ctrl_iface.c revision 324698
1/*
2 * WPA Supplicant / Control interface (shared code for all backends)
3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9#include "utils/includes.h"
10#ifdef CONFIG_TESTING_OPTIONS
11#include <net/ethernet.h>
12#include <netinet/ip.h>
13#endif /* CONFIG_TESTING_OPTIONS */
14
15#include "utils/common.h"
16#include "utils/eloop.h"
17#include "utils/uuid.h"
18#include "common/version.h"
19#include "common/ieee802_11_defs.h"
20#include "common/ieee802_11_common.h"
21#include "common/wpa_ctrl.h"
22#include "crypto/tls.h"
23#include "ap/hostapd.h"
24#include "eap_peer/eap.h"
25#include "eapol_supp/eapol_supp_sm.h"
26#include "rsn_supp/wpa.h"
27#include "rsn_supp/preauth.h"
28#include "rsn_supp/pmksa_cache.h"
29#include "l2_packet/l2_packet.h"
30#include "wps/wps.h"
31#include "fst/fst.h"
32#include "fst/fst_ctrl_iface.h"
33#include "config.h"
34#include "wpa_supplicant_i.h"
35#include "driver_i.h"
36#include "wps_supplicant.h"
37#include "ibss_rsn.h"
38#include "ap.h"
39#include "p2p_supplicant.h"
40#include "p2p/p2p.h"
41#include "hs20_supplicant.h"
42#include "wifi_display.h"
43#include "notify.h"
44#include "bss.h"
45#include "scan.h"
46#include "ctrl_iface.h"
47#include "interworking.h"
48#include "blacklist.h"
49#include "autoscan.h"
50#include "wnm_sta.h"
51#include "offchannel.h"
52#include "drivers/driver.h"
53#include "mesh.h"
54
55static int wpa_supplicant_global_iface_list(struct wpa_global *global,
56					    char *buf, int len);
57static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
58						  char *buf, int len);
59static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s,
60					char *val);
61
62static int set_bssid_filter(struct wpa_supplicant *wpa_s, char *val)
63{
64	char *pos;
65	u8 addr[ETH_ALEN], *filter = NULL, *n;
66	size_t count = 0;
67
68	pos = val;
69	while (pos) {
70		if (*pos == '\0')
71			break;
72		if (hwaddr_aton(pos, addr)) {
73			os_free(filter);
74			return -1;
75		}
76		n = os_realloc_array(filter, count + 1, ETH_ALEN);
77		if (n == NULL) {
78			os_free(filter);
79			return -1;
80		}
81		filter = n;
82		os_memcpy(filter + count * ETH_ALEN, addr, ETH_ALEN);
83		count++;
84
85		pos = os_strchr(pos, ' ');
86		if (pos)
87			pos++;
88	}
89
90	wpa_hexdump(MSG_DEBUG, "bssid_filter", filter, count * ETH_ALEN);
91	os_free(wpa_s->bssid_filter);
92	wpa_s->bssid_filter = filter;
93	wpa_s->bssid_filter_count = count;
94
95	return 0;
96}
97
98
99static int set_disallow_aps(struct wpa_supplicant *wpa_s, char *val)
100{
101	char *pos;
102	u8 addr[ETH_ALEN], *bssid = NULL, *n;
103	struct wpa_ssid_value *ssid = NULL, *ns;
104	size_t count = 0, ssid_count = 0;
105	struct wpa_ssid *c;
106
107	/*
108	 * disallow_list ::= <ssid_spec> | <bssid_spec> | <disallow_list> | ""
109	 * SSID_SPEC ::= ssid <SSID_HEX>
110	 * BSSID_SPEC ::= bssid <BSSID_HEX>
111	 */
112
113	pos = val;
114	while (pos) {
115		if (*pos == '\0')
116			break;
117		if (os_strncmp(pos, "bssid ", 6) == 0) {
118			int res;
119			pos += 6;
120			res = hwaddr_aton2(pos, addr);
121			if (res < 0) {
122				os_free(ssid);
123				os_free(bssid);
124				wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
125					   "BSSID value '%s'", pos);
126				return -1;
127			}
128			pos += res;
129			n = os_realloc_array(bssid, count + 1, ETH_ALEN);
130			if (n == NULL) {
131				os_free(ssid);
132				os_free(bssid);
133				return -1;
134			}
135			bssid = n;
136			os_memcpy(bssid + count * ETH_ALEN, addr, ETH_ALEN);
137			count++;
138		} else if (os_strncmp(pos, "ssid ", 5) == 0) {
139			char *end;
140			pos += 5;
141
142			end = pos;
143			while (*end) {
144				if (*end == '\0' || *end == ' ')
145					break;
146				end++;
147			}
148
149			ns = os_realloc_array(ssid, ssid_count + 1,
150					      sizeof(struct wpa_ssid_value));
151			if (ns == NULL) {
152				os_free(ssid);
153				os_free(bssid);
154				return -1;
155			}
156			ssid = ns;
157
158			if ((end - pos) & 0x01 ||
159			    end - pos > 2 * SSID_MAX_LEN ||
160			    hexstr2bin(pos, ssid[ssid_count].ssid,
161				       (end - pos) / 2) < 0) {
162				os_free(ssid);
163				os_free(bssid);
164				wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
165					   "SSID value '%s'", pos);
166				return -1;
167			}
168			ssid[ssid_count].ssid_len = (end - pos) / 2;
169			wpa_hexdump_ascii(MSG_DEBUG, "disallow_aps SSID",
170					  ssid[ssid_count].ssid,
171					  ssid[ssid_count].ssid_len);
172			ssid_count++;
173			pos = end;
174		} else {
175			wpa_printf(MSG_DEBUG, "Unexpected disallow_aps value "
176				   "'%s'", pos);
177			os_free(ssid);
178			os_free(bssid);
179			return -1;
180		}
181
182		pos = os_strchr(pos, ' ');
183		if (pos)
184			pos++;
185	}
186
187	wpa_hexdump(MSG_DEBUG, "disallow_aps_bssid", bssid, count * ETH_ALEN);
188	os_free(wpa_s->disallow_aps_bssid);
189	wpa_s->disallow_aps_bssid = bssid;
190	wpa_s->disallow_aps_bssid_count = count;
191
192	wpa_printf(MSG_DEBUG, "disallow_aps_ssid_count %d", (int) ssid_count);
193	os_free(wpa_s->disallow_aps_ssid);
194	wpa_s->disallow_aps_ssid = ssid;
195	wpa_s->disallow_aps_ssid_count = ssid_count;
196
197	if (!wpa_s->current_ssid || wpa_s->wpa_state < WPA_AUTHENTICATING)
198		return 0;
199
200	c = wpa_s->current_ssid;
201	if (c->mode != WPAS_MODE_INFRA && c->mode != WPAS_MODE_IBSS)
202		return 0;
203
204	if (!disallowed_bssid(wpa_s, wpa_s->bssid) &&
205	    !disallowed_ssid(wpa_s, c->ssid, c->ssid_len))
206		return 0;
207
208	wpa_printf(MSG_DEBUG, "Disconnect and try to find another network "
209		   "because current AP was marked disallowed");
210
211#ifdef CONFIG_SME
212	wpa_s->sme.prev_bssid_set = 0;
213#endif /* CONFIG_SME */
214	wpa_s->reassociate = 1;
215	wpa_s->own_disconnect_req = 1;
216	wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
217	wpa_supplicant_req_scan(wpa_s, 0, 0);
218
219	return 0;
220}
221
222
223#ifndef CONFIG_NO_CONFIG_BLOBS
224static int wpas_ctrl_set_blob(struct wpa_supplicant *wpa_s, char *pos)
225{
226	char *name = pos;
227	struct wpa_config_blob *blob;
228	size_t len;
229
230	pos = os_strchr(pos, ' ');
231	if (pos == NULL)
232		return -1;
233	*pos++ = '\0';
234	len = os_strlen(pos);
235	if (len & 1)
236		return -1;
237
238	wpa_printf(MSG_DEBUG, "CTRL: Set blob '%s'", name);
239	blob = os_zalloc(sizeof(*blob));
240	if (blob == NULL)
241		return -1;
242	blob->name = os_strdup(name);
243	blob->data = os_malloc(len / 2);
244	if (blob->name == NULL || blob->data == NULL) {
245		wpa_config_free_blob(blob);
246		return -1;
247	}
248
249	if (hexstr2bin(pos, blob->data, len / 2) < 0) {
250		wpa_printf(MSG_DEBUG, "CTRL: Invalid blob hex data");
251		wpa_config_free_blob(blob);
252		return -1;
253	}
254	blob->len = len / 2;
255
256	wpa_config_set_blob(wpa_s->conf, blob);
257
258	return 0;
259}
260#endif /* CONFIG_NO_CONFIG_BLOBS */
261
262
263static int wpas_ctrl_pno(struct wpa_supplicant *wpa_s, char *cmd)
264{
265	char *params;
266	char *pos;
267	int *freqs = NULL;
268	int ret;
269
270	if (atoi(cmd)) {
271		params = os_strchr(cmd, ' ');
272		os_free(wpa_s->manual_sched_scan_freqs);
273		if (params) {
274			params++;
275			pos = os_strstr(params, "freq=");
276			if (pos)
277				freqs = freq_range_to_channel_list(wpa_s,
278								   pos + 5);
279		}
280		wpa_s->manual_sched_scan_freqs = freqs;
281		ret = wpas_start_pno(wpa_s);
282	} else {
283		ret = wpas_stop_pno(wpa_s);
284	}
285	return ret;
286}
287
288
289static int wpas_ctrl_set_band(struct wpa_supplicant *wpa_s, char *band)
290{
291	union wpa_event_data event;
292
293	if (os_strcmp(band, "AUTO") == 0)
294		wpa_s->setband = WPA_SETBAND_AUTO;
295	else if (os_strcmp(band, "5G") == 0)
296		wpa_s->setband = WPA_SETBAND_5G;
297	else if (os_strcmp(band, "2G") == 0)
298		wpa_s->setband = WPA_SETBAND_2G;
299	else
300		return -1;
301
302	if (wpa_drv_setband(wpa_s, wpa_s->setband) == 0) {
303		os_memset(&event, 0, sizeof(event));
304		event.channel_list_changed.initiator = REGDOM_SET_BY_USER;
305		event.channel_list_changed.type = REGDOM_TYPE_UNKNOWN;
306		wpa_supplicant_event(wpa_s, EVENT_CHANNEL_LIST_CHANGED, &event);
307	}
308
309	return 0;
310}
311
312
313static int wpa_supplicant_ctrl_iface_set(struct wpa_supplicant *wpa_s,
314					 char *cmd)
315{
316	char *value;
317	int ret = 0;
318
319	value = os_strchr(cmd, ' ');
320	if (value == NULL)
321		return -1;
322	*value++ = '\0';
323
324	wpa_printf(MSG_DEBUG, "CTRL_IFACE SET '%s'='%s'", cmd, value);
325	if (os_strcasecmp(cmd, "EAPOL::heldPeriod") == 0) {
326		eapol_sm_configure(wpa_s->eapol,
327				   atoi(value), -1, -1, -1);
328	} else if (os_strcasecmp(cmd, "EAPOL::authPeriod") == 0) {
329		eapol_sm_configure(wpa_s->eapol,
330				   -1, atoi(value), -1, -1);
331	} else if (os_strcasecmp(cmd, "EAPOL::startPeriod") == 0) {
332		eapol_sm_configure(wpa_s->eapol,
333				   -1, -1, atoi(value), -1);
334	} else if (os_strcasecmp(cmd, "EAPOL::maxStart") == 0) {
335		eapol_sm_configure(wpa_s->eapol,
336				   -1, -1, -1, atoi(value));
337	} else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKLifetime") == 0) {
338		if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
339				     atoi(value)))
340			ret = -1;
341	} else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKReauthThreshold") ==
342		   0) {
343		if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
344				     atoi(value)))
345			ret = -1;
346	} else if (os_strcasecmp(cmd, "dot11RSNAConfigSATimeout") == 0) {
347		if (wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT, atoi(value)))
348			ret = -1;
349	} else if (os_strcasecmp(cmd, "wps_fragment_size") == 0) {
350		wpa_s->wps_fragment_size = atoi(value);
351#ifdef CONFIG_WPS_TESTING
352	} else if (os_strcasecmp(cmd, "wps_version_number") == 0) {
353		long int val;
354		val = strtol(value, NULL, 0);
355		if (val < 0 || val > 0xff) {
356			ret = -1;
357			wpa_printf(MSG_DEBUG, "WPS: Invalid "
358				   "wps_version_number %ld", val);
359		} else {
360			wps_version_number = val;
361			wpa_printf(MSG_DEBUG, "WPS: Testing - force WPS "
362				   "version %u.%u",
363				   (wps_version_number & 0xf0) >> 4,
364				   wps_version_number & 0x0f);
365		}
366	} else if (os_strcasecmp(cmd, "wps_testing_dummy_cred") == 0) {
367		wps_testing_dummy_cred = atoi(value);
368		wpa_printf(MSG_DEBUG, "WPS: Testing - dummy_cred=%d",
369			   wps_testing_dummy_cred);
370	} else if (os_strcasecmp(cmd, "wps_corrupt_pkhash") == 0) {
371		wps_corrupt_pkhash = atoi(value);
372		wpa_printf(MSG_DEBUG, "WPS: Testing - wps_corrupt_pkhash=%d",
373			   wps_corrupt_pkhash);
374#endif /* CONFIG_WPS_TESTING */
375	} else if (os_strcasecmp(cmd, "ampdu") == 0) {
376		if (wpa_drv_ampdu(wpa_s, atoi(value)) < 0)
377			ret = -1;
378#ifdef CONFIG_TDLS
379#ifdef CONFIG_TDLS_TESTING
380	} else if (os_strcasecmp(cmd, "tdls_testing") == 0) {
381		extern unsigned int tdls_testing;
382		tdls_testing = strtol(value, NULL, 0);
383		wpa_printf(MSG_DEBUG, "TDLS: tdls_testing=0x%x", tdls_testing);
384#endif /* CONFIG_TDLS_TESTING */
385	} else if (os_strcasecmp(cmd, "tdls_disabled") == 0) {
386		int disabled = atoi(value);
387		wpa_printf(MSG_DEBUG, "TDLS: tdls_disabled=%d", disabled);
388		if (disabled) {
389			if (wpa_drv_tdls_oper(wpa_s, TDLS_DISABLE, NULL) < 0)
390				ret = -1;
391		} else if (wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL) < 0)
392			ret = -1;
393		wpa_tdls_enable(wpa_s->wpa, !disabled);
394#endif /* CONFIG_TDLS */
395	} else if (os_strcasecmp(cmd, "pno") == 0) {
396		ret = wpas_ctrl_pno(wpa_s, value);
397	} else if (os_strcasecmp(cmd, "radio_disabled") == 0) {
398		int disabled = atoi(value);
399		if (wpa_drv_radio_disable(wpa_s, disabled) < 0)
400			ret = -1;
401		else if (disabled)
402			wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
403	} else if (os_strcasecmp(cmd, "uapsd") == 0) {
404		if (os_strcmp(value, "disable") == 0)
405			wpa_s->set_sta_uapsd = 0;
406		else {
407			int be, bk, vi, vo;
408			char *pos;
409			/* format: BE,BK,VI,VO;max SP Length */
410			be = atoi(value);
411			pos = os_strchr(value, ',');
412			if (pos == NULL)
413				return -1;
414			pos++;
415			bk = atoi(pos);
416			pos = os_strchr(pos, ',');
417			if (pos == NULL)
418				return -1;
419			pos++;
420			vi = atoi(pos);
421			pos = os_strchr(pos, ',');
422			if (pos == NULL)
423				return -1;
424			pos++;
425			vo = atoi(pos);
426			/* ignore max SP Length for now */
427
428			wpa_s->set_sta_uapsd = 1;
429			wpa_s->sta_uapsd = 0;
430			if (be)
431				wpa_s->sta_uapsd |= BIT(0);
432			if (bk)
433				wpa_s->sta_uapsd |= BIT(1);
434			if (vi)
435				wpa_s->sta_uapsd |= BIT(2);
436			if (vo)
437				wpa_s->sta_uapsd |= BIT(3);
438		}
439	} else if (os_strcasecmp(cmd, "ps") == 0) {
440		ret = wpa_drv_set_p2p_powersave(wpa_s, atoi(value), -1, -1);
441#ifdef CONFIG_WIFI_DISPLAY
442	} else if (os_strcasecmp(cmd, "wifi_display") == 0) {
443		int enabled = !!atoi(value);
444		if (enabled && !wpa_s->global->p2p)
445			ret = -1;
446		else
447			wifi_display_enable(wpa_s->global, enabled);
448#endif /* CONFIG_WIFI_DISPLAY */
449	} else if (os_strcasecmp(cmd, "bssid_filter") == 0) {
450		ret = set_bssid_filter(wpa_s, value);
451	} else if (os_strcasecmp(cmd, "disallow_aps") == 0) {
452		ret = set_disallow_aps(wpa_s, value);
453	} else if (os_strcasecmp(cmd, "no_keep_alive") == 0) {
454		wpa_s->no_keep_alive = !!atoi(value);
455#ifdef CONFIG_TESTING_OPTIONS
456	} else if (os_strcasecmp(cmd, "ext_mgmt_frame_handling") == 0) {
457		wpa_s->ext_mgmt_frame_handling = !!atoi(value);
458	} else if (os_strcasecmp(cmd, "ext_eapol_frame_io") == 0) {
459		wpa_s->ext_eapol_frame_io = !!atoi(value);
460#ifdef CONFIG_AP
461		if (wpa_s->ap_iface) {
462			wpa_s->ap_iface->bss[0]->ext_eapol_frame_io =
463				wpa_s->ext_eapol_frame_io;
464		}
465#endif /* CONFIG_AP */
466	} else if (os_strcasecmp(cmd, "extra_roc_dur") == 0) {
467		wpa_s->extra_roc_dur = atoi(value);
468	} else if (os_strcasecmp(cmd, "test_failure") == 0) {
