wpa_supplicant/ctrl_iface_unix.c

   1 /*
   2  * WPA Supplicant / UNIX domain socket -based control interface
   3  * Copyright (c) 2004-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10 #include <sys/un.h>
  11 #include <sys/stat.h>
  12 #include <grp.h>
  13 #include <stddef.h>
  14 #include <unistd.h>
  15 #include <fcntl.h>
  16 #ifdef __linux__
  17 #include <sys/ioctl.h>
  18 #include <linux/sockios.h>
  19 #endif /* __linux__ */
  20 #ifdef ANDROID
  21 #include <cutils/sockets.h>
  22 #endif /* ANDROID */
  23
  24 #include "utils/common.h"
  25 #include "utils/eloop.h"
  26 #include "utils/list.h"
  27 #include "eapol_supp/eapol_supp_sm.h"
  28 #include "config.h"
  29 #include "wpa_supplicant_i.h"
  30 #include "ctrl_iface.h"
  31
  32 /* Per-interface ctrl_iface */
  33
  34 /**
  35  * struct wpa_ctrl_dst - Internal data structure of control interface monitors
  36  *
  37  * This structure is used to store information about registered control
  38  * interface monitors into struct wpa_supplicant. This data is private to
  39  * ctrl_iface_unix.c and should not be touched directly from other files.
  40  */
  41 struct wpa_ctrl_dst {
  42         struct dl_list list;
  43         struct sockaddr_un addr;
  44         socklen_t addrlen;
  45         int debug_level;
  46         int errors;
  47 };
  48
  49
  50 struct ctrl_iface_priv {
  51         struct wpa_supplicant *wpa_s;
  52         int sock;
  53         struct dl_list ctrl_dst;
  54         int android_control_socket;
  55 };
  56
  57
  58 struct ctrl_iface_global_priv {
  59         struct wpa_global *global;
  60         int sock;
  61         struct dl_list ctrl_dst;
  62         int android_control_socket;
  63 };
  64
  65
  66 static void wpa_supplicant_ctrl_iface_send(struct wpa_supplicant *wpa_s,
  67                                            const char *ifname, int sock,
  68                                            struct dl_list *ctrl_dst,
  69                                            int level, const char *buf,
  70                                            size_t len,
  71                                            struct ctrl_iface_priv *priv,
  72                                            struct ctrl_iface_global_priv *gp);
  73 static int wpas_ctrl_iface_reinit(struct wpa_supplicant *wpa_s,
  74                                   struct ctrl_iface_priv *priv);
  75 static int wpas_ctrl_iface_global_reinit(struct wpa_global *global,
  76                                          struct ctrl_iface_global_priv *priv);
  77
  78
  79 static void wpas_ctrl_sock_debug(const char *title, int sock, const char *buf,
  80                                  size_t len)
  81 {
  82 #ifdef __linux__
  83         socklen_t optlen;
  84         int sndbuf, outq;
  85         int level = MSG_MSGDUMP;
  86
  87         if (len >= 5 && os_strncmp(buf, "PONG\n", 5) == 0)
  88                 level = MSG_EXCESSIVE;
  89
  90         optlen = sizeof(sndbuf);
  91         sndbuf = 0;
  92         if (getsockopt(sock, SOL_SOCKET, SO_SNDBUF, &sndbuf, &optlen) < 0)
  93                 sndbuf = -1;
  94
  95         if (ioctl(sock, SIOCOUTQ, &outq) < 0)
  96                 outq = -1;
  97
  98         wpa_printf(level,
  99                    "CTRL-DEBUG: %s: sock=%d sndbuf=%d outq=%d send_len=%d",
 100                    title, sock, sndbuf, outq, (int) len);
 101 #endif /* __linux__ */
 102 }
 103
 104
 105 static int wpa_supplicant_ctrl_iface_attach(struct dl_list *ctrl_dst,
 106                                             struct sockaddr_un *from,
 107                                             socklen_t fromlen, int global)
 108 {
 109         struct wpa_ctrl_dst *dst;
 110         char addr_txt[200];
 111
 112         dst = os_zalloc(sizeof(*dst));
 113         if (dst == NULL)
 114                 return -1;
 115         os_memcpy(&dst->addr, from, sizeof(struct sockaddr_un));
 116         dst->addrlen = fromlen;
 117         dst->debug_level = MSG_INFO;
 118         dl_list_add(ctrl_dst, &dst->list);
 119         printf_encode(addr_txt, sizeof(addr_txt),
 120                       (u8 *) from->sun_path,
 121                       fromlen - offsetof(struct sockaddr_un, sun_path));
 122         wpa_printf(MSG_DEBUG, "CTRL_IFACE %smonitor attached %s",
 123                    global ? "global " : "", addr_txt);
 124         return 0;
 125 }
 126
 127
 128 static int wpa_supplicant_ctrl_iface_detach(struct dl_list *ctrl_dst,
 129                                             struct sockaddr_un *from,
 130                                             socklen_t fromlen)
 131 {
 132         struct wpa_ctrl_dst *dst;
 133
 134         dl_list_for_each(dst, ctrl_dst, struct wpa_ctrl_dst, list) {
 135                 if (fromlen == dst->addrlen &&
 136                     os_memcmp(from->sun_path, dst->addr.sun_path,
 137                               fromlen - offsetof(struct sockaddr_un, sun_path))
 138                     == 0) {
 139                         char addr_txt[200];
 140                         printf_encode(addr_txt, sizeof(addr_txt),
 141                                       (u8 *) from->sun_path,
 142                                       fromlen -
 143                                       offsetof(struct sockaddr_un, sun_path));
 144                         wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor detached %s",
