libeap/src/drivers/driver_nl80211_scan.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211 - Scanning
   3  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright (c) 2009-2010, Atheros Communications
   6  *
   7  * This software may be distributed under the terms of the BSD license.
   8  * See README for more details.
   9  */
  10
  11 #include "includes.h"
  12 #include <netlink/genl/genl.h>
  13
  14 #include "utils/common.h"
  15 #include "utils/eloop.h"
  16 #include "common/ieee802_11_defs.h"
  17 #include "driver_nl80211.h"
  18
  19
  20 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
  21 {
  22         struct nlattr *tb[NL80211_ATTR_MAX + 1];
  23         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
  24         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
  25         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
  26                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
  27                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
  28         };
  29         struct wpa_scan_results *scan_results = arg;
  30         struct wpa_scan_res *scan_res;
  31         size_t i;
  32
  33         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
  34                   genlmsg_attrlen(gnlh, 0), NULL);
  35
  36         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
  37                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
  38                 return NL_SKIP;
  39         }
  40
  41         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
  42                              tb[NL80211_ATTR_SURVEY_INFO],
  43                              survey_policy)) {
  44                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
  45                            "attributes");
  46                 return NL_SKIP;
  47         }
  48
  49         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
  50                 return NL_SKIP;
  51
  52         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
  53                 return NL_SKIP;
  54
  55         for (i = 0; i < scan_results->num; ++i) {
  56                 scan_res = scan_results->res[i];
  57                 if (!scan_res)
  58                         continue;
  59                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
  60                     scan_res->freq)
  61                         continue;
  62                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
  63                         continue;
  64                 scan_res->noise = (s8)
  65                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
  66                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
  67         }
  68
  69         return NL_SKIP;
  70 }
  71
  72
  73 static int nl80211_get_noise_for_scan_results(
  74         struct wpa_driver_nl80211_data *drv,
  75         struct wpa_scan_results *scan_res)
  76 {
  77         struct nl_msg *msg;
  78
  79         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
  80         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
  81                                   scan_res);
  82 }
  83
  84
  85 /**
  86  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
  87  * @eloop_ctx: Driver private data
  88  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
  89  *
  90  * This function can be used as registered timeout when starting a scan to
  91  * generate a scan completed event if the driver does not report this.
  92  */
  93 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
  94 {
  95         struct wpa_driver_nl80211_data *drv = eloop_ctx;
  96         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
  97                 wpa_driver_nl80211_set_mode(drv->first_bss,
  98                                             drv->ap_scan_as_station);
  99                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
 100         }
 101         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
 102         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
 103 }
 104
 105
 106 static struct nl_msg *
 107 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
 108                     struct wpa_driver_scan_params *params)
 109 {
 110         struct wpa_driver_nl80211_data *drv = bss->drv;
 111         struct nl_msg *msg;
 112         size_t i;
 113         u32 scan_flags = 0;
 114
 115         msg = nl80211_cmd_msg(bss, 0, cmd);
 116         if (!msg)
 117                 return NULL;
 118
 119         if (params->num_ssids) {
 120                 struct nlattr *ssids;
 121
 122                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
 123                 if (ssids == NULL)
 124                         goto fail;
 125                 for (i = 0; i < params->num_ssids; i++) {
 126                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
 127                                           params->ssids[i].ssid,
 128                                           params->ssids[i].ssid_len);
 129                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
 130                                     params->ssids[i].ssid))
 131                                 goto fail;
 132                 }
 133                 nla_nest_end(msg, ssids);
 134         }
 135
 136         if (params->extra_ies) {
 137                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
 138                             params->extra_ies, params->extra_ies_len);
 139                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
 140                             params->extra_ies))
 141                         goto fail;
 142         }
 143
 144         if (params->freqs) {
 145                 struct nlattr *freqs;
 146                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
 147                 if (freqs == NULL)
 148                         goto fail;
 149                 for (i = 0; params->freqs[i]; i++) {
 150                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
