {
1273                 ret = wpas_p2p_nfc_report_handover(wpa_s, 1, req, sel, 0);
1274         } else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "P2P") == 0)
1275         {
1276                 ret = wpas_p2p_nfc_report_handover(wpa_s, 0, req, sel,
1277                                                    forced_freq);
1278 #endif /* CONFIG_P2P */
1279         } else {
1280                 wpa_printf(MSG_DEBUG, "NFC: Unsupported connection handover "
1281                            "reported: role=%s type=%s", role, type);
1282                 ret = -1;
1283         }
1284         wpabuf_free(req);
1285         wpabuf_free(sel);
1286
1287         if (ret)
1288                 wpa_printf(MSG_DEBUG, "NFC: Failed to process reported handover messages");
1289
1290         return ret;
1291 }
1292
1293 #endif /* CONFIG_WPS_NFC */
1294
1295
1296 static int wpa_supplicant_ctrl_iface_wps_reg(struct wpa_supplicant *wpa_s,
1297                                              char *cmd)
1298 {
1299         u8 bssid[ETH_ALEN];
1300         char *pin;
1301         char *new_ssid;
1302         char *new_auth;
1303         char *new_encr;
1304         char *new_key;
1305         struct wps_new_ap_settings ap;
1306
1307         pin = os_strchr(cmd, ' ');
1308         if (pin == NULL)
1309                 return -1;
1310         *pin++ = '\0';
1311
1312         if (hwaddr_aton(cmd, bssid)) {
1313                 wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_REG: invalid BSSID '%s'",
1314                            cmd);
1315                 return -1;
1316         }
1317
1318         new_ssid = os_strchr(pin, ' ');
1319         if (new_ssid == NULL)
1320                 return wpas_wps_start_reg(wpa_s, bssid, pin, NULL);
1321         *new_ssid++ = '\0';
1322
1323         new_auth = os_strchr(new_ssid, ' ');
1324         if (new_auth == NULL)
1325                 return -1;
1326         *new_auth++ = '\0';
1327
1328         new_encr = os_strchr(new_auth, ' ');
1329         if (new_encr == NULL)
1330                 return -1;
1331         *new_encr++ = '\0';
1332
1333         new_key = os_strchr(new_encr, ' ');
1334         if (new_key == NULL)
1335                 return -1;
1336         *new_key++ = '\0';
1337
1338         os_memset(&ap, 0, sizeof(ap));
1339         ap.ssid_hex = new_ssid;
1340         ap.auth = new_auth;
1341         ap.encr = new_encr;
1342         ap.key_hex = new_key;
1343         return wpas_wps_start_reg(wpa_s, bssid, pin, &ap);
1344 }
1345
1346
1347 #ifdef CONFIG_AP
1348 static int wpa_supplicant_ctrl_iface_wps_ap_pin(struct wpa_supplicant *wpa_s,
1349                                                 char *cmd, char *buf,
1350                                                 size_t buflen)
1351 {
1352         int timeout = 300;
1353         char *pos;
1354         const char *pin_txt;
1355
1356         if (!wpa_s->ap_iface)
1357                 return -1;
1358
1359         pos = os_strchr(cmd, ' ');
1360         if (pos)
1361                 *pos++ = '\0';
1362
1363         if (os_strcmp(cmd, "disable") == 0) {
1364                 wpas_wps_ap_pin_disable(wpa_s);
1365                 return os_snprintf(buf, buflen, "OK\n");
1366         }
1367
1368         if (os_strcmp(cmd, "random") == 0) {
1369                 if (pos)
1370                         timeout = atoi(pos);
1371                 pin_txt = wpas_wps_ap_pin_random(wpa_s, timeout);
1372                 if (pin_txt == NULL)
1373                         return -1;
1374                 return os_snprintf(buf, buflen, "%s", pin_txt);
1375         }
1376
1377         if (os_strcmp(cmd, "get") == 0) {
1378                 pin_txt = wpas_wps_ap_pin_get(wpa_s);
1379                 if (pin_txt == NULL)
1380                         return -1;
1381                 return os_snprintf(buf, buflen, "%s", pin_txt);
1382         }
1383
1384         if (os_strcmp(cmd, "set") == 0) {
1385                 char *pin;
1386                 if (pos == NULL)
1387                         return -1;
1388                 pin = pos;
1389                 pos = os_strchr(pos, ' ');
1390                 if (pos) {
1391                         *pos++ = '\0';
1392                         timeout = atoi(pos);
1393                 }
1394                 if (os_strlen(pin) > buflen)
1395                         return -1;
1396                 if (wpas_wps_ap_pin_set(wpa_s, pin, timeout) < 0)
1397                         return -1;
1398                 return os_snprintf(buf, buflen, "%s", pin);
1399         }
1400
1401         return -1;
1402 }
1403 #endif /* CONFIG_AP */
1404
1405
1406 #ifdef CONFIG_WPS_ER
1407 static int wpa_supplicant_ctrl_iface_wps_er_pin(struct wpa_supplicant *wpa_s,
1408                                                 char *cmd)
1409 {
1410         char *uuid = cmd, *pin, *pos;
1411         u8 addr_buf[ETH_ALEN], *addr = NULL;
1412         pin = os_strchr(uuid, ' ');
1413         if (pin == NULL)
1414                 return -1;
1415         *pin++ = '\0';
1416         pos = os_strchr(pin, ' ');
1417         if (pos) {
1418                 *pos++ = '\0';
1419                 if (hwaddr_aton(pos, addr_buf) == 0)
1420                         addr = addr_buf;
1421         }
1422         return wpas_wps_er_add_pin(wpa_s, addr, uuid, pin);
1423 }
1424
1425
1426 static int wpa_supplicant_ctrl_iface_wps_er_learn(struct wpa_supplicant *wpa_s,
1427                                                   char *cmd)
1428 {
1429         char *uuid = cmd, *pin;
1430         pin = os_strchr(uuid, ' ');
1431         if (pin == NULL)
1432                 return -1;
1433         *pin++ = '\0';
1434         return wpas_wps_er_learn(wpa_s, uuid, pin);
1435 }
1436
1437
1438 static int wpa_supplicant_ctrl_iface_wps_er_set_config(
1439         struct wpa_supplicant *wpa_s, char *cmd)
1440 {
1441         char *uuid = cmd, *id;
1442         id = os_strchr(uuid, ' ');
1443         if (id == NULL)
1444                 return -1;
1445         *id++ = '\0';
1446         return wpas_wps_er_set_config(wpa_s, uuid, atoi(id));
1447 }
1448
1449
1450 static int wpa_supplicant_ctrl_iface_wps_er_config(
1451         struct wpa_supplicant *wpa_s, char *cmd)
1452 {
1453         char *pin;
1454         char *new_ssid;
1455         char *new_auth;
1456         char *new_encr;
1457         char *new_key;
1458         struct wps_new_ap_settings ap;
1459
1460         pin = os_strchr(cmd, ' ');
1461         if (pin == NULL)
1462                 return -1;
1463         *pin++ = '\0';
1464
1465         new_ssid = os_strchr(pin, ' ');
1466         if (new_ssid == NULL)
1467                 return -1;
1468         *new_ssid++ = '\0';
1469
1470         new_auth = os_strchr(new_ssid, ' ');
1471         if (new_auth == NULL)
1472                 return -1;
1473         *new_auth++ = '\0';
1474
1475         new_encr = os_strchr(new_auth, ' ');
1476         if (new_encr == NULL)
1477                 return -1;
1478         *new_encr++ = '\0';
1479
1480         new_key = os_strchr(new_encr, ' ');
1481         if (new_key == NULL)
1482                 return -1;
1483         *new_key++ = '\0';
1484
1485         os_memset(&ap, 0, sizeof(ap));
1486         ap.ssid_hex = new_ssid;
1487         ap.auth = new_auth;
1488         ap.encr = new_encr;
1489         ap.key_hex = new_key;
1490         return wpas_wps_er_config(wpa_s, cmd, pin, &ap);
1491 }
1492
1493
1494 #ifdef CONFIG_WPS_NFC
1495 static int wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
1496         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1497 {
1498         int ndef;
1499         struct wpabuf *buf;
1500         int res;
1501         char *uuid;
1502
1503         uuid = os_strchr(cmd, ' ');
1504         if (uuid == NULL)
1505                 return -1;
1506         *uuid++ = '\0';
1507
1508         if (os_strcmp(cmd, "WPS") == 0)
1509                 ndef = 0;
1510         else if (os_strcmp(cmd, "NDEF") == 0)
1511                 ndef = 1;
1512         else
1513                 return -1;
1514
1515         buf = wpas_wps_er_nfc_config_token(wpa_s, ndef, uuid);
1516         if (buf == NULL)
1517                 return -1;
1518
1519         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1520                                          wpabuf_len(buf));
1521         reply[res++] = '\n';
1522         reply[res] = '\0';
1523
1524         wpabuf_free(buf);
1525
1526         return res;
1527 }
1528 #endif /* CONFIG_WPS_NFC */
1529 #endif /* CONFIG_WPS_ER */
1530
1531 #endif /* CONFIG_WPS */
1532
1533
1534 #ifdef CONFIG_IBSS_RSN
1535 static int wpa_supplicant_ctrl_iface_ibss_rsn(
1536         struct wpa_supplicant *wpa_s, char *addr)
1537 {
1538         u8 peer[ETH_ALEN];
1539
1540         if (hwaddr_aton(addr, peer)) {
1541                 wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN: invalid "
1542                            "address '%s'", addr);
1543                 return -1;
1544         }
1545
1546         wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN " MACSTR,
1547                    MAC2STR(peer));
1548
1549         return ibss_rsn_start(wpa_s->ibss_rsn, peer);
1550 }
1551 #endif /* CONFIG_IBSS_RSN */
1552
1553
1554 static int wpa_supplicant_ctrl_iface_ctrl_rsp(struct wpa_supplicant *wpa_s,
1555                                               char *rsp)
1556 {
1557 #ifdef IEEE8021X_EAPOL
1558         char *pos, *id_pos;
1559         int id;
1560         struct wpa_ssid *ssid;
1561
1562         pos = os_strchr(rsp, '-');
1563         if (pos == NULL)
1564                 return -1;
1565         *pos++ = '\0';
1566         id_pos = pos;
1567         pos = os_strchr(pos, ':');
1568         if (pos == NULL)
1569                 return -1;
1570         *pos++ = '\0';
1571         id = atoi(id_pos);
1572         wpa_printf(MSG_DEBUG, "CTRL_IFACE: field=%s id=%d", rsp, id);
1573         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
1574                               (u8 *) pos, os_strlen(pos));
1575
1576         ssid = wpa_config_get_network(wpa_s->conf, id);
1577         if (ssid == NULL) {
1578                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
1579                            "to update", id);
1580                 return -1;
1581         }
1582
1583         return wpa_supplicant_ctrl_iface_ctrl_rsp_handle(wpa_s, ssid, rsp,
1584                                                          pos);
1585 #else /* IEEE8021X_EAPOL */
1586         wpa_printf(MSG_DEBUG, "CTRL_IFACE: 802.1X not included");
1587         return -1;
1588 #endif /* IEEE8021X_EAPOL */
1589 }
1590
1591
1592 static int wpa_supplicant_ctrl_iface_status(struct wpa_supplicant *wpa_s,
1593                                             const char *params,
1594                                             char *buf, size_t buflen)
1595 {
1596         char *pos, *end, tmp[30];
1597         int res, verbose, wps, ret;
1598 #ifdef CONFIG_HS20
1599         const u8 *hs20;
1600 #endif /* CONFIG_HS20 */
1601
1602         if (os_strcmp(params, "-DRIVER") == 0)
1603                 return wpa_drv_status(wpa_s, buf, buflen);
1604         verbose = os_strcmp(params, "-VERBOSE") == 0;
1605         wps = os_strcmp(params, "-WPS") == 0;
1606         pos = buf;
1607         end = buf + buflen;
1608         if (wpa_s->wpa_state >= WPA_ASSOCIATED) {
1609                 struct wpa_ssid *ssid = wpa_s->current_ssid;
1610                 ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
1611                                   MAC2STR(wpa_s->bssid));
1612                 if (os_snprintf_error(end - pos, ret))
1613                         return pos - buf;
1614                 pos += ret;
1615                 ret = os_snprintf(pos, end - pos, "freq=%u\n",
1616                                   wpa_s->assoc_freq);
1617                 if (os_snprintf_error(end - pos, ret))
1618                         return pos - buf;
1619                 pos += ret;
1620                 if (ssid) {
1621                         u8 *_ssid = ssid->ssid;
1622                         size_t ssid_len = ssid->ssid_len;
1623                         u8 ssid_buf[MAX_SSID_LEN];
1624                         if (ssid_len == 0) {
1625                                 int _res = wpa_drv_get_ssid(wpa_s, ssid_buf);
1626                                 if (_res < 0)
1627                                         ssid_len = 0;
1628                                 else
1629                                         ssid_len = _res;
1630                                 _ssid = ssid_buf;
1631                         }
1632                         ret = os_snprintf(pos, end - pos, "ssid=%s\nid=%d\n",
1633                                           wpa_ssid_txt(_ssid, ssid_len),
1634                                           ssid->id);
1635                         if (os_snprintf_error(end - pos, ret))
1636                                 return pos - buf;
1637                         pos += ret;
1638
1639                         if (wps && ssid->passphrase &&
1640                             wpa_key_mgmt_wpa_psk(ssid->key_mgmt) &&
1641                             (ssid->mode == WPAS_MODE_AP ||
1642                              ssid->mode == WPAS_MODE_P2P_GO)) {
1643                                 ret = os_snprintf(pos, end - pos,
1644                                                   "passphrase=%s\n",
1645                                                   ssid->passphrase);
1646                                 if (os_snprintf_error(end - pos, ret))
1647                                         return pos - buf;
1648                                 pos += ret;
1649                         }
1650                         if (ssid->id_str) {
1651                                 ret = os_snprintf(pos, end - pos,
1652                                                   "id_str=%s\n",
1653                                                   ssid->id_str);
1654                                 if (os_snprintf_error(end - pos, ret))
1655                                         return pos - buf;
1656                                 pos += ret;
1657                         }
1658
1659                         switch (ssid->mode) {
1660                         case WPAS_MODE_INFRA:
1661                                 ret = os_snprintf(pos, end - pos,
1662                                                   "mode=station\n");
1663                                 break;
1664                         case WPAS_MODE_IBSS:
1665                                 ret = os_snprintf(pos, end - pos,
1666                                                   "mode=IBSS\n");
1667                                 break;
1668                         case WPAS_MODE_AP:
1669                                 ret = os_snprintf(pos, end - pos,
1670                                                   "mode=AP\n");
1671                                 break;
1672                         case WPAS_MODE_P2P_GO:
1673                                 ret = os_snprintf(pos, end - pos,
1674                                                   "mode=P2P GO\n");
1675                                 break;
1676                         case WPAS_MODE_P2P_GROUP_FORMATION:
1677                                 ret = os_snprintf(pos, end - pos,
1678                                                   "mode=P2P GO - group "
1679                                                   "formation\n");
1680                                 break;
1681                         default:
1682                                 ret = 0;
1683                                 break;
1684                         }
1685                         if (os_snprintf_error(end - pos, ret))
1686                                 return pos - buf;
1687                         pos += ret;
1688                 }
1689
1690 #ifdef CONFIG_AP
1691                 if (wpa_s->ap_iface) {
1692                         pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
1693                                                             end - pos,
1694                                                             verbose);
1695                 } else
1696 #endif /* CONFIG_AP */
1697                 pos += wpa_sm_get_status(wpa_s->wpa, pos, end - pos, verbose);
1698         }
1699 #ifdef CONFIG_SAE
1700         if (wpa_s->wpa_state >= WPA_ASSOCIATED &&
1701 #ifdef CONFIG_AP
1702             !wpa_s->ap_iface &&
1703 #endif /* CONFIG_AP */
1704             wpa_s->sme.sae.state == SAE_ACCEPTED) {
1705                 ret = os_snprintf(pos, end - pos, "sae_group=%d\n",
1706                                   wpa_s->sme.sae.group);
1707                 if (os_snprintf_error(end - pos, ret))
1708                         return pos - buf;
1709                 pos += ret;
1710         }
1711 #endif /* CONFIG_SAE */
1712         ret = os_snprintf(pos, end - pos, "wpa_state=%s\n",
1713                           wpa_supplicant_state_txt(wpa_s->wpa_state));
1714         if (os_snprintf_error(end - pos, ret))
1715                 return pos - buf;
1716         pos += ret;
1717
1718         if (wpa_s->l2 &&
1719             l2_packet_get_ip_addr(wpa_s->l2, tmp, sizeof(tmp)) >= 0) {
1720                 ret = os_snprintf(pos, end - pos, "ip_address=%s\n", tmp);
1721                 if (os_snprintf_error(end - pos, ret))
1722                         return pos - buf;
1723                 pos += ret;
1724         }
1725
1726 #ifdef CONFIG_P2P
1727         if (wpa_s->global->p2p) {
1728                 ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
1729                                   "\n", MAC2STR(wpa_s->global->p2p_dev_addr));
1730                 if (os_snprintf_error(end - pos, ret))
1731                         return pos - buf;
1732                 pos += ret;
1733         }
1734 #endif /* CONFIG_P2P */
1735
1736         ret = os_snprintf(pos, end - pos, "address=" MACSTR "\n",
1737                           MAC2STR(wpa_s->own_addr));
1738         if (os_snprintf_error(end - pos, ret))
1739                 return pos - buf;
1740         pos += ret;
1741
1742 #ifdef CONFIG_HS20
1743         if (wpa_s->current_bss &&
1744             (hs20 = wpa_bss_get_vendor_ie(wpa_s->current_bss,
1745                                           HS20_IE_VENDOR_TYPE)) &&
1746             wpa_s->wpa_proto == WPA_PROTO_RSN &&
1747             wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
1748                 int release = 1;
1749                 if (hs20[1] >= 5) {
1750                         u8 rel_num = (hs20[6] & 0xf0) >> 4;
1751                         release = rel_num + 1;
1752                 }
1753                 ret = os_snprintf(pos, end - pos, "hs20=%d\n", release);
1754                 if (os_snprintf_error(end - pos, ret))
1755                         return pos - buf;
1756                 pos += ret;
1757         }
1758
1759         if (wpa_s->current_ssid) {
1760                 struct wpa_cred *cred;
1761                 char *type;
1762
1763                 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1764                         size_t i;
1765
1766                         if (wpa_s->current_ssid->parent_cred != cred)
1767                                 continue;
1768
1769                         if (cred->provisioning_sp) {
1770                                 ret = os_snprintf(pos, end - pos,
1771                                                   "provisioning_sp=%s\n",
1772                                                   cred->provisioning_sp);
1773                                 if (os_snprintf_error(end - pos, ret))
1774                                         return pos - buf;
1775                                 pos += ret;
1776                         }
1777
1778                         if (!cred->domain)
1779                                 goto no_domain;
1780
1781                         i = 0;
1782                         if (wpa_s->current_bss && wpa_s->current_bss->anqp) {
1783                                 struct wpabuf *names =
1784                                         wpa_s->current_bss->anqp->domain_name;
1785                                 for (i = 0; names && i < cred->num_domain; i++)
1786                                 {
1787                                         if (domain_name_list_contains(
1788                                                     names, cred->domain[i], 1))
1789                                                 break;
1790                                 }
1791                                 if (i == cred->num_domain)
1792                                         i = 0; /* show first entry by default */
1793                         }
1794                         ret = os_snprintf(pos, end - pos, "home_sp=%s\n",
1795                                           cred->domain[i]);
1796                         if (os_snprintf_error(end - pos, ret))
1797                                 return pos - buf;
1798                         pos += ret;
1799
1800                 no_domain:
1801                         if (wpa_s->current_bss == NULL ||
1802                             wpa_s->current_bss->anqp == NULL)
1803                                 res = -1;
1804                         else
1805                                 res = interworking_home_sp_cred(
1806                                         wpa_s, cred,
1807                                         wpa_s->current_bss->anqp->domain_name);
1808                         if (res > 0)
1809                                 type = "home";
1810                         else if (res == 0)
1811                                 type = "roaming";
1812                         else
1813                                 type = "unknown";
1814
1815                         ret = os_snprintf(pos, end - pos, "sp_type=%s\n", type);
1816                         if (os_snprintf_error(end - pos, ret))
1817                                 return pos - buf;
1818                         pos += ret;
1819
1820                         break;
1821                 }
1822         }
1823 #endif /* CONFIG_HS20 */
1824
1825         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
1826             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1827                 res = eapol_sm_get_status(wpa_s->eapol, pos, end - pos,
1828                                           verbose);
1829                 if (res >= 0)
1830                         pos += res;
1831         }
1832
1833         res = rsn_preauth_get_status(wpa_s->wpa, pos, end - pos, verbose);
1834         if (res >= 0)
1835                 pos += res;
1836
1837 #ifdef CONFIG_WPS
1838         {
1839                 char uuid_str[100];
1840                 uuid_bin2str(wpa_s->wps->uuid, uuid_str, sizeof(uuid_str));
1841                 ret = os_snprintf(pos, end - pos, "uuid=%s\n", uuid_str);
1842                 if (os_snprintf_error(end - pos, ret))
1843                         return pos - buf;
1844                 pos += ret;
1845         }
1846 #endif /* CONFIG_WPS */
1847
1848 #ifdef ANDROID
1849         /*
1850          * Allow using the STATUS command with default behavior, say for debug,
1851          * i.e., don't generate a "fake" CONNECTION and SUPPLICANT_STATE_CHANGE
1852          * events with STATUS-NO_EVENTS.
1853          */
1854         if (os_strcmp(params, "-NO_EVENTS")) {
1855                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_STATE_CHANGE
1856                              "id=%d state=%d BSSID=" MACSTR " SSID=%s",
1857                              wpa_s->current_ssid ? wpa_s->current_ssid->id : -1,
1858                              wpa_s->wpa_state,
1859                              MAC2STR(wpa_s->bssid),
1860                              wpa_s->current_ssid && wpa_s->current_ssid->ssid ?
1861                              wpa_ssid_txt(wpa_s->current_ssid->ssid,
1862                                           wpa_s->current_ssid->ssid_len) : "");
1863                 if (wpa_s->wpa_state == WPA_COMPLETED) {
1864                         struct wpa_ssid *ssid = wpa_s->current_ssid;
1865                         wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED
1866                                      "- connection to " MACSTR
1867                                      " completed %s [id=%d id_str=%s]",
1868                                      MAC2STR(wpa_s->bssid), "(auth)",
1869                                      ssid ? ssid->id : -1,
1870                                      ssid && ssid->id_str ? ssid->id_str : "");
1871                 }
1872         }
1873 #endif /* ANDROID */
1874
1875         return pos - buf;
1876 }
1877
1878
1879 static int wpa_supplicant_ctrl_iface_bssid(struct wpa_supplicant *wpa_s,
1880                                            char *cmd)
1881 {
1882         char *pos;
1883         int id;
1884         struct wpa_ssid *ssid;
1885         u8 bssid[ETH_ALEN];
1886
1887         /* cmd: "<network id> <BSSID>" */
1888         pos = os_strchr(cmd, ' ');
1889         if (pos == NULL)
1890                 return -1;
1891         *pos++ = '\0';
1892         id = atoi(cmd);
1893         wpa_printf(MSG_DEBUG, "CTRL_IFACE: id=%d bssid='%s'", id, pos);
1894         if (hwaddr_aton(pos, bssid)) {
1895                 wpa_printf(MSG_DEBUG ,"CTRL_IFACE: invalid BSSID '%s'", pos);
1896                 return -1;
1897         }
1898
1899         ssid = wpa_config_get_network(wpa_s->conf, id);
1900         if (ssid == NULL) {
1901                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
1902                            "to update", id);
1903                 return -1;
1904         }
1905
1906         os_memcpy(ssid->bssid, bssid, ETH_ALEN);
1907         ssid->bssid_set = !is_zero_ether_addr(bssid);
1908
1909         return 0;
1910 }
1911
1912
1913 static int wpa_supplicant_ctrl_iface_blacklist(struct wpa_supplicant *wpa_s,
1914                                                char *cmd, char *buf,
1915                                                size_t buflen)
1916 {
1917         u8 bssid[ETH_ALEN];
1918         struct wpa_blacklist *e;
1919         char *pos, *end;
1920         int ret;
1921
1922         /* cmd: "BLACKLIST [<BSSID>]" */
1923         if (*cmd == '\0') {
1924                 pos = buf;
1925                 end = buf + buflen;
1926                 e = wpa_s->blacklist;
1927                 while (e) {
1928                         ret = os_snprintf(pos, end - pos, MACSTR "\n",
1929                                           MAC2STR(e->bssid));
1930                         if (os_snprintf_error(end - pos, ret))
1931                                 return pos - buf;
1932                         pos += ret;
1933                         e = e->next;
1934                 }
1935                 return pos - buf;
1936         }
1937
1938         cmd++;
1939         if (os_strncmp(cmd, "clear", 5) == 0) {
1940                 wpa_blacklist_clear(wpa_s);
1941                 os_memcpy(buf, "OK\n", 3);
1942                 return 3;
1943         }
1944
1945         wpa_printf(MSG_DEBUG, "CTRL_IFACE: BLACKLIST bssid='%s'", cmd);
1946         if (hwaddr_aton(cmd, bssid)) {
1947                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: invalid BSSID '%s'", cmd);
1948                 return -1;
1949         }
1950
1951         /*
1952          * Add the BSSID twice, so its count will be 2, causing it to be
1953          * skipped when processing scan results.
1954          */
1955         ret = wpa_blacklist_add(wpa_s, bssid);
1956         if (ret < 0)
1957                 return -1;
1958         ret = wpa_blacklist_add(wpa_s, bssid);
1959         if (ret < 0)
1960                 return -1;
1961         os_memcpy(buf, "OK\n", 3);
1962         return 3;
1963 }
1964
1965
1966 static const char * debug_level_str(int level)
1967 {
1968         switch (level) {
1969         case MSG_EXCESSIVE:
1970                 return "EXCESSIVE";
1971         case MSG_MSGDUMP:
1972                 return "MSGDUMP";
1973         case MSG_DEBUG:
1974                 return "DEBUG";
1975         case MSG_INFO:
1976                 return "INFO";
1977         case MSG_WARNING:
1978                 return "WARNING";
1979         case MSG_ERROR:
1980                 return "ERROR";
1981         default:
1982                 return "?";
1983         }
1984 }
1985
1986
1987 static int str_to_debug_level(const char *s)
1988 {
1989         if (os_strcasecmp(s, "EXCESSIVE") == 0)
1990                 return MSG_EXCESSIVE;
1991         if (os_strcasecmp(s, "MSGDUMP") == 0)
1992                 return MSG_MSGDUMP;
1993         if (os_strcasecmp(s, "DEBUG") == 0)
1994                 return MSG_DEBUG;
1995         if (os_strcasecmp(s, "INFO") == 0)
1996                 return MSG_INFO;
1997         if (os_strcasecmp(s, "WARNING") == 0)
1998                 return MSG_WARNING;
1999         if (os_strcasecmp(s, "ERROR") == 0)
2000                 return MSG_ERROR;
2001         return -1;
2002 }
2003
2004
2005 static int wpa_supplicant_ctrl_iface_log_level(struct wpa_supplicant *wpa_s,
2006                                                char *cmd, char *buf,
2007                                                size_t buflen)
2008 {
2009         char *pos, *end, *stamp;
2010         int ret;
2011
2012         /* cmd: "LOG_LEVEL [<level>]" */
2013         if (*cmd == '\0') {
2014                 pos = buf;
2015                 end = buf + buflen;
2016                 ret = os_snprintf(pos, end - pos, "Current level: %s\n"
2017                                   "Timestamp: %d\n",
2018                                   debug_level_str(wpa_debug_level),
2019                                   wpa_debug_timestamp);
2020                 if (os_snprintf_error(end - pos, ret))
2021                         ret = 0;
2022
2023                 return ret;
2024         }
2025
2026         while (*cmd == ' ')
2027                 cmd++;
2028
2029         stamp = os_strchr(cmd, ' ');
2030         if (stamp) {
2031                 *stamp++ = '\0';
2032                 while (*stamp == ' ') {
2033                         stamp++;
2034                 }
2035         }
2036
2037         if (cmd && os_strlen(cmd)) {
2038                 int level = str_to_debug_level(cmd);
2039                 if (level < 0)
2040                         return -1;
2041                 wpa_debug_level = level;
2042         }
2043
2044         if (stamp && os_strlen(stamp))
2045                 wpa_debug_timestamp = atoi(stamp);
2046
2047         os_memcpy(buf, "OK\n", 3);
2048         return 3;
2049 }
2050
2051
2052 static int wpa_supplicant_ctrl_iface_list_networks(
2053         struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
2054 {
2055         char *pos, *end, *prev;
2056         struct wpa_ssid *ssid;
2057         int ret;
2058
2059         pos = buf;
2060         end = buf + buflen;
2061         ret = os_snprintf(pos, end - pos,
2062                           "network id / ssid / bssid / flags\n");
2063         if (os_snprintf_error(end - pos, ret))
2064                 return pos - buf;
2065         pos += ret;
2066
2067         ssid = wpa_s->conf->ssid;
2068
2069         /* skip over ssids until we find next one */
2070         if (cmd != NULL && os_strncmp(cmd, "LAST_ID=", 8) == 0) {
2071                 int last_id = atoi(cmd + 8);
2072                 if (last_id != -1) {
2073                         while (ssid != NULL && ssid->id <= last_id) {
2074                                 ssid = ssid->next;
2075                         }
2076                 }
2077         }
2078
2079         while (ssid) {
2080                 prev = pos;
2081                 ret = os_snprintf(pos, end - pos, "%d\t%s",
2082                                   ssid->id,
2083                                   wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2084                 if (os_snprintf_error(end - pos, ret))
2085                         return prev - buf;
2086                 pos += ret;
2087                 if (ssid->bssid_set) {
2088                         ret = os_snprintf(pos, end - pos, "\t" MACSTR,
2089                                           MAC2STR(ssid->bssid));
2090                 } else {
2091                         ret = os_snprintf(pos, end - pos, "\tany");
2092                 }
2093                 if (os_snprintf_error(end - pos, ret))
2094                         return prev - buf;
2095                 pos += ret;
2096                 ret = os_snprintf(pos, end - pos, "\t%s%s%s%s",
2097                                   ssid == wpa_s->current_ssid ?
2098                                   "[CURRENT]" : "",
2099                                   ssid->disabled ? "[DISABLED]" : "",
2100                                   ssid->disabled_until.sec ?