 145                                    addr_txt);
 146                         dl_list_del(&dst->list);
 147                         os_free(dst);
 148                         return 0;
 149                 }
 150         }
 151         return -1;
 152 }
 153
 154
 155 static int wpa_supplicant_ctrl_iface_level(struct ctrl_iface_priv *priv,
 156                                            struct sockaddr_un *from,
 157                                            socklen_t fromlen,
 158                                            char *level)
 159 {
 160         struct wpa_ctrl_dst *dst;
 161
 162         wpa_printf(MSG_DEBUG, "CTRL_IFACE LEVEL %s", level);
 163
 164         dl_list_for_each(dst, &priv->ctrl_dst, struct wpa_ctrl_dst, list) {
 165                 if (fromlen == dst->addrlen &&
 166                     os_memcmp(from->sun_path, dst->addr.sun_path,
 167                               fromlen - offsetof(struct sockaddr_un, sun_path))
 168                     == 0) {
 169                         char addr_txt[200];
 170                         dst->debug_level = atoi(level);
 171                         printf_encode(addr_txt, sizeof(addr_txt),
 172                                       (u8 *) from->sun_path, fromlen -
 173                                       offsetof(struct sockaddr_un, sun_path));
 174                         wpa_printf(MSG_DEBUG, "CTRL_IFACE changed monitor level to %d for %s",
 175                                    dst->debug_level, addr_txt);
 176                         return 0;
 177                 }
 178         }
 179
 180         return -1;
 181 }
 182
 183
 184 static void wpa_supplicant_ctrl_iface_receive(int sock, void *eloop_ctx,
 185                                               void *sock_ctx)
 186 {
 187         struct wpa_supplicant *wpa_s = eloop_ctx;
 188         struct ctrl_iface_priv *priv = sock_ctx;
 189         char buf[4096];
 190         int res;
 191         struct sockaddr_un from;
 192         socklen_t fromlen = sizeof(from);
 193         char *reply = NULL, *reply_buf = NULL;
 194         size_t reply_len = 0;
 195         int new_attached = 0;
 196
 197         res = recvfrom(sock, buf, sizeof(buf) - 1, 0,
 198                        (struct sockaddr *) &from, &fromlen);
 199         if (res < 0) {
 200                 wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s",
 201                            strerror(errno));
 202                 return;
 203         }
 204         buf[res] = '\0';
 205
 206         if (os_strcmp(buf, "ATTACH") == 0) {
 207                 if (wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst, &from,
 208                                                      fromlen, 0))
 209                         reply_len = 1;
 210                 else {
 211                         new_attached = 1;
 212                         reply_len = 2;
 213                 }
 214         } else if (os_strcmp(buf, "DETACH") == 0) {
 215                 if (wpa_supplicant_ctrl_iface_detach(&priv->ctrl_dst, &from,
 216                                                      fromlen))
 217                         reply_len = 1;
 218                 else
 219                         reply_len = 2;
 220         } else if (os_strncmp(buf, "LEVEL ", 6) == 0) {
 221                 if (wpa_supplicant_ctrl_iface_level(priv, &from, fromlen,
 222                                                     buf + 6))
 223                         reply_len = 1;
 224                 else
 225                         reply_len = 2;
 226         } else {
 227                 reply_buf = wpa_supplicant_ctrl_iface_process(wpa_s, buf,
 228                                                               &reply_len);
 229                 reply = reply_buf;
 230
 231                 /*
 232                  * There could be some password/key material in the command, so
 233                  * clear the buffer explicitly now that it is not needed
 234                  * anymore.
 235                  */
 236                 os_memset(buf, 0, res);
 237         }
 238
 239         if (!reply && reply_len == 1) {
 240                 reply = "FAIL\n";
 241                 reply_len = 5;
 242         } else if (!reply && reply_len == 2) {
 243                 reply = "OK\n";
 244                 reply_len = 3;
 245         }
 246
 247         if (reply) {
 248                 wpas_ctrl_sock_debug("ctrl_sock-sendto", sock, reply,
 249                                      reply_len);
 250                 if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
 251                            fromlen) < 0) {
 252                         int _errno = errno;
 253                         wpa_dbg(wpa_s, MSG_DEBUG,
 254                                 "ctrl_iface sendto failed: %d - %s",
 255                                 _errno, strerror(_errno));
 256                         if (_errno == ENOBUFS || _errno == EAGAIN) {
 257                                 /*
 258                                  * The socket send buffer could be full. This
 259                                  * may happen if client programs are not
 260                                  * receiving their pending messages. Close and
 261                                  * reopen the socket as a workaround to avoid
 262                                  * getting stuck being unable to send any new
 263                                  * responses.