 151                                    "MHz", params->freqs[i]);
 152                         if (nla_put_u32(msg, i + 1, params->freqs[i]))
 153                                 goto fail;
 154                 }
 155                 nla_nest_end(msg, freqs);
 156         }
 157
 158         os_free(drv->filter_ssids);
 159         drv->filter_ssids = params->filter_ssids;
 160         params->filter_ssids = NULL;
 161         drv->num_filter_ssids = params->num_filter_ssids;
 162
 163         if (params->only_new_results) {
 164                 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
 165                 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
 166         }
 167
 168         if (params->low_priority && drv->have_low_prio_scan) {
 169                 wpa_printf(MSG_DEBUG,
 170                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
 171                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 172         }
 173
 174         if (params->mac_addr_rand) {
 175                 wpa_printf(MSG_DEBUG,
 176                            "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
 177                 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
 178
 179                 if (params->mac_addr) {
 180                         wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
 181                                    MAC2STR(params->mac_addr));
 182                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
 183                                     params->mac_addr))
 184                                 goto fail;
 185                 }
 186
 187                 if (params->mac_addr_mask) {
 188                         wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
 189                                    MACSTR, MAC2STR(params->mac_addr_mask));
 190                         if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
 191                                     params->mac_addr_mask))
 192                                 goto fail;
 193                 }
 194         }
 195
 196         if (scan_flags &&
 197             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
 198                 goto fail;
 199
 200         return msg;
 201
 202 fail:
 203         nlmsg_free(msg);
 204         return NULL;
 205 }
 206
 207
 208 /**
 209  * wpa_driver_nl80211_scan - Request the driver to initiate scan
 210  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
 211  * @params: Scan parameters
 212  * Returns: 0 on success, -1 on failure
 213  */
 214 int wpa_driver_nl80211_scan(struct i802_bss *bss,
 215                             struct wpa_driver_scan_params *params)
 216 {
 217         struct wpa_driver_nl80211_data *drv = bss->drv;
 218         int ret = -1, timeout;
 219         struct nl_msg *msg = NULL;
 220
 221         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
 222         drv->scan_for_auth = 0;
 223
 224         if (TEST_FAIL())
 225                 return -1;
 226
 227         msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
 228         if (!msg)
 229                 return -1;
 230
 231         if (params->p2p_probe) {
 232                 struct nlattr *rates;
 233
 234                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
 235
 236                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
 237                 if (rates == NULL)
 238                         goto fail;
 239
 240                 /*
 241                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
 242                  * by masking out everything else apart from the OFDM rates 6,
 243                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
 244                  * rates are left enabled.
 245                  */
 246                 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
 247                             "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
 248                         goto fail;
 249                 nla_nest_end(msg, rates);
 250
 251                 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
 252                         goto fail;
 253         }
 254
 255         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 256         msg = NULL;
 257         if (ret) {
 258                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
 259                            "(%s)", ret, strerror(-ret));
 260                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
 261                         enum nl80211_iftype old_mode = drv->nlmode;
 262
 263                         /*
 264                          * mac80211 does not allow scan requests in AP mode, so
 265                          * try to do this in station mode.
 266                          */
 267                         if (wpa_driver_nl80211_set_mode(
 268                                     bss, NL80211_IFTYPE_STATION))
 269                                 goto fail;
 270
 271                         if (wpa_driver_nl80211_scan(bss, params)) {
 272                                 wpa_driver_nl80211_set_mode(bss, old_mode);
 273                                 goto fail;
 274                         }
 275
 276                         /* Restore AP mode when processing scan results */
 277                         drv->ap_scan_as_station = old_mode;
 278                         ret = 0;
 279                 } else
 280                         goto fail;
 281         }
 282
 283         drv->scan_state = SCAN_REQUESTED;
 284         /* Not all drivers generate "scan completed" wireless event, so try to
 285          * read results after a timeout. */
 286         timeout = 10;
 287         if (drv->scan_complete_events) {
 288                 /*
 289                  * The driver seems to deliver events to notify when scan is
 290                  * complete, so use longer timeout to avoid race conditions
 291                  * with scanning and following association request.