2101                                   "[TEMP-DISABLED]" : "",
2102                                   ssid->disabled == 2 ? "[P2P-PERSISTENT]" :
2103                                   "");
2104                 if (os_snprintf_error(end - pos, ret))
2105                         return prev - buf;
2106                 pos += ret;
2107                 ret = os_snprintf(pos, end - pos, "\n");
2108                 if (os_snprintf_error(end - pos, ret))
2109                         return prev - buf;
2110                 pos += ret;
2111
2112                 ssid = ssid->next;
2113         }
2114
2115         return pos - buf;
2116 }
2117
2118
2119 static char * wpa_supplicant_cipher_txt(char *pos, char *end, int cipher)
2120 {
2121         int ret;
2122         ret = os_snprintf(pos, end - pos, "-");
2123         if (os_snprintf_error(end - pos, ret))
2124                 return pos;
2125         pos += ret;
2126         ret = wpa_write_ciphers(pos, end, cipher, "+");
2127         if (ret < 0)
2128                 return pos;
2129         pos += ret;
2130         return pos;
2131 }
2132
2133
2134 static char * wpa_supplicant_ie_txt(char *pos, char *end, const char *proto,
2135                                     const u8 *ie, size_t ie_len)
2136 {
2137         struct wpa_ie_data data;
2138         char *start;
2139         int ret;
2140
2141         ret = os_snprintf(pos, end - pos, "[%s-", proto);
2142         if (os_snprintf_error(end - pos, ret))
2143                 return pos;
2144         pos += ret;
2145
2146         if (wpa_parse_wpa_ie(ie, ie_len, &data) < 0) {
2147                 ret = os_snprintf(pos, end - pos, "?]");
2148                 if (os_snprintf_error(end - pos, ret))
2149                         return pos;
2150                 pos += ret;
2151                 return pos;
2152         }
2153
2154         start = pos;
2155         if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
2156                 ret = os_snprintf(pos, end - pos, "%sEAP",
2157                                   pos == start ? "" : "+");
2158                 if (os_snprintf_error(end - pos, ret))
2159                         return pos;
2160                 pos += ret;
2161         }
2162         if (data.key_mgmt & WPA_KEY_MGMT_PSK) {
2163                 ret = os_snprintf(pos, end - pos, "%sPSK",
2164                                   pos == start ? "" : "+");
2165                 if (os_snprintf_error(end - pos, ret))
2166                         return pos;
2167                 pos += ret;
2168         }
2169         if (data.key_mgmt & WPA_KEY_MGMT_WPA_NONE) {
2170                 ret = os_snprintf(pos, end - pos, "%sNone",
2171                                   pos == start ? "" : "+");
2172                 if (os_snprintf_error(end - pos, ret))
2173                         return pos;
2174                 pos += ret;
2175         }
2176         if (data.key_mgmt & WPA_KEY_MGMT_SAE) {
2177                 ret = os_snprintf(pos, end - pos, "%sSAE",
2178                                   pos == start ? "" : "+");
2179                 if (os_snprintf_error(end - pos, ret))
2180                         return pos;
2181                 pos += ret;
2182         }
2183 #ifdef CONFIG_IEEE80211R
2184         if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
2185                 ret = os_snprintf(pos, end - pos, "%sFT/EAP",
2186                                   pos == start ? "" : "+");
2187                 if (os_snprintf_error(end - pos, ret))
2188                         return pos;
2189                 pos += ret;
2190         }
2191         if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK) {
2192                 ret = os_snprintf(pos, end - pos, "%sFT/PSK",
2193                                   pos == start ? "" : "+");
2194                 if (os_snprintf_error(end - pos, ret))
2195                         return pos;
2196                 pos += ret;
2197         }
2198         if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE) {
2199                 ret = os_snprintf(pos, end - pos, "%sFT/SAE",
2200                                   pos == start ? "" : "+");
2201                 if (os_snprintf_error(end - pos, ret))
2202                         return pos;
2203                 pos += ret;
2204         }
2205 #endif /* CONFIG_IEEE80211R */
2206 #ifdef CONFIG_IEEE80211W
2207         if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
2208                 ret = os_snprintf(pos, end - pos, "%sEAP-SHA256",
2209                                   pos == start ? "" : "+");
2210                 if (os_snprintf_error(end - pos, ret))
2211                         return pos;
2212                 pos += ret;
2213         }
2214         if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
2215                 ret = os_snprintf(pos, end - pos, "%sPSK-SHA256",
2216                                   pos == start ? "" : "+");
2217                 if (os_snprintf_error(end - pos, ret))
2218                         return pos;
2219                 pos += ret;
2220         }
2221 #endif /* CONFIG_IEEE80211W */
2222
2223         if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
2224                 ret = os_snprintf(pos, end - pos, "%sEAP-SUITE-B",
2225                                   pos == start ? "" : "+");
2226                 if (os_snprintf_error(end - pos, ret))
2227                         return pos;
2228                 pos += ret;
2229         }
2230
2231         pos = wpa_supplicant_cipher_txt(pos, end, data.pairwise_cipher);
2232
2233         if (data.capabilities & WPA_CAPABILITY_PREAUTH) {
2234                 ret = os_snprintf(pos, end - pos, "-preauth");
2235                 if (os_snprintf_error(end - pos, ret))
2236                         return pos;
2237                 pos += ret;
2238         }
2239
2240         ret = os_snprintf(pos, end - pos, "]");
2241         if (os_snprintf_error(end - pos, ret))
2242                 return pos;
2243         pos += ret;
2244
2245         return pos;
2246 }
2247
2248
2249 #ifdef CONFIG_WPS
2250 static char * wpa_supplicant_wps_ie_txt_buf(struct wpa_supplicant *wpa_s,
2251                                             char *pos, char *end,
2252                                             struct wpabuf *wps_ie)
2253 {
2254         int ret;
2255         const char *txt;
2256
2257         if (wps_ie == NULL)
2258                 return pos;
2259         if (wps_is_selected_pbc_registrar(wps_ie))
2260                 txt = "[WPS-PBC]";
2261         else if (wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 0))
2262                 txt = "[WPS-AUTH]";
2263         else if (wps_is_selected_pin_registrar(wps_ie))
2264                 txt = "[WPS-PIN]";
2265         else
2266                 txt = "[WPS]";
2267
2268         ret = os_snprintf(pos, end - pos, "%s", txt);
2269         if (!os_snprintf_error(end - pos, ret))
2270                 pos += ret;
2271         wpabuf_free(wps_ie);
2272         return pos;
2273 }
2274 #endif /* CONFIG_WPS */
2275
2276
2277 static char * wpa_supplicant_wps_ie_txt(struct wpa_supplicant *wpa_s,
2278                                         char *pos, char *end,
2279                                         const struct wpa_bss *bss)
2280 {
2281 #ifdef CONFIG_WPS
2282         struct wpabuf *wps_ie;
2283         wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
2284         return wpa_supplicant_wps_ie_txt_buf(wpa_s, pos, end, wps_ie);
2285 #else /* CONFIG_WPS */
2286         return pos;
2287 #endif /* CONFIG_WPS */
2288 }
2289
2290
2291 /* Format one result on one text line into a buffer. */
2292 static int wpa_supplicant_ctrl_iface_scan_result(
2293         struct wpa_supplicant *wpa_s,
2294         const struct wpa_bss *bss, char *buf, size_t buflen)
2295 {
2296         char *pos, *end;
2297         int ret;
2298         const u8 *ie, *ie2, *p2p, *mesh;
2299
2300         mesh = wpa_bss_get_ie(bss, WLAN_EID_MESH_ID);
2301         p2p = wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE);
2302         if (!p2p)
2303                 p2p = wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE);
2304         if (p2p && bss->ssid_len == P2P_WILDCARD_SSID_LEN &&
2305             os_memcmp(bss->ssid, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) ==
2306             0)
2307                 return 0; /* Do not show P2P listen discovery results here */
2308
2309         pos = buf;
2310         end = buf + buflen;
2311
2312         ret = os_snprintf(pos, end - pos, MACSTR "\t%d\t%d\t",
2313                           MAC2STR(bss->bssid), bss->freq, bss->level);
2314         if (os_snprintf_error(end - pos, ret))
2315                 return -1;
2316         pos += ret;
2317         ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
2318         if (ie)
2319                 pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie, 2 + ie[1]);
2320         ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2321         if (ie2) {
2322                 pos = wpa_supplicant_ie_txt(pos, end, mesh ? "RSN" : "WPA2",
2323                                             ie2, 2 + ie2[1]);
2324         }
2325         pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
2326         if (!ie && !ie2 && bss->caps & IEEE80211_CAP_PRIVACY) {
2327                 ret = os_snprintf(pos, end - pos, "[WEP]");
2328                 if (os_snprintf_error(end - pos, ret))
2329                         return -1;
2330                 pos += ret;
2331         }
2332         if (mesh) {
2333                 ret = os_snprintf(pos, end - pos, "[MESH]");
2334                 if (os_snprintf_error(end - pos, ret))
2335                         return -1;
2336                 pos += ret;
2337         }
2338         if (bss_is_dmg(bss)) {
2339                 const char *s;
2340                 ret = os_snprintf(pos, end - pos, "[DMG]");
2341                 if (os_snprintf_error(end - pos, ret))
2342                         return -1;
2343                 pos += ret;
2344                 switch (bss->caps & IEEE80211_CAP_DMG_MASK) {
2345                 case IEEE80211_CAP_DMG_IBSS:
2346                         s = "[IBSS]";
2347                         break;
2348                 case IEEE80211_CAP_DMG_AP:
2349                         s = "[ESS]";
2350                         break;
2351                 case IEEE80211_CAP_DMG_PBSS:
2352                         s = "[PBSS]";
2353                         break;
2354                 default:
2355                         s = "";
2356                         break;
2357                 }
2358                 ret = os_snprintf(pos, end - pos, "%s", s);
2359                 if (os_snprintf_error(end - pos, ret))
2360                         return -1;
2361                 pos += ret;
2362         } else {
2363                 if (bss->caps & IEEE80211_CAP_IBSS) {
2364                         ret = os_snprintf(pos, end - pos, "[IBSS]");
2365                         if (os_snprintf_error(end - pos, ret))
2366                                 return -1;
2367                         pos += ret;
2368                 }
2369                 if (bss->caps & IEEE80211_CAP_ESS) {
2370                         ret = os_snprintf(pos, end - pos, "[ESS]");
2371                         if (os_snprintf_error(end - pos, ret))
2372                                 return -1;
2373                         pos += ret;
2374                 }
2375         }
2376         if (p2p) {
2377                 ret = os_snprintf(pos, end - pos, "[P2P]");
2378                 if (os_snprintf_error(end - pos, ret))
2379                         return -1;
2380                 pos += ret;
2381         }
2382 #ifdef CONFIG_HS20
2383         if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE) && ie2) {
2384                 ret = os_snprintf(pos, end - pos, "[HS20]");
2385                 if (os_snprintf_error(end - pos, ret))
2386                         return -1;
2387                 pos += ret;
2388         }
2389 #endif /* CONFIG_HS20 */
2390
2391         ret = os_snprintf(pos, end - pos, "\t%s",
2392                           wpa_ssid_txt(bss->ssid, bss->ssid_len));
2393         if (os_snprintf_error(end - pos, ret))
2394                 return -1;
2395         pos += ret;
2396
2397         ret = os_snprintf(pos, end - pos, "\n");
2398         if (os_snprintf_error(end - pos, ret))
2399                 return -1;
2400         pos += ret;
2401
2402         return pos - buf;
2403 }
2404
2405
2406 static int wpa_supplicant_ctrl_iface_scan_results(
2407         struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
2408 {
2409         char *pos, *end;
2410         struct wpa_bss *bss;
2411         int ret;
2412
2413         pos = buf;
2414         end = buf + buflen;
2415         ret = os_snprintf(pos, end - pos, "bssid / frequency / signal level / "
2416                           "flags / ssid\n");
2417         if (os_snprintf_error(end - pos, ret))
2418                 return pos - buf;
2419         pos += ret;
2420
2421         dl_list_for_each(bss, &wpa_s->bss_id, struct wpa_bss, list_id) {
2422                 ret = wpa_supplicant_ctrl_iface_scan_result(wpa_s, bss, pos,
2423                                                             end - pos);
2424                 if (ret < 0 || ret >= end - pos)
2425                         return pos - buf;
2426                 pos += ret;
2427         }
2428
2429         return pos - buf;
2430 }
2431
2432
2433 #ifdef CONFIG_MESH
2434
2435 static int wpa_supplicant_ctrl_iface_mesh_interface_add(
2436         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
2437 {
2438         char *pos, ifname[IFNAMSIZ + 1];
2439
2440         ifname[0] = '\0';
2441
2442         pos = os_strstr(cmd, "ifname=");
2443         if (pos) {
2444                 pos += 7;
2445                 os_strlcpy(ifname, pos, sizeof(ifname));
2446         }
2447
2448         if (wpas_mesh_add_interface(wpa_s, ifname, sizeof(ifname)) < 0)
2449                 return -1;
2450
2451         os_strlcpy(reply, ifname, max_len);
2452         return os_strlen(ifname);
2453 }
2454
2455
2456 static int wpa_supplicant_ctrl_iface_mesh_group_add(
2457         struct wpa_supplicant *wpa_s, char *cmd)
2458 {
2459         int id;
2460         struct wpa_ssid *ssid;
2461
2462         id = atoi(cmd);
2463         wpa_printf(MSG_DEBUG, "CTRL_IFACE: MESH_GROUP_ADD id=%d", id);
2464
2465         ssid = wpa_config_get_network(wpa_s->conf, id);
2466         if (ssid == NULL) {
2467                 wpa_printf(MSG_DEBUG,
2468                            "CTRL_IFACE: Could not find network id=%d", id);
2469                 return -1;
2470         }
2471         if (ssid->mode != WPAS_MODE_MESH) {
2472                 wpa_printf(MSG_DEBUG,
2473                            "CTRL_IFACE: Cannot use MESH_GROUP_ADD on a non mesh network");
2474                 return -1;
2475         }
2476         if (ssid->key_mgmt != WPA_KEY_MGMT_NONE &&
2477             ssid->key_mgmt != WPA_KEY_MGMT_SAE) {
2478                 wpa_printf(MSG_ERROR,
2479                            "CTRL_IFACE: key_mgmt for mesh network should be open or SAE");
2480                 return -1;
2481         }
2482
2483         /*
2484          * TODO: If necessary write our own group_add function,
2485          * for now we can reuse select_network
2486          */
2487         wpa_supplicant_select_network(wpa_s, ssid);
2488
2489         return 0;
2490 }
2491
2492
2493 static int wpa_supplicant_ctrl_iface_mesh_group_remove(
2494         struct wpa_supplicant *wpa_s, char *cmd)
2495 {
2496         struct wpa_supplicant *orig;
2497         struct wpa_global *global;
2498         int found = 0;
2499
2500         wpa_printf(MSG_DEBUG, "CTRL_IFACE: MESH_GROUP_REMOVE ifname=%s", cmd);
2501
2502         global = wpa_s->global;
2503         orig = wpa_s;
2504
2505         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
2506                 if (os_strcmp(wpa_s->ifname, cmd) == 0) {
2507                         found = 1;
2508                         break;
2509                 }
2510         }
2511         if (!found) {
2512                 wpa_printf(MSG_ERROR,
2513                            "CTRL_IFACE: MESH_GROUP_REMOVE ifname=%s not found",
2514                            cmd);
2515                 return -1;
2516         }
2517         if (wpa_s->mesh_if_created && wpa_s == orig) {
2518                 wpa_printf(MSG_ERROR,
2519                            "CTRL_IFACE: MESH_GROUP_REMOVE can't remove itself");
2520                 return -1;
2521         }
2522
2523         wpa_s->reassociate = 0;
2524         wpa_s->disconnected = 1;
2525         wpa_supplicant_cancel_sched_scan(wpa_s);
2526         wpa_supplicant_cancel_scan(wpa_s);
2527
2528         /*
2529          * TODO: If necessary write our own group_remove function,
2530          * for now we can reuse deauthenticate
2531          */
2532         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2533
2534         if (wpa_s->mesh_if_created)
2535                 wpa_supplicant_remove_iface(global, wpa_s, 0);
2536
2537         return 0;
2538 }
2539
2540 #endif /* CONFIG_MESH */
2541
2542
2543 static int wpa_supplicant_ctrl_iface_select_network(
2544         struct wpa_supplicant *wpa_s, char *cmd)
2545 {
2546         int id;
2547         struct wpa_ssid *ssid;
2548         char *pos;
2549
2550         /* cmd: "<network id>" or "any" */
2551         if (os_strncmp(cmd, "any", 3) == 0) {
2552                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK any");
2553                 ssid = NULL;
2554         } else {
2555                 id = atoi(cmd);
2556                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK id=%d", id);
2557
2558                 ssid = wpa_config_get_network(wpa_s->conf, id);
2559                 if (ssid == NULL) {
2560                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2561                                    "network id=%d", id);
2562                         return -1;
2563                 }
2564                 if (ssid->disabled == 2) {
2565                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
2566                                    "SELECT_NETWORK with persistent P2P group");
2567                         return -1;
2568                 }
2569         }
2570
2571         pos = os_strstr(cmd, " freq=");
2572         if (pos) {
2573                 int *freqs = freq_range_to_channel_list(wpa_s, pos + 6);
2574                 if (freqs) {
2575                         wpa_s->scan_req = MANUAL_SCAN_REQ;
2576                         os_free(wpa_s->manual_scan_freqs);
2577                         wpa_s->manual_scan_freqs = freqs;
2578                 }
2579         }
2580
2581         wpa_supplicant_select_network(wpa_s, ssid);
2582
2583         return 0;
2584 }
2585
2586
2587 static int wpa_supplicant_ctrl_iface_enable_network(
2588         struct wpa_supplicant *wpa_s, char *cmd)
2589 {
2590         int id;
2591         struct wpa_ssid *ssid;
2592
2593         /* cmd: "<network id>" or "all" */
2594         if (os_strcmp(cmd, "all") == 0) {
2595                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK all");
2596                 ssid = NULL;
2597         } else {
2598                 id = atoi(cmd);
2599                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK id=%d", id);
2600
2601                 ssid = wpa_config_get_network(wpa_s->conf, id);
2602                 if (ssid == NULL) {
2603                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2604                                    "network id=%d", id);
2605                         return -1;
2606                 }
2607                 if (ssid->disabled == 2) {
2608                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
2609                                    "ENABLE_NETWORK with persistent P2P group");
2610                         return -1;
2611                 }
2612
2613                 if (os_strstr(cmd, " no-connect")) {
2614                         ssid->disabled = 0;
2615                         return 0;
2616                 }
2617         }
2618         wpa_supplicant_enable_network(wpa_s, ssid);
2619
2620         return 0;
2621 }
2622
2623
2624 static int wpa_supplicant_ctrl_iface_disable_network(
2625         struct wpa_supplicant *wpa_s, char *cmd)
2626 {
2627         int id;
2628         struct wpa_ssid *ssid;
2629
2630         /* cmd: "<network id>" or "all" */
2631         if (os_strcmp(cmd, "all") == 0) {
2632                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK all");
2633                 ssid = NULL;
2634         } else {
2635                 id = atoi(cmd);
2636                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK id=%d", id);
2637
2638                 ssid = wpa_config_get_network(wpa_s->conf, id);
2639                 if (ssid == NULL) {
2640                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2641                                    "network id=%d", id);
2642                         return -1;
2643                 }
2644                 if (ssid->disabled == 2) {
2645                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
2646                                    "DISABLE_NETWORK with persistent P2P "
2647                                    "group");
2648                         return -1;
2649                 }
2650         }
2651         wpa_supplicant_disable_network(wpa_s, ssid);
2652
2653         return 0;
2654 }
2655
2656
2657 static int wpa_supplicant_ctrl_iface_add_network(
2658         struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
2659 {
2660         struct wpa_ssid *ssid;
2661         int ret;
2662
2663         wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_NETWORK");
2664
2665         ssid = wpa_config_add_network(wpa_s->conf);
2666         if (ssid == NULL)
2667                 return -1;
2668
2669         wpas_notify_network_added(wpa_s, ssid);
2670
2671         ssid->disabled = 1;
2672         wpa_config_set_network_defaults(ssid);
2673
2674         ret = os_snprintf(buf, buflen, "%d\n", ssid->id);
2675         if (os_snprintf_error(buflen, ret))
2676                 return -1;
2677         return ret;
2678 }
2679
2680
2681 static int wpa_supplicant_ctrl_iface_remove_network(
2682         struct wpa_supplicant *wpa_s, char *cmd)
2683 {
2684         int id;
2685         struct wpa_ssid *ssid;
2686         int was_disabled;
2687
2688         /* cmd: "<network id>" or "all" */
2689         if (os_strcmp(cmd, "all") == 0) {
2690                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK all");
2691                 if (wpa_s->sched_scanning)
2692                         wpa_supplicant_cancel_sched_scan(wpa_s);
2693
2694                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2695                 if (wpa_s->current_ssid) {
2696 #ifdef CONFIG_SME
2697                         wpa_s->sme.prev_bssid_set = 0;
2698 #endif /* CONFIG_SME */
2699                         wpa_sm_set_config(wpa_s->wpa, NULL);
2700                         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2701                         wpa_supplicant_deauthenticate(
2702                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2703                 }
2704                 ssid = wpa_s->conf->ssid;
2705                 while (ssid) {
2706                         struct wpa_ssid *remove_ssid = ssid;
2707                         id = ssid->id;
2708                         ssid = ssid->next;
2709                         if (wpa_s->last_ssid == remove_ssid)
2710                                 wpa_s->last_ssid = NULL;
2711                         wpas_notify_network_removed(wpa_s, remove_ssid);
2712                         wpa_config_remove_network(wpa_s->conf, id);
2713                 }
2714                 return 0;
2715         }
2716
2717         id = atoi(cmd);
2718         wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK id=%d", id);
2719
2720         ssid = wpa_config_get_network(wpa_s->conf, id);
2721         if (ssid)
2722                 wpas_notify_network_removed(wpa_s, ssid);
2723         if (ssid == NULL) {
2724                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
2725                            "id=%d", id);
2726                 return -1;
2727         }
2728
2729         if (wpa_s->last_ssid == ssid)
2730                 wpa_s->last_ssid = NULL;
2731
2732         if (ssid == wpa_s->current_ssid || wpa_s->current_ssid == NULL) {
2733 #ifdef CONFIG_SME
2734                 wpa_s->sme.prev_bssid_set = 0;
2735 #endif /* CONFIG_SME */
2736                 /*
2737                  * Invalidate the EAP session cache if the current or
2738                  * previously used network is removed.
2739                  */
2740                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2741         }
2742
2743         if (ssid == wpa_s->current_ssid) {
2744                 wpa_sm_set_config(wpa_s->wpa, NULL);
2745                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2746
2747                 wpa_supplicant_deauthenticate(wpa_s,
2748                                               WLAN_REASON_DEAUTH_LEAVING);
2749         }
2750
2751         was_disabled = ssid->disabled;
2752
2753         if (wpa_config_remove_network(wpa_s->conf, id) < 0) {
2754                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Not able to remove the "
2755                            "network id=%d", id);
2756                 return -1;
2757         }
2758
2759         if (!was_disabled && wpa_s->sched_scanning) {
2760                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to remove "
2761                            "network from filters");
2762                 wpa_supplicant_cancel_sched_scan(wpa_s);
2763                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2764         }
2765
2766         return 0;
2767 }
2768
2769
2770 static int wpa_supplicant_ctrl_iface_update_network(
2771         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
2772         char *name, char *value)
2773 {
2774         if (wpa_config_set(ssid, name, value, 0) < 0) {
2775                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set network "
2776                            "variable '%s'", name);
2777                 return -1;
2778         }
2779
2780         if (os_strcmp(name, "bssid") != 0 &&
2781             os_strcmp(name, "priority") != 0)
2782                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
2783
2784         if (wpa_s->current_ssid == ssid || wpa_s->current_ssid == NULL) {
2785                 /*
2786                  * Invalidate the EAP session cache if anything in the current
2787                  * or previously used configuration changes.
2788                  */
2789                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2790         }
2791
2792         if ((os_strcmp(name, "psk") == 0 &&
2793              value[0] == '"' && ssid->ssid_len) ||
2794             (os_strcmp(name, "ssid") == 0 && ssid->passphrase))
2795                 wpa_config_update_psk(ssid);
2796         else if (os_strcmp(name, "priority") == 0)
2797                 wpa_config_update_prio_list(wpa_s->conf);
2798         else if (os_strcmp(name, "no_auto_peer") == 0)
2799                 ssid->no_auto_peer = atoi(value);
2800
2801         return 0;
2802 }
2803
2804
2805 static int wpa_supplicant_ctrl_iface_set_network(
2806         struct wpa_supplicant *wpa_s, char *cmd)
2807 {
2808         int id, ret, prev_bssid_set;
2809         struct wpa_ssid *ssid;
2810         char *name, *value;
2811         u8 prev_bssid[ETH_ALEN];
2812
2813         /* cmd: "<network id> <variable name> <value>" */
2814         name = os_strchr(cmd, ' ');
2815         if (name == NULL)
2816                 return -1;
2817         *name++ = '\0';
2818
2819         value = os_strchr(name, ' ');
2820         if (value == NULL)
2821                 return -1;
2822         *value++ = '\0';
2823
2824         id = atoi(cmd);
2825         wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_NETWORK id=%d name='%s'",
2826                    id, name);
2827         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
2828                               (u8 *) value, os_strlen(value));
2829
2830         ssid = wpa_config_get_network(wpa_s->conf, id);
2831         if (ssid == NULL) {
2832                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
2833                            "id=%d", id);
2834                 return -1;
2835         }
2836
2837         prev_bssid_set = ssid->bssid_set;
2838         os_memcpy(prev_bssid, ssid->bssid, ETH_ALEN);
2839         ret = wpa_supplicant_ctrl_iface_update_network(wpa_s, ssid, name,
2840                                                        value);
2841         if (ret == 0 &&
2842             (ssid->bssid_set != prev_bssid_set ||
2843              os_memcmp(ssid->bssid, prev_bssid, ETH_ALEN) != 0))
2844                 wpas_notify_network_bssid_set_changed(wpa_s, ssid);
2845         return ret;
2846 }
2847
2848
2849 static int wpa_supplicant_ctrl_iface_get_network(
2850         struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
2851 {
2852         int id;
2853         size_t res;
2854         struct wpa_ssid *ssid;
2855         char *name, *value;
2856
2857         /* cmd: "<network id> <variable name>" */
2858         name = os_strchr(cmd, ' ');
2859         if (name == NULL || buflen == 0)
2860                 return -1;
2861         *name++ = '\0';
2862
2863         id = atoi(cmd);
2864         wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_NETWORK id=%d name='%s'",
2865                    id, name);
2866
2867         ssid = wpa_config_get_network(wpa_s->conf, id);
2868         if (ssid == NULL) {
2869                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
2870                            "id=%d", id);
2871                 return -1;
2872         }
2873
2874         value = wpa_config_get_no_key(ssid, name);
2875         if (value == NULL) {
2876                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get network "
2877                            "variable '%s'", name);
2878                 return -1;
2879         }
2880
2881         res = os_strlcpy(buf, value, buflen);
2882         if (res >= buflen) {
2883                 os_free(value);
2884                 return -1;
2885         }
2886
2887         os_free(value);
2888
2889         return res;
2890 }
2891
2892
2893 static int wpa_supplicant_ctrl_iface_dup_network(
2894         struct wpa_supplicant *wpa_s, char *cmd)
2895 {
2896         struct wpa_ssid *ssid_s, *ssid_d;
2897         char *name, *id, *value;
2898         int id_s, id_d, ret;
2899
2900         /* cmd: "<src network id> <dst network id> <variable name>" */
2901         id = os_strchr(cmd, ' ');
2902         if (id == NULL)
2903                 return -1;
2904         *id++ = '\0';
2905
2906         name = os_strchr(id, ' ');
2907         if (name == NULL)
2908                 return -1;
2909         *name++ = '\0';
2910
2911         id_s = atoi(cmd);
2912         id_d = atoi(id);
2913         wpa_printf(MSG_DEBUG, "CTRL_IFACE: DUP_NETWORK id=%d -> %d name='%s'",
2914                    id_s, id_d, name);
2915
2916         ssid_s = wpa_config_get_network(wpa_s->conf, id_s);
2917         if (ssid_s == NULL) {
2918                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2919                            "network id=%d", id_s);
2920                 return -1;
2921         }
2922
2923         ssid_d = wpa_config_get_network(wpa_s->conf, id_d);
2924         if (ssid_d == NULL) {
2925                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2926                            "network id=%d", id_d);
2927                 return -1;
2928         }
2929
2930         value = wpa_config_get(ssid_s, name);
2931         if (value == NULL) {
2932                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get network "
2933                            "variable '%s'", name);
2934                 return -1;
2935         }
2936
2937         ret = wpa_supplicant_ctrl_iface_update_network(wpa_s, ssid_d, name,
2938                                                        value);
2939
2940         os_free(value);
2941
2942         return ret;
2943 }
2944
2945
2946 static int wpa_supplicant_ctrl_iface_list_creds(struct wpa_supplicant *wpa_s,
2947                                                 char *buf, size_t buflen)
2948 {
2949         char *pos, *end;
2950         struct wpa_cred *cred;
2951         int ret;
2952
2953         pos = buf;
2954         end = buf + buflen;
2955         ret = os_snprintf(pos, end - pos,
2956                           "cred id / realm / username / domain / imsi\n");
2957         if (os_snprintf_error(end - pos, ret))
2958                 return pos - buf;
2959         pos += ret;
2960
2961         cred = wpa_s->conf->cred;
2962         while (cred) {
2963                 ret = os_snprintf(pos, end - pos, "%d\t%s\t%s\t%s\t%s\n",
2964                                   cred->id, cred->realm ? cred->realm : "",
2965                                   cred->username ? cred->username : "",
2966                                   cred->domain ? cred->domain[0] : "",
2967                                   cred->imsi ? cred->imsi : "");
2968                 if (os_snprintf_error(end - pos, ret))
2969                         return pos - buf;
2970                 pos += ret;
2971
2972                 cred = cred->next;
2973         }
2974
2975         return pos - buf;
2976 }
2977
2978
2979 static int wpa_supplicant_ctrl_iface_add_cred(struct wpa_supplicant *wpa_s,
2980                                               char *buf, size_t buflen)
2981 {
2982         struct wpa_cred *cred;
2983         int ret;
2984
2985         wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_CRED");
2986
2987         cred = wpa_config_add_cred(wpa_s->conf);
2988         if (cred == NULL)
2989                 return -1;
2990
2991         wpa_msg(wpa_s, MSG_INFO, CRED_ADDED "%d", cred->id);
2992
2993         ret = os_snprintf(buf, buflen, "%d\n", cred->id);
2994         if (os_snprintf_error(buflen, ret))
2995                 return -1;
2996         return ret;
2997 }
2998
2999
3000 static int wpas_ctrl_remove_cred(struct wpa_supplicant *wpa_s,
3001                                  struct wpa_cred *cred)
3002 {
3003         struct wpa_ssid *ssid;
3004         char str[20];
3005         int id;
3006
3007         if (cred == NULL) {
3008                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred");
3009                 return -1;
3010         }
3011
3012         id = cred->id;
3013         if (wpa_config_remove_cred(wpa_s->conf, id) < 0) {
3014                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred");
3015                 return -1;
3016         }
3017
3018         wpa_msg(wpa_s, MSG_INFO, CRED_REMOVED "%d", id);
3019
3020         /* Remove any network entry created based on the removed credential */
3021         ssid = wpa_s->conf->ssid;
3022         while (ssid) {
3023                 if (ssid->parent_cred == cred) {
3024                         int res;
3025
3026                         wpa_printf(MSG_DEBUG, "Remove network id %d since it "
3027                                    "used the removed credential", ssid->id);
3028                         res = os_snprintf(str, sizeof(str), "%d", ssid->id);
3029                         if (os_snprintf_error(sizeof(str), res))
3030                                 str[sizeof(str) - 1] = '\0';
3031                         ssid = ssid->next;
3032                         wpa_supplicant_ctrl_iface_remove_network(wpa_s, str);
3033                 } else
3034                         ssid = ssid->next;
3035         }
3036
3037         return 0;
3038 }
3039
3040
3041 static int wpa_supplicant_ctrl_iface_remove_cred(struct wpa_supplicant *wpa_s,
3042                                                  char *cmd)
3043 {
3044         int id;
3045         struct wpa_cred *cred, *prev;
3046
3047         /* cmd: "<cred id>", "all", "sp_fqdn=<FQDN>", or
3048          * "provisioning_sp=<FQDN> */
3049         if (os_strcmp(cmd, "all") == 0) {
3050                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED all");
3051                 cred = wpa_s->conf->cred;
3052                 while (cred) {
3053                         prev = cred;
3054                         cred = cred->next;
3055                         wpas_ctrl_remove_cred(wpa_s, prev);
3056                 }
3057                 return 0;
3058         }
3059
3060         if (os_strncmp(cmd, "sp_fqdn=", 8) == 0) {
3061                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED SP FQDN '%s'",
3062                            cmd + 8);
3063                 cred = wpa_s->conf->cred;
3064                 while (cred) {
3065                         prev = cred;
3066                         cred = cred->next;
3067                         if (prev->domain) {
3068                                 size_t i;
3069                                 for (i = 0; i < prev->num_domain; i++) {
3070                                         if (os_strcmp(prev->domain[i], cmd + 8)
3071                                             != 0)
3072                                                 continue;
3073                                         wpas_ctrl_remove_cred(wpa_s, prev);
3074                                         break;
3075                                 }
3076                         }
3077                 }
3078                 return 0;
3079         }
3080
3081         if (os_strncmp(cmd, "provisioning_sp=", 16) == 0) {
3082                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED provisioning SP FQDN '%s'",
3083                            cmd + 16);
3084                 cred = wpa_s->conf->cred;
3085                 while (cred) {
3086                         prev = cred;
3087                         cred = cred->next;
3088                         if (prev->provisioning_sp &&
3089                             os_strcmp(prev->provisioning_sp, cmd + 16) == 0)
3090                                 wpas_ctrl_remove_cred(wpa_s, prev);
3091                 }
3092                 return 0;
3093         }
3094
3095         id = atoi(cmd);
3096         wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED id=%d", id);
3097
3098         cred = wpa_config_get_cred(wpa_s->conf, id);
3099         return wpas_ctrl_remove_cred(wpa_s, cred);
3100 }
3101
3102
3103 static int wpa_supplicant_ctrl_iface_set_cred(struct wpa_supplicant *wpa_s,
3104                                               char *cmd)
3105 {
3106         int id;
