wpa_supplicant/ctrl_iface.c

   1 /*
   2  * WPA Supplicant / Control interface (shared code for all backends)
   3  * Copyright (c) 2004-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "utils/uuid.h"
  14 #include "common/version.h"
  15 #include "common/ieee802_11_defs.h"
  16 #include "common/ieee802_11_common.h"
  17 #include "common/wpa_ctrl.h"
  18 #include "eap_peer/eap.h"
  19 #include "eapol_supp/eapol_supp_sm.h"
  20 #include "rsn_supp/wpa.h"
  21 #include "rsn_supp/preauth.h"
  22 #include "rsn_supp/pmksa_cache.h"
  23 #include "l2_packet/l2_packet.h"
  24 #include "wps/wps.h"
  25 #include "config.h"
  26 #include "wpa_supplicant_i.h"
  27 #include "driver_i.h"
  28 #include "wps_supplicant.h"
  29 #include "ibss_rsn.h"
  30 #include "ap.h"
  31 #include "p2p_supplicant.h"
  32 #include "p2p/p2p.h"
  33 #include "hs20_supplicant.h"
  34 #include "wifi_display.h"
  35 #include "notify.h"
  36 #include "bss.h"
  37 #include "scan.h"
  38 #include "ctrl_iface.h"
  39 #include "interworking.h"
  40 #include "blacklist.h"
  41 #include "autoscan.h"
  42 #include "wnm_sta.h"
  43 #include "offchannel.h"
  44
  45 static int wpa_supplicant_global_iface_list(struct wpa_global *global,
  46                                             char *buf, int len);
  47 static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
  48                                                   char *buf, int len);
  49 static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s,
  50                                         char *val);
  51
  52 static int set_bssid_filter(struct wpa_supplicant *wpa_s, char *val)
  53 {
  54         char *pos;
  55         u8 addr[ETH_ALEN], *filter = NULL, *n;
  56         size_t count = 0;
  57
  58         pos = val;
  59         while (pos) {
  60                 if (*pos == '\0')
  61                         break;
  62                 if (hwaddr_aton(pos, addr)) {
  63                         os_free(filter);
  64                         return -1;
  65                 }
  66                 n = os_realloc_array(filter, count + 1, ETH_ALEN);
  67                 if (n == NULL) {
  68                         os_free(filter);
  69                         return -1;
  70                 }
  71                 filter = n;
  72                 os_memcpy(filter + count * ETH_ALEN, addr, ETH_ALEN);
  73                 count++;
  74
  75                 pos = os_strchr(pos, ' ');
  76                 if (pos)
  77                         pos++;
  78         }
  79
  80         wpa_hexdump(MSG_DEBUG, "bssid_filter", filter, count * ETH_ALEN);
  81         os_free(wpa_s->bssid_filter);
  82         wpa_s->bssid_filter = filter;
  83         wpa_s->bssid_filter_count = count;
  84
  85         return 0;
  86 }
  87
  88
  89 static int set_disallow_aps(struct wpa_supplicant *wpa_s, char *val)
  90 {
  91         char *pos;
  92         u8 addr[ETH_ALEN], *bssid = NULL, *n;
  93         struct wpa_ssid_value *ssid = NULL, *ns;
  94         size_t count = 0, ssid_count = 0;
  95         struct wpa_ssid *c;
  96
  97         /*
  98          * disallow_list ::= <ssid_spec> | <bssid_spec> | <disallow_list> | ""
  99          * SSID_SPEC ::= ssid <SSID_HEX>
 100          * BSSID_SPEC ::= bssid <BSSID_HEX>
 101          */
 102
 103         pos = val;
 104         while (pos) {
 105                 if (*pos == '\0')
 106                         break;
 107                 if (os_strncmp(pos, "bssid ", 6) == 0) {
 108                         int res;
 109                         pos += 6;
 110                         res = hwaddr_aton2(pos, addr);
 111                         if (res < 0) {
 112                                 os_free(ssid);
 113                                 os_free(bssid);
 114                                 wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
 115                                            "BSSID value '%s'", pos);
 116                                 return -1;
 117                         }
 118                         pos += res;
 119                         n = os_realloc_array(bssid, count + 1, ETH_ALEN);
 120                         if (n == NULL) {
 121                                 os_free(ssid);
 122                                 os_free(bssid);
 123                                 return -1;
 124                         }
 125                         bssid = n;
 126                         os_memcpy(bssid + count * ETH_ALEN, addr, ETH_ALEN);
 127                         count++;
 128                 } else if (os_strncmp(pos, "ssid ", 5) == 0) {
 129                         char *end;
 130                         pos += 5;
 131
 132                         end = pos;
 133                         while (*end) {
 134                                 if (*end == '\0' || *end == ' ')
 135                                         break;
 136                                 end++;
 137                         }
 138
 139                         ns = os_realloc_array(ssid, ssid_count + 1,
 140                                               sizeof(struct wpa_ssid_value));
 141                         if (ns == NULL) {
 142                                 os_free(ssid);
 143                                 os_free(bssid);
 144                                 return -1;
 145                         }
 146                         ssid = ns;
 147
 148                         if ((end - pos) & 0x01 || end - pos > 2 * 32 ||
 149                             hexstr2bin(pos, ssid[ssid_count].ssid,
 150                                        (end - pos) / 2) < 0) {
 151                                 os_free(ssid);
 152                                 os_free(bssid);
 153                                 wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
 154                                            "SSID value '%s'", pos);
 155                                 return -1;
 156                         }
 157                         ssid[ssid_count].ssid_len = (end - pos) / 2;
 158                         wpa_hexdump_ascii(MSG_DEBUG, "disallow_aps SSID",
 159                                           ssid[ssid_count].ssid,
 160                                           ssid[ssid_count].ssid_len);
 161                         ssid_count++;
 162                         pos = end;
 163                 } else {
 164                         wpa_printf(MSG_DEBUG, "Unexpected disallow_aps value "
 165                                    "'%s'", pos);
 166                         os_free(ssid);
 167                         os_free(bssid);
 168                         return -1;
 169                 }
 170
 171                 pos = os_strchr(pos, ' ');
 172                 if (pos)
 173                         pos++;
 174         }
 175
 176         wpa_hexdump(MSG_DEBUG, "disallow_aps_bssid", bssid, count * ETH_ALEN);
 177         os_free(wpa_s->disallow_aps_bssid);
 178         wpa_s->disallow_aps_bssid = bssid;
 179         wpa_s->disallow_aps_bssid_count = count;
 180
 181         wpa_printf(MSG_DEBUG, "disallow_aps_ssid_count %d", (int) ssid_count);
 182         os_free(wpa_s->disallow_aps_ssid);
 183         wpa_s->disallow_aps_ssid = ssid;
 184         wpa_s->disallow_aps_ssid_count = ssid_count;
 185
 186         if (!wpa_s->current_ssid || wpa_s->wpa_state < WPA_AUTHENTICATING)
 187                 return 0;
 188
 189         c = wpa_s->current_ssid;
 190         if (c->mode != WPAS_MODE_INFRA && c->mode != WPAS_MODE_IBSS)
 191                 return 0;
 192
 193         if (!disallowed_bssid(wpa_s, wpa_s->bssid) &&
 194             !disallowed_ssid(wpa_s, c->ssid, c->ssid_len))
 195                 return 0;
 196
 197         wpa_printf(MSG_DEBUG, "Disconnect and try to find another network "
 198                    "because current AP was marked disallowed");
 199
 200 #ifdef CONFIG_SME
 201         wpa_s->sme.prev_bssid_set = 0;
 202 #endif /* CONFIG_SME */
 203         wpa_s->reassociate = 1;
 204         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 205         wpa_supplicant_req_scan(wpa_s, 0, 0);
 206
 207         return 0;
 208 }
 209
 210
 211 #ifndef CONFIG_NO_CONFIG_BLOBS
 212 static int wpas_ctrl_set_blob(struct wpa_supplicant *wpa_s, char *pos)
 213 {
 214         char *name = pos;
 215         struct wpa_config_blob *blob;
 216         size_t len;
 217
 218         pos = os_strchr(pos, ' ');
 219         if (pos == NULL)
 220                 return -1;
 221         *pos++ = '\0';
 222         len = os_strlen(pos);
 223         if (len & 1)
 224                 return -1;
 225
 226         wpa_printf(MSG_DEBUG, "CTRL: Set blob '%s'", name);
 227         blob = os_zalloc(sizeof(*blob));
 228         if (blob == NULL)
 229                 return -1;
 230         blob->name = os_strdup(name);
 231         blob->data = os_malloc(len / 2);
 232         if (blob->name == NULL || blob->data == NULL) {
 233                 wpa_config_free_blob(blob);
 234                 return -1;
 235         }
 236
 237         if (hexstr2bin(pos, blob->data, len / 2) < 0) {
 238                 wpa_printf(MSG_DEBUG, "CTRL: Invalid blob hex data");
 239                 wpa_config_free_blob(blob);
 240                 return -1;
 241         }
 242         blob->len = len / 2;
 243
 244         wpa_config_set_blob(wpa_s->conf, blob);
 245
 246         return 0;
 247 }
 248 #endif /* CONFIG_NO_CONFIG_BLOBS */
 249
 250
 251 static int wpas_ctrl_pno(struct wpa_supplicant *wpa_s, char *cmd)
 252 {
 253         char *params;
 254         char *pos;
 255         int *freqs = NULL;
 256         int ret;
 257
 258         if (atoi(cmd)) {
 259                 params = os_strchr(cmd, ' ');
 260                 os_free(wpa_s->manual_sched_scan_freqs);
 261                 if (params) {
 262                         params++;
 263                         pos = os_strstr(params, "freq=");
 264                         if (pos)
 265                                 freqs = freq_range_to_channel_list(wpa_s,
 266                                                                    pos + 5);
 267                 }
 268                 wpa_s->manual_sched_scan_freqs = freqs;
 269                 ret = wpas_start_pno(wpa_s);
 270         } else {
 271                 ret = wpas_stop_pno(wpa_s);
 272         }
 273         return ret;
 274 }
 275
 276
 277 static int wpa_supplicant_ctrl_iface_set(struct wpa_supplicant *wpa_s,
 278                                          char *cmd)
 279 {
 280         char *value;
 281         int ret = 0;
 282
 283         value = os_strchr(cmd, ' ');
 284         if (value == NULL)
 285                 return -1;
 286         *value++ = '\0';
 287
 288         wpa_printf(MSG_DEBUG, "CTRL_IFACE SET '%s'='%s'", cmd, value);
 289         if (os_strcasecmp(cmd, "EAPOL::heldPeriod") == 0) {
 290                 eapol_sm_configure(wpa_s->eapol,
 291                                    atoi(value), -1, -1, -1);
 292         } else if (os_strcasecmp(cmd, "EAPOL::authPeriod") == 0) {
 293                 eapol_sm_configure(wpa_s->eapol,
 294                                    -1, atoi(value), -1, -1);
 295         } else if (os_strcasecmp(cmd, "EAPOL::startPeriod") == 0) {
 296                 eapol_sm_configure(wpa_s->eapol,
 297                                    -1, -1, atoi(value), -1);
 298         } else if (os_strcasecmp(cmd, "EAPOL::maxStart") == 0) {
 299                 eapol_sm_configure(wpa_s->eapol,
 300                                    -1, -1, -1, atoi(value));
 301         } else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKLifetime") == 0) {
 302                 if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
 303                                      atoi(value)))
 304                         ret = -1;
 305         } else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKReauthThreshold") ==
 306                    0) {
 307                 if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
 308                                      atoi(value)))
 309                         ret = -1;
 310         } else if (os_strcasecmp(cmd, "dot11RSNAConfigSATimeout") == 0) {
 311                 if (wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT, atoi(value)))
 312                         ret = -1;
 313         } else if (os_strcasecmp(cmd, "wps_fragment_size") == 0) {
 314                 wpa_s->wps_fragment_size = atoi(value);
 315 #ifdef CONFIG_WPS_TESTING
 316         } else if (os_strcasecmp(cmd, "wps_version_number") == 0) {
 317                 long int val;
 318                 val = strtol(value, NULL, 0);
 319                 if (val < 0 || val > 0xff) {
 320                         ret = -1;
 321                         wpa_printf(MSG_DEBUG, "WPS: Invalid "
 322                                    "wps_version_number %ld", val);
 323                 } else {
 324                         wps_version_number = val;
 325                         wpa_printf(MSG_DEBUG, "WPS: Testing - force WPS "
 326                                    "version %u.%u",
 327                                    (wps_version_number & 0xf0) >> 4,
 328                                    wps_version_number & 0x0f);
 329                 }
 330         } else if (os_strcasecmp(cmd, "wps_testing_dummy_cred") == 0) {
 331                 wps_testing_dummy_cred = atoi(value);
 332                 wpa_printf(MSG_DEBUG, "WPS: Testing - dummy_cred=%d",
 333                            wps_testing_dummy_cred);
 334         } else if (os_strcasecmp(cmd, "wps_corrupt_pkhash") == 0) {
 335                 wps_corrupt_pkhash = atoi(value);
 336                 wpa_printf(MSG_DEBUG, "WPS: Testing - wps_corrupt_pkhash=%d",
 337                            wps_corrupt_pkhash);
 338 #endif /* CONFIG_WPS_TESTING */
 339         } else if (os_strcasecmp(cmd, "ampdu") == 0) {
 340                 if (wpa_drv_ampdu(wpa_s, atoi(value)) < 0)
 341                         ret = -1;
 342 #ifdef CONFIG_TDLS
 343 #ifdef CONFIG_TDLS_TESTING
 344         } else if (os_strcasecmp(cmd, "tdls_testing") == 0) {
 345                 extern unsigned int tdls_testing;
 346                 tdls_testing = strtol(value, NULL, 0);
 347                 wpa_printf(MSG_DEBUG, "TDLS: tdls_testing=0x%x", tdls_testing);
 348 #endif /* CONFIG_TDLS_TESTING */
 349         } else if (os_strcasecmp(cmd, "tdls_disabled") == 0) {
 350                 int disabled = atoi(value);
 351                 wpa_printf(MSG_DEBUG, "TDLS: tdls_disabled=%d", disabled);
 352                 if (disabled) {
 353                         if (wpa_drv_tdls_oper(wpa_s, TDLS_DISABLE, NULL) < 0)
 354                                 ret = -1;
 355                 } else if (wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL) < 0)
 356                         ret = -1;
 357                 wpa_tdls_enable(wpa_s->wpa, !disabled);
 358 #endif /* CONFIG_TDLS */
 359         } else if (os_strcasecmp(cmd, "pno") == 0) {
 360                 ret = wpas_ctrl_pno(wpa_s, value);
 361         } else if (os_strcasecmp(cmd, "radio_disabled") == 0) {
 362                 int disabled = atoi(value);
 363                 if (wpa_drv_radio_disable(wpa_s, disabled) < 0)
 364                         ret = -1;
 365                 else if (disabled)
 366                         wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
 367         } else if (os_strcasecmp(cmd, "uapsd") == 0) {
 368                 if (os_strcmp(value, "disable") == 0)
 369                         wpa_s->set_sta_uapsd = 0;
 370                 else {
 371                         int be, bk, vi, vo;
 372                         char *pos;
 373                         /* format: BE,BK,VI,VO;max SP Length */
 374                         be = atoi(value);
 375                         pos = os_strchr(value, ',');
 376                         if (pos == NULL)
 377                                 return -1;
 378                         pos++;
 379                         bk = atoi(pos);
 380                         pos = os_strchr(pos, ',');
 381                         if (pos == NULL)
 382                                 return -1;
 383                         pos++;
 384                         vi = atoi(pos);
 385                         pos = os_strchr(pos, ',');
 386                         if (pos == NULL)
 387                                 return -1;
 388                         pos++;
 389                         vo = atoi(pos);
 390                         /* ignore max SP Length for now */
 391
 392                         wpa_s->set_sta_uapsd = 1;
 393                         wpa_s->sta_uapsd = 0;
 394                         if (be)
 395                                 wpa_s->sta_uapsd |= BIT(0);
 396                         if (bk)
 397                                 wpa_s->sta_uapsd |= BIT(1);
 398                         if (vi)
 399                                 wpa_s->sta_uapsd |= BIT(2);
 400                         if (vo)
 401                                 wpa_s->sta_uapsd |= BIT(3);
 402                 }
 403         } else if (os_strcasecmp(cmd, "ps") == 0) {
 404                 ret = wpa_drv_set_p2p_powersave(wpa_s, atoi(value), -1, -1);
 405 #ifdef CONFIG_WIFI_DISPLAY
 406         } else if (os_strcasecmp(cmd, "wifi_display") == 0) {
 407                 int enabled = !!atoi(value);
 408                 if (enabled && !wpa_s->global->p2p)
 409                         ret = -1;
 410                 else
 411                         wifi_display_enable(wpa_s->global, enabled);
 412 #endif /* CONFIG_WIFI_DISPLAY */
 413         } else if (os_strcasecmp(cmd, "bssid_filter") == 0) {
 414                 ret = set_bssid_filter(wpa_s, value);
 415         } else if (os_strcasecmp(cmd, "disallow_aps") == 0) {
 416                 ret = set_disallow_aps(wpa_s, value);
 417         } else if (os_strcasecmp(cmd, "no_keep_alive") == 0) {
 418                 wpa_s->no_keep_alive = !!atoi(value);
 419 #ifdef CONFIG_TESTING_OPTIONS
 420         } else if (os_strcasecmp(cmd, "ext_mgmt_frame_handling") == 0) {
 421                 wpa_s->ext_mgmt_frame_handling = !!atoi(value);
 422 #endif /* CONFIG_TESTING_OPTIONS */
 423 #ifndef CONFIG_NO_CONFIG_BLOBS
 424         } else if (os_strcmp(cmd, "blob") == 0) {
 425                 ret = wpas_ctrl_set_blob(wpa_s, value);
 426 #endif /* CONFIG_NO_CONFIG_BLOBS */
 427         } else {
 428                 value[-1] = '=';
 429                 ret = wpa_config_process_global(wpa_s->conf, cmd, -1);
 430                 if (ret == 0)
 431                         wpa_supplicant_update_config(wpa_s);
 432         }
 433
 434         return ret;
 435 }
 436
 437
 438 static int wpa_supplicant_ctrl_iface_get(struct wpa_supplicant *wpa_s,
 439                                          char *cmd, char *buf, size_t buflen)
 440 {
 441         int res = -1;
 442
 443         wpa_printf(MSG_DEBUG, "CTRL_IFACE GET '%s'", cmd);
 444
 445         if (os_strcmp(cmd, "version") == 0) {
 446                 res = os_snprintf(buf, buflen, "%s", VERSION_STR);
 447         } else if (os_strcasecmp(cmd, "country") == 0) {
 448                 if (wpa_s->conf->country[0] && wpa_s->conf->country[1])
 449                         res = os_snprintf(buf, buflen, "%c%c",
 450                                           wpa_s->conf->country[0],
 451                                           wpa_s->conf->country[1]);
 452 #ifdef CONFIG_WIFI_DISPLAY
 453         } else if (os_strcasecmp(cmd, "wifi_display") == 0) {
 454                 int enabled;
 455                 if (wpa_s->global->p2p == NULL ||
 456                     wpa_s->global->p2p_disabled)
 457                         enabled = 0;
 458                 else
 459                         enabled = wpa_s->global->wifi_display;
 460                 res = os_snprintf(buf, buflen, "%d", enabled);
 461                 if (res < 0 || (unsigned int) res >= buflen)
 462                         return -1;
 463                 return res;
 464 #endif /* CONFIG_WIFI_DISPLAY */
 465 #ifdef CONFIG_TESTING_GET_GTK
 466         } else if (os_strcmp(cmd, "gtk") == 0) {
 467                 if (wpa_s->last_gtk_len == 0)
 468                         return -1;
 469                 res = wpa_snprintf_hex(buf, buflen, wpa_s->last_gtk,
 470                                        wpa_s->last_gtk_len);
 471                 return res;
 472 #endif /* CONFIG_TESTING_GET_GTK */
 473         }
 474
 475         if (res < 0 || (unsigned int) res >= buflen)
 476                 return -1;
 477         return res;
 478 }
 479
 480
 481 #ifdef IEEE8021X_EAPOL
 482 static int wpa_supplicant_ctrl_iface_preauth(struct wpa_supplicant *wpa_s,
 483                                              char *addr)
 484 {
 485         u8 bssid[ETH_ALEN];
 486         struct wpa_ssid *ssid = wpa_s->current_ssid;
 487
 488         if (hwaddr_aton(addr, bssid)) {
 489                 wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH: invalid address "
 490                            "'%s'", addr);
 491                 return -1;
 492         }
 493
 494         wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH " MACSTR, MAC2STR(bssid));
 495         rsn_preauth_deinit(wpa_s->wpa);
 496         if (rsn_preauth_init(wpa_s->wpa, bssid, ssid ? &ssid->eap : NULL))
 497                 return -1;
 498
 499         return 0;
 500 }
 501 #endif /* IEEE8021X_EAPOL */
 502
 503
 504 #ifdef CONFIG_PEERKEY
 505 /* MLME-STKSTART.request(peer) */
 506 static int wpa_supplicant_ctrl_iface_stkstart(
 507         struct wpa_supplicant *wpa_s, char *addr)
 508 {
 509         u8 peer[ETH_ALEN];
 510
 511         if (hwaddr_aton(addr, peer)) {
 512                 wpa_printf(MSG_DEBUG, "CTRL_IFACE STKSTART: invalid "
 513                            "address '%s'", addr);
 514                 return -1;
 515         }
 516
 517         wpa_printf(MSG_DEBUG, "CTRL_IFACE STKSTART " MACSTR,
 518                    MAC2STR(peer));
 519
 520         return wpa_sm_stkstart(wpa_s->wpa, peer);
 521 }
 522 #endif /* CONFIG_PEERKEY */
 523
 524
 525 #ifdef CONFIG_TDLS
 526
 527 static int wpa_supplicant_ctrl_iface_tdls_discover(
 528         struct wpa_supplicant *wpa_s, char *addr)
 529 {
 530         u8 peer[ETH_ALEN];
 531         int ret;
 532
 533         if (hwaddr_aton(addr, peer)) {
 534                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER: invalid "
 535                            "address '%s'", addr);
 536                 return -1;
 537         }
 538
 539         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER " MACSTR,
 540                    MAC2STR(peer));
 541
 542         if (wpa_tdls_is_external_setup(wpa_s->wpa))
 543                 ret = wpa_tdls_send_discovery_request(wpa_s->wpa, peer);
 544         else
 545                 ret = wpa_drv_tdls_oper(wpa_s, TDLS_DISCOVERY_REQ, peer);
 546
 547         return ret;
 548 }
 549
 550
 551 static int wpa_supplicant_ctrl_iface_tdls_setup(
 552         struct wpa_supplicant *wpa_s, char *addr)
 553 {
 554         u8 peer[ETH_ALEN];
 555         int ret;
 556
 557         if (hwaddr_aton(addr, peer)) {
 558                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP: invalid "
 559                            "address '%s'", addr);
 560                 return -1;
 561         }
 562
 563         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP " MACSTR,
 564                    MAC2STR(peer));
 565
 566         if ((wpa_s->conf->tdls_external_control) &&
 567             wpa_tdls_is_external_setup(wpa_s->wpa))
 568                 return wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
 569
 570         wpa_tdls_remove(wpa_s->wpa, peer);
 571
 572         if (wpa_tdls_is_external_setup(wpa_s->wpa))
 573                 ret = wpa_tdls_start(wpa_s->wpa, peer);
 574         else
 575                 ret = wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
 576
 577         return ret;
 578 }
 579
 580
 581 static int wpa_supplicant_ctrl_iface_tdls_teardown(
 582         struct wpa_supplicant *wpa_s, char *addr)
 583 {
 584         u8 peer[ETH_ALEN];
 585         int ret;
 586
 587         if (hwaddr_aton(addr, peer)) {
 588                 wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN: invalid "
 589                            "address '%s'", addr);
 590                 return -1;
 591         }
 592
 593         wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN " MACSTR,
 594                    MAC2STR(peer));
 595
 596         if ((wpa_s->conf->tdls_external_control) &&
 597             wpa_tdls_is_external_setup(wpa_s->wpa))
 598                 return wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
 599
 600         if (wpa_tdls_is_external_setup(wpa_s->wpa))
 601                 ret = wpa_tdls_teardown_link(
 602                         wpa_s->wpa, peer,
 603                         WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
 604         else
 605                 ret = wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
 606
 607         return ret;
 608 }
 609
 610
 611 static int ctrl_iface_get_capability_tdls(
 612         struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
 613 {
 614         int ret;
 615
 616         ret = os_snprintf(buf, buflen, "%s\n",
 617                           wpa_s->drv_flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT ?