469		wpa_s->test_failure = atoi(value);
470#endif /* CONFIG_TESTING_OPTIONS */
471#ifndef CONFIG_NO_CONFIG_BLOBS
472	} else if (os_strcmp(cmd, "blob") == 0) {
473		ret = wpas_ctrl_set_blob(wpa_s, value);
474#endif /* CONFIG_NO_CONFIG_BLOBS */
475	} else if (os_strcasecmp(cmd, "setband") == 0) {
476		ret = wpas_ctrl_set_band(wpa_s, value);
477	} else {
478		value[-1] = '=';
479		ret = wpa_config_process_global(wpa_s->conf, cmd, -1);
480		if (ret == 0)
481			wpa_supplicant_update_config(wpa_s);
482	}
483
484	return ret;
485}
486
487
488static int wpa_supplicant_ctrl_iface_get(struct wpa_supplicant *wpa_s,
489					 char *cmd, char *buf, size_t buflen)
490{
491	int res = -1;
492
493	wpa_printf(MSG_DEBUG, "CTRL_IFACE GET '%s'", cmd);
494
495	if (os_strcmp(cmd, "version") == 0) {
496		res = os_snprintf(buf, buflen, "%s", VERSION_STR);
497	} else if (os_strcasecmp(cmd, "country") == 0) {
498		if (wpa_s->conf->country[0] && wpa_s->conf->country[1])
499			res = os_snprintf(buf, buflen, "%c%c",
500					  wpa_s->conf->country[0],
501					  wpa_s->conf->country[1]);
502#ifdef CONFIG_WIFI_DISPLAY
503	} else if (os_strcasecmp(cmd, "wifi_display") == 0) {
504		int enabled;
505		if (wpa_s->global->p2p == NULL ||
506		    wpa_s->global->p2p_disabled)
507			enabled = 0;
508		else
509			enabled = wpa_s->global->wifi_display;
510		res = os_snprintf(buf, buflen, "%d", enabled);
511#endif /* CONFIG_WIFI_DISPLAY */
512#ifdef CONFIG_TESTING_GET_GTK
513	} else if (os_strcmp(cmd, "gtk") == 0) {
514		if (wpa_s->last_gtk_len == 0)
515			return -1;
516		res = wpa_snprintf_hex(buf, buflen, wpa_s->last_gtk,
517				       wpa_s->last_gtk_len);
518		return res;
519#endif /* CONFIG_TESTING_GET_GTK */
520	} else if (os_strcmp(cmd, "tls_library") == 0) {
521		res = tls_get_library_version(buf, buflen);
522	} else {
523		res = wpa_config_get_value(cmd, wpa_s->conf, buf, buflen);
524	}
525
526	if (os_snprintf_error(buflen, res))
527		return -1;
528	return res;
529}
530
531
532#ifdef IEEE8021X_EAPOL
533static int wpa_supplicant_ctrl_iface_preauth(struct wpa_supplicant *wpa_s,
534					     char *addr)
535{
536	u8 bssid[ETH_ALEN];
537	struct wpa_ssid *ssid = wpa_s->current_ssid;
538
539	if (hwaddr_aton(addr, bssid)) {
540		wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH: invalid address "
541			   "'%s'", addr);
542		return -1;
543	}
544
545	wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH " MACSTR, MAC2STR(bssid));
546	rsn_preauth_deinit(wpa_s->wpa);
547	if (rsn_preauth_init(wpa_s->wpa, bssid, ssid ? &ssid->eap : NULL))
548		return -1;
549
550	return 0;
551}
552#endif /* IEEE8021X_EAPOL */
553
554
555#ifdef CONFIG_PEERKEY
556/* MLME-STKSTART.request(peer) */
557static int wpa_supplicant_ctrl_iface_stkstart(
558	struct wpa_supplicant *wpa_s, char *addr)
559{
560	u8 peer[ETH_ALEN];
561
562	if (hwaddr_aton(addr, peer)) {
563		wpa_printf(MSG_DEBUG, "CTRL_IFACE STKSTART: invalid "
564			   "address '%s'", addr);
565		return -1;
566	}
567
568	wpa_printf(MSG_DEBUG, "CTRL_IFACE STKSTART " MACSTR,
569		   MAC2STR(peer));
570
571	return wpa_sm_stkstart(wpa_s->wpa, peer);
572}
573#endif /* CONFIG_PEERKEY */
574
575
576#ifdef CONFIG_TDLS
577
578static int wpa_supplicant_ctrl_iface_tdls_discover(
579	struct wpa_supplicant *wpa_s, char *addr)
580{
581	u8 peer[ETH_ALEN];
582	int ret;
583
584	if (hwaddr_aton(addr, peer)) {
585		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER: invalid "
586			   "address '%s'", addr);
587		return -1;
588	}
589
590	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER " MACSTR,
591		   MAC2STR(peer));
592
593	if (wpa_tdls_is_external_setup(wpa_s->wpa))
594		ret = wpa_tdls_send_discovery_request(wpa_s->wpa, peer);
595	else
596		ret = wpa_drv_tdls_oper(wpa_s, TDLS_DISCOVERY_REQ, peer);
597
598	return ret;
599}
600
601
602static int wpa_supplicant_ctrl_iface_tdls_setup(
603	struct wpa_supplicant *wpa_s, char *addr)
604{
605	u8 peer[ETH_ALEN];
606	int ret;
607
608	if (hwaddr_aton(addr, peer)) {
609		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP: invalid "
610			   "address '%s'", addr);
611		return -1;
612	}
613
614	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP " MACSTR,
615		   MAC2STR(peer));
616
617	if ((wpa_s->conf->tdls_external_control) &&
618	    wpa_tdls_is_external_setup(wpa_s->wpa))
619		return wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
620
621	wpa_tdls_remove(wpa_s->wpa, peer);
622
623	if (wpa_tdls_is_external_setup(wpa_s->wpa))
624		ret = wpa_tdls_start(wpa_s->wpa, peer);
625	else
626		ret = wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
627
628	return ret;
629}
630
631
632static int wpa_supplicant_ctrl_iface_tdls_teardown(
633	struct wpa_supplicant *wpa_s, char *addr)
634{
635	u8 peer[ETH_ALEN];
636	int ret;
637
638	if (os_strcmp(addr, "*") == 0) {
639		/* remove everyone */
640		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN *");
641		wpa_tdls_teardown_peers(wpa_s->wpa);
642		return 0;
643	}
644
645	if (hwaddr_aton(addr, peer)) {
646		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN: invalid "
647			   "address '%s'", addr);
648		return -1;
649	}
650
651	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN " MACSTR,
652		   MAC2STR(peer));
653
654	if ((wpa_s->conf->tdls_external_control) &&
655	    wpa_tdls_is_external_setup(wpa_s->wpa))
656		return wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
657
658	if (wpa_tdls_is_external_setup(wpa_s->wpa))
659		ret = wpa_tdls_teardown_link(
660			wpa_s->wpa, peer,
661			WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
662	else
663		ret = wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
664
665	return ret;
666}
667
668
669static int ctrl_iface_get_capability_tdls(
670	struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
671{
672	int ret;
673
674	ret = os_snprintf(buf, buflen, "%s\n",
675			  wpa_s->drv_flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT ?
676			  (wpa_s->drv_flags &
677			   WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP ?
678			   "EXTERNAL" : "INTERNAL") : "UNSUPPORTED");
679	if (os_snprintf_error(buflen, ret))
680		return -1;
681	return ret;
682}
683
684
685static int wpa_supplicant_ctrl_iface_tdls_chan_switch(
686	struct wpa_supplicant *wpa_s, char *cmd)
687{
688	u8 peer[ETH_ALEN];
689	struct hostapd_freq_params freq_params;
690	u8 oper_class;
691	char *pos, *end;
692
693	if (!wpa_tdls_is_external_setup(wpa_s->wpa)) {
694		wpa_printf(MSG_INFO,
695			   "tdls_chanswitch: Only supported with external setup");
696		return -1;
697	}
698
699	os_memset(&freq_params, 0, sizeof(freq_params));
700
701	pos = os_strchr(cmd, ' ');
702	if (pos == NULL)
703		return -1;
704	*pos++ = '\0';
705
706	oper_class = strtol(pos, &end, 10);
707	if (pos == end) {
708		wpa_printf(MSG_INFO,
709			   "tdls_chanswitch: Invalid op class provided");
710		return -1;
711	}
712
713	pos = end;
714	freq_params.freq = atoi(pos);
715	if (freq_params.freq == 0) {
716		wpa_printf(MSG_INFO, "tdls_chanswitch: Invalid freq provided");
717		return -1;
718	}
719
720#define SET_FREQ_SETTING(str) \
721	do { \
722		const char *pos2 = os_strstr(pos, " " #str "="); \
723		if (pos2) { \
724			pos2 += sizeof(" " #str "=") - 1; \
725			freq_params.str = atoi(pos2); \
726		} \
727	} while (0)
728
729	SET_FREQ_SETTING(center_freq1);
730	SET_FREQ_SETTING(center_freq2);
731	SET_FREQ_SETTING(bandwidth);
732	SET_FREQ_SETTING(sec_channel_offset);
733#undef SET_FREQ_SETTING
734
735	freq_params.ht_enabled = !!os_strstr(pos, " ht");
736	freq_params.vht_enabled = !!os_strstr(pos, " vht");
737
738	if (hwaddr_aton(cmd, peer)) {
739		wpa_printf(MSG_DEBUG,
740			   "CTRL_IFACE TDLS_CHAN_SWITCH: Invalid address '%s'",
741			   cmd);
742		return -1;
743	}
744
745	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_CHAN_SWITCH " MACSTR
746		   " OP CLASS %d FREQ %d CENTER1 %d CENTER2 %d BW %d SEC_OFFSET %d%s%s",
747		   MAC2STR(peer), oper_class, freq_params.freq,
748		   freq_params.center_freq1, freq_params.center_freq2,
749		   freq_params.bandwidth, freq_params.sec_channel_offset,
750		   freq_params.ht_enabled ? " HT" : "",
751		   freq_params.vht_enabled ? " VHT" : "");
752
753	return wpa_tdls_enable_chan_switch(wpa_s->wpa, peer, oper_class,
754					   &freq_params);
755}
756
757
758static int wpa_supplicant_ctrl_iface_tdls_cancel_chan_switch(
759	struct wpa_supplicant *wpa_s, char *cmd)
760{
761	u8 peer[ETH_ALEN];
762
763	if (!wpa_tdls_is_external_setup(wpa_s->wpa)) {
764		wpa_printf(MSG_INFO,
765			   "tdls_chanswitch: Only supported with external setup");
766		return -1;
767	}
768
769	if (hwaddr_aton(cmd, peer)) {
770		wpa_printf(MSG_DEBUG,
771			   "CTRL_IFACE TDLS_CANCEL_CHAN_SWITCH: Invalid address '%s'",
772			   cmd);
773		return -1;
774	}
775
776	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_CANCEL_CHAN_SWITCH " MACSTR,
777		   MAC2STR(peer));
778
779	return wpa_tdls_disable_chan_switch(wpa_s->wpa, peer);
780}
781
782
783static int wpa_supplicant_ctrl_iface_tdls_link_status(
784	struct wpa_supplicant *wpa_s, const char *addr,
785	char *buf, size_t buflen)
786{
787	u8 peer[ETH_ALEN];
788	const char *tdls_status;
789	int ret;
790
791	if (hwaddr_aton(addr, peer)) {
792		wpa_printf(MSG_DEBUG,
793			   "CTRL_IFACE TDLS_LINK_STATUS: Invalid address '%s'",
794			   addr);
795		return -1;
796	}
797	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_LINK_STATUS " MACSTR,
798		   MAC2STR(peer));
799
800	tdls_status = wpa_tdls_get_link_status(wpa_s->wpa, peer);
801	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_LINK_STATUS: %s", tdls_status);
802	ret = os_snprintf(buf, buflen, "TDLS link status: %s\n", tdls_status);
803	if (os_snprintf_error(buflen, ret))
804		return -1;
805
806	return ret;
807}
808
809#endif /* CONFIG_TDLS */
810
811
812static int wmm_ac_ctrl_addts(struct wpa_supplicant *wpa_s, char *cmd)
813{
814	char *token, *context = NULL;
815	struct wmm_ac_ts_setup_params params = {
816		.tsid = 0xff,
817		.direction = 0xff,
818	};
819
820	while ((token = str_token(cmd, " ", &context))) {
821		if (sscanf(token, "tsid=%i", &params.tsid) == 1 ||
822		    sscanf(token, "up=%i", &params.user_priority) == 1 ||
823		    sscanf(token, "nominal_msdu_size=%i",
824			   &params.nominal_msdu_size) == 1 ||
825		    sscanf(token, "mean_data_rate=%i",
826			   &params.mean_data_rate) == 1 ||
827		    sscanf(token, "min_phy_rate=%i",
828			   &params.minimum_phy_rate) == 1 ||
829		    sscanf(token, "sba=%i",
830			   &params.surplus_bandwidth_allowance) == 1)
831			continue;
832
833		if (os_strcasecmp(token, "downlink") == 0) {
834			params.direction = WMM_TSPEC_DIRECTION_DOWNLINK;
835		} else if (os_strcasecmp(token, "uplink") == 0) {
836			params.direction = WMM_TSPEC_DIRECTION_UPLINK;
837		} else if (os_strcasecmp(token, "bidi") == 0) {
838			params.direction = WMM_TSPEC_DIRECTION_BI_DIRECTIONAL;
839		} else if (os_strcasecmp(token, "fixed_nominal_msdu") == 0) {
840			params.fixed_nominal_msdu = 1;
841		} else {
842			wpa_printf(MSG_DEBUG,
843				   "CTRL: Invalid WMM_AC_ADDTS parameter: '%s'",
844				   token);
845			return -1;
846		}
847
848	}
849
850	return wpas_wmm_ac_addts(wpa_s, &params);
851}
852
853
854static int wmm_ac_ctrl_delts(struct wpa_supplicant *wpa_s, char *cmd)
855{
856	u8 tsid = atoi(cmd);
857
858	return wpas_wmm_ac_delts(wpa_s, tsid);
859}
860
861
862#ifdef CONFIG_IEEE80211R
863static int wpa_supplicant_ctrl_iface_ft_ds(
864	struct wpa_supplicant *wpa_s, char *addr)
865{
866	u8 target_ap[ETH_ALEN];
867	struct wpa_bss *bss;
868	const u8 *mdie;
869
870	if (hwaddr_aton(addr, target_ap)) {
871		wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS: invalid "
872			   "address '%s'", addr);
873		return -1;
874	}
875
876	wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS " MACSTR, MAC2STR(target_ap));
877
878	bss = wpa_bss_get_bssid(wpa_s, target_ap);
879	if (bss)
880		mdie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
881	else
882		mdie = NULL;
883
884	return wpa_ft_start_over_ds(wpa_s->wpa, target_ap, mdie);
885}
886#endif /* CONFIG_IEEE80211R */
887
888
889#ifdef CONFIG_WPS
890static int wpa_supplicant_ctrl_iface_wps_pbc(struct wpa_supplicant *wpa_s,
891					     char *cmd)
892{
893	u8 bssid[ETH_ALEN], *_bssid = bssid;
894#ifdef CONFIG_P2P
895	u8 p2p_dev_addr[ETH_ALEN];
896#endif /* CONFIG_P2P */
897#ifdef CONFIG_AP
898	u8 *_p2p_dev_addr = NULL;
899#endif /* CONFIG_AP */
900
901	if (cmd == NULL || os_strcmp(cmd, "any") == 0) {
902		_bssid = NULL;
903#ifdef CONFIG_P2P
904	} else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
905		if (hwaddr_aton(cmd + 13, p2p_dev_addr)) {
906			wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid "
907				   "P2P Device Address '%s'",
908				   cmd + 13);
909			return -1;
910		}
911		_p2p_dev_addr = p2p_dev_addr;
912#endif /* CONFIG_P2P */
913	} else if (hwaddr_aton(cmd, bssid)) {
914		wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid BSSID '%s'",
915			   cmd);
916		return -1;
917	}
918
919#ifdef CONFIG_AP
920	if (wpa_s->ap_iface)
921		return wpa_supplicant_ap_wps_pbc(wpa_s, _bssid, _p2p_dev_addr);
922#endif /* CONFIG_AP */
923
924	return wpas_wps_start_pbc(wpa_s, _bssid, 0);
925}
926
927
928static int wpa_supplicant_ctrl_iface_wps_pin(struct wpa_supplicant *wpa_s,
929					     char *cmd, char *buf,
930					     size_t buflen)
931{
932	u8 bssid[ETH_ALEN], *_bssid = bssid;
933	char *pin;
934	int ret;
935
936	pin = os_strchr(cmd, ' ');
937	if (pin)
938		*pin++ = '\0';
939
940	if (os_strcmp(cmd, "any") == 0)
941		_bssid = NULL;
942	else if (os_strcmp(cmd, "get") == 0) {
943		ret = wps_generate_pin();
944		goto done;
945	} else if (hwaddr_aton(cmd, bssid)) {
946		wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PIN: invalid BSSID '%s'",
947			   cmd);
948		return -1;
949	}
950
951#ifdef CONFIG_AP
952	if (wpa_s->ap_iface) {
953		int timeout = 0;
954		char *pos;
955
956		if (pin) {
957			pos = os_strchr(pin, ' ');