3107         struct wpa_cred *cred;
3108         char *name, *value;
3109
3110         /* cmd: "<cred id> <variable name> <value>" */
3111         name = os_strchr(cmd, ' ');
3112         if (name == NULL)
3113                 return -1;
3114         *name++ = '\0';
3115
3116         value = os_strchr(name, ' ');
3117         if (value == NULL)
3118                 return -1;
3119         *value++ = '\0';
3120
3121         id = atoi(cmd);
3122         wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_CRED id=%d name='%s'",
3123                    id, name);
3124         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
3125                               (u8 *) value, os_strlen(value));
3126
3127         cred = wpa_config_get_cred(wpa_s->conf, id);
3128         if (cred == NULL) {
3129                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
3130                            id);
3131                 return -1;
3132         }
3133
3134         if (wpa_config_set_cred(cred, name, value, 0) < 0) {
3135                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set cred "
3136                            "variable '%s'", name);
3137                 return -1;
3138         }
3139
3140         wpa_msg(wpa_s, MSG_INFO, CRED_MODIFIED "%d %s", cred->id, name);
3141
3142         return 0;
3143 }
3144
3145
3146 static int wpa_supplicant_ctrl_iface_get_cred(struct wpa_supplicant *wpa_s,
3147                                               char *cmd, char *buf,
3148                                               size_t buflen)
3149 {
3150         int id;
3151         size_t res;
3152         struct wpa_cred *cred;
3153         char *name, *value;
3154
3155         /* cmd: "<cred id> <variable name>" */
3156         name = os_strchr(cmd, ' ');
3157         if (name == NULL)
3158                 return -1;
3159         *name++ = '\0';
3160
3161         id = atoi(cmd);
3162         wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CRED id=%d name='%s'",
3163                    id, name);
3164
3165         cred = wpa_config_get_cred(wpa_s->conf, id);
3166         if (cred == NULL) {
3167                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
3168                            id);
3169                 return -1;
3170         }
3171
3172         value = wpa_config_get_cred_no_key(cred, name);
3173         if (value == NULL) {
3174                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get cred variable '%s'",
3175                            name);
3176                 return -1;
3177         }
3178
3179         res = os_strlcpy(buf, value, buflen);
3180         if (res >= buflen) {
3181                 os_free(value);
3182                 return -1;
3183         }
3184
3185         os_free(value);
3186
3187         return res;
3188 }
3189
3190
3191 #ifndef CONFIG_NO_CONFIG_WRITE
3192 static int wpa_supplicant_ctrl_iface_save_config(struct wpa_supplicant *wpa_s)
3193 {
3194         int ret;
3195
3196         if (!wpa_s->conf->update_config) {
3197                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed "
3198                            "to update configuration (update_config=0)");
3199                 return -1;
3200         }
3201
3202         ret = wpa_config_write(wpa_s->confname, wpa_s->conf);
3203         if (ret) {
3204                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to "
3205                            "update configuration");
3206         } else {
3207                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration"
3208                            " updated");
3209         }
3210
3211         return ret;
3212 }
3213 #endif /* CONFIG_NO_CONFIG_WRITE */
3214
3215
3216 struct cipher_info {
3217         unsigned int capa;
3218         const char *name;
3219         int group_only;
3220 };
3221
3222 static const struct cipher_info ciphers[] = {
3223         { WPA_DRIVER_CAPA_ENC_CCMP_256, "CCMP-256", 0 },
3224         { WPA_DRIVER_CAPA_ENC_GCMP_256, "GCMP-256", 0 },
3225         { WPA_DRIVER_CAPA_ENC_CCMP, "CCMP", 0 },
3226         { WPA_DRIVER_CAPA_ENC_GCMP, "GCMP", 0 },
3227         { WPA_DRIVER_CAPA_ENC_TKIP, "TKIP", 0 },
3228         { WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE, "NONE", 0 },
3229         { WPA_DRIVER_CAPA_ENC_WEP104, "WEP104", 1 },
3230         { WPA_DRIVER_CAPA_ENC_WEP40, "WEP40", 1 }
3231 };
3232
3233
3234 static int ctrl_iface_get_capability_pairwise(int res, char *strict,
3235                                               struct wpa_driver_capa *capa,
3236                                               char *buf, size_t buflen)
3237 {
3238         int ret;
3239         char *pos, *end;
3240         size_t len;
3241         unsigned int i;
3242
3243         pos = buf;
3244         end = pos + buflen;
3245
3246         if (res < 0) {
3247                 if (strict)
3248                         return 0;
3249                 len = os_strlcpy(buf, "CCMP TKIP NONE", buflen);
3250                 if (len >= buflen)
3251                         return -1;
3252                 return len;
3253         }
3254
3255         for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
3256                 if (!ciphers[i].group_only && capa->enc & ciphers[i].capa) {
3257                         ret = os_snprintf(pos, end - pos, "%s%s",
3258                                           pos == buf ? "" : " ",
3259                                           ciphers[i].name);
3260                         if (os_snprintf_error(end - pos, ret))
3261                                 return pos - buf;
3262                         pos += ret;
3263                 }
3264         }
3265
3266         return pos - buf;
3267 }
3268
3269
3270 static int ctrl_iface_get_capability_group(int res, char *strict,
3271                                            struct wpa_driver_capa *capa,
3272                                            char *buf, size_t buflen)
3273 {
3274         int ret;
3275         char *pos, *end;
3276         size_t len;
3277         unsigned int i;
3278
3279         pos = buf;
3280         end = pos + buflen;
3281
3282         if (res < 0) {
3283                 if (strict)
3284                         return 0;
3285                 len = os_strlcpy(buf, "CCMP TKIP WEP104 WEP40", buflen);
3286                 if (len >= buflen)
3287                         return -1;
3288                 return len;
3289         }
3290
3291         for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
3292                 if (capa->enc & ciphers[i].capa) {
3293                         ret = os_snprintf(pos, end - pos, "%s%s",
3294                                           pos == buf ? "" : " ",
3295                                           ciphers[i].name);
3296                         if (os_snprintf_error(end - pos, ret))
3297                                 return pos - buf;
3298                         pos += ret;
3299                 }
3300         }
3301
3302         return pos - buf;
3303 }
3304
3305
3306 static int ctrl_iface_get_capability_key_mgmt(int res, char *strict,
3307                                               struct wpa_driver_capa *capa,
3308                                               char *buf, size_t buflen)
3309 {
3310         int ret;
3311         char *pos, *end;
3312         size_t len;
3313
3314         pos = buf;
3315         end = pos + buflen;
3316
3317         if (res < 0) {
3318                 if (strict)
3319                         return 0;
3320                 len = os_strlcpy(buf, "WPA-PSK WPA-EAP IEEE8021X WPA-NONE "
3321                                  "NONE", buflen);
3322                 if (len >= buflen)
3323                         return -1;
3324                 return len;
3325         }
3326
3327         ret = os_snprintf(pos, end - pos, "NONE IEEE8021X");
3328         if (os_snprintf_error(end - pos, ret))
3329                 return pos - buf;
3330         pos += ret;
3331
3332         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3333                               WPA_DRIVER_CAPA_KEY_MGMT_WPA2)) {
3334                 ret = os_snprintf(pos, end - pos, " WPA-EAP");
3335                 if (os_snprintf_error(end - pos, ret))
3336                         return pos - buf;
3337                 pos += ret;
3338         }
3339
3340         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
3341                               WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
3342                 ret = os_snprintf(pos, end - pos, " WPA-PSK");
3343                 if (os_snprintf_error(end - pos, ret))
3344                         return pos - buf;
3345                 pos += ret;
3346         }
3347
3348         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE) {
3349                 ret = os_snprintf(pos, end - pos, " WPA-NONE");
3350                 if (os_snprintf_error(end - pos, ret))
3351                         return pos - buf;
3352                 pos += ret;
3353         }
3354
3355         return pos - buf;
3356 }
3357
3358
3359 static int ctrl_iface_get_capability_proto(int res, char *strict,
3360                                            struct wpa_driver_capa *capa,
3361                                            char *buf, size_t buflen)
3362 {
3363         int ret;
3364         char *pos, *end;
3365         size_t len;
3366
3367         pos = buf;
3368         end = pos + buflen;
3369
3370         if (res < 0) {
3371                 if (strict)
3372                         return 0;
3373                 len = os_strlcpy(buf, "RSN WPA", buflen);
3374                 if (len >= buflen)
3375                         return -1;
3376                 return len;
3377         }
3378
3379         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
3380                               WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
3381                 ret = os_snprintf(pos, end - pos, "%sRSN",
3382                                   pos == buf ? "" : " ");
3383                 if (os_snprintf_error(end - pos, ret))
3384                         return pos - buf;
3385                 pos += ret;
3386         }
3387
3388         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3389                               WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK)) {
3390                 ret = os_snprintf(pos, end - pos, "%sWPA",
3391                                   pos == buf ? "" : " ");
3392                 if (os_snprintf_error(end - pos, ret))
3393                         return pos - buf;
3394                 pos += ret;
3395         }
3396
3397         return pos - buf;
3398 }
3399
3400
3401 static int ctrl_iface_get_capability_auth_alg(int res, char *strict,
3402                                               struct wpa_driver_capa *capa,
3403                                               char *buf, size_t buflen)
3404 {
3405         int ret;
3406         char *pos, *end;
3407         size_t len;
3408
3409         pos = buf;
3410         end = pos + buflen;
3411
3412         if (res < 0) {
3413                 if (strict)
3414                         return 0;
3415                 len = os_strlcpy(buf, "OPEN SHARED LEAP", buflen);
3416                 if (len >= buflen)
3417                         return -1;
3418                 return len;
3419         }
3420
3421         if (capa->auth & (WPA_DRIVER_AUTH_OPEN)) {
3422                 ret = os_snprintf(pos, end - pos, "%sOPEN",
3423                                   pos == buf ? "" : " ");
3424                 if (os_snprintf_error(end - pos, ret))
3425                         return pos - buf;
3426                 pos += ret;
3427         }
3428
3429         if (capa->auth & (WPA_DRIVER_AUTH_SHARED)) {
3430                 ret = os_snprintf(pos, end - pos, "%sSHARED",
3431                                   pos == buf ? "" : " ");
3432                 if (os_snprintf_error(end - pos, ret))
3433                         return pos - buf;
3434                 pos += ret;
3435         }
3436
3437         if (capa->auth & (WPA_DRIVER_AUTH_LEAP)) {
3438                 ret = os_snprintf(pos, end - pos, "%sLEAP",
3439                                   pos == buf ? "" : " ");
3440                 if (os_snprintf_error(end - pos, ret))
3441                         return pos - buf;
3442                 pos += ret;
3443         }
3444
3445         return pos - buf;
3446 }
3447
3448
3449 static int ctrl_iface_get_capability_modes(int res, char *strict,
3450                                            struct wpa_driver_capa *capa,
3451                                            char *buf, size_t buflen)
3452 {
3453         int ret;
3454         char *pos, *end;
3455         size_t len;
3456
3457         pos = buf;
3458         end = pos + buflen;
3459
3460         if (res < 0) {
3461                 if (strict)
3462                         return 0;
3463                 len = os_strlcpy(buf, "IBSS AP", buflen);
3464                 if (len >= buflen)
3465                         return -1;
3466                 return len;
3467         }
3468
3469         if (capa->flags & WPA_DRIVER_FLAGS_IBSS) {
3470                 ret = os_snprintf(pos, end - pos, "%sIBSS",
3471                                   pos == buf ? "" : " ");
3472                 if (os_snprintf_error(end - pos, ret))
3473                         return pos - buf;
3474                 pos += ret;
3475         }
3476
3477         if (capa->flags & WPA_DRIVER_FLAGS_AP) {
3478                 ret = os_snprintf(pos, end - pos, "%sAP",
3479                                   pos == buf ? "" : " ");
3480                 if (os_snprintf_error(end - pos, ret))
3481                         return pos - buf;
3482                 pos += ret;
3483         }
3484
3485         return pos - buf;
3486 }
3487
3488
3489 static int ctrl_iface_get_capability_channels(struct wpa_supplicant *wpa_s,
3490                                               char *buf, size_t buflen)
3491 {
3492         struct hostapd_channel_data *chnl;
3493         int ret, i, j;
3494         char *pos, *end, *hmode;
3495
3496         pos = buf;
3497         end = pos + buflen;
3498
3499         for (j = 0; j < wpa_s->hw.num_modes; j++) {
3500                 switch (wpa_s->hw.modes[j].mode) {
3501                 case HOSTAPD_MODE_IEEE80211B:
3502                         hmode = "B";
3503                         break;
3504                 case HOSTAPD_MODE_IEEE80211G:
3505                         hmode = "G";
3506                         break;
3507                 case HOSTAPD_MODE_IEEE80211A:
3508                         hmode = "A";
3509                         break;
3510                 case HOSTAPD_MODE_IEEE80211AD:
3511                         hmode = "AD";
3512                         break;
3513                 default:
3514                         continue;
3515                 }
3516                 ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:", hmode);
3517                 if (os_snprintf_error(end - pos, ret))
3518                         return pos - buf;
3519                 pos += ret;
3520                 chnl = wpa_s->hw.modes[j].channels;
3521                 for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
3522                         if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
3523                                 continue;
3524                         ret = os_snprintf(pos, end - pos, " %d", chnl[i].chan);
3525                         if (os_snprintf_error(end - pos, ret))
3526                                 return pos - buf;
3527                         pos += ret;
3528                 }
3529                 ret = os_snprintf(pos, end - pos, "\n");
3530                 if (os_snprintf_error(end - pos, ret))
3531                         return pos - buf;
3532                 pos += ret;
3533         }
3534
3535         return pos - buf;
3536 }
3537
3538
3539 static int ctrl_iface_get_capability_freq(struct wpa_supplicant *wpa_s,
3540                                           char *buf, size_t buflen)
3541 {
3542         struct hostapd_channel_data *chnl;
3543         int ret, i, j;
3544         char *pos, *end, *hmode;
3545
3546         pos = buf;
3547         end = pos + buflen;
3548
3549         for (j = 0; j < wpa_s->hw.num_modes; j++) {
3550                 switch (wpa_s->hw.modes[j].mode) {
3551                 case HOSTAPD_MODE_IEEE80211B:
3552                         hmode = "B";
3553                         break;
3554                 case HOSTAPD_MODE_IEEE80211G:
3555                         hmode = "G";
3556                         break;
3557                 case HOSTAPD_MODE_IEEE80211A:
3558                         hmode = "A";
3559                         break;
3560                 case HOSTAPD_MODE_IEEE80211AD:
3561                         hmode = "AD";
3562                         break;
3563                 default:
3564                         continue;
3565                 }
3566                 ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:\n",
3567                                   hmode);
3568                 if (os_snprintf_error(end - pos, ret))
3569                         return pos - buf;
3570                 pos += ret;
3571                 chnl = wpa_s->hw.modes[j].channels;
3572                 for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
3573                         if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
3574                                 continue;
3575                         ret = os_snprintf(pos, end - pos, " %d = %d MHz%s%s\n",
3576                                           chnl[i].chan, chnl[i].freq,
3577                                           chnl[i].flag & HOSTAPD_CHAN_NO_IR ?
3578                                           " (NO_IR)" : "",
3579                                           chnl[i].flag & HOSTAPD_CHAN_RADAR ?
3580                                           " (DFS)" : "");
3581
3582                         if (os_snprintf_error(end - pos, ret))
3583                                 return pos - buf;
3584                         pos += ret;
3585                 }
3586                 ret = os_snprintf(pos, end - pos, "\n");
3587                 if (os_snprintf_error(end - pos, ret))
3588                         return pos - buf;
3589                 pos += ret;
3590         }
3591
3592         return pos - buf;
3593 }
3594
3595
3596 static int wpa_supplicant_ctrl_iface_get_capability(
3597         struct wpa_supplicant *wpa_s, const char *_field, char *buf,
3598         size_t buflen)
3599 {
3600         struct wpa_driver_capa capa;
3601         int res;
3602         char *strict;
3603         char field[30];
3604         size_t len;
3605
3606         /* Determine whether or not strict checking was requested */
3607         len = os_strlcpy(field, _field, sizeof(field));
3608         if (len >= sizeof(field))
3609                 return -1;
3610         strict = os_strchr(field, ' ');
3611         if (strict != NULL) {
3612                 *strict++ = '\0';
3613                 if (os_strcmp(strict, "strict") != 0)
3614                         return -1;
3615         }
3616
3617         wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CAPABILITY '%s' %s",
3618                 field, strict ? strict : "");
3619
3620         if (os_strcmp(field, "eap") == 0) {
3621                 return eap_get_names(buf, buflen);
3622         }
3623
3624         res = wpa_drv_get_capa(wpa_s, &capa);
3625
3626         if (os_strcmp(field, "pairwise") == 0)
3627                 return ctrl_iface_get_capability_pairwise(res, strict, &capa,
3628                                                           buf, buflen);
3629
3630         if (os_strcmp(field, "group") == 0)
3631                 return ctrl_iface_get_capability_group(res, strict, &capa,
3632                                                        buf, buflen);
3633
3634         if (os_strcmp(field, "key_mgmt") == 0)
3635                 return ctrl_iface_get_capability_key_mgmt(res, strict, &capa,
3636                                                           buf, buflen);
3637
3638         if (os_strcmp(field, "proto") == 0)
3639                 return ctrl_iface_get_capability_proto(res, strict, &capa,
3640                                                        buf, buflen);
3641
3642         if (os_strcmp(field, "auth_alg") == 0)
3643                 return ctrl_iface_get_capability_auth_alg(res, strict, &capa,
3644                                                           buf, buflen);
3645
3646         if (os_strcmp(field, "modes") == 0)
3647                 return ctrl_iface_get_capability_modes(res, strict, &capa,
3648                                                        buf, buflen);
3649
3650         if (os_strcmp(field, "channels") == 0)
3651                 return ctrl_iface_get_capability_channels(wpa_s, buf, buflen);
3652
3653         if (os_strcmp(field, "freq") == 0)
3654                 return ctrl_iface_get_capability_freq(wpa_s, buf, buflen);
3655
3656 #ifdef CONFIG_TDLS
3657         if (os_strcmp(field, "tdls") == 0)
3658                 return ctrl_iface_get_capability_tdls(wpa_s, buf, buflen);
3659 #endif /* CONFIG_TDLS */
3660
3661 #ifdef CONFIG_ERP
3662         if (os_strcmp(field, "erp") == 0) {
3663                 res = os_snprintf(buf, buflen, "ERP");
3664                 if (os_snprintf_error(buflen, res))
3665                         return -1;
3666                 return res;
3667         }
3668 #endif /* CONFIG_EPR */
3669
3670         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown GET_CAPABILITY field '%s'",
3671                    field);
3672
3673         return -1;
3674 }
3675
3676
3677 #ifdef CONFIG_INTERWORKING
3678 static char * anqp_add_hex(char *pos, char *end, const char *title,
3679                            struct wpabuf *data)
3680 {
3681         char *start = pos;
3682         size_t i;
3683         int ret;
3684         const u8 *d;
3685
3686         if (data == NULL)
3687                 return start;
3688
3689         ret = os_snprintf(pos, end - pos, "%s=", title);
3690         if (os_snprintf_error(end - pos, ret))
3691                 return start;
3692         pos += ret;
3693
3694         d = wpabuf_head_u8(data);
3695         for (i = 0; i < wpabuf_len(data); i++) {
3696                 ret = os_snprintf(pos, end - pos, "%02x", *d++);
3697                 if (os_snprintf_error(end - pos, ret))
3698                         return start;
3699                 pos += ret;
3700         }
3701
3702         ret = os_snprintf(pos, end - pos, "\n");
3703         if (os_snprintf_error(end - pos, ret))
3704                 return start;
3705         pos += ret;
3706
3707         return pos;
3708 }
3709 #endif /* CONFIG_INTERWORKING */
3710
3711
3712 static int print_bss_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
3713                           unsigned long mask, char *buf, size_t buflen)
3714 {
3715         size_t i;
3716         int ret;
3717         char *pos, *end;
3718         const u8 *ie, *ie2;
3719
3720         pos = buf;
3721         end = buf + buflen;
3722
3723         if (mask & WPA_BSS_MASK_ID) {
3724                 ret = os_snprintf(pos, end - pos, "id=%u\n", bss->id);
3725                 if (os_snprintf_error(end - pos, ret))
3726                         return 0;
3727                 pos += ret;
3728         }
3729
3730         if (mask & WPA_BSS_MASK_BSSID) {
3731                 ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
3732                                   MAC2STR(bss->bssid));
3733                 if (os_snprintf_error(end - pos, ret))
3734                         return 0;
3735                 pos += ret;
3736         }
3737
3738         if (mask & WPA_BSS_MASK_FREQ) {
3739                 ret = os_snprintf(pos, end - pos, "freq=%d\n", bss->freq);
3740                 if (os_snprintf_error(end - pos, ret))
3741                         return 0;
3742                 pos += ret;
3743         }
3744
3745         if (mask & WPA_BSS_MASK_BEACON_INT) {
3746                 ret = os_snprintf(pos, end - pos, "beacon_int=%d\n",
3747                                   bss->beacon_int);
3748                 if (os_snprintf_error(end - pos, ret))
3749                         return 0;
3750                 pos += ret;
3751         }
3752
3753         if (mask & WPA_BSS_MASK_CAPABILITIES) {
3754                 ret = os_snprintf(pos, end - pos, "capabilities=0x%04x\n",
3755                                   bss->caps);
3756                 if (os_snprintf_error(end - pos, ret))
3757                         return 0;
3758                 pos += ret;
3759         }
3760
3761         if (mask & WPA_BSS_MASK_QUAL) {
3762                 ret = os_snprintf(pos, end - pos, "qual=%d\n", bss->qual);
3763                 if (os_snprintf_error(end - pos, ret))
3764                         return 0;
3765                 pos += ret;
3766         }
3767
3768         if (mask & WPA_BSS_MASK_NOISE) {
3769                 ret = os_snprintf(pos, end - pos, "noise=%d\n", bss->noise);
3770                 if (os_snprintf_error(end - pos, ret))
3771                         return 0;
3772                 pos += ret;
3773         }
3774
3775         if (mask & WPA_BSS_MASK_LEVEL) {
3776                 ret = os_snprintf(pos, end - pos, "level=%d\n", bss->level);
3777                 if (os_snprintf_error(end - pos, ret))
3778                         return 0;
3779                 pos += ret;
3780         }
3781
3782         if (mask & WPA_BSS_MASK_TSF) {
3783                 ret = os_snprintf(pos, end - pos, "tsf=%016llu\n",
3784                                   (unsigned long long) bss->tsf);
3785                 if (os_snprintf_error(end - pos, ret))
3786                         return 0;
3787                 pos += ret;
3788         }
3789
3790         if (mask & WPA_BSS_MASK_AGE) {
3791                 struct os_reltime now;
3792
3793                 os_get_reltime(&now);
3794                 ret = os_snprintf(pos, end - pos, "age=%d\n",
3795                                   (int) (now.sec - bss->last_update.sec));
3796                 if (os_snprintf_error(end - pos, ret))
3797                         return 0;
3798                 pos += ret;
3799         }
3800
3801         if (mask & WPA_BSS_MASK_IE) {
3802                 ret = os_snprintf(pos, end - pos, "ie=");
3803                 if (os_snprintf_error(end - pos, ret))
3804                         return 0;
3805                 pos += ret;
3806
3807                 ie = (const u8 *) (bss + 1);
3808                 for (i = 0; i < bss->ie_len; i++) {
3809                         ret = os_snprintf(pos, end - pos, "%02x", *ie++);
3810                         if (os_snprintf_error(end - pos, ret))
3811                                 return 0;
3812                         pos += ret;
3813                 }
3814
3815                 ret = os_snprintf(pos, end - pos, "\n");
3816                 if (os_snprintf_error(end - pos, ret))
3817                         return 0;
3818                 pos += ret;
3819         }
3820
3821         if (mask & WPA_BSS_MASK_FLAGS) {
3822                 ret = os_snprintf(pos, end - pos, "flags=");
3823                 if (os_snprintf_error(end - pos, ret))
3824                         return 0;
3825                 pos += ret;
3826
3827                 ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
3828                 if (ie)
3829                         pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie,
3830                                                     2 + ie[1]);
3831                 ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
3832                 if (ie2)
3833                         pos = wpa_supplicant_ie_txt(pos, end, "WPA2", ie2,
3834                                                     2 + ie2[1]);
3835                 pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
3836                 if (!ie && !ie2 && bss->caps & IEEE80211_CAP_PRIVACY) {
3837                         ret = os_snprintf(pos, end - pos, "[WEP]");
3838                         if (os_snprintf_error(end - pos, ret))
3839                                 return 0;
3840                         pos += ret;
3841                 }
3842                 if (bss_is_dmg(bss)) {
3843                         const char *s;
3844                         ret = os_snprintf(pos, end - pos, "[DMG]");
3845                         if (os_snprintf_error(end - pos, ret))
3846                                 return 0;
3847                         pos += ret;
3848                         switch (bss->caps & IEEE80211_CAP_DMG_MASK) {
3849                         case IEEE80211_CAP_DMG_IBSS:
3850                                 s = "[IBSS]";
3851                                 break;
3852                         case IEEE80211_CAP_DMG_AP:
3853                                 s = "[ESS]";
3854                                 break;
3855                         case IEEE80211_CAP_DMG_PBSS:
3856                                 s = "[PBSS]";
3857                                 break;
3858                         default:
3859                                 s = "";
3860                                 break;
3861                         }
3862                         ret = os_snprintf(pos, end - pos, "%s", s);
3863                         if (os_snprintf_error(end - pos, ret))
3864                                 return 0;
3865                         pos += ret;
3866                 } else {
3867                         if (bss->caps & IEEE80211_CAP_IBSS) {
3868                                 ret = os_snprintf(pos, end - pos, "[IBSS]");
3869                                 if (os_snprintf_error(end - pos, ret))
3870                                         return 0;
3871                                 pos += ret;
3872                         }
3873                         if (bss->caps & IEEE80211_CAP_ESS) {
3874                                 ret = os_snprintf(pos, end - pos, "[ESS]");
3875                                 if (os_snprintf_error(end - pos, ret))
3876                                         return 0;
3877                                 pos += ret;
3878                         }
3879                 }
3880                 if (wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE) ||
3881                     wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE)) {
3882                         ret = os_snprintf(pos, end - pos, "[P2P]");
3883                         if (os_snprintf_error(end - pos, ret))
3884                                 return 0;
3885                         pos += ret;
3886                 }
3887 #ifdef CONFIG_HS20
3888                 if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
3889                         ret = os_snprintf(pos, end - pos, "[HS20]");
3890                         if (os_snprintf_error(end - pos, ret))
3891                                 return 0;
3892                         pos += ret;
3893                 }
3894 #endif /* CONFIG_HS20 */
3895
3896                 ret = os_snprintf(pos, end - pos, "\n");
3897                 if (os_snprintf_error(end - pos, ret))
3898                         return 0;
3899                 pos += ret;
3900         }
3901
3902         if (mask & WPA_BSS_MASK_SSID) {
3903                 ret = os_snprintf(pos, end - pos, "ssid=%s\n",
3904                                   wpa_ssid_txt(bss->ssid, bss->ssid_len));
3905                 if (os_snprintf_error(end - pos, ret))
3906                         return 0;
3907                 pos += ret;
3908         }
3909
3910 #ifdef CONFIG_WPS
3911         if (mask & WPA_BSS_MASK_WPS_SCAN) {
3912                 ie = (const u8 *) (bss + 1);
3913                 ret = wpas_wps_scan_result_text(ie, bss->ie_len, pos, end);
3914                 if (ret < 0 || ret >= end - pos)
3915                         return 0;
3916                 pos += ret;
3917         }
3918 #endif /* CONFIG_WPS */
3919
3920 #ifdef CONFIG_P2P
3921         if (mask & WPA_BSS_MASK_P2P_SCAN) {
3922                 ie = (const u8 *) (bss + 1);
3923                 ret = wpas_p2p_scan_result_text(ie, bss->ie_len, pos, end);
3924                 if (ret < 0 || ret >= end - pos)
3925                         return 0;
3926                 pos += ret;
3927         }
3928 #endif /* CONFIG_P2P */
3929
3930 #ifdef CONFIG_WIFI_DISPLAY
3931         if (mask & WPA_BSS_MASK_WIFI_DISPLAY) {
3932                 struct wpabuf *wfd;
3933                 ie = (const u8 *) (bss + 1);
3934                 wfd = ieee802_11_vendor_ie_concat(ie, bss->ie_len,
3935                                                   WFD_IE_VENDOR_TYPE);
3936                 if (wfd) {
3937                         ret = os_snprintf(pos, end - pos, "wfd_subelems=");
3938                         if (os_snprintf_error(end - pos, ret)) {
3939                                 wpabuf_free(wfd);
3940                                 return 0;
3941                         }
3942                         pos += ret;
3943
3944                         pos += wpa_snprintf_hex(pos, end - pos,
3945                                                 wpabuf_head(wfd),
3946                                                 wpabuf_len(wfd));
3947                         wpabuf_free(wfd);
3948
3949                         ret = os_snprintf(pos, end - pos, "\n");
3950                         if (os_snprintf_error(end - pos, ret))
3951                                 return 0;
3952                         pos += ret;
3953                 }
3954         }
3955 #endif /* CONFIG_WIFI_DISPLAY */
3956
3957 #ifdef CONFIG_INTERWORKING
3958         if ((mask & WPA_BSS_MASK_INTERNETW) && bss->anqp) {
3959                 struct wpa_bss_anqp *anqp = bss->anqp;
3960                 pos = anqp_add_hex(pos, end, "anqp_venue_name",
3961                                    anqp->venue_name);
3962                 pos = anqp_add_hex(pos, end, "anqp_network_auth_type",
3963                                    anqp->network_auth_type);
3964                 pos = anqp_add_hex(pos, end, "anqp_roaming_consortium",
3965                                    anqp->roaming_consortium);
3966                 pos = anqp_add_hex(pos, end, "anqp_ip_addr_type_availability",
3967                                    anqp->ip_addr_type_availability);
3968                 pos = anqp_add_hex(pos, end, "anqp_nai_realm",
3969                                    anqp->nai_realm);
3970                 pos = anqp_add_hex(pos, end, "anqp_3gpp", anqp->anqp_3gpp);
3971                 pos = anqp_add_hex(pos, end, "anqp_domain_name",
3972                                    anqp->domain_name);
3973 #ifdef CONFIG_HS20
3974                 pos = anqp_add_hex(pos, end, "hs20_operator_friendly_name",
3975                                    anqp->hs20_operator_friendly_name);
3976                 pos = anqp_add_hex(pos, end, "hs20_wan_metrics",
3977                                    anqp->hs20_wan_metrics);
3978                 pos = anqp_add_hex(pos, end, "hs20_connection_capability",
3979                                    anqp->hs20_connection_capability);
3980                 pos = anqp_add_hex(pos, end, "hs20_operating_class",
3981                                    anqp->hs20_operating_class);
3982                 pos = anqp_add_hex(pos, end, "hs20_osu_providers_list",
3983                                    anqp->hs20_osu_providers_list);
3984 #endif /* CONFIG_HS20 */
3985         }
3986 #endif /* CONFIG_INTERWORKING */
3987
3988 #ifdef CONFIG_MESH
3989         if (mask & WPA_BSS_MASK_MESH_SCAN) {
3990                 ie = (const u8 *) (bss + 1);
3991                 ret = wpas_mesh_scan_result_text(ie, bss->ie_len, pos, end);
3992                 if (ret < 0 || ret >= end - pos)
3993                         return 0;
3994                 pos += ret;
3995         }
3996 #endif /* CONFIG_MESH */
3997
3998         if (mask & WPA_BSS_MASK_DELIM) {
3999                 ret = os_snprintf(pos, end - pos, "====\n");
4000                 if (os_snprintf_error(end - pos, ret))
4001                         return 0;
4002                 pos += ret;
4003         }
4004
4005         return pos - buf;
4006 }
4007
4008
4009 static int wpa_supplicant_ctrl_iface_bss(struct wpa_supplicant *wpa_s,
4010                                          const char *cmd, char *buf,
4011                                          size_t buflen)
4012 {
4013         u8 bssid[ETH_ALEN];
4014         size_t i;
4015         struct wpa_bss *bss;
4016         struct wpa_bss *bsslast = NULL;
4017         struct dl_list *next;
4018         int ret = 0;
4019         int len;
4020         char *ctmp, *end = buf + buflen;
4021         unsigned long mask = WPA_BSS_MASK_ALL;
4022
4023         if (os_strncmp(cmd, "RANGE=", 6) == 0) {
4024                 if (os_strncmp(cmd + 6, "ALL", 3) == 0) {
4025                         bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss,
4026                                             list_id);
4027                         bsslast = dl_list_last(&wpa_s->bss_id, struct wpa_bss,
4028                                                list_id);
4029                 } else { /* N1-N2 */
4030                         unsigned int id1, id2;
4031
4032                         if ((ctmp = os_strchr(cmd + 6, '-')) == NULL) {
4033                                 wpa_printf(MSG_INFO, "Wrong BSS range "
4034                                            "format");
4035                                 return 0;
4036                         }
4037
4038                         if (*(cmd + 6) == '-')
4039                                 id1 = 0;
4040                         else
4041                                 id1 = atoi(cmd + 6);
4042                         ctmp++;
4043                         if (*ctmp >= '0' && *ctmp <= '9')
4044                                 id2 = atoi(ctmp);
4045                         else
4046                                 id2 = (unsigned int) -1;
4047                         bss = wpa_bss_get_id_range(wpa_s, id1, id2);
4048                         if (id2 == (unsigned int) -1)
4049                                 bsslast = dl_list_last(&wpa_s->bss_id,
4050                                                        struct wpa_bss,
4051                                                        list_id);
4052                         else {
4053                                 bsslast = wpa_bss_get_id(wpa_s, id2);
4054                                 if (bsslast == NULL && bss && id2 > id1) {
4055                                         struct wpa_bss *tmp = bss;
4056                                         for (;;) {
4057                                                 next = tmp->list_id.next;