 618                           (wpa_s->drv_flags &
 619                            WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP ?
 620                            "EXTERNAL" : "INTERNAL") : "UNSUPPORTED");
 621         if (ret < 0 || (size_t) ret > buflen)
 622                 return -1;
 623         return ret;
 624 }
 625
 626 #endif /* CONFIG_TDLS */
 627
 628
 629 #ifdef CONFIG_IEEE80211R
 630 static int wpa_supplicant_ctrl_iface_ft_ds(
 631         struct wpa_supplicant *wpa_s, char *addr)
 632 {
 633         u8 target_ap[ETH_ALEN];
 634         struct wpa_bss *bss;
 635         const u8 *mdie;
 636
 637         if (hwaddr_aton(addr, target_ap)) {
 638                 wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS: invalid "
 639                            "address '%s'", addr);
 640                 return -1;
 641         }
 642
 643         wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS " MACSTR, MAC2STR(target_ap));
 644
 645         bss = wpa_bss_get_bssid(wpa_s, target_ap);
 646         if (bss)
 647                 mdie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
 648         else
 649                 mdie = NULL;
 650
 651         return wpa_ft_start_over_ds(wpa_s->wpa, target_ap, mdie);
 652 }
 653 #endif /* CONFIG_IEEE80211R */
 654
 655
 656 #ifdef CONFIG_WPS
 657 static int wpa_supplicant_ctrl_iface_wps_pbc(struct wpa_supplicant *wpa_s,
 658                                              char *cmd)
 659 {
 660         u8 bssid[ETH_ALEN], *_bssid = bssid;
 661 #ifdef CONFIG_P2P
 662         u8 p2p_dev_addr[ETH_ALEN];
 663 #endif /* CONFIG_P2P */
 664 #ifdef CONFIG_AP
 665         u8 *_p2p_dev_addr = NULL;
 666 #endif /* CONFIG_AP */
 667
 668         if (cmd == NULL || os_strcmp(cmd, "any") == 0) {
 669                 _bssid = NULL;
 670 #ifdef CONFIG_P2P
 671         } else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
 672                 if (hwaddr_aton(cmd + 13, p2p_dev_addr)) {
 673                         wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid "
 674                                    "P2P Device Address '%s'",
 675                                    cmd + 13);
 676                         return -1;
 677                 }
 678                 _p2p_dev_addr = p2p_dev_addr;
 679 #endif /* CONFIG_P2P */
 680         } else if (hwaddr_aton(cmd, bssid)) {
 681                 wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid BSSID '%s'",
 682                            cmd);
 683                 return -1;
 684         }
 685
 686 #ifdef CONFIG_AP
 687         if (wpa_s->ap_iface)
 688                 return wpa_supplicant_ap_wps_pbc(wpa_s, _bssid, _p2p_dev_addr);
 689 #endif /* CONFIG_AP */
 690
 691         return wpas_wps_start_pbc(wpa_s, _bssid, 0);
 692 }
 693
 694
 695 static int wpa_supplicant_ctrl_iface_wps_pin(struct wpa_supplicant *wpa_s,
 696                                              char *cmd, char *buf,
 697                                              size_t buflen)
 698 {
 699         u8 bssid[ETH_ALEN], *_bssid = bssid;
 700         char *pin;
 701         int ret;
 702
 703         pin = os_strchr(cmd, ' ');
 704         if (pin)
 705                 *pin++ = '\0';
 706
 707         if (os_strcmp(cmd, "any") == 0)
 708                 _bssid = NULL;
 709         else if (os_strcmp(cmd, "get") == 0) {
 710                 ret = wps_generate_pin();
 711                 goto done;
 712         } else if (hwaddr_aton(cmd, bssid)) {
 713                 wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PIN: invalid BSSID '%s'",
 714                            cmd);
 715                 return -1;
 716         }
 717
 718 #ifdef CONFIG_AP
 719         if (wpa_s->ap_iface) {
 720                 int timeout = 0;
 721                 char *pos;
 722
 723                 if (pin) {
 724                         pos = os_strchr(pin, ' ');
 725                         if (pos) {
 726                                 *pos++ = '\0';
 727                                 timeout = atoi(pos);
 728                         }
 729                 }
 730
 731                 return wpa_supplicant_ap_wps_pin(wpa_s, _bssid, pin,
 732                                                  buf, buflen, timeout);
 733         }
 734 #endif /* CONFIG_AP */
 735
 736         if (pin) {
 737                 ret = wpas_wps_start_pin(wpa_s, _bssid, pin, 0,
 738                                          DEV_PW_DEFAULT);
 739                 if (ret < 0)
 740                         return -1;
 741                 ret = os_snprintf(buf, buflen, "%s", pin);
 742                 if (ret < 0 || (size_t) ret >= buflen)
 743                         return -1;
 744                 return ret;
 745         }
 746
 747         ret = wpas_wps_start_pin(wpa_s, _bssid, NULL, 0, DEV_PW_DEFAULT);
 748         if (ret < 0)
 749                 return -1;
 750
 751 done:
 752         /* Return the generated PIN */
 753         ret = os_snprintf(buf, buflen, "%08d", ret);
 754         if (ret < 0 || (size_t) ret >= buflen)
 755                 return -1;
 756         return ret;
 757 }
 758
 759
 760 static int wpa_supplicant_ctrl_iface_wps_check_pin(
 761         struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
 762 {
 763         char pin[9];
 764         size_t len;
 765         char *pos;
 766         int ret;
 767
 768         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS_CHECK_PIN",
 769                               (u8 *) cmd, os_strlen(cmd));
 770         for (pos = cmd, len = 0; *pos != '\0'; pos++) {
 771                 if (*pos < '0' || *pos > '9')
 772                         continue;
 773                 pin[len++] = *pos;
 774                 if (len == 9) {
 775                         wpa_printf(MSG_DEBUG, "WPS: Too long PIN");
 776                         return -1;
 777                 }
 778         }
 779         if (len != 4 && len != 8) {
 780                 wpa_printf(MSG_DEBUG, "WPS: Invalid PIN length %d", (int) len);
 781                 return -1;
 782         }
 783         pin[len] = '\0';
 784
 785         if (len == 8) {
 786                 unsigned int pin_val;
 787                 pin_val = atoi(pin);
 788                 if (!wps_pin_valid(pin_val)) {
 789                         wpa_printf(MSG_DEBUG, "WPS: Invalid checksum digit");
 790                         ret = os_snprintf(buf, buflen, "FAIL-CHECKSUM\n");
 791                         if (ret < 0 || (size_t) ret >= buflen)
 792                                 return -1;
 793                         return ret;
 794                 }
 795         }
 796
 797         ret = os_snprintf(buf, buflen, "%s", pin);
 798         if (ret < 0 || (size_t) ret >= buflen)
 799                 return -1;
 800
 801         return ret;
 802 }
 803
 804
 805 #ifdef CONFIG_WPS_NFC
 806
 807 static int wpa_supplicant_ctrl_iface_wps_nfc(struct wpa_supplicant *wpa_s,
 808                                              char *cmd)
 809 {
 810         u8 bssid[ETH_ALEN], *_bssid = bssid;
 811
 812         if (cmd == NULL || cmd[0] == '\0')
 813                 _bssid = NULL;
 814         else if (hwaddr_aton(cmd, bssid))
 815                 return -1;
 816
 817         return wpas_wps_start_nfc(wpa_s, NULL, _bssid, NULL, 0, 0, NULL, NULL,
 818                                   0, 0);
 819 }
 820
 821
 822 static int wpa_supplicant_ctrl_iface_wps_nfc_config_token(
 823         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
 824 {
 825         int ndef;
 826         struct wpabuf *buf;
 827         int res;
 828         char *pos;
 829
 830         pos = os_strchr(cmd, ' ');
 831         if (pos)
 832                 *pos++ = '\0';
 833         if (os_strcmp(cmd, "WPS") == 0)
 834                 ndef = 0;
 835         else if (os_strcmp(cmd, "NDEF") == 0)
 836                 ndef = 1;
 837         else
 838                 return -1;
 839
 840         buf = wpas_wps_nfc_config_token(wpa_s, ndef, pos);
 841         if (buf == NULL)
 842                 return -1;
 843
 844         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
 845                                          wpabuf_len(buf));
 846         reply[res++] = '\n';
 847         reply[res] = '\0';
 848
 849         wpabuf_free(buf);
 850
 851         return res;
 852 }
 853
 854
 855 static int wpa_supplicant_ctrl_iface_wps_nfc_token(
 856         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
 857 {
 858         int ndef;
 859         struct wpabuf *buf;
 860         int res;
 861
 862         if (os_strcmp(cmd, "WPS") == 0)
 863                 ndef = 0;
 864         else if (os_strcmp(cmd, "NDEF") == 0)
 865                 ndef = 1;
 866         else
 867                 return -1;
 868
 869         buf = wpas_wps_nfc_token(wpa_s, ndef);
 870         if (buf == NULL)
 871                 return -1;
 872
 873         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
 874                                          wpabuf_len(buf));
 875         reply[res++] = '\n';
 876         reply[res] = '\0';
 877
 878         wpabuf_free(buf);
 879
 880         return res;
 881 }
 882
 883
 884 static int wpa_supplicant_ctrl_iface_wps_nfc_tag_read(
 885         struct wpa_supplicant *wpa_s, char *pos)
 886 {
 887         size_t len;
 888         struct wpabuf *buf;
 889         int ret;
 890         char *freq;
 891         int forced_freq = 0;
 892
 893         freq = strstr(pos, " freq=");
 894         if (freq) {
 895                 *freq = '\0';
 896                 freq += 6;
 897                 forced_freq = atoi(freq);
 898         }
 899
 900         len = os_strlen(pos);
 901         if (len & 0x01)
 902                 return -1;
 903         len /= 2;
 904
 905         buf = wpabuf_alloc(len);
 906         if (buf == NULL)
 907                 return -1;
 908         if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
 909                 wpabuf_free(buf);
 910                 return -1;
 911         }
 912
 913         ret = wpas_wps_nfc_tag_read(wpa_s, buf, forced_freq);
 914         wpabuf_free(buf);
 915
 916         return ret;
 917 }
 918
 919
 920 static int wpas_ctrl_nfc_get_handover_req_wps(struct wpa_supplicant *wpa_s,
 921                                               char *reply, size_t max_len,
 922                                               int ndef)
 923 {
 924         struct wpabuf *buf;
 925         int res;
 926
 927         buf = wpas_wps_nfc_handover_req(wpa_s, ndef);
 928         if (buf == NULL)
 929                 return -1;
 930
 931         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
 932                                          wpabuf_len(buf));
 933         reply[res++] = '\n';
 934         reply[res] = '\0';
 935
 936         wpabuf_free(buf);
 937
 938         return res;
 939 }
 940
 941
 942 #ifdef CONFIG_P2P
 943 static int wpas_ctrl_nfc_get_handover_req_p2p(struct wpa_supplicant *wpa_s,
 944                                               char *reply, size_t max_len,
 945                                               int ndef)
 946 {
 947         struct wpabuf *buf;
 948         int res;
 949
 950         buf = wpas_p2p_nfc_handover_req(wpa_s, ndef);
 951         if (buf == NULL) {
 952                 wpa_printf(MSG_DEBUG, "P2P: Could not generate NFC handover request");
 953                 return -1;
 954         }
 955
 956         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
 957                                          wpabuf_len(buf));
 958         reply[res++] = '\n';
 959         reply[res] = '\0';
 960
 961         wpabuf_free(buf);
 962
 963         return res;
 964 }
 965 #endif /* CONFIG_P2P */
 966
 967
 968 static int wpas_ctrl_nfc_get_handover_req(struct wpa_supplicant *wpa_s,
 969                                           char *cmd, char *reply,
 970                                           size_t max_len)
 971 {
 972         char *pos;
 973         int ndef;
 974
 975         pos = os_strchr(cmd, ' ');
 976         if (pos == NULL)
 977                 return -1;
 978         *pos++ = '\0';
 979
 980         if (os_strcmp(cmd, "WPS") == 0)
 981                 ndef = 0;
 982         else if (os_strcmp(cmd, "NDEF") == 0)
 983                 ndef = 1;
 984         else
 985                 return -1;
 986
 987         if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
 988                 if (!ndef)
 989                         return -1;
 990                 return wpas_ctrl_nfc_get_handover_req_wps(
 991                         wpa_s, reply, max_len, ndef);
 992         }
 993
 994 #ifdef CONFIG_P2P
 995         if (os_strcmp(pos, "P2P-CR") == 0) {
 996                 return wpas_ctrl_nfc_get_handover_req_p2p(
 997                         wpa_s, reply, max_len, ndef);
 998         }
 999 #endif /* CONFIG_P2P */
1000
1001         return -1;
1002 }
1003
1004
1005 static int wpas_ctrl_nfc_get_handover_sel_wps(struct wpa_supplicant *wpa_s,
1006                                               char *reply, size_t max_len,
1007                                               int ndef, int cr, char *uuid)
1008 {
1009         struct wpabuf *buf;
1010         int res;
1011
1012         buf = wpas_wps_nfc_handover_sel(wpa_s, ndef, cr, uuid);
1013         if (buf == NULL)
1014                 return -1;
1015
1016         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1017                                          wpabuf_len(buf));
1018         reply[res++] = '\n';
1019         reply[res] = '\0';
1020
1021         wpabuf_free(buf);
1022
1023         return res;
1024 }
1025
1026
1027 #ifdef CONFIG_P2P
1028 static int wpas_ctrl_nfc_get_handover_sel_p2p(struct wpa_supplicant *wpa_s,
1029                                               char *reply, size_t max_len,
1030                                               int ndef, int tag)
1031 {
1032         struct wpabuf *buf;
1033         int res;
1034
1035         buf = wpas_p2p_nfc_handover_sel(wpa_s, ndef, tag);
1036         if (buf == NULL)
1037                 return -1;
1038
1039         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1040                                          wpabuf_len(buf));
1041         reply[res++] = '\n';
1042         reply[res] = '\0';
1043
1044         wpabuf_free(buf);
1045
1046         return res;
1047 }
1048 #endif /* CONFIG_P2P */
1049
1050
1051 static int wpas_ctrl_nfc_get_handover_sel(struct wpa_supplicant *wpa_s,
1052                                           char *cmd, char *reply,
1053                                           size_t max_len)
1054 {
1055         char *pos, *pos2;
1056         int ndef;
1057
1058         pos = os_strchr(cmd, ' ');
1059         if (pos == NULL)
1060                 return -1;
1061         *pos++ = '\0';
1062
1063         if (os_strcmp(cmd, "WPS") == 0)
1064                 ndef = 0;
1065         else if (os_strcmp(cmd, "NDEF") == 0)
1066                 ndef = 1;
1067         else
1068                 return -1;
1069
1070         pos2 = os_strchr(pos, ' ');
1071         if (pos2)
1072                 *pos2++ = '\0';
1073         if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1074                 if (!ndef)
1075                         return -1;
1076                 return wpas_ctrl_nfc_get_handover_sel_wps(
1077                         wpa_s, reply, max_len, ndef,
1078                         os_strcmp(pos, "WPS-CR") == 0, pos2);
1079         }
1080
1081 #ifdef CONFIG_P2P
1082         if (os_strcmp(pos, "P2P-CR") == 0) {
1083                 return wpas_ctrl_nfc_get_handover_sel_p2p(
1084                         wpa_s, reply, max_len, ndef, 0);
1085         }
1086
1087         if (os_strcmp(pos, "P2P-CR-TAG") == 0) {
1088                 return wpas_ctrl_nfc_get_handover_sel_p2p(
1089                         wpa_s, reply, max_len, ndef, 1);
1090         }
1091 #endif /* CONFIG_P2P */
1092
1093         return -1;
1094 }
1095
1096
1097 static int wpas_ctrl_nfc_rx_handover_sel(struct wpa_supplicant *wpa_s,
1098                                          char *cmd)
1099 {
1100         size_t len;
1101         struct wpabuf *buf;
1102         int ret;
1103
1104         len = os_strlen(cmd);
1105         if (len & 0x01)
1106                 return -1;
1107         len /= 2;
1108
1109         buf = wpabuf_alloc(len);
1110         if (buf == NULL)
1111                 return -1;
1112         if (hexstr2bin(cmd, wpabuf_put(buf, len), len) < 0) {
1113                 wpabuf_free(buf);
1114                 return -1;
1115         }
1116
1117         ret = wpas_wps_nfc_rx_handover_sel(wpa_s, buf);
1118         wpabuf_free(buf);
1119
1120         return ret;
1121 }
1122
1123
1124 static int wpas_ctrl_nfc_report_handover(struct wpa_supplicant *wpa_s,
1125                                          char *cmd)
1126 {
1127         size_t len;
1128         struct wpabuf *req, *sel;
1129         int ret;
1130         char *pos, *role, *type, *pos2;
1131 #ifdef CONFIG_P2P
1132         char *freq;
1133         int forced_freq = 0;
1134
1135         freq = strstr(cmd, " freq=");
1136         if (freq) {
1137                 *freq = '\0';
1138                 freq += 6;
1139                 forced_freq = atoi(freq);
1140         }
1141 #endif /* CONFIG_P2P */
1142
1143         role = cmd;
1144         pos = os_strchr(role, ' ');
1145         if (pos == NULL) {
1146                 wpa_printf(MSG_DEBUG, "NFC: Missing type in handover report");
1147                 return -1;
1148         }
1149         *pos++ = '\0';
1150
1151         type = pos;
1152         pos = os_strchr(type, ' ');
1153         if (pos == NULL) {
1154                 wpa_printf(MSG_DEBUG, "NFC: Missing request message in handover report");
1155                 return -1;
1156         }
1157         *pos++ = '\0';
1158
1159         pos2 = os_strchr(pos, ' ');
1160         if (pos2 == NULL) {
1161                 wpa_printf(MSG_DEBUG, "NFC: Missing select message in handover report");
1162                 return -1;
1163         }
1164         *pos2++ = '\0';
1165
1166         len = os_strlen(pos);
1167         if (len & 0x01) {
1168                 wpa_printf(MSG_DEBUG, "NFC: Invalid request message length in handover report");
1169                 return -1;
1170         }
1171         len /= 2;
1172
1173         req = wpabuf_alloc(len);
1174         if (req == NULL) {
1175                 wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for request message");
1176                 return -1;
1177         }
1178         if (hexstr2bin(pos, wpabuf_put(req, len), len) < 0) {
1179                 wpa_printf(MSG_DEBUG, "NFC: Invalid request message hexdump in handover report");
1180                 wpabuf_free(req);
1181                 return -1;
1182         }
1183
1184         len = os_strlen(pos2);
1185         if (len & 0x01) {
1186                 wpa_printf(MSG_DEBUG, "NFC: Invalid select message length in handover report");
1187                 wpabuf_free(req);
1188                 return -1;
1189         }
1190         len /= 2;
1191
1192         sel = wpabuf_alloc(len);
1193         if (sel == NULL) {
1194                 wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for select message");
1195                 wpabuf_free(req);
1196                 return -1;
1197         }
1198         if (hexstr2bin(pos2, wpabuf_put(sel, len), len) < 0) {
1199                 wpa_printf(MSG_DEBUG, "NFC: Invalid select message hexdump in handover report");
1200                 wpabuf_free(req);
1201                 wpabuf_free(sel);
1202                 return -1;
1203         }
1204
1205         wpa_printf(MSG_DEBUG, "NFC: Connection handover reported - role=%s type=%s req_len=%d sel_len=%d",
1206                    role, type, (int) wpabuf_len(req), (int) wpabuf_len(sel));
1207
1208         if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "WPS") == 0) {
1209                 ret = wpas_wps_nfc_report_handover(wpa_s, req, sel);
1210 #ifdef CONFIG_AP
1211         } else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "WPS") == 0)
1212         {
1213                 ret = wpas_ap_wps_nfc_report_handover(wpa_s, req, sel);
1214                 if (ret < 0)
1215                         ret = wpas_er_wps_nfc_report_handover(wpa_s, req, sel);
1216 #endif /* CONFIG_AP */
1217 #ifdef CONFIG_P2P
1218         } else if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "P2P") == 0)
1219         {
1220                 ret = wpas_p2p_nfc_report_handover(wpa_s, 1, req, sel, 0);
1221         } else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "P2P") == 0)
1222         {
1223                 ret = wpas_p2p_nfc_report_handover(wpa_s, 0, req, sel,
1224                                                    forced_freq);
1225 #endif /* CONFIG_P2P */
1226         } else {
1227                 wpa_printf(MSG_DEBUG, "NFC: Unsupported connection handover "
1228                            "reported: role=%s type=%s", role, type);
1229                 ret = -1;
1230         }
1231         wpabuf_free(req);
1232         wpabuf_free(sel);
1233
1234         if (ret)
1235                 wpa_printf(MSG_DEBUG, "NFC: Failed to process reported handover messages");
1236
1237         return ret;
1238 }
1239
1240 #endif /* CONFIG_WPS_NFC */
1241
1242
1243 static int wpa_supplicant_ctrl_iface_wps_reg(struct wpa_supplicant *wpa_s,
1244                                              char *cmd)
1245 {
1246         u8 bssid[ETH_ALEN];
1247         char *pin;
1248         char *new_ssid;
1249         char *new_auth;
1250         char *new_encr;
1251         char *new_key;
1252         struct wps_new_ap_settings ap;
1253
1254         pin = os_strchr(cmd, ' ');
1255         if (pin == NULL)
1256                 return -1;
1257         *pin++ = '\0';
1258
1259         if (hwaddr_aton(cmd, bssid)) {
1260                 wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_REG: invalid BSSID '%s'",
1261                            cmd);
1262                 return -1;
1263         }
1264
1265         new_ssid = os_strchr(pin, ' ');
1266         if (new_ssid == NULL)
1267                 return wpas_wps_start_reg(wpa_s, bssid, pin, NULL);
1268         *new_ssid++ = '\0';
1269
1270         new_auth = os_strchr(new_ssid, ' ');
1271         if (new_auth == NULL)
1272                 return -1;
1273         *new_auth++ = '\0';
1274
1275         new_encr = os_strchr(new_auth, ' ');
1276         if (new_encr == NULL)
1277                 return -1;
1278         *new_encr++ = '\0';
1279
1280         new_key = os_strchr(new_encr, ' ');
1281         if (new_key == NULL)
1282                 return -1;
1283         *new_key++ = '\0';
1284
1285         os_memset(&ap, 0, sizeof(ap));
1286         ap.ssid_hex = new_ssid;
1287         ap.auth = new_auth;
1288         ap.encr = new_encr;
1289         ap.key_hex = new_key;
1290         return wpas_wps_start_reg(wpa_s, bssid, pin, &ap);
1291 }
1292
1293
1294 #ifdef CONFIG_AP
1295 static int wpa_supplicant_ctrl_iface_wps_ap_pin(struct wpa_supplicant *wpa_s,
1296                                                 char *cmd, char *buf,
1297                                                 size_t buflen)
1298 {
1299         int timeout = 300;
1300         char *pos;
1301         const char *pin_txt;
1302
1303         if (!wpa_s->ap_iface)
1304                 return -1;
1305
1306         pos = os_strchr(cmd, ' ');
1307         if (pos)
1308                 *pos++ = '\0';
1309
1310         if (os_strcmp(cmd, "disable") == 0) {
1311                 wpas_wps_ap_pin_disable(wpa_s);
1312                 return os_snprintf(buf, buflen, "OK\n");
1313         }
1314
1315         if (os_strcmp(cmd, "random") == 0) {
1316                 if (pos)
1317                         timeout = atoi(pos);
1318                 pin_txt = wpas_wps_ap_pin_random(wpa_s, timeout);
1319                 if (pin_txt == NULL)
1320                         return -1;
1321                 return os_snprintf(buf, buflen, "%s", pin_txt);
1322         }
1323
1324         if (os_strcmp(cmd, "get") == 0) {
1325                 pin_txt = wpas_wps_ap_pin_get(wpa_s);
1326                 if (pin_txt == NULL)
1327                         return -1;
1328                 return os_snprintf(buf, buflen, "%s", pin_txt);
1329         }
1330
1331         if (os_strcmp(cmd, "set") == 0) {
1332                 char *pin;
1333                 if (pos == NULL)
1334                         return -1;
1335                 pin = pos;
1336                 pos = os_strchr(pos, ' ');
1337                 if (pos) {
1338                         *pos++ = '\0';
1339                         timeout = atoi(pos);
1340                 }
1341                 if (os_strlen(pin) > buflen)
1342                         return -1;
1343                 if (wpas_wps_ap_pin_set(wpa_s, pin, timeout) < 0)
1344                         return -1;
1345                 return os_snprintf(buf, buflen, "%s", pin);
1346         }
1347
1348         return -1;
1349 }
1350 #endif /* CONFIG_AP */
1351
1352
1353 #ifdef CONFIG_WPS_ER
1354 static int wpa_supplicant_ctrl_iface_wps_er_pin(struct wpa_supplicant *wpa_s,
1355                                                 char *cmd)
1356 {
1357         char *uuid = cmd, *pin, *pos;
1358         u8 addr_buf[ETH_ALEN], *addr = NULL;
1359         pin = os_strchr(uuid, ' ');
1360         if (pin == NULL)
1361                 return -1;
1362         *pin++ = '\0';
1363         pos = os_strchr(pin, ' ');
1364         if (pos) {
1365                 *pos++ = '\0';
1366                 if (hwaddr_aton(pos, addr_buf) == 0)
1367                         addr = addr_buf;
1368         }
1369         return wpas_wps_er_add_pin(wpa_s, addr, uuid, pin);
1370 }
1371
1372
1373 static int wpa_supplicant_ctrl_iface_wps_er_learn(struct wpa_supplicant *wpa_s,
1374                                                   char *cmd)
1375 {
1376         char *uuid = cmd, *pin;
1377         pin = os_strchr(uuid, ' ');
1378         if (pin == NULL)
1379                 return -1;
1380         *pin++ = '\0';
1381         return wpas_wps_er_learn(wpa_s, uuid, pin);
1382 }
1383
1384
1385 static int wpa_supplicant_ctrl_iface_wps_er_set_config(
1386         struct wpa_supplicant *wpa_s, char *cmd)
1387 {
1388         char *uuid = cmd, *id;
1389         id = os_strchr(uuid, ' ');
1390         if (id == NULL)
1391                 return -1;
1392         *id++ = '\0';
1393         return wpas_wps_er_set_config(wpa_s, uuid, atoi(id));
1394 }
1395
1396
1397 static int wpa_supplicant_ctrl_iface_wps_er_config(
1398         struct wpa_supplicant *wpa_s, char *cmd)
1399 {
1400         char *pin;
1401         char *new_ssid;
1402         char *new_auth;
1403         char *new_encr;
1404         char *new_key;
1405         struct wps_new_ap_settings ap;
1406
1407         pin = os_strchr(cmd, ' ');
1408         if (pin == NULL)
1409                 return -1;
1410         *pin++ = '\0';
1411
1412         new_ssid = os_strchr(pin, ' ');
1413         if (new_ssid == NULL)
1414                 return -1;
1415         *new_ssid++ = '\0';
1416
1417         new_auth = os_strchr(new_ssid, ' ');
1418         if (new_auth == NULL)
1419                 return -1;
1420         *new_auth++ = '\0';
1421
1422         new_encr = os_strchr(new_auth, ' ');
1423         if (new_encr == NULL)
1424                 return -1;
1425         *new_encr++ = '\0';
1426
1427         new_key = os_strchr(new_encr, ' ');
1428         if (new_key == NULL)
1429                 return -1;
1430         *new_key++ = '\0';
1431
1432         os_memset(&ap, 0, sizeof(ap));
1433         ap.ssid_hex = new_ssid;
1434         ap.auth = new_auth;
1435         ap.encr = new_encr;
1436         ap.key_hex = new_key;
1437         return wpas_wps_er_config(wpa_s, cmd, pin, &ap);
1438 }
1439
1440
1441 #ifdef CONFIG_WPS_NFC
1442 static int wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
1443         struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1444 {
1445         int ndef;
1446         struct wpabuf *buf;
1447         int res;
1448         char *uuid;
1449
1450         uuid = os_strchr(cmd, ' ');
1451         if (uuid == NULL)
1452                 return -1;
1453         *uuid++ = '\0';
1454
1455         if (os_strcmp(cmd, "WPS") == 0)
1456                 ndef = 0;
1457         else if (os_strcmp(cmd, "NDEF") == 0)
1458                 ndef = 1;
1459         else
1460                 return -1;
1461
1462         buf = wpas_wps_er_nfc_config_token(wpa_s, ndef, uuid);
1463         if (buf == NULL)
1464                 return -1;
1465
1466         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1467                                          wpabuf_len(buf));
1468         reply[res++] = '\n';
1469         reply[res] = '\0';
1470
1471         wpabuf_free(buf);
1472
1473         return res;
1474 }
1475 #endif /* CONFIG_WPS_NFC */
1476 #endif /* CONFIG_WPS_ER */
1477
1478 #endif /* CONFIG_WPS */
1479
1480
1481 #ifdef CONFIG_IBSS_RSN
1482 static int wpa_supplicant_ctrl_iface_ibss_rsn(
1483         struct wpa_supplicant *wpa_s, char *addr)
1484 {
1485         u8 peer[ETH_ALEN];
1486
1487         if (hwaddr_aton(addr, peer)) {
1488                 wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN: invalid "
1489                            "address '%s'", addr);
1490                 return -1;
1491         }
1492
1493         wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN " MACSTR,
1494                    MAC2STR(peer));
1495
1496         return ibss_rsn_start(wpa_s->ibss_rsn, peer);
1497 }
1498 #endif /* CONFIG_IBSS_RSN */
1499
1500
1501 static int wpa_supplicant_ctrl_iface_ctrl_rsp(struct wpa_supplicant *wpa_s,
1502                                               char *rsp)
1503 {
1504 #ifdef IEEE8021X_EAPOL
1505         char *pos, *id_pos;
1506         int id;
1507         struct wpa_ssid *ssid;
1508
1509         pos = os_strchr(rsp, '-');
1510         if (pos == NULL)
1511                 return -1;
1512         *pos++ = '\0';
1513         id_pos = pos;
1514         pos = os_strchr(pos, ':');
1515         if (pos == NULL)
1516                 return -1;
1517         *pos++ = '\0';
1518         id = atoi(id_pos);
1519         wpa_printf(MSG_DEBUG, "CTRL_IFACE: field=%s id=%d", rsp, id);
1520         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
1521                               (u8 *) pos, os_strlen(pos));
1522
1523         ssid = wpa_config_get_network(wpa_s->conf, id);
1524         if (ssid == NULL) {
1525                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
1526                            "to update", id);
1527                 return -1;
1528         }
1529
1530         return wpa_supplicant_ctrl_iface_ctrl_rsp_handle(wpa_s, ssid, rsp,
1531                                                          pos);
1532 #else /* IEEE8021X_EAPOL */
1533         wpa_printf(MSG_DEBUG, "CTRL_IFACE: 802.1X not included");
1534         return -1;
1535 #endif /* IEEE8021X_EAPOL */
1536 }
1537
1538
1539 static int wpa_supplicant_ctrl_iface_status(struct wpa_supplicant *wpa_s,
1540                                             const char *params,
1541                                             char *buf, size_t buflen)
1542 {
1543         char *pos, *end, tmp[30];
1544         int res, verbose, wps, ret;
1545 #ifdef CONFIG_HS20
1546         const u8 *hs20;
1547 #endif /* CONFIG_HS20 */
1548
1549         if (os_strcmp(params, "-DRIVER") == 0)
1550                 return wpa_drv_status(wpa_s, buf, buflen);
1551         verbose = os_strcmp(params, "-VERBOSE") == 0;
1552         wps = os_strcmp(params, "-WPS") == 0;
1553         pos = buf;
1554         end = buf + buflen;
1555         if (wpa_s->wpa_state >= WPA_ASSOCIATED) {
1556                 struct wpa_ssid *ssid = wpa_s->current_ssid;
1557                 ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
1558                                   MAC2STR(wpa_s->bssid));
1559                 if (ret < 0 || ret >= end - pos)
1560                         return pos - buf;
1561                 pos += ret;
1562                 if (ssid) {
1563                         u8 *_ssid = ssid->ssid;
1564                         size_t ssid_len = ssid->ssid_len;
1565                         u8 ssid_buf[MAX_SSID_LEN];
1566                         if (ssid_len == 0) {
1567                                 int _res = wpa_drv_get_ssid(wpa_s, ssid_buf);
1568                                 if (_res < 0)
1569                                         ssid_len = 0;
1570                                 else
1571                                         ssid_len = _res;
1572                                 _ssid = ssid_buf;
1573                         }
1574                         ret = os_snprintf(pos, end - pos, "ssid=%s\nid=%d\n",
1575                                           wpa_ssid_txt(_ssid, ssid_len),
1576                                           ssid->id);
1577                         if (ret < 0 || ret >= end - pos)
1578                                 return pos - buf;
1579                         pos += ret;
1580
1581                         if (wps && ssid->passphrase &&
1582                             wpa_key_mgmt_wpa_psk(ssid->key_mgmt) &&
1583                             (ssid->mode == WPAS_MODE_AP ||
1584                              ssid->mode == WPAS_MODE_P2P_GO)) {
1585                                 ret = os_snprintf(pos, end - pos,
1586                                                   "passphrase=%s\n",
1587                                                   ssid->passphrase);
1588                                 if (ret < 0 || ret >= end - pos)
1589                                         return pos - buf;
1590                                 pos += ret;
1591                         }
1592                         if (ssid->id_str) {
1593                                 ret = os_snprintf(pos, end - pos,
1594                                                   "id_str=%s\n",
1595                                                   ssid->id_str);
1596                                 if (ret < 0 || ret >= end - pos)
1597                                         return pos - buf;
1598                                 pos += ret;
1599                         }
1600
1601                         switch (ssid->mode) {
1602                         case WPAS_MODE_INFRA:
1603                                 ret = os_snprintf(pos, end - pos,
1604                                                   "mode=station\n");
1605                                 break;
1606                         case WPAS_MODE_IBSS:
1607                                 ret = os_snprintf(pos, end - pos,
1608                                                   "mode=IBSS\n");
1609                                 break;
1610                         case WPAS_MODE_AP:
1611                                 ret = os_snprintf(pos, end - pos,
1612                                                   "mode=AP\n");
1613                                 break;
1614                         case WPAS_MODE_P2P_GO:
1615                                 ret = os_snprintf(pos, end - pos,
1616                                                   "mode=P2P GO\n");
1617                                 break;
1618                         case WPAS_MODE_P2P_GROUP_FORMATION:
1619                                 ret = os_snprintf(pos, end - pos,
1620                                                   "mode=P2P GO - group "
1621                                                   "formation\n");
1622                                 break;
1623                         default:
1624                                 ret = 0;
1625                                 break;
1626                         }
1627                         if (ret < 0 || ret >= end - pos)
1628                                 return pos - buf;
1629                         pos += ret;
1630                 }
1631
1632 #ifdef CONFIG_AP
1633                 if (wpa_s->ap_iface) {
1634                         pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
1635                                                             end - pos,
1636                                                             verbose);
1637                 } else
1638 #endif /* CONFIG_AP */
1639                 pos += wpa_sm_get_status(wpa_s->wpa, pos, end - pos, verbose);
1640         }
1641 #ifdef CONFIG_SAE
1642         if (wpa_s->wpa_state >= WPA_ASSOCIATED &&
1643 #ifdef CONFIG_AP
1644             !wpa_s->ap_iface &&
1645 #endif /* CONFIG_AP */
1646             wpa_s->sme.sae.state == SAE_ACCEPTED) {
1647                 ret = os_snprintf(pos, end - pos, "sae_group=%d\n",
1648                                   wpa_s->sme.sae.group);
1649                 if (ret < 0 || ret >= end - pos)
1650                         return pos - buf;
1651                 pos += ret;
1652         }
1653 #endif /* CONFIG_SAE */
1654         ret = os_snprintf(pos, end - pos, "wpa_state=%s\n",
1655                           wpa_supplicant_state_txt(wpa_s->wpa_state));
1656         if (ret < 0 || ret >= end - pos)
1657                 return pos - buf;
1658         pos += ret;
1659
1660         if (wpa_s->l2 &&
1661             l2_packet_get_ip_addr(wpa_s->l2, tmp, sizeof(tmp)) >= 0) {
1662                 ret = os_snprintf(pos, end - pos, "ip_address=%s\n", tmp);
1663                 if (ret < 0 || ret >= end - pos)
1664                         return pos - buf;
1665                 pos += ret;
1666         }
1667
1668 #ifdef CONFIG_P2P
1669         if (wpa_s->global->p2p) {
1670                 ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
1671                                   "\n", MAC2STR(wpa_s->global->p2p_dev_addr));
1672                 if (ret < 0 || ret >= end - pos)
1673                         return pos - buf;
1674                 pos += ret;
1675         }
1676 #endif /* CONFIG_P2P */
1677
1678         ret = os_snprintf(pos, end - pos, "address=" MACSTR "\n",
1679                           MAC2STR(wpa_s->own_addr));
1680         if (ret < 0 || ret >= end - pos)
1681                 return pos - buf;
1682         pos += ret;
1683
1684 #ifdef CONFIG_HS20
1685         if (wpa_s->current_bss &&
1686             (hs20 = wpa_bss_get_vendor_ie(wpa_s->current_bss,
1687                                           HS20_IE_VENDOR_TYPE)) &&
1688             wpa_s->wpa_proto == WPA_PROTO_RSN &&
1689             wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
1690                 int release = 1;
1691                 if (hs20[1] >= 5) {
1692                         u8 rel_num = (hs20[6] & 0xf0) >> 4;
1693                         release = rel_num + 1;
1694                 }
1695                 ret = os_snprintf(pos, end - pos, "hs20=%d\n", release);
1696                 if (ret < 0 || ret >= end - pos)
1697                         return pos - buf;
1698                 pos += ret;
1699         }
1700
1701         if (wpa_s->current_ssid) {
1702                 struct wpa_cred *cred;
1703                 char *type;
1704
1705                 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1706                         size_t i;
1707
1708                         if (wpa_s->current_ssid->parent_cred != cred)
1709                                 continue;
1710
1711                         if (cred->provisioning_sp) {
1712                                 ret = os_snprintf(pos, end - pos,
1713                                                   "provisioning_sp=%s\n",
1714                                                   cred->provisioning_sp);
1715                                 if (ret < 0 || ret >= end - pos)
1716                                         return pos - buf;
1717                                 pos += ret;
1718                         }
1719
1720                         if (!cred->domain)
1721                                 goto no_domain;
1722
1723                         i = 0;
1724                         if (wpa_s->current_bss && wpa_s->current_bss->anqp) {
1725                                 struct wpabuf *names =
1726                                         wpa_s->current_bss->anqp->domain_name;
1727                                 for (i = 0; names && i < cred->num_domain; i++)
1728                                 {
1729                                         if (domain_name_list_contains(
1730                                                     names, cred->domain[i], 1))
1731                                                 break;
1732                                 }
1733                                 if (i == cred->num_domain)
1734                                         i = 0; /* show first entry by default */
1735                         }
1736                         ret = os_snprintf(pos, end - pos, "home_sp=%s\n",
1737                                           cred->domain[i]);
1738                         if (ret < 0 || ret >= end - pos)
1739                                 return pos - buf;
1740                         pos += ret;
1741
1742                 no_domain:
1743                         if (wpa_s->current_bss == NULL ||
1744                             wpa_s->current_bss->anqp == NULL)
1745                                 res = -1;
1746                         else
1747                                 res = interworking_home_sp_cred(
1748                                         wpa_s, cred,
1749                                         wpa_s->current_bss->anqp->domain_name);
1750                         if (res > 0)
1751                                 type = "home";
1752                         else if (res == 0)
1753                                 type = "roaming";
1754                         else
1755                                 type = "unknown";
1756
1757                         ret = os_snprintf(pos, end - pos, "sp_type=%s\n", type);
1758                         if (ret < 0 || ret >= end - pos)
1759                                 return pos - buf;
1760                         pos += ret;
1761
1762                         break;
1763                 }
1764         }
1765 #endif /* CONFIG_HS20 */
1766
1767         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
1768             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1769                 res = eapol_sm_get_status(wpa_s->eapol, pos, end - pos,
1770                                           verbose);
1771                 if (res >= 0)
1772                         pos += res;
1773         }
1774
1775         res = rsn_preauth_get_status(wpa_s->wpa, pos, end - pos, verbose);
1776         if (res >= 0)
1777                 pos += res;
1778
1779 #ifdef CONFIG_WPS
1780         {
1781                 char uuid_str[100];
1782                 uuid_bin2str(wpa_s->wps->uuid, uuid_str, sizeof(uuid_str));
1783                 ret = os_snprintf(pos, end - pos, "uuid=%s\n", uuid_str);
1784                 if (ret < 0 || ret >= end - pos)
1785                         return pos - buf;
1786                 pos += ret;
1787         }
1788 #endif /* CONFIG_WPS */
1789
1790 #ifdef ANDROID
1791         wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_STATE_CHANGE
1792                      "id=%d state=%d BSSID=" MACSTR " SSID=%s",
1793                      wpa_s->current_ssid ? wpa_s->current_ssid->id : -1,
1794                      wpa_s->wpa_state,
1795                      MAC2STR(wpa_s->bssid),
1796                      wpa_s->current_ssid && wpa_s->current_ssid->ssid ?