958			if (pos) {
959				*pos++ = '\0';
960				timeout = atoi(pos);
961			}
962		}
963
964		return wpa_supplicant_ap_wps_pin(wpa_s, _bssid, pin,
965						 buf, buflen, timeout);
966	}
967#endif /* CONFIG_AP */
968
969	if (pin) {
970		ret = wpas_wps_start_pin(wpa_s, _bssid, pin, 0,
971					 DEV_PW_DEFAULT);
972		if (ret < 0)
973			return -1;
974		ret = os_snprintf(buf, buflen, "%s", pin);
975		if (os_snprintf_error(buflen, ret))
976			return -1;
977		return ret;
978	}
979
980	ret = wpas_wps_start_pin(wpa_s, _bssid, NULL, 0, DEV_PW_DEFAULT);
981	if (ret < 0)
982		return -1;
983
984done:
985	/* Return the generated PIN */
986	ret = os_snprintf(buf, buflen, "%08d", ret);
987	if (os_snprintf_error(buflen, ret))
988		return -1;
989	return ret;
990}
991
992
993static int wpa_supplicant_ctrl_iface_wps_check_pin(
994	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
995{
996	char pin[9];
997	size_t len;
998	char *pos;
999	int ret;
1000
1001	wpa_hexdump_ascii_key(MSG_DEBUG, "WPS_CHECK_PIN",
1002			      (u8 *) cmd, os_strlen(cmd));
1003	for (pos = cmd, len = 0; *pos != '\0'; pos++) {
1004		if (*pos < '0' || *pos > '9')
1005			continue;
1006		pin[len++] = *pos;
1007		if (len == 9) {
1008			wpa_printf(MSG_DEBUG, "WPS: Too long PIN");
1009			return -1;
1010		}
1011	}
1012	if (len != 4 && len != 8) {
1013		wpa_printf(MSG_DEBUG, "WPS: Invalid PIN length %d", (int) len);
1014		return -1;
1015	}
1016	pin[len] = '\0';
1017
1018	if (len == 8) {
1019		unsigned int pin_val;
1020		pin_val = atoi(pin);
1021		if (!wps_pin_valid(pin_val)) {
1022			wpa_printf(MSG_DEBUG, "WPS: Invalid checksum digit");
1023			ret = os_snprintf(buf, buflen, "FAIL-CHECKSUM\n");
1024			if (os_snprintf_error(buflen, ret))
1025				return -1;
1026			return ret;
1027		}
1028	}
1029
1030	ret = os_snprintf(buf, buflen, "%s", pin);
1031	if (os_snprintf_error(buflen, ret))
1032		return -1;
1033
1034	return ret;
1035}
1036
1037
1038#ifdef CONFIG_WPS_NFC
1039
1040static int wpa_supplicant_ctrl_iface_wps_nfc(struct wpa_supplicant *wpa_s,
1041					     char *cmd)
1042{
1043	u8 bssid[ETH_ALEN], *_bssid = bssid;
1044
1045	if (cmd == NULL || cmd[0] == '\0')
1046		_bssid = NULL;
1047	else if (hwaddr_aton(cmd, bssid))
1048		return -1;
1049
1050	return wpas_wps_start_nfc(wpa_s, NULL, _bssid, NULL, 0, 0, NULL, NULL,
1051				  0, 0);
1052}
1053
1054
1055static int wpa_supplicant_ctrl_iface_wps_nfc_config_token(
1056	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1057{
1058	int ndef;
1059	struct wpabuf *buf;
1060	int res;
1061	char *pos;
1062
1063	pos = os_strchr(cmd, ' ');
1064	if (pos)
1065		*pos++ = '\0';
1066	if (os_strcmp(cmd, "WPS") == 0)
1067		ndef = 0;
1068	else if (os_strcmp(cmd, "NDEF") == 0)
1069		ndef = 1;
1070	else
1071		return -1;
1072
1073	buf = wpas_wps_nfc_config_token(wpa_s, ndef, pos);
1074	if (buf == NULL)
1075		return -1;
1076
1077	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1078					 wpabuf_len(buf));
1079	reply[res++] = '\n';
1080	reply[res] = '\0';
1081
1082	wpabuf_free(buf);
1083
1084	return res;
1085}
1086
1087
1088static int wpa_supplicant_ctrl_iface_wps_nfc_token(
1089	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1090{
1091	int ndef;
1092	struct wpabuf *buf;
1093	int res;
1094
1095	if (os_strcmp(cmd, "WPS") == 0)
1096		ndef = 0;
1097	else if (os_strcmp(cmd, "NDEF") == 0)
1098		ndef = 1;
1099	else
1100		return -1;
1101
1102	buf = wpas_wps_nfc_token(wpa_s, ndef);
1103	if (buf == NULL)
1104		return -1;
1105
1106	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1107					 wpabuf_len(buf));
1108	reply[res++] = '\n';
1109	reply[res] = '\0';
1110
1111	wpabuf_free(buf);
1112
1113	return res;
1114}
1115
1116
1117static int wpa_supplicant_ctrl_iface_wps_nfc_tag_read(
1118	struct wpa_supplicant *wpa_s, char *pos)
1119{
1120	size_t len;
1121	struct wpabuf *buf;
1122	int ret;
1123	char *freq;
1124	int forced_freq = 0;
1125
1126	freq = strstr(pos, " freq=");
1127	if (freq) {
1128		*freq = '\0';
1129		freq += 6;
1130		forced_freq = atoi(freq);
1131	}
1132
1133	len = os_strlen(pos);
1134	if (len & 0x01)
1135		return -1;
1136	len /= 2;
1137
1138	buf = wpabuf_alloc(len);
1139	if (buf == NULL)
1140		return -1;
1141	if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
1142		wpabuf_free(buf);
1143		return -1;
1144	}
1145
1146	ret = wpas_wps_nfc_tag_read(wpa_s, buf, forced_freq);
1147	wpabuf_free(buf);
1148
1149	return ret;
1150}
1151
1152
1153static int wpas_ctrl_nfc_get_handover_req_wps(struct wpa_supplicant *wpa_s,
1154					      char *reply, size_t max_len,
1155					      int ndef)
1156{
1157	struct wpabuf *buf;
1158	int res;
1159
1160	buf = wpas_wps_nfc_handover_req(wpa_s, ndef);
1161	if (buf == NULL)
1162		return -1;
1163
1164	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1165					 wpabuf_len(buf));
1166	reply[res++] = '\n';
1167	reply[res] = '\0';
1168
1169	wpabuf_free(buf);
1170
1171	return res;
1172}
1173
1174
1175#ifdef CONFIG_P2P
1176static int wpas_ctrl_nfc_get_handover_req_p2p(struct wpa_supplicant *wpa_s,
1177					      char *reply, size_t max_len,
1178					      int ndef)
1179{
1180	struct wpabuf *buf;
1181	int res;
1182
1183	buf = wpas_p2p_nfc_handover_req(wpa_s, ndef);
1184	if (buf == NULL) {
1185		wpa_printf(MSG_DEBUG, "P2P: Could not generate NFC handover request");
1186		return -1;
1187	}
1188
1189	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1190					 wpabuf_len(buf));
1191	reply[res++] = '\n';
1192	reply[res] = '\0';
1193
1194	wpabuf_free(buf);
1195
1196	return res;
1197}
1198#endif /* CONFIG_P2P */
1199
1200
1201static int wpas_ctrl_nfc_get_handover_req(struct wpa_supplicant *wpa_s,
1202					  char *cmd, char *reply,
1203					  size_t max_len)
1204{
1205	char *pos;
1206	int ndef;
1207
1208	pos = os_strchr(cmd, ' ');
1209	if (pos == NULL)
1210		return -1;
1211	*pos++ = '\0';
1212
1213	if (os_strcmp(cmd, "WPS") == 0)
1214		ndef = 0;
1215	else if (os_strcmp(cmd, "NDEF") == 0)
1216		ndef = 1;
1217	else
1218		return -1;
1219
1220	if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1221		if (!ndef)
1222			return -1;
1223		return wpas_ctrl_nfc_get_handover_req_wps(
1224			wpa_s, reply, max_len, ndef);
1225	}
1226
1227#ifdef CONFIG_P2P
1228	if (os_strcmp(pos, "P2P-CR") == 0) {
1229		return wpas_ctrl_nfc_get_handover_req_p2p(
1230			wpa_s, reply, max_len, ndef);
1231	}
1232#endif /* CONFIG_P2P */
1233
1234	return -1;
1235}
1236
1237
1238static int wpas_ctrl_nfc_get_handover_sel_wps(struct wpa_supplicant *wpa_s,
1239					      char *reply, size_t max_len,
1240					      int ndef, int cr, char *uuid)
1241{
1242	struct wpabuf *buf;
1243	int res;
1244
1245	buf = wpas_wps_nfc_handover_sel(wpa_s, ndef, cr, uuid);
1246	if (buf == NULL)
1247		return -1;
1248
1249	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1250					 wpabuf_len(buf));
1251	reply[res++] = '\n';
1252	reply[res] = '\0';
1253
1254	wpabuf_free(buf);
1255
1256	return res;
1257}
1258
1259
1260#ifdef CONFIG_P2P
1261static int wpas_ctrl_nfc_get_handover_sel_p2p(struct wpa_supplicant *wpa_s,
1262					      char *reply, size_t max_len,
1263					      int ndef, int tag)
1264{
1265	struct wpabuf *buf;
1266	int res;
1267
1268	buf = wpas_p2p_nfc_handover_sel(wpa_s, ndef, tag);
1269	if (buf == NULL)
1270		return -1;
1271
1272	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1273					 wpabuf_len(buf));
1274	reply[res++] = '\n';
1275	reply[res] = '\0';
1276
1277	wpabuf_free(buf);
1278
1279	return res;
1280}
1281#endif /* CONFIG_P2P */
1282
1283
1284static int wpas_ctrl_nfc_get_handover_sel(struct wpa_supplicant *wpa_s,
1285					  char *cmd, char *reply,
1286					  size_t max_len)
1287{
1288	char *pos, *pos2;
1289	int ndef;
1290
1291	pos = os_strchr(cmd, ' ');
1292	if (pos == NULL)
1293		return -1;
1294	*pos++ = '\0';
1295
1296	if (os_strcmp(cmd, "WPS") == 0)
1297		ndef = 0;
1298	else if (os_strcmp(cmd, "NDEF") == 0)
1299		ndef = 1;
1300	else
1301		return -1;
1302
1303	pos2 = os_strchr(pos, ' ');
1304	if (pos2)
1305		*pos2++ = '\0';
1306	if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1307		if (!ndef)
1308			return -1;
1309		return wpas_ctrl_nfc_get_handover_sel_wps(
1310			wpa_s, reply, max_len, ndef,
1311			os_strcmp(pos, "WPS-CR") == 0, pos2);
1312	}
1313
1314#ifdef CONFIG_P2P
1315	if (os_strcmp(pos, "P2P-CR") == 0) {
1316		return wpas_ctrl_nfc_get_handover_sel_p2p(
1317			wpa_s, reply, max_len, ndef, 0);
1318	}
1319
1320	if (os_strcmp(pos, "P2P-CR-TAG") == 0) {
1321		return wpas_ctrl_nfc_get_handover_sel_p2p(
1322			wpa_s, reply, max_len, ndef, 1);
1323	}
1324#endif /* CONFIG_P2P */
1325
1326	return -1;
1327}
1328
1329
1330static int wpas_ctrl_nfc_report_handover(struct wpa_supplicant *wpa_s,
1331					 char *cmd)
1332{
1333	size_t len;
1334	struct wpabuf *req, *sel;
1335	int ret;
1336	char *pos, *role, *type, *pos2;
1337#ifdef CONFIG_P2P
1338	char *freq;
1339	int forced_freq = 0;
1340
1341	freq = strstr(cmd, " freq=");
1342	if (freq) {
1343		*freq = '\0';
1344		freq += 6;
1345		forced_freq = atoi(freq);
1346	}
1347#endif /* CONFIG_P2P */
1348
1349	role = cmd;
1350	pos = os_strchr(role, ' ');
1351	if (pos == NULL) {
1352		wpa_printf(MSG_DEBUG, "NFC: Missing type in handover report");
1353		return -1;
1354	}
1355	*pos++ = '\0';
1356
1357	type = pos;
1358	pos = os_strchr(type, ' ');
1359	if (pos == NULL) {
1360		wpa_printf(MSG_DEBUG, "NFC: Missing request message in handover report");
1361		return -1;
1362	}
1363	*pos++ = '\0';
1364
1365	pos2 = os_strchr(pos, ' ');
1366	if (pos2 == NULL) {
1367		wpa_printf(MSG_DEBUG, "NFC: Missing select message in handover report");
1368		return -1;
1369	}
1370	*pos2++ = '\0';
1371
1372	len = os_strlen(pos);
1373	if (len & 0x01) {
1374		wpa_printf(MSG_DEBUG, "NFC: Invalid request message length in handover report");
1375		return -1;
1376	}
1377	len /= 2;
1378
1379	req = wpabuf_alloc(len);
1380	if (req == NULL) {
1381		wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for request message");
1382		return -1;
1383	}
1384	if (hexstr2bin(pos, wpabuf_put(req, len), len) < 0) {
1385		wpa_printf(MSG_DEBUG, "NFC: Invalid request message hexdump in handover report");
1386		wpabuf_free(req);
1387		return -1;
1388	}
1389
1390	len = os_strlen(pos2);
1391	if (len & 0x01) {
1392		wpa_printf(MSG_DEBUG, "NFC: Invalid select message length in handover report");
1393		wpabuf_free(req);
1394		return -1;
1395	}
1396	len /= 2;
1397
1398	sel = wpabuf_alloc(len);
1399	if (sel == NULL) {
1400		wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for select message");
1401		wpabuf_free(req);
1402		return -1;
1403	}
1404	if (hexstr2bin(pos2, wpabuf_put(sel, len), len) < 0) {
1405		wpa_printf(MSG_DEBUG, "NFC: Invalid select message hexdump in handover report");
1406		wpabuf_free(req);
1407		wpabuf_free(sel);
1408		return -1;
1409	}
1410
1411	wpa_printf(MSG_DEBUG, "NFC: Connection handover reported - role=%s type=%s req_len=%d sel_len=%d",
1412		   role, type, (int) wpabuf_len(req), (int) wpabuf_len(sel));
1413
1414	if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "WPS") == 0) {
1415		ret = wpas_wps_nfc_report_handover(wpa_s, req, sel);
1416#ifdef CONFIG_AP
1417	} else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "WPS") == 0)
1418	{
1419		ret = wpas_ap_wps_nfc_report_handover(wpa_s, req, sel);
1420		if (ret < 0)
1421			ret = wpas_er_wps_nfc_report_handover(wpa_s, req, sel);
1422#endif /* CONFIG_AP */
1423#ifdef CONFIG_P2P
1424	} else if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "P2P") == 0)
1425	{
1426		ret = wpas_p2p_nfc_report_handover(wpa_s, 1, req, sel, 0);
1427	} else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "P2P") == 0)
1428	{
1429		ret = wpas_p2p_nfc_report_handover(wpa_s, 0, req, sel,
1430						   forced_freq);
1431#endif /* CONFIG_P2P */
1432	} else {
1433		wpa_printf(MSG_DEBUG, "NFC: Unsupported connection handover "
1434			   "reported: role=%s type=%s", role, type);
1435		ret = -1;
1436	}
1437	wpabuf_free(req);
1438	wpabuf_free(sel);
1439
1440	if (ret)
1441		wpa_printf(MSG_DEBUG, "NFC: Failed to process reported handover messages");
1442
1443	return ret;
1444}
1445
1446#endif /* CONFIG_WPS_NFC */
1447
1448
1449static int wpa_supplicant_ctrl_iface_wps_reg(struct wpa_supplicant *wpa_s,
1450					     char *cmd)
1451{
1452	u8 bssid[ETH_ALEN];
1453	char *pin;
1454	char *new_ssid;
1455	char *new_auth;
1456	char *new_encr;
1457	char *new_key;
1458	struct wps_new_ap_settings ap;
1459
1460	pin = os_strchr(cmd, ' ');
1461	if (pin == NULL)
1462		return -1;
1463	*pin++ = '\0';
1464
1465	if (hwaddr_aton(cmd, bssid)) {
1466		wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_REG: invalid BSSID '%s'",
1467			   cmd);
1468		return -1;
1469	}
1470
1471	new_ssid = os_strchr(pin, ' ');
1472	if (new_ssid == NULL)
1473		return wpas_wps_start_reg(wpa_s, bssid, pin, NULL);
1474	*new_ssid++ = '\0';
1475
1476	new_auth = os_strchr(new_ssid, ' ');
1477	if (new_auth == NULL)
1478		return -1;
1479	*new_auth++ = '\0';
1480
1481	new_encr = os_strchr(new_auth, ' ');
1482	if (new_encr == NULL)
1483		return -1;
1484	*new_encr++ = '\0';
1485
1486	new_key = os_strchr(new_encr, ' ');
1487	if (new_key == NULL)
1488		return -1;
1489	*new_key++ = '\0';
1490
1491	os_memset(&ap, 0, sizeof(ap));
1492	ap.ssid_hex = new_ssid;
1493	ap.auth = new_auth;
1494	ap.encr = new_encr;
1495	ap.key_hex = new_key;
1496	return wpas_wps_start_reg(wpa_s, bssid, pin, &ap);
1497}
1498
1499
1500#ifdef CONFIG_AP
1501static int wpa_supplicant_ctrl_iface_wps_ap_pin(struct wpa_supplicant *wpa_s,
1502						char *cmd, char *buf,
1503						size_t buflen)
1504{
1505	int timeout = 300;
1506	char *pos;
1507	const char *pin_txt;
1508
1509	if (!wpa_s->ap_iface)
1510		return -1;
1511
1512	pos = os_strchr(cmd, ' ');
1513	if (pos)
1514		*pos++ = '\0';
1515
1516	if (os_strcmp(cmd, "disable") == 0) {
1517		wpas_wps_ap_pin_disable(wpa_s);
1518		return os_snprintf(buf, buflen, "OK\n");
1519	}
1520
1521	if (os_strcmp(cmd, "random") == 0) {