 292                  */
 293                 timeout = 30;
 294         }
 295         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
 296                    "seconds", ret, timeout);
 297         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
 298         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
 299                                drv, drv->ctx);
 300
 301 fail:
 302         nlmsg_free(msg);
 303         return ret;
 304 }
 305
 306
 307 /**
 308  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
 309  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
 310  * @params: Scan parameters
 311  * @interval: Interval between scan cycles in milliseconds
 312  * Returns: 0 on success, -1 on failure or if not supported
 313  */
 314 int wpa_driver_nl80211_sched_scan(void *priv,
 315                                   struct wpa_driver_scan_params *params,
 316                                   u32 interval)
 317 {
 318         struct i802_bss *bss = priv;
 319         struct wpa_driver_nl80211_data *drv = bss->drv;
 320         int ret = -1;
 321         struct nl_msg *msg;
 322         size_t i;
 323
 324         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
 325
 326 #ifdef ANDROID
 327         if (!drv->capa.sched_scan_supported)
 328                 return android_pno_start(bss, params);
 329 #endif /* ANDROID */
 330
 331         msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
 332         if (!msg ||
 333             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval))
 334                 goto fail;
 335
 336         if ((drv->num_filter_ssids &&
 337             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
 338             params->filter_rssi) {
 339                 struct nlattr *match_sets;
 340                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
 341                 if (match_sets == NULL)
 342                         goto fail;
 343
 344                 for (i = 0; i < drv->num_filter_ssids; i++) {
 345                         struct nlattr *match_set_ssid;
 346                         wpa_hexdump_ascii(MSG_MSGDUMP,
 347                                           "nl80211: Sched scan filter SSID",
 348                                           drv->filter_ssids[i].ssid,
 349                                           drv->filter_ssids[i].ssid_len);
 350
 351                         match_set_ssid = nla_nest_start(msg, i + 1);
 352                         if (match_set_ssid == NULL ||
 353                             nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
 354                                     drv->filter_ssids[i].ssid_len,
 355                                     drv->filter_ssids[i].ssid) ||
 356                             (params->filter_rssi &&
 357                              nla_put_u32(msg,
 358                                          NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 359                                          params->filter_rssi)))
 360                                 goto fail;
 361
 362                         nla_nest_end(msg, match_set_ssid);
 363                 }
 364
 365                 /*
 366                  * Due to backward compatibility code, newer kernels treat this
 367                  * matchset (with only an RSSI filter) as the default for all
 368                  * other matchsets, unless it's the only one, in which case the
 369                  * matchset will actually allow all SSIDs above the RSSI.
 370                  */
 371                 if (params->filter_rssi) {
 372                         struct nlattr *match_set_rssi;
 373                         match_set_rssi = nla_nest_start(msg, 0);
 374                         if (match_set_rssi == NULL ||
 375                             nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 376                                         params->filter_rssi))
 377                                 goto fail;
 378                         wpa_printf(MSG_MSGDUMP,
 379                                    "nl80211: Sched scan RSSI filter %d dBm",
 380                                    params->filter_rssi);
 381                         nla_nest_end(msg, match_set_rssi);
 382                 }
 383
 384                 nla_nest_end(msg, match_sets);
 385         }
 386
 387         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 388
 389         /* TODO: if we get an error here, we should fall back to normal scan */
 390
 391         msg = NULL;
 392         if (ret) {
 393                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
 394                            "ret=%d (%s)", ret, strerror(-ret));
 395                 goto fail;
 396         }
 397
 398         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
 399                    "scan interval %d msec", ret, interval);
 400
 401 fail:
 402         nlmsg_free(msg);
 403         return ret;
 404 }
 405
 406
 407 /**
 408  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
 409  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
 410  * Returns: 0 on success, -1 on failure or if not supported
 411  */
 412 int wpa_driver_nl80211_stop_sched_scan(void *priv)
 413 {
 414         struct i802_bss *bss = priv;
 415         struct wpa_driver_nl80211_data *drv = bss->drv;
 416         int ret;
 417         struct nl_msg *msg;
 418
 419 #ifdef ANDROID
 420         if (!drv->capa.sched_scan_supported)
 421                 return android_pno_stop(bss);
 422 #endif /* ANDROID */
 423
 424         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
 425         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 426         if (ret) {
 427                 wpa_printf(MSG_DEBUG,
 428                            "nl80211: Sched scan stop failed: ret=%d (%s)",
 429                            ret, strerror(-ret));
 430         } else {
 431                 wpa_printf(MSG_DEBUG,
 432                            "nl80211: Sched scan stop sent");
 433         }
 434
 435         return ret;
 436 }
 437
 438
 439 const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
 440 {
 441         const u8 *end, *pos;
 442
 443         if (ies == NULL)
 444                 return NULL;
 445
 446         pos = ies;
 447         end = ies + ies_len;
 448
 449         while (pos + 1 < end) {
 450                 if (pos + 2 + pos[1] > end)
 451                         break;
 452                 if (pos[0] == ie)
 453                         return pos;
 454                 pos += 2 + pos[1];
 455         }
 456
 457         return NULL;
 458 }
 459
 460
 461 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
 462                                  const u8 *ie, size_t ie_len)
 463 {
 464         const u8 *ssid;
 465         size_t i;
 466
 467         if (drv->filter_ssids == NULL)
 468                 return 0;
 469
 470         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
 471         if (ssid == NULL)
 472                 return 1;
 473
 474         for (i = 0; i < drv->num_filter_ssids; i++) {
 475                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
 476                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