4058                                                 if (next == &wpa_s->bss_id)
4059                                                         break;
4060                                                 tmp = dl_list_entry(
4061                                                         next, struct wpa_bss,
4062                                                         list_id);
4063                                                 if (tmp->id > id2)
4064                                                         break;
4065                                                 bsslast = tmp;
4066                                         }
4067                                 }
4068                         }
4069                 }
4070         } else if (os_strncmp(cmd, "FIRST", 5) == 0)
4071                 bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss, list_id);
4072         else if (os_strncmp(cmd, "LAST", 4) == 0)
4073                 bss = dl_list_last(&wpa_s->bss_id, struct wpa_bss, list_id);
4074         else if (os_strncmp(cmd, "ID-", 3) == 0) {
4075                 i = atoi(cmd + 3);
4076                 bss = wpa_bss_get_id(wpa_s, i);
4077         } else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
4078                 i = atoi(cmd + 5);
4079                 bss = wpa_bss_get_id(wpa_s, i);
4080                 if (bss) {
4081                         next = bss->list_id.next;
4082                         if (next == &wpa_s->bss_id)
4083                                 bss = NULL;
4084                         else
4085                                 bss = dl_list_entry(next, struct wpa_bss,
4086                                                     list_id);
4087                 }
4088 #ifdef CONFIG_P2P
4089         } else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
4090                 if (hwaddr_aton(cmd + 13, bssid) == 0)
4091                         bss = wpa_bss_get_p2p_dev_addr(wpa_s, bssid);
4092                 else
4093                         bss = NULL;
4094 #endif /* CONFIG_P2P */
4095         } else if (hwaddr_aton(cmd, bssid) == 0)
4096                 bss = wpa_bss_get_bssid(wpa_s, bssid);
4097         else {
4098                 struct wpa_bss *tmp;
4099                 i = atoi(cmd);
4100                 bss = NULL;
4101                 dl_list_for_each(tmp, &wpa_s->bss_id, struct wpa_bss, list_id)
4102                 {
4103                         if (i-- == 0) {
4104                                 bss = tmp;
4105                                 break;
4106                         }
4107                 }
4108         }
4109
4110         if ((ctmp = os_strstr(cmd, "MASK=")) != NULL) {
4111                 mask = strtoul(ctmp + 5, NULL, 0x10);
4112                 if (mask == 0)
4113                         mask = WPA_BSS_MASK_ALL;
4114         }
4115
4116         if (bss == NULL)
4117                 return 0;
4118
4119         if (bsslast == NULL)
4120                 bsslast = bss;
4121         do {
4122                 len = print_bss_info(wpa_s, bss, mask, buf, buflen);
4123                 ret += len;
4124                 buf += len;
4125                 buflen -= len;
4126                 if (bss == bsslast) {
4127                         if ((mask & WPA_BSS_MASK_DELIM) && len &&
4128                             (bss == dl_list_last(&wpa_s->bss_id,
4129                                                  struct wpa_bss, list_id))) {
4130                                 int res;
4131
4132                                 res = os_snprintf(buf - 5, end - buf + 5,
4133                                                   "####\n");
4134                                 if (os_snprintf_error(end - buf + 5, res)) {
4135                                         wpa_printf(MSG_DEBUG,
4136                                                    "Could not add end delim");
4137                                 }
4138                         }
4139                         break;
4140                 }
4141                 next = bss->list_id.next;
4142                 if (next == &wpa_s->bss_id)
4143                         break;
4144                 bss = dl_list_entry(next, struct wpa_bss, list_id);
4145         } while (bss && len);
4146
4147         return ret;
4148 }
4149
4150
4151 static int wpa_supplicant_ctrl_iface_ap_scan(
4152         struct wpa_supplicant *wpa_s, char *cmd)
4153 {
4154         int ap_scan = atoi(cmd);
4155         return wpa_supplicant_set_ap_scan(wpa_s, ap_scan);
4156 }
4157
4158
4159 static int wpa_supplicant_ctrl_iface_scan_interval(
4160         struct wpa_supplicant *wpa_s, char *cmd)
4161 {
4162         int scan_int = atoi(cmd);
4163         return wpa_supplicant_set_scan_interval(wpa_s, scan_int);
4164 }
4165
4166
4167 static int wpa_supplicant_ctrl_iface_bss_expire_age(
4168         struct wpa_supplicant *wpa_s, char *cmd)
4169 {
4170         int expire_age = atoi(cmd);
4171         return wpa_supplicant_set_bss_expiration_age(wpa_s, expire_age);
4172 }
4173
4174
4175 static int wpa_supplicant_ctrl_iface_bss_expire_count(
4176         struct wpa_supplicant *wpa_s, char *cmd)
4177 {
4178         int expire_count = atoi(cmd);
4179         return wpa_supplicant_set_bss_expiration_count(wpa_s, expire_count);
4180 }
4181
4182
4183 static void wpa_supplicant_ctrl_iface_bss_flush(
4184         struct wpa_supplicant *wpa_s, char *cmd)
4185 {
4186         int flush_age = atoi(cmd);
4187
4188         if (flush_age == 0)
4189                 wpa_bss_flush(wpa_s);
4190         else
4191                 wpa_bss_flush_by_age(wpa_s, flush_age);
4192 }
4193
4194
4195 #ifdef CONFIG_TESTING_OPTIONS
4196 static void wpa_supplicant_ctrl_iface_drop_sa(struct wpa_supplicant *wpa_s)
4197 {
4198         wpa_printf(MSG_DEBUG, "Dropping SA without deauthentication");
4199         /* MLME-DELETEKEYS.request */
4200         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 0, 0, NULL, 0, NULL, 0);
4201         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 1, 0, NULL, 0, NULL, 0);
4202         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 2, 0, NULL, 0, NULL, 0);
4203         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 3, 0, NULL, 0, NULL, 0);
4204 #ifdef CONFIG_IEEE80211W
4205         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 4, 0, NULL, 0, NULL, 0);
4206         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 5, 0, NULL, 0, NULL, 0);
4207 #endif /* CONFIG_IEEE80211W */
4208
4209         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, wpa_s->bssid, 0, 0, NULL, 0, NULL,
4210                         0);
4211         /* MLME-SETPROTECTION.request(None) */
4212         wpa_drv_mlme_setprotection(wpa_s, wpa_s->bssid,
4213                                    MLME_SETPROTECTION_PROTECT_TYPE_NONE,
4214                                    MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
4215         wpa_sm_drop_sa(wpa_s->wpa);
4216 }
4217 #endif /* CONFIG_TESTING_OPTIONS */
4218
4219
4220 static int wpa_supplicant_ctrl_iface_roam(struct wpa_supplicant *wpa_s,
4221                                           char *addr)
4222 {
4223 #ifdef CONFIG_NO_SCAN_PROCESSING
4224         return -1;
4225 #else /* CONFIG_NO_SCAN_PROCESSING */
4226         u8 bssid[ETH_ALEN];
4227         struct wpa_bss *bss;
4228         struct wpa_ssid *ssid = wpa_s->current_ssid;
4229
4230         if (hwaddr_aton(addr, bssid)) {
4231                 wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: invalid "
4232                            "address '%s'", addr);
4233                 return -1;
4234         }
4235
4236         wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM " MACSTR, MAC2STR(bssid));
4237
4238         if (!ssid) {
4239                 wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: No network "
4240                            "configuration known for the target AP");
4241                 return -1;
4242         }
4243
4244         bss = wpa_bss_get(wpa_s, bssid, ssid->ssid, ssid->ssid_len);
4245         if (!bss) {
4246                 wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: Target AP not found "
4247                            "from BSS table");
4248                 return -1;
4249         }
4250
4251         /*
4252          * TODO: Find best network configuration block from configuration to
4253          * allow roaming to other networks
4254          */
4255
4256         wpa_s->reassociate = 1;
4257         wpa_supplicant_connect(wpa_s, bss, ssid);
4258
4259         return 0;
4260 #endif /* CONFIG_NO_SCAN_PROCESSING */
4261 }
4262
4263
4264 #ifdef CONFIG_P2P
4265 static int p2p_ctrl_find(struct wpa_supplicant *wpa_s, char *cmd)
4266 {
4267         unsigned int timeout = atoi(cmd);
4268         enum p2p_discovery_type type = P2P_FIND_START_WITH_FULL;
4269         u8 dev_id[ETH_ALEN], *_dev_id = NULL;
4270         u8 dev_type[WPS_DEV_TYPE_LEN], *_dev_type = NULL;
4271         char *pos;
4272         unsigned int search_delay;
4273
4274         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
4275                 wpa_dbg(wpa_s, MSG_INFO,
4276                         "Reject P2P_FIND since interface is disabled");
4277                 return -1;
4278         }
4279         if (os_strstr(cmd, "type=social"))
4280                 type = P2P_FIND_ONLY_SOCIAL;
4281         else if (os_strstr(cmd, "type=progressive"))
4282                 type = P2P_FIND_PROGRESSIVE;
4283
4284         pos = os_strstr(cmd, "dev_id=");
4285         if (pos) {
4286                 pos += 7;
4287                 if (hwaddr_aton(pos, dev_id))
4288                         return -1;
4289                 _dev_id = dev_id;
4290         }
4291
4292         pos = os_strstr(cmd, "dev_type=");
4293         if (pos) {
4294                 pos += 9;
4295                 if (wps_dev_type_str2bin(pos, dev_type) < 0)
4296                         return -1;
4297                 _dev_type = dev_type;
4298         }
4299
4300         pos = os_strstr(cmd, "delay=");
4301         if (pos) {
4302                 pos += 6;
4303                 search_delay = atoi(pos);
4304         } else
4305                 search_delay = wpas_p2p_search_delay(wpa_s);
4306
4307         return wpas_p2p_find(wpa_s, timeout, type, _dev_type != NULL, _dev_type,
4308                              _dev_id, search_delay);
4309 }
4310
4311
4312 static int p2p_ctrl_connect(struct wpa_supplicant *wpa_s, char *cmd,
4313                             char *buf, size_t buflen)
4314 {
4315         u8 addr[ETH_ALEN];
4316         char *pos, *pos2;
4317         char *pin = NULL;
4318         enum p2p_wps_method wps_method;
4319         int new_pin;
4320         int ret;
4321         int persistent_group, persistent_id = -1;
4322         int join;
4323         int auth;
4324         int automatic;
4325         int go_intent = -1;
4326         int freq = 0;
4327         int pd;
4328         int ht40, vht;
4329
4330         /* <addr> <"pbc" | "pin" | PIN> [label|display|keypad]
4331          * [persistent|persistent=<network id>]
4332          * [join] [auth] [go_intent=<0..15>] [freq=<in MHz>] [provdisc]
4333          * [ht40] [vht] */
4334
4335         if (hwaddr_aton(cmd, addr))
4336                 return -1;
4337
4338         pos = cmd + 17;
4339         if (*pos != ' ')
4340                 return -1;
4341         pos++;
4342
4343         persistent_group = os_strstr(pos, " persistent") != NULL;
4344         pos2 = os_strstr(pos, " persistent=");
4345         if (pos2) {
4346                 struct wpa_ssid *ssid;
4347                 persistent_id = atoi(pos2 + 12);
4348                 ssid = wpa_config_get_network(wpa_s->conf, persistent_id);
4349                 if (ssid == NULL || ssid->disabled != 2 ||
4350                     ssid->mode != WPAS_MODE_P2P_GO) {
4351                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
4352                                    "SSID id=%d for persistent P2P group (GO)",
4353                                    persistent_id);
4354                         return -1;
4355                 }
4356         }
4357         join = os_strstr(pos, " join") != NULL;
4358         auth = os_strstr(pos, " auth") != NULL;
4359         automatic = os_strstr(pos, " auto") != NULL;
4360         pd = os_strstr(pos, " provdisc") != NULL;
4361         vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
4362         ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
4363                 vht;
4364
4365         pos2 = os_strstr(pos, " go_intent=");
4366         if (pos2) {
4367                 pos2 += 11;
4368                 go_intent = atoi(pos2);
4369                 if (go_intent < 0 || go_intent > 15)
4370                         return -1;
4371         }
4372
4373         pos2 = os_strstr(pos, " freq=");
4374         if (pos2) {
4375                 pos2 += 6;
4376                 freq = atoi(pos2);
4377                 if (freq <= 0)
4378                         return -1;
4379         }
4380
4381         if (os_strncmp(pos, "pin", 3) == 0) {
4382                 /* Request random PIN (to be displayed) and enable the PIN */
4383                 wps_method = WPS_PIN_DISPLAY;
4384         } else if (os_strncmp(pos, "pbc", 3) == 0) {
4385                 wps_method = WPS_PBC;
4386         } else {
4387                 pin = pos;
4388                 pos = os_strchr(pin, ' ');
4389                 wps_method = WPS_PIN_KEYPAD;
4390                 if (pos) {
4391                         *pos++ = '\0';
4392                         if (os_strncmp(pos, "display", 7) == 0)
4393                                 wps_method = WPS_PIN_DISPLAY;
4394                 }
4395                 if (!wps_pin_str_valid(pin)) {
4396                         os_memcpy(buf, "FAIL-INVALID-PIN\n", 17);
4397                         return 17;
4398                 }
4399         }
4400
4401         new_pin = wpas_p2p_connect(wpa_s, addr, pin, wps_method,
4402                                    persistent_group, automatic, join,
4403                                    auth, go_intent, freq, persistent_id, pd,
4404                                    ht40, vht);
4405         if (new_pin == -2) {
4406                 os_memcpy(buf, "FAIL-CHANNEL-UNAVAILABLE\n", 25);
4407                 return 25;
4408         }
4409         if (new_pin == -3) {
4410                 os_memcpy(buf, "FAIL-CHANNEL-UNSUPPORTED\n", 25);
4411                 return 25;
4412         }
4413         if (new_pin < 0)
4414                 return -1;
4415         if (wps_method == WPS_PIN_DISPLAY && pin == NULL) {
4416                 ret = os_snprintf(buf, buflen, "%08d", new_pin);
4417                 if (os_snprintf_error(buflen, ret))
4418                         return -1;
4419                 return ret;
4420         }
4421
4422         os_memcpy(buf, "OK\n", 3);
4423         return 3;
4424 }
4425
4426
4427 static int p2p_ctrl_listen(struct wpa_supplicant *wpa_s, char *cmd)
4428 {
4429         unsigned int timeout = atoi(cmd);
4430         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
4431                 wpa_dbg(wpa_s, MSG_INFO,
4432                         "Reject P2P_LISTEN since interface is disabled");
4433                 return -1;
4434         }
4435         return wpas_p2p_listen(wpa_s, timeout);
4436 }
4437
4438
4439 static int p2p_ctrl_prov_disc(struct wpa_supplicant *wpa_s, char *cmd)
4440 {
4441         u8 addr[ETH_ALEN];
4442         char *pos;
4443         enum wpas_p2p_prov_disc_use use = WPAS_P2P_PD_FOR_GO_NEG;
4444
4445         /* <addr> <config method> [join|auto] */
4446
4447         if (hwaddr_aton(cmd, addr))
4448                 return -1;
4449
4450         pos = cmd + 17;
4451         if (*pos != ' ')
4452                 return -1;
4453         pos++;
4454
4455         if (os_strstr(pos, " join") != NULL)
4456                 use = WPAS_P2P_PD_FOR_JOIN;
4457         else if (os_strstr(pos, " auto") != NULL)
4458                 use = WPAS_P2P_PD_AUTO;
4459
4460         return wpas_p2p_prov_disc(wpa_s, addr, pos, use);
4461 }
4462
4463
4464 static int p2p_get_passphrase(struct wpa_supplicant *wpa_s, char *buf,
4465                               size_t buflen)
4466 {
4467         struct wpa_ssid *ssid = wpa_s->current_ssid;
4468
4469         if (ssid == NULL || ssid->mode != WPAS_MODE_P2P_GO ||
4470             ssid->passphrase == NULL)
4471                 return -1;
4472
4473         os_strlcpy(buf, ssid->passphrase, buflen);
4474         return os_strlen(buf);
4475 }
4476
4477
4478 static int p2p_ctrl_serv_disc_req(struct wpa_supplicant *wpa_s, char *cmd,
4479                                   char *buf, size_t buflen)
4480 {
4481         u64 ref;
4482         int res;
4483         u8 dst_buf[ETH_ALEN], *dst;
4484         struct wpabuf *tlvs;
4485         char *pos;
4486         size_t len;
4487
4488         if (hwaddr_aton(cmd, dst_buf))
4489                 return -1;
4490         dst = dst_buf;
4491         if (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
4492             dst[3] == 0 && dst[4] == 0 && dst[5] == 0)
4493                 dst = NULL;
4494         pos = cmd + 17;
4495         if (*pos != ' ')
4496                 return -1;
4497         pos++;
4498
4499         if (os_strncmp(pos, "upnp ", 5) == 0) {
4500                 u8 version;
4501                 pos += 5;
4502                 if (hexstr2bin(pos, &version, 1) < 0)
4503                         return -1;
4504                 pos += 2;
4505                 if (*pos != ' ')
4506                         return -1;
4507                 pos++;
4508                 ref = wpas_p2p_sd_request_upnp(wpa_s, dst, version, pos);
4509 #ifdef CONFIG_WIFI_DISPLAY
4510         } else if (os_strncmp(pos, "wifi-display ", 13) == 0) {
4511                 ref = wpas_p2p_sd_request_wifi_display(wpa_s, dst, pos + 13);
4512 #endif /* CONFIG_WIFI_DISPLAY */
4513         } else {
4514                 len = os_strlen(pos);
4515                 if (len & 1)
4516                         return -1;
4517                 len /= 2;
4518                 tlvs = wpabuf_alloc(len);
4519                 if (tlvs == NULL)
4520                         return -1;
4521                 if (hexstr2bin(pos, wpabuf_put(tlvs, len), len) < 0) {
4522                         wpabuf_free(tlvs);
4523                         return -1;
4524                 }
4525
4526                 ref = wpas_p2p_sd_request(wpa_s, dst, tlvs);
4527                 wpabuf_free(tlvs);
4528         }
4529         if (ref == 0)
4530                 return -1;
4531         res = os_snprintf(buf, buflen, "%llx", (long long unsigned) ref);
4532         if (os_snprintf_error(buflen, res))
4533                 return -1;
4534         return res;
4535 }
4536
4537
4538 static int p2p_ctrl_serv_disc_cancel_req(struct wpa_supplicant *wpa_s,
4539                                          char *cmd)
4540 {
4541         long long unsigned val;
4542         u64 req;
4543         if (sscanf(cmd, "%llx", &val) != 1)
4544                 return -1;
4545         req = val;
4546         return wpas_p2p_sd_cancel_request(wpa_s, req);
4547 }
4548
4549
4550 static int p2p_ctrl_serv_disc_resp(struct wpa_supplicant *wpa_s, char *cmd)
4551 {
4552         int freq;
4553         u8 dst[ETH_ALEN];
4554         u8 dialog_token;
4555         struct wpabuf *resp_tlvs;
4556         char *pos, *pos2;
4557         size_t len;
4558
4559         pos = os_strchr(cmd, ' ');
4560         if (pos == NULL)
4561                 return -1;
4562         *pos++ = '\0';
4563         freq = atoi(cmd);
4564         if (freq == 0)
4565                 return -1;
4566
4567         if (hwaddr_aton(pos, dst))
4568                 return -1;
4569         pos += 17;
4570         if (*pos != ' ')
4571                 return -1;
4572         pos++;
4573
4574         pos2 = os_strchr(pos, ' ');
4575         if (pos2 == NULL)
4576                 return -1;
4577         *pos2++ = '\0';
4578         dialog_token = atoi(pos);
4579
4580         len = os_strlen(pos2);
4581         if (len & 1)
4582                 return -1;
4583         len /= 2;
4584         resp_tlvs = wpabuf_alloc(len);
4585         if (resp_tlvs == NULL)
4586                 return -1;
4587         if (hexstr2bin(pos2, wpabuf_put(resp_tlvs, len), len) < 0) {
4588                 wpabuf_free(resp_tlvs);
4589                 return -1;
4590         }
4591
4592         wpas_p2p_sd_response(wpa_s, freq, dst, dialog_token, resp_tlvs);
4593         wpabuf_free(resp_tlvs);
4594         return 0;
4595 }
4596
4597
4598 static int p2p_ctrl_serv_disc_external(struct wpa_supplicant *wpa_s,
4599                                        char *cmd)
4600 {
4601         if (os_strcmp(cmd, "0") && os_strcmp(cmd, "1"))
4602                 return -1;
4603         wpa_s->p2p_sd_over_ctrl_iface = atoi(cmd);
4604         return 0;
4605 }
4606
4607
4608 static int p2p_ctrl_service_add_bonjour(struct wpa_supplicant *wpa_s,
4609                                         char *cmd)
4610 {
4611         char *pos;
4612         size_t len;
4613         struct wpabuf *query, *resp;
4614
4615         pos = os_strchr(cmd, ' ');
4616         if (pos == NULL)
4617                 return -1;
4618         *pos++ = '\0';
4619
4620         len = os_strlen(cmd);
4621         if (len & 1)
4622                 return -1;
4623         len /= 2;
4624         query = wpabuf_alloc(len);
4625         if (query == NULL)
4626                 return -1;
4627         if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
4628                 wpabuf_free(query);
4629                 return -1;
4630         }
4631
4632         len = os_strlen(pos);
4633         if (len & 1) {
4634                 wpabuf_free(query);
4635                 return -1;
4636         }
4637         len /= 2;
4638         resp = wpabuf_alloc(len);
4639         if (resp == NULL) {
4640                 wpabuf_free(query);
4641                 return -1;
4642         }
4643         if (hexstr2bin(pos, wpabuf_put(resp, len), len) < 0) {
4644                 wpabuf_free(query);
4645                 wpabuf_free(resp);
4646                 return -1;
4647         }
4648
4649         if (wpas_p2p_service_add_bonjour(wpa_s, query, resp) < 0) {
4650                 wpabuf_free(query);
4651                 wpabuf_free(resp);
4652                 return -1;
4653         }
4654         return 0;
4655 }
4656
4657
4658 static int p2p_ctrl_service_add_upnp(struct wpa_supplicant *wpa_s, char *cmd)
4659 {
4660         char *pos;
4661         u8 version;
4662
4663         pos = os_strchr(cmd, ' ');
4664         if (pos == NULL)
4665                 return -1;
4666         *pos++ = '\0';
4667
4668         if (hexstr2bin(cmd, &version, 1) < 0)
4669                 return -1;
4670
4671         return wpas_p2p_service_add_upnp(wpa_s, version, pos);
4672 }
4673
4674
4675 static int p2p_ctrl_service_add(struct wpa_supplicant *wpa_s, char *cmd)
4676 {
4677         char *pos;
4678
4679         pos = os_strchr(cmd, ' ');
4680         if (pos == NULL)
4681                 return -1;
4682         *pos++ = '\0';
4683
4684         if (os_strcmp(cmd, "bonjour") == 0)
4685                 return p2p_ctrl_service_add_bonjour(wpa_s, pos);
4686         if (os_strcmp(cmd, "upnp") == 0)
4687                 return p2p_ctrl_service_add_upnp(wpa_s, pos);
4688         wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
4689         return -1;
4690 }
4691
4692
4693 static int p2p_ctrl_service_del_bonjour(struct wpa_supplicant *wpa_s,
4694                                         char *cmd)
4695 {
4696         size_t len;
4697         struct wpabuf *query;
4698         int ret;
4699
4700         len = os_strlen(cmd);
4701         if (len & 1)
4702                 return -1;
4703         len /= 2;
4704         query = wpabuf_alloc(len);
4705         if (query == NULL)
4706                 return -1;
4707         if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
4708                 wpabuf_free(query);
4709                 return -1;
4710         }
4711
4712         ret = wpas_p2p_service_del_bonjour(wpa_s, query);
4713         wpabuf_free(query);
4714         return ret;
4715 }
4716
4717
4718 static int p2p_ctrl_service_del_upnp(struct wpa_supplicant *wpa_s, char *cmd)
4719 {
4720         char *pos;
4721         u8 version;
4722
4723         pos = os_strchr(cmd, ' ');
4724         if (pos == NULL)
4725                 return -1;
4726         *pos++ = '\0';
4727
4728         if (hexstr2bin(cmd, &version, 1) < 0)
4729                 return -1;
4730
4731         return wpas_p2p_service_del_upnp(wpa_s, version, pos);
4732 }
4733
4734
4735 static int p2p_ctrl_service_del(struct wpa_supplicant *wpa_s, char *cmd)
4736 {
4737         char *pos;
4738
4739         pos = os_strchr(cmd, ' ');
4740         if (pos == NULL)
4741                 return -1;
4742         *pos++ = '\0';
4743
4744         if (os_strcmp(cmd, "bonjour") == 0)
4745                 return p2p_ctrl_service_del_bonjour(wpa_s, pos);
4746         if (os_strcmp(cmd, "upnp") == 0)
4747                 return p2p_ctrl_service_del_upnp(wpa_s, pos);
4748         wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
4749         return -1;
4750 }
4751
4752
4753 static int p2p_ctrl_reject(struct wpa_supplicant *wpa_s, char *cmd)
4754 {
4755         u8 addr[ETH_ALEN];
4756
4757         /* <addr> */
4758
4759         if (hwaddr_aton(cmd, addr))
4760                 return -1;
4761
4762         return wpas_p2p_reject(wpa_s, addr);
4763 }
4764
4765
4766 static int p2p_ctrl_invite_persistent(struct wpa_supplicant *wpa_s, char *cmd)
4767 {
4768         char *pos;
4769         int id;
4770         struct wpa_ssid *ssid;
4771         u8 *_peer = NULL, peer[ETH_ALEN];
4772         int freq = 0, pref_freq = 0;
4773         int ht40, vht;
4774
4775         id = atoi(cmd);
4776         pos = os_strstr(cmd, " peer=");
4777         if (pos) {
4778                 pos += 6;
4779                 if (hwaddr_aton(pos, peer))
4780                         return -1;
4781                 _peer = peer;
4782         }
4783         ssid = wpa_config_get_network(wpa_s->conf, id);
4784         if (ssid == NULL || ssid->disabled != 2) {
4785                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
4786                            "for persistent P2P group",
4787                            id);
4788                 return -1;
4789         }
4790
4791         pos = os_strstr(cmd, " freq=");
4792         if (pos) {
4793                 pos += 6;
4794                 freq = atoi(pos);
4795                 if (freq <= 0)
4796                         return -1;
4797         }
4798
4799         pos = os_strstr(cmd, " pref=");
4800         if (pos) {
4801                 pos += 6;
4802                 pref_freq = atoi(pos);
4803                 if (pref_freq <= 0)
4804                         return -1;
4805         }
4806
4807         vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
4808         ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
4809                 vht;
4810
4811         return wpas_p2p_invite(wpa_s, _peer, ssid, NULL, freq, ht40, vht,
4812                                pref_freq);
4813 }
4814
4815
4816 static int p2p_ctrl_invite_group(struct wpa_supplicant *wpa_s, char *cmd)
4817 {
4818         char *pos;
4819         u8 peer[ETH_ALEN], go_dev_addr[ETH_ALEN], *go_dev = NULL;
4820
4821         pos = os_strstr(cmd, " peer=");
4822         if (!pos)
4823                 return -1;
4824
4825         *pos = '\0';
4826         pos += 6;
4827         if (hwaddr_aton(pos, peer)) {
4828                 wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'", pos);
4829                 return -1;
4830         }
4831
4832         pos = os_strstr(pos, " go_dev_addr=");
4833         if (pos) {
4834                 pos += 13;
4835                 if (hwaddr_aton(pos, go_dev_addr)) {
4836                         wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'",
4837                                    pos);
4838                         return -1;
4839                 }
4840                 go_dev = go_dev_addr;
4841         }
4842
4843         return wpas_p2p_invite_group(wpa_s, cmd, peer, go_dev);
4844 }
4845
4846
4847 static int p2p_ctrl_invite(struct wpa_supplicant *wpa_s, char *cmd)
4848 {
4849         if (os_strncmp(cmd, "persistent=", 11) == 0)
4850                 return p2p_ctrl_invite_persistent(wpa_s, cmd + 11);
4851         if (os_strncmp(cmd, "group=", 6) == 0)
4852                 return p2p_ctrl_invite_group(wpa_s, cmd + 6);
4853
4854         return -1;
4855 }
4856
4857
4858 static int p2p_ctrl_group_add_persistent(struct wpa_supplicant *wpa_s,
4859                                          char *cmd, int freq, int ht40,
4860                                          int vht)
4861 {
4862         int id;
4863         struct wpa_ssid *ssid;
4864
4865         id = atoi(cmd);
4866         ssid = wpa_config_get_network(wpa_s->conf, id);
4867         if (ssid == NULL || ssid->disabled != 2) {
4868                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
4869                            "for persistent P2P group",
4870                            id);
4871                 return -1;
4872         }
4873
4874         return wpas_p2p_group_add_persistent(wpa_s, ssid, 0, freq, 0, ht40, vht,
4875                                              NULL, 0);
4876 }
4877
4878
4879 static int p2p_ctrl_group_add(struct wpa_supplicant *wpa_s, char *cmd)
4880 {
4881         int freq = 0, ht40, vht;
4882         char *pos;
4883
4884         pos = os_strstr(cmd, "freq=");
4885         if (pos)
4886                 freq = atoi(pos + 5);
4887
4888         vht = (os_strstr(cmd, "vht") != NULL) || wpa_s->conf->p2p_go_vht;
4889         ht40 = (os_strstr(cmd, "ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
4890                 vht;
4891
4892         if (os_strncmp(cmd, "persistent=", 11) == 0)
4893                 return p2p_ctrl_group_add_persistent(wpa_s, cmd + 11, freq,
4894                                                      ht40, vht);
4895         if (os_strcmp(cmd, "persistent") == 0 ||
4896             os_strncmp(cmd, "persistent ", 11) == 0)
4897                 return wpas_p2p_group_add(wpa_s, 1, freq, ht40, vht);
4898         if (os_strncmp(cmd, "freq=", 5) == 0)
4899                 return wpas_p2p_group_add(wpa_s, 0, freq, ht40, vht);
4900         if (ht40)
4901                 return wpas_p2p_group_add(wpa_s, 0, freq, ht40, vht);
4902
4903         wpa_printf(MSG_DEBUG, "CTRL: Invalid P2P_GROUP_ADD parameters '%s'",
4904                    cmd);
4905         return -1;
4906 }
4907
4908
4909 static int p2p_ctrl_peer(struct wpa_supplicant *wpa_s, char *cmd,
4910                          char *buf, size_t buflen)
4911 {
4912         u8 addr[ETH_ALEN], *addr_ptr;
4913         int next, res;
4914         const struct p2p_peer_info *info;
4915         char *pos, *end;
4916         char devtype[WPS_DEV_TYPE_BUFSIZE];
4917         struct wpa_ssid *ssid;
4918         size_t i;
4919
4920         if (!wpa_s->global->p2p)
4921                 return -1;
4922
4923         if (os_strcmp(cmd, "FIRST") == 0) {
4924                 addr_ptr = NULL;
4925                 next = 0;
4926         } else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
4927                 if (hwaddr_aton(cmd + 5, addr) < 0)
4928                         return -1;
4929                 addr_ptr = addr;
4930                 next = 1;
4931         } else {
4932                 if (hwaddr_aton(cmd, addr) < 0)
4933                         return -1;
4934                 addr_ptr = addr;
4935                 next = 0;
4936         }
4937
4938         info = p2p_get_peer_info(wpa_s->global->p2p, addr_ptr, next);
4939         if (info == NULL)
4940                 return -1;
4941
4942         pos = buf;
4943         end = buf + buflen;
4944
4945         res = os_snprintf(pos, end - pos, MACSTR "\n"
4946                           "pri_dev_type=%s\n"
4947                           "device_name=%s\n"
4948                           "manufacturer=%s\n"
4949                           "model_name=%s\n"
4950                           "model_number=%s\n"
4951                           "serial_number=%s\n"
4952                           "config_methods=0x%x\n"
4953                           "dev_capab=0x%x\n"
4954                           "group_capab=0x%x\n"
4955                           "level=%d\n",
4956                           MAC2STR(info->p2p_device_addr),
4957                           wps_dev_type_bin2str(info->pri_dev_type,
4958                                                devtype, sizeof(devtype)),
4959                           info->device_name,
4960                           info->manufacturer,
4961                           info->model_name,
4962                           info->model_number,
4963                           info->serial_number,
4964                           info->config_methods,
4965                           info->dev_capab,
4966                           info->group_capab,
4967                           info->level);
4968         if (os_snprintf_error(end - pos, res))
4969                 return pos - buf;
4970         pos += res;
4971
4972         for (i = 0; i < info->wps_sec_dev_type_list_len / WPS_DEV_TYPE_LEN; i++)
4973         {
4974                 const u8 *t;
4975                 t = &info->wps_sec_dev_type_list[i * WPS_DEV_TYPE_LEN];
4976                 res = os_snprintf(pos, end - pos, "sec_dev_type=%s\n",
4977                                   wps_dev_type_bin2str(t, devtype,
4978                                                        sizeof(devtype)));
4979                 if (os_snprintf_error(end - pos, res))
4980                         return pos - buf;
4981                 pos += res;
4982         }
4983
4984         ssid = wpas_p2p_get_persistent(wpa_s, info->p2p_device_addr, NULL, 0);
4985         if (ssid) {
4986                 res = os_snprintf(pos, end - pos, "persistent=%d\n", ssid->id);
4987                 if (os_snprintf_error(end - pos, res))
4988                         return pos - buf;
4989                 pos += res;
4990         }
4991
4992         res = p2p_get_peer_info_txt(info, pos, end - pos);
4993         if (res < 0)
4994                 return pos - buf;
4995         pos += res;
4996
4997         if (info->vendor_elems) {
4998                 res = os_snprintf(pos, end - pos, "vendor_elems=");
4999                 if (os_snprintf_error(end - pos, res))
5000                         return pos - buf;
5001                 pos += res;
5002
5003                 pos += wpa_snprintf_hex(pos, end - pos,
5004                                         wpabuf_head(info->vendor_elems),
5005                                         wpabuf_len(info->vendor_elems));
5006
5007                 res = os_snprintf(pos, end - pos, "\n");
5008                 if (os_snprintf_error(end - pos, res))
5009                         return pos - buf;
5010                 pos += res;
5011         }
5012
5013         return pos - buf;
5014 }
5015
5016
5017 static int p2p_ctrl_disallow_freq(struct wpa_supplicant *wpa_s,
5018                                   const char *param)
5019 {
5020         unsigned int i;
5021
5022         if (wpa_s->global->p2p == NULL)
5023                 return -1;
5024
5025         if (freq_range_list_parse(&wpa_s->global->p2p_disallow_freq, param) < 0)
5026                 return -1;
5027
5028         for (i = 0; i < wpa_s->global->p2p_disallow_freq.num; i++) {
5029                 struct wpa_freq_range *freq;
5030                 freq = &wpa_s->global->p2p_disallow_freq.range[i];
5031                 wpa_printf(MSG_DEBUG, "P2P: Disallowed frequency range %u-%u",
5032                            freq->min, freq->max);
5033         }
5034
5035         wpas_p2p_update_channel_list(wpa_s);
5036         return 0;
5037 }
5038
5039
5040 static int p2p_ctrl_set(struct wpa_supplicant *wpa_s, char *cmd)
5041 {
5042         char *param;
5043
5044         if (wpa_s->global->p2p == NULL)
5045                 return -1;
5046
5047         param = os_strchr(cmd, ' ');
5048         if (param == NULL)
5049                 return -1;
5050         *param++ = '\0';
5051
5052         if (os_strcmp(cmd, "discoverability") == 0) {
5053                 p2p_set_client_discoverability(wpa_s->global->p2p,
5054                                                atoi(param));
5055                 return 0;
5056         }
5057
5058         if (os_strcmp(cmd, "managed") == 0) {
5059                 p2p_set_managed_oper(wpa_s->global->p2p, atoi(param));
5060                 return 0;
5061         }
5062
5063         if (os_strcmp(cmd, "listen_channel") == 0) {
5064                 return p2p_set_listen_channel(wpa_s->global->p2p, 81,
5065                                               atoi(param), 1);
5066         }
5067
5068         if (os_strcmp(cmd, "ssid_postfix") == 0) {
5069                 return p2p_set_ssid_postfix(wpa_s->global->p2p, (u8 *) param,
5070                                             os_strlen(param));
5071         }
5072
5073         if (os_strcmp(cmd, "noa") == 0) {
5074                 char *pos;
5075                 int count, start, duration;
5076                 /* GO NoA parameters: count,start_offset(ms),duration(ms) */
5077                 count = atoi(param);
5078                 pos = os_strchr(param, ',');
5079                 if (pos == NULL)
5080                         return -1;
5081                 pos++;
5082                 start = atoi(pos);
5083                 pos = os_strchr(pos, ',');
5084                 if (pos == NULL)
5085                         return -1;
5086                 pos++;
5087                 duration = atoi(pos);
5088                 if (count < 0 || count > 255 || start < 0 || duration < 0)
5089                         return -1;
5090                 if (count == 0 && duration > 0)
5091                         return -1;
5092                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: P2P_SET GO NoA: count=%d "
5093                            "start=%d duration=%d", count, start, duration);
5094                 return wpas_p2p_set_noa(wpa_s, count, start, duration);
5095         }
5096
5097         if (os_strcmp(cmd, "ps") == 0)
5098                 return wpa_drv_set_p2p_powersave(wpa_s, atoi(param), -1, -1);
5099
5100         if (os_strcmp(cmd, "oppps") == 0)
5101                 return wpa_drv_set_p2p_powersave(wpa_s, -1, atoi(param), -1);
5102
5103         if (os_strcmp(cmd, "ctwindow") == 0)
5104                 return wpa_drv_set_p2p_powersave(wpa_s, -1, -1, atoi(param));
5105
5106         if (os_strcmp(cmd, "disabled") == 0) {
5107                 wpa_s->global->p2p_disabled = atoi(param);
5108                 wpa_printf(MSG_DEBUG, "P2P functionality %s",
5109                            wpa_s->global->p2p_disabled ?