1522		if (pos)
1523			timeout = atoi(pos);
1524		pin_txt = wpas_wps_ap_pin_random(wpa_s, timeout);
1525		if (pin_txt == NULL)
1526			return -1;
1527		return os_snprintf(buf, buflen, "%s", pin_txt);
1528	}
1529
1530	if (os_strcmp(cmd, "get") == 0) {
1531		pin_txt = wpas_wps_ap_pin_get(wpa_s);
1532		if (pin_txt == NULL)
1533			return -1;
1534		return os_snprintf(buf, buflen, "%s", pin_txt);
1535	}
1536
1537	if (os_strcmp(cmd, "set") == 0) {
1538		char *pin;
1539		if (pos == NULL)
1540			return -1;
1541		pin = pos;
1542		pos = os_strchr(pos, ' ');
1543		if (pos) {
1544			*pos++ = '\0';
1545			timeout = atoi(pos);
1546		}
1547		if (os_strlen(pin) > buflen)
1548			return -1;
1549		if (wpas_wps_ap_pin_set(wpa_s, pin, timeout) < 0)
1550			return -1;
1551		return os_snprintf(buf, buflen, "%s", pin);
1552	}
1553
1554	return -1;
1555}
1556#endif /* CONFIG_AP */
1557
1558
1559#ifdef CONFIG_WPS_ER
1560static int wpa_supplicant_ctrl_iface_wps_er_pin(struct wpa_supplicant *wpa_s,
1561						char *cmd)
1562{
1563	char *uuid = cmd, *pin, *pos;
1564	u8 addr_buf[ETH_ALEN], *addr = NULL;
1565	pin = os_strchr(uuid, ' ');
1566	if (pin == NULL)
1567		return -1;
1568	*pin++ = '\0';
1569	pos = os_strchr(pin, ' ');
1570	if (pos) {
1571		*pos++ = '\0';
1572		if (hwaddr_aton(pos, addr_buf) == 0)
1573			addr = addr_buf;
1574	}
1575	return wpas_wps_er_add_pin(wpa_s, addr, uuid, pin);
1576}
1577
1578
1579static int wpa_supplicant_ctrl_iface_wps_er_learn(struct wpa_supplicant *wpa_s,
1580						  char *cmd)
1581{
1582	char *uuid = cmd, *pin;
1583	pin = os_strchr(uuid, ' ');
1584	if (pin == NULL)
1585		return -1;
1586	*pin++ = '\0';
1587	return wpas_wps_er_learn(wpa_s, uuid, pin);
1588}
1589
1590
1591static int wpa_supplicant_ctrl_iface_wps_er_set_config(
1592	struct wpa_supplicant *wpa_s, char *cmd)
1593{
1594	char *uuid = cmd, *id;
1595	id = os_strchr(uuid, ' ');
1596	if (id == NULL)
1597		return -1;
1598	*id++ = '\0';
1599	return wpas_wps_er_set_config(wpa_s, uuid, atoi(id));
1600}
1601
1602
1603static int wpa_supplicant_ctrl_iface_wps_er_config(
1604	struct wpa_supplicant *wpa_s, char *cmd)
1605{
1606	char *pin;
1607	char *new_ssid;
1608	char *new_auth;
1609	char *new_encr;
1610	char *new_key;
1611	struct wps_new_ap_settings ap;
1612
1613	pin = os_strchr(cmd, ' ');
1614	if (pin == NULL)
1615		return -1;
1616	*pin++ = '\0';
1617
1618	new_ssid = os_strchr(pin, ' ');
1619	if (new_ssid == NULL)
1620		return -1;
1621	*new_ssid++ = '\0';
1622
1623	new_auth = os_strchr(new_ssid, ' ');
1624	if (new_auth == NULL)
1625		return -1;
1626	*new_auth++ = '\0';
1627
1628	new_encr = os_strchr(new_auth, ' ');
1629	if (new_encr == NULL)
1630		return -1;
1631	*new_encr++ = '\0';
1632
1633	new_key = os_strchr(new_encr, ' ');
1634	if (new_key == NULL)
1635		return -1;
1636	*new_key++ = '\0';
1637
1638	os_memset(&ap, 0, sizeof(ap));
1639	ap.ssid_hex = new_ssid;
1640	ap.auth = new_auth;
1641	ap.encr = new_encr;
1642	ap.key_hex = new_key;
1643	return wpas_wps_er_config(wpa_s, cmd, pin, &ap);
1644}
1645
1646
1647#ifdef CONFIG_WPS_NFC
1648static int wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
1649	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1650{
1651	int ndef;
1652	struct wpabuf *buf;
1653	int res;
1654	char *uuid;
1655
1656	uuid = os_strchr(cmd, ' ');
1657	if (uuid == NULL)
1658		return -1;
1659	*uuid++ = '\0';
1660
1661	if (os_strcmp(cmd, "WPS") == 0)
1662		ndef = 0;
1663	else if (os_strcmp(cmd, "NDEF") == 0)
1664		ndef = 1;
1665	else
1666		return -1;
1667
1668	buf = wpas_wps_er_nfc_config_token(wpa_s, ndef, uuid);
1669	if (buf == NULL)
1670		return -1;
1671
1672	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1673					 wpabuf_len(buf));
1674	reply[res++] = '\n';
1675	reply[res] = '\0';
1676
1677	wpabuf_free(buf);
1678
1679	return res;
1680}
1681#endif /* CONFIG_WPS_NFC */
1682#endif /* CONFIG_WPS_ER */
1683
1684#endif /* CONFIG_WPS */
1685
1686
1687#ifdef CONFIG_IBSS_RSN
1688static int wpa_supplicant_ctrl_iface_ibss_rsn(
1689	struct wpa_supplicant *wpa_s, char *addr)
1690{
1691	u8 peer[ETH_ALEN];
1692
1693	if (hwaddr_aton(addr, peer)) {
1694		wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN: invalid "
1695			   "address '%s'", addr);
1696		return -1;
1697	}
1698
1699	wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN " MACSTR,
1700		   MAC2STR(peer));
1701
1702	return ibss_rsn_start(wpa_s->ibss_rsn, peer);
1703}
1704#endif /* CONFIG_IBSS_RSN */
1705
1706
1707static int wpa_supplicant_ctrl_iface_ctrl_rsp(struct wpa_supplicant *wpa_s,
1708					      char *rsp)
1709{
1710#ifdef IEEE8021X_EAPOL
1711	char *pos, *id_pos;
1712	int id;
1713	struct wpa_ssid *ssid;
1714
1715	pos = os_strchr(rsp, '-');
1716	if (pos == NULL)
1717		return -1;
1718	*pos++ = '\0';
1719	id_pos = pos;
1720	pos = os_strchr(pos, ':');
1721	if (pos == NULL)
1722		return -1;
1723	*pos++ = '\0';
1724	id = atoi(id_pos);
1725	wpa_printf(MSG_DEBUG, "CTRL_IFACE: field=%s id=%d", rsp, id);
1726	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
1727			      (u8 *) pos, os_strlen(pos));
1728
1729	ssid = wpa_config_get_network(wpa_s->conf, id);
1730	if (ssid == NULL) {
1731		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
1732			   "to update", id);
1733		return -1;
1734	}
1735
1736	return wpa_supplicant_ctrl_iface_ctrl_rsp_handle(wpa_s, ssid, rsp,
1737							 pos);
1738#else /* IEEE8021X_EAPOL */
1739	wpa_printf(MSG_DEBUG, "CTRL_IFACE: 802.1X not included");
1740	return -1;
1741#endif /* IEEE8021X_EAPOL */
1742}
1743
1744
1745static int wpa_supplicant_ctrl_iface_status(struct wpa_supplicant *wpa_s,
1746					    const char *params,
1747					    char *buf, size_t buflen)
1748{
1749	char *pos, *end, tmp[30];
1750	int res, verbose, wps, ret;
1751#ifdef CONFIG_HS20
1752	const u8 *hs20;
1753#endif /* CONFIG_HS20 */
1754	const u8 *sess_id;
1755	size_t sess_id_len;
1756
1757	if (os_strcmp(params, "-DRIVER") == 0)
1758		return wpa_drv_status(wpa_s, buf, buflen);
1759	verbose = os_strcmp(params, "-VERBOSE") == 0;
1760	wps = os_strcmp(params, "-WPS") == 0;
1761	pos = buf;
1762	end = buf + buflen;
1763	if (wpa_s->wpa_state >= WPA_ASSOCIATED) {
1764		struct wpa_ssid *ssid = wpa_s->current_ssid;
1765		ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
1766				  MAC2STR(wpa_s->bssid));
1767		if (os_snprintf_error(end - pos, ret))
1768			return pos - buf;
1769		pos += ret;
1770		ret = os_snprintf(pos, end - pos, "freq=%u\n",
1771				  wpa_s->assoc_freq);
1772		if (os_snprintf_error(end - pos, ret))
1773			return pos - buf;
1774		pos += ret;
1775		if (ssid) {
1776			u8 *_ssid = ssid->ssid;
1777			size_t ssid_len = ssid->ssid_len;
1778			u8 ssid_buf[SSID_MAX_LEN];
1779			if (ssid_len == 0) {
1780				int _res = wpa_drv_get_ssid(wpa_s, ssid_buf);
1781				if (_res < 0)
1782					ssid_len = 0;
1783				else
1784					ssid_len = _res;
1785				_ssid = ssid_buf;
1786			}
1787			ret = os_snprintf(pos, end - pos, "ssid=%s\nid=%d\n",
1788					  wpa_ssid_txt(_ssid, ssid_len),
1789					  ssid->id);
1790			if (os_snprintf_error(end - pos, ret))
1791				return pos - buf;
1792			pos += ret;
1793
1794			if (wps && ssid->passphrase &&
1795			    wpa_key_mgmt_wpa_psk(ssid->key_mgmt) &&
1796			    (ssid->mode == WPAS_MODE_AP ||
1797			     ssid->mode == WPAS_MODE_P2P_GO)) {
1798				ret = os_snprintf(pos, end - pos,
1799						  "passphrase=%s\n",
1800						  ssid->passphrase);
1801				if (os_snprintf_error(end - pos, ret))
1802					return pos - buf;
1803				pos += ret;
1804			}
1805			if (ssid->id_str) {
1806				ret = os_snprintf(pos, end - pos,
1807						  "id_str=%s\n",
1808						  ssid->id_str);
1809				if (os_snprintf_error(end - pos, ret))
1810					return pos - buf;
1811				pos += ret;
1812			}
1813
1814			switch (ssid->mode) {
1815			case WPAS_MODE_INFRA:
1816				ret = os_snprintf(pos, end - pos,
1817						  "mode=station\n");
1818				break;
1819			case WPAS_MODE_IBSS:
1820				ret = os_snprintf(pos, end - pos,
1821						  "mode=IBSS\n");
1822				break;
1823			case WPAS_MODE_AP:
1824				ret = os_snprintf(pos, end - pos,
1825						  "mode=AP\n");
1826				break;
1827			case WPAS_MODE_P2P_GO:
1828				ret = os_snprintf(pos, end - pos,
1829						  "mode=P2P GO\n");
1830				break;
1831			case WPAS_MODE_P2P_GROUP_FORMATION:
1832				ret = os_snprintf(pos, end - pos,
1833						  "mode=P2P GO - group "
1834						  "formation\n");
1835				break;
1836			default:
1837				ret = 0;
1838				break;
1839			}
1840			if (os_snprintf_error(end - pos, ret))
1841				return pos - buf;
1842			pos += ret;
1843		}
1844
1845#ifdef CONFIG_AP
1846		if (wpa_s->ap_iface) {
1847			pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
1848							    end - pos,
1849							    verbose);
1850		} else
1851#endif /* CONFIG_AP */
1852		pos += wpa_sm_get_status(wpa_s->wpa, pos, end - pos, verbose);
1853	}
1854#ifdef CONFIG_SAE
1855	if (wpa_s->wpa_state >= WPA_ASSOCIATED &&
1856#ifdef CONFIG_AP
1857	    !wpa_s->ap_iface &&
1858#endif /* CONFIG_AP */
1859	    wpa_s->sme.sae.state == SAE_ACCEPTED) {
1860		ret = os_snprintf(pos, end - pos, "sae_group=%d\n",
1861				  wpa_s->sme.sae.group);
1862		if (os_snprintf_error(end - pos, ret))
1863			return pos - buf;
1864		pos += ret;
1865	}
1866#endif /* CONFIG_SAE */
1867	ret = os_snprintf(pos, end - pos, "wpa_state=%s\n",
1868			  wpa_supplicant_state_txt(wpa_s->wpa_state));
1869	if (os_snprintf_error(end - pos, ret))
1870		return pos - buf;
1871	pos += ret;
1872
1873	if (wpa_s->l2 &&
1874	    l2_packet_get_ip_addr(wpa_s->l2, tmp, sizeof(tmp)) >= 0) {
1875		ret = os_snprintf(pos, end - pos, "ip_address=%s\n", tmp);
1876		if (os_snprintf_error(end - pos, ret))
1877			return pos - buf;
1878		pos += ret;
1879	}
1880
1881#ifdef CONFIG_P2P
1882	if (wpa_s->global->p2p) {
1883		ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
1884				  "\n", MAC2STR(wpa_s->global->p2p_dev_addr));
1885		if (os_snprintf_error(end - pos, ret))
1886			return pos - buf;
1887		pos += ret;
1888	}
1889#endif /* CONFIG_P2P */
1890
1891	ret = os_snprintf(pos, end - pos, "address=" MACSTR "\n",
1892			  MAC2STR(wpa_s->own_addr));
1893	if (os_snprintf_error(end - pos, ret))
1894		return pos - buf;
1895	pos += ret;
1896
1897#ifdef CONFIG_HS20
1898	if (wpa_s->current_bss &&
1899	    (hs20 = wpa_bss_get_vendor_ie(wpa_s->current_bss,
1900					  HS20_IE_VENDOR_TYPE)) &&
1901	    wpa_s->wpa_proto == WPA_PROTO_RSN &&
1902	    wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
1903		int release = 1;
1904		if (hs20[1] >= 5) {
1905			u8 rel_num = (hs20[6] & 0xf0) >> 4;
1906			release = rel_num + 1;
1907		}
1908		ret = os_snprintf(pos, end - pos, "hs20=%d\n", release);
1909		if (os_snprintf_error(end - pos, ret))
1910			return pos - buf;
1911		pos += ret;
1912	}
1913
1914	if (wpa_s->current_ssid) {
1915		struct wpa_cred *cred;
1916		char *type;
1917
1918		for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1919			size_t i;
1920
1921			if (wpa_s->current_ssid->parent_cred != cred)
1922				continue;
1923
1924			if (cred->provisioning_sp) {
1925				ret = os_snprintf(pos, end - pos,
1926						  "provisioning_sp=%s\n",
1927						  cred->provisioning_sp);
1928				if (os_snprintf_error(end - pos, ret))
1929					return pos - buf;
1930				pos += ret;
1931			}
1932
1933			if (!cred->domain)
1934				goto no_domain;
1935
1936			i = 0;
1937			if (wpa_s->current_bss && wpa_s->current_bss->anqp) {
1938				struct wpabuf *names =
1939					wpa_s->current_bss->anqp->domain_name;
1940				for (i = 0; names && i < cred->num_domain; i++)
1941				{
1942					if (domain_name_list_contains(
1943						    names, cred->domain[i], 1))
1944						break;
1945				}
1946				if (i == cred->num_domain)
1947					i = 0; /* show first entry by default */
1948			}
1949			ret = os_snprintf(pos, end - pos, "home_sp=%s\n",
1950					  cred->domain[i]);
1951			if (os_snprintf_error(end - pos, ret))
1952				return pos - buf;
1953			pos += ret;
1954
1955		no_domain:
1956			if (wpa_s->current_bss == NULL ||
1957			    wpa_s->current_bss->anqp == NULL)
1958				res = -1;
1959			else
1960				res = interworking_home_sp_cred(
1961					wpa_s, cred,
1962					wpa_s->current_bss->anqp->domain_name);
1963			if (res > 0)
1964				type = "home";
1965			else if (res == 0)
1966				type = "roaming";
1967			else
1968				type = "unknown";
1969
1970			ret = os_snprintf(pos, end - pos, "sp_type=%s\n", type);
1971			if (os_snprintf_error(end - pos, ret))
1972				return pos - buf;
1973			pos += ret;
1974
1975			break;
1976		}
1977	}
1978#endif /* CONFIG_HS20 */
1979
1980	if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
1981	    wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1982		res = eapol_sm_get_status(wpa_s->eapol, pos, end - pos,
1983					  verbose);
1984		if (res >= 0)
1985			pos += res;
1986	}
1987
1988	sess_id = eapol_sm_get_session_id(wpa_s->eapol, &sess_id_len);
1989	if (sess_id) {
1990		char *start = pos;
1991
1992		ret = os_snprintf(pos, end - pos, "eap_session_id=");
1993		if (os_snprintf_error(end - pos, ret))
1994			return start - buf;
1995		pos += ret;
1996		ret = wpa_snprintf_hex(pos, end - pos, sess_id, sess_id_len);
1997		if (ret <= 0)
1998			return start - buf;
1999		pos += ret;
2000		ret = os_snprintf(pos, end - pos, "\n");
2001		if (os_snprintf_error(end - pos, ret))
2002			return start - buf;
2003		pos += ret;
2004	}
2005
2006	res = rsn_preauth_get_status(wpa_s->wpa, pos, end - pos, verbose);
2007	if (res >= 0)
2008		pos += res;
2009
2010#ifdef CONFIG_WPS
2011	{
2012		char uuid_str[100];
2013		uuid_bin2str(wpa_s->wps->uuid, uuid_str, sizeof(uuid_str));
2014		ret = os_snprintf(pos, end - pos, "uuid=%s\n", uuid_str);
2015		if (os_snprintf_error(end - pos, ret))
2016			return pos - buf;
2017		pos += ret;
2018	}
2019#endif /* CONFIG_WPS */
2020
2021#ifdef ANDROID
2022	/*
2023	 * Allow using the STATUS command with default behavior, say for debug,
2024	 * i.e., don't generate a "fake" CONNECTION and SUPPLICANT_STATE_CHANGE
2025	 * events with STATUS-NO_EVENTS.