 477                     0)
 478                         return 0;
 479         }
 480
 481         return 1;
 482 }
 483
 484
 485 int bss_info_handler(struct nl_msg *msg, void *arg)
 486 {
 487         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 488         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 489         struct nlattr *bss[NL80211_BSS_MAX + 1];
 490         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
 491                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
 492                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
 493                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
 494                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
 495                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
 496                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
 497                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
 498                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
 499                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
 500                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
 501                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
 502         };
 503         struct nl80211_bss_info_arg *_arg = arg;
 504         struct wpa_scan_results *res = _arg->res;
 505         struct wpa_scan_res **tmp;
 506         struct wpa_scan_res *r;
 507         const u8 *ie, *beacon_ie;
 508         size_t ie_len, beacon_ie_len;
 509         u8 *pos;
 510         size_t i;
 511
 512         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 513                   genlmsg_attrlen(gnlh, 0), NULL);
 514         if (!tb[NL80211_ATTR_BSS])
 515                 return NL_SKIP;
 516         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
 517                              bss_policy))
 518                 return NL_SKIP;
 519         if (bss[NL80211_BSS_STATUS]) {
 520                 enum nl80211_bss_status status;
 521                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
 522                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
 523                     bss[NL80211_BSS_FREQUENCY]) {
 524                         _arg->assoc_freq =
 525                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 526                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
 527                                    _arg->assoc_freq);
 528                 }
 529                 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
 530                     bss[NL80211_BSS_FREQUENCY]) {
 531                         _arg->ibss_freq =
 532                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 533                         wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
 534                                    _arg->ibss_freq);
 535                 }
 536                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
 537                     bss[NL80211_BSS_BSSID]) {
 538                         os_memcpy(_arg->assoc_bssid,
 539                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
 540                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
 541                                    MACSTR, MAC2STR(_arg->assoc_bssid));
 542                 }
 543         }
 544         if (!res)
 545                 return NL_SKIP;
 546         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
 547                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
 548                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
 549         } else {
 550                 ie = NULL;
 551                 ie_len = 0;
 552         }
 553         if (bss[NL80211_BSS_BEACON_IES]) {
 554                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
 555                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
 556         } else {
 557                 beacon_ie = NULL;
 558                 beacon_ie_len = 0;
 559         }
 560
 561         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
 562                                   ie ? ie_len : beacon_ie_len))
 563                 return NL_SKIP;
 564
 565         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
 566         if (r == NULL)
 567                 return NL_SKIP;
 568         if (bss[NL80211_BSS_BSSID])
 569                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
 570                           ETH_ALEN);
 571         if (bss[NL80211_BSS_FREQUENCY])
 572                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 573         if (bss[NL80211_BSS_BEACON_INTERVAL])
 574                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
 575         if (bss[NL80211_BSS_CAPABILITY])
 576                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
 577         r->flags |= WPA_SCAN_NOISE_INVALID;
 578         if (bss[NL80211_BSS_SIGNAL_MBM]) {
 579                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
 580                 r->level /= 100; /* mBm to dBm */
 581                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
 582         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
 583                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
 584                 r->flags |= WPA_SCAN_QUAL_INVALID;
 585         } else
 586                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
 587         if (bss[NL80211_BSS_TSF])
 588                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
 589         if (bss[NL80211_BSS_BEACON_TSF]) {
 590                 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
 591                 if (tsf > r->tsf)
 592                         r->tsf = tsf;
 593         }
 594         if (bss[NL80211_BSS_SEEN_MS_AGO])
 595                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
 596         r->ie_len = ie_len;
 597         pos = (u8 *) (r + 1);
 598         if (ie) {
 599                 os_memcpy(pos, ie, ie_len);
 600                 pos += ie_len;
 601         }
 602         r->beacon_ie_len = beacon_ie_len;
 603         if (beacon_ie)
 604                 os_memcpy(pos, beacon_ie, beacon_ie_len);
 605
 606         if (bss[NL80211_BSS_STATUS]) {
 607                 enum nl80211_bss_status status;
 608                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
 609                 switch (status) {
 610                 case NL80211_BSS_STATUS_ASSOCIATED:
 611                         r->flags |= WPA_SCAN_ASSOCIATED;
 612                         break;
 613                 default:
 614                         break;
 615                 }
 616         }
 617
 618         /*
 619          * cfg80211 maintains separate BSS table entries for APs if the same
 620          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
 621          * not use frequency as a separate key in the BSS table, so filter out
 622          * duplicated entries. Prefer associated BSS entry in such a case in
 623          * order to get the correct frequency into the BSS table. Similarly,
 624          * prefer newer entries over older.