5110                            "disabled" : "enabled");
5111                 if (wpa_s->global->p2p_disabled) {
5112                         wpas_p2p_stop_find(wpa_s);
5113                         os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
5114                         p2p_flush(wpa_s->global->p2p);
5115                 }
5116                 return 0;
5117         }
5118
5119         if (os_strcmp(cmd, "conc_pref") == 0) {
5120                 if (os_strcmp(param, "sta") == 0)
5121                         wpa_s->global->conc_pref = WPA_CONC_PREF_STA;
5122                 else if (os_strcmp(param, "p2p") == 0)
5123                         wpa_s->global->conc_pref = WPA_CONC_PREF_P2P;
5124                 else {
5125                         wpa_printf(MSG_INFO, "Invalid conc_pref value");
5126                         return -1;
5127                 }
5128                 wpa_printf(MSG_DEBUG, "Single channel concurrency preference: "
5129                            "%s", param);
5130                 return 0;
5131         }
5132
5133         if (os_strcmp(cmd, "force_long_sd") == 0) {
5134                 wpa_s->force_long_sd = atoi(param);
5135                 return 0;
5136         }
5137
5138         if (os_strcmp(cmd, "peer_filter") == 0) {
5139                 u8 addr[ETH_ALEN];
5140                 if (hwaddr_aton(param, addr))
5141                         return -1;
5142                 p2p_set_peer_filter(wpa_s->global->p2p, addr);
5143                 return 0;
5144         }
5145
5146         if (os_strcmp(cmd, "cross_connect") == 0)
5147                 return wpas_p2p_set_cross_connect(wpa_s, atoi(param));
5148
5149         if (os_strcmp(cmd, "go_apsd") == 0) {
5150                 if (os_strcmp(param, "disable") == 0)
5151                         wpa_s->set_ap_uapsd = 0;
5152                 else {
5153                         wpa_s->set_ap_uapsd = 1;
5154                         wpa_s->ap_uapsd = atoi(param);
5155                 }
5156                 return 0;
5157         }
5158
5159         if (os_strcmp(cmd, "client_apsd") == 0) {
5160                 if (os_strcmp(param, "disable") == 0)
5161                         wpa_s->set_sta_uapsd = 0;
5162                 else {
5163                         int be, bk, vi, vo;
5164                         char *pos;
5165                         /* format: BE,BK,VI,VO;max SP Length */
5166                         be = atoi(param);
5167                         pos = os_strchr(param, ',');
5168                         if (pos == NULL)
5169                                 return -1;
5170                         pos++;
5171                         bk = atoi(pos);
5172                         pos = os_strchr(pos, ',');
5173                         if (pos == NULL)
5174                                 return -1;
5175                         pos++;
5176                         vi = atoi(pos);
5177                         pos = os_strchr(pos, ',');
5178                         if (pos == NULL)
5179                                 return -1;
5180                         pos++;
5181                         vo = atoi(pos);
5182                         /* ignore max SP Length for now */
5183
5184                         wpa_s->set_sta_uapsd = 1;
5185                         wpa_s->sta_uapsd = 0;
5186                         if (be)
5187                                 wpa_s->sta_uapsd |= BIT(0);
5188                         if (bk)
5189                                 wpa_s->sta_uapsd |= BIT(1);
5190                         if (vi)
5191                                 wpa_s->sta_uapsd |= BIT(2);
5192                         if (vo)
5193                                 wpa_s->sta_uapsd |= BIT(3);
5194                 }
5195                 return 0;
5196         }
5197
5198         if (os_strcmp(cmd, "disallow_freq") == 0)
5199                 return p2p_ctrl_disallow_freq(wpa_s, param);
5200
5201         if (os_strcmp(cmd, "disc_int") == 0) {
5202                 int min_disc_int, max_disc_int, max_disc_tu;
5203                 char *pos;
5204
5205                 pos = param;
5206
5207                 min_disc_int = atoi(pos);
5208                 pos = os_strchr(pos, ' ');
5209                 if (pos == NULL)
5210                         return -1;
5211                 *pos++ = '\0';
5212
5213                 max_disc_int = atoi(pos);
5214                 pos = os_strchr(pos, ' ');
5215                 if (pos == NULL)
5216                         return -1;
5217                 *pos++ = '\0';
5218
5219                 max_disc_tu = atoi(pos);
5220
5221                 return p2p_set_disc_int(wpa_s->global->p2p, min_disc_int,
5222                                         max_disc_int, max_disc_tu);
5223         }
5224
5225         if (os_strcmp(cmd, "per_sta_psk") == 0) {
5226                 wpa_s->global->p2p_per_sta_psk = !!atoi(param);
5227                 return 0;
5228         }
5229
5230 #ifdef CONFIG_WPS_NFC
5231         if (os_strcmp(cmd, "nfc_tag") == 0)
5232                 return wpas_p2p_nfc_tag_enabled(wpa_s, !!atoi(param));
5233 #endif /* CONFIG_WPS_NFC */
5234
5235         if (os_strcmp(cmd, "disable_ip_addr_req") == 0) {
5236                 wpa_s->p2p_disable_ip_addr_req = !!atoi(param);
5237                 return 0;
5238         }
5239
5240         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown P2P_SET field value '%s'",
5241                    cmd);
5242
5243         return -1;
5244 }
5245
5246
5247 static void p2p_ctrl_flush(struct wpa_supplicant *wpa_s)
5248 {
5249         os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
5250         wpa_s->force_long_sd = 0;
5251         wpas_p2p_stop_find(wpa_s);
5252         if (wpa_s->global->p2p)
5253                 p2p_flush(wpa_s->global->p2p);
5254 }
5255
5256
5257 static int p2p_ctrl_presence_req(struct wpa_supplicant *wpa_s, char *cmd)
5258 {
5259         char *pos, *pos2;
5260         unsigned int dur1 = 0, int1 = 0, dur2 = 0, int2 = 0;
5261
5262         if (cmd[0]) {
5263                 pos = os_strchr(cmd, ' ');
5264                 if (pos == NULL)
5265                         return -1;
5266                 *pos++ = '\0';
5267                 dur1 = atoi(cmd);
5268
5269                 pos2 = os_strchr(pos, ' ');
5270                 if (pos2)
5271                         *pos2++ = '\0';
5272                 int1 = atoi(pos);
5273         } else
5274                 pos2 = NULL;
5275
5276         if (pos2) {
5277                 pos = os_strchr(pos2, ' ');
5278                 if (pos == NULL)
5279                         return -1;
5280                 *pos++ = '\0';
5281                 dur2 = atoi(pos2);
5282                 int2 = atoi(pos);
5283         }
5284
5285         return wpas_p2p_presence_req(wpa_s, dur1, int1, dur2, int2);
5286 }
5287
5288
5289 static int p2p_ctrl_ext_listen(struct wpa_supplicant *wpa_s, char *cmd)
5290 {
5291         char *pos;
5292         unsigned int period = 0, interval = 0;
5293
5294         if (cmd[0]) {
5295                 pos = os_strchr(cmd, ' ');
5296                 if (pos == NULL)
5297                         return -1;
5298                 *pos++ = '\0';
5299                 period = atoi(cmd);
5300                 interval = atoi(pos);
5301         }
5302
5303         return wpas_p2p_ext_listen(wpa_s, period, interval);
5304 }
5305
5306
5307 static int p2p_ctrl_remove_client(struct wpa_supplicant *wpa_s, const char *cmd)
5308 {
5309         const char *pos;
5310         u8 peer[ETH_ALEN];
5311         int iface_addr = 0;
5312
5313         pos = cmd;
5314         if (os_strncmp(pos, "iface=", 6) == 0) {
5315                 iface_addr = 1;
5316                 pos += 6;
5317         }
5318         if (hwaddr_aton(pos, peer))
5319                 return -1;
5320
5321         wpas_p2p_remove_client(wpa_s, peer, iface_addr);
5322         return 0;
5323 }
5324
5325 #endif /* CONFIG_P2P */
5326
5327
5328 static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s, char *val)
5329 {
5330         struct wpa_freq_range_list ranges;
5331         int *freqs = NULL;
5332         struct hostapd_hw_modes *mode;
5333         u16 i;
5334
5335         if (wpa_s->hw.modes == NULL)
5336                 return NULL;
5337
5338         os_memset(&ranges, 0, sizeof(ranges));
5339         if (freq_range_list_parse(&ranges, val) < 0)
5340                 return NULL;
5341
5342         for (i = 0; i < wpa_s->hw.num_modes; i++) {
5343                 int j;
5344
5345                 mode = &wpa_s->hw.modes[i];
5346                 for (j = 0; j < mode->num_channels; j++) {
5347                         unsigned int freq;
5348
5349                         if (mode->channels[j].flag & HOSTAPD_CHAN_DISABLED)
5350                                 continue;
5351
5352                         freq = mode->channels[j].freq;
5353                         if (!freq_range_list_includes(&ranges, freq))
5354                                 continue;
5355
5356                         int_array_add_unique(&freqs, freq);
5357                 }
5358         }
5359
5360         os_free(ranges.range);
5361         return freqs;
5362 }
5363
5364
5365 #ifdef CONFIG_INTERWORKING
5366
5367 static int ctrl_interworking_select(struct wpa_supplicant *wpa_s, char *param)
5368 {
5369         int auto_sel = 0;
5370         int *freqs = NULL;
5371
5372         if (param) {
5373                 char *pos;
5374
5375                 auto_sel = os_strstr(param, "auto") != NULL;
5376
5377                 pos = os_strstr(param, "freq=");
5378                 if (pos) {
5379                         freqs = freq_range_to_channel_list(wpa_s, pos + 5);
5380                         if (freqs == NULL)
5381                                 return -1;
5382                 }
5383
5384         }
5385
5386         return interworking_select(wpa_s, auto_sel, freqs);
5387 }
5388
5389
5390 static int ctrl_interworking_connect(struct wpa_supplicant *wpa_s, char *dst)
5391 {
5392         u8 bssid[ETH_ALEN];
5393         struct wpa_bss *bss;
5394
5395         if (hwaddr_aton(dst, bssid)) {
5396                 wpa_printf(MSG_DEBUG, "Invalid BSSID '%s'", dst);
5397                 return -1;
5398         }
5399
5400         bss = wpa_bss_get_bssid(wpa_s, bssid);
5401         if (bss == NULL) {
5402                 wpa_printf(MSG_DEBUG, "Could not find BSS " MACSTR,
5403                            MAC2STR(bssid));
5404                 return -1;
5405         }
5406
5407         return interworking_connect(wpa_s, bss);
5408 }
5409
5410
5411 static int get_anqp(struct wpa_supplicant *wpa_s, char *dst)
5412 {
5413         u8 dst_addr[ETH_ALEN];
5414         int used;
5415         char *pos;
5416 #define MAX_ANQP_INFO_ID 100
5417         u16 id[MAX_ANQP_INFO_ID];
5418         size_t num_id = 0;
5419         u32 subtypes = 0;
5420
5421         used = hwaddr_aton2(dst, dst_addr);
5422         if (used < 0)
5423                 return -1;
5424         pos = dst + used;
5425         if (*pos == ' ')
5426                 pos++;
5427         while (num_id < MAX_ANQP_INFO_ID) {
5428                 if (os_strncmp(pos, "hs20:", 5) == 0) {
5429 #ifdef CONFIG_HS20
5430                         int num = atoi(pos + 5);
5431                         if (num <= 0 || num > 31)
5432                                 return -1;
5433                         subtypes |= BIT(num);
5434 #else /* CONFIG_HS20 */
5435                         return -1;
5436 #endif /* CONFIG_HS20 */
5437                 } else {
5438                         id[num_id] = atoi(pos);
5439                         if (id[num_id])
5440                                 num_id++;
5441                 }
5442                 pos = os_strchr(pos + 1, ',');
5443                 if (pos == NULL)
5444                         break;
5445                 pos++;
5446         }
5447
5448         if (num_id == 0)
5449                 return -1;
5450
5451         return anqp_send_req(wpa_s, dst_addr, id, num_id, subtypes);
5452 }
5453
5454
5455 static int gas_request(struct wpa_supplicant *wpa_s, char *cmd)
5456 {
5457         u8 dst_addr[ETH_ALEN];
5458         struct wpabuf *advproto, *query = NULL;
5459         int used, ret = -1;
5460         char *pos, *end;
5461         size_t len;
5462
5463         used = hwaddr_aton2(cmd, dst_addr);
5464         if (used < 0)
5465                 return -1;
5466
5467         pos = cmd + used;
5468         while (*pos == ' ')
5469                 pos++;
5470
5471         /* Advertisement Protocol ID */
5472         end = os_strchr(pos, ' ');
5473         if (end)
5474                 len = end - pos;
5475         else
5476                 len = os_strlen(pos);
5477         if (len & 0x01)
5478                 return -1;
5479         len /= 2;
5480         if (len == 0)
5481                 return -1;
5482         advproto = wpabuf_alloc(len);
5483         if (advproto == NULL)
5484                 return -1;
5485         if (hexstr2bin(pos, wpabuf_put(advproto, len), len) < 0)
5486                 goto fail;
5487
5488         if (end) {
5489                 /* Optional Query Request */
5490                 pos = end + 1;
5491                 while (*pos == ' ')
5492                         pos++;
5493
5494                 len = os_strlen(pos);
5495                 if (len) {
5496                         if (len & 0x01)
5497                                 goto fail;
5498                         len /= 2;
5499                         if (len == 0)
5500                                 goto fail;
5501                         query = wpabuf_alloc(len);
5502                         if (query == NULL)
5503                                 goto fail;
5504                         if (hexstr2bin(pos, wpabuf_put(query, len), len) < 0)
5505                                 goto fail;
5506                 }
5507         }
5508
5509         ret = gas_send_request(wpa_s, dst_addr, advproto, query);
5510
5511 fail:
5512         wpabuf_free(advproto);
5513         wpabuf_free(query);
5514
5515         return ret;
5516 }
5517
5518
5519 static int gas_response_get(struct wpa_supplicant *wpa_s, char *cmd, char *buf,
5520                             size_t buflen)
5521 {
5522         u8 addr[ETH_ALEN];
5523         int dialog_token;
5524         int used;
5525         char *pos;
5526         size_t resp_len, start, requested_len;
5527         struct wpabuf *resp;
5528         int ret;
5529
5530         used = hwaddr_aton2(cmd, addr);
5531         if (used < 0)
5532                 return -1;
5533
5534         pos = cmd + used;
5535         while (*pos == ' ')
5536                 pos++;
5537         dialog_token = atoi(pos);
5538
5539         if (wpa_s->last_gas_resp &&
5540             os_memcmp(addr, wpa_s->last_gas_addr, ETH_ALEN) == 0 &&
5541             dialog_token == wpa_s->last_gas_dialog_token)
5542                 resp = wpa_s->last_gas_resp;
5543         else if (wpa_s->prev_gas_resp &&
5544                  os_memcmp(addr, wpa_s->prev_gas_addr, ETH_ALEN) == 0 &&
5545                  dialog_token == wpa_s->prev_gas_dialog_token)
5546                 resp = wpa_s->prev_gas_resp;
5547         else
5548                 return -1;
5549
5550         resp_len = wpabuf_len(resp);
5551         start = 0;
5552         requested_len = resp_len;
5553
5554         pos = os_strchr(pos, ' ');
5555         if (pos) {
5556                 start = atoi(pos);
5557                 if (start > resp_len)
5558                         return os_snprintf(buf, buflen, "FAIL-Invalid range");
5559                 pos = os_strchr(pos, ',');
5560                 if (pos == NULL)
5561                         return -1;
5562                 pos++;
5563                 requested_len = atoi(pos);
5564                 if (start + requested_len > resp_len)
5565                         return os_snprintf(buf, buflen, "FAIL-Invalid range");
5566         }
5567
5568         if (requested_len * 2 + 1 > buflen)
5569                 return os_snprintf(buf, buflen, "FAIL-Too long response");
5570
5571         ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(resp) + start,
5572                                requested_len);
5573
5574         if (start + requested_len == resp_len) {
5575                 /*
5576                  * Free memory by dropping the response after it has been
5577                  * fetched.
5578                  */
5579                 if (resp == wpa_s->prev_gas_resp) {
5580                         wpabuf_free(wpa_s->prev_gas_resp);
5581                         wpa_s->prev_gas_resp = NULL;
5582                 } else {
5583                         wpabuf_free(wpa_s->last_gas_resp);
5584                         wpa_s->last_gas_resp = NULL;
5585                 }
5586         }
5587
5588         return ret;
5589 }
5590 #endif /* CONFIG_INTERWORKING */
5591
5592
5593 #ifdef CONFIG_HS20
5594
5595 static int get_hs20_anqp(struct wpa_supplicant *wpa_s, char *dst)
5596 {
5597         u8 dst_addr[ETH_ALEN];
5598         int used;
5599         char *pos;
5600         u32 subtypes = 0;
5601
5602         used = hwaddr_aton2(dst, dst_addr);
5603         if (used < 0)
5604                 return -1;
5605         pos = dst + used;
5606         if (*pos == ' ')
5607                 pos++;
5608         for (;;) {
5609                 int num = atoi(pos);
5610                 if (num <= 0 || num > 31)
5611                         return -1;
5612                 subtypes |= BIT(num);
5613                 pos = os_strchr(pos + 1, ',');
5614                 if (pos == NULL)
5615                         break;
5616                 pos++;
5617         }
5618
5619         if (subtypes == 0)
5620                 return -1;
5621
5622         return hs20_anqp_send_req(wpa_s, dst_addr, subtypes, NULL, 0);
5623 }
5624
5625
5626 static int hs20_nai_home_realm_list(struct wpa_supplicant *wpa_s,
5627                                     const u8 *addr, const char *realm)
5628 {
5629         u8 *buf;
5630         size_t rlen, len;
5631         int ret;
5632
5633         rlen = os_strlen(realm);
5634         len = 3 + rlen;
5635         buf = os_malloc(len);
5636         if (buf == NULL)
5637                 return -1;
5638         buf[0] = 1; /* NAI Home Realm Count */
5639         buf[1] = 0; /* Formatted in accordance with RFC 4282 */
5640         buf[2] = rlen;
5641         os_memcpy(buf + 3, realm, rlen);
5642
5643         ret = hs20_anqp_send_req(wpa_s, addr,
5644                                  BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
5645                                  buf, len);
5646
5647         os_free(buf);
5648
5649         return ret;
5650 }
5651
5652
5653 static int hs20_get_nai_home_realm_list(struct wpa_supplicant *wpa_s,
5654                                         char *dst)
5655 {
5656         struct wpa_cred *cred = wpa_s->conf->cred;
5657         u8 dst_addr[ETH_ALEN];
5658         int used;
5659         u8 *buf;
5660         size_t len;
5661         int ret;
5662
5663         used = hwaddr_aton2(dst, dst_addr);
5664         if (used < 0)
5665                 return -1;
5666
5667         while (dst[used] == ' ')
5668                 used++;
5669         if (os_strncmp(dst + used, "realm=", 6) == 0)
5670                 return hs20_nai_home_realm_list(wpa_s, dst_addr,
5671                                                 dst + used + 6);
5672
5673         len = os_strlen(dst + used);
5674
5675         if (len == 0 && cred && cred->realm)
5676                 return hs20_nai_home_realm_list(wpa_s, dst_addr, cred->realm);
5677
5678         if (len & 1)
5679                 return -1;
5680         len /= 2;
5681         buf = os_malloc(len);
5682         if (buf == NULL)
5683                 return -1;
5684         if (hexstr2bin(dst + used, buf, len) < 0) {
5685                 os_free(buf);
5686                 return -1;
5687         }
5688
5689         ret = hs20_anqp_send_req(wpa_s, dst_addr,
5690                                  BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
5691                                  buf, len);
5692         os_free(buf);
5693
5694         return ret;
5695 }
5696
5697
5698 static int hs20_icon_request(struct wpa_supplicant *wpa_s, char *cmd)
5699 {
5700         u8 dst_addr[ETH_ALEN];
5701         int used;
5702         char *icon;
5703
5704         used = hwaddr_aton2(cmd, dst_addr);
5705         if (used < 0)
5706                 return -1;
5707
5708         while (cmd[used] == ' ')
5709                 used++;
5710         icon = &cmd[used];
5711
5712         wpa_s->fetch_osu_icon_in_progress = 0;
5713         return hs20_anqp_send_req(wpa_s, dst_addr, BIT(HS20_STYPE_ICON_REQUEST),
5714                                   (u8 *) icon, os_strlen(icon));
5715 }
5716
5717 #endif /* CONFIG_HS20 */
5718
5719
5720 #ifdef CONFIG_AUTOSCAN
5721
5722 static int wpa_supplicant_ctrl_iface_autoscan(struct wpa_supplicant *wpa_s,
5723                                               char *cmd)
5724 {
5725         enum wpa_states state = wpa_s->wpa_state;
5726         char *new_params = NULL;
5727
5728         if (os_strlen(cmd) > 0) {
5729                 new_params = os_strdup(cmd);
5730                 if (new_params == NULL)
5731                         return -1;
5732         }
5733
5734         os_free(wpa_s->conf->autoscan);
5735         wpa_s->conf->autoscan = new_params;
5736
5737         if (wpa_s->conf->autoscan == NULL)
5738                 autoscan_deinit(wpa_s);
5739         else if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
5740                 autoscan_init(wpa_s, 1);
5741         else if (state == WPA_SCANNING)
5742                 wpa_supplicant_reinit_autoscan(wpa_s);
5743
5744         return 0;
5745 }
5746
5747 #endif /* CONFIG_AUTOSCAN */
5748
5749
5750 #ifdef CONFIG_WNM
5751
5752 static int wpas_ctrl_iface_wnm_sleep(struct wpa_supplicant *wpa_s, char *cmd)
5753 {
5754         int enter;
5755         int intval = 0;
5756         char *pos;
5757         int ret;
5758         struct wpabuf *tfs_req = NULL;
5759
5760         if (os_strncmp(cmd, "enter", 5) == 0)
5761                 enter = 1;
5762         else if (os_strncmp(cmd, "exit", 4) == 0)
5763                 enter = 0;
5764         else
5765                 return -1;
5766
5767         pos = os_strstr(cmd, " interval=");
5768         if (pos)
5769                 intval = atoi(pos + 10);
5770
5771         pos = os_strstr(cmd, " tfs_req=");
5772         if (pos) {
5773                 char *end;
5774                 size_t len;
5775                 pos += 9;
5776                 end = os_strchr(pos, ' ');
5777                 if (end)
5778                         len = end - pos;
5779                 else
5780                         len = os_strlen(pos);
5781                 if (len & 1)
5782                         return -1;
5783                 len /= 2;
5784                 tfs_req = wpabuf_alloc(len);
5785                 if (tfs_req == NULL)
5786                         return -1;
5787                 if (hexstr2bin(pos, wpabuf_put(tfs_req, len), len) < 0) {
5788                         wpabuf_free(tfs_req);
5789                         return -1;
5790                 }
5791         }
5792
5793         ret = ieee802_11_send_wnmsleep_req(wpa_s, enter ? WNM_SLEEP_MODE_ENTER :
5794                                            WNM_SLEEP_MODE_EXIT, intval,
5795                                            tfs_req);
5796         wpabuf_free(tfs_req);
5797
5798         return ret;
5799 }
5800
5801
5802 static int wpas_ctrl_iface_wnm_bss_query(struct wpa_supplicant *wpa_s, char *cmd)
5803 {
5804         int query_reason;
5805
5806         query_reason = atoi(cmd);
5807
5808         wpa_printf(MSG_DEBUG, "CTRL_IFACE: WNM_BSS_QUERY query_reason=%d",
5809                    query_reason);
5810
5811         return wnm_send_bss_transition_mgmt_query(wpa_s, query_reason);
5812 }
5813
5814 #endif /* CONFIG_WNM */
5815
5816
5817 static int wpa_supplicant_signal_poll(struct wpa_supplicant *wpa_s, char *buf,
5818                                       size_t buflen)
5819 {
5820         struct wpa_signal_info si;
5821         int ret;
5822         char *pos, *end;
5823
5824         ret = wpa_drv_signal_poll(wpa_s, &si);
5825         if (ret)
5826                 return -1;
5827
5828         pos = buf;
5829         end = buf + buflen;
5830
5831         ret = os_snprintf(pos, end - pos, "RSSI=%d\nLINKSPEED=%d\n"
5832                           "NOISE=%d\nFREQUENCY=%u\n",
5833                           si.current_signal, si.current_txrate / 1000,
5834                           si.current_noise, si.frequency);
5835         if (os_snprintf_error(end - pos, ret))
5836                 return -1;
5837         pos += ret;
5838
5839         if (si.chanwidth != CHAN_WIDTH_UNKNOWN) {
5840                 ret = os_snprintf(pos, end - pos, "WIDTH=%s\n",
5841                                   channel_width_to_string(si.chanwidth));
5842                 if (os_snprintf_error(end - pos, ret))
5843                         return -1;
5844                 pos += ret;
5845         }
5846
5847         if (si.center_frq1 > 0 && si.center_frq2 > 0) {
5848                 ret = os_snprintf(pos, end - pos,
5849                                   "CENTER_FRQ1=%d\nCENTER_FRQ2=%d\n",
5850                                   si.center_frq1, si.center_frq2);
5851                 if (os_snprintf_error(end - pos, ret))
5852                         return -1;
5853                 pos += ret;
5854         }
5855
5856         if (si.avg_signal) {
5857                 ret = os_snprintf(pos, end - pos,
5858                                   "AVG_RSSI=%d\n", si.avg_signal);
5859                 if (os_snprintf_error(end - pos, ret))
5860                         return -1;
5861                 pos += ret;
5862         }
5863
5864         return pos - buf;
5865 }
5866
5867
5868 static int wpa_supplicant_pktcnt_poll(struct wpa_supplicant *wpa_s, char *buf,
5869                                       size_t buflen)
5870 {
5871         struct hostap_sta_driver_data sta;
5872         int ret;
5873
5874         ret = wpa_drv_pktcnt_poll(wpa_s, &sta);
5875         if (ret)
5876                 return -1;
5877
5878         ret = os_snprintf(buf, buflen, "TXGOOD=%lu\nTXBAD=%lu\nRXGOOD=%lu\n",
5879                           sta.tx_packets, sta.tx_retry_failed, sta.rx_packets);
5880         if (os_snprintf_error(buflen, ret))
5881                 return -1;
5882         return ret;
5883 }
5884
5885
5886 #ifdef ANDROID
5887 static int wpa_supplicant_driver_cmd(struct wpa_supplicant *wpa_s, char *cmd,
5888                                      char *buf, size_t buflen)
5889 {
5890         int ret;
5891
5892         ret = wpa_drv_driver_cmd(wpa_s, cmd, buf, buflen);
5893         if (ret == 0) {
5894                 if (os_strncasecmp(cmd, "COUNTRY", 7) == 0) {
5895                         struct p2p_data *p2p = wpa_s->global->p2p;
5896                         if (p2p) {
5897                                 char country[3];
5898                                 country[0] = cmd[8];
5899                                 country[1] = cmd[9];
5900                                 country[2] = 0x04;
5901                                 p2p_set_country(p2p, country);
5902                         }
5903                 }
5904                 ret = os_snprintf(buf, buflen, "%s\n", "OK");
5905                 if (os_snprintf_error(buflen, ret))
5906                         ret = -1;
5907         }
5908         return ret;
5909 }
5910 #endif /* ANDROID */
5911
5912
5913 static int wpa_supplicant_vendor_cmd(struct wpa_supplicant *wpa_s, char *cmd,
5914                                      char *buf, size_t buflen)
5915 {
5916         int ret;
5917         char *pos;
5918         u8 *data = NULL;
5919         unsigned int vendor_id, subcmd;
5920         struct wpabuf *reply;
5921         size_t data_len = 0;
5922
5923         /* cmd: <vendor id> <subcommand id> [<hex formatted data>] */
5924         vendor_id = strtoul(cmd, &pos, 16);
5925         if (!isblank(*pos))
5926                 return -EINVAL;
5927
5928         subcmd = strtoul(pos, &pos, 10);
5929
5930         if (*pos != '\0') {
5931                 if (!isblank(*pos++))
5932                         return -EINVAL;
5933                 data_len = os_strlen(pos);
5934         }
5935
5936         if (data_len) {
5937                 data_len /= 2;
5938                 data = os_malloc(data_len);
5939                 if (!data)
5940                         return -1;
5941
5942                 if (hexstr2bin(pos, data, data_len)) {
5943                         wpa_printf(MSG_DEBUG,
5944                                    "Vendor command: wrong parameter format");
5945                         os_free(data);
5946                         return -EINVAL;
5947                 }
5948         }
5949
5950         reply = wpabuf_alloc((buflen - 1) / 2);
5951         if (!reply) {
5952                 os_free(data);
5953                 return -1;
5954         }
5955
5956         ret = wpa_drv_vendor_cmd(wpa_s, vendor_id, subcmd, data, data_len,
5957                                  reply);
5958
5959         if (ret == 0)
5960                 ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(reply),
5961                                        wpabuf_len(reply));
5962
5963         wpabuf_free(reply);
5964         os_free(data);
5965
5966         return ret;
5967 }
5968
5969
5970 static void wpa_supplicant_ctrl_iface_flush(struct wpa_supplicant *wpa_s)
5971 {
5972         wpa_dbg(wpa_s, MSG_DEBUG, "Flush all wpa_supplicant state");
5973
5974 #ifdef CONFIG_P2P
5975         wpas_p2p_cancel(wpa_s);
5976         wpas_p2p_stop_find(wpa_s);
5977         p2p_ctrl_flush(wpa_s);
5978         wpas_p2p_group_remove(wpa_s, "*");
5979         wpas_p2p_service_flush(wpa_s);
5980         wpa_s->global->p2p_disabled = 0;
5981         wpa_s->global->p2p_per_sta_psk = 0;
5982         wpa_s->conf->num_sec_device_types = 0;
5983         wpa_s->p2p_disable_ip_addr_req = 0;
5984         os_free(wpa_s->global->p2p_go_avoid_freq.range);
5985         wpa_s->global->p2p_go_avoid_freq.range = NULL;
5986 #endif /* CONFIG_P2P */
5987
5988 #ifdef CONFIG_WPS_TESTING
5989         wps_version_number = 0x20;
5990         wps_testing_dummy_cred = 0;
5991         wps_corrupt_pkhash = 0;
5992 #endif /* CONFIG_WPS_TESTING */
5993 #ifdef CONFIG_WPS
5994         wpa_s->wps_fragment_size = 0;
5995         wpas_wps_cancel(wpa_s);
5996         wps_registrar_flush(wpa_s->wps->registrar);
5997 #endif /* CONFIG_WPS */
5998         wpa_s->after_wps = 0;
5999         wpa_s->known_wps_freq = 0;
6000
6001 #ifdef CONFIG_TDLS
6002 #ifdef CONFIG_TDLS_TESTING
6003         extern unsigned int tdls_testing;
6004         tdls_testing = 0;
6005 #endif /* CONFIG_TDLS_TESTING */
6006         wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL);
6007         wpa_tdls_enable(wpa_s->wpa, 1);
6008 #endif /* CONFIG_TDLS */
6009
6010         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
6011         wpa_supplicant_stop_countermeasures(wpa_s, NULL);
6012
6013         wpa_s->no_keep_alive = 0;
6014
6015         os_free(wpa_s->disallow_aps_bssid);
6016         wpa_s->disallow_aps_bssid = NULL;
6017         wpa_s->disallow_aps_bssid_count = 0;
6018         os_free(wpa_s->disallow_aps_ssid);
6019         wpa_s->disallow_aps_ssid = NULL;
6020         wpa_s->disallow_aps_ssid_count = 0;
6021
6022         wpa_s->set_sta_uapsd = 0;
6023         wpa_s->sta_uapsd = 0;
6024
6025         wpa_drv_radio_disable(wpa_s, 0);
6026
6027         wpa_bss_flush(wpa_s);
6028         wpa_blacklist_clear(wpa_s);
6029         wpa_s->extra_blacklist_count = 0;
6030         wpa_supplicant_ctrl_iface_remove_network(wpa_s, "all");
6031         wpa_supplicant_ctrl_iface_remove_cred(wpa_s, "all");
6032         wpa_config_flush_blobs(wpa_s->conf);
6033         wpa_s->conf->auto_interworking = 0;
6034         wpa_s->conf->okc = 0;
6035
6036         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
6037         rsn_preauth_deinit(wpa_s->wpa);
6038
6039         wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME, 43200);
6040         wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD, 70);
6041         wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT, 60);
6042         eapol_sm_notify_logoff(wpa_s->eapol, FALSE);
6043
6044         radio_remove_works(wpa_s, NULL, 1);
6045         wpa_s->ext_work_in_progress = 0;
6046
6047         wpa_s->next_ssid = NULL;
6048
6049 #ifdef CONFIG_INTERWORKING
6050         hs20_cancel_fetch_osu(wpa_s);
6051 #endif /* CONFIG_INTERWORKING */
6052
6053         wpa_s->ext_mgmt_frame_handling = 0;
6054         wpa_s->ext_eapol_frame_io = 0;
6055 #ifdef CONFIG_TESTING_OPTIONS
6056         wpa_s->extra_roc_dur = 0;
6057 #endif /* CONFIG_TESTING_OPTIONS */
6058
6059         wpa_s->disconnected = 0;
6060 }
6061
6062
6063 static int wpas_ctrl_radio_work_show(struct wpa_supplicant *wpa_s,
6064                                      char *buf, size_t buflen)
6065 {
6066         struct wpa_radio_work *work;
6067         char *pos, *end;
6068         struct os_reltime now, diff;
6069
6070         pos = buf;
6071         end = buf + buflen;
6072
6073         os_get_reltime(&now);
6074
6075         dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
6076         {
6077                 int ret;
6078
6079                 os_reltime_sub(&now, &work->time, &diff);
6080                 ret = os_snprintf(pos, end - pos, "%s@%s:%u:%u:%ld.%06ld\n",
6081                                   work->type, work->wpa_s->ifname, work->freq,
6082                                   work->started, diff.sec, diff.usec);
6083                 if (os_snprintf_error(end - pos, ret))
6084                         break;
6085                 pos += ret;
6086         }
6087
6088         return pos - buf;
6089 }
6090
6091
6092 static void wpas_ctrl_radio_work_timeout(void *eloop_ctx, void *timeout_ctx)
6093 {
6094         struct wpa_radio_work *work = eloop_ctx;