2026	 */
2027	if (os_strcmp(params, "-NO_EVENTS")) {
2028		wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_STATE_CHANGE
2029			     "id=%d state=%d BSSID=" MACSTR " SSID=%s",
2030			     wpa_s->current_ssid ? wpa_s->current_ssid->id : -1,
2031			     wpa_s->wpa_state,
2032			     MAC2STR(wpa_s->bssid),
2033			     wpa_s->current_ssid && wpa_s->current_ssid->ssid ?
2034			     wpa_ssid_txt(wpa_s->current_ssid->ssid,
2035					  wpa_s->current_ssid->ssid_len) : "");
2036		if (wpa_s->wpa_state == WPA_COMPLETED) {
2037			struct wpa_ssid *ssid = wpa_s->current_ssid;
2038			wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED
2039				     "- connection to " MACSTR
2040				     " completed %s [id=%d id_str=%s]",
2041				     MAC2STR(wpa_s->bssid), "(auth)",
2042				     ssid ? ssid->id : -1,
2043				     ssid && ssid->id_str ? ssid->id_str : "");
2044		}
2045	}
2046#endif /* ANDROID */
2047
2048	return pos - buf;
2049}
2050
2051
2052static int wpa_supplicant_ctrl_iface_bssid(struct wpa_supplicant *wpa_s,
2053					   char *cmd)
2054{
2055	char *pos;
2056	int id;
2057	struct wpa_ssid *ssid;
2058	u8 bssid[ETH_ALEN];
2059
2060	/* cmd: "<network id> <BSSID>" */
2061	pos = os_strchr(cmd, ' ');
2062	if (pos == NULL)
2063		return -1;
2064	*pos++ = '\0';
2065	id = atoi(cmd);
2066	wpa_printf(MSG_DEBUG, "CTRL_IFACE: id=%d bssid='%s'", id, pos);
2067	if (hwaddr_aton(pos, bssid)) {
2068		wpa_printf(MSG_DEBUG ,"CTRL_IFACE: invalid BSSID '%s'", pos);
2069		return -1;
2070	}
2071
2072	ssid = wpa_config_get_network(wpa_s->conf, id);
2073	if (ssid == NULL) {
2074		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
2075			   "to update", id);
2076		return -1;
2077	}
2078
2079	os_memcpy(ssid->bssid, bssid, ETH_ALEN);
2080	ssid->bssid_set = !is_zero_ether_addr(bssid);
2081
2082	return 0;
2083}
2084
2085
2086static int wpa_supplicant_ctrl_iface_blacklist(struct wpa_supplicant *wpa_s,
2087					       char *cmd, char *buf,
2088					       size_t buflen)
2089{
2090	u8 bssid[ETH_ALEN];
2091	struct wpa_blacklist *e;
2092	char *pos, *end;
2093	int ret;
2094
2095	/* cmd: "BLACKLIST [<BSSID>]" */
2096	if (*cmd == '\0') {
2097		pos = buf;
2098		end = buf + buflen;
2099		e = wpa_s->blacklist;
2100		while (e) {
2101			ret = os_snprintf(pos, end - pos, MACSTR "\n",
2102					  MAC2STR(e->bssid));
2103			if (os_snprintf_error(end - pos, ret))
2104				return pos - buf;
2105			pos += ret;
2106			e = e->next;
2107		}
2108		return pos - buf;
2109	}
2110
2111	cmd++;
2112	if (os_strncmp(cmd, "clear", 5) == 0) {
2113		wpa_blacklist_clear(wpa_s);
2114		os_memcpy(buf, "OK\n", 3);
2115		return 3;
2116	}
2117
2118	wpa_printf(MSG_DEBUG, "CTRL_IFACE: BLACKLIST bssid='%s'", cmd);
2119	if (hwaddr_aton(cmd, bssid)) {
2120		wpa_printf(MSG_DEBUG, "CTRL_IFACE: invalid BSSID '%s'", cmd);
2121		return -1;
2122	}
2123
2124	/*
2125	 * Add the BSSID twice, so its count will be 2, causing it to be
2126	 * skipped when processing scan results.
2127	 */
2128	ret = wpa_blacklist_add(wpa_s, bssid);
2129	if (ret < 0)
2130		return -1;
2131	ret = wpa_blacklist_add(wpa_s, bssid);
2132	if (ret < 0)
2133		return -1;
2134	os_memcpy(buf, "OK\n", 3);
2135	return 3;
2136}
2137
2138
2139static int wpa_supplicant_ctrl_iface_log_level(struct wpa_supplicant *wpa_s,
2140					       char *cmd, char *buf,
2141					       size_t buflen)
2142{
2143	char *pos, *end, *stamp;
2144	int ret;
2145
2146	/* cmd: "LOG_LEVEL [<level>]" */
2147	if (*cmd == '\0') {
2148		pos = buf;
2149		end = buf + buflen;
2150		ret = os_snprintf(pos, end - pos, "Current level: %s\n"
2151				  "Timestamp: %d\n",
2152				  debug_level_str(wpa_debug_level),
2153				  wpa_debug_timestamp);
2154		if (os_snprintf_error(end - pos, ret))
2155			ret = 0;
2156
2157		return ret;
2158	}
2159
2160	while (*cmd == ' ')
2161		cmd++;
2162
2163	stamp = os_strchr(cmd, ' ');
2164	if (stamp) {
2165		*stamp++ = '\0';
2166		while (*stamp == ' ') {
2167			stamp++;
2168		}
2169	}
2170
2171	if (os_strlen(cmd)) {
2172		int level = str_to_debug_level(cmd);
2173		if (level < 0)
2174			return -1;
2175		wpa_debug_level = level;
2176	}
2177
2178	if (stamp && os_strlen(stamp))
2179		wpa_debug_timestamp = atoi(stamp);
2180
2181	os_memcpy(buf, "OK\n", 3);
2182	return 3;
2183}
2184
2185
2186static int wpa_supplicant_ctrl_iface_list_networks(
2187	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
2188{
2189	char *pos, *end, *prev;
2190	struct wpa_ssid *ssid;
2191	int ret;
2192
2193	pos = buf;
2194	end = buf + buflen;
2195	ret = os_snprintf(pos, end - pos,
2196			  "network id / ssid / bssid / flags\n");
2197	if (os_snprintf_error(end - pos, ret))
2198		return pos - buf;
2199	pos += ret;
2200
2201	ssid = wpa_s->conf->ssid;
2202
2203	/* skip over ssids until we find next one */
2204	if (cmd != NULL && os_strncmp(cmd, "LAST_ID=", 8) == 0) {
2205		int last_id = atoi(cmd + 8);
2206		if (last_id != -1) {
2207			while (ssid != NULL && ssid->id <= last_id) {
2208				ssid = ssid->next;
2209			}
2210		}
2211	}
2212
2213	while (ssid) {
2214		prev = pos;
2215		ret = os_snprintf(pos, end - pos, "%d\t%s",
2216				  ssid->id,
2217				  wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2218		if (os_snprintf_error(end - pos, ret))
2219			return prev - buf;
2220		pos += ret;
2221		if (ssid->bssid_set) {
2222			ret = os_snprintf(pos, end - pos, "\t" MACSTR,
2223					  MAC2STR(ssid->bssid));
2224		} else {
2225			ret = os_snprintf(pos, end - pos, "\tany");
2226		}
2227		if (os_snprintf_error(end - pos, ret))
2228			return prev - buf;
2229		pos += ret;
2230		ret = os_snprintf(pos, end - pos, "\t%s%s%s%s",
2231				  ssid == wpa_s->current_ssid ?
2232				  "[CURRENT]" : "",
2233				  ssid->disabled ? "[DISABLED]" : "",
2234				  ssid->disabled_until.sec ?
2235				  "[TEMP-DISABLED]" : "",
2236				  ssid->disabled == 2 ? "[P2P-PERSISTENT]" :
2237				  "");
2238		if (os_snprintf_error(end - pos, ret))
2239			return prev - buf;
2240		pos += ret;
2241		ret = os_snprintf(pos, end - pos, "\n");
2242		if (os_snprintf_error(end - pos, ret))
2243			return prev - buf;
2244		pos += ret;
2245
2246		ssid = ssid->next;
2247	}
2248
2249	return pos - buf;
2250}
2251
2252
2253static char * wpa_supplicant_cipher_txt(char *pos, char *end, int cipher)
2254{
2255	int ret;
2256	ret = os_snprintf(pos, end - pos, "-");
2257	if (os_snprintf_error(end - pos, ret))
2258		return pos;
2259	pos += ret;
2260	ret = wpa_write_ciphers(pos, end, cipher, "+");
2261	if (ret < 0)
2262		return pos;
2263	pos += ret;
2264	return pos;
2265}
2266
2267
2268static char * wpa_supplicant_ie_txt(char *pos, char *end, const char *proto,
2269				    const u8 *ie, size_t ie_len)
2270{
2271	struct wpa_ie_data data;
2272	char *start;
2273	int ret;
2274
2275	ret = os_snprintf(pos, end - pos, "[%s-", proto);
2276	if (os_snprintf_error(end - pos, ret))
2277		return pos;
2278	pos += ret;
2279
2280	if (wpa_parse_wpa_ie(ie, ie_len, &data) < 0) {
2281		ret = os_snprintf(pos, end - pos, "?]");
2282		if (os_snprintf_error(end - pos, ret))
2283			return pos;
2284		pos += ret;
2285		return pos;
2286	}
2287
2288	start = pos;
2289	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
2290		ret = os_snprintf(pos, end - pos, "%sEAP",
2291				  pos == start ? "" : "+");
2292		if (os_snprintf_error(end - pos, ret))
2293			return pos;
2294		pos += ret;
2295	}
2296	if (data.key_mgmt & WPA_KEY_MGMT_PSK) {
2297		ret = os_snprintf(pos, end - pos, "%sPSK",
2298				  pos == start ? "" : "+");
2299		if (os_snprintf_error(end - pos, ret))
2300			return pos;
2301		pos += ret;
2302	}
2303	if (data.key_mgmt & WPA_KEY_MGMT_WPA_NONE) {
2304		ret = os_snprintf(pos, end - pos, "%sNone",
2305				  pos == start ? "" : "+");
2306		if (os_snprintf_error(end - pos, ret))
2307			return pos;
2308		pos += ret;
2309	}
2310	if (data.key_mgmt & WPA_KEY_MGMT_SAE) {
2311		ret = os_snprintf(pos, end - pos, "%sSAE",
2312				  pos == start ? "" : "+");
2313		if (os_snprintf_error(end - pos, ret))
2314			return pos;
2315		pos += ret;
2316	}
2317#ifdef CONFIG_IEEE80211R
2318	if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
2319		ret = os_snprintf(pos, end - pos, "%sFT/EAP",
2320				  pos == start ? "" : "+");
2321		if (os_snprintf_error(end - pos, ret))
2322			return pos;
2323		pos += ret;
2324	}
2325	if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK) {
2326		ret = os_snprintf(pos, end - pos, "%sFT/PSK",
2327				  pos == start ? "" : "+");
2328		if (os_snprintf_error(end - pos, ret))
2329			return pos;
2330		pos += ret;
2331	}
2332	if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE) {
2333		ret = os_snprintf(pos, end - pos, "%sFT/SAE",
2334				  pos == start ? "" : "+");
2335		if (os_snprintf_error(end - pos, ret))
2336			return pos;
2337		pos += ret;
2338	}
2339#endif /* CONFIG_IEEE80211R */
2340#ifdef CONFIG_IEEE80211W
2341	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
2342		ret = os_snprintf(pos, end - pos, "%sEAP-SHA256",
2343				  pos == start ? "" : "+");
2344		if (os_snprintf_error(end - pos, ret))
2345			return pos;
2346		pos += ret;
2347	}
2348	if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
2349		ret = os_snprintf(pos, end - pos, "%sPSK-SHA256",
2350				  pos == start ? "" : "+");
2351		if (os_snprintf_error(end - pos, ret))
2352			return pos;
2353		pos += ret;
2354	}
2355#endif /* CONFIG_IEEE80211W */
2356
2357#ifdef CONFIG_SUITEB
2358	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
2359		ret = os_snprintf(pos, end - pos, "%sEAP-SUITE-B",
2360				  pos == start ? "" : "+");
2361		if (os_snprintf_error(end - pos, ret))
2362			return pos;
2363		pos += ret;
2364	}
2365#endif /* CONFIG_SUITEB */
2366
2367#ifdef CONFIG_SUITEB192
2368	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
2369		ret = os_snprintf(pos, end - pos, "%sEAP-SUITE-B-192",
2370				  pos == start ? "" : "+");
2371		if (os_snprintf_error(end - pos, ret))
2372			return pos;
2373		pos += ret;
2374	}
2375#endif /* CONFIG_SUITEB192 */
2376
2377	if (data.key_mgmt & WPA_KEY_MGMT_OSEN) {
2378		ret = os_snprintf(pos, end - pos, "%sOSEN",
2379				  pos == start ? "" : "+");
2380		if (os_snprintf_error(end - pos, ret))
2381			return pos;
2382		pos += ret;
2383	}
2384
2385	pos = wpa_supplicant_cipher_txt(pos, end, data.pairwise_cipher);
2386
2387	if (data.capabilities & WPA_CAPABILITY_PREAUTH) {
2388		ret = os_snprintf(pos, end - pos, "-preauth");
2389		if (os_snprintf_error(end - pos, ret))
2390			return pos;
2391		pos += ret;
2392	}
2393
2394	ret = os_snprintf(pos, end - pos, "]");
2395	if (os_snprintf_error(end - pos, ret))
2396		return pos;
2397	pos += ret;
2398
2399	return pos;
2400}
2401
2402
2403#ifdef CONFIG_WPS
2404static char * wpa_supplicant_wps_ie_txt_buf(struct wpa_supplicant *wpa_s,
2405					    char *pos, char *end,
2406					    struct wpabuf *wps_ie)
2407{
2408	int ret;
2409	const char *txt;
2410
2411	if (wps_ie == NULL)
2412		return pos;
2413	if (wps_is_selected_pbc_registrar(wps_ie))
2414		txt = "[WPS-PBC]";
2415	else if (wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 0))
2416		txt = "[WPS-AUTH]";
2417	else if (wps_is_selected_pin_registrar(wps_ie))
2418		txt = "[WPS-PIN]";
2419	else
2420		txt = "[WPS]";
2421
2422	ret = os_snprintf(pos, end - pos, "%s", txt);
2423	if (!os_snprintf_error(end - pos, ret))
2424		pos += ret;
2425	wpabuf_free(wps_ie);
2426	return pos;
2427}
2428#endif /* CONFIG_WPS */
2429
2430
2431static char * wpa_supplicant_wps_ie_txt(struct wpa_supplicant *wpa_s,
2432					char *pos, char *end,
2433					const struct wpa_bss *bss)
2434{
2435#ifdef CONFIG_WPS
2436	struct wpabuf *wps_ie;
2437	wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
2438	return wpa_supplicant_wps_ie_txt_buf(wpa_s, pos, end, wps_ie);
2439#else /* CONFIG_WPS */
2440	return pos;
2441#endif /* CONFIG_WPS */
2442}
2443
2444
2445/* Format one result on one text line into a buffer. */
2446static int wpa_supplicant_ctrl_iface_scan_result(
2447	struct wpa_supplicant *wpa_s,
2448	const struct wpa_bss *bss, char *buf, size_t buflen)
2449{
2450	char *pos, *end;
2451	int ret;
2452	const u8 *ie, *ie2, *osen_ie, *p2p, *mesh;
2453
2454	mesh = wpa_bss_get_ie(bss, WLAN_EID_MESH_ID);
2455	p2p = wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE);
2456	if (!p2p)
2457		p2p = wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE);
2458	if (p2p && bss->ssid_len == P2P_WILDCARD_SSID_LEN &&
2459	    os_memcmp(bss->ssid, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) ==
2460	    0)
2461		return 0; /* Do not show P2P listen discovery results here */
2462
2463	pos = buf;
2464	end = buf + buflen;
2465
2466	ret = os_snprintf(pos, end - pos, MACSTR "\t%d\t%d\t",