 264                                  */
 265                                 sock = wpas_ctrl_iface_reinit(wpa_s, priv);
 266                                 if (sock < 0) {
 267                                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to reinitialize ctrl_iface socket");
 268                                 }
 269                         }
 270                         if (new_attached) {
 271                                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to send response to ATTACH - detaching");
 272                                 new_attached = 0;
 273                                 wpa_supplicant_ctrl_iface_detach(
 274                                         &priv->ctrl_dst, &from, fromlen);
 275                         }
 276                 }
 277         }
 278         os_free(reply_buf);
 279
 280         if (new_attached)
 281                 eapol_sm_notify_ctrl_attached(wpa_s->eapol);
 282 }
 283
 284
 285 static char * wpa_supplicant_ctrl_iface_path(struct wpa_supplicant *wpa_s)
 286 {
 287         char *buf;
 288         size_t len;
 289         char *pbuf, *dir = NULL;
 290         int res;
 291
 292         if (wpa_s->conf->ctrl_interface == NULL)
 293                 return NULL;
 294
 295         pbuf = os_strdup(wpa_s->conf->ctrl_interface);
 296         if (pbuf == NULL)
 297                 return NULL;
 298         if (os_strncmp(pbuf, "DIR=", 4) == 0) {
 299                 char *gid_str;
 300                 dir = pbuf + 4;
 301                 gid_str = os_strstr(dir, " GROUP=");
 302                 if (gid_str)
 303                         *gid_str = '\0';
 304         } else
 305                 dir = pbuf;
 306
 307         len = os_strlen(dir) + os_strlen(wpa_s->ifname) + 2;
 308         buf = os_malloc(len);
 309         if (buf == NULL) {
 310                 os_free(pbuf);
 311                 return NULL;
 312         }
 313
 314         res = os_snprintf(buf, len, "%s/%s", dir, wpa_s->ifname);
 315         if (os_snprintf_error(len, res)) {
 316                 os_free(pbuf);
 317                 os_free(buf);
 318                 return NULL;
 319         }
 320 #ifdef __CYGWIN__
 321         {
 322                 /* Windows/WinPcap uses interface names that are not suitable
 323                  * as a file name - convert invalid chars to underscores */
 324                 char *pos = buf;
 325                 while (*pos) {
 326                         if (*pos == '\\')
 327                                 *pos = '_';
 328                         pos++;
 329                 }
 330         }
 331 #endif /* __CYGWIN__ */
 332         os_free(pbuf);
 333         return buf;
 334 }
 335
 336
 337 static void wpa_supplicant_ctrl_iface_msg_cb(void *ctx, int level,
 338                                              enum wpa_msg_type type,
 339                                              const char *txt, size_t len)
 340 {
 341         struct wpa_supplicant *wpa_s = ctx;
 342
 343         if (wpa_s == NULL)
 344                 return;
 345
 346         if (type != WPA_MSG_NO_GLOBAL && wpa_s->global->ctrl_iface) {
 347                 struct ctrl_iface_global_priv *priv = wpa_s->global->ctrl_iface;
 348                 if (!dl_list_empty(&priv->ctrl_dst)) {
 349                         wpa_supplicant_ctrl_iface_send(
 350                                 wpa_s,
 351                                 type != WPA_MSG_PER_INTERFACE ?
 352                                 NULL : wpa_s->ifname,
 353                                 priv->sock, &priv->ctrl_dst, level, txt, len,
 354                                 NULL, priv);
 355                 }
 356         }
 357
 358         if (type == WPA_MSG_ONLY_GLOBAL || wpa_s->ctrl_iface == NULL)
 359                 return;
 360         wpa_supplicant_ctrl_iface_send(wpa_s, NULL, wpa_s->ctrl_iface->sock,
 361                                        &wpa_s->ctrl_iface->ctrl_dst,
 362                                        level, txt, len, wpa_s->ctrl_iface,
 363                                        NULL);
 364 }
 365
 366
 367 static int wpas_ctrl_iface_open_sock(struct wpa_supplicant *wpa_s,
 368                                      struct ctrl_iface_priv *priv)
 369 {
 370         struct sockaddr_un addr;
 371         char *fname = NULL;
 372         gid_t gid = 0;
 373         int gid_set = 0;
 374         char *buf, *dir = NULL, *gid_str = NULL;
 375         struct group *grp;
 376         char *endp;
 377         int flags;
 378
 379         buf = os_strdup(wpa_s->conf->ctrl_interface);
 380         if (buf == NULL)
 381                 goto fail;
 382 #ifdef ANDROID
 383         os_snprintf(addr.sun_path, sizeof(addr.sun_path), "wpa_%s",
 384                     wpa_s->conf->ctrl_interface);
 385         priv->sock = android_get_control_socket(addr.sun_path);
 386         if (priv->sock >= 0) {
 387                 priv->android_control_socket = 1;
 388                 goto havesock;
 389         }
 390 #endif /* ANDROID */
 391         if (os_strncmp(buf, "DIR=", 4) == 0) {
 392                 dir = buf + 4;
 393                 gid_str = os_strstr(dir, " GROUP=");
 394                 if (gid_str) {
 395                         *gid_str = '\0';
 396                         gid_str += 7;
 397                 }
 398         } else {
 399                 dir = buf;
 400                 gid_str = wpa_s->conf->ctrl_interface_group;
 401         }
 402
 403         if (mkdir(dir, S_IRWXU | S_IRWXG) < 0) {
 404                 if (errno == EEXIST) {
 405                         wpa_printf(MSG_DEBUG, "Using existing control "
 406                                    "interface directory.");
 407                 } else {
 408                         wpa_printf(MSG_ERROR, "mkdir[ctrl_interface=%s]: %s",
 409                                    dir, strerror(errno));
 410                         goto fail;
 411                 }
 412         }
 413
 414 #ifdef ANDROID
 415         /*
 416          * wpa_supplicant is started from /init.*.rc on Android and that seems
 417          * to be using umask 0077 which would leave the control interface
 418          * directory without group access. This breaks things since Wi-Fi
 419          * framework assumes that this directory can be accessed by other
 420          * applications in the wifi group. Fix this by adding group access even
 421          * if umask value would prevent this.