6095         struct wpa_external_work *ework = work->ctx;
6096
6097         wpa_dbg(work->wpa_s, MSG_DEBUG,
6098                 "Timing out external radio work %u (%s)",
6099                 ework->id, work->type);
6100         wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_TIMEOUT "%u", ework->id);
6101         work->wpa_s->ext_work_in_progress = 0;
6102         radio_work_done(work);
6103         os_free(ework);
6104 }
6105
6106
6107 static void wpas_ctrl_radio_work_cb(struct wpa_radio_work *work, int deinit)
6108 {
6109         struct wpa_external_work *ework = work->ctx;
6110
6111         if (deinit) {
6112                 if (work->started)
6113                         eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
6114                                              work, NULL);
6115
6116                 os_free(ework);
6117                 return;
6118         }
6119
6120         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting external radio work %u (%s)",
6121                 ework->id, ework->type);
6122         wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_START "%u", ework->id);
6123         work->wpa_s->ext_work_in_progress = 1;
6124         if (!ework->timeout)
6125                 ework->timeout = 10;
6126         eloop_register_timeout(ework->timeout, 0, wpas_ctrl_radio_work_timeout,
6127                                work, NULL);
6128 }
6129
6130
6131 static int wpas_ctrl_radio_work_add(struct wpa_supplicant *wpa_s, char *cmd,
6132                                     char *buf, size_t buflen)
6133 {
6134         struct wpa_external_work *ework;
6135         char *pos, *pos2;
6136         size_t type_len;
6137         int ret;
6138         unsigned int freq = 0;
6139
6140         /* format: <name> [freq=<MHz>] [timeout=<seconds>] */
6141
6142         ework = os_zalloc(sizeof(*ework));
6143         if (ework == NULL)
6144                 return -1;
6145
6146         pos = os_strchr(cmd, ' ');
6147         if (pos) {
6148                 type_len = pos - cmd;
6149                 pos++;
6150
6151                 pos2 = os_strstr(pos, "freq=");
6152                 if (pos2)
6153                         freq = atoi(pos2 + 5);
6154
6155                 pos2 = os_strstr(pos, "timeout=");
6156                 if (pos2)
6157                         ework->timeout = atoi(pos2 + 8);
6158         } else {
6159                 type_len = os_strlen(cmd);
6160         }
6161         if (4 + type_len >= sizeof(ework->type))
6162                 type_len = sizeof(ework->type) - 4 - 1;
6163         os_strlcpy(ework->type, "ext:", sizeof(ework->type));
6164         os_memcpy(ework->type + 4, cmd, type_len);
6165         ework->type[4 + type_len] = '\0';
6166
6167         wpa_s->ext_work_id++;
6168         if (wpa_s->ext_work_id == 0)
6169                 wpa_s->ext_work_id++;
6170         ework->id = wpa_s->ext_work_id;
6171
6172         if (radio_add_work(wpa_s, freq, ework->type, 0, wpas_ctrl_radio_work_cb,
6173                            ework) < 0) {
6174                 os_free(ework);
6175                 return -1;
6176         }
6177
6178         ret = os_snprintf(buf, buflen, "%u", ework->id);
6179         if (os_snprintf_error(buflen, ret))
6180                 return -1;
6181         return ret;
6182 }
6183
6184
6185 static int wpas_ctrl_radio_work_done(struct wpa_supplicant *wpa_s, char *cmd)
6186 {
6187         struct wpa_radio_work *work;
6188         unsigned int id = atoi(cmd);
6189
6190         dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
6191         {
6192                 struct wpa_external_work *ework;
6193
6194                 if (os_strncmp(work->type, "ext:", 4) != 0)
6195                         continue;
6196                 ework = work->ctx;
6197                 if (id && ework->id != id)
6198                         continue;
6199                 wpa_dbg(wpa_s, MSG_DEBUG,
6200                         "Completed external radio work %u (%s)",
6201                         ework->id, ework->type);
6202                 eloop_cancel_timeout(wpas_ctrl_radio_work_timeout, work, NULL);
6203                 wpa_s->ext_work_in_progress = 0;
6204                 radio_work_done(work);
6205                 os_free(ework);
6206                 return 3; /* "OK\n" */
6207         }
6208
6209         return -1;
6210 }
6211
6212
6213 static int wpas_ctrl_radio_work(struct wpa_supplicant *wpa_s, char *cmd,
6214                                 char *buf, size_t buflen)
6215 {
6216         if (os_strcmp(cmd, "show") == 0)
6217                 return wpas_ctrl_radio_work_show(wpa_s, buf, buflen);
6218         if (os_strncmp(cmd, "add ", 4) == 0)
6219                 return wpas_ctrl_radio_work_add(wpa_s, cmd + 4, buf, buflen);
6220         if (os_strncmp(cmd, "done ", 5) == 0)
6221                 return wpas_ctrl_radio_work_done(wpa_s, cmd + 4);
6222         return -1;
6223 }
6224
6225
6226 void wpas_ctrl_radio_work_flush(struct wpa_supplicant *wpa_s)
6227 {
6228         struct wpa_radio_work *work, *tmp;
6229
6230         if (!wpa_s || !wpa_s->radio)
6231                 return;
6232
6233         dl_list_for_each_safe(work, tmp, &wpa_s->radio->work,
6234                               struct wpa_radio_work, list) {
6235                 struct wpa_external_work *ework;
6236
6237                 if (os_strncmp(work->type, "ext:", 4) != 0)
6238                         continue;
6239                 ework = work->ctx;
6240                 wpa_dbg(wpa_s, MSG_DEBUG,
6241                         "Flushing%s external radio work %u (%s)",
6242                         work->started ? " started" : "", ework->id,
6243                         ework->type);
6244                 if (work->started)
6245                         eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
6246                                              work, NULL);
6247                 radio_work_done(work);
6248                 os_free(ework);
6249         }
6250 }
6251
6252
6253 static void wpas_ctrl_eapol_response(void *eloop_ctx, void *timeout_ctx)
6254 {
6255         struct wpa_supplicant *wpa_s = eloop_ctx;
6256         eapol_sm_notify_ctrl_response(wpa_s->eapol);
6257 }
6258
6259
6260 static int scan_id_list_parse(struct wpa_supplicant *wpa_s, const char *value,
6261                               unsigned int *scan_id_count, int scan_id[])
6262 {
6263         const char *pos = value;
6264
6265         while (pos) {
6266                 if (*pos == ' ' || *pos == '\0')
6267                         break;
6268                 if (*scan_id_count == MAX_SCAN_ID)
6269                         return -1;
6270                 scan_id[(*scan_id_count)++] = atoi(pos);
6271                 pos = os_strchr(pos, ',');
6272                 if (pos)
6273                         pos++;
6274         }
6275
6276         return 0;
6277 }
6278
6279
6280 static void wpas_ctrl_scan(struct wpa_supplicant *wpa_s, char *params,
6281                            char *reply, int reply_size, int *reply_len)
6282 {
6283         char *pos;
6284         unsigned int manual_scan_passive = 0;
6285         unsigned int manual_scan_use_id = 0;
6286         unsigned int manual_scan_only_new = 0;
6287         unsigned int scan_only = 0;
6288         unsigned int scan_id_count = 0;
6289         int scan_id[MAX_SCAN_ID];
6290         void (*scan_res_handler)(struct wpa_supplicant *wpa_s,
6291                                  struct wpa_scan_results *scan_res);
6292         int *manual_scan_freqs = NULL;
6293
6294         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
6295                 *reply_len = -1;
6296                 return;
6297         }
6298
6299         if (radio_work_pending(wpa_s, "scan")) {
6300                 wpa_printf(MSG_DEBUG,
6301                            "Pending scan scheduled - reject new request");
6302                 *reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
6303                 return;
6304         }
6305
6306         if (params) {
6307                 if (os_strncasecmp(params, "TYPE=ONLY", 9) == 0)
6308                         scan_only = 1;
6309
6310                 pos = os_strstr(params, "freq=");
6311                 if (pos) {
6312                         manual_scan_freqs = freq_range_to_channel_list(wpa_s,
6313                                                                        pos + 5);
6314                         if (manual_scan_freqs == NULL) {
6315                                 *reply_len = -1;
6316                                 goto done;
6317                         }
6318                 }
6319
6320                 pos = os_strstr(params, "passive=");
6321                 if (pos)
6322                         manual_scan_passive = !!atoi(pos + 8);
6323
6324                 pos = os_strstr(params, "use_id=");
6325                 if (pos)
6326                         manual_scan_use_id = atoi(pos + 7);
6327
6328                 pos = os_strstr(params, "only_new=1");
6329                 if (pos)
6330                         manual_scan_only_new = 1;
6331
6332                 pos = os_strstr(params, "scan_id=");
6333                 if (pos && scan_id_list_parse(wpa_s, pos + 8, &scan_id_count,
6334                                               scan_id) < 0) {
6335                         *reply_len = -1;
6336                         goto done;
6337                 }
6338         }
6339
6340         if (scan_only)
6341                 scan_res_handler = scan_only_handler;
6342         else if (wpa_s->scan_res_handler == scan_only_handler)
6343                 scan_res_handler = NULL;
6344         else
6345                 scan_res_handler = wpa_s->scan_res_handler;
6346
6347         if (!wpa_s->sched_scanning && !wpa_s->scanning &&
6348             ((wpa_s->wpa_state <= WPA_SCANNING) ||
6349              (wpa_s->wpa_state == WPA_COMPLETED))) {
6350                 wpa_s->manual_scan_passive = manual_scan_passive;
6351                 wpa_s->manual_scan_use_id = manual_scan_use_id;
6352                 wpa_s->manual_scan_only_new = manual_scan_only_new;
6353                 wpa_s->scan_id_count = scan_id_count;
6354                 os_memcpy(wpa_s->scan_id, scan_id, scan_id_count * sizeof(int));
6355                 wpa_s->scan_res_handler = scan_res_handler;
6356                 os_free(wpa_s->manual_scan_freqs);
6357                 wpa_s->manual_scan_freqs = manual_scan_freqs;
6358                 manual_scan_freqs = NULL;
6359
6360                 wpa_s->normal_scans = 0;
6361                 wpa_s->scan_req = MANUAL_SCAN_REQ;
6362                 wpa_s->after_wps = 0;
6363                 wpa_s->known_wps_freq = 0;
6364                 wpa_supplicant_req_scan(wpa_s, 0, 0);
6365                 if (wpa_s->manual_scan_use_id) {
6366                         wpa_s->manual_scan_id++;
6367                         wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
6368                                 wpa_s->manual_scan_id);
6369                         *reply_len = os_snprintf(reply, reply_size, "%u\n",
6370                                                  wpa_s->manual_scan_id);
6371                 }
6372         } else if (wpa_s->sched_scanning) {
6373                 wpa_s->manual_scan_passive = manual_scan_passive;
6374                 wpa_s->manual_scan_use_id = manual_scan_use_id;
6375                 wpa_s->manual_scan_only_new = manual_scan_only_new;
6376                 wpa_s->scan_id_count = scan_id_count;
6377                 os_memcpy(wpa_s->scan_id, scan_id, scan_id_count * sizeof(int));
6378                 wpa_s->scan_res_handler = scan_res_handler;
6379                 os_free(wpa_s->manual_scan_freqs);
6380                 wpa_s->manual_scan_freqs = manual_scan_freqs;
6381                 manual_scan_freqs = NULL;
6382
6383                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to allow requested full scan to proceed");
6384                 wpa_supplicant_cancel_sched_scan(wpa_s);
6385                 wpa_s->scan_req = MANUAL_SCAN_REQ;
6386                 wpa_supplicant_req_scan(wpa_s, 0, 0);
6387                 if (wpa_s->manual_scan_use_id) {
6388                         wpa_s->manual_scan_id++;
6389                         *reply_len = os_snprintf(reply, reply_size, "%u\n",
6390                                                  wpa_s->manual_scan_id);
6391                         wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
6392                                 wpa_s->manual_scan_id);
6393                 }
6394         } else {
6395                 wpa_printf(MSG_DEBUG, "Ongoing scan action - reject new request");
6396                 *reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
6397         }
6398
6399 done:
6400         os_free(manual_scan_freqs);
6401 }
6402
6403
6404 #ifdef CONFIG_TESTING_OPTIONS
6405
6406 static void wpas_ctrl_iface_mgmt_tx_cb(struct wpa_supplicant *wpa_s,
6407                                        unsigned int freq, const u8 *dst,
6408                                        const u8 *src, const u8 *bssid,
6409                                        const u8 *data, size_t data_len,
6410                                        enum offchannel_send_action_result
6411                                        result)
6412 {
6413         wpa_msg(wpa_s, MSG_INFO, "MGMT-TX-STATUS freq=%u dst=" MACSTR
6414                 " src=" MACSTR " bssid=" MACSTR " result=%s",
6415                 freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid),
6416                 result == OFFCHANNEL_SEND_ACTION_SUCCESS ?
6417                 "SUCCESS" : (result == OFFCHANNEL_SEND_ACTION_NO_ACK ?
6418                              "NO_ACK" : "FAILED"));
6419 }
6420
6421
6422 static int wpas_ctrl_iface_mgmt_tx(struct wpa_supplicant *wpa_s, char *cmd)
6423 {
6424         char *pos, *param;
6425         size_t len;
6426         u8 *buf, da[ETH_ALEN], bssid[ETH_ALEN];
6427         int res, used;
6428         int freq = 0, no_cck = 0, wait_time = 0;
6429
6430         /* <DA> <BSSID> [freq=<MHz>] [wait_time=<ms>] [no_cck=1]
6431          *    <action=Action frame payload> */
6432
6433         wpa_printf(MSG_DEBUG, "External MGMT TX: %s", cmd);
6434
6435         pos = cmd;
6436         used = hwaddr_aton2(pos, da);
6437         if (used < 0)
6438                 return -1;
6439         pos += used;
6440         while (*pos == ' ')
6441                 pos++;
6442         used = hwaddr_aton2(pos, bssid);
6443         if (used < 0)
6444                 return -1;
6445         pos += used;
6446
6447         param = os_strstr(pos, " freq=");
6448         if (param) {
6449                 param += 6;
6450                 freq = atoi(param);
6451         }
6452
6453         param = os_strstr(pos, " no_cck=");
6454         if (param) {
6455                 param += 8;
6456                 no_cck = atoi(param);
6457         }
6458
6459         param = os_strstr(pos, " wait_time=");
6460         if (param) {
6461                 param += 11;
6462                 wait_time = atoi(param);
6463         }
6464
6465         param = os_strstr(pos, " action=");
6466         if (param == NULL)
6467                 return -1;
6468         param += 8;
6469
6470         len = os_strlen(param);
6471         if (len & 1)
6472                 return -1;
6473         len /= 2;
6474
6475         buf = os_malloc(len);
6476         if (buf == NULL)
6477                 return -1;
6478
6479         if (hexstr2bin(param, buf, len) < 0) {
6480                 os_free(buf);
6481                 return -1;
6482         }
6483
6484         res = offchannel_send_action(wpa_s, freq, da, wpa_s->own_addr, bssid,
6485                                      buf, len, wait_time,
6486                                      wpas_ctrl_iface_mgmt_tx_cb, no_cck);
6487         os_free(buf);
6488         return res;
6489 }
6490
6491
6492 static void wpas_ctrl_iface_mgmt_tx_done(struct wpa_supplicant *wpa_s)
6493 {
6494         wpa_printf(MSG_DEBUG, "External MGMT TX - done waiting");
6495         offchannel_send_action_done(wpa_s);
6496 }
6497
6498
6499 static int wpas_ctrl_iface_driver_event(struct wpa_supplicant *wpa_s, char *cmd)
6500 {
6501         char *pos, *param;
6502         union wpa_event_data event;
6503         enum wpa_event_type ev;
6504
6505         /* <event name> [parameters..] */
6506
6507         wpa_dbg(wpa_s, MSG_DEBUG, "Testing - external driver event: %s", cmd);
6508
6509         pos = cmd;
6510         param = os_strchr(pos, ' ');
6511         if (param)
6512                 *param++ = '\0';
6513
6514         os_memset(&event, 0, sizeof(event));
6515
6516         if (os_strcmp(cmd, "INTERFACE_ENABLED") == 0) {
6517                 ev = EVENT_INTERFACE_ENABLED;
6518         } else if (os_strcmp(cmd, "INTERFACE_DISABLED") == 0) {
6519                 ev = EVENT_INTERFACE_DISABLED;
6520         } else if (os_strcmp(cmd, "AVOID_FREQUENCIES") == 0) {
6521                 ev = EVENT_AVOID_FREQUENCIES;
6522                 if (param == NULL)
6523                         param = "";
6524                 if (freq_range_list_parse(&event.freq_range, param) < 0)
6525                         return -1;
6526                 wpa_supplicant_event(wpa_s, ev, &event);
6527                 os_free(event.freq_range.range);
6528                 return 0;
6529         } else {
6530                 wpa_dbg(wpa_s, MSG_DEBUG, "Testing - unknown driver event: %s",
6531                         cmd);
6532                 return -1;
6533         }
6534
6535         wpa_supplicant_event(wpa_s, ev, &event);
6536
6537         return 0;
6538 }
6539
6540
6541 static int wpas_ctrl_iface_eapol_rx(struct wpa_supplicant *wpa_s, char *cmd)
6542 {
6543         char *pos;
6544         u8 src[ETH_ALEN], *buf;
6545         int used;
6546         size_t len;
6547
6548         wpa_printf(MSG_DEBUG, "External EAPOL RX: %s", cmd);
6549
6550         pos = cmd;
6551         used = hwaddr_aton2(pos, src);
6552         if (used < 0)
6553                 return -1;
6554         pos += used;
6555         while (*pos == ' ')
6556                 pos++;
6557
6558         len = os_strlen(pos);
6559         if (len & 1)
6560                 return -1;
6561         len /= 2;
6562
6563         buf = os_malloc(len);
6564         if (buf == NULL)
6565                 return -1;
6566
6567         if (hexstr2bin(pos, buf, len) < 0) {
6568                 os_free(buf);
6569                 return -1;
6570         }
6571
6572         wpa_supplicant_rx_eapol(wpa_s, src, buf, len);
6573         os_free(buf);
6574
6575         return 0;
6576 }
6577
6578
6579 static u16 ipv4_hdr_checksum(const void *buf, size_t len)
6580 {
6581         size_t i;
6582         u32 sum = 0;
6583         const u16 *pos = buf;
6584
6585         for (i = 0; i < len / 2; i++)
6586                 sum += *pos++;
6587
6588         while (sum >> 16)
6589                 sum = (sum & 0xffff) + (sum >> 16);
6590
6591         return sum ^ 0xffff;
6592 }
6593
6594
6595 #define HWSIM_PACKETLEN 1500
6596 #define HWSIM_IP_LEN (HWSIM_PACKETLEN - sizeof(struct ether_header))
6597
6598 void wpas_data_test_rx(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
6599 {
6600         struct wpa_supplicant *wpa_s = ctx;
6601         const struct ether_header *eth;
6602         const struct iphdr *ip;
6603         const u8 *pos;
6604         unsigned int i;
6605
6606         if (len != HWSIM_PACKETLEN)
6607                 return;
6608
6609         eth = (const struct ether_header *) buf;
6610         ip = (const struct iphdr *) (eth + 1);
6611         pos = (const u8 *) (ip + 1);
6612
6613         if (ip->ihl != 5 || ip->version != 4 ||
6614             ntohs(ip->tot_len) != HWSIM_IP_LEN)
6615                 return;
6616
6617         for (i = 0; i < HWSIM_IP_LEN - sizeof(*ip); i++) {
6618                 if (*pos != (u8) i)
6619                         return;
6620                 pos++;
6621         }
6622
6623         wpa_msg(wpa_s, MSG_INFO, "DATA-TEST-RX " MACSTR " " MACSTR,
6624                 MAC2STR(eth->ether_dhost), MAC2STR(eth->ether_shost));
6625 }
6626
6627
6628 static int wpas_ctrl_iface_data_test_config(struct wpa_supplicant *wpa_s,
6629                                             char *cmd)
6630 {
6631         int enabled = atoi(cmd);
6632
6633         if (!enabled) {
6634                 if (wpa_s->l2_test) {
6635                         l2_packet_deinit(wpa_s->l2_test);
6636                         wpa_s->l2_test = NULL;
6637                         wpa_dbg(wpa_s, MSG_DEBUG, "test data: Disabled");
6638                 }
6639                 return 0;
6640         }
6641
6642         if (wpa_s->l2_test)
6643                 return 0;
6644
6645         wpa_s->l2_test = l2_packet_init(wpa_s->ifname, wpa_s->own_addr,
6646                                         ETHERTYPE_IP, wpas_data_test_rx,
6647                                         wpa_s, 1);
6648         if (wpa_s->l2_test == NULL)
6649                 return -1;
6650
6651         wpa_dbg(wpa_s, MSG_DEBUG, "test data: Enabled");
6652
6653         return 0;
6654 }
6655
6656
6657 static int wpas_ctrl_iface_data_test_tx(struct wpa_supplicant *wpa_s, char *cmd)
6658 {
6659         u8 dst[ETH_ALEN], src[ETH_ALEN];
6660         char *pos;
6661         int used;
6662         long int val;
6663         u8 tos;
6664         u8 buf[HWSIM_PACKETLEN];
6665         struct ether_header *eth;
6666         struct iphdr *ip;
6667         u8 *dpos;
6668         unsigned int i;
6669
6670         if (wpa_s->l2_test == NULL)
6671                 return -1;
6672
6673         /* format: <dst> <src> <tos> */
6674
6675         pos = cmd;
6676         used = hwaddr_aton2(pos, dst);
6677         if (used < 0)
6678                 return -1;
6679         pos += used;
6680         while (*pos == ' ')
6681                 pos++;
6682         used = hwaddr_aton2(pos, src);
6683         if (used < 0)
6684                 return -1;
6685         pos += used;
6686
6687         val = strtol(pos, NULL, 0);
6688         if (val < 0 || val > 0xff)
6689                 return -1;
6690         tos = val;
6691
6692         eth = (struct ether_header *) buf;
6693         os_memcpy(eth->ether_dhost, dst, ETH_ALEN);
6694         os_memcpy(eth->ether_shost, src, ETH_ALEN);
6695         eth->ether_type = htons(ETHERTYPE_IP);
6696         ip = (struct iphdr *) (eth + 1);
6697         os_memset(ip, 0, sizeof(*ip));
6698         ip->ihl = 5;
6699         ip->version = 4;
6700         ip->ttl = 64;
6701         ip->tos = tos;
6702         ip->tot_len = htons(HWSIM_IP_LEN);
6703         ip->protocol = 1;
6704         ip->saddr = htonl(192 << 24 | 168 << 16 | 1 << 8 | 1);
6705         ip->daddr = htonl(192 << 24 | 168 << 16 | 1 << 8 | 2);
6706         ip->check = ipv4_hdr_checksum(ip, sizeof(*ip));
6707         dpos = (u8 *) (ip + 1);
6708         for (i = 0; i < HWSIM_IP_LEN - sizeof(*ip); i++)
6709                 *dpos++ = i;
6710
6711         if (l2_packet_send(wpa_s->l2_test, dst, ETHERTYPE_IP, buf,
6712                            HWSIM_PACKETLEN) < 0)
6713                 return -1;
6714
6715         wpa_dbg(wpa_s, MSG_DEBUG, "test data: TX dst=" MACSTR " src=" MACSTR
6716                 " tos=0x%x", MAC2STR(dst), MAC2STR(src), tos);
6717
6718         return 0;
6719 }
6720
6721
6722 static int wpas_ctrl_iface_data_test_frame(struct wpa_supplicant *wpa_s,
6723                                            char *cmd)
6724 {
6725         u8 *buf;
6726         struct ether_header *eth;
6727         struct l2_packet_data *l2 = NULL;
6728         size_t len;
6729         u16 ethertype;
6730         int res = -1;
6731
6732         len = os_strlen(cmd);
6733         if (len & 1 || len < ETH_HLEN * 2)
6734                 return -1;
6735         len /= 2;
6736
6737         buf = os_malloc(len);
6738         if (buf == NULL)
6739                 return -1;
6740
6741         if (hexstr2bin(cmd, buf, len) < 0)
6742                 goto done;
6743
6744         eth = (struct ether_header *) buf;
6745         ethertype = ntohs(eth->ether_type);
6746
6747         l2 = l2_packet_init(wpa_s->ifname, wpa_s->own_addr, ethertype,
6748                             wpas_data_test_rx, wpa_s, 1);
6749         if (l2 == NULL)
6750                 goto done;
6751
6752         res = l2_packet_send(l2, eth->ether_dhost, ethertype, buf, len);
6753         wpa_dbg(wpa_s, MSG_DEBUG, "test data: TX frame res=%d", res);
6754 done:
6755         if (l2)
6756                 l2_packet_deinit(l2);
6757         os_free(buf);
6758
6759         return res < 0 ? -1 : 0;
6760 }
6761
6762 #endif /* CONFIG_TESTING_OPTIONS */
6763
6764
6765 static void wpas_ctrl_vendor_elem_update(struct wpa_supplicant *wpa_s)
6766 {
6767         unsigned int i;
6768         char buf[30];
6769
6770         wpa_printf(MSG_DEBUG, "Update vendor elements");
6771
6772         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6773                 if (wpa_s->vendor_elem[i]) {
6774                         int res;
6775
6776                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6777                         if (!os_snprintf_error(sizeof(buf), res)) {
6778                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6779                                                 wpa_s->vendor_elem[i]);
6780                         }
6781                 }
6782         }
6783
6784 #ifdef CONFIG_P2P
6785         if (wpa_s->parent == wpa_s &&
6786             wpa_s->global->p2p &&
6787             !wpa_s->global->p2p_disabled)
6788                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6789 #endif /* CONFIG_P2P */
6790 }
6791
6792
6793 static struct wpa_supplicant *
6794 wpas_ctrl_vendor_elem_iface(struct wpa_supplicant *wpa_s,
6795                             enum wpa_vendor_elem_frame frame)
6796 {
6797         switch (frame) {
6798 #ifdef CONFIG_P2P
6799         case VENDOR_ELEM_PROBE_REQ_P2P:
6800         case VENDOR_ELEM_PROBE_RESP_P2P:
6801         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6802         case VENDOR_ELEM_BEACON_P2P_GO:
6803         case VENDOR_ELEM_P2P_PD_REQ:
6804         case VENDOR_ELEM_P2P_PD_RESP:
6805         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6806         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6807         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6808         case VENDOR_ELEM_P2P_INV_REQ:
6809         case VENDOR_ELEM_P2P_INV_RESP:
6810         case VENDOR_ELEM_P2P_ASSOC_REQ:
6811                 return wpa_s->parent;
6812 #endif /* CONFIG_P2P */
6813         default:
6814                 return wpa_s;
6815         }
6816 }
6817
6818
6819 static int wpas_ctrl_vendor_elem_add(struct wpa_supplicant *wpa_s, char *cmd)
6820 {
6821         char *pos = cmd;
6822         int frame;
6823         size_t len;
6824         struct wpabuf *buf;
6825         struct ieee802_11_elems elems;
6826
6827         frame = atoi(pos);
6828         if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
6829                 return -1;
6830         wpa_s = wpas_ctrl_vendor_elem_iface(wpa_s, frame);
6831
6832         pos = os_strchr(pos, ' ');
6833         if (pos == NULL)
6834                 return -1;
6835         pos++;
6836
6837         len = os_strlen(pos);
6838         if (len == 0)
6839                 return 0;
6840         if (len & 1)
6841                 return -1;
6842         len /= 2;
6843
6844         buf = wpabuf_alloc(len);
6845         if (buf == NULL)
6846                 return -1;
6847
6848         if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
6849                 wpabuf_free(buf);
6850                 return -1;
6851         }
6852
6853         if (ieee802_11_parse_elems(wpabuf_head_u8(buf), len, &elems, 0) ==
6854             ParseFailed) {
6855                 wpabuf_free(buf);
6856                 return -1;
6857         }
6858
6859         if (wpa_s->vendor_elem[frame] == NULL) {
6860                 wpa_s->vendor_elem[frame] = buf;
6861                 wpas_ctrl_vendor_elem_update(wpa_s);
6862                 return 0;
6863         }
6864
6865         if (wpabuf_resize(&wpa_s->vendor_elem[frame], len) < 0) {
6866                 wpabuf_free(buf);
6867                 return -1;
6868         }
6869
6870         wpabuf_put_buf(wpa_s->vendor_elem[frame], buf);
6871         wpabuf_free(buf);
6872         wpas_ctrl_vendor_elem_update(wpa_s);
6873
6874         return 0;
6875 }
6876
6877
6878 static int wpas_ctrl_vendor_elem_get(struct wpa_supplicant *wpa_s, char *cmd,
6879                                      char *buf, size_t buflen)
6880 {
6881         int frame = atoi(cmd);
6882
6883         if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
6884                 return -1;
6885         wpa_s = wpas_ctrl_vendor_elem_iface(wpa_s, frame);
6886
6887         if (wpa_s->vendor_elem[frame] == NULL)
6888                 return 0;
6889
6890         return wpa_snprintf_hex(buf, buflen,
6891                                 wpabuf_head_u8(wpa_s->vendor_elem[frame]),
6892                                 wpabuf_len(wpa_s->vendor_elem[frame]));
6893 }
6894
6895
6896 static int wpas_ctrl_vendor_elem_remove(struct wpa_supplicant *wpa_s, char *cmd)
6897 {
6898         char *pos = cmd;
6899         int frame;
6900         size_t len;
6901         u8 *buf;
6902         struct ieee802_11_elems elems;
6903         u8 *ie, *end;
6904
6905         frame = atoi(pos);
6906         if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
6907                 return -1;
6908         wpa_s = wpas_ctrl_vendor_elem_iface(wpa_s, frame);
6909
6910         pos = os_strchr(pos, ' ');
6911         if (pos == NULL)
6912                 return -1;
6913         pos++;
6914
6915         if (*pos == '*') {
6916                 wpabuf_free(wpa_s->vendor_elem[frame]);
6917                 wpa_s->vendor_elem[frame] = NULL;
6918                 wpas_ctrl_vendor_elem_update(wpa_s);
6919                 return 0;
6920         }
6921
6922         if (wpa_s->vendor_elem[frame] == NULL)
6923                 return -1;
6924
6925         len = os_strlen(pos);
6926         if (len == 0)
6927                 return 0;
6928         if (len & 1)
6929                 return -1;
6930         len /= 2;
6931
6932         buf = os_malloc(len);
6933         if (buf == NULL)
6934                 return -1;
6935
6936         if (hexstr2bin(pos, buf, len) < 0) {
6937                 os_free(buf);
6938                 return -1;
6939         }
6940
6941         if (ieee802_11_parse_elems(buf, len, &elems, 0) == ParseFailed) {
6942                 os_free(buf);
6943                 return -1;
6944         }
6945
6946         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6947         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6948
6949         for (; ie + 1 < end; ie += 2 + ie[1]) {
6950                 if (ie + len > end)
6951                         break;
6952                 if (os_memcmp(ie, buf, len) != 0)
6953                         continue;
6954
6955                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6956                         wpabuf_free(wpa_s->vendor_elem[frame]);
6957                         wpa_s->vendor_elem[frame] = NULL;
6958                 } else {
6959                         os_memmove(ie, ie + len,
6960                                    end - (ie + len));
6961                         wpa_s->vendor_elem[frame]->used -= len;
6962                 }
6963                 os_free(buf);
6964                 wpas_ctrl_vendor_elem_update(wpa_s);
6965                 return 0;
6966         }
6967
6968         os_free(buf);
6969
6970         return -1;
6971 }
6972
6973
6974 static void wpas_ctrl_neighbor_rep_cb(void *ctx, struct wpabuf *neighbor_rep)
6975 {
6976         struct wpa_supplicant *wpa_s = ctx;
6977
6978         if (neighbor_rep) {
6979                 wpa_msg_ctrl(wpa_s, MSG_INFO, RRM_EVENT_NEIGHBOR_REP_RXED
6980                              "length=%u",
6981                              (unsigned int) wpabuf_len(neighbor_rep));
6982                 wpabuf_free(neighbor_rep);
6983         } else {
6984                 wpa_msg_ctrl(wpa_s, MSG_INFO, RRM_EVENT_NEIGHBOR_REP_FAILED);
6985         }
6986 }
6987
6988
6989 static int wpas_ctrl_iface_send_neigbor_rep(struct wpa_supplicant *wpa_s,
6990                                             char *cmd)
6991 {
6992         struct wpa_ssid ssid;
6993         struct wpa_ssid *ssid_p = NULL;
6994         int ret = 0;
6995
6996         if (os_strncmp(cmd, " ssid=", 6) == 0) {
6997                 ssid.ssid_len = os_strlen(cmd + 6);
6998                 if (ssid.ssid_len > 32)
6999                         return -1;
7000                 ssid.ssid = (u8 *) (cmd + 6);
7001                 ssid_p = &ssid;
7002         }
7003
7004         ret = wpas_rrm_send_neighbor_rep_request(wpa_s, ssid_p,
7005                                                  wpas_ctrl_neighbor_rep_cb,
7006                                                  wpa_s);
7007
7008         return ret;
7009 }
7010
7011
7012 static int wpas_ctrl_iface_erp_flush(struct wpa_supplicant *wpa_s)
7013 {
7014         eapol_sm_erp_flush(wpa_s->eapol);
7015         return 0;
7016 }
7017
7018
7019 char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
7020                                          char *buf, size_t *resp_len)
7021 {
7022         char *reply;
7023         const int reply_size = 4096;
7024         int reply_len;
7025
7026         if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0 ||
7027             os_strncmp(buf, "SET_NETWORK ", 12) == 0) {
7028                 if (wpa_debug_show_keys)
7029                         wpa_dbg(wpa_s, MSG_DEBUG,
7030                                 "Control interface command '%s'", buf);
7031                 else
7032                         wpa_dbg(wpa_s, MSG_DEBUG,
7033                                 "Control interface command '%s [REMOVED]'",
7034                                 os_strncmp(buf, WPA_CTRL_RSP,
7035                                            os_strlen(WPA_CTRL_RSP)) == 0 ?