1797                      wpa_ssid_txt(wpa_s->current_ssid->ssid,
1798                                   wpa_s->current_ssid->ssid_len) : "");
1799         if (wpa_s->wpa_state == WPA_COMPLETED) {
1800                 struct wpa_ssid *ssid = wpa_s->current_ssid;
1801                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED
1802                              "- connection to " MACSTR
1803                              " completed %s [id=%d id_str=%s]",
1804                              MAC2STR(wpa_s->bssid), "(auth)",
1805                              ssid ? ssid->id : -1,
1806                              ssid && ssid->id_str ? ssid->id_str : "");
1807         }
1808 #endif /* ANDROID */
1809
1810         return pos - buf;
1811 }
1812
1813
1814 static int wpa_supplicant_ctrl_iface_bssid(struct wpa_supplicant *wpa_s,
1815                                            char *cmd)
1816 {
1817         char *pos;
1818         int id;
1819         struct wpa_ssid *ssid;
1820         u8 bssid[ETH_ALEN];
1821
1822         /* cmd: "<network id> <BSSID>" */
1823         pos = os_strchr(cmd, ' ');
1824         if (pos == NULL)
1825                 return -1;
1826         *pos++ = '\0';
1827         id = atoi(cmd);
1828         wpa_printf(MSG_DEBUG, "CTRL_IFACE: id=%d bssid='%s'", id, pos);
1829         if (hwaddr_aton(pos, bssid)) {
1830                 wpa_printf(MSG_DEBUG ,"CTRL_IFACE: invalid BSSID '%s'", pos);
1831                 return -1;
1832         }
1833
1834         ssid = wpa_config_get_network(wpa_s->conf, id);
1835         if (ssid == NULL) {
1836                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
1837                            "to update", id);
1838                 return -1;
1839         }
1840
1841         os_memcpy(ssid->bssid, bssid, ETH_ALEN);
1842         ssid->bssid_set = !is_zero_ether_addr(bssid);
1843
1844         return 0;
1845 }
1846
1847
1848 static int wpa_supplicant_ctrl_iface_blacklist(struct wpa_supplicant *wpa_s,
1849                                                char *cmd, char *buf,
1850                                                size_t buflen)
1851 {
1852         u8 bssid[ETH_ALEN];
1853         struct wpa_blacklist *e;
1854         char *pos, *end;
1855         int ret;
1856
1857         /* cmd: "BLACKLIST [<BSSID>]" */
1858         if (*cmd == '\0') {
1859                 pos = buf;
1860                 end = buf + buflen;
1861                 e = wpa_s->blacklist;
1862                 while (e) {
1863                         ret = os_snprintf(pos, end - pos, MACSTR "\n",
1864                                           MAC2STR(e->bssid));
1865                         if (ret < 0 || ret >= end - pos)
1866                                 return pos - buf;
1867                         pos += ret;
1868                         e = e->next;
1869                 }
1870                 return pos - buf;
1871         }
1872
1873         cmd++;
1874         if (os_strncmp(cmd, "clear", 5) == 0) {
1875                 wpa_blacklist_clear(wpa_s);
1876                 os_memcpy(buf, "OK\n", 3);
1877                 return 3;
1878         }
1879
1880         wpa_printf(MSG_DEBUG, "CTRL_IFACE: BLACKLIST bssid='%s'", cmd);
1881         if (hwaddr_aton(cmd, bssid)) {
1882                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: invalid BSSID '%s'", cmd);
1883                 return -1;
1884         }
1885
1886         /*
1887          * Add the BSSID twice, so its count will be 2, causing it to be
1888          * skipped when processing scan results.
1889          */
1890         ret = wpa_blacklist_add(wpa_s, bssid);
1891         if (ret != 0)
1892                 return -1;
1893         ret = wpa_blacklist_add(wpa_s, bssid);
1894         if (ret != 0)
1895                 return -1;
1896         os_memcpy(buf, "OK\n", 3);
1897         return 3;
1898 }
1899
1900
1901 static const char * debug_level_str(int level)
1902 {
1903         switch (level) {
1904         case MSG_EXCESSIVE:
1905                 return "EXCESSIVE";
1906         case MSG_MSGDUMP:
1907                 return "MSGDUMP";
1908         case MSG_DEBUG:
1909                 return "DEBUG";
1910         case MSG_INFO:
1911                 return "INFO";
1912         case MSG_WARNING:
1913                 return "WARNING";
1914         case MSG_ERROR:
1915                 return "ERROR";
1916         default:
1917                 return "?";
1918         }
1919 }
1920
1921
1922 static int str_to_debug_level(const char *s)
1923 {
1924         if (os_strcasecmp(s, "EXCESSIVE") == 0)
1925                 return MSG_EXCESSIVE;
1926         if (os_strcasecmp(s, "MSGDUMP") == 0)
1927                 return MSG_MSGDUMP;
1928         if (os_strcasecmp(s, "DEBUG") == 0)
1929                 return MSG_DEBUG;
1930         if (os_strcasecmp(s, "INFO") == 0)
1931                 return MSG_INFO;
1932         if (os_strcasecmp(s, "WARNING") == 0)
1933                 return MSG_WARNING;
1934         if (os_strcasecmp(s, "ERROR") == 0)
1935                 return MSG_ERROR;
1936         return -1;
1937 }
1938
1939
1940 static int wpa_supplicant_ctrl_iface_log_level(struct wpa_supplicant *wpa_s,
1941                                                char *cmd, char *buf,
1942                                                size_t buflen)
1943 {
1944         char *pos, *end, *stamp;
1945         int ret;
1946
1947         if (cmd == NULL) {
1948                 return -1;
1949         }
1950
1951         /* cmd: "LOG_LEVEL [<level>]" */
1952         if (*cmd == '\0') {
1953                 pos = buf;
1954                 end = buf + buflen;
1955                 ret = os_snprintf(pos, end - pos, "Current level: %s\n"
1956                                   "Timestamp: %d\n",
1957                                   debug_level_str(wpa_debug_level),
1958                                   wpa_debug_timestamp);
1959                 if (ret < 0 || ret >= end - pos)
1960                         ret = 0;
1961
1962                 return ret;
1963         }
1964
1965         while (*cmd == ' ')
1966                 cmd++;
1967
1968         stamp = os_strchr(cmd, ' ');
1969         if (stamp) {
1970                 *stamp++ = '\0';
1971                 while (*stamp == ' ') {
1972                         stamp++;
1973                 }
1974         }
1975
1976         if (cmd && os_strlen(cmd)) {
1977                 int level = str_to_debug_level(cmd);
1978                 if (level < 0)
1979                         return -1;
1980                 wpa_debug_level = level;
1981         }
1982
1983         if (stamp && os_strlen(stamp))
1984                 wpa_debug_timestamp = atoi(stamp);
1985
1986         os_memcpy(buf, "OK\n", 3);
1987         return 3;
1988 }
1989
1990
1991 static int wpa_supplicant_ctrl_iface_list_networks(
1992         struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
1993 {
1994         char *pos, *end;
1995         struct wpa_ssid *ssid;
1996         int ret;
1997
1998         pos = buf;
1999         end = buf + buflen;
2000         ret = os_snprintf(pos, end - pos,
2001                           "network id / ssid / bssid / flags\n");
2002         if (ret < 0 || ret >= end - pos)
2003                 return pos - buf;
2004         pos += ret;
2005
2006         ssid = wpa_s->conf->ssid;
2007         while (ssid) {
2008                 ret = os_snprintf(pos, end - pos, "%d\t%s",
2009                                   ssid->id,
2010                                   wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2011                 if (ret < 0 || ret >= end - pos)
2012                         return pos - buf;
2013                 pos += ret;
2014                 if (ssid->bssid_set) {
2015                         ret = os_snprintf(pos, end - pos, "\t" MACSTR,
2016                                           MAC2STR(ssid->bssid));
2017                 } else {
2018                         ret = os_snprintf(pos, end - pos, "\tany");
2019                 }
2020                 if (ret < 0 || ret >= end - pos)
2021                         return pos - buf;
2022                 pos += ret;
2023                 ret = os_snprintf(pos, end - pos, "\t%s%s%s%s",
2024                                   ssid == wpa_s->current_ssid ?
2025                                   "[CURRENT]" : "",
2026                                   ssid->disabled ? "[DISABLED]" : "",
2027                                   ssid->disabled_until.sec ?
2028                                   "[TEMP-DISABLED]" : "",
2029                                   ssid->disabled == 2 ? "[P2P-PERSISTENT]" :
2030                                   "");
2031                 if (ret < 0 || ret >= end - pos)
2032                         return pos - buf;
2033                 pos += ret;
2034                 ret = os_snprintf(pos, end - pos, "\n");
2035                 if (ret < 0 || ret >= end - pos)
2036                         return pos - buf;
2037                 pos += ret;
2038
2039                 ssid = ssid->next;
2040         }
2041
2042         return pos - buf;
2043 }
2044
2045
2046 static char * wpa_supplicant_cipher_txt(char *pos, char *end, int cipher)
2047 {
2048         int ret;
2049         ret = os_snprintf(pos, end - pos, "-");
2050         if (ret < 0 || ret >= end - pos)
2051                 return pos;
2052         pos += ret;
2053         ret = wpa_write_ciphers(pos, end, cipher, "+");
2054         if (ret < 0)
2055                 return pos;
2056         pos += ret;
2057         return pos;
2058 }
2059
2060
2061 static char * wpa_supplicant_ie_txt(char *pos, char *end, const char *proto,
2062                                     const u8 *ie, size_t ie_len)
2063 {
2064         struct wpa_ie_data data;
2065         char *start;
2066         int ret;
2067
2068         ret = os_snprintf(pos, end - pos, "[%s-", proto);
2069         if (ret < 0 || ret >= end - pos)
2070                 return pos;
2071         pos += ret;
2072
2073         if (wpa_parse_wpa_ie(ie, ie_len, &data) < 0) {
2074                 ret = os_snprintf(pos, end - pos, "?]");
2075                 if (ret < 0 || ret >= end - pos)
2076                         return pos;
2077                 pos += ret;
2078                 return pos;
2079         }
2080
2081         start = pos;
2082         if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
2083                 ret = os_snprintf(pos, end - pos, "%sEAP",
2084                                   pos == start ? "" : "+");
2085                 if (ret < 0 || ret >= end - pos)
2086                         return pos;
2087                 pos += ret;
2088         }
2089         if (data.key_mgmt & WPA_KEY_MGMT_PSK) {
2090                 ret = os_snprintf(pos, end - pos, "%sPSK",
2091                                   pos == start ? "" : "+");
2092                 if (ret < 0 || ret >= end - pos)
2093                         return pos;
2094                 pos += ret;
2095         }
2096         if (data.key_mgmt & WPA_KEY_MGMT_WPA_NONE) {
2097                 ret = os_snprintf(pos, end - pos, "%sNone",
2098                                   pos == start ? "" : "+");
2099                 if (ret < 0 || ret >= end - pos)
2100                         return pos;
2101                 pos += ret;
2102         }
2103 #ifdef CONFIG_IEEE80211R
2104         if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
2105                 ret = os_snprintf(pos, end - pos, "%sFT/EAP",
2106                                   pos == start ? "" : "+");
2107                 if (ret < 0 || ret >= end - pos)
2108                         return pos;
2109                 pos += ret;
2110         }
2111         if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK) {
2112                 ret = os_snprintf(pos, end - pos, "%sFT/PSK",
2113                                   pos == start ? "" : "+");
2114                 if (ret < 0 || ret >= end - pos)
2115                         return pos;
2116                 pos += ret;
2117         }
2118 #endif /* CONFIG_IEEE80211R */
2119 #ifdef CONFIG_IEEE80211W
2120         if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
2121                 ret = os_snprintf(pos, end - pos, "%sEAP-SHA256",
2122                                   pos == start ? "" : "+");
2123                 if (ret < 0 || ret >= end - pos)
2124                         return pos;
2125                 pos += ret;
2126         }
2127         if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
2128                 ret = os_snprintf(pos, end - pos, "%sPSK-SHA256",
2129                                   pos == start ? "" : "+");
2130                 if (ret < 0 || ret >= end - pos)
2131                         return pos;
2132                 pos += ret;
2133         }
2134 #endif /* CONFIG_IEEE80211W */
2135
2136         pos = wpa_supplicant_cipher_txt(pos, end, data.pairwise_cipher);
2137
2138         if (data.capabilities & WPA_CAPABILITY_PREAUTH) {
2139                 ret = os_snprintf(pos, end - pos, "-preauth");
2140                 if (ret < 0 || ret >= end - pos)
2141                         return pos;
2142                 pos += ret;
2143         }
2144
2145         ret = os_snprintf(pos, end - pos, "]");
2146         if (ret < 0 || ret >= end - pos)
2147                 return pos;
2148         pos += ret;
2149
2150         return pos;
2151 }
2152
2153
2154 #ifdef CONFIG_WPS
2155 static char * wpa_supplicant_wps_ie_txt_buf(struct wpa_supplicant *wpa_s,
2156                                             char *pos, char *end,
2157                                             struct wpabuf *wps_ie)
2158 {
2159         int ret;
2160         const char *txt;
2161
2162         if (wps_ie == NULL)
2163                 return pos;
2164         if (wps_is_selected_pbc_registrar(wps_ie))
2165                 txt = "[WPS-PBC]";
2166         else if (wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 0))
2167                 txt = "[WPS-AUTH]";
2168         else if (wps_is_selected_pin_registrar(wps_ie))
2169                 txt = "[WPS-PIN]";
2170         else
2171                 txt = "[WPS]";
2172
2173         ret = os_snprintf(pos, end - pos, "%s", txt);
2174         if (ret >= 0 && ret < end - pos)
2175                 pos += ret;
2176         wpabuf_free(wps_ie);
2177         return pos;
2178 }
2179 #endif /* CONFIG_WPS */
2180
2181
2182 static char * wpa_supplicant_wps_ie_txt(struct wpa_supplicant *wpa_s,
2183                                         char *pos, char *end,
2184                                         const struct wpa_bss *bss)
2185 {
2186 #ifdef CONFIG_WPS
2187         struct wpabuf *wps_ie;
2188         wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
2189         return wpa_supplicant_wps_ie_txt_buf(wpa_s, pos, end, wps_ie);
2190 #else /* CONFIG_WPS */
2191         return pos;
2192 #endif /* CONFIG_WPS */
2193 }
2194
2195
2196 /* Format one result on one text line into a buffer. */
2197 static int wpa_supplicant_ctrl_iface_scan_result(
2198         struct wpa_supplicant *wpa_s,
2199         const struct wpa_bss *bss, char *buf, size_t buflen)
2200 {
2201         char *pos, *end;
2202         int ret;
2203         const u8 *ie, *ie2, *p2p;
2204
2205         p2p = wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE);
2206         if (!p2p)
2207                 p2p = wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE);
2208         if (p2p && bss->ssid_len == P2P_WILDCARD_SSID_LEN &&
2209             os_memcmp(bss->ssid, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) ==
2210             0)
2211                 return 0; /* Do not show P2P listen discovery results here */
2212
2213         pos = buf;
2214         end = buf + buflen;
2215
2216         ret = os_snprintf(pos, end - pos, MACSTR "\t%d\t%d\t",
2217                           MAC2STR(bss->bssid), bss->freq, bss->level);
2218         if (ret < 0 || ret >= end - pos)
2219                 return -1;
2220         pos += ret;
2221         ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
2222         if (ie)
2223                 pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie, 2 + ie[1]);
2224         ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2225         if (ie2)
2226                 pos = wpa_supplicant_ie_txt(pos, end, "WPA2", ie2, 2 + ie2[1]);
2227         pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
2228         if (!ie && !ie2 && bss->caps & IEEE80211_CAP_PRIVACY) {
2229                 ret = os_snprintf(pos, end - pos, "[WEP]");
2230                 if (ret < 0 || ret >= end - pos)
2231                         return -1;
2232                 pos += ret;
2233         }
2234         if (bss->caps & IEEE80211_CAP_IBSS) {
2235                 ret = os_snprintf(pos, end - pos, "[IBSS]");
2236                 if (ret < 0 || ret >= end - pos)
2237                         return -1;
2238                 pos += ret;
2239         }
2240         if (bss->caps & IEEE80211_CAP_ESS) {
2241                 ret = os_snprintf(pos, end - pos, "[ESS]");
2242                 if (ret < 0 || ret >= end - pos)
2243                         return -1;
2244                 pos += ret;
2245         }
2246         if (p2p) {
2247                 ret = os_snprintf(pos, end - pos, "[P2P]");
2248                 if (ret < 0 || ret >= end - pos)
2249                         return -1;
2250                 pos += ret;
2251         }
2252 #ifdef CONFIG_HS20
2253         if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE) && ie2) {
2254                 ret = os_snprintf(pos, end - pos, "[HS20]");
2255                 if (ret < 0 || ret >= end - pos)
2256                         return -1;
2257                 pos += ret;
2258         }
2259 #endif /* CONFIG_HS20 */
2260
2261         ret = os_snprintf(pos, end - pos, "\t%s",
2262                           wpa_ssid_txt(bss->ssid, bss->ssid_len));
2263         if (ret < 0 || ret >= end - pos)
2264                 return -1;
2265         pos += ret;
2266
2267         ret = os_snprintf(pos, end - pos, "\n");
2268         if (ret < 0 || ret >= end - pos)
2269                 return -1;
2270         pos += ret;
2271
2272         return pos - buf;
2273 }
2274
2275
2276 static int wpa_supplicant_ctrl_iface_scan_results(
2277         struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
2278 {
2279         char *pos, *end;
2280         struct wpa_bss *bss;
2281         int ret;
2282
2283         pos = buf;
2284         end = buf + buflen;
2285         ret = os_snprintf(pos, end - pos, "bssid / frequency / signal level / "
2286                           "flags / ssid\n");
2287         if (ret < 0 || ret >= end - pos)
2288                 return pos - buf;
2289         pos += ret;
2290
2291         dl_list_for_each(bss, &wpa_s->bss_id, struct wpa_bss, list_id) {
2292                 ret = wpa_supplicant_ctrl_iface_scan_result(wpa_s, bss, pos,
2293                                                             end - pos);
2294                 if (ret < 0 || ret >= end - pos)
2295                         return pos - buf;
2296                 pos += ret;
2297         }
2298
2299         return pos - buf;
2300 }
2301
2302
2303 static int wpa_supplicant_ctrl_iface_select_network(
2304         struct wpa_supplicant *wpa_s, char *cmd)
2305 {
2306         int id;
2307         struct wpa_ssid *ssid;
2308         char *pos;
2309
2310         /* cmd: "<network id>" or "any" */
2311         if (os_strncmp(cmd, "any", 3) == 0) {
2312                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK any");
2313                 ssid = NULL;
2314         } else {
2315                 id = atoi(cmd);
2316                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK id=%d", id);
2317
2318                 ssid = wpa_config_get_network(wpa_s->conf, id);
2319                 if (ssid == NULL) {
2320                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2321                                    "network id=%d", id);
2322                         return -1;
2323                 }
2324                 if (ssid->disabled == 2) {
2325                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
2326                                    "SELECT_NETWORK with persistent P2P group");
2327                         return -1;
2328                 }
2329         }
2330
2331         pos = os_strstr(cmd, " freq=");
2332         if (pos) {
2333                 int *freqs = freq_range_to_channel_list(wpa_s, pos + 6);
2334                 if (freqs) {
2335                         wpa_s->scan_req = MANUAL_SCAN_REQ;
2336                         os_free(wpa_s->manual_scan_freqs);
2337                         wpa_s->manual_scan_freqs = freqs;
2338                 }
2339         }
2340
2341         wpa_supplicant_select_network(wpa_s, ssid);
2342
2343         return 0;
2344 }
2345
2346
2347 static int wpa_supplicant_ctrl_iface_enable_network(
2348         struct wpa_supplicant *wpa_s, char *cmd)
2349 {
2350         int id;
2351         struct wpa_ssid *ssid;
2352
2353         /* cmd: "<network id>" or "all" */
2354         if (os_strcmp(cmd, "all") == 0) {
2355                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK all");
2356                 ssid = NULL;
2357         } else {
2358                 id = atoi(cmd);
2359                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK id=%d", id);
2360
2361                 ssid = wpa_config_get_network(wpa_s->conf, id);
2362                 if (ssid == NULL) {
2363                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2364                                    "network id=%d", id);
2365                         return -1;
2366                 }
2367                 if (ssid->disabled == 2) {
2368                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
2369                                    "ENABLE_NETWORK with persistent P2P group");
2370                         return -1;
2371                 }
2372
2373                 if (os_strstr(cmd, " no-connect")) {
2374                         ssid->disabled = 0;
2375                         return 0;
2376                 }
2377         }
2378         wpa_supplicant_enable_network(wpa_s, ssid);
2379
2380         return 0;
2381 }
2382
2383
2384 static int wpa_supplicant_ctrl_iface_disable_network(
2385         struct wpa_supplicant *wpa_s, char *cmd)
2386 {
2387         int id;
2388         struct wpa_ssid *ssid;
2389
2390         /* cmd: "<network id>" or "all" */
2391         if (os_strcmp(cmd, "all") == 0) {
2392                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK all");
2393                 ssid = NULL;
2394         } else {
2395                 id = atoi(cmd);
2396                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK id=%d", id);
2397
2398                 ssid = wpa_config_get_network(wpa_s->conf, id);
2399                 if (ssid == NULL) {
2400                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2401                                    "network id=%d", id);
2402                         return -1;
2403                 }
2404                 if (ssid->disabled == 2) {
2405                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
2406                                    "DISABLE_NETWORK with persistent P2P "
2407                                    "group");
2408                         return -1;
2409                 }
2410         }
2411         wpa_supplicant_disable_network(wpa_s, ssid);
2412
2413         return 0;
2414 }
2415
2416
2417 static int wpa_supplicant_ctrl_iface_add_network(
2418         struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
2419 {
2420         struct wpa_ssid *ssid;
2421         int ret;
2422
2423         wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_NETWORK");
2424
2425         ssid = wpa_config_add_network(wpa_s->conf);
2426         if (ssid == NULL)
2427                 return -1;
2428
2429         wpas_notify_network_added(wpa_s, ssid);
2430
2431         ssid->disabled = 1;
2432         wpa_config_set_network_defaults(ssid);
2433
2434         ret = os_snprintf(buf, buflen, "%d\n", ssid->id);
2435         if (ret < 0 || (size_t) ret >= buflen)
2436                 return -1;
2437         return ret;
2438 }
2439
2440
2441 static int wpa_supplicant_ctrl_iface_remove_network(
2442         struct wpa_supplicant *wpa_s, char *cmd)
2443 {
2444         int id;
2445         struct wpa_ssid *ssid;
2446         int was_disabled;
2447
2448         /* cmd: "<network id>" or "all" */
2449         if (os_strcmp(cmd, "all") == 0) {
2450                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK all");
2451                 if (wpa_s->sched_scanning)
2452                         wpa_supplicant_cancel_sched_scan(wpa_s);
2453
2454                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2455                 if (wpa_s->current_ssid) {
2456 #ifdef CONFIG_SME
2457                         wpa_s->sme.prev_bssid_set = 0;
2458 #endif /* CONFIG_SME */
2459                         wpa_sm_set_config(wpa_s->wpa, NULL);
2460                         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2461                         wpa_supplicant_deauthenticate(
2462                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2463                 }
2464                 ssid = wpa_s->conf->ssid;
2465                 while (ssid) {
2466                         struct wpa_ssid *remove_ssid = ssid;
2467                         id = ssid->id;
2468                         ssid = ssid->next;
2469                         wpas_notify_network_removed(wpa_s, remove_ssid);
2470                         wpa_config_remove_network(wpa_s->conf, id);
2471                 }
2472                 return 0;
2473         }
2474
2475         id = atoi(cmd);
2476         wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK id=%d", id);
2477
2478         ssid = wpa_config_get_network(wpa_s->conf, id);
2479         if (ssid)
2480                 wpas_notify_network_removed(wpa_s, ssid);
2481         if (ssid == NULL) {
2482                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
2483                            "id=%d", id);
2484                 return -1;
2485         }
2486
2487         if (ssid == wpa_s->current_ssid || wpa_s->current_ssid == NULL) {
2488 #ifdef CONFIG_SME
2489                 wpa_s->sme.prev_bssid_set = 0;
2490 #endif /* CONFIG_SME */
2491                 /*
2492                  * Invalidate the EAP session cache if the current or
2493                  * previously used network is removed.
2494                  */
2495                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2496         }
2497
2498         if (ssid == wpa_s->current_ssid) {
2499                 wpa_sm_set_config(wpa_s->wpa, NULL);
2500                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2501
2502                 wpa_supplicant_deauthenticate(wpa_s,
2503                                               WLAN_REASON_DEAUTH_LEAVING);
2504         }
2505
2506         was_disabled = ssid->disabled;
2507
2508         if (wpa_config_remove_network(wpa_s->conf, id) < 0) {
2509                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Not able to remove the "
2510                            "network id=%d", id);
2511                 return -1;
2512         }
2513
2514         if (!was_disabled && wpa_s->sched_scanning) {
2515                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to remove "
2516                            "network from filters");
2517                 wpa_supplicant_cancel_sched_scan(wpa_s);
2518                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2519         }
2520
2521         return 0;
2522 }
2523
2524
2525 static int wpa_supplicant_ctrl_iface_set_network(
2526         struct wpa_supplicant *wpa_s, char *cmd)
2527 {
2528         int id;
2529         struct wpa_ssid *ssid;
2530         char *name, *value;
2531
2532         /* cmd: "<network id> <variable name> <value>" */
2533         name = os_strchr(cmd, ' ');
2534         if (name == NULL)
2535                 return -1;
2536         *name++ = '\0';
2537
2538         value = os_strchr(name, ' ');
2539         if (value == NULL)
2540                 return -1;
2541         *value++ = '\0';
2542
2543         id = atoi(cmd);
2544         wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_NETWORK id=%d name='%s'",
2545                    id, name);
2546         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
2547                               (u8 *) value, os_strlen(value));
2548
2549         ssid = wpa_config_get_network(wpa_s->conf, id);
2550         if (ssid == NULL) {
2551                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
2552                            "id=%d", id);
2553                 return -1;
2554         }
2555
2556         if (wpa_config_set(ssid, name, value, 0) < 0) {
2557                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set network "
2558                            "variable '%s'", name);
2559                 return -1;
2560         }
2561
2562         if (os_strcmp(name, "bssid") != 0 &&
2563             os_strcmp(name, "priority") != 0)
2564                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
2565
2566         if (wpa_s->current_ssid == ssid || wpa_s->current_ssid == NULL) {
2567                 /*
2568                  * Invalidate the EAP session cache if anything in the current
2569                  * or previously used configuration changes.