 422          */
 423         if (chmod(dir, S_IRWXU | S_IRWXG) < 0) {
 424                 wpa_printf(MSG_ERROR, "CTRL: Could not chmod directory: %s",
 425                            strerror(errno));
 426                 /* Try to continue anyway */
 427         }
 428 #endif /* ANDROID */
 429
 430         if (gid_str) {
 431                 grp = getgrnam(gid_str);
 432                 if (grp) {
 433                         gid = grp->gr_gid;
 434                         gid_set = 1;
 435                         wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d"
 436                                    " (from group name '%s')",
 437                                    (int) gid, gid_str);
 438                 } else {
 439                         /* Group name not found - try to parse this as gid */
 440                         gid = strtol(gid_str, &endp, 10);
 441                         if (*gid_str == '\0' || *endp != '\0') {
 442                                 wpa_printf(MSG_ERROR, "CTRL: Invalid group "
 443                                            "'%s'", gid_str);
 444                                 goto fail;
 445                         }
 446                         gid_set = 1;
 447                         wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d",
 448                                    (int) gid);
 449                 }
 450         }
 451
 452         if (gid_set && chown(dir, -1, gid) < 0) {
 453                 wpa_printf(MSG_ERROR, "chown[ctrl_interface=%s,gid=%d]: %s",
 454                            dir, (int) gid, strerror(errno));
 455                 goto fail;
 456         }
 457
 458         /* Make sure the group can enter and read the directory */
 459         if (gid_set &&
 460             chmod(dir, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP) < 0) {
 461                 wpa_printf(MSG_ERROR, "CTRL: chmod[ctrl_interface]: %s",
 462                            strerror(errno));
 463                 goto fail;
 464         }
 465
 466         if (os_strlen(dir) + 1 + os_strlen(wpa_s->ifname) >=
 467             sizeof(addr.sun_path)) {
 468                 wpa_printf(MSG_ERROR, "ctrl_iface path limit exceeded");
 469                 goto fail;
 470         }
 471
 472         priv->sock = socket(PF_UNIX, SOCK_DGRAM, 0);
 473         if (priv->sock < 0) {
 474                 wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno));
 475                 goto fail;
 476         }
 477
 478         os_memset(&addr, 0, sizeof(addr));
 479 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
 480         addr.sun_len = sizeof(addr);
 481 #endif /* __FreeBSD__ */
 482         addr.sun_family = AF_UNIX;
 483         fname = wpa_supplicant_ctrl_iface_path(wpa_s);
 484         if (fname == NULL)
 485                 goto fail;
 486         os_strlcpy(addr.sun_path, fname, sizeof(addr.sun_path));
 487         if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
 488                 wpa_printf(MSG_DEBUG, "ctrl_iface bind(PF_UNIX) failed: %s",
 489                            strerror(errno));
 490                 if (connect(priv->sock, (struct sockaddr *) &addr,
 491                             sizeof(addr)) < 0) {
 492                         wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not"
 493                                    " allow connections - assuming it was left"
 494                                    "over from forced program termination");
 495                         if (unlink(fname) < 0) {
 496                                 wpa_printf(MSG_ERROR,
 497                                            "Could not unlink existing ctrl_iface socket '%s': %s",
 498                                            fname, strerror(errno));
 499                                 goto fail;
 500                         }
 501                         if (bind(priv->sock, (struct sockaddr *) &addr,
 502                                  sizeof(addr)) < 0) {
 503                                 wpa_printf(MSG_ERROR, "supp-ctrl-iface-init: bind(PF_UNIX): %s",
 504                                            strerror(errno));
 505                                 goto fail;
 506                         }
 507                         wpa_printf(MSG_DEBUG, "Successfully replaced leftover "
 508                                    "ctrl_iface socket '%s'", fname);
 509                 } else {
 510                         wpa_printf(MSG_INFO, "ctrl_iface exists and seems to "
 511                                    "be in use - cannot override it");
 512                         wpa_printf(MSG_INFO, "Delete '%s' manually if it is "
 513                                    "not used anymore", fname);
 514                         os_free(fname);
 515                         fname = NULL;
 516                         goto fail;
 517                 }
 518         }
 519
 520         if (gid_set && chown(fname, -1, gid) < 0) {
 521                 wpa_printf(MSG_ERROR, "chown[ctrl_interface=%s,gid=%d]: %s",
 522                            fname, (int) gid, strerror(errno));
 523                 goto fail;
 524         }
 525
 526         if (chmod(fname, S_IRWXU | S_IRWXG) < 0) {
 527                 wpa_printf(MSG_ERROR, "chmod[ctrl_interface=%s]: %s",
 528                            fname, strerror(errno));
 529                 goto fail;
 530         }
 531         os_free(fname);
 532
 533 #ifdef ANDROID
 534 havesock:
 535 #endif /* ANDROID */
 536
 537         /*
 538          * Make socket non-blocking so that we don't hang forever if
 539          * target dies unexpectedly.
 540          */
 541         flags = fcntl(priv->sock, F_GETFL);
 542         if (flags >= 0) {
 543                 flags |= O_NONBLOCK;
 544                 if (fcntl(priv->sock, F_SETFL, flags) < 0) {
 545                         wpa_printf(MSG_INFO, "fcntl(ctrl, O_NONBLOCK): %s",
 546                                    strerror(errno));
 547                         /* Not fatal, continue on.*/
 548                 }
 549         }
 550
 551         eloop_register_read_sock(priv->sock, wpa_supplicant_ctrl_iface_receive,
 552                                  wpa_s, priv);
 553         wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb);
 554
 555         os_free(buf);
 556         return 0;
 557
 558 fail:
 559         if (priv->sock >= 0) {
 560                 close(priv->sock);
 561                 priv->sock = -1;
 562         }
 563         if (fname) {
 564                 unlink(fname);
 565                 os_free(fname);
 566         }
 567         os_free(buf);
 568         return -1;
 569 }
 570
 571
 572 struct ctrl_iface_priv *
 573 wpa_supplicant_ctrl_iface_init(struct wpa_supplicant *wpa_s)
 574 {
 575         struct ctrl_iface_priv *priv;
 576
 577         priv = os_zalloc(sizeof(*priv));
 578         if (priv == NULL)
 579                 return NULL;
 580         dl_list_init(&priv->ctrl_dst);
 581         priv->wpa_s = wpa_s;
 582         priv->sock = -1;
 583
 584         if (wpa_s->conf->ctrl_interface == NULL)
 585                 return priv;
 586
 587         if (wpas_ctrl_iface_open_sock(wpa_s, priv) < 0) {
 588                 os_free(priv);
 589                 return NULL;
 590         }
 591
 592         return priv;
 593 }
 594
 595
 596 static int wpas_ctrl_iface_reinit(struct wpa_supplicant *wpa_s,
 597                                   struct ctrl_iface_priv *priv)
 598 {
 599         int res;
 600
 601         if (priv->sock <= 0)
 602                 return -1;
 603
 604         /*
 605          * On Android, the control socket being used may be the socket
 606          * that is created when wpa_supplicant is started as a /init.*.rc
 607          * service. Such a socket is maintained as a key-value pair in
 608          * Android's environment. Closing this control socket would leave us
 609          * in a bad state with an invalid socket descriptor.