7036                                 WPA_CTRL_RSP : "SET_NETWORK");
7037         } else if (os_strncmp(buf, "WPS_NFC_TAG_READ", 16) == 0 ||
7038                    os_strncmp(buf, "NFC_REPORT_HANDOVER", 19) == 0) {
7039                 wpa_hexdump_ascii_key(MSG_DEBUG, "RX ctrl_iface",
7040                                       (const u8 *) buf, os_strlen(buf));
7041         } else {
7042                 int level = MSG_DEBUG;
7043                 if (os_strcmp(buf, "PING") == 0)
7044                         level = MSG_EXCESSIVE;
7045                 wpa_dbg(wpa_s, level, "Control interface command '%s'", buf);
7046         }
7047
7048         reply = os_malloc(reply_size);
7049         if (reply == NULL) {
7050                 *resp_len = 1;
7051                 return NULL;
7052         }
7053
7054         os_memcpy(reply, "OK\n", 3);
7055         reply_len = 3;
7056
7057         if (os_strcmp(buf, "PING") == 0) {
7058                 os_memcpy(reply, "PONG\n", 5);
7059                 reply_len = 5;
7060         } else if (os_strcmp(buf, "IFNAME") == 0) {
7061                 reply_len = os_strlen(wpa_s->ifname);
7062                 os_memcpy(reply, wpa_s->ifname, reply_len);
7063         } else if (os_strncmp(buf, "RELOG", 5) == 0) {
7064                 if (wpa_debug_reopen_file() < 0)
7065                         reply_len = -1;
7066         } else if (os_strncmp(buf, "NOTE ", 5) == 0) {
7067                 wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
7068         } else if (os_strcmp(buf, "MIB") == 0) {
7069                 reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
7070                 if (reply_len >= 0) {
7071                         reply_len += eapol_sm_get_mib(wpa_s->eapol,
7072                                                       reply + reply_len,
7073                                                       reply_size - reply_len);
7074                 }
7075         } else if (os_strncmp(buf, "STATUS", 6) == 0) {
7076                 reply_len = wpa_supplicant_ctrl_iface_status(
7077                         wpa_s, buf + 6, reply, reply_size);
7078         } else if (os_strcmp(buf, "PMKSA") == 0) {
7079                 reply_len = wpa_sm_pmksa_cache_list(wpa_s->wpa, reply,
7080                                                     reply_size);
7081         } else if (os_strcmp(buf, "PMKSA_FLUSH") == 0) {
7082                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
7083         } else if (os_strncmp(buf, "SET ", 4) == 0) {
7084                 if (wpa_supplicant_ctrl_iface_set(wpa_s, buf + 4))
7085                         reply_len = -1;
7086         } else if (os_strncmp(buf, "GET ", 4) == 0) {
7087                 reply_len = wpa_supplicant_ctrl_iface_get(wpa_s, buf + 4,
7088                                                           reply, reply_size);
7089         } else if (os_strcmp(buf, "LOGON") == 0) {
7090                 eapol_sm_notify_logoff(wpa_s->eapol, FALSE);
7091         } else if (os_strcmp(buf, "LOGOFF") == 0) {
7092                 eapol_sm_notify_logoff(wpa_s->eapol, TRUE);
7093         } else if (os_strcmp(buf, "REASSOCIATE") == 0) {
7094                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
7095                         reply_len = -1;
7096                 else
7097                         wpas_request_connection(wpa_s);
7098         } else if (os_strcmp(buf, "REATTACH") == 0) {
7099                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED ||
7100                     !wpa_s->current_ssid)
7101                         reply_len = -1;
7102                 else {
7103                         wpa_s->reattach = 1;
7104                         wpas_request_connection(wpa_s);
7105                 }
7106         } else if (os_strcmp(buf, "RECONNECT") == 0) {
7107                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
7108                         reply_len = -1;
7109                 else if (wpa_s->disconnected)
7110                         wpas_request_connection(wpa_s);
7111 #ifdef IEEE8021X_EAPOL
7112         } else if (os_strncmp(buf, "PREAUTH ", 8) == 0) {
7113                 if (wpa_supplicant_ctrl_iface_preauth(wpa_s, buf + 8))
7114                         reply_len = -1;
7115 #endif /* IEEE8021X_EAPOL */
7116 #ifdef CONFIG_PEERKEY
7117         } else if (os_strncmp(buf, "STKSTART ", 9) == 0) {
7118                 if (wpa_supplicant_ctrl_iface_stkstart(wpa_s, buf + 9))
7119                         reply_len = -1;
7120 #endif /* CONFIG_PEERKEY */
7121 #ifdef CONFIG_IEEE80211R
7122         } else if (os_strncmp(buf, "FT_DS ", 6) == 0) {
7123                 if (wpa_supplicant_ctrl_iface_ft_ds(wpa_s, buf + 6))
7124                         reply_len = -1;
7125 #endif /* CONFIG_IEEE80211R */
7126 #ifdef CONFIG_WPS
7127         } else if (os_strcmp(buf, "WPS_PBC") == 0) {
7128                 int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, NULL);
7129                 if (res == -2) {
7130                         os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
7131                         reply_len = 17;
7132                 } else if (res)
7133                         reply_len = -1;
7134         } else if (os_strncmp(buf, "WPS_PBC ", 8) == 0) {
7135                 int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, buf + 8);
7136                 if (res == -2) {
7137                         os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
7138                         reply_len = 17;
7139                 } else if (res)
7140                         reply_len = -1;
7141         } else if (os_strncmp(buf, "WPS_PIN ", 8) == 0) {
7142                 reply_len = wpa_supplicant_ctrl_iface_wps_pin(wpa_s, buf + 8,
7143                                                               reply,
7144                                                               reply_size);
7145         } else if (os_strncmp(buf, "WPS_CHECK_PIN ", 14) == 0) {
7146                 reply_len = wpa_supplicant_ctrl_iface_wps_check_pin(
7147                         wpa_s, buf + 14, reply, reply_size);
7148         } else if (os_strcmp(buf, "WPS_CANCEL") == 0) {
7149                 if (wpas_wps_cancel(wpa_s))
7150                         reply_len = -1;
7151 #ifdef CONFIG_WPS_NFC
7152         } else if (os_strcmp(buf, "WPS_NFC") == 0) {
7153                 if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, NULL))
7154                         reply_len = -1;
7155         } else if (os_strncmp(buf, "WPS_NFC ", 8) == 0) {
7156                 if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, buf + 8))
7157                         reply_len = -1;
7158         } else if (os_strncmp(buf, "WPS_NFC_CONFIG_TOKEN ", 21) == 0) {
7159                 reply_len = wpa_supplicant_ctrl_iface_wps_nfc_config_token(
7160                         wpa_s, buf + 21, reply, reply_size);
7161         } else if (os_strncmp(buf, "WPS_NFC_TOKEN ", 14) == 0) {
7162                 reply_len = wpa_supplicant_ctrl_iface_wps_nfc_token(
7163                         wpa_s, buf + 14, reply, reply_size);
7164         } else if (os_strncmp(buf, "WPS_NFC_TAG_READ ", 17) == 0) {
7165                 if (wpa_supplicant_ctrl_iface_wps_nfc_tag_read(wpa_s,
7166                                                                buf + 17))
7167                         reply_len = -1;
7168         } else if (os_strncmp(buf, "NFC_GET_HANDOVER_REQ ", 21) == 0) {
7169                 reply_len = wpas_ctrl_nfc_get_handover_req(
7170                         wpa_s, buf + 21, reply, reply_size);
7171         } else if (os_strncmp(buf, "NFC_GET_HANDOVER_SEL ", 21) == 0) {
7172                 reply_len = wpas_ctrl_nfc_get_handover_sel(
7173                         wpa_s, buf + 21, reply, reply_size);
7174         } else if (os_strncmp(buf, "NFC_REPORT_HANDOVER ", 20) == 0) {
7175                 if (wpas_ctrl_nfc_report_handover(wpa_s, buf + 20))
7176                         reply_len = -1;
7177 #endif /* CONFIG_WPS_NFC */
7178         } else if (os_strncmp(buf, "WPS_REG ", 8) == 0) {
7179                 if (wpa_supplicant_ctrl_iface_wps_reg(wpa_s, buf + 8))
7180                         reply_len = -1;
7181 #ifdef CONFIG_AP
7182         } else if (os_strncmp(buf, "WPS_AP_PIN ", 11) == 0) {
7183                 reply_len = wpa_supplicant_ctrl_iface_wps_ap_pin(
7184                         wpa_s, buf + 11, reply, reply_size);
7185 #endif /* CONFIG_AP */
7186 #ifdef CONFIG_WPS_ER
7187         } else if (os_strcmp(buf, "WPS_ER_START") == 0) {
7188                 if (wpas_wps_er_start(wpa_s, NULL))
7189                         reply_len = -1;
7190         } else if (os_strncmp(buf, "WPS_ER_START ", 13) == 0) {
7191                 if (wpas_wps_er_start(wpa_s, buf + 13))
7192                         reply_len = -1;
7193         } else if (os_strcmp(buf, "WPS_ER_STOP") == 0) {
7194                 wpas_wps_er_stop(wpa_s);
7195         } else if (os_strncmp(buf, "WPS_ER_PIN ", 11) == 0) {
7196                 if (wpa_supplicant_ctrl_iface_wps_er_pin(wpa_s, buf + 11))
7197                         reply_len = -1;
7198         } else if (os_strncmp(buf, "WPS_ER_PBC ", 11) == 0) {
7199                 int ret = wpas_wps_er_pbc(wpa_s, buf + 11);
7200                 if (ret == -2) {
7201                         os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
7202                         reply_len = 17;
7203                 } else if (ret == -3) {
7204                         os_memcpy(reply, "FAIL-UNKNOWN-UUID\n", 18);
7205                         reply_len = 18;
7206                 } else if (ret == -4) {
7207                         os_memcpy(reply, "FAIL-NO-AP-SETTINGS\n", 20);
7208                         reply_len = 20;
7209                 } else if (ret)
7210                         reply_len = -1;
7211         } else if (os_strncmp(buf, "WPS_ER_LEARN ", 13) == 0) {
7212                 if (wpa_supplicant_ctrl_iface_wps_er_learn(wpa_s, buf + 13))
7213                         reply_len = -1;
7214         } else if (os_strncmp(buf, "WPS_ER_SET_CONFIG ", 18) == 0) {
7215                 if (wpa_supplicant_ctrl_iface_wps_er_set_config(wpa_s,
7216                                                                 buf + 18))
7217                         reply_len = -1;
7218         } else if (os_strncmp(buf, "WPS_ER_CONFIG ", 14) == 0) {
7219                 if (wpa_supplicant_ctrl_iface_wps_er_config(wpa_s, buf + 14))
7220                         reply_len = -1;
7221 #ifdef CONFIG_WPS_NFC
7222         } else if (os_strncmp(buf, "WPS_ER_NFC_CONFIG_TOKEN ", 24) == 0) {
7223                 reply_len = wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
7224                         wpa_s, buf + 24, reply, reply_size);
7225 #endif /* CONFIG_WPS_NFC */
7226 #endif /* CONFIG_WPS_ER */
7227 #endif /* CONFIG_WPS */
7228 #ifdef CONFIG_IBSS_RSN
7229         } else if (os_strncmp(buf, "IBSS_RSN ", 9) == 0) {
7230                 if (wpa_supplicant_ctrl_iface_ibss_rsn(wpa_s, buf + 9))
7231                         reply_len = -1;
7232 #endif /* CONFIG_IBSS_RSN */
7233 #ifdef CONFIG_MESH
7234         } else if (os_strncmp(buf, "MESH_INTERFACE_ADD ", 19) == 0) {
7235                 reply_len = wpa_supplicant_ctrl_iface_mesh_interface_add(
7236                         wpa_s, buf + 19, reply, reply_size);
7237         } else if (os_strcmp(buf, "MESH_INTERFACE_ADD") == 0) {
7238                 reply_len = wpa_supplicant_ctrl_iface_mesh_interface_add(
7239                         wpa_s, "", reply, reply_size);
7240         } else if (os_strncmp(buf, "MESH_GROUP_ADD ", 15) == 0) {
7241                 if (wpa_supplicant_ctrl_iface_mesh_group_add(wpa_s, buf + 15))
7242                         reply_len = -1;
7243         } else if (os_strncmp(buf, "MESH_GROUP_REMOVE ", 18) == 0) {
7244                 if (wpa_supplicant_ctrl_iface_mesh_group_remove(wpa_s,
7245                                                                 buf + 18))
7246                         reply_len = -1;
7247 #endif /* CONFIG_MESH */
7248 #ifdef CONFIG_P2P
7249         } else if (os_strncmp(buf, "P2P_FIND ", 9) == 0) {
7250                 if (p2p_ctrl_find(wpa_s, buf + 9))
7251                         reply_len = -1;
7252         } else if (os_strcmp(buf, "P2P_FIND") == 0) {
7253                 if (p2p_ctrl_find(wpa_s, ""))
7254                         reply_len = -1;
7255         } else if (os_strcmp(buf, "P2P_STOP_FIND") == 0) {
7256                 wpas_p2p_stop_find(wpa_s);
7257         } else if (os_strncmp(buf, "P2P_CONNECT ", 12) == 0) {
7258                 reply_len = p2p_ctrl_connect(wpa_s, buf + 12, reply,
7259                                              reply_size);
7260         } else if (os_strncmp(buf, "P2P_LISTEN ", 11) == 0) {
7261                 if (p2p_ctrl_listen(wpa_s, buf + 11))
7262                         reply_len = -1;
7263         } else if (os_strcmp(buf, "P2P_LISTEN") == 0) {
7264                 if (p2p_ctrl_listen(wpa_s, ""))
7265                         reply_len = -1;
7266         } else if (os_strncmp(buf, "P2P_GROUP_REMOVE ", 17) == 0) {
7267                 if (wpas_p2p_group_remove(wpa_s, buf + 17))
7268                         reply_len = -1;
7269         } else if (os_strcmp(buf, "P2P_GROUP_ADD") == 0) {
7270                 if (wpas_p2p_group_add(wpa_s, 0, 0, 0, 0))
7271                         reply_len = -1;
7272         } else if (os_strncmp(buf, "P2P_GROUP_ADD ", 14) == 0) {
7273                 if (p2p_ctrl_group_add(wpa_s, buf + 14))
7274                         reply_len = -1;
7275         } else if (os_strncmp(buf, "P2P_PROV_DISC ", 14) == 0) {
7276                 if (p2p_ctrl_prov_disc(wpa_s, buf + 14))
7277                         reply_len = -1;
7278         } else if (os_strcmp(buf, "P2P_GET_PASSPHRASE") == 0) {
7279                 reply_len = p2p_get_passphrase(wpa_s, reply, reply_size);
7280         } else if (os_strncmp(buf, "P2P_SERV_DISC_REQ ", 18) == 0) {
7281                 reply_len = p2p_ctrl_serv_disc_req(wpa_s, buf + 18, reply,
7282                                                    reply_size);
7283         } else if (os_strncmp(buf, "P2P_SERV_DISC_CANCEL_REQ ", 25) == 0) {
7284                 if (p2p_ctrl_serv_disc_cancel_req(wpa_s, buf + 25) < 0)
7285                         reply_len = -1;
7286         } else if (os_strncmp(buf, "P2P_SERV_DISC_RESP ", 19) == 0) {
7287                 if (p2p_ctrl_serv_disc_resp(wpa_s, buf + 19) < 0)
7288                         reply_len = -1;
7289         } else if (os_strcmp(buf, "P2P_SERVICE_UPDATE") == 0) {
7290                 wpas_p2p_sd_service_update(wpa_s);
7291         } else if (os_strncmp(buf, "P2P_SERV_DISC_EXTERNAL ", 23) == 0) {
7292                 if (p2p_ctrl_serv_disc_external(wpa_s, buf + 23) < 0)
7293                         reply_len = -1;
7294         } else if (os_strcmp(buf, "P2P_SERVICE_FLUSH") == 0) {
7295                 wpas_p2p_service_flush(wpa_s);
7296         } else if (os_strncmp(buf, "P2P_SERVICE_ADD ", 16) == 0) {
7297                 if (p2p_ctrl_service_add(wpa_s, buf + 16) < 0)
7298                         reply_len = -1;
7299         } else if (os_strncmp(buf, "P2P_SERVICE_DEL ", 16) == 0) {
7300                 if (p2p_ctrl_service_del(wpa_s, buf + 16) < 0)
7301                         reply_len = -1;
7302         } else if (os_strncmp(buf, "P2P_REJECT ", 11) == 0) {
7303                 if (p2p_ctrl_reject(wpa_s, buf + 11) < 0)
7304                         reply_len = -1;
7305         } else if (os_strncmp(buf, "P2P_INVITE ", 11) == 0) {
7306                 if (p2p_ctrl_invite(wpa_s, buf + 11) < 0)
7307                         reply_len = -1;
7308         } else if (os_strncmp(buf, "P2P_PEER ", 9) == 0) {
7309                 reply_len = p2p_ctrl_peer(wpa_s, buf + 9, reply,
7310                                               reply_size);
7311         } else if (os_strncmp(buf, "P2P_SET ", 8) == 0) {
7312                 if (p2p_ctrl_set(wpa_s, buf + 8) < 0)
7313                         reply_len = -1;
7314         } else if (os_strcmp(buf, "P2P_FLUSH") == 0) {
7315                 p2p_ctrl_flush(wpa_s);
7316         } else if (os_strncmp(buf, "P2P_UNAUTHORIZE ", 16) == 0) {
7317                 if (wpas_p2p_unauthorize(wpa_s, buf + 16) < 0)
7318                         reply_len = -1;
7319         } else if (os_strcmp(buf, "P2P_CANCEL") == 0) {
7320                 if (wpas_p2p_cancel(wpa_s))
7321                         reply_len = -1;
7322         } else if (os_strncmp(buf, "P2P_PRESENCE_REQ ", 17) == 0) {
7323                 if (p2p_ctrl_presence_req(wpa_s, buf + 17) < 0)
7324                         reply_len = -1;
7325         } else if (os_strcmp(buf, "P2P_PRESENCE_REQ") == 0) {
7326                 if (p2p_ctrl_presence_req(wpa_s, "") < 0)
7327                         reply_len = -1;
7328         } else if (os_strncmp(buf, "P2P_EXT_LISTEN ", 15) == 0) {
7329                 if (p2p_ctrl_ext_listen(wpa_s, buf + 15) < 0)
7330                         reply_len = -1;
7331         } else if (os_strcmp(buf, "P2P_EXT_LISTEN") == 0) {
7332                 if (p2p_ctrl_ext_listen(wpa_s, "") < 0)
7333                         reply_len = -1;
7334         } else if (os_strncmp(buf, "P2P_REMOVE_CLIENT ", 18) == 0) {
7335                 if (p2p_ctrl_remove_client(wpa_s, buf + 18) < 0)
7336                         reply_len = -1;
7337 #endif /* CONFIG_P2P */
7338 #ifdef CONFIG_WIFI_DISPLAY
7339         } else if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0) {
7340                 if (wifi_display_subelem_set(wpa_s->global, buf + 16) < 0)
7341                         reply_len = -1;
7342         } else if (os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0) {
7343                 reply_len = wifi_display_subelem_get(wpa_s->global, buf + 16,
7344                                                      reply, reply_size);
7345 #endif /* CONFIG_WIFI_DISPLAY */
7346 #ifdef CONFIG_INTERWORKING
7347         } else if (os_strcmp(buf, "FETCH_ANQP") == 0) {
7348                 if (interworking_fetch_anqp(wpa_s) < 0)
7349                         reply_len = -1;
7350         } else if (os_strcmp(buf, "STOP_FETCH_ANQP") == 0) {
7351                 interworking_stop_fetch_anqp(wpa_s);
7352         } else if (os_strcmp(buf, "INTERWORKING_SELECT") == 0) {
7353                 if (ctrl_interworking_select(wpa_s, NULL) < 0)
7354                         reply_len = -1;
7355         } else if (os_strncmp(buf, "INTERWORKING_SELECT ", 20) == 0) {
7356                 if (ctrl_interworking_select(wpa_s, buf + 20) < 0)
7357                         reply_len = -1;
7358         } else if (os_strncmp(buf, "INTERWORKING_CONNECT ", 21) == 0) {
7359                 if (ctrl_interworking_connect(wpa_s, buf + 21) < 0)
7360                         reply_len = -1;
7361         } else if (os_strncmp(buf, "ANQP_GET ", 9) == 0) {
7362                 if (get_anqp(wpa_s, buf + 9) < 0)
7363                         reply_len = -1;
7364         } else if (os_strncmp(buf, "GAS_REQUEST ", 12) == 0) {
7365                 if (gas_request(wpa_s, buf + 12) < 0)
7366                         reply_len = -1;
7367         } else if (os_strncmp(buf, "GAS_RESPONSE_GET ", 17) == 0) {
7368                 reply_len = gas_response_get(wpa_s, buf + 17, reply,
7369                                              reply_size);
7370 #endif /* CONFIG_INTERWORKING */
7371 #ifdef CONFIG_HS20
7372         } else if (os_strncmp(buf, "HS20_ANQP_GET ", 14) == 0) {
7373                 if (get_hs20_anqp(wpa_s, buf + 14) < 0)
7374                         reply_len = -1;
7375         } else if (os_strncmp(buf, "HS20_GET_NAI_HOME_REALM_LIST ", 29) == 0) {
7376                 if (hs20_get_nai_home_realm_list(wpa_s, buf + 29) < 0)
7377                         reply_len = -1;
7378         } else if (os_strncmp(buf, "HS20_ICON_REQUEST ", 18) == 0) {
7379                 if (hs20_icon_request(wpa_s, buf + 18) < 0)
7380                         reply_len = -1;
7381         } else if (os_strcmp(buf, "FETCH_OSU") == 0) {
7382                 if (hs20_fetch_osu(wpa_s) < 0)
7383                         reply_len = -1;
7384         } else if (os_strcmp(buf, "CANCEL_FETCH_OSU") == 0) {
7385                 hs20_cancel_fetch_osu(wpa_s);
7386 #endif /* CONFIG_HS20 */
7387         } else if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0)
7388         {
7389                 if (wpa_supplicant_ctrl_iface_ctrl_rsp(
7390                             wpa_s, buf + os_strlen(WPA_CTRL_RSP)))
7391                         reply_len = -1;
7392                 else {
7393                         /*
7394                          * Notify response from timeout to allow the control
7395                          * interface response to be sent first.