2570                  */
2571                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2572         }
2573
2574         if ((os_strcmp(name, "psk") == 0 &&
2575              value[0] == '"' && ssid->ssid_len) ||
2576             (os_strcmp(name, "ssid") == 0 && ssid->passphrase))
2577                 wpa_config_update_psk(ssid);
2578         else if (os_strcmp(name, "priority") == 0)
2579                 wpa_config_update_prio_list(wpa_s->conf);
2580
2581         return 0;
2582 }
2583
2584
2585 static int wpa_supplicant_ctrl_iface_get_network(
2586         struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
2587 {
2588         int id;
2589         size_t res;
2590         struct wpa_ssid *ssid;
2591         char *name, *value;
2592
2593         /* cmd: "<network id> <variable name>" */
2594         name = os_strchr(cmd, ' ');
2595         if (name == NULL || buflen == 0)
2596                 return -1;
2597         *name++ = '\0';
2598
2599         id = atoi(cmd);
2600         wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_NETWORK id=%d name='%s'",
2601                    id, name);
2602
2603         ssid = wpa_config_get_network(wpa_s->conf, id);
2604         if (ssid == NULL) {
2605                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
2606                            "id=%d", id);
2607                 return -1;
2608         }
2609
2610         value = wpa_config_get_no_key(ssid, name);
2611         if (value == NULL) {
2612                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get network "
2613                            "variable '%s'", name);
2614                 return -1;
2615         }
2616
2617         res = os_strlcpy(buf, value, buflen);
2618         if (res >= buflen) {
2619                 os_free(value);
2620                 return -1;
2621         }
2622
2623         os_free(value);
2624
2625         return res;
2626 }
2627
2628
2629 static int wpa_supplicant_ctrl_iface_list_creds(struct wpa_supplicant *wpa_s,
2630                                                 char *buf, size_t buflen)
2631 {
2632         char *pos, *end;
2633         struct wpa_cred *cred;
2634         int ret;
2635
2636         pos = buf;
2637         end = buf + buflen;
2638         ret = os_snprintf(pos, end - pos,
2639                           "cred id / realm / username / domain / imsi\n");
2640         if (ret < 0 || ret >= end - pos)
2641                 return pos - buf;
2642         pos += ret;
2643
2644         cred = wpa_s->conf->cred;
2645         while (cred) {
2646                 ret = os_snprintf(pos, end - pos, "%d\t%s\t%s\t%s\t%s\n",
2647                                   cred->id, cred->realm ? cred->realm : "",
2648                                   cred->username ? cred->username : "",
2649                                   cred->domain ? cred->domain[0] : "",
2650                                   cred->imsi ? cred->imsi : "");
2651                 if (ret < 0 || ret >= end - pos)
2652                         return pos - buf;
2653                 pos += ret;
2654
2655                 cred = cred->next;
2656         }
2657
2658         return pos - buf;
2659 }
2660
2661
2662 static int wpa_supplicant_ctrl_iface_add_cred(struct wpa_supplicant *wpa_s,
2663                                               char *buf, size_t buflen)
2664 {
2665         struct wpa_cred *cred;
2666         int ret;
2667
2668         wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_CRED");
2669
2670         cred = wpa_config_add_cred(wpa_s->conf);
2671         if (cred == NULL)
2672                 return -1;
2673
2674         wpa_msg(wpa_s, MSG_INFO, CRED_ADDED "%d", cred->id);
2675
2676         ret = os_snprintf(buf, buflen, "%d\n", cred->id);
2677         if (ret < 0 || (size_t) ret >= buflen)
2678                 return -1;
2679         return ret;
2680 }
2681
2682
2683 static int wpas_ctrl_remove_cred(struct wpa_supplicant *wpa_s,
2684                                  struct wpa_cred *cred)
2685 {
2686         struct wpa_ssid *ssid;
2687         char str[20];
2688         int id;
2689
2690         if (cred == NULL) {
2691                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred");
2692                 return -1;
2693         }
2694
2695         id = cred->id;
2696         if (wpa_config_remove_cred(wpa_s->conf, id) < 0) {
2697                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred");
2698                 return -1;
2699         }
2700
2701         wpa_msg(wpa_s, MSG_INFO, CRED_REMOVED "%d", id);
2702
2703         /* Remove any network entry created based on the removed credential */
2704         ssid = wpa_s->conf->ssid;
2705         while (ssid) {
2706                 if (ssid->parent_cred == cred) {
2707                         wpa_printf(MSG_DEBUG, "Remove network id %d since it "
2708                                    "used the removed credential", ssid->id);
2709                         os_snprintf(str, sizeof(str), "%d", ssid->id);
2710                         ssid = ssid->next;
2711                         wpa_supplicant_ctrl_iface_remove_network(wpa_s, str);
2712                 } else
2713                         ssid = ssid->next;
2714         }
2715
2716         return 0;
2717 }
2718
2719
2720 static int wpa_supplicant_ctrl_iface_remove_cred(struct wpa_supplicant *wpa_s,
2721                                                  char *cmd)
2722 {
2723         int id;
2724         struct wpa_cred *cred, *prev;
2725
2726         /* cmd: "<cred id>", "all", "sp_fqdn=<FQDN>", or
2727          * "provisioning_sp=<FQDN> */
2728         if (os_strcmp(cmd, "all") == 0) {
2729                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED all");
2730                 cred = wpa_s->conf->cred;
2731                 while (cred) {
2732                         prev = cred;
2733                         cred = cred->next;
2734                         wpas_ctrl_remove_cred(wpa_s, prev);
2735                 }
2736                 return 0;
2737         }
2738
2739         if (os_strncmp(cmd, "sp_fqdn=", 8) == 0) {
2740                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED SP FQDN '%s'",
2741                            cmd + 8);
2742                 cred = wpa_s->conf->cred;
2743                 while (cred) {
2744                         prev = cred;
2745                         cred = cred->next;
2746                         if (prev->domain) {
2747                                 size_t i;
2748                                 for (i = 0; i < prev->num_domain; i++) {
2749                                         if (os_strcmp(prev->domain[i], cmd + 8)
2750                                             != 0)
2751                                                 continue;
2752                                         wpas_ctrl_remove_cred(wpa_s, prev);
2753                                         break;
2754                                 }
2755                         }
2756                 }
2757                 return 0;
2758         }
2759
2760         if (os_strncmp(cmd, "provisioning_sp=", 16) == 0) {
2761                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED provisioning SP FQDN '%s'",
2762                            cmd + 16);
2763                 cred = wpa_s->conf->cred;
2764                 while (cred) {
2765                         prev = cred;
2766                         cred = cred->next;
2767                         if (prev->provisioning_sp &&
2768                             os_strcmp(prev->provisioning_sp, cmd + 16) == 0)
2769                                 wpas_ctrl_remove_cred(wpa_s, prev);
2770                 }
2771                 return 0;
2772         }
2773
2774         id = atoi(cmd);
2775         wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED id=%d", id);
2776
2777         cred = wpa_config_get_cred(wpa_s->conf, id);
2778         return wpas_ctrl_remove_cred(wpa_s, cred);
2779 }
2780
2781
2782 static int wpa_supplicant_ctrl_iface_set_cred(struct wpa_supplicant *wpa_s,
2783                                               char *cmd)
2784 {
2785         int id;
2786         struct wpa_cred *cred;
2787         char *name, *value;
2788
2789         /* cmd: "<cred id> <variable name> <value>" */
2790         name = os_strchr(cmd, ' ');
2791         if (name == NULL)
2792                 return -1;
2793         *name++ = '\0';
2794
2795         value = os_strchr(name, ' ');
2796         if (value == NULL)
2797                 return -1;
2798         *value++ = '\0';
2799
2800         id = atoi(cmd);
2801         wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_CRED id=%d name='%s'",
2802                    id, name);
2803         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
2804                               (u8 *) value, os_strlen(value));
2805
2806         cred = wpa_config_get_cred(wpa_s->conf, id);
2807         if (cred == NULL) {
2808                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
2809                            id);
2810                 return -1;
2811         }
2812
2813         if (wpa_config_set_cred(cred, name, value, 0) < 0) {
2814                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set cred "
2815                            "variable '%s'", name);
2816                 return -1;
2817         }
2818
2819         wpa_msg(wpa_s, MSG_INFO, CRED_MODIFIED "%d %s", cred->id, name);
2820
2821         return 0;
2822 }
2823
2824
2825 static int wpa_supplicant_ctrl_iface_get_cred(struct wpa_supplicant *wpa_s,
2826                                               char *cmd, char *buf,
2827                                               size_t buflen)
2828 {
2829         int id;
2830         size_t res;
2831         struct wpa_cred *cred;
2832         char *name, *value;
2833
2834         /* cmd: "<cred id> <variable name>" */
2835         name = os_strchr(cmd, ' ');
2836         if (name == NULL)
2837                 return -1;
2838         *name++ = '\0';
2839
2840         id = atoi(cmd);
2841         wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CRED id=%d name='%s'",
2842                    id, name);
2843
2844         cred = wpa_config_get_cred(wpa_s->conf, id);
2845         if (cred == NULL) {
2846                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
2847                            id);
2848                 return -1;
2849         }
2850
2851         value = wpa_config_get_cred_no_key(cred, name);
2852         if (value == NULL) {
2853                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get cred variable '%s'",
2854                            name);
2855                 return -1;
2856         }
2857
2858         res = os_strlcpy(buf, value, buflen);
2859         if (res >= buflen) {
2860                 os_free(value);
2861                 return -1;
2862         }
2863
2864         os_free(value);
2865
2866         return res;
2867 }
2868
2869
2870 #ifndef CONFIG_NO_CONFIG_WRITE
2871 static int wpa_supplicant_ctrl_iface_save_config(struct wpa_supplicant *wpa_s)
2872 {
2873         int ret;
2874
2875         if (!wpa_s->conf->update_config) {
2876                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed "
2877                            "to update configuration (update_config=0)");
2878                 return -1;
2879         }
2880
2881         ret = wpa_config_write(wpa_s->confname, wpa_s->conf);
2882         if (ret) {
2883                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to "
2884                            "update configuration");
2885         } else {
2886                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration"
2887                            " updated");
2888         }
2889
2890         return ret;
2891 }
2892 #endif /* CONFIG_NO_CONFIG_WRITE */
2893
2894
2895 struct cipher_info {
2896         unsigned int capa;
2897         const char *name;
2898         int group_only;
2899 };
2900
2901 static const struct cipher_info ciphers[] = {
2902         { WPA_DRIVER_CAPA_ENC_CCMP_256, "CCMP-256", 0 },
2903         { WPA_DRIVER_CAPA_ENC_GCMP_256, "GCMP-256", 0 },
2904         { WPA_DRIVER_CAPA_ENC_CCMP, "CCMP", 0 },
2905         { WPA_DRIVER_CAPA_ENC_GCMP, "GCMP", 0 },
2906         { WPA_DRIVER_CAPA_ENC_TKIP, "TKIP", 0 },
2907         { WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE, "NONE", 0 },
2908         { WPA_DRIVER_CAPA_ENC_WEP104, "WEP104", 1 },
2909         { WPA_DRIVER_CAPA_ENC_WEP40, "WEP40", 1 }
2910 };
2911
2912
2913 static int ctrl_iface_get_capability_pairwise(int res, char *strict,
2914                                               struct wpa_driver_capa *capa,
2915                                               char *buf, size_t buflen)
2916 {
2917         int ret;
2918         char *pos, *end;
2919         size_t len;
2920         unsigned int i;
2921
2922         pos = buf;
2923         end = pos + buflen;
2924
2925         if (res < 0) {
2926                 if (strict)
2927                         return 0;
2928                 len = os_strlcpy(buf, "CCMP TKIP NONE", buflen);
2929                 if (len >= buflen)
2930                         return -1;
2931                 return len;
2932         }
2933
2934         for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
2935                 if (!ciphers[i].group_only && capa->enc & ciphers[i].capa) {
2936                         ret = os_snprintf(pos, end - pos, "%s%s",
2937                                           pos == buf ? "" : " ",
2938                                           ciphers[i].name);
2939                         if (ret < 0 || ret >= end - pos)
2940                                 return pos - buf;
2941                         pos += ret;
2942                 }
2943         }
2944
2945         return pos - buf;
2946 }
2947
2948
2949 static int ctrl_iface_get_capability_group(int res, char *strict,
2950                                            struct wpa_driver_capa *capa,
2951                                            char *buf, size_t buflen)
2952 {
2953         int ret;
2954         char *pos, *end;
2955         size_t len;
2956         unsigned int i;
2957
2958         pos = buf;
2959         end = pos + buflen;
2960
2961         if (res < 0) {
2962                 if (strict)
2963                         return 0;
2964                 len = os_strlcpy(buf, "CCMP TKIP WEP104 WEP40", buflen);
2965                 if (len >= buflen)
2966                         return -1;
2967                 return len;
2968         }
2969
2970         for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
2971                 if (capa->enc & ciphers[i].capa) {
2972                         ret = os_snprintf(pos, end - pos, "%s%s",
2973                                           pos == buf ? "" : " ",
2974                                           ciphers[i].name);
2975                         if (ret < 0 || ret >= end - pos)
2976                                 return pos - buf;
2977                         pos += ret;
2978                 }
2979         }
2980
2981         return pos - buf;
2982 }
2983
2984
2985 static int ctrl_iface_get_capability_key_mgmt(int res, char *strict,
2986                                               struct wpa_driver_capa *capa,
2987                                               char *buf, size_t buflen)
2988 {
2989         int ret;
2990         char *pos, *end;
2991         size_t len;
2992
2993         pos = buf;
2994         end = pos + buflen;
2995
2996         if (res < 0) {
2997                 if (strict)
2998                         return 0;
2999                 len = os_strlcpy(buf, "WPA-PSK WPA-EAP IEEE8021X WPA-NONE "
3000                                  "NONE", buflen);
3001                 if (len >= buflen)
3002                         return -1;
3003                 return len;
3004         }
3005
3006         ret = os_snprintf(pos, end - pos, "NONE IEEE8021X");
3007         if (ret < 0 || ret >= end - pos)
3008                 return pos - buf;
3009         pos += ret;
3010
3011         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3012                               WPA_DRIVER_CAPA_KEY_MGMT_WPA2)) {
3013                 ret = os_snprintf(pos, end - pos, " WPA-EAP");
3014                 if (ret < 0 || ret >= end - pos)
3015                         return pos - buf;
3016                 pos += ret;
3017         }
3018
3019         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
3020                               WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
3021                 ret = os_snprintf(pos, end - pos, " WPA-PSK");
3022                 if (ret < 0 || ret >= end - pos)
3023                         return pos - buf;
3024                 pos += ret;
3025         }
3026
3027         if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE) {
3028                 ret = os_snprintf(pos, end - pos, " WPA-NONE");
3029                 if (ret < 0 || ret >= end - pos)
3030                         return pos - buf;
3031                 pos += ret;
3032         }
3033
3034         return pos - buf;
3035 }
3036
3037
3038 static int ctrl_iface_get_capability_proto(int res, char *strict,
3039                                            struct wpa_driver_capa *capa,
3040                                            char *buf, size_t buflen)
3041 {
3042         int ret;
3043         char *pos, *end;
3044         size_t len;
3045
3046         pos = buf;
3047         end = pos + buflen;
3048
3049         if (res < 0) {
3050                 if (strict)
3051                         return 0;
3052                 len = os_strlcpy(buf, "RSN WPA", buflen);
3053                 if (len >= buflen)
3054                         return -1;
3055                 return len;
3056         }
3057
3058         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
3059                               WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
3060                 ret = os_snprintf(pos, end - pos, "%sRSN",
3061                                   pos == buf ? "" : " ");
3062                 if (ret < 0 || ret >= end - pos)
3063                         return pos - buf;
3064                 pos += ret;
3065         }
3066
3067         if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3068                               WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK)) {
3069                 ret = os_snprintf(pos, end - pos, "%sWPA",
3070                                   pos == buf ? "" : " ");
3071                 if (ret < 0 || ret >= end - pos)
3072                         return pos - buf;
3073                 pos += ret;
3074         }
3075
3076         return pos - buf;
3077 }
3078
3079
3080 static int ctrl_iface_get_capability_auth_alg(int res, char *strict,
3081                                               struct wpa_driver_capa *capa,
3082                                               char *buf, size_t buflen)
3083 {
3084         int ret;
3085         char *pos, *end;
3086         size_t len;
3087
3088         pos = buf;
3089         end = pos + buflen;
3090
3091         if (res < 0) {
3092                 if (strict)
3093                         return 0;
3094                 len = os_strlcpy(buf, "OPEN SHARED LEAP", buflen);
3095                 if (len >= buflen)
3096                         return -1;
3097                 return len;
3098         }
3099
3100         if (capa->auth & (WPA_DRIVER_AUTH_OPEN)) {
3101                 ret = os_snprintf(pos, end - pos, "%sOPEN",
3102                                   pos == buf ? "" : " ");
3103                 if (ret < 0 || ret >= end - pos)
3104                         return pos - buf;
3105                 pos += ret;
3106         }
3107
3108         if (capa->auth & (WPA_DRIVER_AUTH_SHARED)) {
3109                 ret = os_snprintf(pos, end - pos, "%sSHARED",
3110                                   pos == buf ? "" : " ");
3111                 if (ret < 0 || ret >= end - pos)
3112                         return pos - buf;
3113                 pos += ret;
3114         }
3115
3116         if (capa->auth & (WPA_DRIVER_AUTH_LEAP)) {
3117                 ret = os_snprintf(pos, end - pos, "%sLEAP",
3118                                   pos == buf ? "" : " ");
3119                 if (ret < 0 || ret >= end - pos)
3120                         return pos - buf;
3121                 pos += ret;
3122         }
3123
3124         return pos - buf;
3125 }
3126
3127
3128 static int ctrl_iface_get_capability_modes(int res, char *strict,
3129                                            struct wpa_driver_capa *capa,
3130                                            char *buf, size_t buflen)
3131 {
3132         int ret;
3133         char *pos, *end;
3134         size_t len;
3135
3136         pos = buf;
3137         end = pos + buflen;
3138
3139         if (res < 0) {
3140                 if (strict)
3141                         return 0;
3142                 len = os_strlcpy(buf, "IBSS AP", buflen);
3143                 if (len >= buflen)
3144                         return -1;
3145                 return len;
3146         }
3147
3148         if (capa->flags & WPA_DRIVER_FLAGS_IBSS) {
3149                 ret = os_snprintf(pos, end - pos, "%sIBSS",
3150                                   pos == buf ? "" : " ");
3151                 if (ret < 0 || ret >= end - pos)
3152                         return pos - buf;
3153                 pos += ret;
3154         }
3155
3156         if (capa->flags & WPA_DRIVER_FLAGS_AP) {
3157                 ret = os_snprintf(pos, end - pos, "%sAP",
3158                                   pos == buf ? "" : " ");
3159                 if (ret < 0 || ret >= end - pos)
3160                         return pos - buf;
3161                 pos += ret;
3162         }
3163
3164         return pos - buf;
3165 }
3166
3167
3168 static int ctrl_iface_get_capability_channels(struct wpa_supplicant *wpa_s,
3169                                               char *buf, size_t buflen)
3170 {
3171         struct hostapd_channel_data *chnl;
3172         int ret, i, j;
3173         char *pos, *end, *hmode;
3174
3175         pos = buf;
3176         end = pos + buflen;
3177
3178         for (j = 0; j < wpa_s->hw.num_modes; j++) {
3179                 switch (wpa_s->hw.modes[j].mode) {
3180                 case HOSTAPD_MODE_IEEE80211B:
3181                         hmode = "B";
3182                         break;
3183                 case HOSTAPD_MODE_IEEE80211G:
3184                         hmode = "G";
3185                         break;
3186                 case HOSTAPD_MODE_IEEE80211A:
3187                         hmode = "A";
3188                         break;
3189                 case HOSTAPD_MODE_IEEE80211AD:
3190                         hmode = "AD";
3191                         break;
3192                 default:
3193                         continue;
3194                 }
3195                 ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:", hmode);
3196                 if (ret < 0 || ret >= end - pos)
3197                         return pos - buf;
3198                 pos += ret;
3199                 chnl = wpa_s->hw.modes[j].channels;
3200                 for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
3201                         if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
3202                                 continue;
3203                         ret = os_snprintf(pos, end - pos, " %d", chnl[i].chan);
3204                         if (ret < 0 || ret >= end - pos)
3205                                 return pos - buf;
3206                         pos += ret;
3207                 }
3208                 ret = os_snprintf(pos, end - pos, "\n");
3209                 if (ret < 0 || ret >= end - pos)
3210                         return pos - buf;
3211                 pos += ret;
3212         }
3213
3214         return pos - buf;
3215 }
3216
3217
3218 static int ctrl_iface_get_capability_freq(struct wpa_supplicant *wpa_s,
3219                                           char *buf, size_t buflen)
3220 {
3221         struct hostapd_channel_data *chnl;
3222         int ret, i, j;
3223         char *pos, *end, *hmode;
3224
3225         pos = buf;
3226         end = pos + buflen;
3227
3228         for (j = 0; j < wpa_s->hw.num_modes; j++) {
3229                 switch (wpa_s->hw.modes[j].mode) {
3230                 case HOSTAPD_MODE_IEEE80211B:
3231                         hmode = "B";
3232                         break;
3233                 case HOSTAPD_MODE_IEEE80211G:
3234                         hmode = "G";
3235                         break;
3236                 case HOSTAPD_MODE_IEEE80211A:
3237                         hmode = "A";
3238                         break;
3239                 case HOSTAPD_MODE_IEEE80211AD:
3240                         hmode = "AD";
3241                         break;
3242                 default:
3243                         continue;
3244                 }
3245                 ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:\n",
3246                                   hmode);
3247                 if (ret < 0 || ret >= end - pos)
3248                         return pos - buf;
3249                 pos += ret;
3250                 chnl = wpa_s->hw.modes[j].channels;
3251                 for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
3252                         if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
3253                                 continue;
3254                         ret = os_snprintf(pos, end - pos, " %d = %d MHz%s%s\n",
3255                                           chnl[i].chan, chnl[i].freq,
3256                                           chnl[i].flag & HOSTAPD_CHAN_NO_IBSS ?
3257                                           " (NO_IBSS)" : "",
3258                                           chnl[i].flag & HOSTAPD_CHAN_RADAR ?
3259                                           " (DFS)" : "");
3260
3261                         if (ret < 0 || ret >= end - pos)
3262                                 return pos - buf;
3263                         pos += ret;
3264                 }
3265                 ret = os_snprintf(pos, end - pos, "\n");
3266                 if (ret < 0 || ret >= end - pos)
3267                         return pos - buf;
3268                 pos += ret;
3269         }
3270
3271         return pos - buf;
3272 }
3273
3274
3275 static int wpa_supplicant_ctrl_iface_get_capability(
3276         struct wpa_supplicant *wpa_s, const char *_field, char *buf,
3277         size_t buflen)
3278 {
3279         struct wpa_driver_capa capa;
3280         int res;
3281         char *strict;
3282         char field[30];
3283         size_t len;
3284
3285         /* Determine whether or not strict checking was requested */
3286         len = os_strlcpy(field, _field, sizeof(field));
3287         if (len >= sizeof(field))
3288                 return -1;
3289         strict = os_strchr(field, ' ');
3290         if (strict != NULL) {
3291                 *strict++ = '\0';
3292                 if (os_strcmp(strict, "strict") != 0)
3293                         return -1;
3294         }
3295
3296         wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CAPABILITY '%s' %s",
3297                 field, strict ? strict : "");
3298
3299         if (os_strcmp(field, "eap") == 0) {
3300                 return eap_get_names(buf, buflen);
3301         }
3302
3303         res = wpa_drv_get_capa(wpa_s, &capa);
3304
3305         if (os_strcmp(field, "pairwise") == 0)
3306                 return ctrl_iface_get_capability_pairwise(res, strict, &capa,
3307                                                           buf, buflen);
3308
3309         if (os_strcmp(field, "group") == 0)
3310                 return ctrl_iface_get_capability_group(res, strict, &capa,
3311                                                        buf, buflen);
3312
3313         if (os_strcmp(field, "key_mgmt") == 0)
3314                 return ctrl_iface_get_capability_key_mgmt(res, strict, &capa,
3315                                                           buf, buflen);
3316
3317         if (os_strcmp(field, "proto") == 0)
3318                 return ctrl_iface_get_capability_proto(res, strict, &capa,
3319                                                        buf, buflen);
3320
3321         if (os_strcmp(field, "auth_alg") == 0)
3322                 return ctrl_iface_get_capability_auth_alg(res, strict, &capa,
3323                                                           buf, buflen);
3324
3325         if (os_strcmp(field, "modes") == 0)
3326                 return ctrl_iface_get_capability_modes(res, strict, &capa,
3327                                                        buf, buflen);
3328
3329         if (os_strcmp(field, "channels") == 0)
3330                 return ctrl_iface_get_capability_channels(wpa_s, buf, buflen);
3331
3332         if (os_strcmp(field, "freq") == 0)
3333                 return ctrl_iface_get_capability_freq(wpa_s, buf, buflen);
3334
3335 #ifdef CONFIG_TDLS
3336         if (os_strcmp(field, "tdls") == 0)
3337                 return ctrl_iface_get_capability_tdls(wpa_s, buf, buflen);
3338 #endif /* CONFIG_TDLS */
3339
3340         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown GET_CAPABILITY field '%s'",
3341                    field);
3342
3343         return -1;
3344 }
3345
3346
3347 #ifdef CONFIG_INTERWORKING
3348 static char * anqp_add_hex(char *pos, char *end, const char *title,
3349                            struct wpabuf *data)
3350 {
3351         char *start = pos;
3352         size_t i;
3353         int ret;
3354         const u8 *d;
3355
3356         if (data == NULL)
3357                 return start;
3358
3359         ret = os_snprintf(pos, end - pos, "%s=", title);
3360         if (ret < 0 || ret >= end - pos)
3361                 return start;
3362         pos += ret;
3363
3364         d = wpabuf_head_u8(data);
3365         for (i = 0; i < wpabuf_len(data); i++) {
3366                 ret = os_snprintf(pos, end - pos, "%02x", *d++);
3367                 if (ret < 0 || ret >= end - pos)
3368                         return start;
3369                 pos += ret;
3370         }
3371
3372         ret = os_snprintf(pos, end - pos, "\n");
3373         if (ret < 0 || ret >= end - pos)
3374                 return start;
3375         pos += ret;
3376
3377         return pos;
3378 }
3379 #endif /* CONFIG_INTERWORKING */
3380
3381
3382 static int print_bss_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
3383                           unsigned long mask, char *buf, size_t buflen)
3384 {
3385         size_t i;
3386         int ret;
3387         char *pos, *end;
3388         const u8 *ie, *ie2;
3389
3390         pos = buf;
3391         end = buf + buflen;
3392
3393         if (mask & WPA_BSS_MASK_ID) {
3394                 ret = os_snprintf(pos, end - pos, "id=%u\n", bss->id);
3395                 if (ret < 0 || ret >= end - pos)
3396                         return 0;
3397                 pos += ret;
3398         }
3399
3400         if (mask & WPA_BSS_MASK_BSSID) {
3401                 ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
3402                                   MAC2STR(bss->bssid));
3403                 if (ret < 0 || ret >= end - pos)
3404                         return 0;
3405                 pos += ret;
3406         }
3407
3408         if (mask & WPA_BSS_MASK_FREQ) {
3409                 ret = os_snprintf(pos, end - pos, "freq=%d\n", bss->freq);
3410                 if (ret < 0 || ret >= end - pos)
3411                         return 0;
3412                 pos += ret;
3413         }
3414
3415         if (mask & WPA_BSS_MASK_BEACON_INT) {
3416                 ret = os_snprintf(pos, end - pos, "beacon_int=%d\n",
3417                                   bss->beacon_int);
3418                 if (ret < 0 || ret >= end - pos)
3419                         return 0;
3420                 pos += ret;
3421         }
3422
3423         if (mask & WPA_BSS_MASK_CAPABILITIES) {
3424                 ret = os_snprintf(pos, end - pos, "capabilities=0x%04x\n",
3425                                   bss->caps);
3426                 if (ret < 0 || ret >= end - pos)
3427                         return 0;
3428                 pos += ret;
3429         }
3430
3431         if (mask & WPA_BSS_MASK_QUAL) {
3432                 ret = os_snprintf(pos, end - pos, "qual=%d\n", bss->qual);
3433                 if (ret < 0 || ret >= end - pos)
3434                         return 0;
3435                 pos += ret;
3436         }
3437
3438         if (mask & WPA_BSS_MASK_NOISE) {
3439                 ret = os_snprintf(pos, end - pos, "noise=%d\n", bss->noise);
3440                 if (ret < 0 || ret >= end - pos)
3441                         return 0;
3442                 pos += ret;
3443         }
3444
3445         if (mask & WPA_BSS_MASK_LEVEL) {
3446                 ret = os_snprintf(pos, end - pos, "level=%d\n", bss->level);
3447                 if (ret < 0 || ret >= end - pos)
3448                         return 0;
3449                 pos += ret;
3450         }
3451
3452         if (mask & WPA_BSS_MASK_TSF) {
3453                 ret = os_snprintf(pos, end - pos, "tsf=%016llu\n",
3454                                   (unsigned long long) bss->tsf);
3455                 if (ret < 0 || ret >= end - pos)
3456                         return 0;
3457                 pos += ret;
3458         }
3459
3460         if (mask & WPA_BSS_MASK_AGE) {
3461                 struct os_reltime now;
3462
3463                 os_get_reltime(&now);
3464                 ret = os_snprintf(pos, end - pos, "age=%d\n",
3465                                   (int) (now.sec - bss->last_update.sec));
3466                 if (ret < 0 || ret >= end - pos)
3467                         return 0;
3468                 pos += ret;
3469         }
3470
3471         if (mask & WPA_BSS_MASK_IE) {
3472                 ret = os_snprintf(pos, end - pos, "ie=");
3473                 if (ret < 0 || ret >= end - pos)
3474                         return 0;
3475                 pos += ret;
3476
3477                 ie = (const u8 *) (bss + 1);
3478                 for (i = 0; i < bss->ie_len; i++) {
3479                         ret = os_snprintf(pos, end - pos, "%02x", *ie++);
3480                         if (ret < 0 || ret >= end - pos)
3481                                 return 0;
3482                         pos += ret;
3483                 }
3484
3485                 ret = os_snprintf(pos, end - pos, "\n");
3486                 if (ret < 0 || ret >= end - pos)
3487                         return 0;
3488                 pos += ret;
3489         }
3490
3491         if (mask & WPA_BSS_MASK_FLAGS) {
3492                 ret = os_snprintf(pos, end - pos, "flags=");
3493                 if (ret < 0 || ret >= end - pos)
3494                         return 0;
3495                 pos += ret;
3496
3497                 ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
3498                 if (ie)
3499                         pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie,
3500                                                     2 + ie[1]);
3501                 ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
3502                 if (ie2)
3503                         pos = wpa_supplicant_ie_txt(pos, end, "WPA2", ie2,
3504                                                     2 + ie2[1]);
3505                 pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
3506                 if (!ie && !ie2 && bss->caps & IEEE80211_CAP_PRIVACY) {
3507                         ret = os_snprintf(pos, end - pos, "[WEP]");
3508                         if (ret < 0 || ret >= end - pos)
3509                                 return 0;
3510                         pos += ret;
3511                 }
3512                 if (bss->caps & IEEE80211_CAP_IBSS) {
3513                         ret = os_snprintf(pos, end - pos, "[IBSS]");
3514                         if (ret < 0 || ret >= end - pos)
3515                                 return 0;
3516                         pos += ret;
3517                 }
3518                 if (bss->caps & IEEE80211_CAP_ESS) {
3519                         ret = os_snprintf(pos, end - pos, "[ESS]");
3520                         if (ret < 0 || ret >= end - pos)
3521                                 return 0;
3522                         pos += ret;
3523                 }
3524                 if (wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE) ||
3525                     wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE)) {
3526                         ret = os_snprintf(pos, end - pos, "[P2P]");
3527                         if (ret < 0 || ret >= end - pos)
3528                                 return 0;
3529                         pos += ret;
3530                 }
3531 #ifdef CONFIG_HS20
3532                 if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
3533                         ret = os_snprintf(pos, end - pos, "[HS20]");
3534                         if (ret < 0 || ret >= end - pos)
3535                                 return 0;
3536                         pos += ret;
3537                 }
3538 #endif /* CONFIG_HS20 */
3539
3540                 ret = os_snprintf(pos, end - pos, "\n");
3541                 if (ret < 0 || ret >= end - pos)
3542                         return 0;
3543                 pos += ret;
3544         }
3545
3546         if (mask & WPA_BSS_MASK_SSID) {
3547                 ret = os_snprintf(pos, end - pos, "ssid=%s\n",
3548                                   wpa_ssid_txt(bss->ssid, bss->ssid_len));
3549                 if (ret < 0 || ret >= end - pos)
3550                         return 0;
3551                 pos += ret;
3552         }
3553
3554 #ifdef CONFIG_WPS
3555         if (mask & WPA_BSS_MASK_WPS_SCAN) {
3556                 ie = (const u8 *) (bss + 1);
3557                 ret = wpas_wps_scan_result_text(ie, bss->ie_len, pos, end);
3558                 if (ret < 0 || ret >= end - pos)
3559                         return 0;
3560                 pos += ret;
3561         }
3562 #endif /* CONFIG_WPS */
3563
3564 #ifdef CONFIG_P2P
3565         if (mask & WPA_BSS_MASK_P2P_SCAN) {
3566                 ie = (const u8 *) (bss + 1);
3567                 ret = wpas_p2p_scan_result_text(ie, bss->ie_len, pos, end);
3568                 if (ret < 0 || ret >= end - pos)
3569                         return 0;
3570                 pos += ret;
3571         }
3572 #endif /* CONFIG_P2P */
3573
3574 #ifdef CONFIG_WIFI_DISPLAY
3575         if (mask & WPA_BSS_MASK_WIFI_DISPLAY) {
3576                 struct wpabuf *wfd;
3577                 ie = (const u8 *) (bss + 1);
3578                 wfd = ieee802_11_vendor_ie_concat(ie, bss->ie_len,
3579                                                   WFD_IE_VENDOR_TYPE);
3580                 if (wfd) {
3581                         ret = os_snprintf(pos, end - pos, "wfd_subelems=");
3582                         if (ret < 0 || ret >= end - pos) {
3583                                 wpabuf_free(wfd);
3584                                 return 0;
3585                         }
3586                         pos += ret;
3587
3588                         pos += wpa_snprintf_hex(pos, end - pos,
3589                                                 wpabuf_head(wfd),
3590                                                 wpabuf_len(wfd));
3591                         wpabuf_free(wfd);
3592
3593                         ret = os_snprintf(pos, end - pos, "\n");
3594                         if (ret < 0 || ret >= end - pos)
3595                                 return 0;
3596                         pos += ret;
3597                 }
3598         }
3599 #endif /* CONFIG_WIFI_DISPLAY */
3600
3601 #ifdef CONFIG_INTERWORKING
3602         if ((mask & WPA_BSS_MASK_INTERNETW) && bss->anqp) {
3603                 struct wpa_bss_anqp *anqp = bss->anqp;
3604                 pos = anqp_add_hex(pos, end, "anqp_venue_name",
3605                                    anqp->venue_name);
3606                 pos = anqp_add_hex(pos, end, "anqp_network_auth_type",
3607                                    anqp->network_auth_type);
3608                 pos = anqp_add_hex(pos, end, "anqp_roaming_consortium",
3609                                    anqp->roaming_consortium);
3610                 pos = anqp_add_hex(pos, end, "anqp_ip_addr_type_availability",
3611                                    anqp->ip_addr_type_availability);
3612                 pos = anqp_add_hex(pos, end, "anqp_nai_realm",
3613                                    anqp->nai_realm);
3614                 pos = anqp_add_hex(pos, end, "anqp_3gpp", anqp->anqp_3gpp);
3615                 pos = anqp_add_hex(pos, end, "anqp_domain_name",