2467			  MAC2STR(bss->bssid), bss->freq, bss->level);
2468	if (os_snprintf_error(end - pos, ret))
2469		return -1;
2470	pos += ret;
2471	ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
2472	if (ie)
2473		pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie, 2 + ie[1]);
2474	ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2475	if (ie2) {
2476		pos = wpa_supplicant_ie_txt(pos, end, mesh ? "RSN" : "WPA2",
2477					    ie2, 2 + ie2[1]);
2478	}
2479	osen_ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
2480	if (osen_ie)
2481		pos = wpa_supplicant_ie_txt(pos, end, "OSEN",
2482					    osen_ie, 2 + osen_ie[1]);
2483	pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
2484	if (!ie && !ie2 && !osen_ie && (bss->caps & IEEE80211_CAP_PRIVACY)) {
2485		ret = os_snprintf(pos, end - pos, "[WEP]");
2486		if (os_snprintf_error(end - pos, ret))
2487			return -1;
2488		pos += ret;
2489	}
2490	if (mesh) {
2491		ret = os_snprintf(pos, end - pos, "[MESH]");
2492		if (os_snprintf_error(end - pos, ret))
2493			return -1;
2494		pos += ret;
2495	}
2496	if (bss_is_dmg(bss)) {
2497		const char *s;
2498		ret = os_snprintf(pos, end - pos, "[DMG]");
2499		if (os_snprintf_error(end - pos, ret))
2500			return -1;
2501		pos += ret;
2502		switch (bss->caps & IEEE80211_CAP_DMG_MASK) {
2503		case IEEE80211_CAP_DMG_IBSS:
2504			s = "[IBSS]";
2505			break;
2506		case IEEE80211_CAP_DMG_AP:
2507			s = "[ESS]";
2508			break;
2509		case IEEE80211_CAP_DMG_PBSS:
2510			s = "[PBSS]";
2511			break;
2512		default:
2513			s = "";
2514			break;
2515		}
2516		ret = os_snprintf(pos, end - pos, "%s", s);
2517		if (os_snprintf_error(end - pos, ret))
2518			return -1;
2519		pos += ret;
2520	} else {
2521		if (bss->caps & IEEE80211_CAP_IBSS) {
2522			ret = os_snprintf(pos, end - pos, "[IBSS]");
2523			if (os_snprintf_error(end - pos, ret))
2524				return -1;
2525			pos += ret;
2526		}
2527		if (bss->caps & IEEE80211_CAP_ESS) {
2528			ret = os_snprintf(pos, end - pos, "[ESS]");
2529			if (os_snprintf_error(end - pos, ret))
2530				return -1;
2531			pos += ret;
2532		}
2533	}
2534	if (p2p) {
2535		ret = os_snprintf(pos, end - pos, "[P2P]");
2536		if (os_snprintf_error(end - pos, ret))
2537			return -1;
2538		pos += ret;
2539	}
2540#ifdef CONFIG_HS20
2541	if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE) && ie2) {
2542		ret = os_snprintf(pos, end - pos, "[HS20]");
2543		if (os_snprintf_error(end - pos, ret))
2544			return -1;
2545		pos += ret;
2546	}
2547#endif /* CONFIG_HS20 */
2548#ifdef CONFIG_FST
2549	if (wpa_bss_get_ie(bss, WLAN_EID_MULTI_BAND)) {
2550		ret = os_snprintf(pos, end - pos, "[FST]");
2551		if (os_snprintf_error(end - pos, ret))
2552			return -1;
2553		pos += ret;
2554	}
2555#endif /* CONFIG_FST */
2556
2557	ret = os_snprintf(pos, end - pos, "\t%s",
2558			  wpa_ssid_txt(bss->ssid, bss->ssid_len));
2559	if (os_snprintf_error(end - pos, ret))
2560		return -1;
2561	pos += ret;
2562
2563	ret = os_snprintf(pos, end - pos, "\n");
2564	if (os_snprintf_error(end - pos, ret))
2565		return -1;
2566	pos += ret;
2567
2568	return pos - buf;
2569}
2570
2571
2572static int wpa_supplicant_ctrl_iface_scan_results(
2573	struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
2574{
2575	char *pos, *end;
2576	struct wpa_bss *bss;
2577	int ret;
2578
2579	pos = buf;
2580	end = buf + buflen;
2581	ret = os_snprintf(pos, end - pos, "bssid / frequency / signal level / "
2582			  "flags / ssid\n");
2583	if (os_snprintf_error(end - pos, ret))
2584		return pos - buf;
2585	pos += ret;
2586
2587	dl_list_for_each(bss, &wpa_s->bss_id, struct wpa_bss, list_id) {
2588		ret = wpa_supplicant_ctrl_iface_scan_result(wpa_s, bss, pos,
2589							    end - pos);
2590		if (ret < 0 || ret >= end - pos)
2591			return pos - buf;
2592		pos += ret;
2593	}
2594
2595	return pos - buf;
2596}
2597
2598
2599#ifdef CONFIG_MESH
2600
2601static int wpa_supplicant_ctrl_iface_mesh_interface_add(
2602	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
2603{
2604	char *pos, ifname[IFNAMSIZ + 1];
2605
2606	ifname[0] = '\0';
2607
2608	pos = os_strstr(cmd, "ifname=");
2609	if (pos) {
2610		pos += 7;
2611		os_strlcpy(ifname, pos, sizeof(ifname));
2612	}
2613
2614	if (wpas_mesh_add_interface(wpa_s, ifname, sizeof(ifname)) < 0)
2615		return -1;
2616
2617	os_strlcpy(reply, ifname, max_len);
2618	return os_strlen(ifname);
2619}
2620
2621
2622static int wpa_supplicant_ctrl_iface_mesh_group_add(
2623	struct wpa_supplicant *wpa_s, char *cmd)
2624{
2625	int id;
2626	struct wpa_ssid *ssid;
2627
2628	id = atoi(cmd);
2629	wpa_printf(MSG_DEBUG, "CTRL_IFACE: MESH_GROUP_ADD id=%d", id);
2630
2631	ssid = wpa_config_get_network(wpa_s->conf, id);
2632	if (ssid == NULL) {
2633		wpa_printf(MSG_DEBUG,
2634			   "CTRL_IFACE: Could not find network id=%d", id);
2635		return -1;
2636	}
2637	if (ssid->mode != WPAS_MODE_MESH) {
2638		wpa_printf(MSG_DEBUG,
2639			   "CTRL_IFACE: Cannot use MESH_GROUP_ADD on a non mesh network");
2640		return -1;
2641	}
2642	if (ssid->key_mgmt != WPA_KEY_MGMT_NONE &&
2643	    ssid->key_mgmt != WPA_KEY_MGMT_SAE) {
2644		wpa_printf(MSG_ERROR,
2645			   "CTRL_IFACE: key_mgmt for mesh network should be open or SAE");
2646		return -1;
2647	}
2648
2649	/*
2650	 * TODO: If necessary write our own group_add function,
2651	 * for now we can reuse select_network
2652	 */
2653	wpa_supplicant_select_network(wpa_s, ssid);
2654
2655	return 0;
2656}
2657
2658
2659static int wpa_supplicant_ctrl_iface_mesh_group_remove(
2660	struct wpa_supplicant *wpa_s, char *cmd)
2661{
2662	struct wpa_supplicant *orig;
2663	struct wpa_global *global;
2664	int found = 0;
2665
2666	wpa_printf(MSG_DEBUG, "CTRL_IFACE: MESH_GROUP_REMOVE ifname=%s", cmd);
2667
2668	global = wpa_s->global;
2669	orig = wpa_s;
2670
2671	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
2672		if (os_strcmp(wpa_s->ifname, cmd) == 0) {
2673			found = 1;
2674			break;
2675		}
2676	}
2677	if (!found) {
2678		wpa_printf(MSG_ERROR,
2679			   "CTRL_IFACE: MESH_GROUP_REMOVE ifname=%s not found",
2680			   cmd);
2681		return -1;
2682	}
2683	if (wpa_s->mesh_if_created && wpa_s == orig) {
2684		wpa_printf(MSG_ERROR,
2685			   "CTRL_IFACE: MESH_GROUP_REMOVE can't remove itself");
2686		return -1;
2687	}
2688
2689	wpa_s->reassociate = 0;
2690	wpa_s->disconnected = 1;
2691	wpa_supplicant_cancel_sched_scan(wpa_s);
2692	wpa_supplicant_cancel_scan(wpa_s);
2693
2694	/*
2695	 * TODO: If necessary write our own group_remove function,
2696	 * for now we can reuse deauthenticate
2697	 */
2698	wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2699
2700	if (wpa_s->mesh_if_created)
2701		wpa_supplicant_remove_iface(global, wpa_s, 0);
2702
2703	return 0;
2704}
2705
2706#endif /* CONFIG_MESH */
2707
2708
2709static int wpa_supplicant_ctrl_iface_select_network(
2710	struct wpa_supplicant *wpa_s, char *cmd)
2711{
2712	int id;
2713	struct wpa_ssid *ssid;
2714	char *pos;
2715
2716	/* cmd: "<network id>" or "any" */
2717	if (os_strncmp(cmd, "any", 3) == 0) {
2718		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK any");
2719		ssid = NULL;
2720	} else {
2721		id = atoi(cmd);
2722		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK id=%d", id);
2723
2724		ssid = wpa_config_get_network(wpa_s->conf, id);
2725		if (ssid == NULL) {
2726			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2727				   "network id=%d", id);
2728			return -1;
2729		}
2730		if (ssid->disabled == 2) {
2731			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
2732				   "SELECT_NETWORK with persistent P2P group");
2733			return -1;
2734		}
2735	}
2736
2737	pos = os_strstr(cmd, " freq=");
2738	if (pos) {
2739		int *freqs = freq_range_to_channel_list(wpa_s, pos + 6);
2740		if (freqs) {
2741			wpa_s->scan_req = MANUAL_SCAN_REQ;
2742			os_free(wpa_s->manual_scan_freqs);
2743			wpa_s->manual_scan_freqs = freqs;
2744		}
2745	}
2746
2747	wpa_s->scan_min_time.sec = 0;
2748	wpa_s->scan_min_time.usec = 0;
2749	wpa_supplicant_select_network(wpa_s, ssid);
2750
2751	return 0;
2752}
2753
2754
2755static int wpa_supplicant_ctrl_iface_enable_network(
2756	struct wpa_supplicant *wpa_s, char *cmd)
2757{
2758	int id;
2759	struct wpa_ssid *ssid;
2760
2761	/* cmd: "<network id>" or "all" */
2762	if (os_strcmp(cmd, "all") == 0) {
2763		wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK all");
2764		ssid = NULL;
2765	} else {
2766		id = atoi(cmd);
2767		wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK id=%d", id);
2768
2769		ssid = wpa_config_get_network(wpa_s->conf, id);
2770		if (ssid == NULL) {
2771			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2772				   "network id=%d", id);
2773			return -1;
2774		}
2775		if (ssid->disabled == 2) {
2776			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
2777				   "ENABLE_NETWORK with persistent P2P group");
2778			return -1;
2779		}
2780
2781		if (os_strstr(cmd, " no-connect")) {
2782			ssid->disabled = 0;
2783			return 0;
2784		}
2785	}
2786	wpa_s->scan_min_time.sec = 0;
2787	wpa_s->scan_min_time.usec = 0;
2788	wpa_supplicant_enable_network(wpa_s, ssid);
2789
2790	return 0;
2791}
2792
2793
2794static int wpa_supplicant_ctrl_iface_disable_network(
2795	struct wpa_supplicant *wpa_s, char *cmd)
2796{
2797	int id;
2798	struct wpa_ssid *ssid;
2799
2800	/* cmd: "<network id>" or "all" */
2801	if (os_strcmp(cmd, "all") == 0) {
2802		wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK all");
2803		ssid = NULL;
2804	} else {
2805		id = atoi(cmd);
2806		wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK id=%d", id);
2807
2808		ssid = wpa_config_get_network(wpa_s->conf, id);
2809		if (ssid == NULL) {
2810			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
2811				   "network id=%d", id);
2812			return -1;
2813		}
2814		if (ssid->disabled == 2) {
2815			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
2816				   "DISABLE_NETWORK with persistent P2P "
2817				   "group");
2818			return -1;
2819		}
2820	}
2821	wpa_supplicant_disable_network(wpa_s, ssid);
2822
2823	return 0;
2824}
2825
2826
2827static int wpa_supplicant_ctrl_iface_add_network(
2828	struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
2829{
2830	struct wpa_ssid *ssid;
2831	int ret;
2832
2833	wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_NETWORK");
2834
2835	ssid = wpa_config_add_network(wpa_s->conf);
2836	if (ssid == NULL)
2837		return -1;
2838
2839	wpas_notify_network_added(wpa_s, ssid);
2840
2841	ssid->disabled = 1;
2842	wpa_config_set_network_defaults(ssid);
2843
2844	ret = os_snprintf(buf, buflen, "%d\n", ssid->id);
2845	if (os_snprintf_error(buflen, ret))
2846		return -1;
2847	return ret;
2848}
2849
2850
2851static int wpa_supplicant_ctrl_iface_remove_network(
2852	struct wpa_supplicant *wpa_s, char *cmd)
2853{
2854	int id;
2855	struct wpa_ssid *ssid;
2856	int was_disabled;
2857
2858	/* cmd: "<network id>" or "all" */
2859	if (os_strcmp(cmd, "all") == 0) {
2860		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK all");
2861		if (wpa_s->sched_scanning)
2862			wpa_supplicant_cancel_sched_scan(wpa_s);
2863
2864		eapol_sm_invalidate_cached_session(wpa_s->eapol);
2865		if (wpa_s->current_ssid) {
2866#ifdef CONFIG_SME
2867			wpa_s->sme.prev_bssid_set = 0;
2868#endif /* CONFIG_SME */
2869			wpa_sm_set_config(wpa_s->wpa, NULL);
2870			eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2871			if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2872				wpa_s->own_disconnect_req = 1;
2873			wpa_supplicant_deauthenticate(
2874				wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2875		}
2876		ssid = wpa_s->conf->ssid;
2877		while (ssid) {
2878			struct wpa_ssid *remove_ssid = ssid;
2879			id = ssid->id;
2880			ssid = ssid->next;
2881			if (wpa_s->last_ssid == remove_ssid)
2882				wpa_s->last_ssid = NULL;
2883			wpas_notify_network_removed(wpa_s, remove_ssid);
2884			wpa_config_remove_network(wpa_s->conf, id);
2885		}
2886		return 0;
2887	}
2888
2889	id = atoi(cmd);
2890	wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK id=%d", id);
2891
2892	ssid = wpa_config_get_network(wpa_s->conf, id);
2893	if (ssid)
2894		wpas_notify_network_removed(wpa_s, ssid);
2895	if (ssid == NULL) {
2896		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
2897			   "id=%d", id);
2898		return -1;
2899	}
2900
2901	if (wpa_s->last_ssid == ssid)
2902		wpa_s->last_ssid = NULL;
2903
2904	if (ssid == wpa_s->current_ssid || wpa_s->current_ssid == NULL) {
2905#ifdef CONFIG_SME
2906		wpa_s->sme.prev_bssid_set = 0;
2907#endif /* CONFIG_SME */
2908		/*
2909		 * Invalidate the EAP session cache if the current or
2910		 * previously used network is removed.