 610          */
 611         if (priv->android_control_socket)
 612                 return priv->sock;
 613
 614         eloop_unregister_read_sock(priv->sock);
 615         close(priv->sock);
 616         priv->sock = -1;
 617         res = wpas_ctrl_iface_open_sock(wpa_s, priv);
 618         if (res < 0)
 619                 return -1;
 620         return priv->sock;
 621 }
 622
 623
 624 void wpa_supplicant_ctrl_iface_deinit(struct ctrl_iface_priv *priv)
 625 {
 626         struct wpa_ctrl_dst *dst, *prev;
 627
 628         if (priv->sock > -1) {
 629                 char *fname;
 630                 char *buf, *dir = NULL;
 631                 eloop_unregister_read_sock(priv->sock);
 632                 if (!dl_list_empty(&priv->ctrl_dst)) {
 633                         /*
 634                          * Wait before closing the control socket if
 635                          * there are any attached monitors in order to allow
 636                          * them to receive any pending messages.
 637                          */
 638                         wpa_printf(MSG_DEBUG, "CTRL_IFACE wait for attached "
 639                                    "monitors to receive messages");
 640                         os_sleep(0, 100000);
 641                 }
 642                 close(priv->sock);
 643                 priv->sock = -1;
 644                 fname = wpa_supplicant_ctrl_iface_path(priv->wpa_s);
 645                 if (fname) {
 646                         unlink(fname);
 647                         os_free(fname);
 648                 }
 649
 650                 if (priv->wpa_s->conf->ctrl_interface == NULL)
 651                         goto free_dst;
 652                 buf = os_strdup(priv->wpa_s->conf->ctrl_interface);
 653                 if (buf == NULL)
 654                         goto free_dst;
 655                 if (os_strncmp(buf, "DIR=", 4) == 0) {
 656                         char *gid_str;
 657                         dir = buf + 4;
 658                         gid_str = os_strstr(dir, " GROUP=");
 659                         if (gid_str)
 660                                 *gid_str = '\0';
 661                 } else
 662                         dir = buf;
 663
 664                 if (rmdir(dir) < 0) {
 665                         if (errno == ENOTEMPTY) {
 666                                 wpa_printf(MSG_DEBUG, "Control interface "
 667                                            "directory not empty - leaving it "
 668                                            "behind");
 669                         } else {
 670                                 wpa_printf(MSG_ERROR,
 671                                            "rmdir[ctrl_interface=%s]: %s",
 672                                            dir, strerror(errno));
 673                         }
 674                 }
 675                 os_free(buf);
 676         }
 677
 678 free_dst:
 679         dl_list_for_each_safe(dst, prev, &priv->ctrl_dst, struct wpa_ctrl_dst,
 680                               list)
 681                 os_free(dst);
 682         os_free(priv);
 683 }
 684
 685
 686 /**
 687  * wpa_supplicant_ctrl_iface_send - Send a control interface packet to monitors
 688  * @ifname: Interface name for global control socket or %NULL
 689  * @sock: Local socket fd
 690  * @ctrl_dst: List of attached listeners
 691  * @level: Priority level of the message
 692  * @buf: Message data
 693  * @len: Message length
 694  *
 695  * Send a packet to all monitor programs attached to the control interface.