3616                                    anqp->domain_name);
3617 #ifdef CONFIG_HS20
3618                 pos = anqp_add_hex(pos, end, "hs20_operator_friendly_name",
3619                                    anqp->hs20_operator_friendly_name);
3620                 pos = anqp_add_hex(pos, end, "hs20_wan_metrics",
3621                                    anqp->hs20_wan_metrics);
3622                 pos = anqp_add_hex(pos, end, "hs20_connection_capability",
3623                                    anqp->hs20_connection_capability);
3624                 pos = anqp_add_hex(pos, end, "hs20_operating_class",
3625                                    anqp->hs20_operating_class);
3626                 pos = anqp_add_hex(pos, end, "hs20_osu_providers_list",
3627                                    anqp->hs20_osu_providers_list);
3628 #endif /* CONFIG_HS20 */
3629         }
3630 #endif /* CONFIG_INTERWORKING */
3631
3632         if (mask & WPA_BSS_MASK_DELIM) {
3633                 ret = os_snprintf(pos, end - pos, "====\n");
3634                 if (ret < 0 || ret >= end - pos)
3635                         return 0;
3636                 pos += ret;
3637         }
3638
3639         return pos - buf;
3640 }
3641
3642
3643 static int wpa_supplicant_ctrl_iface_bss(struct wpa_supplicant *wpa_s,
3644                                          const char *cmd, char *buf,
3645                                          size_t buflen)
3646 {
3647         u8 bssid[ETH_ALEN];
3648         size_t i;
3649         struct wpa_bss *bss;
3650         struct wpa_bss *bsslast = NULL;
3651         struct dl_list *next;
3652         int ret = 0;
3653         int len;
3654         char *ctmp;
3655         unsigned long mask = WPA_BSS_MASK_ALL;
3656
3657         if (os_strncmp(cmd, "RANGE=", 6) == 0) {
3658                 if (os_strncmp(cmd + 6, "ALL", 3) == 0) {
3659                         bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss,
3660                                             list_id);
3661                         bsslast = dl_list_last(&wpa_s->bss_id, struct wpa_bss,
3662                                                list_id);
3663                 } else { /* N1-N2 */
3664                         unsigned int id1, id2;
3665
3666                         if ((ctmp = os_strchr(cmd + 6, '-')) == NULL) {
3667                                 wpa_printf(MSG_INFO, "Wrong BSS range "
3668                                            "format");
3669                                 return 0;
3670                         }
3671
3672                         if (*(cmd + 6) == '-')
3673                                 id1 = 0;
3674                         else
3675                                 id1 = atoi(cmd + 6);
3676                         ctmp++;
3677                         if (*ctmp >= '0' && *ctmp <= '9')
3678                                 id2 = atoi(ctmp);
3679                         else
3680                                 id2 = (unsigned int) -1;
3681                         bss = wpa_bss_get_id_range(wpa_s, id1, id2);
3682                         if (id2 == (unsigned int) -1)
3683                                 bsslast = dl_list_last(&wpa_s->bss_id,
3684                                                        struct wpa_bss,
3685                                                        list_id);
3686                         else {
3687                                 bsslast = wpa_bss_get_id(wpa_s, id2);
3688                                 if (bsslast == NULL && bss && id2 > id1) {
3689                                         struct wpa_bss *tmp = bss;
3690                                         for (;;) {
3691                                                 next = tmp->list_id.next;
3692                                                 if (next == &wpa_s->bss_id)
3693                                                         break;
3694                                                 tmp = dl_list_entry(
3695                                                         next, struct wpa_bss,
3696                                                         list_id);
3697                                                 if (tmp->id > id2)
3698                                                         break;
3699                                                 bsslast = tmp;
3700                                         }
3701                                 }
3702                         }
3703                 }
3704         } else if (os_strncmp(cmd, "FIRST", 5) == 0)
3705                 bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss, list_id);
3706         else if (os_strncmp(cmd, "LAST", 4) == 0)
3707                 bss = dl_list_last(&wpa_s->bss_id, struct wpa_bss, list_id);
3708         else if (os_strncmp(cmd, "ID-", 3) == 0) {
3709                 i = atoi(cmd + 3);
3710                 bss = wpa_bss_get_id(wpa_s, i);
3711         } else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
3712                 i = atoi(cmd + 5);
3713                 bss = wpa_bss_get_id(wpa_s, i);
3714                 if (bss) {
3715                         next = bss->list_id.next;
3716                         if (next == &wpa_s->bss_id)
3717                                 bss = NULL;
3718                         else
3719                                 bss = dl_list_entry(next, struct wpa_bss,
3720                                                     list_id);
3721                 }
3722 #ifdef CONFIG_P2P
3723         } else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
3724                 if (hwaddr_aton(cmd + 13, bssid) == 0)
3725                         bss = wpa_bss_get_p2p_dev_addr(wpa_s, bssid);
3726                 else
3727                         bss = NULL;
3728 #endif /* CONFIG_P2P */
3729         } else if (hwaddr_aton(cmd, bssid) == 0)
3730                 bss = wpa_bss_get_bssid(wpa_s, bssid);
3731         else {
3732                 struct wpa_bss *tmp;
3733                 i = atoi(cmd);
3734                 bss = NULL;
3735                 dl_list_for_each(tmp, &wpa_s->bss_id, struct wpa_bss, list_id)
3736                 {
3737                         if (i-- == 0) {
3738                                 bss = tmp;
3739                                 break;
3740                         }
3741                 }
3742         }
3743
3744         if ((ctmp = os_strstr(cmd, "MASK=")) != NULL) {
3745                 mask = strtoul(ctmp + 5, NULL, 0x10);
3746                 if (mask == 0)
3747                         mask = WPA_BSS_MASK_ALL;
3748         }
3749
3750         if (bss == NULL)
3751                 return 0;
3752
3753         if (bsslast == NULL)
3754                 bsslast = bss;
3755         do {
3756                 len = print_bss_info(wpa_s, bss, mask, buf, buflen);
3757                 ret += len;
3758                 buf += len;
3759                 buflen -= len;
3760                 if (bss == bsslast) {
3761                         if ((mask & WPA_BSS_MASK_DELIM) && len &&
3762                             (bss == dl_list_last(&wpa_s->bss_id,
3763                                                  struct wpa_bss, list_id)))
3764                                 os_snprintf(buf - 5, 5, "####\n");
3765                         break;
3766                 }
3767                 next = bss->list_id.next;
3768                 if (next == &wpa_s->bss_id)
3769                         break;
3770                 bss = dl_list_entry(next, struct wpa_bss, list_id);
3771         } while (bss && len);
3772
3773         return ret;
3774 }
3775
3776
3777 static int wpa_supplicant_ctrl_iface_ap_scan(
3778         struct wpa_supplicant *wpa_s, char *cmd)
3779 {
3780         int ap_scan = atoi(cmd);
3781         return wpa_supplicant_set_ap_scan(wpa_s, ap_scan);
3782 }
3783
3784
3785 static int wpa_supplicant_ctrl_iface_scan_interval(
3786         struct wpa_supplicant *wpa_s, char *cmd)
3787 {
3788         int scan_int = atoi(cmd);
3789         return wpa_supplicant_set_scan_interval(wpa_s, scan_int);
3790 }
3791
3792
3793 static int wpa_supplicant_ctrl_iface_bss_expire_age(
3794         struct wpa_supplicant *wpa_s, char *cmd)
3795 {
3796         int expire_age = atoi(cmd);
3797         return wpa_supplicant_set_bss_expiration_age(wpa_s, expire_age);
3798 }
3799
3800
3801 static int wpa_supplicant_ctrl_iface_bss_expire_count(
3802         struct wpa_supplicant *wpa_s, char *cmd)
3803 {
3804         int expire_count = atoi(cmd);
3805         return wpa_supplicant_set_bss_expiration_count(wpa_s, expire_count);
3806 }
3807
3808
3809 static int wpa_supplicant_ctrl_iface_bss_flush(
3810         struct wpa_supplicant *wpa_s, char *cmd)
3811 {
3812         int flush_age = atoi(cmd);
3813
3814         if (flush_age == 0)
3815                 wpa_bss_flush(wpa_s);
3816         else
3817                 wpa_bss_flush_by_age(wpa_s, flush_age);
3818         return 0;
3819 }
3820
3821
3822 static void wpa_supplicant_ctrl_iface_drop_sa(struct wpa_supplicant *wpa_s)
3823 {
3824         wpa_printf(MSG_DEBUG, "Dropping SA without deauthentication");
3825         /* MLME-DELETEKEYS.request */
3826         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 0, 0, NULL, 0, NULL, 0);
3827         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 1, 0, NULL, 0, NULL, 0);
3828         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 2, 0, NULL, 0, NULL, 0);
3829         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 3, 0, NULL, 0, NULL, 0);
3830 #ifdef CONFIG_IEEE80211W
3831         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 4, 0, NULL, 0, NULL, 0);
3832         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 5, 0, NULL, 0, NULL, 0);
3833 #endif /* CONFIG_IEEE80211W */
3834
3835         wpa_drv_set_key(wpa_s, WPA_ALG_NONE, wpa_s->bssid, 0, 0, NULL, 0, NULL,
3836                         0);
3837         /* MLME-SETPROTECTION.request(None) */
3838         wpa_drv_mlme_setprotection(wpa_s, wpa_s->bssid,
3839                                    MLME_SETPROTECTION_PROTECT_TYPE_NONE,
3840                                    MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
3841         wpa_sm_drop_sa(wpa_s->wpa);
3842 }
3843
3844
3845 static int wpa_supplicant_ctrl_iface_roam(struct wpa_supplicant *wpa_s,
3846                                           char *addr)
3847 {
3848 #ifdef CONFIG_NO_SCAN_PROCESSING
3849         return -1;
3850 #else /* CONFIG_NO_SCAN_PROCESSING */
3851         u8 bssid[ETH_ALEN];
3852         struct wpa_bss *bss;
3853         struct wpa_ssid *ssid = wpa_s->current_ssid;
3854
3855         if (hwaddr_aton(addr, bssid)) {
3856                 wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: invalid "
3857                            "address '%s'", addr);
3858                 return -1;
3859         }
3860
3861         wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM " MACSTR, MAC2STR(bssid));
3862
3863         if (!ssid) {
3864                 wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: No network "
3865                            "configuration known for the target AP");
3866                 return -1;
3867         }
3868
3869         bss = wpa_bss_get(wpa_s, bssid, ssid->ssid, ssid->ssid_len);
3870         if (!bss) {
3871                 wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: Target AP not found "
3872                            "from BSS table");
3873                 return -1;
3874         }
3875
3876         /*
3877          * TODO: Find best network configuration block from configuration to
3878          * allow roaming to other networks
3879          */
3880
3881         wpa_s->reassociate = 1;
3882         wpa_supplicant_connect(wpa_s, bss, ssid);
3883
3884         return 0;
3885 #endif /* CONFIG_NO_SCAN_PROCESSING */
3886 }
3887
3888
3889 #ifdef CONFIG_P2P
3890 static int p2p_ctrl_find(struct wpa_supplicant *wpa_s, char *cmd)
3891 {
3892         unsigned int timeout = atoi(cmd);
3893         enum p2p_discovery_type type = P2P_FIND_START_WITH_FULL;
3894         u8 dev_id[ETH_ALEN], *_dev_id = NULL;
3895         u8 dev_type[WPS_DEV_TYPE_LEN], *_dev_type = NULL;
3896         char *pos;
3897         unsigned int search_delay;
3898
3899         if (os_strstr(cmd, "type=social"))
3900                 type = P2P_FIND_ONLY_SOCIAL;
3901         else if (os_strstr(cmd, "type=progressive"))
3902                 type = P2P_FIND_PROGRESSIVE;
3903
3904         pos = os_strstr(cmd, "dev_id=");
3905         if (pos) {
3906                 pos += 7;
3907                 if (hwaddr_aton(pos, dev_id))
3908                         return -1;
3909                 _dev_id = dev_id;
3910         }
3911
3912         pos = os_strstr(cmd, "dev_type=");
3913         if (pos) {
3914                 pos += 9;
3915                 if (wps_dev_type_str2bin(pos, dev_type) < 0)
3916                         return -1;
3917                 _dev_type = dev_type;
3918         }
3919
3920         pos = os_strstr(cmd, "delay=");
3921         if (pos) {
3922                 pos += 6;
3923                 search_delay = atoi(pos);
3924         } else
3925                 search_delay = wpas_p2p_search_delay(wpa_s);
3926
3927         return wpas_p2p_find(wpa_s, timeout, type, _dev_type != NULL, _dev_type,
3928                              _dev_id, search_delay);
3929 }
3930
3931
3932 static int p2p_ctrl_connect(struct wpa_supplicant *wpa_s, char *cmd,
3933                             char *buf, size_t buflen)
3934 {
3935         u8 addr[ETH_ALEN];
3936         char *pos, *pos2;
3937         char *pin = NULL;
3938         enum p2p_wps_method wps_method;
3939         int new_pin;
3940         int ret;
3941         int persistent_group, persistent_id = -1;
3942         int join;
3943         int auth;
3944         int automatic;
3945         int go_intent = -1;
3946         int freq = 0;
3947         int pd;
3948         int ht40, vht;
3949
3950         /* <addr> <"pbc" | "pin" | PIN> [label|display|keypad]
3951          * [persistent|persistent=<network id>]
3952          * [join] [auth] [go_intent=<0..15>] [freq=<in MHz>] [provdisc]
3953          * [ht40] [vht] */
3954
3955         if (hwaddr_aton(cmd, addr))
3956                 return -1;
3957
3958         pos = cmd + 17;
3959         if (*pos != ' ')
3960                 return -1;
3961         pos++;
3962
3963         persistent_group = os_strstr(pos, " persistent") != NULL;
3964         pos2 = os_strstr(pos, " persistent=");
3965         if (pos2) {
3966                 struct wpa_ssid *ssid;
3967                 persistent_id = atoi(pos2 + 12);
3968                 ssid = wpa_config_get_network(wpa_s->conf, persistent_id);
3969                 if (ssid == NULL || ssid->disabled != 2 ||
3970                     ssid->mode != WPAS_MODE_P2P_GO) {
3971                         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3972                                    "SSID id=%d for persistent P2P group (GO)",
3973                                    persistent_id);
3974                         return -1;
3975                 }
3976         }
3977         join = os_strstr(pos, " join") != NULL;
3978         auth = os_strstr(pos, " auth") != NULL;
3979         automatic = os_strstr(pos, " auto") != NULL;
3980         pd = os_strstr(pos, " provdisc") != NULL;
3981         vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
3982         ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
3983                 vht;
3984
3985         pos2 = os_strstr(pos, " go_intent=");
3986         if (pos2) {
3987                 pos2 += 11;
3988                 go_intent = atoi(pos2);
3989                 if (go_intent < 0 || go_intent > 15)
3990                         return -1;
3991         }
3992
3993         pos2 = os_strstr(pos, " freq=");
3994         if (pos2) {
3995                 pos2 += 6;
3996                 freq = atoi(pos2);
3997                 if (freq <= 0)
3998                         return -1;
3999         }
4000
4001         if (os_strncmp(pos, "pin", 3) == 0) {
4002                 /* Request random PIN (to be displayed) and enable the PIN */
4003                 wps_method = WPS_PIN_DISPLAY;
4004         } else if (os_strncmp(pos, "pbc", 3) == 0) {
4005                 wps_method = WPS_PBC;
4006         } else {
4007                 pin = pos;
4008                 pos = os_strchr(pin, ' ');
4009                 wps_method = WPS_PIN_KEYPAD;
4010                 if (pos) {
4011                         *pos++ = '\0';
4012                         if (os_strncmp(pos, "display", 7) == 0)
4013                                 wps_method = WPS_PIN_DISPLAY;
4014                 }
4015                 if (!wps_pin_str_valid(pin)) {
4016                         os_memcpy(buf, "FAIL-INVALID-PIN\n", 17);
4017                         return 17;
4018                 }
4019         }
4020
4021         new_pin = wpas_p2p_connect(wpa_s, addr, pin, wps_method,
4022                                    persistent_group, automatic, join,
4023                                    auth, go_intent, freq, persistent_id, pd,
4024                                    ht40, vht);
4025         if (new_pin == -2) {
4026                 os_memcpy(buf, "FAIL-CHANNEL-UNAVAILABLE\n", 25);
4027                 return 25;
4028         }
4029         if (new_pin == -3) {
4030                 os_memcpy(buf, "FAIL-CHANNEL-UNSUPPORTED\n", 25);
4031                 return 25;
4032         }
4033         if (new_pin < 0)
4034                 return -1;
4035         if (wps_method == WPS_PIN_DISPLAY && pin == NULL) {
4036                 ret = os_snprintf(buf, buflen, "%08d", new_pin);
4037                 if (ret < 0 || (size_t) ret >= buflen)
4038                         return -1;
4039                 return ret;
4040         }
4041
4042         os_memcpy(buf, "OK\n", 3);
4043         return 3;
4044 }
4045
4046
4047 static int p2p_ctrl_listen(struct wpa_supplicant *wpa_s, char *cmd)
4048 {
4049         unsigned int timeout = atoi(cmd);
4050         return wpas_p2p_listen(wpa_s, timeout);
4051 }
4052
4053
4054 static int p2p_ctrl_prov_disc(struct wpa_supplicant *wpa_s, char *cmd)
4055 {
4056         u8 addr[ETH_ALEN];
4057         char *pos;
4058         enum wpas_p2p_prov_disc_use use = WPAS_P2P_PD_FOR_GO_NEG;
4059
4060         /* <addr> <config method> [join|auto] */
4061
4062         if (hwaddr_aton(cmd, addr))
4063                 return -1;
4064
4065         pos = cmd + 17;
4066         if (*pos != ' ')
4067                 return -1;
4068         pos++;
4069
4070         if (os_strstr(pos, " join") != NULL)
4071                 use = WPAS_P2P_PD_FOR_JOIN;
4072         else if (os_strstr(pos, " auto") != NULL)
4073                 use = WPAS_P2P_PD_AUTO;
4074
4075         return wpas_p2p_prov_disc(wpa_s, addr, pos, use);
4076 }
4077
4078
4079 static int p2p_get_passphrase(struct wpa_supplicant *wpa_s, char *buf,
4080                               size_t buflen)
4081 {
4082         struct wpa_ssid *ssid = wpa_s->current_ssid;
4083
4084         if (ssid == NULL || ssid->mode != WPAS_MODE_P2P_GO ||
4085             ssid->passphrase == NULL)
4086                 return -1;
4087
4088         os_strlcpy(buf, ssid->passphrase, buflen);
4089         return os_strlen(buf);
4090 }
4091
4092
4093 static int p2p_ctrl_serv_disc_req(struct wpa_supplicant *wpa_s, char *cmd,
4094                                   char *buf, size_t buflen)
4095 {
4096         u64 ref;
4097         int res;
4098         u8 dst_buf[ETH_ALEN], *dst;
4099         struct wpabuf *tlvs;
4100         char *pos;
4101         size_t len;
4102
4103         if (hwaddr_aton(cmd, dst_buf))
4104                 return -1;
4105         dst = dst_buf;
4106         if (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
4107             dst[3] == 0 && dst[4] == 0 && dst[5] == 0)
4108                 dst = NULL;
4109         pos = cmd + 17;
4110         if (*pos != ' ')
4111                 return -1;
4112         pos++;
4113
4114         if (os_strncmp(pos, "upnp ", 5) == 0) {
4115                 u8 version;
4116                 pos += 5;
4117                 if (hexstr2bin(pos, &version, 1) < 0)
4118                         return -1;
4119                 pos += 2;
4120                 if (*pos != ' ')
4121                         return -1;
4122                 pos++;
4123                 ref = wpas_p2p_sd_request_upnp(wpa_s, dst, version, pos);
4124 #ifdef CONFIG_WIFI_DISPLAY
4125         } else if (os_strncmp(pos, "wifi-display ", 13) == 0) {
4126                 ref = wpas_p2p_sd_request_wifi_display(wpa_s, dst, pos + 13);
4127 #endif /* CONFIG_WIFI_DISPLAY */
4128         } else {
4129                 len = os_strlen(pos);
4130                 if (len & 1)
4131                         return -1;
4132                 len /= 2;
4133                 tlvs = wpabuf_alloc(len);
4134                 if (tlvs == NULL)
4135                         return -1;
4136                 if (hexstr2bin(pos, wpabuf_put(tlvs, len), len) < 0) {
4137                         wpabuf_free(tlvs);
4138                         return -1;
4139                 }
4140
4141                 ref = wpas_p2p_sd_request(wpa_s, dst, tlvs);
4142                 wpabuf_free(tlvs);
4143         }
4144         if (ref == 0)
4145                 return -1;
4146         res = os_snprintf(buf, buflen, "%llx", (long long unsigned) ref);
4147         if (res < 0 || (unsigned) res >= buflen)
4148                 return -1;
4149         return res;
4150 }
4151
4152
4153 static int p2p_ctrl_serv_disc_cancel_req(struct wpa_supplicant *wpa_s,
4154                                          char *cmd)
4155 {
4156         long long unsigned val;
4157         u64 req;
4158         if (sscanf(cmd, "%llx", &val) != 1)
4159                 return -1;
4160         req = val;
4161         return wpas_p2p_sd_cancel_request(wpa_s, req);
4162 }
4163
4164
4165 static int p2p_ctrl_serv_disc_resp(struct wpa_supplicant *wpa_s, char *cmd)
4166 {
4167         int freq;
4168         u8 dst[ETH_ALEN];
4169         u8 dialog_token;
4170         struct wpabuf *resp_tlvs;
4171         char *pos, *pos2;
4172         size_t len;
4173
4174         pos = os_strchr(cmd, ' ');
4175         if (pos == NULL)
4176                 return -1;
4177         *pos++ = '\0';
4178         freq = atoi(cmd);
4179         if (freq == 0)
4180                 return -1;
4181
4182         if (hwaddr_aton(pos, dst))
4183                 return -1;
4184         pos += 17;
4185         if (*pos != ' ')
4186                 return -1;
4187         pos++;
4188
4189         pos2 = os_strchr(pos, ' ');
4190         if (pos2 == NULL)
4191                 return -1;
4192         *pos2++ = '\0';
4193         dialog_token = atoi(pos);
4194
4195         len = os_strlen(pos2);
4196         if (len & 1)
4197                 return -1;
4198         len /= 2;
4199         resp_tlvs = wpabuf_alloc(len);
4200         if (resp_tlvs == NULL)
4201                 return -1;
4202         if (hexstr2bin(pos2, wpabuf_put(resp_tlvs, len), len) < 0) {
4203                 wpabuf_free(resp_tlvs);
4204                 return -1;
4205         }
4206
4207         wpas_p2p_sd_response(wpa_s, freq, dst, dialog_token, resp_tlvs);
4208         wpabuf_free(resp_tlvs);
4209         return 0;
4210 }
4211
4212
4213 static int p2p_ctrl_serv_disc_external(struct wpa_supplicant *wpa_s,
4214                                        char *cmd)
4215 {
4216         if (os_strcmp(cmd, "0") && os_strcmp(cmd, "1"))
4217                 return -1;
4218         wpa_s->p2p_sd_over_ctrl_iface = atoi(cmd);
4219         return 0;
4220 }
4221
4222
4223 static int p2p_ctrl_service_add_bonjour(struct wpa_supplicant *wpa_s,
4224                                         char *cmd)
4225 {
4226         char *pos;
4227         size_t len;
4228         struct wpabuf *query, *resp;
4229
4230         pos = os_strchr(cmd, ' ');
4231         if (pos == NULL)
4232                 return -1;
4233         *pos++ = '\0';
4234
4235         len = os_strlen(cmd);
4236         if (len & 1)
4237                 return -1;
4238         len /= 2;
4239         query = wpabuf_alloc(len);
4240         if (query == NULL)
4241                 return -1;
4242         if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
4243                 wpabuf_free(query);
4244                 return -1;
4245         }
4246
4247         len = os_strlen(pos);
4248         if (len & 1) {
4249                 wpabuf_free(query);
4250                 return -1;
4251         }
4252         len /= 2;
4253         resp = wpabuf_alloc(len);
4254         if (resp == NULL) {
4255                 wpabuf_free(query);
4256                 return -1;
4257         }
4258         if (hexstr2bin(pos, wpabuf_put(resp, len), len) < 0) {
4259                 wpabuf_free(query);
4260                 wpabuf_free(resp);
4261                 return -1;
4262         }
4263
4264         if (wpas_p2p_service_add_bonjour(wpa_s, query, resp) < 0) {
4265                 wpabuf_free(query);
4266                 wpabuf_free(resp);
4267                 return -1;
4268         }
4269         return 0;
4270 }
4271
4272
4273 static int p2p_ctrl_service_add_upnp(struct wpa_supplicant *wpa_s, char *cmd)
4274 {
4275         char *pos;
4276         u8 version;
4277
4278         pos = os_strchr(cmd, ' ');
4279         if (pos == NULL)
4280                 return -1;
4281         *pos++ = '\0';
4282
4283         if (hexstr2bin(cmd, &version, 1) < 0)
4284                 return -1;
4285
4286         return wpas_p2p_service_add_upnp(wpa_s, version, pos);
4287 }
4288
4289
4290 static int p2p_ctrl_service_add(struct wpa_supplicant *wpa_s, char *cmd)
4291 {
4292         char *pos;
4293
4294         pos = os_strchr(cmd, ' ');
4295         if (pos == NULL)
4296                 return -1;
4297         *pos++ = '\0';
4298
4299         if (os_strcmp(cmd, "bonjour") == 0)
4300                 return p2p_ctrl_service_add_bonjour(wpa_s, pos);
4301         if (os_strcmp(cmd, "upnp") == 0)
4302                 return p2p_ctrl_service_add_upnp(wpa_s, pos);
4303         wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
4304         return -1;
4305 }
4306
4307
4308 static int p2p_ctrl_service_del_bonjour(struct wpa_supplicant *wpa_s,
4309                                         char *cmd)
4310 {
4311         size_t len;
4312         struct wpabuf *query;
4313         int ret;
4314
4315         len = os_strlen(cmd);
4316         if (len & 1)
4317                 return -1;
4318         len /= 2;
4319         query = wpabuf_alloc(len);
4320         if (query == NULL)
4321                 return -1;
4322         if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
4323                 wpabuf_free(query);
4324                 return -1;
4325         }
4326
4327         ret = wpas_p2p_service_del_bonjour(wpa_s, query);
4328         wpabuf_free(query);
4329         return ret;
4330 }
4331
4332
4333 static int p2p_ctrl_service_del_upnp(struct wpa_supplicant *wpa_s, char *cmd)
4334 {
4335         char *pos;
4336         u8 version;
4337
4338         pos = os_strchr(cmd, ' ');
4339         if (pos == NULL)
4340                 return -1;
4341         *pos++ = '\0';
4342
4343         if (hexstr2bin(cmd, &version, 1) < 0)
4344                 return -1;
4345
4346         return wpas_p2p_service_del_upnp(wpa_s, version, pos);
4347 }
4348
4349
4350 static int p2p_ctrl_service_del(struct wpa_supplicant *wpa_s, char *cmd)
4351 {
4352         char *pos;
4353
4354         pos = os_strchr(cmd, ' ');
4355         if (pos == NULL)
4356                 return -1;
4357         *pos++ = '\0';
4358
4359         if (os_strcmp(cmd, "bonjour") == 0)
4360                 return p2p_ctrl_service_del_bonjour(wpa_s, pos);
4361         if (os_strcmp(cmd, "upnp") == 0)
4362                 return p2p_ctrl_service_del_upnp(wpa_s, pos);
4363         wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
4364         return -1;
4365 }
4366
4367
4368 static int p2p_ctrl_reject(struct wpa_supplicant *wpa_s, char *cmd)
4369 {
4370         u8 addr[ETH_ALEN];
4371
4372         /* <addr> */
4373
4374         if (hwaddr_aton(cmd, addr))
4375                 return -1;
4376
4377         return wpas_p2p_reject(wpa_s, addr);
4378 }
4379
4380
4381 static int p2p_ctrl_invite_persistent(struct wpa_supplicant *wpa_s, char *cmd)
4382 {
4383         char *pos;
4384         int id;
4385         struct wpa_ssid *ssid;
4386         u8 *_peer = NULL, peer[ETH_ALEN];
4387         int freq = 0, pref_freq = 0;
4388         int ht40, vht;
4389
4390         id = atoi(cmd);
4391         pos = os_strstr(cmd, " peer=");
4392         if (pos) {
4393                 pos += 6;
4394                 if (hwaddr_aton(pos, peer))
4395                         return -1;
4396                 _peer = peer;
4397         }
4398         ssid = wpa_config_get_network(wpa_s->conf, id);
4399         if (ssid == NULL || ssid->disabled != 2) {
4400                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
4401                            "for persistent P2P group",
4402                            id);
4403                 return -1;
4404         }
4405
4406         pos = os_strstr(cmd, " freq=");
4407         if (pos) {
4408                 pos += 6;
4409                 freq = atoi(pos);
4410                 if (freq <= 0)
4411                         return -1;
4412         }
4413
4414         pos = os_strstr(cmd, " pref=");
4415         if (pos) {
4416                 pos += 6;
4417                 pref_freq = atoi(pos);
4418                 if (pref_freq <= 0)
4419                         return -1;
4420         }
4421
4422         vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
4423         ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
4424                 vht;
4425
4426         return wpas_p2p_invite(wpa_s, _peer, ssid, NULL, freq, ht40, vht,
4427                                pref_freq);
4428 }
4429
4430
4431 static int p2p_ctrl_invite_group(struct wpa_supplicant *wpa_s, char *cmd)
4432 {
4433         char *pos;
4434         u8 peer[ETH_ALEN], go_dev_addr[ETH_ALEN], *go_dev = NULL;
4435
4436         pos = os_strstr(cmd, " peer=");
4437         if (!pos)
4438                 return -1;
4439
4440         *pos = '\0';
4441         pos += 6;
4442         if (hwaddr_aton(pos, peer)) {
4443                 wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'", pos);
4444                 return -1;
4445         }
4446
4447         pos = os_strstr(pos, " go_dev_addr=");
4448         if (pos) {
4449                 pos += 13;
4450                 if (hwaddr_aton(pos, go_dev_addr)) {
4451                         wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'",
4452                                    pos);
4453                         return -1;
4454                 }
4455                 go_dev = go_dev_addr;
4456         }
4457
4458         return wpas_p2p_invite_group(wpa_s, cmd, peer, go_dev);
4459 }
4460
4461
4462 static int p2p_ctrl_invite(struct wpa_supplicant *wpa_s, char *cmd)
4463 {
4464         if (os_strncmp(cmd, "persistent=", 11) == 0)
4465                 return p2p_ctrl_invite_persistent(wpa_s, cmd + 11);
4466         if (os_strncmp(cmd, "group=", 6) == 0)
4467                 return p2p_ctrl_invite_group(wpa_s, cmd + 6);
4468
4469         return -1;
4470 }
4471
4472
4473 static int p2p_ctrl_group_add_persistent(struct wpa_supplicant *wpa_s,
4474                                          char *cmd, int freq, int ht40,
4475                                          int vht)
4476 {
4477         int id;
4478         struct wpa_ssid *ssid;
4479
4480         id = atoi(cmd);
4481         ssid = wpa_config_get_network(wpa_s->conf, id);
4482         if (ssid == NULL || ssid->disabled != 2) {
4483                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
4484                            "for persistent P2P group",
4485                            id);
4486                 return -1;
4487         }
4488
4489         return wpas_p2p_group_add_persistent(wpa_s, ssid, 0, freq, 0, ht40, vht,
4490                                              NULL, 0);
4491 }
4492
4493
4494 static int p2p_ctrl_group_add(struct wpa_supplicant *wpa_s, char *cmd)
4495 {
4496         int freq = 0, ht40, vht;
4497         char *pos;
4498
4499         pos = os_strstr(cmd, "freq=");
4500         if (pos)
4501                 freq = atoi(pos + 5);
4502
4503         vht = (os_strstr(cmd, "vht") != NULL) || wpa_s->conf->p2p_go_vht;
4504         ht40 = (os_strstr(cmd, "ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
4505                 vht;
4506
4507         if (os_strncmp(cmd, "persistent=", 11) == 0)
4508                 return p2p_ctrl_group_add_persistent(wpa_s, cmd + 11, freq,
4509                                                      ht40, vht);
4510         if (os_strcmp(cmd, "persistent") == 0 ||
4511             os_strncmp(cmd, "persistent ", 11) == 0)
4512                 return wpas_p2p_group_add(wpa_s, 1, freq, ht40, vht);
4513         if (os_strncmp(cmd, "freq=", 5) == 0)
4514                 return wpas_p2p_group_add(wpa_s, 0, freq, ht40, vht);
4515         if (ht40)
4516                 return wpas_p2p_group_add(wpa_s, 0, freq, ht40, vht);
4517
4518         wpa_printf(MSG_DEBUG, "CTRL: Invalid P2P_GROUP_ADD parameters '%s'",
4519                    cmd);
4520         return -1;
4521 }
4522
4523
4524 static int p2p_ctrl_peer(struct wpa_supplicant *wpa_s, char *cmd,
4525                          char *buf, size_t buflen)
4526 {
4527         u8 addr[ETH_ALEN], *addr_ptr;
4528         int next, res;
4529         const struct p2p_peer_info *info;
4530         char *pos, *end;
4531         char devtype[WPS_DEV_TYPE_BUFSIZE];
4532         struct wpa_ssid *ssid;
4533         size_t i;
4534
4535         if (!wpa_s->global->p2p)
4536                 return -1;
4537
4538         if (os_strcmp(cmd, "FIRST") == 0) {
4539                 addr_ptr = NULL;
4540                 next = 0;
4541         } else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
4542                 if (hwaddr_aton(cmd + 5, addr) < 0)
4543                         return -1;
4544                 addr_ptr = addr;
4545                 next = 1;
4546         } else {
4547                 if (hwaddr_aton(cmd, addr) < 0)
4548                         return -1;
4549                 addr_ptr = addr;
4550                 next = 0;
4551         }
4552
4553         info = p2p_get_peer_info(wpa_s->global->p2p, addr_ptr, next);
4554         if (info == NULL)
4555                 return -1;
4556
4557         pos = buf;
4558         end = buf + buflen;
4559
4560         res = os_snprintf(pos, end - pos, MACSTR "\n"
4561                           "pri_dev_type=%s\n"
4562                           "device_name=%s\n"
4563                           "manufacturer=%s\n"
4564                           "model_name=%s\n"
4565                           "model_number=%s\n"
4566                           "serial_number=%s\n"
4567                           "config_methods=0x%x\n"
4568                           "dev_capab=0x%x\n"
4569                           "group_capab=0x%x\n"
4570                           "level=%d\n",
4571                           MAC2STR(info->p2p_device_addr),
4572                           wps_dev_type_bin2str(info->pri_dev_type,
4573                                                devtype, sizeof(devtype)),
4574                           info->device_name,
4575                           info->manufacturer,
4576                           info->model_name,
4577                           info->model_number,
4578                           info->serial_number,
4579                           info->config_methods,
4580                           info->dev_capab,
4581                           info->group_capab,
4582                           info->level);
4583         if (res < 0 || res >= end - pos)
4584                 return pos - buf;
4585         pos += res;
4586
4587         for (i = 0; i < info->wps_sec_dev_type_list_len / WPS_DEV_TYPE_LEN; i++)
4588         {
4589                 const u8 *t;
4590                 t = &info->wps_sec_dev_type_list[i * WPS_DEV_TYPE_LEN];
4591                 res = os_snprintf(pos, end - pos, "sec_dev_type=%s\n",
4592                                   wps_dev_type_bin2str(t, devtype,
4593                                                        sizeof(devtype)));
4594                 if (res < 0 || res >= end - pos)
4595                         return pos - buf;
4596                 pos += res;
4597         }
4598
4599         ssid = wpas_p2p_get_persistent(wpa_s, info->p2p_device_addr, NULL, 0);
4600         if (ssid) {
4601                 res = os_snprintf(pos, end - pos, "persistent=%d\n", ssid->id);
4602                 if (res < 0 || res >= end - pos)
4603                         return pos - buf;
4604                 pos += res;
4605         }
4606
4607         res = p2p_get_peer_info_txt(info, pos, end - pos);
4608         if (res < 0)
4609                 return pos - buf;
4610         pos += res;
4611
4612         return pos - buf;
4613 }
4614
4615
4616 static int p2p_ctrl_disallow_freq(struct wpa_supplicant *wpa_s,
4617                                   const char *param)
4618 {
4619         unsigned int i;
4620
4621         if (wpa_s->global->p2p == NULL)
4622                 return -1;
4623
4624         if (freq_range_list_parse(&wpa_s->global->p2p_disallow_freq, param) < 0)
4625                 return -1;
4626
4627         for (i = 0; i < wpa_s->global->p2p_disallow_freq.num; i++) {
4628                 struct wpa_freq_range *freq;
4629                 freq = &wpa_s->global->p2p_disallow_freq.range[i];
4630                 wpa_printf(MSG_DEBUG, "P2P: Disallowed frequency range %u-%u",
4631                            freq->min, freq->max);
4632         }
4633
4634         wpas_p2p_update_channel_list(wpa_s);
4635         return 0;
4636 }
4637
4638
4639 static int p2p_ctrl_set(struct wpa_supplicant *wpa_s, char *cmd)
4640 {
4641         char *param;
4642
4643         if (wpa_s->global->p2p == NULL)
4644                 return -1;
4645
4646         param = os_strchr(cmd, ' ');
4647         if (param == NULL)
4648                 return -1;
4649         *param++ = '\0';
4650
4651         if (os_strcmp(cmd, "discoverability") == 0) {
4652                 p2p_set_client_discoverability(wpa_s->global->p2p,
4653                                                atoi(param));
4654                 return 0;
4655         }
4656
4657         if (os_strcmp(cmd, "managed") == 0) {
4658                 p2p_set_managed_oper(wpa_s->global->p2p, atoi(param));
4659                 return 0;
4660         }
4661
4662         if (os_strcmp(cmd, "listen_channel") == 0) {
4663                 return p2p_set_listen_channel(wpa_s->global->p2p, 81,
4664                                               atoi(param));
4665         }
4666
4667         if (os_strcmp(cmd, "ssid_postfix") == 0) {
4668                 return p2p_set_ssid_postfix(wpa_s->global->p2p, (u8 *) param,
4669                                             os_strlen(param));
4670         }
4671
4672         if (os_strcmp(cmd, "noa") == 0) {
4673                 char *pos;
4674                 int count, start, duration;
4675                 /* GO NoA parameters: count,start_offset(ms),duration(ms) */
4676                 count = atoi(param);
4677                 pos = os_strchr(param, ',');
4678                 if (pos == NULL)
4679                         return -1;
4680                 pos++;
4681                 start = atoi(pos);
4682                 pos = os_strchr(pos, ',');
4683                 if (pos == NULL)
4684                         return -1;
4685                 pos++;
4686                 duration = atoi(pos);
4687                 if (count < 0 || count > 255 || start < 0 || duration < 0)
4688                         return -1;
4689                 if (count == 0 && duration > 0)
4690                         return -1;
4691                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: P2P_SET GO NoA: count=%d "
4692                            "start=%d duration=%d", count, start, duration);
4693                 return wpas_p2p_set_noa(wpa_s, count, start, duration);
4694         }
4695
4696         if (os_strcmp(cmd, "ps") == 0)
4697                 return wpa_drv_set_p2p_powersave(wpa_s, atoi(param), -1, -1);
4698
4699         if (os_strcmp(cmd, "oppps") == 0)
4700                 return wpa_drv_set_p2p_powersave(wpa_s, -1, atoi(param), -1);
4701
4702         if (os_strcmp(cmd, "ctwindow") == 0)
4703                 return wpa_drv_set_p2p_powersave(wpa_s, -1, -1, atoi(param));
4704
4705         if (os_strcmp(cmd, "disabled") == 0) {
4706                 wpa_s->global->p2p_disabled = atoi(param);
4707                 wpa_printf(MSG_DEBUG, "P2P functionality %s",
4708                            wpa_s->global->p2p_disabled ?