2911		 */
2912		eapol_sm_invalidate_cached_session(wpa_s->eapol);
2913	}
2914
2915	if (ssid == wpa_s->current_ssid) {
2916		wpa_sm_set_config(wpa_s->wpa, NULL);
2917		eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2918
2919		if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2920			wpa_s->own_disconnect_req = 1;
2921		wpa_supplicant_deauthenticate(wpa_s,
2922					      WLAN_REASON_DEAUTH_LEAVING);
2923	}
2924
2925	was_disabled = ssid->disabled;
2926
2927	if (wpa_config_remove_network(wpa_s->conf, id) < 0) {
2928		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Not able to remove the "
2929			   "network id=%d", id);
2930		return -1;
2931	}
2932
2933	if (!was_disabled && wpa_s->sched_scanning) {
2934		wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to remove "
2935			   "network from filters");
2936		wpa_supplicant_cancel_sched_scan(wpa_s);
2937		wpa_supplicant_req_scan(wpa_s, 0, 0);
2938	}
2939
2940	return 0;
2941}
2942
2943
2944static int wpa_supplicant_ctrl_iface_update_network(
2945	struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
2946	char *name, char *value)
2947{
2948	if (wpa_config_set(ssid, name, value, 0) < 0) {
2949		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set network "
2950			   "variable '%s'", name);
2951		return -1;
2952	}
2953
2954	if (os_strcmp(name, "bssid") != 0 &&
2955	    os_strcmp(name, "priority") != 0)
2956		wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
2957
2958	if (wpa_s->current_ssid == ssid || wpa_s->current_ssid == NULL) {
2959		/*
2960		 * Invalidate the EAP session cache if anything in the current
2961		 * or previously used configuration changes.
2962		 */
2963		eapol_sm_invalidate_cached_session(wpa_s->eapol);
2964	}
2965
2966	if ((os_strcmp(name, "psk") == 0 &&
2967	     value[0] == '"' && ssid->ssid_len) ||
2968	    (os_strcmp(name, "ssid") == 0 && ssid->passphrase))
2969		wpa_config_update_psk(ssid);
2970	else if (os_strcmp(name, "priority") == 0)
2971		wpa_config_update_prio_list(wpa_s->conf);
2972
2973	return 0;
2974}
2975
2976
2977static int wpa_supplicant_ctrl_iface_set_network(
2978	struct wpa_supplicant *wpa_s, char *cmd)
2979{
2980	int id, ret, prev_bssid_set, prev_disabled;
2981	struct wpa_ssid *ssid;
2982	char *name, *value;
2983	u8 prev_bssid[ETH_ALEN];
2984
2985	/* cmd: "<network id> <variable name> <value>" */
2986	name = os_strchr(cmd, ' ');
2987	if (name == NULL)
2988		return -1;
2989	*name++ = '\0';
2990
2991	value = os_strchr(name, ' ');
2992	if (value == NULL)
2993		return -1;
2994	*value++ = '\0';
2995
2996	id = atoi(cmd);
2997	wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_NETWORK id=%d name='%s'",
2998		   id, name);
2999	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
3000			      (u8 *) value, os_strlen(value));
3001
3002	ssid = wpa_config_get_network(wpa_s->conf, id);
3003	if (ssid == NULL) {
3004		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
3005			   "id=%d", id);
3006		return -1;
3007	}
3008
3009	prev_bssid_set = ssid->bssid_set;
3010	prev_disabled = ssid->disabled;
3011	os_memcpy(prev_bssid, ssid->bssid, ETH_ALEN);
3012	ret = wpa_supplicant_ctrl_iface_update_network(wpa_s, ssid, name,
3013						       value);
3014	if (ret == 0 &&
3015	    (ssid->bssid_set != prev_bssid_set ||
3016	     os_memcmp(ssid->bssid, prev_bssid, ETH_ALEN) != 0))
3017		wpas_notify_network_bssid_set_changed(wpa_s, ssid);
3018
3019	if (prev_disabled != ssid->disabled &&
3020	    (prev_disabled == 2 || ssid->disabled == 2))
3021		wpas_notify_network_type_changed(wpa_s, ssid);
3022
3023	return ret;
3024}
3025
3026
3027static int wpa_supplicant_ctrl_iface_get_network(
3028	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
3029{
3030	int id;
3031	size_t res;
3032	struct wpa_ssid *ssid;
3033	char *name, *value;
3034
3035	/* cmd: "<network id> <variable name>" */
3036	name = os_strchr(cmd, ' ');
3037	if (name == NULL || buflen == 0)
3038		return -1;
3039	*name++ = '\0';
3040
3041	id = atoi(cmd);
3042	wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: GET_NETWORK id=%d name='%s'",
3043		   id, name);
3044
3045	ssid = wpa_config_get_network(wpa_s->conf, id);
3046	if (ssid == NULL) {
3047		wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: Could not find network "
3048			   "id=%d", id);
3049		return -1;
3050	}
3051
3052	value = wpa_config_get_no_key(ssid, name);
3053	if (value == NULL) {
3054		wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: Failed to get network "
3055			   "variable '%s'", name);
3056		return -1;
3057	}
3058
3059	res = os_strlcpy(buf, value, buflen);
3060	if (res >= buflen) {
3061		os_free(value);
3062		return -1;
3063	}
3064
3065	os_free(value);
3066
3067	return res;
3068}
3069
3070
3071static int wpa_supplicant_ctrl_iface_dup_network(
3072	struct wpa_supplicant *wpa_s, char *cmd,
3073	struct wpa_supplicant *dst_wpa_s)
3074{
3075	struct wpa_ssid *ssid_s, *ssid_d;
3076	char *name, *id, *value;
3077	int id_s, id_d, ret;
3078
3079	/* cmd: "<src network id> <dst network id> <variable name>" */
3080	id = os_strchr(cmd, ' ');
3081	if (id == NULL)
3082		return -1;
3083	*id++ = '\0';
3084
3085	name = os_strchr(id, ' ');
3086	if (name == NULL)
3087		return -1;
3088	*name++ = '\0';
3089
3090	id_s = atoi(cmd);
3091	id_d = atoi(id);
3092
3093	wpa_printf(MSG_DEBUG,
3094		   "CTRL_IFACE: DUP_NETWORK ifname=%s->%s id=%d->%d name='%s'",
3095		   wpa_s->ifname, dst_wpa_s->ifname, id_s, id_d, name);
3096
3097	ssid_s = wpa_config_get_network(wpa_s->conf, id_s);
3098	if (ssid_s == NULL) {
3099		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3100			   "network id=%d", id_s);
3101		return -1;
3102	}
3103
3104	ssid_d = wpa_config_get_network(dst_wpa_s->conf, id_d);
3105	if (ssid_d == NULL) {
3106		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3107			   "network id=%d", id_d);
3108		return -1;
3109	}
3110
3111	value = wpa_config_get(ssid_s, name);
3112	if (value == NULL) {
3113		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get network "
3114			   "variable '%s'", name);
3115		return -1;
3116	}
3117
3118	ret = wpa_supplicant_ctrl_iface_update_network(dst_wpa_s, ssid_d, name,
3119						       value);
3120
3121	os_free(value);
3122
3123	return ret;
3124}
3125
3126
3127static int wpa_supplicant_ctrl_iface_list_creds(struct wpa_supplicant *wpa_s,
3128						char *buf, size_t buflen)
3129{
3130	char *pos, *end;
3131	struct wpa_cred *cred;
3132	int ret;
3133
3134	pos = buf;
3135	end = buf + buflen;
3136	ret = os_snprintf(pos, end - pos,
3137			  "cred id / realm / username / domain / imsi\n");
3138	if (os_snprintf_error(end - pos, ret))
3139		return pos - buf;
3140	pos += ret;
3141
3142	cred = wpa_s->conf->cred;
3143	while (cred) {
3144		ret = os_snprintf(pos, end - pos, "%d\t%s\t%s\t%s\t%s\n",
3145				  cred->id, cred->realm ? cred->realm : "",
3146				  cred->username ? cred->username : "",
3147				  cred->domain ? cred->domain[0] : "",
3148				  cred->imsi ? cred->imsi : "");
3149		if (os_snprintf_error(end - pos, ret))
3150			return pos - buf;
3151		pos += ret;
3152
3153		cred = cred->next;
3154	}
3155
3156	return pos - buf;
3157}
3158
3159
3160static int wpa_supplicant_ctrl_iface_add_cred(struct wpa_supplicant *wpa_s,
3161					      char *buf, size_t buflen)
3162{
3163	struct wpa_cred *cred;
3164	int ret;
3165
3166	wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_CRED");
3167
3168	cred = wpa_config_add_cred(wpa_s->conf);
3169	if (cred == NULL)
3170		return -1;
3171
3172	wpa_msg(wpa_s, MSG_INFO, CRED_ADDED "%d", cred->id);
3173
3174	ret = os_snprintf(buf, buflen, "%d\n", cred->id);
3175	if (os_snprintf_error(buflen, ret))
3176		return -1;
3177	return ret;
3178}
3179
3180
3181static int wpas_ctrl_remove_cred(struct wpa_supplicant *wpa_s,
3182				 struct wpa_cred *cred)
3183{
3184	struct wpa_ssid *ssid;
3185	char str[20];
3186	int id;
3187
3188	if (cred == NULL) {
3189		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred");
3190		return -1;
3191	}
3192
3193	id = cred->id;
3194	if (wpa_config_remove_cred(wpa_s->conf, id) < 0) {
3195		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred");
3196		return -1;
3197	}
3198
3199	wpa_msg(wpa_s, MSG_INFO, CRED_REMOVED "%d", id);
3200
3201	/* Remove any network entry created based on the removed credential */
3202	ssid = wpa_s->conf->ssid;
3203	while (ssid) {
3204		if (ssid->parent_cred == cred) {
3205			int res;
3206
3207			wpa_printf(MSG_DEBUG, "Remove network id %d since it "
3208				   "used the removed credential", ssid->id);
3209			res = os_snprintf(str, sizeof(str), "%d", ssid->id);
3210			if (os_snprintf_error(sizeof(str), res))
3211				str[sizeof(str) - 1] = '\0';
3212			ssid = ssid->next;
3213			wpa_supplicant_ctrl_iface_remove_network(wpa_s, str);
3214		} else
3215			ssid = ssid->next;
3216	}
3217
3218	return 0;
3219}
3220
3221
3222static int wpa_supplicant_ctrl_iface_remove_cred(struct wpa_supplicant *wpa_s,
3223						 char *cmd)
3224{
3225	int id;
3226	struct wpa_cred *cred, *prev;
3227
3228	/* cmd: "<cred id>", "all", "sp_fqdn=<FQDN>", or
3229	 * "provisioning_sp=<FQDN> */
3230	if (os_strcmp(cmd, "all") == 0) {
3231		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED all");
3232		cred = wpa_s->conf->cred;
3233		while (cred) {
3234			prev = cred;
3235			cred = cred->next;
3236			wpas_ctrl_remove_cred(wpa_s, prev);
3237		}
3238		return 0;
3239	}
3240
3241	if (os_strncmp(cmd, "sp_fqdn=", 8) == 0) {
3242		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED SP FQDN '%s'",
3243			   cmd + 8);
3244		cred = wpa_s->conf->cred;
3245		while (cred) {
3246			prev = cred;
3247			cred = cred->next;
3248			if (prev->domain) {
3249				size_t i;
3250				for (i = 0; i < prev->num_domain; i++) {
3251					if (os_strcmp(prev->domain[i], cmd + 8)
3252					    != 0)
3253						continue;
3254					wpas_ctrl_remove_cred(wpa_s, prev);
3255					break;
3256				}
3257			}
3258		}
3259		return 0;
3260	}
3261
3262	if (os_strncmp(cmd, "provisioning_sp=", 16) == 0) {
3263		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED provisioning SP FQDN '%s'",
3264			   cmd + 16);
3265		cred = wpa_s->conf->cred;
3266		while (cred) {
3267			prev = cred;
3268			cred = cred->next;
3269			if (prev->provisioning_sp &&
3270			    os_strcmp(prev->provisioning_sp, cmd + 16) == 0)
3271				wpas_ctrl_remove_cred(wpa_s, prev);
3272		}
3273		return 0;
3274	}
3275
3276	id = atoi(cmd);
3277	wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED id=%d", id);
3278
3279	cred = wpa_config_get_cred(wpa_s->conf, id);
3280	return wpas_ctrl_remove_cred(wpa_s, cred);
3281}
3282
3283
3284static int wpa_supplicant_ctrl_iface_set_cred(struct wpa_supplicant *wpa_s,
3285					      char *cmd)
3286{
3287	int id;
3288	struct wpa_cred *cred;
3289	char *name, *value;
3290
3291	/* cmd: "<cred id> <variable name> <value>" */
3292	name = os_strchr(cmd, ' ');
3293	if (name == NULL)
3294		return -1;
3295	*name++ = '\0';
3296
3297	value = os_strchr(name, ' ');
3298	if (value == NULL)
3299		return -1;
3300	*value++ = '\0';
3301
3302	id = atoi(cmd);
3303	wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_CRED id=%d name='%s'",
3304		   id, name);
3305	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
3306			      (u8 *) value, os_strlen(value));
3307
3308	cred = wpa_config_get_cred(wpa_s->conf, id);
3309	if (cred == NULL) {
3310		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
3311			   id);
3312		return -1;
3313	}
3314
3315	if (wpa_config_set_cred(cred, name, value, 0) < 0) {
3316		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set cred "
3317			   "variable '%s'", name);
3318		return -1;
3319	}
3320
3321	wpa_msg(wpa_s, MSG_INFO, CRED_MODIFIED "%d %s", cred->id, name);
3322
3323	return 0;
3324}
3325
3326
3327static int wpa_supplicant_ctrl_iface_get_cred(struct wpa_supplicant *wpa_s,
3328					      char *cmd, char *buf,
3329					      size_t buflen)
3330{
3331	int id;
3332	size_t res;
3333	struct wpa_cred *cred;
3334	char *name, *value;
3335
3336	/* cmd: "<cred id> <variable name>" */
3337	name = os_strchr(cmd, ' ');
3338	if (name == NULL)
3339		return -1;
3340	*name++ = '\0';
3341
3342	id = atoi(cmd);
3343	wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CRED id=%d name='%s'",
3344		   id, name);
3345
3346	cred = wpa_config_get_cred(wpa_s->conf, id);
3347	if (cred == NULL) {
3348		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
3349			   id);
3350		return -1;
3351	}
3352
3353	value = wpa_config_get_cred_no_key(cred, name);
3354	if (value == NULL) {
3355		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get cred variable '%s'",
3356			   name);
3357		return -1;
3358	}
3359
3360	res = os_strlcpy(buf, value, buflen);
3361	if (res >= buflen) {
3362		os_free(value);
3363		return -1;
3364	}
3365
3366	os_free(value);
3367
3368	return res;
3369}
3370
3371
3372#ifndef CONFIG_NO_CONFIG_WRITE
3373static int wpa_supplicant_ctrl_iface_save_config(struct wpa_supplicant *wpa_s)
3374{
3375	int ret;
3376
3377	if (!wpa_s->conf->update_config) {
3378		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed "
3379			   "to update configuration (update_config=0)");
3380		return -1;
3381	}
3382
3383	ret = wpa_config_write(wpa_s->confname, wpa_s->conf);
3384	if (ret) {
3385		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to "
3386			   "update configuration");
3387	} else {
3388		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration"
3389			   " updated");
3390	}
3391
3392	return ret;
3393}
3394#endif /* CONFIG_NO_CONFIG_WRITE */
3395
3396
3397struct cipher_info {
3398	unsigned int capa;
3399	const char *name;
3400	int group_only;
3401};
3402
3403static const struct cipher_info ciphers[] = {
3404	{ WPA_DRIVER_CAPA_ENC_CCMP_256, "CCMP-256", 0 },