 696  */
 697 static void wpa_supplicant_ctrl_iface_send(struct wpa_supplicant *wpa_s,
 698                                            const char *ifname, int sock,
 699                                            struct dl_list *ctrl_dst,
 700                                            int level, const char *buf,
 701                                            size_t len,
 702                                            struct ctrl_iface_priv *priv,
 703                                            struct ctrl_iface_global_priv *gp)
 704 {
 705         struct wpa_ctrl_dst *dst, *next;
 706         char levelstr[10];
 707         int idx, res;
 708         struct msghdr msg;
 709         struct iovec io[5];
 710
 711         if (sock < 0 || dl_list_empty(ctrl_dst))
 712                 return;
 713
 714         res = os_snprintf(levelstr, sizeof(levelstr), "<%d>", level);
 715         if (os_snprintf_error(sizeof(levelstr), res))
 716                 return;
 717         idx = 0;
 718         if (ifname) {
 719                 io[idx].iov_base = "IFNAME=";
 720                 io[idx].iov_len = 7;
 721                 idx++;
 722                 io[idx].iov_base = (char *) ifname;
 723                 io[idx].iov_len = os_strlen(ifname);
 724                 idx++;
 725                 io[idx].iov_base = " ";
 726                 io[idx].iov_len = 1;
 727                 idx++;
 728         }
 729         io[idx].iov_base = levelstr;
 730         io[idx].iov_len = os_strlen(levelstr);
 731         idx++;
 732         io[idx].iov_base = (char *) buf;
 733         io[idx].iov_len = len;
 734         idx++;
 735         os_memset(&msg, 0, sizeof(msg));
 736         msg.msg_iov = io;
 737         msg.msg_iovlen = idx;
 738
 739         dl_list_for_each_safe(dst, next, ctrl_dst, struct wpa_ctrl_dst, list) {
 740                 int _errno;
 741                 char addr_txt[200];
 742
 743                 if (level < dst->debug_level)
 744                         continue;
 745
 746                 printf_encode(addr_txt, sizeof(addr_txt),
 747                               (u8 *) dst->addr.sun_path, dst->addrlen -
 748                               offsetof(struct sockaddr_un, sun_path));
 749                 msg.msg_name = (void *) &dst->addr;
 750                 msg.msg_namelen = dst->addrlen;
 751                 wpas_ctrl_sock_debug("ctrl_sock-sendmsg", sock, buf, len);
 752                 if (sendmsg(sock, &msg, MSG_DONTWAIT) >= 0) {
 753                         wpa_printf(MSG_MSGDUMP,
 754                                    "CTRL_IFACE monitor sent successfully to %s",
 755                                    addr_txt);
 756                         dst->errors = 0;
 757                         continue;
 758                 }
 759
 760                 _errno = errno;
 761                 wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor[%s]: %d - %s",
 762                            addr_txt, errno, strerror(errno));
 763                 dst->errors++;
 764
 765                 if (dst->errors > 10 || _errno == ENOENT || _errno == EPERM) {
 766                         wpa_printf(MSG_INFO, "CTRL_IFACE: Detach monitor %s that cannot receive messages",
 767                                 addr_txt);
 768                         wpa_supplicant_ctrl_iface_detach(ctrl_dst, &dst->addr,
 769                                                          dst->addrlen);
 770                 }
 771
 772                 if (_errno == ENOBUFS || _errno == EAGAIN) {
 773                         /*
 774                          * The socket send buffer could be full. This may happen
 775                          * if client programs are not receiving their pending
 776                          * messages. Close and reopen the socket as a workaround
 777                          * to avoid getting stuck being unable to send any new
 778                          * responses.
 779                          */
 780                         if (priv)
 781                                 sock = wpas_ctrl_iface_reinit(wpa_s, priv);
 782                         else if (gp)
 783                                 sock = wpas_ctrl_iface_global_reinit(
 784                                         wpa_s->global, gp);
 785                         else
 786                                 break;
 787                         if (sock < 0) {
 788                                 wpa_dbg(wpa_s, MSG_DEBUG,
 789                                         "Failed to reinitialize ctrl_iface socket");
 790                                 break;
 791                         }
 792                 }
 793         }
 794 }
 795
 796
 797 void wpa_supplicant_ctrl_iface_wait(struct ctrl_iface_priv *priv)
 798 {
 799         char buf[256];
 800         int res;
 801         struct sockaddr_un from;
 802         socklen_t fromlen = sizeof(from);
 803
 804         for (;;) {
 805                 wpa_printf(MSG_DEBUG, "CTRL_IFACE - %s - wait for monitor to "
 806                            "attach", priv->wpa_s->ifname);
 807                 eloop_wait_for_read_sock(priv->sock);
 808
 809                 res = recvfrom(priv->sock, buf, sizeof(buf) - 1, 0,
 810                                (struct sockaddr *) &from, &fromlen);
 811                 if (res < 0) {
 812                         wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s",
 813                                    strerror(errno));
 814                         continue;
 815                 }
 816                 buf[res] = '\0';
 817
 818                 if (os_strcmp(buf, "ATTACH") == 0) {
 819                         /* handle ATTACH signal of first monitor interface */
 820                         if (!wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst,
 821                                                               &from, fromlen,
 822                                                               0)) {
 823                                 if (sendto(priv->sock, "OK\n", 3, 0,
 824                                            (struct sockaddr *) &from, fromlen) <
 825                                     0) {
 826                                         wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s",
 827                                                    strerror(errno));
 828                                 }
 829                                 /* OK to continue */
 830                                 return;
 831                         } else {
 832                                 if (sendto(priv->sock, "FAIL\n", 5, 0,
 833                                            (struct sockaddr *) &from, fromlen) <
 834                                     0) {
 835                                         wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s",
 836                                                    strerror(errno));
 837                                 }
 838                         }
 839                 } else {
 840                         /* return FAIL for all other signals */
 841                         if (sendto(priv->sock, "FAIL\n", 5, 0,
 842                                    (struct sockaddr *) &from, fromlen) < 0) {
 843                                 wpa_printf(MSG_DEBUG,
 844                                            "ctrl_iface sendto failed: %s",
 845                                            strerror(errno));
 846                         }
 847                 }
 848         }
 849 }
 850
 851
 852 /* Global ctrl_iface */
 853
 854 static void wpa_supplicant_global_ctrl_iface_receive(int sock, void *eloop_ctx,
 855                                                      void *sock_ctx)
 856 {
 857         struct wpa_global *global = eloop_ctx;
 858         struct ctrl_iface_global_priv *priv = sock_ctx;
 859         char buf[4096];
 860         int res;
 861         struct sockaddr_un from;
 862         socklen_t fromlen = sizeof(from);
 863         char *reply = NULL, *reply_buf = NULL;
 864         size_t reply_len;
 865
 866         res = recvfrom(sock, buf, sizeof(buf) - 1, 0,
 867                        (struct sockaddr *) &from, &fromlen);
 868         if (res < 0) {
 869                 wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s",
 870                            strerror(errno));
 871                 return;
 872         }
 873         buf[res] = '\0';
 874
 875         if (os_strcmp(buf, "ATTACH") == 0) {
 876                 if (wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst, &from,
 877                                                      fromlen, 1))
 878                         reply_len = 1;
 879                 else
 880                         reply_len = 2;
 881         } else if (os_strcmp(buf, "DETACH") == 0) {
 882                 if (wpa_supplicant_ctrl_iface_detach(&priv->ctrl_dst, &from,
 883                                                      fromlen))
 884                         reply_len = 1;
 885                 else
 886                         reply_len = 2;
 887         } else {
 888                 reply_buf = wpa_supplicant_global_ctrl_iface_process(
 889                         global, buf, &reply_len);
 890                 reply = reply_buf;
 891
 892                 /*
 893                  * There could be some password/key material in the command, so
 894                  * clear the buffer explicitly now that it is not needed
 895                  * anymore.