4709                            "disabled" : "enabled");
4710                 if (wpa_s->global->p2p_disabled) {
4711                         wpas_p2p_stop_find(wpa_s);
4712                         os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
4713                         p2p_flush(wpa_s->global->p2p);
4714                 }
4715                 return 0;
4716         }
4717
4718         if (os_strcmp(cmd, "conc_pref") == 0) {
4719                 if (os_strcmp(param, "sta") == 0)
4720                         wpa_s->global->conc_pref = WPA_CONC_PREF_STA;
4721                 else if (os_strcmp(param, "p2p") == 0)
4722                         wpa_s->global->conc_pref = WPA_CONC_PREF_P2P;
4723                 else {
4724                         wpa_printf(MSG_INFO, "Invalid conc_pref value");
4725                         return -1;
4726                 }
4727                 wpa_printf(MSG_DEBUG, "Single channel concurrency preference: "
4728                            "%s", param);
4729                 return 0;
4730         }
4731
4732         if (os_strcmp(cmd, "force_long_sd") == 0) {
4733                 wpa_s->force_long_sd = atoi(param);
4734                 return 0;
4735         }
4736
4737         if (os_strcmp(cmd, "peer_filter") == 0) {
4738                 u8 addr[ETH_ALEN];
4739                 if (hwaddr_aton(param, addr))
4740                         return -1;
4741                 p2p_set_peer_filter(wpa_s->global->p2p, addr);
4742                 return 0;
4743         }
4744
4745         if (os_strcmp(cmd, "cross_connect") == 0)
4746                 return wpas_p2p_set_cross_connect(wpa_s, atoi(param));
4747
4748         if (os_strcmp(cmd, "go_apsd") == 0) {
4749                 if (os_strcmp(param, "disable") == 0)
4750                         wpa_s->set_ap_uapsd = 0;
4751                 else {
4752                         wpa_s->set_ap_uapsd = 1;
4753                         wpa_s->ap_uapsd = atoi(param);
4754                 }
4755                 return 0;
4756         }
4757
4758         if (os_strcmp(cmd, "client_apsd") == 0) {
4759                 if (os_strcmp(param, "disable") == 0)
4760                         wpa_s->set_sta_uapsd = 0;
4761                 else {
4762                         int be, bk, vi, vo;
4763                         char *pos;
4764                         /* format: BE,BK,VI,VO;max SP Length */
4765                         be = atoi(param);
4766                         pos = os_strchr(param, ',');
4767                         if (pos == NULL)
4768                                 return -1;
4769                         pos++;
4770                         bk = atoi(pos);
4771                         pos = os_strchr(pos, ',');
4772                         if (pos == NULL)
4773                                 return -1;
4774                         pos++;
4775                         vi = atoi(pos);
4776                         pos = os_strchr(pos, ',');
4777                         if (pos == NULL)
4778                                 return -1;
4779                         pos++;
4780                         vo = atoi(pos);
4781                         /* ignore max SP Length for now */
4782
4783                         wpa_s->set_sta_uapsd = 1;
4784                         wpa_s->sta_uapsd = 0;
4785                         if (be)
4786                                 wpa_s->sta_uapsd |= BIT(0);
4787                         if (bk)
4788                                 wpa_s->sta_uapsd |= BIT(1);
4789                         if (vi)
4790                                 wpa_s->sta_uapsd |= BIT(2);
4791                         if (vo)
4792                                 wpa_s->sta_uapsd |= BIT(3);
4793                 }
4794                 return 0;
4795         }
4796
4797         if (os_strcmp(cmd, "disallow_freq") == 0)
4798                 return p2p_ctrl_disallow_freq(wpa_s, param);
4799
4800         if (os_strcmp(cmd, "disc_int") == 0) {
4801                 int min_disc_int, max_disc_int, max_disc_tu;
4802                 char *pos;
4803
4804                 pos = param;
4805
4806                 min_disc_int = atoi(pos);
4807                 pos = os_strchr(pos, ' ');
4808                 if (pos == NULL)
4809                         return -1;
4810                 *pos++ = '\0';
4811
4812                 max_disc_int = atoi(pos);
4813                 pos = os_strchr(pos, ' ');
4814                 if (pos == NULL)
4815                         return -1;
4816                 *pos++ = '\0';
4817
4818                 max_disc_tu = atoi(pos);
4819
4820                 return p2p_set_disc_int(wpa_s->global->p2p, min_disc_int,
4821                                         max_disc_int, max_disc_tu);
4822         }
4823
4824         if (os_strcmp(cmd, "per_sta_psk") == 0) {
4825                 wpa_s->global->p2p_per_sta_psk = !!atoi(param);
4826                 return 0;
4827         }
4828
4829 #ifdef CONFIG_WPS_NFC
4830         if (os_strcmp(cmd, "nfc_tag") == 0)
4831                 return wpas_p2p_nfc_tag_enabled(wpa_s, !!atoi(param));
4832 #endif /* CONFIG_WPS_NFC */
4833
4834         if (os_strcmp(cmd, "disable_ip_addr_req") == 0) {
4835                 wpa_s->p2p_disable_ip_addr_req = !!atoi(param);
4836                 return 0;
4837         }
4838
4839         wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown P2P_SET field value '%s'",
4840                    cmd);
4841
4842         return -1;
4843 }
4844
4845
4846 static void p2p_ctrl_flush(struct wpa_supplicant *wpa_s)
4847 {
4848         os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
4849         wpa_s->force_long_sd = 0;
4850         if (wpa_s->global->p2p)
4851                 p2p_flush(wpa_s->global->p2p);
4852 }
4853
4854
4855 static int p2p_ctrl_presence_req(struct wpa_supplicant *wpa_s, char *cmd)
4856 {
4857         char *pos, *pos2;
4858         unsigned int dur1 = 0, int1 = 0, dur2 = 0, int2 = 0;
4859
4860         if (cmd[0]) {
4861                 pos = os_strchr(cmd, ' ');
4862                 if (pos == NULL)
4863                         return -1;
4864                 *pos++ = '\0';
4865                 dur1 = atoi(cmd);
4866
4867                 pos2 = os_strchr(pos, ' ');
4868                 if (pos2)
4869                         *pos2++ = '\0';
4870                 int1 = atoi(pos);
4871         } else
4872                 pos2 = NULL;
4873
4874         if (pos2) {
4875                 pos = os_strchr(pos2, ' ');
4876                 if (pos == NULL)
4877                         return -1;
4878                 *pos++ = '\0';
4879                 dur2 = atoi(pos2);
4880                 int2 = atoi(pos);
4881         }
4882
4883         return wpas_p2p_presence_req(wpa_s, dur1, int1, dur2, int2);
4884 }
4885
4886
4887 static int p2p_ctrl_ext_listen(struct wpa_supplicant *wpa_s, char *cmd)
4888 {
4889         char *pos;
4890         unsigned int period = 0, interval = 0;
4891
4892         if (cmd[0]) {
4893                 pos = os_strchr(cmd, ' ');
4894                 if (pos == NULL)
4895                         return -1;
4896                 *pos++ = '\0';
4897                 period = atoi(cmd);
4898                 interval = atoi(pos);
4899         }
4900
4901         return wpas_p2p_ext_listen(wpa_s, period, interval);
4902 }
4903
4904
4905 static int p2p_ctrl_remove_client(struct wpa_supplicant *wpa_s, const char *cmd)
4906 {
4907         const char *pos;
4908         u8 peer[ETH_ALEN];
4909         int iface_addr = 0;
4910
4911         pos = cmd;
4912         if (os_strncmp(pos, "iface=", 6) == 0) {
4913                 iface_addr = 1;
4914                 pos += 6;
4915         }
4916         if (hwaddr_aton(pos, peer))
4917                 return -1;
4918
4919         wpas_p2p_remove_client(wpa_s, peer, iface_addr);
4920         return 0;
4921 }
4922
4923 #endif /* CONFIG_P2P */
4924
4925
4926 static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s, char *val)
4927 {
4928         struct wpa_freq_range_list ranges;
4929         int *freqs = NULL;
4930         struct hostapd_hw_modes *mode;
4931         u16 i;
4932
4933         if (wpa_s->hw.modes == NULL)
4934                 return NULL;
4935
4936         os_memset(&ranges, 0, sizeof(ranges));
4937         if (freq_range_list_parse(&ranges, val) < 0)
4938                 return NULL;
4939
4940         for (i = 0; i < wpa_s->hw.num_modes; i++) {
4941                 int j;
4942
4943                 mode = &wpa_s->hw.modes[i];
4944                 for (j = 0; j < mode->num_channels; j++) {
4945                         unsigned int freq;
4946
4947                         if (mode->channels[j].flag & HOSTAPD_CHAN_DISABLED)
4948                                 continue;
4949
4950                         freq = mode->channels[j].freq;
4951                         if (!freq_range_list_includes(&ranges, freq))
4952                                 continue;
4953
4954                         int_array_add_unique(&freqs, freq);
4955                 }
4956         }
4957
4958         os_free(ranges.range);
4959         return freqs;
4960 }
4961
4962
4963 #ifdef CONFIG_INTERWORKING
4964
4965 static int ctrl_interworking_select(struct wpa_supplicant *wpa_s, char *param)
4966 {
4967         int auto_sel = 0;
4968         int *freqs = NULL;
4969
4970         if (param) {
4971                 char *pos;
4972
4973                 auto_sel = os_strstr(param, "auto") != NULL;
4974
4975                 pos = os_strstr(param, "freq=");
4976                 if (pos) {
4977                         freqs = freq_range_to_channel_list(wpa_s, pos + 5);
4978                         if (freqs == NULL)
4979                                 return -1;
4980                 }
4981
4982         }
4983
4984         return interworking_select(wpa_s, auto_sel, freqs);
4985 }
4986
4987
4988 static int ctrl_interworking_connect(struct wpa_supplicant *wpa_s, char *dst)
4989 {
4990         u8 bssid[ETH_ALEN];
4991         struct wpa_bss *bss;
4992
4993         if (hwaddr_aton(dst, bssid)) {
4994                 wpa_printf(MSG_DEBUG, "Invalid BSSID '%s'", dst);
4995                 return -1;
4996         }
4997
4998         bss = wpa_bss_get_bssid(wpa_s, bssid);
4999         if (bss == NULL) {
5000                 wpa_printf(MSG_DEBUG, "Could not find BSS " MACSTR,
5001                            MAC2STR(bssid));
5002                 return -1;
5003         }
5004
5005         return interworking_connect(wpa_s, bss);
5006 }
5007
5008
5009 static int get_anqp(struct wpa_supplicant *wpa_s, char *dst)
5010 {
5011         u8 dst_addr[ETH_ALEN];
5012         int used;
5013         char *pos;
5014 #define MAX_ANQP_INFO_ID 100
5015         u16 id[MAX_ANQP_INFO_ID];
5016         size_t num_id = 0;
5017         u32 subtypes = 0;
5018
5019         used = hwaddr_aton2(dst, dst_addr);
5020         if (used < 0)
5021                 return -1;
5022         pos = dst + used;
5023         while (num_id < MAX_ANQP_INFO_ID) {
5024                 if (os_strncmp(pos, "hs20:", 5) == 0) {
5025 #ifdef CONFIG_HS20
5026                         int num = atoi(pos + 5);
5027                         if (num <= 0 || num > 31)
5028                                 return -1;
5029                         subtypes |= BIT(num);
5030 #else /* CONFIG_HS20 */
5031                         return -1;
5032 #endif /* CONFIG_HS20 */
5033                 } else {
5034                         id[num_id] = atoi(pos);
5035                         if (id[num_id])
5036                                 num_id++;
5037                 }
5038                 pos = os_strchr(pos + 1, ',');
5039                 if (pos == NULL)
5040                         break;
5041                 pos++;
5042         }
5043
5044         if (num_id == 0)
5045                 return -1;
5046
5047         return anqp_send_req(wpa_s, dst_addr, id, num_id, subtypes);
5048 }
5049
5050
5051 static int gas_request(struct wpa_supplicant *wpa_s, char *cmd)
5052 {
5053         u8 dst_addr[ETH_ALEN];
5054         struct wpabuf *advproto, *query = NULL;
5055         int used, ret = -1;
5056         char *pos, *end;
5057         size_t len;
5058
5059         used = hwaddr_aton2(cmd, dst_addr);
5060         if (used < 0)
5061                 return -1;
5062
5063         pos = cmd + used;
5064         while (*pos == ' ')
5065                 pos++;
5066
5067         /* Advertisement Protocol ID */
5068         end = os_strchr(pos, ' ');
5069         if (end)
5070                 len = end - pos;
5071         else
5072                 len = os_strlen(pos);
5073         if (len & 0x01)
5074                 return -1;
5075         len /= 2;
5076         if (len == 0)
5077                 return -1;
5078         advproto = wpabuf_alloc(len);
5079         if (advproto == NULL)
5080                 return -1;
5081         if (hexstr2bin(pos, wpabuf_put(advproto, len), len) < 0)
5082                 goto fail;
5083
5084         if (end) {
5085                 /* Optional Query Request */
5086                 pos = end + 1;
5087                 while (*pos == ' ')
5088                         pos++;
5089
5090                 len = os_strlen(pos);
5091                 if (len) {
5092                         if (len & 0x01)
5093                                 goto fail;
5094                         len /= 2;
5095                         if (len == 0)
5096                                 goto fail;
5097                         query = wpabuf_alloc(len);
5098                         if (query == NULL)
5099                                 goto fail;
5100                         if (hexstr2bin(pos, wpabuf_put(query, len), len) < 0)
5101                                 goto fail;
5102                 }
5103         }
5104
5105         ret = gas_send_request(wpa_s, dst_addr, advproto, query);
5106
5107 fail:
5108         wpabuf_free(advproto);
5109         wpabuf_free(query);
5110
5111         return ret;
5112 }
5113
5114
5115 static int gas_response_get(struct wpa_supplicant *wpa_s, char *cmd, char *buf,
5116                             size_t buflen)
5117 {
5118         u8 addr[ETH_ALEN];
5119         int dialog_token;
5120         int used;
5121         char *pos;
5122         size_t resp_len, start, requested_len;
5123         struct wpabuf *resp;
5124         int ret;
5125
5126         used = hwaddr_aton2(cmd, addr);
5127         if (used < 0)
5128                 return -1;
5129
5130         pos = cmd + used;
5131         while (*pos == ' ')
5132                 pos++;
5133         dialog_token = atoi(pos);
5134
5135         if (wpa_s->last_gas_resp &&
5136             os_memcmp(addr, wpa_s->last_gas_addr, ETH_ALEN) == 0 &&
5137             dialog_token == wpa_s->last_gas_dialog_token)
5138                 resp = wpa_s->last_gas_resp;
5139         else if (wpa_s->prev_gas_resp &&
5140                  os_memcmp(addr, wpa_s->prev_gas_addr, ETH_ALEN) == 0 &&
5141                  dialog_token == wpa_s->prev_gas_dialog_token)
5142                 resp = wpa_s->prev_gas_resp;
5143         else
5144                 return -1;
5145
5146         resp_len = wpabuf_len(resp);
5147         start = 0;
5148         requested_len = resp_len;
5149
5150         pos = os_strchr(pos, ' ');
5151         if (pos) {
5152                 start = atoi(pos);
5153                 if (start > resp_len)
5154                         return os_snprintf(buf, buflen, "FAIL-Invalid range");
5155                 pos = os_strchr(pos, ',');
5156                 if (pos == NULL)
5157                         return -1;
5158                 pos++;
5159                 requested_len = atoi(pos);
5160                 if (start + requested_len > resp_len)
5161                         return os_snprintf(buf, buflen, "FAIL-Invalid range");
5162         }
5163
5164         if (requested_len * 2 + 1 > buflen)
5165                 return os_snprintf(buf, buflen, "FAIL-Too long response");
5166
5167         ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(resp) + start,
5168                                requested_len);
5169
5170         if (start + requested_len == resp_len) {
5171                 /*
5172                  * Free memory by dropping the response after it has been
5173                  * fetched.
5174                  */
5175                 if (resp == wpa_s->prev_gas_resp) {
5176                         wpabuf_free(wpa_s->prev_gas_resp);
5177                         wpa_s->prev_gas_resp = NULL;
5178                 } else {
5179                         wpabuf_free(wpa_s->last_gas_resp);
5180                         wpa_s->last_gas_resp = NULL;
5181                 }
5182         }
5183
5184         return ret;
5185 }
5186 #endif /* CONFIG_INTERWORKING */
5187
5188
5189 #ifdef CONFIG_HS20
5190
5191 static int get_hs20_anqp(struct wpa_supplicant *wpa_s, char *dst)
5192 {
5193         u8 dst_addr[ETH_ALEN];
5194         int used;
5195         char *pos;
5196         u32 subtypes = 0;
5197
5198         used = hwaddr_aton2(dst, dst_addr);
5199         if (used < 0)
5200                 return -1;
5201         pos = dst + used;
5202         for (;;) {
5203                 int num = atoi(pos);
5204                 if (num <= 0 || num > 31)
5205                         return -1;
5206                 subtypes |= BIT(num);
5207                 pos = os_strchr(pos + 1, ',');
5208                 if (pos == NULL)
5209                         break;
5210                 pos++;
5211         }
5212
5213         if (subtypes == 0)
5214                 return -1;
5215
5216         return hs20_anqp_send_req(wpa_s, dst_addr, subtypes, NULL, 0);
5217 }
5218
5219
5220 static int hs20_nai_home_realm_list(struct wpa_supplicant *wpa_s,
5221                                     const u8 *addr, const char *realm)
5222 {
5223         u8 *buf;
5224         size_t rlen, len;
5225         int ret;
5226
5227         rlen = os_strlen(realm);
5228         len = 3 + rlen;
5229         buf = os_malloc(len);
5230         if (buf == NULL)
5231                 return -1;
5232         buf[0] = 1; /* NAI Home Realm Count */
5233         buf[1] = 0; /* Formatted in accordance with RFC 4282 */
5234         buf[2] = rlen;
5235         os_memcpy(buf + 3, realm, rlen);
5236
5237         ret = hs20_anqp_send_req(wpa_s, addr,
5238                                  BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
5239                                  buf, len);
5240
5241         os_free(buf);
5242
5243         return ret;
5244 }
5245
5246
5247 static int hs20_get_nai_home_realm_list(struct wpa_supplicant *wpa_s,
5248                                         char *dst)
5249 {
5250         struct wpa_cred *cred = wpa_s->conf->cred;
5251         u8 dst_addr[ETH_ALEN];
5252         int used;
5253         u8 *buf;
5254         size_t len;
5255         int ret;
5256
5257         used = hwaddr_aton2(dst, dst_addr);
5258         if (used < 0)
5259                 return -1;
5260
5261         while (dst[used] == ' ')
5262                 used++;
5263         if (os_strncmp(dst + used, "realm=", 6) == 0)
5264                 return hs20_nai_home_realm_list(wpa_s, dst_addr,
5265                                                 dst + used + 6);
5266
5267         len = os_strlen(dst + used);
5268
5269         if (len == 0 && cred && cred->realm)
5270                 return hs20_nai_home_realm_list(wpa_s, dst_addr, cred->realm);
5271
5272         if (len % 1)
5273                 return -1;
5274         len /= 2;
5275         buf = os_malloc(len);
5276         if (buf == NULL)
5277                 return -1;
5278         if (hexstr2bin(dst + used, buf, len) < 0) {
5279                 os_free(buf);
5280                 return -1;
5281         }
5282
5283         ret = hs20_anqp_send_req(wpa_s, dst_addr,
5284                                  BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
5285                                  buf, len);
5286         os_free(buf);
5287
5288         return ret;
5289 }
5290
5291
5292 static int hs20_icon_request(struct wpa_supplicant *wpa_s, char *cmd)
5293 {
5294         u8 dst_addr[ETH_ALEN];
5295         int used;
5296         char *icon;
5297
5298         used = hwaddr_aton2(cmd, dst_addr);
5299         if (used < 0)
5300                 return -1;
5301
5302         while (cmd[used] == ' ')
5303                 used++;
5304         icon = &cmd[used];
5305
5306         wpa_s->fetch_osu_icon_in_progress = 0;
5307         return hs20_anqp_send_req(wpa_s, dst_addr, BIT(HS20_STYPE_ICON_REQUEST),
5308                                   (u8 *) icon, os_strlen(icon));
5309 }
5310
5311 #endif /* CONFIG_HS20 */
5312
5313
5314 static int wpa_supplicant_ctrl_iface_sta_autoconnect(
5315         struct wpa_supplicant *wpa_s, char *cmd)
5316 {
5317         wpa_s->auto_reconnect_disabled = atoi(cmd) == 0 ? 1 : 0;
5318         return 0;
5319 }
5320
5321
5322 #ifdef CONFIG_AUTOSCAN
5323
5324 static int wpa_supplicant_ctrl_iface_autoscan(struct wpa_supplicant *wpa_s,
5325                                               char *cmd)
5326 {
5327         enum wpa_states state = wpa_s->wpa_state;
5328         char *new_params = NULL;
5329
5330         if (os_strlen(cmd) > 0) {
5331                 new_params = os_strdup(cmd);
5332                 if (new_params == NULL)
5333                         return -1;
5334         }
5335
5336         os_free(wpa_s->conf->autoscan);
5337         wpa_s->conf->autoscan = new_params;
5338
5339         if (wpa_s->conf->autoscan == NULL)
5340                 autoscan_deinit(wpa_s);
5341         else if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
5342                 autoscan_init(wpa_s, 1);
5343         else if (state == WPA_SCANNING)
5344                 wpa_supplicant_reinit_autoscan(wpa_s);
5345
5346         return 0;
5347 }
5348
5349 #endif /* CONFIG_AUTOSCAN */
5350
5351
5352 #ifdef CONFIG_WNM
5353
5354 static int wpas_ctrl_iface_wnm_sleep(struct wpa_supplicant *wpa_s, char *cmd)
5355 {
5356         int enter;
5357         int intval = 0;
5358         char *pos;
5359         int ret;
5360         struct wpabuf *tfs_req = NULL;
5361
5362         if (os_strncmp(cmd, "enter", 5) == 0)
5363                 enter = 1;
5364         else if (os_strncmp(cmd, "exit", 4) == 0)
5365                 enter = 0;
5366         else
5367                 return -1;
5368
5369         pos = os_strstr(cmd, " interval=");
5370         if (pos)
5371                 intval = atoi(pos + 10);
5372
5373         pos = os_strstr(cmd, " tfs_req=");
5374         if (pos) {
5375                 char *end;
5376                 size_t len;
5377                 pos += 9;
5378                 end = os_strchr(pos, ' ');
5379                 if (end)
5380                         len = end - pos;
5381                 else
5382                         len = os_strlen(pos);
5383                 if (len & 1)
5384                         return -1;
5385                 len /= 2;
5386                 tfs_req = wpabuf_alloc(len);
5387                 if (tfs_req == NULL)
5388                         return -1;
5389                 if (hexstr2bin(pos, wpabuf_put(tfs_req, len), len) < 0) {
5390                         wpabuf_free(tfs_req);
5391                         return -1;
5392                 }
5393         }
5394
5395         ret = ieee802_11_send_wnmsleep_req(wpa_s, enter ? WNM_SLEEP_MODE_ENTER :
5396                                            WNM_SLEEP_MODE_EXIT, intval,
5397                                            tfs_req);
5398         wpabuf_free(tfs_req);
5399
5400         return ret;
5401 }
5402
5403
5404 static int wpas_ctrl_iface_wnm_bss_query(struct wpa_supplicant *wpa_s, char *cmd)
5405 {
5406         int query_reason;
5407
5408         query_reason = atoi(cmd);
5409
5410         wpa_printf(MSG_DEBUG, "CTRL_IFACE: WNM_BSS_QUERY query_reason=%d",
5411                    query_reason);
5412
5413         return wnm_send_bss_transition_mgmt_query(wpa_s, query_reason);
5414 }
5415
5416 #endif /* CONFIG_WNM */
5417
5418
5419 /* Get string representation of channel width */
5420 static const char * channel_width_name(enum chan_width width)
5421 {
5422         switch (width) {
5423         case CHAN_WIDTH_20_NOHT:
5424                 return "20 MHz (no HT)";
5425         case CHAN_WIDTH_20:
5426                 return "20 MHz";
5427         case CHAN_WIDTH_40:
5428                 return "40 MHz";
5429         case CHAN_WIDTH_80:
5430                 return "80 MHz";
5431         case CHAN_WIDTH_80P80:
5432                 return "80+80 MHz";
5433         case CHAN_WIDTH_160:
5434                 return "160 MHz";
5435         default:
5436                 return "unknown";
5437         }
5438 }
5439
5440
5441 static int wpa_supplicant_signal_poll(struct wpa_supplicant *wpa_s, char *buf,
5442                                       size_t buflen)
5443 {
5444         struct wpa_signal_info si;
5445         int ret;
5446         char *pos, *end;
5447
5448         ret = wpa_drv_signal_poll(wpa_s, &si);
5449         if (ret)
5450                 return -1;
5451
5452         pos = buf;
5453         end = buf + buflen;
5454
5455         ret = os_snprintf(pos, end - pos, "RSSI=%d\nLINKSPEED=%d\n"
5456                           "NOISE=%d\nFREQUENCY=%u\n",
5457                           si.current_signal, si.current_txrate / 1000,
5458                           si.current_noise, si.frequency);
5459         if (ret < 0 || ret > end - pos)
5460                 return -1;
5461         pos += ret;
5462
5463         if (si.chanwidth != CHAN_WIDTH_UNKNOWN) {
5464                 ret = os_snprintf(pos, end - pos, "WIDTH=%s\n",
5465                                   channel_width_name(si.chanwidth));
5466                 if (ret < 0 || ret > end - pos)
5467                         return -1;
5468                 pos += ret;
5469         }
5470
5471         if (si.center_frq1 > 0 && si.center_frq2 > 0) {
5472                 ret = os_snprintf(pos, end - pos,
5473                                   "CENTER_FRQ1=%d\nCENTER_FRQ2=%d\n",
5474                                   si.center_frq1, si.center_frq2);
5475                 if (ret < 0 || ret > end - pos)
5476                         return -1;
5477                 pos += ret;
5478         }
5479
5480         if (si.avg_signal) {
5481                 ret = os_snprintf(pos, end - pos,
5482                                   "AVG_RSSI=%d\n", si.avg_signal);
5483                 if (ret < 0 || ret >= end - pos)
5484                         return -1;
5485                 pos += ret;
5486         }
5487
5488         return pos - buf;
5489 }
5490
5491
5492 static int wpa_supplicant_pktcnt_poll(struct wpa_supplicant *wpa_s, char *buf,
5493                                       size_t buflen)
5494 {
5495         struct hostap_sta_driver_data sta;
5496         int ret;
5497
5498         ret = wpa_drv_pktcnt_poll(wpa_s, &sta);
5499         if (ret)
5500                 return -1;
5501
5502         ret = os_snprintf(buf, buflen, "TXGOOD=%lu\nTXBAD=%lu\nRXGOOD=%lu\n",
5503                           sta.tx_packets, sta.tx_retry_failed, sta.rx_packets);
5504         if (ret < 0 || (size_t) ret > buflen)
5505                 return -1;
5506         return ret;
5507 }
5508
5509
5510 #ifdef ANDROID
5511 static int wpa_supplicant_driver_cmd(struct wpa_supplicant *wpa_s, char *cmd,
5512                                      char *buf, size_t buflen)
5513 {
5514         int ret;
5515
5516         ret = wpa_drv_driver_cmd(wpa_s, cmd, buf, buflen);
5517         if (ret == 0) {
5518                 if (os_strncasecmp(cmd, "COUNTRY", 7) == 0) {
5519                         struct p2p_data *p2p = wpa_s->global->p2p;
5520                         if (p2p) {
5521                                 char country[3];
5522                                 country[0] = cmd[8];
5523                                 country[1] = cmd[9];
5524                                 country[2] = 0x04;
5525                                 p2p_set_country(p2p, country);
5526                         }
5527                 }
5528                 ret = os_snprintf(buf, buflen, "%s\n", "OK");
5529         }
5530         return ret;
5531 }
5532 #endif /* ANDROID */
5533
5534
5535 static int wpa_supplicant_vendor_cmd(struct wpa_supplicant *wpa_s, char *cmd,
5536                                      char *buf, size_t buflen)
5537 {
5538         int ret;
5539         char *pos;
5540         u8 *data = NULL;
5541         unsigned int vendor_id, subcmd;
5542         struct wpabuf *reply;
5543         size_t data_len = 0;
5544
5545         /* cmd: <vendor id> <subcommand id> [<hex formatted data>] */
5546         vendor_id = strtoul(cmd, &pos, 16);
5547         if (!isblank(*pos))
5548                 return -EINVAL;
5549
5550         subcmd = strtoul(pos, &pos, 10);
5551
5552         if (*pos != '\0') {
5553                 if (!isblank(*pos++))
5554                         return -EINVAL;
5555                 data_len = os_strlen(pos);
5556         }
5557
5558         if (data_len) {
5559                 data_len /= 2;
5560                 data = os_malloc(data_len);
5561                 if (!data)
5562                         return -ENOBUFS;
5563
5564                 if (hexstr2bin(pos, data, data_len)) {
5565                         wpa_printf(MSG_DEBUG,
5566                                    "Vendor command: wrong parameter format");
5567                         os_free(data);
5568                         return -EINVAL;
5569                 }
5570         }
5571
5572         reply = wpabuf_alloc((buflen - 1) / 2);
5573         if (!reply) {
5574                 os_free(data);
5575                 return -ENOBUFS;
5576         }
5577
5578         ret = wpa_drv_vendor_cmd(wpa_s, vendor_id, subcmd, data, data_len,
5579                                  reply);
5580
5581         if (ret == 0)
5582                 ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(reply),
5583                                        wpabuf_len(reply));
5584
5585         wpabuf_free(reply);
5586         os_free(data);
5587
5588         return ret;
5589 }
5590
5591
5592 static void wpa_supplicant_ctrl_iface_flush(struct wpa_supplicant *wpa_s)
5593 {
5594         wpa_dbg(wpa_s, MSG_DEBUG, "Flush all wpa_supplicant state");
5595
5596 #ifdef CONFIG_P2P
5597         wpas_p2p_stop_find(wpa_s);
5598         p2p_ctrl_flush(wpa_s);
5599         wpas_p2p_group_remove(wpa_s, "*");
5600         wpas_p2p_service_flush(wpa_s);
5601         wpa_s->global->p2p_disabled = 0;
5602         wpa_s->global->p2p_per_sta_psk = 0;
5603         wpa_s->conf->num_sec_device_types = 0;
5604         wpa_s->p2p_disable_ip_addr_req = 0;
5605 #endif /* CONFIG_P2P */
5606
5607 #ifdef CONFIG_WPS_TESTING
5608         wps_version_number = 0x20;
5609         wps_testing_dummy_cred = 0;
5610         wps_corrupt_pkhash = 0;
5611 #endif /* CONFIG_WPS_TESTING */
5612 #ifdef CONFIG_WPS
5613         wpa_s->wps_fragment_size = 0;
5614         wpas_wps_cancel(wpa_s);
5615 #endif /* CONFIG_WPS */
5616         wpa_s->after_wps = 0;
5617         wpa_s->known_wps_freq = 0;
5618
5619 #ifdef CONFIG_TDLS
5620 #ifdef CONFIG_TDLS_TESTING
5621         extern unsigned int tdls_testing;
5622         tdls_testing = 0;
5623 #endif /* CONFIG_TDLS_TESTING */
5624         wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL);
5625         wpa_tdls_enable(wpa_s->wpa, 1);
5626 #endif /* CONFIG_TDLS */
5627
5628         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
5629         wpa_supplicant_stop_countermeasures(wpa_s, NULL);
5630
5631         wpa_s->no_keep_alive = 0;
5632
5633         os_free(wpa_s->disallow_aps_bssid);
5634         wpa_s->disallow_aps_bssid = NULL;
5635         wpa_s->disallow_aps_bssid_count = 0;
5636         os_free(wpa_s->disallow_aps_ssid);
5637         wpa_s->disallow_aps_ssid = NULL;
5638         wpa_s->disallow_aps_ssid_count = 0;
5639
5640         wpa_s->set_sta_uapsd = 0;
5641         wpa_s->sta_uapsd = 0;
5642
5643         wpa_drv_radio_disable(wpa_s, 0);
5644
5645         wpa_bss_flush(wpa_s);
5646         wpa_blacklist_clear(wpa_s);
5647         wpa_s->extra_blacklist_count = 0;
5648         wpa_supplicant_ctrl_iface_remove_network(wpa_s, "all");
5649         wpa_supplicant_ctrl_iface_remove_cred(wpa_s, "all");
5650         wpa_config_flush_blobs(wpa_s->conf);
5651         wpa_s->conf->auto_interworking = 0;
5652         wpa_s->conf->okc = 0;
5653
5654         wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME, 43200);
5655         wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD, 70);
5656         wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT, 60);
5657         eapol_sm_notify_logoff(wpa_s->eapol, FALSE);
5658
5659         radio_remove_works(wpa_s, NULL, 1);
5660
5661         wpa_s->next_ssid = NULL;
5662
5663 #ifdef CONFIG_INTERWORKING
5664         hs20_cancel_fetch_osu(wpa_s);
5665 #endif /* CONFIG_INTERWORKING */
5666
5667         wpa_s->ext_mgmt_frame_handling = 0;
5668 }
5669
5670
5671 static int wpas_ctrl_radio_work_show(struct wpa_supplicant *wpa_s,
5672                                      char *buf, size_t buflen)
5673 {
5674         struct wpa_radio_work *work;
5675         char *pos, *end;
5676         struct os_reltime now, diff;
5677
5678         pos = buf;
5679         end = buf + buflen;
5680
5681         os_get_reltime(&now);
5682
5683         dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
5684         {
5685                 int ret;
5686
5687                 os_reltime_sub(&now, &work->time, &diff);
5688                 ret = os_snprintf(pos, end - pos, "%s@%s:%u:%u:%ld.%06ld\n",
5689                                   work->type, work->wpa_s->ifname, work->freq,
5690                                   work->started, diff.sec, diff.usec);
5691                 if (ret < 0 || ret >= end - pos)
5692                         break;
5693                 pos += ret;
5694         }
5695
5696         return pos - buf;
5697 }
5698
5699
5700 static void wpas_ctrl_radio_work_timeout(void *eloop_ctx, void *timeout_ctx)
5701 {
5702         struct wpa_radio_work *work = eloop_ctx;
5703         struct wpa_external_work *ework = work->ctx;
5704
5705         wpa_dbg(work->wpa_s, MSG_DEBUG,