7396                          */
7397                         eloop_register_timeout(0, 0, wpas_ctrl_eapol_response,
7398                                                wpa_s, NULL);
7399                 }
7400         } else if (os_strcmp(buf, "RECONFIGURE") == 0) {
7401                 if (wpa_supplicant_reload_configuration(wpa_s))
7402                         reply_len = -1;
7403         } else if (os_strcmp(buf, "TERMINATE") == 0) {
7404                 wpa_supplicant_terminate_proc(wpa_s->global);
7405         } else if (os_strncmp(buf, "BSSID ", 6) == 0) {
7406                 if (wpa_supplicant_ctrl_iface_bssid(wpa_s, buf + 6))
7407                         reply_len = -1;
7408         } else if (os_strncmp(buf, "BLACKLIST", 9) == 0) {
7409                 reply_len = wpa_supplicant_ctrl_iface_blacklist(
7410                         wpa_s, buf + 9, reply, reply_size);
7411         } else if (os_strncmp(buf, "LOG_LEVEL", 9) == 0) {
7412                 reply_len = wpa_supplicant_ctrl_iface_log_level(
7413                         wpa_s, buf + 9, reply, reply_size);
7414         } else if (os_strncmp(buf, "LIST_NETWORKS ", 14) == 0) {
7415                 reply_len = wpa_supplicant_ctrl_iface_list_networks(
7416                         wpa_s, buf + 14, reply, reply_size);
7417         } else if (os_strcmp(buf, "LIST_NETWORKS") == 0) {
7418                 reply_len = wpa_supplicant_ctrl_iface_list_networks(
7419                         wpa_s, NULL, reply, reply_size);
7420         } else if (os_strcmp(buf, "DISCONNECT") == 0) {
7421 #ifdef CONFIG_SME
7422                 wpa_s->sme.prev_bssid_set = 0;
7423 #endif /* CONFIG_SME */
7424                 wpa_s->reassociate = 0;
7425                 wpa_s->disconnected = 1;
7426                 wpa_supplicant_cancel_sched_scan(wpa_s);
7427                 wpa_supplicant_cancel_scan(wpa_s);
7428                 wpa_supplicant_deauthenticate(wpa_s,
7429                                               WLAN_REASON_DEAUTH_LEAVING);
7430         } else if (os_strcmp(buf, "SCAN") == 0) {
7431                 wpas_ctrl_scan(wpa_s, NULL, reply, reply_size, &reply_len);
7432         } else if (os_strncmp(buf, "SCAN ", 5) == 0) {
7433                 wpas_ctrl_scan(wpa_s, buf + 5, reply, reply_size, &reply_len);
7434         } else if (os_strcmp(buf, "SCAN_RESULTS") == 0) {
7435                 reply_len = wpa_supplicant_ctrl_iface_scan_results(
7436                         wpa_s, reply, reply_size);
7437         } else if (os_strncmp(buf, "SELECT_NETWORK ", 15) == 0) {
7438                 if (wpa_supplicant_ctrl_iface_select_network(wpa_s, buf + 15))
7439                         reply_len = -1;
7440         } else if (os_strncmp(buf, "ENABLE_NETWORK ", 15) == 0) {
7441                 if (wpa_supplicant_ctrl_iface_enable_network(wpa_s, buf + 15))
7442                         reply_len = -1;
7443         } else if (os_strncmp(buf, "DISABLE_NETWORK ", 16) == 0) {
7444                 if (wpa_supplicant_ctrl_iface_disable_network(wpa_s, buf + 16))
7445                         reply_len = -1;
7446         } else if (os_strcmp(buf, "ADD_NETWORK") == 0) {
7447                 reply_len = wpa_supplicant_ctrl_iface_add_network(
7448                         wpa_s, reply, reply_size);
7449         } else if (os_strncmp(buf, "REMOVE_NETWORK ", 15) == 0) {
7450                 if (wpa_supplicant_ctrl_iface_remove_network(wpa_s, buf + 15))
7451                         reply_len = -1;
7452         } else if (os_strncmp(buf, "SET_NETWORK ", 12) == 0) {
7453                 if (wpa_supplicant_ctrl_iface_set_network(wpa_s, buf + 12))
7454                         reply_len = -1;
7455         } else if (os_strncmp(buf, "GET_NETWORK ", 12) == 0) {
7456                 reply_len = wpa_supplicant_ctrl_iface_get_network(
7457                         wpa_s, buf + 12, reply, reply_size);
7458         } else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
7459                 if (wpa_supplicant_ctrl_iface_dup_network(wpa_s, buf + 12))
7460                         reply_len = -1;
7461         } else if (os_strcmp(buf, "LIST_CREDS") == 0) {
7462                 reply_len = wpa_supplicant_ctrl_iface_list_creds(
7463                         wpa_s, reply, reply_size);
7464         } else if (os_strcmp(buf, "ADD_CRED") == 0) {
7465                 reply_len = wpa_supplicant_ctrl_iface_add_cred(
7466                         wpa_s, reply, reply_size);
7467         } else if (os_strncmp(buf, "REMOVE_CRED ", 12) == 0) {
7468                 if (wpa_supplicant_ctrl_iface_remove_cred(wpa_s, buf + 12))
7469                         reply_len = -1;
7470         } else if (os_strncmp(buf, "SET_CRED ", 9) == 0) {
7471                 if (wpa_supplicant_ctrl_iface_set_cred(wpa_s, buf + 9))
7472                         reply_len = -1;
7473         } else if (os_strncmp(buf, "GET_CRED ", 9) == 0) {
7474                 reply_len = wpa_supplicant_ctrl_iface_get_cred(wpa_s, buf + 9,
7475                                                                reply,
7476                                                                reply_size);
7477 #ifndef CONFIG_NO_CONFIG_WRITE
7478         } else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
7479                 if (wpa_supplicant_ctrl_iface_save_config(wpa_s))
7480                         reply_len = -1;
7481 #endif /* CONFIG_NO_CONFIG_WRITE */
7482         } else if (os_strncmp(buf, "GET_CAPABILITY ", 15) == 0) {
7483                 reply_len = wpa_supplicant_ctrl_iface_get_capability(
7484                         wpa_s, buf + 15, reply, reply_size);
7485         } else if (os_strncmp(buf, "AP_SCAN ", 8) == 0) {
7486                 if (wpa_supplicant_ctrl_iface_ap_scan(wpa_s, buf + 8))
7487                         reply_len = -1;
7488         } else if (os_strncmp(buf, "SCAN_INTERVAL ", 14) == 0) {
7489                 if (wpa_supplicant_ctrl_iface_scan_interval(wpa_s, buf + 14))
7490                         reply_len = -1;
7491         } else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
7492                 reply_len = wpa_supplicant_global_iface_list(
7493                         wpa_s->global, reply, reply_size);
7494         } else if (os_strcmp(buf, "INTERFACES") == 0) {
7495                 reply_len = wpa_supplicant_global_iface_interfaces(
7496                         wpa_s->global, reply, reply_size);
7497         } else if (os_strncmp(buf, "BSS ", 4) == 0) {
7498                 reply_len = wpa_supplicant_ctrl_iface_bss(
7499                         wpa_s, buf + 4, reply, reply_size);
7500 #ifdef CONFIG_AP
7501         } else if (os_strcmp(buf, "STA-FIRST") == 0) {
7502                 reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
7503         } else if (os_strncmp(buf, "STA ", 4) == 0) {
7504                 reply_len = ap_ctrl_iface_sta(wpa_s, buf + 4, reply,
7505                                               reply_size);
7506         } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
7507                 reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
7508                                                    reply_size);
7509         } else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
7510                 if (ap_ctrl_iface_sta_deauthenticate(wpa_s, buf + 15))
7511                         reply_len = -1;
7512         } else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
7513                 if (ap_ctrl_iface_sta_disassociate(wpa_s, buf + 13))
7514                         reply_len = -1;
7515         } else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
7516                 if (ap_ctrl_iface_chanswitch(wpa_s, buf + 12))
7517                         reply_len = -1;
7518 #endif /* CONFIG_AP */
7519         } else if (os_strcmp(buf, "SUSPEND") == 0) {
7520                 wpas_notify_suspend(wpa_s->global);
7521         } else if (os_strcmp(buf, "RESUME") == 0) {
7522                 wpas_notify_resume(wpa_s->global);
7523 #ifdef CONFIG_TESTING_OPTIONS
7524         } else if (os_strcmp(buf, "DROP_SA") == 0) {
7525                 wpa_supplicant_ctrl_iface_drop_sa(wpa_s);
7526 #endif /* CONFIG_TESTING_OPTIONS */
7527         } else if (os_strncmp(buf, "ROAM ", 5) == 0) {
7528                 if (wpa_supplicant_ctrl_iface_roam(wpa_s, buf + 5))
7529                         reply_len = -1;
7530         } else if (os_strncmp(buf, "STA_AUTOCONNECT ", 16) == 0) {
7531                 wpa_s->auto_reconnect_disabled = atoi(buf + 16) == 0;
7532         } else if (os_strncmp(buf, "BSS_EXPIRE_AGE ", 15) == 0) {
7533                 if (wpa_supplicant_ctrl_iface_bss_expire_age(wpa_s, buf + 15))
7534                         reply_len = -1;
7535         } else if (os_strncmp(buf, "BSS_EXPIRE_COUNT ", 17) == 0) {
7536                 if (wpa_supplicant_ctrl_iface_bss_expire_count(wpa_s,
7537                                                                buf + 17))
7538                         reply_len = -1;
7539         } else if (os_strncmp(buf, "BSS_FLUSH ", 10) == 0) {
7540                 wpa_supplicant_ctrl_iface_bss_flush(wpa_s, buf + 10);
7541 #ifdef CONFIG_TDLS
7542         } else if (os_strncmp(buf, "TDLS_DISCOVER ", 14) == 0) {
7543                 if (wpa_supplicant_ctrl_iface_tdls_discover(wpa_s, buf + 14))
7544                         reply_len = -1;
7545         } else if (os_strncmp(buf, "TDLS_SETUP ", 11) == 0) {
7546                 if (wpa_supplicant_ctrl_iface_tdls_setup(wpa_s, buf + 11))
7547                         reply_len = -1;
7548         } else if (os_strncmp(buf, "TDLS_TEARDOWN ", 14) == 0) {
7549                 if (wpa_supplicant_ctrl_iface_tdls_teardown(wpa_s, buf + 14))
7550                         reply_len = -1;
7551 #endif /* CONFIG_TDLS */
7552         } else if (os_strcmp(buf, "WMM_AC_STATUS") == 0) {
7553                 reply_len = wpas_wmm_ac_status(wpa_s, reply, reply_size);
7554         } else if (os_strncmp(buf, "WMM_AC_ADDTS ", 13) == 0) {
7555                 if (wmm_ac_ctrl_addts(wpa_s, buf + 13))
7556                         reply_len = -1;
7557         } else if (os_strncmp(buf, "WMM_AC_DELTS ", 13) == 0) {
7558                 if (wmm_ac_ctrl_delts(wpa_s, buf + 13))
7559                         reply_len = -1;
7560         } else if (os_strncmp(buf, "SIGNAL_POLL", 11) == 0) {
7561                 reply_len = wpa_supplicant_signal_poll(wpa_s, reply,
7562                                                        reply_size);
7563         } else if (os_strncmp(buf, "PKTCNT_POLL", 11) == 0) {
7564                 reply_len = wpa_supplicant_pktcnt_poll(wpa_s, reply,
7565                                                        reply_size);
7566 #ifdef CONFIG_AUTOSCAN
7567         } else if (os_strncmp(buf, "AUTOSCAN ", 9) == 0) {
7568                 if (wpa_supplicant_ctrl_iface_autoscan(wpa_s, buf + 9))
7569                         reply_len = -1;
7570 #endif /* CONFIG_AUTOSCAN */
7571 #ifdef ANDROID
7572         } else if (os_strncmp(buf, "DRIVER ", 7) == 0) {
7573                 reply_len = wpa_supplicant_driver_cmd(wpa_s, buf + 7, reply,
7574                                                       reply_size);
7575 #endif /* ANDROID */
7576         } else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
7577                 reply_len = wpa_supplicant_vendor_cmd(wpa_s, buf + 7, reply,
7578                                                       reply_size);
7579         } else if (os_strcmp(buf, "REAUTHENTICATE") == 0) {
7580                 pmksa_cache_clear_current(wpa_s->wpa);
7581                 eapol_sm_request_reauth(wpa_s->eapol);
7582 #ifdef CONFIG_WNM
7583         } else if (os_strncmp(buf, "WNM_SLEEP ", 10) == 0) {
7584                 if (wpas_ctrl_iface_wnm_sleep(wpa_s, buf + 10))
7585                         reply_len = -1;
7586         } else if (os_strncmp(buf, "WNM_BSS_QUERY ", 10) == 0) {
7587                 if (wpas_ctrl_iface_wnm_bss_query(wpa_s, buf + 10))
7588                                 reply_len = -1;
7589 #endif /* CONFIG_WNM */
7590         } else if (os_strcmp(buf, "FLUSH") == 0) {
7591                 wpa_supplicant_ctrl_iface_flush(wpa_s);
7592         } else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
7593                 reply_len = wpas_ctrl_radio_work(wpa_s, buf + 11, reply,
7594                                                  reply_size);
7595 #ifdef CONFIG_TESTING_OPTIONS
7596         } else if (os_strncmp(buf, "MGMT_TX ", 8) == 0) {
7597                 if (wpas_ctrl_iface_mgmt_tx(wpa_s, buf + 8) < 0)
7598                         reply_len = -1;
7599         } else if (os_strcmp(buf, "MGMT_TX_DONE") == 0) {
7600                 wpas_ctrl_iface_mgmt_tx_done(wpa_s);
7601         } else if (os_strncmp(buf, "DRIVER_EVENT ", 13) == 0) {
7602                 if (wpas_ctrl_iface_driver_event(wpa_s, buf + 13) < 0)
7603                         reply_len = -1;
7604         } else if (os_strncmp(buf, "EAPOL_RX ", 9) == 0) {
7605                 if (wpas_ctrl_iface_eapol_rx(wpa_s, buf + 9) < 0)
7606                         reply_len = -1;
7607         } else if (os_strncmp(buf, "DATA_TEST_CONFIG ", 17) == 0) {
7608                 if (wpas_ctrl_iface_data_test_config(wpa_s, buf + 17) < 0)
7609                         reply_len = -1;
7610         } else if (os_strncmp(buf, "DATA_TEST_TX ", 13) == 0) {
7611                 if (wpas_ctrl_iface_data_test_tx(wpa_s, buf + 13) < 0)
7612                         reply_len = -1;
7613         } else if (os_strncmp(buf, "DATA_TEST_FRAME ", 16) == 0) {
7614                 if (wpas_ctrl_iface_data_test_frame(wpa_s, buf + 16) < 0)
7615                         reply_len = -1;
7616 #endif /* CONFIG_TESTING_OPTIONS */
7617         } else if (os_strncmp(buf, "VENDOR_ELEM_ADD ", 16) == 0) {
7618                 if (wpas_ctrl_vendor_elem_add(wpa_s, buf + 16) < 0)
7619                         reply_len = -1;
7620         } else if (os_strncmp(buf, "VENDOR_ELEM_GET ", 16) == 0) {
7621                 reply_len = wpas_ctrl_vendor_elem_get(wpa_s, buf + 16, reply,
7622                                                       reply_size);
7623         } else if (os_strncmp(buf, "VENDOR_ELEM_REMOVE ", 19) == 0) {
7624                 if (wpas_ctrl_vendor_elem_remove(wpa_s, buf + 19) < 0)
7625                         reply_len = -1;
7626         } else if (os_strncmp(buf, "NEIGHBOR_REP_REQUEST", 20) == 0) {
7627                 if (wpas_ctrl_iface_send_neigbor_rep(wpa_s, buf + 20))
7628                         reply_len = -1;
7629         } else if (os_strcmp(buf, "ERP_FLUSH") == 0) {
7630                 wpas_ctrl_iface_erp_flush(wpa_s);
7631         } else {
7632                 os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
7633                 reply_len = 16;
7634         }
7635
7636         if (reply_len < 0) {
7637                 os_memcpy(reply, "FAIL\n", 5);
7638                 reply_len = 5;
7639         }
7640
7641         *resp_len = reply_len;
7642         return reply;
7643 }
7644
7645
7646 static int wpa_supplicant_global_iface_add(struct wpa_global *global,
7647                                            char *cmd)
7648 {
7649         struct wpa_interface iface;
7650         char *pos;
7651
7652         /*
7653          * <ifname>TAB<confname>TAB<driver>TAB<ctrl_interface>TAB<driver_param>
7654          * TAB<bridge_ifname>
7655          */
7656         wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_ADD '%s'", cmd);
7657
7658         os_memset(&iface, 0, sizeof(iface));
7659
7660         do {
7661                 iface.ifname = pos = cmd;
7662                 pos = os_strchr(pos, '\t');
7663                 if (pos)
7664                         *pos++ = '\0';
7665                 if (iface.ifname[0] == '\0')
7666                         return -1;
7667                 if (pos == NULL)
7668                         break;
7669
7670                 iface.confname = pos;
7671                 pos = os_strchr(pos, '\t');
7672                 if (pos)
7673                         *pos++ = '\0';
7674                 if (iface.confname[0] == '\0')
7675                         iface.confname = NULL;
7676                 if (pos == NULL)
7677                         break;
7678
7679                 iface.driver = pos;
7680                 pos = os_strchr(pos, '\t');
7681                 if (pos)
7682                         *pos++ = '\0';
7683                 if (iface.driver[0] == '\0')
7684                         iface.driver = NULL;
7685                 if (pos == NULL)
7686                         break;
7687
7688                 iface.ctrl_interface = pos;
7689                 pos = os_strchr(pos, '\t');
7690                 if (pos)
7691                         *pos++ = '\0';
7692                 if (iface.ctrl_interface[0] == '\0')
7693                         iface.ctrl_interface = NULL;
7694                 if (pos == NULL)
7695                         break;
7696
7697                 iface.driver_param = pos;
7698                 pos = os_strchr(pos, '\t');
7699                 if (pos)
7700                         *pos++ = '\0';
7701                 if (iface.driver_param[0] == '\0')
7702                         iface.driver_param = NULL;
7703                 if (pos == NULL)
7704                         break;
7705
7706                 iface.bridge_ifname = pos;
7707                 pos = os_strchr(pos, '\t');
7708                 if (pos)
7709                         *pos++ = '\0';
7710                 if (iface.bridge_ifname[0] == '\0')
7711                         iface.bridge_ifname = NULL;
7712                 if (pos == NULL)
7713                         break;
7714         } while (0);
7715
7716         if (wpa_supplicant_get_iface(global, iface.ifname))
7717                 return -1;
7718
7719         return wpa_supplicant_add_iface(global, &iface) ? 0 : -1;
7720 }
7721
7722
7723 static int wpa_supplicant_global_iface_remove(struct wpa_global *global,
7724                                               char *cmd)
7725 {
7726         struct wpa_supplicant *wpa_s;
7727
7728         wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_REMOVE '%s'", cmd);
7729
7730         wpa_s = wpa_supplicant_get_iface(global, cmd);
7731         if (wpa_s == NULL)
7732                 return -1;
7733         return wpa_supplicant_remove_iface(global, wpa_s, 0);
7734 }
7735
7736
7737 static void wpa_free_iface_info(struct wpa_interface_info *iface)
7738 {
7739         struct wpa_interface_info *prev;
7740
7741         while (iface) {
7742                 prev = iface;
7743                 iface = iface->next;
7744
7745                 os_free(prev->ifname);
7746                 os_free(prev->desc);
7747                 os_free(prev);
7748         }
7749 }
7750
7751
7752 static int wpa_supplicant_global_iface_list(struct wpa_global *global,
7753                                             char *buf, int len)
7754 {
7755         int i, res;
7756         struct wpa_interface_info *iface = NULL, *last = NULL, *tmp;
7757         char *pos, *end;
7758
7759         for (i = 0; wpa_drivers[i]; i++) {
7760                 struct wpa_driver_ops *drv = wpa_drivers[i];
7761                 if (drv->get_interfaces == NULL)
7762                         continue;
7763                 tmp = drv->get_interfaces(global->drv_priv[i]);
7764                 if (tmp == NULL)
7765                         continue;
7766
7767                 if (last == NULL)
7768                         iface = last = tmp;
7769                 else
7770                         last->next = tmp;
7771                 while (last->next)
7772                         last = last->next;
7773         }
7774
7775         pos = buf;
7776         end = buf + len;
7777         for (tmp = iface; tmp; tmp = tmp->next) {
7778                 res = os_snprintf(pos, end - pos, "%s\t%s\t%s\n",
7779                                   tmp->drv_name, tmp->ifname,
7780                                   tmp->desc ? tmp->desc : "");
7781                 if (os_snprintf_error(end - pos, res)) {
7782                         *pos = '\0';
7783                         break;
7784                 }
7785                 pos += res;
7786         }
7787
7788         wpa_free_iface_info(iface);
7789
7790         return pos - buf;
7791 }
7792
7793
7794 static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
7795                                                   char *buf, int len)
7796 {
7797         int res;
7798         char *pos, *end;
7799         struct wpa_supplicant *wpa_s;
7800
7801         wpa_s = global->ifaces;
7802         pos = buf;
7803         end = buf + len;
7804
7805         while (wpa_s) {
7806                 res = os_snprintf(pos, end - pos, "%s\n", wpa_s->ifname);
7807                 if (os_snprintf_error(end - pos, res)) {
7808                         *pos = '\0';
7809                         break;
7810                 }
7811                 pos += res;
7812                 wpa_s = wpa_s->next;
7813         }
7814         return pos - buf;
7815 }
7816
7817
7818 static char * wpas_global_ctrl_iface_ifname(struct wpa_global *global,
7819                                             const char *ifname,
7820                                             char *cmd, size_t *resp_len)
7821 {
7822         struct wpa_supplicant *wpa_s;
7823
7824         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
7825                 if (os_strcmp(ifname, wpa_s->ifname) == 0)
7826                         break;
7827         }
7828
7829         if (wpa_s == NULL) {
7830                 char *resp = os_strdup("FAIL-NO-IFNAME-MATCH\n");
7831                 if (resp)
7832                         *resp_len = os_strlen(resp);
7833                 else
7834                         *resp_len = 1;
7835                 return resp;
7836         }
7837
7838         return wpa_supplicant_ctrl_iface_process(wpa_s, cmd, resp_len);
7839 }
7840
7841
7842 static char * wpas_global_ctrl_iface_redir_p2p(struct wpa_global *global,
7843                                                char *buf, size_t *resp_len)
7844 {
7845 #ifdef CONFIG_P2P
7846         static const char * cmd[] = {
7847                 "LIST_NETWORKS",
7848                 "P2P_FIND",
7849                 "P2P_STOP_FIND",
7850                 "P2P_LISTEN",
7851                 "P2P_GROUP_ADD",
7852                 "P2P_GET_PASSPHRASE",
7853                 "P2P_SERVICE_UPDATE",
7854                 "P2P_SERVICE_FLUSH",
7855                 "P2P_FLUSH",
7856                 "P2P_CANCEL",
7857                 "P2P_PRESENCE_REQ",
7858                 "P2P_EXT_LISTEN",
7859                 NULL
7860         };
7861         static const char * prefix[] = {
7862 #ifdef ANDROID
7863                 "DRIVER ",
7864 #endif /* ANDROID */
7865                 "GET_NETWORK ",
7866                 "REMOVE_NETWORK ",
7867                 "P2P_FIND ",
7868                 "P2P_CONNECT ",
7869                 "P2P_LISTEN ",
7870                 "P2P_GROUP_REMOVE ",
7871                 "P2P_GROUP_ADD ",
7872                 "P2P_PROV_DISC ",
7873                 "P2P_SERV_DISC_REQ ",
7874                 "P2P_SERV_DISC_CANCEL_REQ ",
7875                 "P2P_SERV_DISC_RESP ",
7876                 "P2P_SERV_DISC_EXTERNAL ",
7877                 "P2P_SERVICE_ADD ",
7878                 "P2P_SERVICE_DEL ",
7879                 "P2P_REJECT ",
7880                 "P2P_INVITE ",
7881                 "P2P_PEER ",
7882                 "P2P_SET ",
7883                 "P2P_UNAUTHORIZE ",
7884                 "P2P_PRESENCE_REQ ",
7885                 "P2P_EXT_LISTEN ",
7886                 "P2P_REMOVE_CLIENT ",
7887                 "NFC_GET_HANDOVER_SEL ",
7888                 "NFC_GET_HANDOVER_REQ ",
7889                 "NFC_REPORT_HANDOVER ",
7890                 NULL
7891         };
7892         int found = 0;
7893         int i;
7894
7895         if (global->p2p_init_wpa_s == NULL)
7896                 return NULL;
7897
7898         for (i = 0; !found && cmd[i]; i++) {
7899                 if (os_strcmp(buf, cmd[i]) == 0)
7900                         found = 1;
7901         }
7902
7903         for (i = 0; !found && prefix[i]; i++) {
7904                 if (os_strncmp(buf, prefix[i], os_strlen(prefix[i])) == 0)
7905                         found = 1;
7906         }
7907
7908         if (found)
7909                 return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
7910                                                          buf, resp_len);
7911 #endif /* CONFIG_P2P */
7912         return NULL;
7913 }
7914
7915
7916 static char * wpas_global_ctrl_iface_redir_wfd(struct wpa_global *global,
7917                                                char *buf, size_t *resp_len)
7918 {
7919 #ifdef CONFIG_WIFI_DISPLAY
7920         if (global->p2p_init_wpa_s == NULL)
7921                 return NULL;
7922         if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0 ||
7923             os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0)
7924                 return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
7925                                                          buf, resp_len);
7926 #endif /* CONFIG_WIFI_DISPLAY */
7927         return NULL;
7928 }
7929
7930
7931 static char * wpas_global_ctrl_iface_redir(struct wpa_global *global,
7932                                            char *buf, size_t *resp_len)
7933 {
7934         char *ret;
7935
7936         ret = wpas_global_ctrl_iface_redir_p2p(global, buf, resp_len);
7937         if (ret)
7938                 return ret;
7939
7940         ret = wpas_global_ctrl_iface_redir_wfd(global, buf, resp_len);
7941         if (ret)
7942                 return ret;
7943
7944         return NULL;
7945 }
7946
7947
7948 static int wpas_global_ctrl_iface_set(struct wpa_global *global, char *cmd)
7949 {
7950         char *value;
7951
7952         value = os_strchr(cmd, ' ');
7953         if (value == NULL)
7954                 return -1;
7955         *value++ = '\0';
7956
7957         wpa_printf(MSG_DEBUG, "GLOBAL_CTRL_IFACE SET '%s'='%s'", cmd, value);
7958
7959 #ifdef CONFIG_WIFI_DISPLAY
7960         if (os_strcasecmp(cmd, "wifi_display") == 0) {
7961                 wifi_display_enable(global, !!atoi(value));
7962                 return 0;
7963         }
7964 #endif /* CONFIG_WIFI_DISPLAY */
7965
7966         /* Restore cmd to its original value to allow redirection */
7967         value[-1] = ' ';
7968
7969         return -1;
7970 }
7971
7972
7973 #ifndef CONFIG_NO_CONFIG_WRITE
7974 static int wpas_global_ctrl_iface_save_config(struct wpa_global *global)
7975 {
7976         int ret = 0, saved = 0;
7977         struct wpa_supplicant *wpa_s;
7978
7979         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
7980                 if (!wpa_s->conf->update_config) {
7981                         wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed to update configuration (update_config=0)");
7982                         continue;
7983                 }
7984
7985                 if (wpa_config_write(wpa_s->confname, wpa_s->conf)) {
7986                         wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to update configuration");
7987                         ret = 1;
7988                 } else {
7989                         wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration updated");
7990                         saved++;
7991                 }
7992         }
7993
7994         if (!saved && !ret) {
7995                 wpa_dbg(wpa_s, MSG_DEBUG,
7996                         "CTRL_IFACE: SAVE_CONFIG - No configuration files could be updated");
7997                 ret = 1;
7998         }
7999
8000         return ret;
8001 }
8002 #endif /* CONFIG_NO_CONFIG_WRITE */
8003
8004
8005 static int wpas_global_ctrl_iface_status(struct wpa_global *global,
8006                                          char *buf, size_t buflen)
8007 {
8008         char *pos, *end;
8009         int ret;
8010         struct wpa_supplicant *wpa_s;
8011
8012         pos = buf;
8013         end = buf + buflen;
8014
8015 #ifdef CONFIG_P2P
8016         if (global->p2p && !global->p2p_disabled) {
8017                 ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
8018                                   "\n"
8019                                   "p2p_state=%s\n",
8020                                   MAC2STR(global->p2p_dev_addr),
8021                                   p2p_get_state_txt(global->p2p));
8022                 if (os_snprintf_error(end - pos, ret))
8023                         return pos - buf;
8024                 pos += ret;
8025         } else if (global->p2p) {
8026                 ret = os_snprintf(pos, end - pos, "p2p_state=DISABLED\n");
8027                 if (os_snprintf_error(end - pos, ret))
8028                         return pos - buf;
8029                 pos += ret;
8030         }
8031 #endif /* CONFIG_P2P */
8032
8033 #ifdef CONFIG_WIFI_DISPLAY
8034         ret = os_snprintf(pos, end - pos, "wifi_display=%d\n",
8035                           !!global->wifi_display);
8036         if (os_snprintf_error(end - pos, ret))
8037                 return pos - buf;
8038         pos += ret;
8039 #endif /* CONFIG_WIFI_DISPLAY */
8040
8041         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
8042                 ret = os_snprintf(pos, end - pos, "ifname=%s\n"
8043                                   "address=" MACSTR "\n",
8044                                   wpa_s->ifname, MAC2STR(wpa_s->own_addr));
8045                 if (os_snprintf_error(end - pos, ret))
8046                         return pos - buf;
8047                 pos += ret;
8048         }
8049
8050         return pos - buf;
8051 }
8052
8053
8054 char * wpa_supplicant_global_ctrl_iface_process(struct wpa_global *global,
8055                                                 char *buf, size_t *resp_len)
8056 {
8057         char *reply;
8058         const int reply_size = 2048;
8059         int reply_len;
8060         int level = MSG_DEBUG;
8061
8062         if (os_strncmp(buf, "IFNAME=", 7) == 0) {
8063                 char *pos = os_strchr(buf + 7, ' ');
8064                 if (pos) {
8065                         *pos++ = '\0';
8066                         return wpas_global_ctrl_iface_ifname(global,
8067                                                              buf + 7, pos,
8068                                                              resp_len);
8069                 }
8070         }
8071
8072         reply = wpas_global_ctrl_iface_redir(global, buf, resp_len);
8073         if (reply)
8074                 return reply;
8075
8076         if (os_strcmp(buf, "PING") == 0)
8077                 level = MSG_EXCESSIVE;
8078         wpa_hexdump_ascii(level, "RX global ctrl_iface",
8079                           (const u8 *) buf, os_strlen(buf));
8080
8081         reply = os_malloc(reply_size);
8082         if (reply == NULL) {
8083                 *resp_len = 1;
8084                 return NULL;
8085         }
8086
8087         os_memcpy(reply, "OK\n", 3);
8088         reply_len = 3;
8089
8090         if (os_strcmp(buf, "PING") == 0) {
8091                 os_memcpy(reply, "PONG\n", 5);
8092                 reply_len = 5;
8093         } else if (os_strncmp(buf, "INTERFACE_ADD ", 14) == 0) {
8094                 if (wpa_supplicant_global_iface_add(global, buf + 14))
8095                         reply_len = -1;
8096         } else if (os_strncmp(buf, "INTERFACE_REMOVE ", 17) == 0) {
8097                 if (wpa_supplicant_global_iface_remove(global, buf + 17))
8098                         reply_len = -1;
8099         } else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
8100                 reply_len = wpa_supplicant_global_iface_list(
8101                         global, reply, reply_size);
8102         } else if (os_strcmp(buf, "INTERFACES") == 0) {
8103                 reply_len = wpa_supplicant_global_iface_interfaces(
8104                         global, reply, reply_size);
8105         } else if (os_strcmp(buf, "TERMINATE") == 0) {
8106                 wpa_supplicant_terminate_proc(global);
8107         } else if (os_strcmp(buf, "SUSPEND") == 0) {
8108                 wpas_notify_suspend(global);
8109         } else if (os_strcmp(buf, "RESUME") == 0) {
8110                 wpas_notify_resume(global);
8111         } else if (os_strncmp(buf, "SET ", 4) == 0) {
8112                 if (wpas_global_ctrl_iface_set(global, buf + 4)) {
8113 #ifdef CONFIG_P2P
8114                         if (global->p2p_init_wpa_s) {
8115                                 os_free(reply);
8116                                 /* Check if P2P redirection would work for this
8117                                  * command. */
8118                                 return wpa_supplicant_ctrl_iface_process(
8119                                         global->p2p_init_wpa_s,
8120                                         buf, resp_len);
8121                         }
8122 #endif /* CONFIG_P2P */
8123                         reply_len = -1;
8124                 }
8125 #ifndef CONFIG_NO_CONFIG_WRITE
8126         } else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
8127                 if (wpas_global_ctrl_iface_save_config(global))
8128                         reply_len = -1;
8129 #endif /* CONFIG_NO_CONFIG_WRITE */
8130         } else if (os_strcmp(buf, "STATUS") == 0) {
8131                 reply_len = wpas_global_ctrl_iface_status(global, reply,
8132                                                           reply_size);
8133 #ifdef CONFIG_MODULE_TESTS
8134         } else if (os_strcmp(buf, "MODULE_TESTS") == 0) {
8135                 int wpas_module_tests(void);
8136                 if (wpas_module_tests() < 0)
8137                         reply_len = -1;
8138 #endif /* CONFIG_MODULE_TESTS */
8139         } else if (os_strncmp(buf, "RELOG", 5) == 0) {
8140                 if (wpa_debug_reopen_file() < 0)
8141                         reply_len = -1;
8142         } else {
8143                 os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
8144                 reply_len = 16;
8145         }
8146
8147         if (reply_len < 0) {
8148                 os_memcpy(reply, "FAIL\n", 5);
8149                 reply_len = 5;
8150         }
8151
8152         *resp_len = reply_len;
8153         return reply;
8154 }