 896                  */
 897                 os_memset(buf, 0, res);
 898         }
 899
 900         if (!reply && reply_len == 1) {
 901                 reply = "FAIL\n";
 902                 reply_len = 5;
 903         } else if (!reply && reply_len == 2) {
 904                 reply = "OK\n";
 905                 reply_len = 3;
 906         }
 907
 908         if (reply) {
 909                 wpas_ctrl_sock_debug("global_ctrl_sock-sendto",
 910                                      sock, reply, reply_len);
 911                 if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
 912                            fromlen) < 0) {
 913                         wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s",
 914                                 strerror(errno));
 915                 }
 916         }
 917         os_free(reply_buf);
 918 }
 919
 920
 921 static int wpas_global_ctrl_iface_open_sock(struct wpa_global *global,
 922                                             struct ctrl_iface_global_priv *priv)
 923 {
 924         struct sockaddr_un addr;
 925         const char *ctrl = global->params.ctrl_interface;
 926         int flags;
 927
 928         wpa_printf(MSG_DEBUG, "Global control interface '%s'", ctrl);
 929
 930 #ifdef ANDROID
 931         if (os_strncmp(ctrl, "@android:", 9) == 0) {
 932                 priv->sock = android_get_control_socket(ctrl + 9);
 933                 if (priv->sock < 0) {
 934                         wpa_printf(MSG_ERROR, "Failed to open Android control "
 935                                    "socket '%s'", ctrl + 9);
 936                         goto fail;
 937                 }
 938                 wpa_printf(MSG_DEBUG, "Using Android control socket '%s'",
 939                            ctrl + 9);
 940                 priv->android_control_socket = 1;
 941                 goto havesock;
 942         }
 943
 944         if (os_strncmp(ctrl, "@abstract:", 10) != 0) {
 945                 /*
 946                  * Backwards compatibility - try to open an Android control
 947                  * socket and if that fails, assume this was a UNIX domain
 948                  * socket instead.
 949                  */
 950                 priv->sock = android_get_control_socket(ctrl);
 951                 if (priv->sock >= 0) {
 952                         wpa_printf(MSG_DEBUG,
 953                                    "Using Android control socket '%s'",
 954                                    ctrl);
 955                         priv->android_control_socket = 1;
 956                         goto havesock;
 957                 }
 958         }
 959 #endif /* ANDROID */
 960
 961         priv->sock = socket(PF_UNIX, SOCK_DGRAM, 0);
 962         if (priv->sock < 0) {
 963                 wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno));
 964                 goto fail;
 965         }
 966
 967         os_memset(&addr, 0, sizeof(addr));
 968 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
 969         addr.sun_len = sizeof(addr);
 970 #endif /* __FreeBSD__ */
 971         addr.sun_family = AF_UNIX;
 972
 973         if (os_strncmp(ctrl, "@abstract:", 10) == 0) {
 974                 addr.sun_path[0] = '\0';
 975                 os_strlcpy(addr.sun_path + 1, ctrl + 10,
 976                            sizeof(addr.sun_path) - 1);
 977                 if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) <
 978                     0) {
 979                         wpa_printf(MSG_ERROR, "supp-global-ctrl-iface-init: "
 980                                    "bind(PF_UNIX;%s) failed: %s",
 981                                    ctrl, strerror(errno));
 982                         goto fail;
 983                 }
 984                 wpa_printf(MSG_DEBUG, "Using Abstract control socket '%s'",
 985                            ctrl + 10);
 986                 goto havesock;
 987         }
 988
 989         os_strlcpy(addr.sun_path, ctrl, sizeof(addr.sun_path));
 990         if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
 991                 wpa_printf(MSG_INFO, "supp-global-ctrl-iface-init(%s) (will try fixup): bind(PF_UNIX): %s",
 992                            ctrl, strerror(errno));
 993                 if (connect(priv->sock, (struct sockaddr *) &addr,
 994                             sizeof(addr)) < 0) {
 995                         wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not"
 996                                    " allow connections - assuming it was left"
 997                                    "over from forced program termination");
 998                         if (unlink(ctrl) < 0) {
 999                                 wpa_printf(MSG_ERROR,
1000                                            "Could not unlink existing ctrl_iface socket '%s': %s",
1001                                            ctrl, strerror(errno));
1002                                 goto fail;
1003                         }
1004                         if (bind(priv->sock, (struct sockaddr *) &addr,
1005                                  sizeof(addr)) < 0) {
1006                                 wpa_printf(MSG_ERROR, "supp-glb-iface-init: bind(PF_UNIX;%s): %s",
1007                                            ctrl, strerror(errno));
1008                                 goto fail;
1009                         }
1010                         wpa_printf(MSG_DEBUG, "Successfully replaced leftover "
1011                                    "ctrl_iface socket '%s'",
1012                                    ctrl);
1013                 } else {
1014                         wpa_printf(MSG_INFO, "ctrl_iface exists and seems to "
1015                                    "be in use - cannot override it");
1016                         wpa_printf(MSG_INFO, "Delete '%s' manually if it is "
1017                                    "not used anymore",
1018                                    ctrl);