5706                 "Timing out external radio work %u (%s)",
5707                 ework->id, work->type);
5708         wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_TIMEOUT "%u", ework->id);
5709         os_free(ework);
5710         radio_work_done(work);
5711 }
5712
5713
5714 static void wpas_ctrl_radio_work_cb(struct wpa_radio_work *work, int deinit)
5715 {
5716         struct wpa_external_work *ework = work->ctx;
5717
5718         if (deinit) {
5719                 if (work->started)
5720                         eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
5721                                              work, NULL);
5722
5723                 os_free(ework);
5724                 return;
5725         }
5726
5727         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting external radio work %u (%s)",
5728                 ework->id, ework->type);
5729         wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_START "%u", ework->id);
5730         if (!ework->timeout)
5731                 ework->timeout = 10;
5732         eloop_register_timeout(ework->timeout, 0, wpas_ctrl_radio_work_timeout,
5733                                work, NULL);
5734 }
5735
5736
5737 static int wpas_ctrl_radio_work_add(struct wpa_supplicant *wpa_s, char *cmd,
5738                                     char *buf, size_t buflen)
5739 {
5740         struct wpa_external_work *ework;
5741         char *pos, *pos2;
5742         size_t type_len;
5743         int ret;
5744         unsigned int freq = 0;
5745
5746         /* format: <name> [freq=<MHz>] [timeout=<seconds>] */
5747
5748         ework = os_zalloc(sizeof(*ework));
5749         if (ework == NULL)
5750                 return -1;
5751
5752         pos = os_strchr(cmd, ' ');
5753         if (pos) {
5754                 type_len = pos - cmd;
5755                 pos++;
5756
5757                 pos2 = os_strstr(pos, "freq=");
5758                 if (pos2)
5759                         freq = atoi(pos2 + 5);
5760
5761                 pos2 = os_strstr(pos, "timeout=");
5762                 if (pos2)
5763                         ework->timeout = atoi(pos2 + 8);
5764         } else {
5765                 type_len = os_strlen(cmd);
5766         }
5767         if (4 + type_len >= sizeof(ework->type))
5768                 type_len = sizeof(ework->type) - 4 - 1;
5769         os_strlcpy(ework->type, "ext:", sizeof(ework->type));
5770         os_memcpy(ework->type + 4, cmd, type_len);
5771         ework->type[4 + type_len] = '\0';
5772
5773         wpa_s->ext_work_id++;
5774         if (wpa_s->ext_work_id == 0)
5775                 wpa_s->ext_work_id++;
5776         ework->id = wpa_s->ext_work_id;
5777
5778         if (radio_add_work(wpa_s, freq, ework->type, 0, wpas_ctrl_radio_work_cb,
5779                            ework) < 0) {
5780                 os_free(ework);
5781                 return -1;
5782         }
5783
5784         ret = os_snprintf(buf, buflen, "%u", ework->id);
5785         if (ret < 0 || (size_t) ret >= buflen)
5786                 return -1;
5787         return ret;
5788 }
5789
5790
5791 static int wpas_ctrl_radio_work_done(struct wpa_supplicant *wpa_s, char *cmd)
5792 {
5793         struct wpa_radio_work *work;
5794         unsigned int id = atoi(cmd);
5795
5796         dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
5797         {
5798                 struct wpa_external_work *ework;
5799
5800                 if (os_strncmp(work->type, "ext:", 4) != 0)
5801                         continue;
5802                 ework = work->ctx;
5803                 if (id && ework->id != id)
5804                         continue;
5805                 wpa_dbg(wpa_s, MSG_DEBUG,
5806                         "Completed external radio work %u (%s)",
5807                         ework->id, ework->type);
5808                 eloop_cancel_timeout(wpas_ctrl_radio_work_timeout, work, NULL);
5809                 radio_work_done(work);
5810                 os_free(ework);
5811                 return 3; /* "OK\n" */
5812         }
5813
5814         return -1;
5815 }
5816
5817
5818 static int wpas_ctrl_radio_work(struct wpa_supplicant *wpa_s, char *cmd,
5819                                 char *buf, size_t buflen)
5820 {
5821         if (os_strcmp(cmd, "show") == 0)
5822                 return wpas_ctrl_radio_work_show(wpa_s, buf, buflen);
5823         if (os_strncmp(cmd, "add ", 4) == 0)
5824                 return wpas_ctrl_radio_work_add(wpa_s, cmd + 4, buf, buflen);
5825         if (os_strncmp(cmd, "done ", 5) == 0)
5826                 return wpas_ctrl_radio_work_done(wpa_s, cmd + 4);
5827         return -1;
5828 }
5829
5830
5831 void wpas_ctrl_radio_work_flush(struct wpa_supplicant *wpa_s)
5832 {
5833         struct wpa_radio_work *work, *tmp;
5834
5835         if (!wpa_s || !wpa_s->radio)
5836                 return;
5837
5838         dl_list_for_each_safe(work, tmp, &wpa_s->radio->work,
5839                               struct wpa_radio_work, list) {
5840                 struct wpa_external_work *ework;
5841
5842                 if (os_strncmp(work->type, "ext:", 4) != 0)
5843                         continue;
5844                 ework = work->ctx;
5845                 wpa_dbg(wpa_s, MSG_DEBUG,
5846                         "Flushing %sexternal radio work %u (%s)",
5847                         work->started ? " started" : "", ework->id,
5848                         ework->type);
5849                 if (work->started)
5850                         eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
5851                                              work, NULL);
5852                 os_free(ework);
5853                 radio_work_done(work);
5854         }
5855 }
5856
5857
5858 static void wpas_ctrl_eapol_response(void *eloop_ctx, void *timeout_ctx)
5859 {
5860         struct wpa_supplicant *wpa_s = eloop_ctx;
5861         eapol_sm_notify_ctrl_response(wpa_s->eapol);
5862 }
5863
5864
5865 static int set_scan_freqs(struct wpa_supplicant *wpa_s, char *val)
5866 {
5867         int *freqs = NULL;
5868
5869         freqs = freq_range_to_channel_list(wpa_s, val);
5870         if (freqs == NULL)
5871                 return -1;
5872
5873         os_free(wpa_s->manual_scan_freqs);
5874         wpa_s->manual_scan_freqs = freqs;
5875
5876         return 0;
5877 }
5878
5879
5880 static void wpas_ctrl_scan(struct wpa_supplicant *wpa_s, char *params,
5881                            char *reply, int reply_size, int *reply_len)
5882 {
5883         char *pos;
5884
5885         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
5886                 *reply_len = -1;
5887                 return;
5888         }
5889
5890         wpa_s->manual_scan_passive = 0;
5891         wpa_s->manual_scan_use_id = 0;
5892         wpa_s->manual_scan_only_new = 0;
5893
5894         if (params) {
5895                 if (os_strncasecmp(params, "TYPE=ONLY", 9) == 0)
5896                         wpa_s->scan_res_handler = scan_only_handler;
5897
5898                 pos = os_strstr(params, "freq=");
5899                 if (pos && set_scan_freqs(wpa_s, pos + 5) < 0) {
5900                         *reply_len = -1;
5901                         return;
5902                 }
5903
5904                 pos = os_strstr(params, "passive=");
5905                 if (pos)
5906                         wpa_s->manual_scan_passive = !!atoi(pos + 8);
5907
5908                 pos = os_strstr(params, "use_id=");
5909                 if (pos)
5910                         wpa_s->manual_scan_use_id = atoi(pos + 7);
5911
5912                 pos = os_strstr(params, "only_new=1");
5913                 if (pos)
5914                         wpa_s->manual_scan_only_new = 1;
5915         } else {
5916                 os_free(wpa_s->manual_scan_freqs);
5917                 wpa_s->manual_scan_freqs = NULL;
5918                 if (wpa_s->scan_res_handler == scan_only_handler)
5919                         wpa_s->scan_res_handler = NULL;
5920         }
5921
5922         if (!wpa_s->sched_scanning && !wpa_s->scanning &&
5923             ((wpa_s->wpa_state <= WPA_SCANNING) ||
5924              (wpa_s->wpa_state == WPA_COMPLETED))) {
5925                 wpa_s->normal_scans = 0;
5926                 wpa_s->scan_req = MANUAL_SCAN_REQ;
5927                 wpa_s->after_wps = 0;
5928                 wpa_s->known_wps_freq = 0;
5929                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5930                 if (wpa_s->manual_scan_use_id) {
5931                         wpa_s->manual_scan_id++;
5932                         wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
5933                                 wpa_s->manual_scan_id);
5934                         *reply_len = os_snprintf(reply, reply_size, "%u\n",
5935                                                  wpa_s->manual_scan_id);
5936                 }
5937         } else if (wpa_s->sched_scanning) {
5938                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to allow requested full scan to proceed");
5939                 wpa_supplicant_cancel_sched_scan(wpa_s);
5940                 wpa_s->scan_req = MANUAL_SCAN_REQ;
5941                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5942                 if (wpa_s->manual_scan_use_id) {
5943                         wpa_s->manual_scan_id++;
5944                         *reply_len = os_snprintf(reply, reply_size, "%u\n",
5945                                                  wpa_s->manual_scan_id);
5946                         wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
5947                                 wpa_s->manual_scan_id);
5948                 }
5949         } else {
5950                 wpa_printf(MSG_DEBUG, "Ongoing scan action - reject new request");
5951                 *reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
5952         }
5953 }
5954
5955
5956 #ifdef CONFIG_TESTING_OPTIONS
5957
5958 static void wpas_ctrl_iface_mgmt_tx_cb(struct wpa_supplicant *wpa_s,
5959                                        unsigned int freq, const u8 *dst,
5960                                        const u8 *src, const u8 *bssid,
5961                                        const u8 *data, size_t data_len,
5962                                        enum offchannel_send_action_result
5963                                        result)
5964 {
5965         wpa_msg(wpa_s, MSG_INFO, "MGMT-TX-STATUS freq=%u dst=" MACSTR
5966                 " src=" MACSTR " bssid=" MACSTR " result=%s",
5967                 freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid),
5968                 result == OFFCHANNEL_SEND_ACTION_SUCCESS ?
5969                 "SUCCESS" : (result == OFFCHANNEL_SEND_ACTION_NO_ACK ?
5970                              "NO_ACK" : "FAILED"));
5971 }
5972
5973
5974 static int wpas_ctrl_iface_mgmt_tx(struct wpa_supplicant *wpa_s, char *cmd)
5975 {
5976         char *pos, *param;
5977         size_t len;
5978         u8 *buf, da[ETH_ALEN], bssid[ETH_ALEN];
5979         int res, used;
5980         int freq = 0, no_cck = 0, wait_time = 0;
5981
5982         /* <DA> <BSSID> [freq=<MHz>] [wait_time=<ms>] [no_cck=1]
5983          *    <action=Action frame payload> */
5984
5985         wpa_printf(MSG_DEBUG, "External MGMT TX: %s", cmd);
5986
5987         pos = cmd;
5988         used = hwaddr_aton2(pos, da);
5989         if (used < 0)
5990                 return -1;
5991         pos += used;
5992         while (*pos == ' ')
5993                 pos++;
5994         used = hwaddr_aton2(pos, bssid);
5995         if (used < 0)
5996                 return -1;
5997         pos += used;
5998
5999         param = os_strstr(pos, " freq=");
6000         if (param) {
6001                 param += 6;
6002                 freq = atoi(param);
6003         }
6004
6005         param = os_strstr(pos, " no_cck=");
6006         if (param) {
6007                 param += 8;
6008                 no_cck = atoi(param);
6009         }
6010
6011         param = os_strstr(pos, " wait_time=");
6012         if (param) {
6013                 param += 11;
6014                 wait_time = atoi(param);
6015         }
6016
6017         param = os_strstr(pos, " action=");
6018         if (param == NULL)
6019                 return -1;
6020         param += 8;
6021
6022         len = os_strlen(param);
6023         if (len & 1)
6024                 return -1;
6025         len /= 2;
6026
6027         buf = os_malloc(len);
6028         if (buf == NULL)
6029                 return -1;
6030
6031         if (hexstr2bin(param, buf, len) < 0) {
6032                 os_free(buf);
6033                 return -1;
6034         }
6035
6036         res = offchannel_send_action(wpa_s, freq, da, wpa_s->own_addr, bssid,
6037                                      buf, len, wait_time,
6038                                      wpas_ctrl_iface_mgmt_tx_cb, no_cck);
6039         os_free(buf);
6040         return res;
6041 }
6042
6043
6044 static void wpas_ctrl_iface_mgmt_tx_done(struct wpa_supplicant *wpa_s)
6045 {
6046         wpa_printf(MSG_DEBUG, "External MGMT TX - done waiting");
6047         offchannel_send_action_done(wpa_s);
6048 }
6049
6050 #endif /* CONFIG_TESTING_OPTIONS */
6051
6052
6053 char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
6054                                          char *buf, size_t *resp_len)
6055 {
6056         char *reply;
6057         const int reply_size = 4096;
6058         int reply_len;
6059
6060         if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0 ||
6061             os_strncmp(buf, "SET_NETWORK ", 12) == 0) {
6062                 if (wpa_debug_show_keys)
6063                         wpa_dbg(wpa_s, MSG_DEBUG,
6064                                 "Control interface command '%s'", buf);
6065                 else
6066                         wpa_dbg(wpa_s, MSG_DEBUG,
6067                                 "Control interface command '%s [REMOVED]'",
6068                                 os_strncmp(buf, WPA_CTRL_RSP,
6069                                            os_strlen(WPA_CTRL_RSP)) == 0 ?
6070                                 WPA_CTRL_RSP : "SET_NETWORK");
6071         } else if (os_strncmp(buf, "WPS_NFC_TAG_READ", 16) == 0 ||
6072                    os_strncmp(buf, "NFC_REPORT_HANDOVER", 19) == 0 ||
6073                    os_strncmp(buf, "NFC_RX_HANDOVER_SEL", 19) == 0) {
6074                 wpa_hexdump_ascii_key(MSG_DEBUG, "RX ctrl_iface",
6075                                       (const u8 *) buf, os_strlen(buf));
6076         } else {
6077                 int level = MSG_DEBUG;
6078                 if (os_strcmp(buf, "PING") == 0)
6079                         level = MSG_EXCESSIVE;
6080                 wpa_dbg(wpa_s, level, "Control interface command '%s'", buf);
6081         }
6082
6083         reply = os_malloc(reply_size);
6084         if (reply == NULL) {
6085                 *resp_len = 1;
6086                 return NULL;
6087         }
6088
6089         os_memcpy(reply, "OK\n", 3);
6090         reply_len = 3;
6091
6092         if (os_strcmp(buf, "PING") == 0) {
6093                 os_memcpy(reply, "PONG\n", 5);
6094                 reply_len = 5;
6095         } else if (os_strcmp(buf, "IFNAME") == 0) {
6096                 reply_len = os_strlen(wpa_s->ifname);
6097                 os_memcpy(reply, wpa_s->ifname, reply_len);
6098         } else if (os_strncmp(buf, "RELOG", 5) == 0) {
6099                 if (wpa_debug_reopen_file() < 0)
6100                         reply_len = -1;
6101         } else if (os_strncmp(buf, "NOTE ", 5) == 0) {
6102                 wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
6103         } else if (os_strcmp(buf, "MIB") == 0) {
6104                 reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
6105                 if (reply_len >= 0) {
6106                         int res;
6107                         res = eapol_sm_get_mib(wpa_s->eapol, reply + reply_len,
6108                                                reply_size - reply_len);
6109                         if (res < 0)
6110                                 reply_len = -1;
6111                         else
6112                                 reply_len += res;
6113                 }
6114         } else if (os_strncmp(buf, "STATUS", 6) == 0) {
6115                 reply_len = wpa_supplicant_ctrl_iface_status(
6116                         wpa_s, buf + 6, reply, reply_size);
6117         } else if (os_strcmp(buf, "PMKSA") == 0) {
6118                 reply_len = wpa_sm_pmksa_cache_list(wpa_s->wpa, reply,
6119                                                     reply_size);
6120         } else if (os_strncmp(buf, "SET ", 4) == 0) {
6121                 if (wpa_supplicant_ctrl_iface_set(wpa_s, buf + 4))
6122                         reply_len = -1;
6123         } else if (os_strncmp(buf, "GET ", 4) == 0) {
6124                 reply_len = wpa_supplicant_ctrl_iface_get(wpa_s, buf + 4,
6125                                                           reply, reply_size);
6126         } else if (os_strcmp(buf, "LOGON") == 0) {
6127                 eapol_sm_notify_logoff(wpa_s->eapol, FALSE);
6128         } else if (os_strcmp(buf, "LOGOFF") == 0) {
6129                 eapol_sm_notify_logoff(wpa_s->eapol, TRUE);
6130         } else if (os_strcmp(buf, "REASSOCIATE") == 0) {
6131                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
6132                         reply_len = -1;
6133                 else
6134                         wpas_request_connection(wpa_s);
6135         } else if (os_strcmp(buf, "REATTACH") == 0) {
6136                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED ||
6137                     !wpa_s->current_ssid)
6138                         reply_len = -1;
6139                 else {
6140                         wpa_s->reattach = 1;
6141                         wpas_request_connection(wpa_s);
6142                 }
6143         } else if (os_strcmp(buf, "RECONNECT") == 0) {
6144                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
6145                         reply_len = -1;
6146                 else if (wpa_s->disconnected)
6147                         wpas_request_connection(wpa_s);
6148 #ifdef IEEE8021X_EAPOL
6149         } else if (os_strncmp(buf, "PREAUTH ", 8) == 0) {
6150                 if (wpa_supplicant_ctrl_iface_preauth(wpa_s, buf + 8))
6151                         reply_len = -1;
6152 #endif /* IEEE8021X_EAPOL */
6153 #ifdef CONFIG_PEERKEY
6154         } else if (os_strncmp(buf, "STKSTART ", 9) == 0) {
6155                 if (wpa_supplicant_ctrl_iface_stkstart(wpa_s, buf + 9))
6156                         reply_len = -1;
6157 #endif /* CONFIG_PEERKEY */
6158 #ifdef CONFIG_IEEE80211R
6159         } else if (os_strncmp(buf, "FT_DS ", 6) == 0) {
6160                 if (wpa_supplicant_ctrl_iface_ft_ds(wpa_s, buf + 6))
6161                         reply_len = -1;
6162 #endif /* CONFIG_IEEE80211R */
6163 #ifdef CONFIG_WPS
6164         } else if (os_strcmp(buf, "WPS_PBC") == 0) {
6165                 int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, NULL);
6166                 if (res == -2) {
6167                         os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
6168                         reply_len = 17;
6169                 } else if (res)
6170                         reply_len = -1;
6171         } else if (os_strncmp(buf, "WPS_PBC ", 8) == 0) {
6172                 int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, buf + 8);
6173                 if (res == -2) {
6174                         os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
6175                         reply_len = 17;
6176                 } else if (res)
6177                         reply_len = -1;
6178         } else if (os_strncmp(buf, "WPS_PIN ", 8) == 0) {
6179                 reply_len = wpa_supplicant_ctrl_iface_wps_pin(wpa_s, buf + 8,
6180                                                               reply,
6181                                                               reply_size);
6182         } else if (os_strncmp(buf, "WPS_CHECK_PIN ", 14) == 0) {
6183                 reply_len = wpa_supplicant_ctrl_iface_wps_check_pin(
6184                         wpa_s, buf + 14, reply, reply_size);
6185         } else if (os_strcmp(buf, "WPS_CANCEL") == 0) {
6186                 if (wpas_wps_cancel(wpa_s))
6187                         reply_len = -1;
6188 #ifdef CONFIG_WPS_NFC
6189         } else if (os_strcmp(buf, "WPS_NFC") == 0) {
6190                 if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, NULL))
6191                         reply_len = -1;
6192         } else if (os_strncmp(buf, "WPS_NFC ", 8) == 0) {
6193                 if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, buf + 8))
6194                         reply_len = -1;
6195         } else if (os_strncmp(buf, "WPS_NFC_CONFIG_TOKEN ", 21) == 0) {
6196                 reply_len = wpa_supplicant_ctrl_iface_wps_nfc_config_token(
6197                         wpa_s, buf + 21, reply, reply_size);
6198         } else if (os_strncmp(buf, "WPS_NFC_TOKEN ", 14) == 0) {
6199                 reply_len = wpa_supplicant_ctrl_iface_wps_nfc_token(
6200                         wpa_s, buf + 14, reply, reply_size);
6201         } else if (os_strncmp(buf, "WPS_NFC_TAG_READ ", 17) == 0) {
6202                 if (wpa_supplicant_ctrl_iface_wps_nfc_tag_read(wpa_s,
6203                                                                buf + 17))
6204                         reply_len = -1;
6205         } else if (os_strncmp(buf, "NFC_GET_HANDOVER_REQ ", 21) == 0) {
6206                 reply_len = wpas_ctrl_nfc_get_handover_req(
6207                         wpa_s, buf + 21, reply, reply_size);
6208         } else if (os_strncmp(buf, "NFC_GET_HANDOVER_SEL ", 21) == 0) {
6209                 reply_len = wpas_ctrl_nfc_get_handover_sel(
6210                         wpa_s, buf + 21, reply, reply_size);
6211         } else if (os_strncmp(buf, "NFC_RX_HANDOVER_SEL ", 20) == 0) {
6212                 if (wpas_ctrl_nfc_rx_handover_sel(wpa_s, buf + 20))
6213                         reply_len = -1;
6214         } else if (os_strncmp(buf, "NFC_REPORT_HANDOVER ", 20) == 0) {
6215                 if (wpas_ctrl_nfc_report_handover(wpa_s, buf + 20))
6216                         reply_len = -1;
6217 #endif /* CONFIG_WPS_NFC */
6218         } else if (os_strncmp(buf, "WPS_REG ", 8) == 0) {
6219                 if (wpa_supplicant_ctrl_iface_wps_reg(wpa_s, buf + 8))
6220                         reply_len = -1;
6221 #ifdef CONFIG_AP
6222         } else if (os_strncmp(buf, "WPS_AP_PIN ", 11) == 0) {
6223                 reply_len = wpa_supplicant_ctrl_iface_wps_ap_pin(
6224                         wpa_s, buf + 11, reply, reply_size);
6225 #endif /* CONFIG_AP */
6226 #ifdef CONFIG_WPS_ER
6227         } else if (os_strcmp(buf, "WPS_ER_START") == 0) {
6228                 if (wpas_wps_er_start(wpa_s, NULL))
6229                         reply_len = -1;
6230         } else if (os_strncmp(buf, "WPS_ER_START ", 13) == 0) {
6231                 if (wpas_wps_er_start(wpa_s, buf + 13))
6232                         reply_len = -1;
6233         } else if (os_strcmp(buf, "WPS_ER_STOP") == 0) {
6234                 if (wpas_wps_er_stop(wpa_s))
6235                         reply_len = -1;
6236         } else if (os_strncmp(buf, "WPS_ER_PIN ", 11) == 0) {
6237                 if (wpa_supplicant_ctrl_iface_wps_er_pin(wpa_s, buf + 11))
6238                         reply_len = -1;
6239         } else if (os_strncmp(buf, "WPS_ER_PBC ", 11) == 0) {
6240                 int ret = wpas_wps_er_pbc(wpa_s, buf + 11);
6241                 if (ret == -2) {
6242                         os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
6243                         reply_len = 17;
6244                 } else if (ret == -3) {
6245                         os_memcpy(reply, "FAIL-UNKNOWN-UUID\n", 18);
6246                         reply_len = 18;
6247                 } else if (ret == -4) {
6248                         os_memcpy(reply, "FAIL-NO-AP-SETTINGS\n", 20);
6249                         reply_len = 20;
6250                 } else if (ret)
6251                         reply_len = -1;
6252         } else if (os_strncmp(buf, "WPS_ER_LEARN ", 13) == 0) {
6253                 if (wpa_supplicant_ctrl_iface_wps_er_learn(wpa_s, buf + 13))
6254                         reply_len = -1;
6255         } else if (os_strncmp(buf, "WPS_ER_SET_CONFIG ", 18) == 0) {
6256                 if (wpa_supplicant_ctrl_iface_wps_er_set_config(wpa_s,
6257                                                                 buf + 18))
6258                         reply_len = -1;
6259         } else if (os_strncmp(buf, "WPS_ER_CONFIG ", 14) == 0) {
6260                 if (wpa_supplicant_ctrl_iface_wps_er_config(wpa_s, buf + 14))
6261                         reply_len = -1;
6262 #ifdef CONFIG_WPS_NFC
6263         } else if (os_strncmp(buf, "WPS_ER_NFC_CONFIG_TOKEN ", 24) == 0) {
6264                 reply_len = wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
6265                         wpa_s, buf + 24, reply, reply_size);
6266 #endif /* CONFIG_WPS_NFC */
6267 #endif /* CONFIG_WPS_ER */
6268 #endif /* CONFIG_WPS */
6269 #ifdef CONFIG_IBSS_RSN
6270         } else if (os_strncmp(buf, "IBSS_RSN ", 9) == 0) {
6271                 if (wpa_supplicant_ctrl_iface_ibss_rsn(wpa_s, buf + 9))
6272                         reply_len = -1;
6273 #endif /* CONFIG_IBSS_RSN */
6274 #ifdef CONFIG_P2P
6275         } else if (os_strncmp(buf, "P2P_FIND ", 9) == 0) {
6276                 if (p2p_ctrl_find(wpa_s, buf + 9))
6277                         reply_len = -1;
6278         } else if (os_strcmp(buf, "P2P_FIND") == 0) {
6279                 if (p2p_ctrl_find(wpa_s, ""))
6280                         reply_len = -1;
6281         } else if (os_strcmp(buf, "P2P_STOP_FIND") == 0) {
6282                 wpas_p2p_stop_find(wpa_s);
6283         } else if (os_strncmp(buf, "P2P_CONNECT ", 12) == 0) {
6284                 reply_len = p2p_ctrl_connect(wpa_s, buf + 12, reply,
6285                                              reply_size);
6286         } else if (os_strncmp(buf, "P2P_LISTEN ", 11) == 0) {
6287                 if (p2p_ctrl_listen(wpa_s, buf + 11))
6288                         reply_len = -1;
6289         } else if (os_strcmp(buf, "P2P_LISTEN") == 0) {
6290                 if (p2p_ctrl_listen(wpa_s, ""))
6291                         reply_len = -1;
6292         } else if (os_strncmp(buf, "P2P_GROUP_REMOVE ", 17) == 0) {
6293                 if (wpas_p2p_group_remove(wpa_s, buf + 17))
6294                         reply_len = -1;
6295         } else if (os_strcmp(buf, "P2P_GROUP_ADD") == 0) {
6296                 if (wpas_p2p_group_add(wpa_s, 0, 0, 0, 0))
6297                         reply_len = -1;
6298         } else if (os_strncmp(buf, "P2P_GROUP_ADD ", 14) == 0) {
6299                 if (p2p_ctrl_group_add(wpa_s, buf + 14))
6300                         reply_len = -1;
6301         } else if (os_strncmp(buf, "P2P_PROV_DISC ", 14) == 0) {
6302                 if (p2p_ctrl_prov_disc(wpa_s, buf + 14))
6303                         reply_len = -1;
6304         } else if (os_strcmp(buf, "P2P_GET_PASSPHRASE") == 0) {
6305                 reply_len = p2p_get_passphrase(wpa_s, reply, reply_size);
6306         } else if (os_strncmp(buf, "P2P_SERV_DISC_REQ ", 18) == 0) {
6307                 reply_len = p2p_ctrl_serv_disc_req(wpa_s, buf + 18, reply,
6308                                                    reply_size);
6309         } else if (os_strncmp(buf, "P2P_SERV_DISC_CANCEL_REQ ", 25) == 0) {
6310                 if (p2p_ctrl_serv_disc_cancel_req(wpa_s, buf + 25) < 0)
6311                         reply_len = -1;
6312         } else if (os_strncmp(buf, "P2P_SERV_DISC_RESP ", 19) == 0) {
6313                 if (p2p_ctrl_serv_disc_resp(wpa_s, buf + 19) < 0)
6314                         reply_len = -1;
6315         } else if (os_strcmp(buf, "P2P_SERVICE_UPDATE") == 0) {
6316                 wpas_p2p_sd_service_update(wpa_s);
6317         } else if (os_strncmp(buf, "P2P_SERV_DISC_EXTERNAL ", 23) == 0) {
6318                 if (p2p_ctrl_serv_disc_external(wpa_s, buf + 23) < 0)
6319                         reply_len = -1;
6320         } else if (os_strcmp(buf, "P2P_SERVICE_FLUSH") == 0) {
6321                 wpas_p2p_service_flush(wpa_s);
6322         } else if (os_strncmp(buf, "P2P_SERVICE_ADD ", 16) == 0) {
6323                 if (p2p_ctrl_service_add(wpa_s, buf + 16) < 0)
6324                         reply_len = -1;
6325         } else if (os_strncmp(buf, "P2P_SERVICE_DEL ", 16) == 0) {
6326                 if (p2p_ctrl_service_del(wpa_s, buf + 16) < 0)
6327                         reply_len = -1;
6328         } else if (os_strncmp(buf, "P2P_REJECT ", 11) == 0) {
6329                 if (p2p_ctrl_reject(wpa_s, buf + 11) < 0)
6330                         reply_len = -1;
6331         } else if (os_strncmp(buf, "P2P_INVITE ", 11) == 0) {
6332                 if (p2p_ctrl_invite(wpa_s, buf + 11) < 0)
6333                         reply_len = -1;
6334         } else if (os_strncmp(buf, "P2P_PEER ", 9) == 0) {
6335                 reply_len = p2p_ctrl_peer(wpa_s, buf + 9, reply,
6336                                               reply_size);
6337         } else if (os_strncmp(buf, "P2P_SET ", 8) == 0) {
6338                 if (p2p_ctrl_set(wpa_s, buf + 8) < 0)
6339                         reply_len = -1;
6340         } else if (os_strcmp(buf, "P2P_FLUSH") == 0) {
6341                 p2p_ctrl_flush(wpa_s);
6342         } else if (os_strncmp(buf, "P2P_UNAUTHORIZE ", 16) == 0) {
6343                 if (wpas_p2p_unauthorize(wpa_s, buf + 16) < 0)
6344                         reply_len = -1;
6345         } else if (os_strcmp(buf, "P2P_CANCEL") == 0) {
6346                 if (wpas_p2p_cancel(wpa_s))
6347                         reply_len = -1;
6348         } else if (os_strncmp(buf, "P2P_PRESENCE_REQ ", 17) == 0) {
6349                 if (p2p_ctrl_presence_req(wpa_s, buf + 17) < 0)
6350                         reply_len = -1;
6351         } else if (os_strcmp(buf, "P2P_PRESENCE_REQ") == 0) {
6352                 if (p2p_ctrl_presence_req(wpa_s, "") < 0)
6353                         reply_len = -1;
6354         } else if (os_strncmp(buf, "P2P_EXT_LISTEN ", 15) == 0) {
6355                 if (p2p_ctrl_ext_listen(wpa_s, buf + 15) < 0)
6356                         reply_len = -1;
6357         } else if (os_strcmp(buf, "P2P_EXT_LISTEN") == 0) {
6358                 if (p2p_ctrl_ext_listen(wpa_s, "") < 0)
6359                         reply_len = -1;
6360         } else if (os_strncmp(buf, "P2P_REMOVE_CLIENT ", 18) == 0) {
6361                 if (p2p_ctrl_remove_client(wpa_s, buf + 18) < 0)
6362                         reply_len = -1;
6363 #endif /* CONFIG_P2P */
6364 #ifdef CONFIG_WIFI_DISPLAY
6365         } else if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0) {
6366                 if (wifi_display_subelem_set(wpa_s->global, buf + 16) < 0)
6367                         reply_len = -1;
6368         } else if (os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0) {
6369                 reply_len = wifi_display_subelem_get(wpa_s->global, buf + 16,
6370                                                      reply, reply_size);
6371 #endif /* CONFIG_WIFI_DISPLAY */
6372 #ifdef CONFIG_INTERWORKING
6373         } else if (os_strcmp(buf, "FETCH_ANQP") == 0) {
6374                 if (interworking_fetch_anqp(wpa_s) < 0)
6375                         reply_len = -1;
6376         } else if (os_strcmp(buf, "STOP_FETCH_ANQP") == 0) {
6377                 interworking_stop_fetch_anqp(wpa_s);
6378         } else if (os_strcmp(buf, "INTERWORKING_SELECT") == 0) {
6379                 if (ctrl_interworking_select(wpa_s, NULL) < 0)
6380                         reply_len = -1;
6381         } else if (os_strncmp(buf, "INTERWORKING_SELECT ", 20) == 0) {
6382                 if (ctrl_interworking_select(wpa_s, buf + 20) < 0)
6383                         reply_len = -1;
6384         } else if (os_strncmp(buf, "INTERWORKING_CONNECT ", 21) == 0) {
6385                 if (ctrl_interworking_connect(wpa_s, buf + 21) < 0)
6386                         reply_len = -1;
6387         } else if (os_strncmp(buf, "ANQP_GET ", 9) == 0) {
6388                 if (get_anqp(wpa_s, buf + 9) < 0)
6389                         reply_len = -1;
6390         } else if (os_strncmp(buf, "GAS_REQUEST ", 12) == 0) {
6391                 if (gas_request(wpa_s, buf + 12) < 0)
6392                         reply_len = -1;
6393         } else if (os_strncmp(buf, "GAS_RESPONSE_GET ", 17) == 0) {
6394                 reply_len = gas_response_get(wpa_s, buf + 17, reply,
6395                                              reply_size);
6396 #endif /* CONFIG_INTERWORKING */
6397 #ifdef CONFIG_HS20
6398         } else if (os_strncmp(buf, "HS20_ANQP_GET ", 14) == 0) {
6399                 if (get_hs20_anqp(wpa_s, buf + 14) < 0)
6400                         reply_len = -1;
6401         } else if (os_strncmp(buf, "HS20_GET_NAI_HOME_REALM_LIST ", 29) == 0) {
6402                 if (hs20_get_nai_home_realm_list(wpa_s, buf + 29) < 0)
6403                         reply_len = -1;
6404         } else if (os_strncmp(buf, "HS20_ICON_REQUEST ", 18) == 0) {
6405                 if (hs20_icon_request(wpa_s, buf + 18) < 0)
6406                         reply_len = -1;
6407         } else if (os_strcmp(buf, "FETCH_OSU") == 0) {
6408                 if (hs20_fetch_osu(wpa_s) < 0)
6409                         reply_len = -1;
6410         } else if (os_strcmp(buf, "CANCEL_FETCH_OSU") == 0) {
6411                 hs20_cancel_fetch_osu(wpa_s);
6412 #endif /* CONFIG_HS20 */
6413         } else if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0)
6414         {
6415                 if (wpa_supplicant_ctrl_iface_ctrl_rsp(
6416                             wpa_s, buf + os_strlen(WPA_CTRL_RSP)))
6417                         reply_len = -1;
6418                 else {
6419                         /*
6420                          * Notify response from timeout to allow the control
6421                          * interface response to be sent first.