 625          */
 626         for (i = 0; i < res->num; i++) {
 627                 const u8 *s1, *s2;
 628                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
 629                         continue;
 630
 631                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
 632                                     res->res[i]->ie_len, WLAN_EID_SSID);
 633                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
 634                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
 635                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
 636                         continue;
 637
 638                 /* Same BSSID,SSID was already included in scan results */
 639                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
 640                            "for " MACSTR, MAC2STR(r->bssid));
 641
 642                 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
 643                      !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
 644                     r->age < res->res[i]->age) {
 645                         os_free(res->res[i]);
 646                         res->res[i] = r;
 647                 } else
 648                         os_free(r);
 649                 return NL_SKIP;
 650         }
 651
 652         tmp = os_realloc_array(res->res, res->num + 1,
 653                                sizeof(struct wpa_scan_res *));
 654         if (tmp == NULL) {
 655                 os_free(r);
 656                 return NL_SKIP;
 657         }
 658         tmp[res->num++] = r;
 659         res->res = tmp;
 660
 661         return NL_SKIP;
 662 }
 663
 664
 665 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
 666                                  const u8 *addr)
 667 {
 668         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
 669                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
 670                            "mismatch (" MACSTR ")", MAC2STR(addr));
 671                 wpa_driver_nl80211_mlme(drv, addr,
 672                                         NL80211_CMD_DEAUTHENTICATE,
 673                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
 674         }
 675 }
 676
 677
 678 static void wpa_driver_nl80211_check_bss_status(
 679         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
 680 {
 681         size_t i;
 682
 683         for (i = 0; i < res->num; i++) {
 684                 struct wpa_scan_res *r = res->res[i];
 685
 686                 if (r->flags & WPA_SCAN_ASSOCIATED) {
 687                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
 688                                    "indicate BSS status with " MACSTR
 689                                    " as associated",
 690                                    MAC2STR(r->bssid));
 691                         if (is_sta_interface(drv->nlmode) &&
 692                             !drv->associated) {
 693                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
 694                                            "(not associated) does not match "
 695                                            "with BSS state");
 696                                 clear_state_mismatch(drv, r->bssid);
 697                         } else if (is_sta_interface(drv->nlmode) &&
 698                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
 699                                    0) {
 700                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
 701                                            "(associated with " MACSTR ") does "
 702                                            "not match with BSS state",
 703                                            MAC2STR(drv->bssid));
 704                                 clear_state_mismatch(drv, r->bssid);
 705                                 clear_state_mismatch(drv, drv->bssid);
 706                         }
 707                 }
 708         }
 709 }
 710
 711
 712 static struct wpa_scan_results *
 713 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
 714 {
 715         struct nl_msg *msg;
 716         struct wpa_scan_results *res;
 717         int ret;
 718         struct nl80211_bss_info_arg arg;
 719
 720         res = os_zalloc(sizeof(*res));
 721         if (res == NULL)
 722                 return NULL;
 723         if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
 724                                     NL80211_CMD_GET_SCAN))) {
 725                 wpa_scan_results_free(res);
 726                 return NULL;
 727         }
 728
 729         arg.drv = drv;
 730         arg.res = res;
 731         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
 732         if (ret == 0) {
 733                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
 734                            "BSSes)", (unsigned long) res->num);
 735                 nl80211_get_noise_for_scan_results(drv, res);
 736                 return res;
 737         }
 738         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
 739                    "(%s)", ret, strerror(-ret));
 740         wpa_scan_results_free(res);
 741         return NULL;
 742 }
 743
 744
 745 /**
 746  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
 747  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
 748  * Returns: Scan results on success, -1 on failure
 749  */
 750 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
 751 {
 752         struct i802_bss *bss = priv;
 753         struct wpa_driver_nl80211_data *drv = bss->drv;
 754         struct wpa_scan_results *res;
 755
 756         res = nl80211_get_scan_results(drv);
 757         if (res)
 758                 wpa_driver_nl80211_check_bss_status(drv, res);
 759         return res;
 760 }
 761
 762
 763 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
 764 {
 765         struct wpa_scan_results *res;
 766         size_t i;
 767
 768         res = nl80211_get_scan_results(drv);
 769         if (res == NULL) {
 770                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
 771                 return;
 772         }
 773
 774         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
 775         for (i = 0; i < res->num; i++) {
 776                 struct wpa_scan_res *r = res->res[i];
 777                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s",
 778                            (int) i, (int) res->num, MAC2STR(r->bssid),
 779                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
 780         }
 781
 782         wpa_scan_results_free(res);
 783 }