1019                         goto fail;
1020                 }
1021         }
1022
1023         wpa_printf(MSG_DEBUG, "Using UNIX control socket '%s'", ctrl);
1024
1025         if (global->params.ctrl_interface_group) {
1026                 char *gid_str = global->params.ctrl_interface_group;
1027                 gid_t gid = 0;
1028                 struct group *grp;
1029                 char *endp;
1030
1031                 grp = getgrnam(gid_str);
1032                 if (grp) {
1033                         gid = grp->gr_gid;
1034                         wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d"
1035                                    " (from group name '%s')",
1036                                    (int) gid, gid_str);
1037                 } else {
1038                         /* Group name not found - try to parse this as gid */
1039                         gid = strtol(gid_str, &endp, 10);
1040                         if (*gid_str == '\0' || *endp != '\0') {
1041                                 wpa_printf(MSG_ERROR, "CTRL: Invalid group "
1042                                            "'%s'", gid_str);
1043                                 goto fail;
1044                         }
1045                         wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d",
1046                                    (int) gid);
1047                 }
1048                 if (chown(ctrl, -1, gid) < 0) {
1049                         wpa_printf(MSG_ERROR,
1050                                    "chown[global_ctrl_interface=%s,gid=%d]: %s",
1051                                    ctrl, (int) gid, strerror(errno));
1052                         goto fail;
1053                 }
1054
1055                 if (chmod(ctrl, S_IRWXU | S_IRWXG) < 0) {
1056                         wpa_printf(MSG_ERROR,
1057                                    "chmod[global_ctrl_interface=%s]: %s",
1058                                    ctrl, strerror(errno));
1059                         goto fail;
1060                 }
1061         } else {
1062                 if (chmod(ctrl, S_IRWXU) < 0) {
1063                         wpa_printf(MSG_DEBUG,
1064                                    "chmod[global_ctrl_interface=%s](S_IRWXU): %s",
1065                                    ctrl, strerror(errno));
1066                         /* continue anyway since group change was not required
1067                          */
1068                 }
1069         }
1070
1071 havesock:
1072
1073         /*
1074          * Make socket non-blocking so that we don't hang forever if
1075          * target dies unexpectedly.
1076          */
1077         flags = fcntl(priv->sock, F_GETFL);
1078         if (flags >= 0) {
1079                 flags |= O_NONBLOCK;
1080                 if (fcntl(priv->sock, F_SETFL, flags) < 0) {
1081                         wpa_printf(MSG_INFO, "fcntl(ctrl, O_NONBLOCK): %s",
1082                                    strerror(errno));
1083                         /* Not fatal, continue on.*/
1084                 }
1085         }
1086
1087         eloop_register_read_sock(priv->sock,
1088                                  wpa_supplicant_global_ctrl_iface_receive,
1089                                  global, priv);
1090
1091         return 0;
1092
1093 fail:
1094         if (priv->sock >= 0) {
1095                 close(priv->sock);
1096                 priv->sock = -1;
1097         }
1098         return -1;
1099 }
1100
1101
1102 struct ctrl_iface_global_priv *
1103 wpa_supplicant_global_ctrl_iface_init(struct wpa_global *global)
1104 {
1105         struct ctrl_iface_global_priv *priv;
1106
1107         priv = os_zalloc(sizeof(*priv));
1108         if (priv == NULL)
1109                 return NULL;
1110         dl_list_init(&priv->ctrl_dst);
1111         priv->global = global;
1112         priv->sock = -1;
1113
1114         if (global->params.ctrl_interface == NULL)
1115                 return priv;
1116
1117         if (wpas_global_ctrl_iface_open_sock(global, priv) < 0) {
1118                 os_free(priv);
1119                 return NULL;
1120         }
1121
1122         wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb);
1123
1124         return priv;
1125 }
1126
1127
1128 static int wpas_ctrl_iface_global_reinit(struct wpa_global *global,
1129                                          struct ctrl_iface_global_priv *priv)
1130 {
1131         int res;
1132
1133         if (priv->sock <= 0)
1134                 return -1;
1135
1136         /*
1137          * On Android, the control socket being used may be the socket
1138          * that is created when wpa_supplicant is started as a /init.*.rc
1139          * service. Such a socket is maintained as a key-value pair in
1140          * Android's environment. Closing this control socket would leave us
1141          * in a bad state with an invalid socket descriptor.
1142          */
1143         if (priv->android_control_socket)
1144                 return priv->sock;
1145
1146         eloop_unregister_read_sock(priv->sock);
1147         close(priv->sock);
1148         priv->sock = -1;
1149         res = wpas_global_ctrl_iface_open_sock(global, priv);
1150         if (res < 0)
1151                 return -1;
1152         return priv->sock;
1153 }
1154
1155
1156 void
1157 wpa_supplicant_global_ctrl_iface_deinit(struct ctrl_iface_global_priv *priv)
1158 {
1159         struct wpa_ctrl_dst *dst, *prev;
1160
1161         if (priv->sock >= 0) {
1162                 eloop_unregister_read_sock(priv->sock);
1163                 close(priv->sock);
1164         }
1165         if (priv->global->params.ctrl_interface)
1166                 unlink(priv->global->params.ctrl_interface);
1167         dl_list_for_each_safe(dst, prev, &priv->ctrl_dst, struct wpa_ctrl_dst,
1168                               list)
1169                 os_free(dst);
1170         os_free(priv);
1171 }