6422                          */
6423                         eloop_register_timeout(0, 0, wpas_ctrl_eapol_response,
6424                                                wpa_s, NULL);
6425                 }
6426         } else if (os_strcmp(buf, "RECONFIGURE") == 0) {
6427                 if (wpa_supplicant_reload_configuration(wpa_s))
6428                         reply_len = -1;
6429         } else if (os_strcmp(buf, "TERMINATE") == 0) {
6430                 wpa_supplicant_terminate_proc(wpa_s->global);
6431         } else if (os_strncmp(buf, "BSSID ", 6) == 0) {
6432                 if (wpa_supplicant_ctrl_iface_bssid(wpa_s, buf + 6))
6433                         reply_len = -1;
6434         } else if (os_strncmp(buf, "BLACKLIST", 9) == 0) {
6435                 reply_len = wpa_supplicant_ctrl_iface_blacklist(
6436                         wpa_s, buf + 9, reply, reply_size);
6437         } else if (os_strncmp(buf, "LOG_LEVEL", 9) == 0) {
6438                 reply_len = wpa_supplicant_ctrl_iface_log_level(
6439                         wpa_s, buf + 9, reply, reply_size);
6440         } else if (os_strcmp(buf, "LIST_NETWORKS") == 0) {
6441                 reply_len = wpa_supplicant_ctrl_iface_list_networks(
6442                         wpa_s, reply, reply_size);
6443         } else if (os_strcmp(buf, "DISCONNECT") == 0) {
6444 #ifdef CONFIG_SME
6445                 wpa_s->sme.prev_bssid_set = 0;
6446 #endif /* CONFIG_SME */
6447                 wpa_s->reassociate = 0;
6448                 wpa_s->disconnected = 1;
6449                 wpa_supplicant_cancel_sched_scan(wpa_s);
6450                 wpa_supplicant_cancel_scan(wpa_s);
6451                 wpa_supplicant_deauthenticate(wpa_s,
6452                                               WLAN_REASON_DEAUTH_LEAVING);
6453         } else if (os_strcmp(buf, "SCAN") == 0) {
6454                 wpas_ctrl_scan(wpa_s, NULL, reply, reply_size, &reply_len);
6455         } else if (os_strncmp(buf, "SCAN ", 5) == 0) {
6456                 wpas_ctrl_scan(wpa_s, buf + 5, reply, reply_size, &reply_len);
6457         } else if (os_strcmp(buf, "SCAN_RESULTS") == 0) {
6458                 reply_len = wpa_supplicant_ctrl_iface_scan_results(
6459                         wpa_s, reply, reply_size);
6460         } else if (os_strncmp(buf, "SELECT_NETWORK ", 15) == 0) {
6461                 if (wpa_supplicant_ctrl_iface_select_network(wpa_s, buf + 15))
6462                         reply_len = -1;
6463         } else if (os_strncmp(buf, "ENABLE_NETWORK ", 15) == 0) {
6464                 if (wpa_supplicant_ctrl_iface_enable_network(wpa_s, buf + 15))
6465                         reply_len = -1;
6466         } else if (os_strncmp(buf, "DISABLE_NETWORK ", 16) == 0) {
6467                 if (wpa_supplicant_ctrl_iface_disable_network(wpa_s, buf + 16))
6468                         reply_len = -1;
6469         } else if (os_strcmp(buf, "ADD_NETWORK") == 0) {
6470                 reply_len = wpa_supplicant_ctrl_iface_add_network(
6471                         wpa_s, reply, reply_size);
6472         } else if (os_strncmp(buf, "REMOVE_NETWORK ", 15) == 0) {
6473                 if (wpa_supplicant_ctrl_iface_remove_network(wpa_s, buf + 15))
6474                         reply_len = -1;
6475         } else if (os_strncmp(buf, "SET_NETWORK ", 12) == 0) {
6476                 if (wpa_supplicant_ctrl_iface_set_network(wpa_s, buf + 12))
6477                         reply_len = -1;
6478         } else if (os_strncmp(buf, "GET_NETWORK ", 12) == 0) {
6479                 reply_len = wpa_supplicant_ctrl_iface_get_network(
6480                         wpa_s, buf + 12, reply, reply_size);
6481         } else if (os_strcmp(buf, "LIST_CREDS") == 0) {
6482                 reply_len = wpa_supplicant_ctrl_iface_list_creds(
6483                         wpa_s, reply, reply_size);
6484         } else if (os_strcmp(buf, "ADD_CRED") == 0) {
6485                 reply_len = wpa_supplicant_ctrl_iface_add_cred(
6486                         wpa_s, reply, reply_size);
6487         } else if (os_strncmp(buf, "REMOVE_CRED ", 12) == 0) {
6488                 if (wpa_supplicant_ctrl_iface_remove_cred(wpa_s, buf + 12))
6489                         reply_len = -1;
6490         } else if (os_strncmp(buf, "SET_CRED ", 9) == 0) {
6491                 if (wpa_supplicant_ctrl_iface_set_cred(wpa_s, buf + 9))
6492                         reply_len = -1;
6493         } else if (os_strncmp(buf, "GET_CRED ", 9) == 0) {
6494                 reply_len = wpa_supplicant_ctrl_iface_get_cred(wpa_s, buf + 9,
6495                                                                reply,
6496                                                                reply_size);
6497 #ifndef CONFIG_NO_CONFIG_WRITE
6498         } else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
6499                 if (wpa_supplicant_ctrl_iface_save_config(wpa_s))
6500                         reply_len = -1;
6501 #endif /* CONFIG_NO_CONFIG_WRITE */
6502         } else if (os_strncmp(buf, "GET_CAPABILITY ", 15) == 0) {
6503                 reply_len = wpa_supplicant_ctrl_iface_get_capability(
6504                         wpa_s, buf + 15, reply, reply_size);
6505         } else if (os_strncmp(buf, "AP_SCAN ", 8) == 0) {
6506                 if (wpa_supplicant_ctrl_iface_ap_scan(wpa_s, buf + 8))
6507                         reply_len = -1;
6508         } else if (os_strncmp(buf, "SCAN_INTERVAL ", 14) == 0) {
6509                 if (wpa_supplicant_ctrl_iface_scan_interval(wpa_s, buf + 14))
6510                         reply_len = -1;
6511         } else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
6512                 reply_len = wpa_supplicant_global_iface_list(
6513                         wpa_s->global, reply, reply_size);
6514         } else if (os_strcmp(buf, "INTERFACES") == 0) {
6515                 reply_len = wpa_supplicant_global_iface_interfaces(
6516                         wpa_s->global, reply, reply_size);
6517         } else if (os_strncmp(buf, "BSS ", 4) == 0) {
6518                 reply_len = wpa_supplicant_ctrl_iface_bss(
6519                         wpa_s, buf + 4, reply, reply_size);
6520 #ifdef CONFIG_AP
6521         } else if (os_strcmp(buf, "STA-FIRST") == 0) {
6522                 reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
6523         } else if (os_strncmp(buf, "STA ", 4) == 0) {
6524                 reply_len = ap_ctrl_iface_sta(wpa_s, buf + 4, reply,
6525                                               reply_size);
6526         } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
6527                 reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
6528                                                    reply_size);
6529         } else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
6530                 if (ap_ctrl_iface_sta_deauthenticate(wpa_s, buf + 15))
6531                         reply_len = -1;
6532         } else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
6533                 if (ap_ctrl_iface_sta_disassociate(wpa_s, buf + 13))
6534                         reply_len = -1;
6535         } else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
6536                 if (ap_ctrl_iface_chanswitch(wpa_s, buf + 12))
6537                         reply_len = -1;
6538 #endif /* CONFIG_AP */
6539         } else if (os_strcmp(buf, "SUSPEND") == 0) {
6540                 wpas_notify_suspend(wpa_s->global);
6541         } else if (os_strcmp(buf, "RESUME") == 0) {
6542                 wpas_notify_resume(wpa_s->global);
6543         } else if (os_strcmp(buf, "DROP_SA") == 0) {
6544                 wpa_supplicant_ctrl_iface_drop_sa(wpa_s);
6545         } else if (os_strncmp(buf, "ROAM ", 5) == 0) {
6546                 if (wpa_supplicant_ctrl_iface_roam(wpa_s, buf + 5))
6547                         reply_len = -1;
6548         } else if (os_strncmp(buf, "STA_AUTOCONNECT ", 16) == 0) {
6549                 if (wpa_supplicant_ctrl_iface_sta_autoconnect(wpa_s, buf + 16))
6550                         reply_len = -1;
6551         } else if (os_strncmp(buf, "BSS_EXPIRE_AGE ", 15) == 0) {
6552                 if (wpa_supplicant_ctrl_iface_bss_expire_age(wpa_s, buf + 15))
6553                         reply_len = -1;
6554         } else if (os_strncmp(buf, "BSS_EXPIRE_COUNT ", 17) == 0) {
6555                 if (wpa_supplicant_ctrl_iface_bss_expire_count(wpa_s,
6556                                                                buf + 17))
6557                         reply_len = -1;
6558         } else if (os_strncmp(buf, "BSS_FLUSH ", 10) == 0) {
6559                 if (wpa_supplicant_ctrl_iface_bss_flush(wpa_s, buf + 10))
6560                         reply_len = -1;
6561 #ifdef CONFIG_TDLS
6562         } else if (os_strncmp(buf, "TDLS_DISCOVER ", 14) == 0) {
6563                 if (wpa_supplicant_ctrl_iface_tdls_discover(wpa_s, buf + 14))
6564                         reply_len = -1;
6565         } else if (os_strncmp(buf, "TDLS_SETUP ", 11) == 0) {
6566                 if (wpa_supplicant_ctrl_iface_tdls_setup(wpa_s, buf + 11))
6567                         reply_len = -1;
6568         } else if (os_strncmp(buf, "TDLS_TEARDOWN ", 14) == 0) {
6569                 if (wpa_supplicant_ctrl_iface_tdls_teardown(wpa_s, buf + 14))
6570                         reply_len = -1;
6571 #endif /* CONFIG_TDLS */
6572         } else if (os_strncmp(buf, "SIGNAL_POLL", 11) == 0) {
6573                 reply_len = wpa_supplicant_signal_poll(wpa_s, reply,
6574                                                        reply_size);
6575         } else if (os_strncmp(buf, "PKTCNT_POLL", 11) == 0) {
6576                 reply_len = wpa_supplicant_pktcnt_poll(wpa_s, reply,
6577                                                        reply_size);
6578 #ifdef CONFIG_AUTOSCAN
6579         } else if (os_strncmp(buf, "AUTOSCAN ", 9) == 0) {
6580                 if (wpa_supplicant_ctrl_iface_autoscan(wpa_s, buf + 9))
6581                         reply_len = -1;
6582 #endif /* CONFIG_AUTOSCAN */
6583 #ifdef ANDROID
6584         } else if (os_strncmp(buf, "DRIVER ", 7) == 0) {
6585                 reply_len = wpa_supplicant_driver_cmd(wpa_s, buf + 7, reply,
6586                                                       reply_size);
6587 #endif /* ANDROID */
6588         } else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
6589                 reply_len = wpa_supplicant_vendor_cmd(wpa_s, buf + 7, reply,
6590                                                       reply_size);
6591         } else if (os_strcmp(buf, "REAUTHENTICATE") == 0) {
6592                 pmksa_cache_clear_current(wpa_s->wpa);
6593                 eapol_sm_request_reauth(wpa_s->eapol);
6594 #ifdef CONFIG_WNM
6595         } else if (os_strncmp(buf, "WNM_SLEEP ", 10) == 0) {
6596                 if (wpas_ctrl_iface_wnm_sleep(wpa_s, buf + 10))
6597                         reply_len = -1;
6598         } else if (os_strncmp(buf, "WNM_BSS_QUERY ", 10) == 0) {
6599                 if (wpas_ctrl_iface_wnm_bss_query(wpa_s, buf + 10))
6600                                 reply_len = -1;
6601 #endif /* CONFIG_WNM */
6602         } else if (os_strcmp(buf, "FLUSH") == 0) {
6603                 wpa_supplicant_ctrl_iface_flush(wpa_s);
6604         } else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
6605                 reply_len = wpas_ctrl_radio_work(wpa_s, buf + 11, reply,
6606                                                  reply_size);
6607 #ifdef CONFIG_TESTING_OPTIONS
6608         } else if (os_strncmp(buf, "MGMT_TX ", 8) == 0) {
6609                 if (wpas_ctrl_iface_mgmt_tx(wpa_s, buf + 8) < 0)
6610                         reply_len = -1;
6611         } else if (os_strcmp(buf, "MGMT_TX_DONE") == 0) {
6612                 wpas_ctrl_iface_mgmt_tx_done(wpa_s);
6613 #endif /* CONFIG_TESTING_OPTIONS */
6614         } else {
6615                 os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
6616                 reply_len = 16;
6617         }
6618
6619         if (reply_len < 0) {
6620                 os_memcpy(reply, "FAIL\n", 5);
6621                 reply_len = 5;
6622         }
6623
6624         *resp_len = reply_len;
6625         return reply;
6626 }
6627
6628
6629 static int wpa_supplicant_global_iface_add(struct wpa_global *global,
6630                                            char *cmd)
6631 {
6632         struct wpa_interface iface;
6633         char *pos;
6634
6635         /*
6636          * <ifname>TAB<confname>TAB<driver>TAB<ctrl_interface>TAB<driver_param>
6637          * TAB<bridge_ifname>
6638          */
6639         wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_ADD '%s'", cmd);
6640
6641         os_memset(&iface, 0, sizeof(iface));
6642
6643         do {
6644                 iface.ifname = pos = cmd;
6645                 pos = os_strchr(pos, '\t');
6646                 if (pos)
6647                         *pos++ = '\0';
6648                 if (iface.ifname[0] == '\0')
6649                         return -1;
6650                 if (pos == NULL)
6651                         break;
6652
6653                 iface.confname = pos;
6654                 pos = os_strchr(pos, '\t');
6655                 if (pos)
6656                         *pos++ = '\0';
6657                 if (iface.confname[0] == '\0')
6658                         iface.confname = NULL;
6659                 if (pos == NULL)
6660                         break;
6661
6662                 iface.driver = pos;
6663                 pos = os_strchr(pos, '\t');
6664                 if (pos)
6665                         *pos++ = '\0';
6666                 if (iface.driver[0] == '\0')
6667                         iface.driver = NULL;
6668                 if (pos == NULL)
6669                         break;
6670
6671                 iface.ctrl_interface = pos;
6672                 pos = os_strchr(pos, '\t');
6673                 if (pos)
6674                         *pos++ = '\0';
6675                 if (iface.ctrl_interface[0] == '\0')
6676                         iface.ctrl_interface = NULL;
6677                 if (pos == NULL)
6678                         break;
6679
6680                 iface.driver_param = pos;
6681                 pos = os_strchr(pos, '\t');
6682                 if (pos)
6683                         *pos++ = '\0';
6684                 if (iface.driver_param[0] == '\0')
6685                         iface.driver_param = NULL;
6686                 if (pos == NULL)
6687                         break;
6688
6689                 iface.bridge_ifname = pos;
6690                 pos = os_strchr(pos, '\t');
6691                 if (pos)
6692                         *pos++ = '\0';
6693                 if (iface.bridge_ifname[0] == '\0')
6694                         iface.bridge_ifname = NULL;
6695                 if (pos == NULL)
6696                         break;
6697         } while (0);
6698
6699         if (wpa_supplicant_get_iface(global, iface.ifname))
6700                 return -1;
6701
6702         return wpa_supplicant_add_iface(global, &iface) ? 0 : -1;
6703 }
6704
6705
6706 static int wpa_supplicant_global_iface_remove(struct wpa_global *global,
6707                                               char *cmd)
6708 {
6709         struct wpa_supplicant *wpa_s;
6710
6711         wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_REMOVE '%s'", cmd);
6712
6713         wpa_s = wpa_supplicant_get_iface(global, cmd);
6714         if (wpa_s == NULL)
6715                 return -1;
6716         return wpa_supplicant_remove_iface(global, wpa_s, 0);
6717 }
6718
6719
6720 static void wpa_free_iface_info(struct wpa_interface_info *iface)
6721 {
6722         struct wpa_interface_info *prev;
6723
6724         while (iface) {
6725                 prev = iface;
6726                 iface = iface->next;
6727
6728                 os_free(prev->ifname);
6729                 os_free(prev->desc);
6730                 os_free(prev);
6731         }
6732 }
6733
6734
6735 static int wpa_supplicant_global_iface_list(struct wpa_global *global,
6736                                             char *buf, int len)
6737 {
6738         int i, res;
6739         struct wpa_interface_info *iface = NULL, *last = NULL, *tmp;
6740         char *pos, *end;
6741
6742         for (i = 0; wpa_drivers[i]; i++) {
6743                 struct wpa_driver_ops *drv = wpa_drivers[i];
6744                 if (drv->get_interfaces == NULL)
6745                         continue;
6746                 tmp = drv->get_interfaces(global->drv_priv[i]);
6747                 if (tmp == NULL)
6748                         continue;
6749
6750                 if (last == NULL)
6751                         iface = last = tmp;
6752                 else
6753                         last->next = tmp;
6754                 while (last->next)
6755                         last = last->next;
6756         }
6757
6758         pos = buf;
6759         end = buf + len;
6760         for (tmp = iface; tmp; tmp = tmp->next) {
6761                 res = os_snprintf(pos, end - pos, "%s\t%s\t%s\n",
6762                                   tmp->drv_name, tmp->ifname,
6763                                   tmp->desc ? tmp->desc : "");
6764                 if (res < 0 || res >= end - pos) {
6765                         *pos = '\0';
6766                         break;
6767                 }
6768                 pos += res;
6769         }
6770
6771         wpa_free_iface_info(iface);
6772
6773         return pos - buf;
6774 }
6775
6776
6777 static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
6778                                                   char *buf, int len)
6779 {
6780         int res;
6781         char *pos, *end;
6782         struct wpa_supplicant *wpa_s;
6783
6784         wpa_s = global->ifaces;
6785         pos = buf;
6786         end = buf + len;
6787
6788         while (wpa_s) {
6789                 res = os_snprintf(pos, end - pos, "%s\n", wpa_s->ifname);
6790                 if (res < 0 || res >= end - pos) {
6791                         *pos = '\0';
6792                         break;
6793                 }
6794                 pos += res;
6795                 wpa_s = wpa_s->next;
6796         }
6797         return pos - buf;
6798 }
6799
6800
6801 static char * wpas_global_ctrl_iface_ifname(struct wpa_global *global,
6802                                             const char *ifname,
6803                                             char *cmd, size_t *resp_len)
6804 {
6805         struct wpa_supplicant *wpa_s;
6806
6807         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
6808                 if (os_strcmp(ifname, wpa_s->ifname) == 0)
6809                         break;
6810         }
6811
6812         if (wpa_s == NULL) {
6813                 char *resp = os_strdup("FAIL-NO-IFNAME-MATCH\n");
6814                 if (resp)
6815                         *resp_len = os_strlen(resp);
6816                 else
6817                         *resp_len = 1;
6818                 return resp;
6819         }
6820
6821         return wpa_supplicant_ctrl_iface_process(wpa_s, cmd, resp_len);
6822 }
6823
6824
6825 static char * wpas_global_ctrl_iface_redir_p2p(struct wpa_global *global,
6826                                                char *buf, size_t *resp_len)
6827 {
6828 #ifdef CONFIG_P2P
6829         static const char * cmd[] = {
6830                 "LIST_NETWORKS",
6831                 "SAVE_CONFIG",
6832                 "P2P_FIND",
6833                 "P2P_STOP_FIND",
6834                 "P2P_LISTEN",
6835                 "P2P_GROUP_ADD",
6836                 "P2P_GET_PASSPHRASE",
6837                 "P2P_SERVICE_UPDATE",
6838                 "P2P_SERVICE_FLUSH",
6839                 "P2P_FLUSH",
6840                 "P2P_CANCEL",
6841                 "P2P_PRESENCE_REQ",
6842                 "P2P_EXT_LISTEN",
6843                 NULL
6844         };
6845         static const char * prefix[] = {
6846 #ifdef ANDROID
6847                 "DRIVER ",
6848 #endif /* ANDROID */
6849                 "GET_NETWORK ",
6850                 "REMOVE_NETWORK ",
6851                 "SET ",
6852                 "P2P_FIND ",
6853                 "P2P_CONNECT ",
6854                 "P2P_LISTEN ",
6855                 "P2P_GROUP_REMOVE ",
6856                 "P2P_GROUP_ADD ",
6857                 "P2P_PROV_DISC ",
6858                 "P2P_SERV_DISC_REQ ",
6859                 "P2P_SERV_DISC_CANCEL_REQ ",
6860                 "P2P_SERV_DISC_RESP ",
6861                 "P2P_SERV_DISC_EXTERNAL ",
6862                 "P2P_SERVICE_ADD ",
6863                 "P2P_SERVICE_DEL ",
6864                 "P2P_REJECT ",
6865                 "P2P_INVITE ",
6866                 "P2P_PEER ",
6867                 "P2P_SET ",
6868                 "P2P_UNAUTHORIZE ",
6869                 "P2P_PRESENCE_REQ ",
6870                 "P2P_EXT_LISTEN ",
6871                 "P2P_REMOVE_CLIENT ",
6872                 NULL
6873         };
6874         int found = 0;
6875         int i;
6876
6877         if (global->p2p_init_wpa_s == NULL)
6878                 return NULL;
6879
6880         for (i = 0; !found && cmd[i]; i++) {
6881                 if (os_strcmp(buf, cmd[i]) == 0)
6882                         found = 1;
6883         }
6884
6885         for (i = 0; !found && prefix[i]; i++) {
6886                 if (os_strncmp(buf, prefix[i], os_strlen(prefix[i])) == 0)
6887                         found = 1;
6888         }
6889
6890         if (found)
6891                 return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
6892                                                          buf, resp_len);
6893 #endif /* CONFIG_P2P */
6894         return NULL;
6895 }
6896
6897
6898 static char * wpas_global_ctrl_iface_redir_wfd(struct wpa_global *global,
6899                                                char *buf, size_t *resp_len)
6900 {
6901 #ifdef CONFIG_WIFI_DISPLAY
6902         if (global->p2p_init_wpa_s == NULL)
6903                 return NULL;
6904         if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0 ||
6905             os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0)
6906                 return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
6907                                                          buf, resp_len);
6908 #endif /* CONFIG_WIFI_DISPLAY */
6909         return NULL;
6910 }
6911
6912
6913 static char * wpas_global_ctrl_iface_redir(struct wpa_global *global,
6914                                            char *buf, size_t *resp_len)
6915 {
6916         char *ret;
6917
6918         ret = wpas_global_ctrl_iface_redir_p2p(global, buf, resp_len);
6919         if (ret)
6920                 return ret;
6921
6922         ret = wpas_global_ctrl_iface_redir_wfd(global, buf, resp_len);
6923         if (ret)
6924                 return ret;
6925
6926         return NULL;
6927 }
6928
6929
6930 static int wpas_global_ctrl_iface_set(struct wpa_global *global, char *cmd)
6931 {
6932         char *value;
6933
6934         value = os_strchr(cmd, ' ');
6935         if (value == NULL)
6936                 return -1;
6937         *value++ = '\0';
6938
6939         wpa_printf(MSG_DEBUG, "GLOBAL_CTRL_IFACE SET '%s'='%s'", cmd, value);
6940
6941 #ifdef CONFIG_WIFI_DISPLAY
6942         if (os_strcasecmp(cmd, "wifi_display") == 0) {
6943                 wifi_display_enable(global, !!atoi(value));
6944                 return 0;
6945         }
6946 #endif /* CONFIG_WIFI_DISPLAY */
6947
6948         return -1;
6949 }
6950
6951
6952 #ifndef CONFIG_NO_CONFIG_WRITE
6953 static int wpas_global_ctrl_iface_save_config(struct wpa_global *global)
6954 {
6955         int ret = 0;
6956         struct wpa_supplicant *wpa_s;
6957
6958         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
6959                 if (!wpa_s->conf->update_config) {
6960                         wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed to update configuration (update_config=0)");
6961                         continue;
6962                 }
6963
6964                 if (wpa_config_write(wpa_s->confname, wpa_s->conf)) {
6965                         wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to update configuration");
6966                         ret = 1;
6967                 } else {
6968                         wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration updated");
6969                 }
6970         }
6971
6972         return ret;
6973 }
6974 #endif /* CONFIG_NO_CONFIG_WRITE */
6975
6976
6977 static int wpas_global_ctrl_iface_status(struct wpa_global *global,
6978                                          char *buf, size_t buflen)
6979 {
6980         char *pos, *end;
6981         int ret;
6982         struct wpa_supplicant *wpa_s;
6983
6984         pos = buf;
6985         end = buf + buflen;
6986
6987 #ifdef CONFIG_P2P
6988         if (global->p2p && !global->p2p_disabled) {
6989                 ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
6990                                   "\n"
6991                                   "p2p_state=%s\n",
6992                                   MAC2STR(global->p2p_dev_addr),
6993                                   p2p_get_state_txt(global->p2p));
6994                 if (ret < 0 || ret >= end - pos)
6995                         return pos - buf;
6996                 pos += ret;
6997         } else if (global->p2p) {
6998                 ret = os_snprintf(pos, end - pos, "p2p_state=DISABLED\n");
6999                 if (ret < 0 || ret >= end - pos)
7000                         return pos - buf;
7001                 pos += ret;
7002         }
7003 #endif /* CONFIG_P2P */
7004
7005 #ifdef CONFIG_WIFI_DISPLAY
7006         ret = os_snprintf(pos, end - pos, "wifi_display=%d\n",
7007                           !!global->wifi_display);
7008         if (ret < 0 || ret >= end - pos)
7009                 return pos - buf;
7010         pos += ret;
7011 #endif /* CONFIG_WIFI_DISPLAY */
7012
7013         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
7014                 ret = os_snprintf(pos, end - pos, "ifname=%s\n"
7015                                   "address=" MACSTR "\n",
7016                                   wpa_s->ifname, MAC2STR(wpa_s->own_addr));
7017                 if (ret < 0 || ret >= end - pos)
7018                         return pos - buf;
7019                 pos += ret;
7020         }
7021
7022         return pos - buf;
7023 }
7024
7025
7026 char * wpa_supplicant_global_ctrl_iface_process(struct wpa_global *global,
7027                                                 char *buf, size_t *resp_len)
7028 {
7029         char *reply;
7030         const int reply_size = 2048;
7031         int reply_len;
7032         int level = MSG_DEBUG;
7033
7034         if (os_strncmp(buf, "IFNAME=", 7) == 0) {
7035                 char *pos = os_strchr(buf + 7, ' ');
7036                 if (pos) {
7037                         *pos++ = '\0';
7038                         return wpas_global_ctrl_iface_ifname(global,
7039                                                              buf + 7, pos,
7040                                                              resp_len);
7041                 }
7042         }
7043
7044         reply = wpas_global_ctrl_iface_redir(global, buf, resp_len);
7045         if (reply)
7046                 return reply;
7047
7048         if (os_strcmp(buf, "PING") == 0)
7049                 level = MSG_EXCESSIVE;
7050         wpa_hexdump_ascii(level, "RX global ctrl_iface",
7051                           (const u8 *) buf, os_strlen(buf));
7052
7053         reply = os_malloc(reply_size);
7054         if (reply == NULL) {
7055                 *resp_len = 1;
7056                 return NULL;
7057         }
7058
7059         os_memcpy(reply, "OK\n", 3);
7060         reply_len = 3;
7061
7062         if (os_strcmp(buf, "PING") == 0) {
7063                 os_memcpy(reply, "PONG\n", 5);
7064                 reply_len = 5;
7065         } else if (os_strncmp(buf, "INTERFACE_ADD ", 14) == 0) {
7066                 if (wpa_supplicant_global_iface_add(global, buf + 14))
7067                         reply_len = -1;
7068         } else if (os_strncmp(buf, "INTERFACE_REMOVE ", 17) == 0) {
7069                 if (wpa_supplicant_global_iface_remove(global, buf + 17))
7070                         reply_len = -1;
7071         } else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
7072                 reply_len = wpa_supplicant_global_iface_list(
7073                         global, reply, reply_size);
7074         } else if (os_strcmp(buf, "INTERFACES") == 0) {
7075                 reply_len = wpa_supplicant_global_iface_interfaces(
7076                         global, reply, reply_size);
7077         } else if (os_strcmp(buf, "TERMINATE") == 0) {
7078                 wpa_supplicant_terminate_proc(global);
7079         } else if (os_strcmp(buf, "SUSPEND") == 0) {
7080                 wpas_notify_suspend(global);
7081         } else if (os_strcmp(buf, "RESUME") == 0) {
7082                 wpas_notify_resume(global);
7083         } else if (os_strncmp(buf, "SET ", 4) == 0) {
7084                 if (wpas_global_ctrl_iface_set(global, buf + 4))
7085                         reply_len = -1;
7086 #ifndef CONFIG_NO_CONFIG_WRITE
7087         } else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
7088                 if (wpas_global_ctrl_iface_save_config(global))
7089                         reply_len = -1;
7090 #endif /* CONFIG_NO_CONFIG_WRITE */
7091         } else if (os_strcmp(buf, "STATUS") == 0) {
7092                 reply_len = wpas_global_ctrl_iface_status(global, reply,
7093                                                           reply_size);
7094 #ifdef CONFIG_MODULE_TESTS
7095         } else if (os_strcmp(buf, "MODULE_TESTS") == 0) {
7096                 int wpas_module_tests(void);
7097                 if (wpas_module_tests() < 0)
7098                         reply_len = -1;
7099 #endif /* CONFIG_MODULE_TESTS */
7100         } else {
7101                 os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
7102                 reply_len = 16;
7103         }
7104
7105         if (reply_len < 0) {
7106                 os_memcpy(reply, "FAIL\n", 5);
7107                 reply_len = 5;
7108         }
7109
7110         *resp_len = reply_len;
7111         return reply;
7112 }