3405	{ WPA_DRIVER_CAPA_ENC_GCMP_256, "GCMP-256", 0 },
3406	{ WPA_DRIVER_CAPA_ENC_CCMP, "CCMP", 0 },
3407	{ WPA_DRIVER_CAPA_ENC_GCMP, "GCMP", 0 },
3408	{ WPA_DRIVER_CAPA_ENC_TKIP, "TKIP", 0 },
3409	{ WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE, "NONE", 0 },
3410	{ WPA_DRIVER_CAPA_ENC_WEP104, "WEP104", 1 },
3411	{ WPA_DRIVER_CAPA_ENC_WEP40, "WEP40", 1 }
3412};
3413
3414static const struct cipher_info ciphers_group_mgmt[] = {
3415	{ WPA_DRIVER_CAPA_ENC_BIP, "AES-128-CMAC", 1 },
3416	{ WPA_DRIVER_CAPA_ENC_BIP_GMAC_128, "BIP-GMAC-128", 1 },
3417	{ WPA_DRIVER_CAPA_ENC_BIP_GMAC_256, "BIP-GMAC-256", 1 },
3418	{ WPA_DRIVER_CAPA_ENC_BIP_CMAC_256, "BIP-CMAC-256", 1 },
3419};
3420
3421
3422static int ctrl_iface_get_capability_pairwise(int res, char *strict,
3423					      struct wpa_driver_capa *capa,
3424					      char *buf, size_t buflen)
3425{
3426	int ret;
3427	char *pos, *end;
3428	size_t len;
3429	unsigned int i;
3430
3431	pos = buf;
3432	end = pos + buflen;
3433
3434	if (res < 0) {
3435		if (strict)
3436			return 0;
3437		len = os_strlcpy(buf, "CCMP TKIP NONE", buflen);
3438		if (len >= buflen)
3439			return -1;
3440		return len;
3441	}
3442
3443	for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
3444		if (!ciphers[i].group_only && capa->enc & ciphers[i].capa) {
3445			ret = os_snprintf(pos, end - pos, "%s%s",
3446					  pos == buf ? "" : " ",
3447					  ciphers[i].name);
3448			if (os_snprintf_error(end - pos, ret))
3449				return pos - buf;
3450			pos += ret;
3451		}
3452	}
3453
3454	return pos - buf;
3455}
3456
3457
3458static int ctrl_iface_get_capability_group(int res, char *strict,
3459					   struct wpa_driver_capa *capa,
3460					   char *buf, size_t buflen)
3461{
3462	int ret;
3463	char *pos, *end;
3464	size_t len;
3465	unsigned int i;
3466
3467	pos = buf;
3468	end = pos + buflen;
3469
3470	if (res < 0) {
3471		if (strict)
3472			return 0;
3473		len = os_strlcpy(buf, "CCMP TKIP WEP104 WEP40", buflen);
3474		if (len >= buflen)
3475			return -1;
3476		return len;
3477	}
3478
3479	for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
3480		if (capa->enc & ciphers[i].capa) {
3481			ret = os_snprintf(pos, end - pos, "%s%s",
3482					  pos == buf ? "" : " ",
3483					  ciphers[i].name);
3484			if (os_snprintf_error(end - pos, ret))
3485				return pos - buf;
3486			pos += ret;
3487		}
3488	}
3489
3490	return pos - buf;
3491}
3492
3493
3494static int ctrl_iface_get_capability_group_mgmt(int res, char *strict,
3495						struct wpa_driver_capa *capa,
3496						char *buf, size_t buflen)
3497{
3498	int ret;
3499	char *pos, *end;
3500	unsigned int i;
3501
3502	pos = buf;
3503	end = pos + buflen;
3504
3505	if (res < 0)
3506		return 0;
3507
3508	for (i = 0; i < ARRAY_SIZE(ciphers_group_mgmt); i++) {
3509		if (capa->enc & ciphers_group_mgmt[i].capa) {
3510			ret = os_snprintf(pos, end - pos, "%s%s",
3511					  pos == buf ? "" : " ",
3512					  ciphers_group_mgmt[i].name);
3513			if (os_snprintf_error(end - pos, ret))
3514				return pos - buf;
3515			pos += ret;
3516		}
3517	}
3518
3519	return pos - buf;
3520}
3521
3522
3523static int ctrl_iface_get_capability_key_mgmt(int res, char *strict,
3524					      struct wpa_driver_capa *capa,
3525					      char *buf, size_t buflen)
3526{
3527	int ret;
3528	char *pos, *end;
3529	size_t len;
3530
3531	pos = buf;
3532	end = pos + buflen;
3533
3534	if (res < 0) {
3535		if (strict)
3536			return 0;
3537		len = os_strlcpy(buf, "WPA-PSK WPA-EAP IEEE8021X WPA-NONE "
3538				 "NONE", buflen);
3539		if (len >= buflen)
3540			return -1;
3541		return len;
3542	}
3543
3544	ret = os_snprintf(pos, end - pos, "NONE IEEE8021X");
3545	if (os_snprintf_error(end - pos, ret))
3546		return pos - buf;
3547	pos += ret;
3548
3549	if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3550			      WPA_DRIVER_CAPA_KEY_MGMT_WPA2)) {
3551		ret = os_snprintf(pos, end - pos, " WPA-EAP");
3552		if (os_snprintf_error(end - pos, ret))
3553			return pos - buf;
3554		pos += ret;
3555	}
3556
3557	if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
3558			      WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
3559		ret = os_snprintf(pos, end - pos, " WPA-PSK");
3560		if (os_snprintf_error(end - pos, ret))
3561			return pos - buf;
3562		pos += ret;
3563	}
3564
3565	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE) {
3566		ret = os_snprintf(pos, end - pos, " WPA-NONE");
3567		if (os_snprintf_error(end - pos, ret))
3568			return pos - buf;
3569		pos += ret;
3570	}
3571
3572#ifdef CONFIG_SUITEB
3573	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B) {
3574		ret = os_snprintf(pos, end - pos, " WPA-EAP-SUITE-B");
3575		if (os_snprintf_error(end - pos, ret))
3576			return pos - buf;
3577		pos += ret;
3578	}
3579#endif /* CONFIG_SUITEB */
3580#ifdef CONFIG_SUITEB192
3581	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B_192) {
3582		ret = os_snprintf(pos, end - pos, " WPA-EAP-SUITE-B-192");
3583		if (os_snprintf_error(end - pos, ret))
3584			return pos - buf;
3585		pos += ret;
3586	}
3587#endif /* CONFIG_SUITEB192 */
3588
3589	return pos - buf;
3590}
3591
3592
3593static int ctrl_iface_get_capability_proto(int res, char *strict,
3594					   struct wpa_driver_capa *capa,
3595					   char *buf, size_t buflen)
3596{
3597	int ret;
3598	char *pos, *end;
3599	size_t len;
3600
3601	pos = buf;
3602	end = pos + buflen;
3603
3604	if (res < 0) {
3605		if (strict)
3606			return 0;
3607		len = os_strlcpy(buf, "RSN WPA", buflen);
3608		if (len >= buflen)
3609			return -1;
3610		return len;
3611	}
3612
3613	if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
3614			      WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
3615		ret = os_snprintf(pos, end - pos, "%sRSN",
3616				  pos == buf ? "" : " ");
3617		if (os_snprintf_error(end - pos, ret))
3618			return pos - buf;
3619		pos += ret;
3620	}
3621
3622	if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3623			      WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK)) {
3624		ret = os_snprintf(pos, end - pos, "%sWPA",
3625				  pos == buf ? "" : " ");
3626		if (os_snprintf_error(end - pos, ret))
3627			return pos - buf;
3628		pos += ret;
3629	}
3630
3631	return pos - buf;
3632}
3633
3634
3635static int ctrl_iface_get_capability_auth_alg(struct wpa_supplicant *wpa_s,
3636					      int res, char *strict,
3637					      struct wpa_driver_capa *capa,
3638					      char *buf, size_t buflen)
3639{
3640	int ret;
3641	char *pos, *end;
3642	size_t len;
3643
3644	pos = buf;
3645	end = pos + buflen;
3646
3647	if (res < 0) {
3648		if (strict)
3649			return 0;
3650		len = os_strlcpy(buf, "OPEN SHARED LEAP", buflen);
3651		if (len >= buflen)
3652			return -1;
3653		return len;
3654	}
3655
3656	if (capa->auth & (WPA_DRIVER_AUTH_OPEN)) {
3657		ret = os_snprintf(pos, end - pos, "%sOPEN",
3658				  pos == buf ? "" : " ");
3659		if (os_snprintf_error(end - pos, ret))
3660			return pos - buf;
3661		pos += ret;
3662	}
3663
3664	if (capa->auth & (WPA_DRIVER_AUTH_SHARED)) {
3665		ret = os_snprintf(pos, end - pos, "%sSHARED",
3666				  pos == buf ? "" : " ");
3667		if (os_snprintf_error(end - pos, ret))
3668			return pos - buf;
3669		pos += ret;
3670	}
3671
3672	if (capa->auth & (WPA_DRIVER_AUTH_LEAP)) {
3673		ret = os_snprintf(pos, end - pos, "%sLEAP",
3674				  pos == buf ? "" : " ");
3675		if (os_snprintf_error(end - pos, ret))
3676			return pos - buf;
3677		pos += ret;
3678	}
3679
3680#ifdef CONFIG_SAE
3681	if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE) {
3682		ret = os_snprintf(pos, end - pos, "%sSAE",
3683				  pos == buf ? "" : " ");
3684		if (os_snprintf_error(end - pos, ret))
3685			return pos - buf;
3686		pos += ret;
3687	}
3688#endif /* CONFIG_SAE */
3689
3690	return pos - buf;
3691}
3692
3693
3694static int ctrl_iface_get_capability_modes(int res, char *strict,
3695					   struct wpa_driver_capa *capa,
3696					   char *buf, size_t buflen)
3697{
3698	int ret;
3699	char *pos, *end;
3700	size_t len;
3701
3702	pos = buf;
3703	end = pos + buflen;
3704
3705	if (res < 0) {
3706		if (strict)
3707			return 0;
3708		len = os_strlcpy(buf, "IBSS AP", buflen);
3709		if (len >= buflen)
3710			return -1;
3711		return len;
3712	}
3713
3714	if (capa->flags & WPA_DRIVER_FLAGS_IBSS) {
3715		ret = os_snprintf(pos, end - pos, "%sIBSS",
3716				  pos == buf ? "" : " ");
3717		if (os_snprintf_error(end - pos, ret))
3718			return pos - buf;
3719		pos += ret;
3720	}
3721
3722	if (capa->flags & WPA_DRIVER_FLAGS_AP) {
3723		ret = os_snprintf(pos, end - pos, "%sAP",
3724				  pos == buf ? "" : " ");
3725		if (os_snprintf_error(end - pos, ret))
3726			return pos - buf;
3727		pos += ret;
3728	}
3729
3730#ifdef CONFIG_MESH
3731	if (capa->flags & WPA_DRIVER_FLAGS_MESH) {
3732		ret = os_snprintf(pos, end - pos, "%sMESH",
3733				  pos == buf ? "" : " ");
3734		if (os_snprintf_error(end - pos, ret))
3735			return pos - buf;
3736		pos += ret;
3737	}
3738#endif /* CONFIG_MESH */
3739
3740	return pos - buf;
3741}
3742
3743
3744static int ctrl_iface_get_capability_channels(struct wpa_supplicant *wpa_s,
3745					      char *buf, size_t buflen)
3746{
3747	struct hostapd_channel_data *chnl;
3748	int ret, i, j;
3749	char *pos, *end, *hmode;
3750
3751	pos = buf;
3752	end = pos + buflen;
3753
3754	for (j = 0; j < wpa_s->hw.num_modes; j++) {
3755		switch (wpa_s->hw.modes[j].mode) {
3756		case HOSTAPD_MODE_IEEE80211B:
3757			hmode = "B";
3758			break;
3759		case HOSTAPD_MODE_IEEE80211G:
3760			hmode = "G";
3761			break;
3762		case HOSTAPD_MODE_IEEE80211A:
3763			hmode = "A";
3764			break;
3765		case HOSTAPD_MODE_IEEE80211AD:
3766			hmode = "AD";
3767			break;
3768		default:
3769			continue;
3770		}
3771		ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:", hmode);
3772		if (os_snprintf_error(end - pos, ret))
3773			return pos - buf;
3774		pos += ret;
3775		chnl = wpa_s->hw.modes[j].channels;
3776		for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
3777			if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
3778				continue;
3779			ret = os_snprintf(pos, end - pos, " %d", chnl[i].chan);
3780			if (os_snprintf_error(end - pos, ret))
3781				return pos - buf;
3782			pos += ret;
3783		}
3784		ret = os_snprintf(pos, end - pos, "\n");
3785		if (os_snprintf_error(end - pos, ret))
3786			return pos - buf;
3787		pos += ret;
3788	}
3789
3790	return pos - buf;
3791}
3792
3793
3794static int ctrl_iface_get_capability_freq(struct wpa_supplicant *wpa_s,
3795					  char *buf, size_t buflen)
3796{
3797	struct hostapd_channel_data *chnl;
3798	int ret, i, j;
3799	char *pos, *end, *hmode;
3800
3801	pos = buf;
3802	end = pos + buflen;
3803
3804	for (j = 0; j < wpa_s->hw.num_modes; j++) {
3805		switch (wpa_s->hw.modes[j].mode) {
3806		case HOSTAPD_MODE_IEEE80211B:
3807			hmode = "B";
3808			break;
3809		case HOSTAPD_MODE_IEEE80211G:
3810			hmode = "G";
3811			break;
3812		case HOSTAPD_MODE_IEEE80211A:
3813			hmode = "A";
3814			break;
3815		case HOSTAPD_MODE_IEEE80211AD:
3816			hmode = "AD";
3817			break;
3818		default:
3819			continue;
3820		}
3821		ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:\n",
3822				  hmode);
3823		if (os_snprintf_error(end - pos, ret))
3824			return pos - buf;
3825		pos += ret;
3826		chnl = wpa_s->hw.modes[j].channels;
3827		for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
3828			if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
3829				continue;
3830			ret = os_snprintf(pos, end - pos, " %d = %d MHz%s%s\n",
3831					  chnl[i].chan, chnl[i].freq,
3832					  chnl[i].flag & HOSTAPD_CHAN_NO_IR ?
3833					  " (NO_IR)" : "",
3834					  chnl[i].flag & HOSTAPD_CHAN_RADAR ?
3835					  " (DFS)" : "");
3836
3837			if (os_snprintf_error(end - pos, ret))
3838				return pos - buf;
3839			pos += ret;
3840		}
3841		ret = os_snprintf(pos, end - pos, "\n");
3842		if (os_snprintf_error(end - pos, ret))
3843			return pos - buf;
3844		pos += ret;
3845	}
3846
3847	return pos - buf;
3848}
3849
3850
3851static int wpa_supplicant_ctrl_iface_get_capability(
3852	struct wpa_supplicant *wpa_s, const char *_field, char *buf,
3853	size_t buflen)
3854{
3855	struct wpa_driver_capa capa;
3856	int res;
3857	char *strict;
3858	char field[30];
3859	size_t len;
3860
3861	/* Determine whether or not strict checking was requested */
3862	len = os_strlcpy(field, _field, sizeof(field));
3863	if (len >= sizeof(field))
3864		return -1;
3865	strict = os_strchr(field, ' ');
3866	if (strict != NULL) {
3867		*strict++ = '\0';
3868		if (os_strcmp(strict, "strict") != 0)
3869			return -1;
3870	}
3871
3872	wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CAPABILITY '%s' %s",
3873		field, strict ? strict : "");
3874
3875	if (os_strcmp(field, "eap") == 0) {
3876		return eap_get_names(buf, buflen);
3877	}
3878
3879	res = wpa_drv_get_capa(wpa_s, &capa);
3880
3881	if (os_strcmp(field, "pairwise") == 0)
3882		return ctrl_iface_get_capability_pairwise(res, strict, &capa,
3883							  buf, buflen);
3884
3885	if (os_strcmp(field, "group") == 0)
3886		return ctrl_iface_get_capability_group(res, strict, &capa,
3887						       buf, buflen);
3888
3889	if (os_strcmp(field, "group_mgmt") == 0)
3890		return ctrl_iface_get_capability_group_mgmt(res, strict, &capa,
3891							    buf, buflen);
3892
3893	if (os_strcmp(field, "key_mgmt") == 0)
3894		return ctrl_iface_get_capability_key_mgmt(res, strict, &capa,
3895							  buf, buflen);
3896
3897	if (os_strcmp(field, "proto") == 0)
3898		return ctrl_iface_get_capability_proto(res, strict, &capa,
3899						       buf, buflen);
3900
3901	if (os_strcmp(field, "auth_alg") == 0)
3902		return ctrl_iface_get_capability_auth_alg(wpa_s, res, strict,
3903							  &capa, buf, buflen);
3904
3905	if (os_strcmp(field, "modes") == 0)
3906		return ctrl_iface_get_capability_modes(res, strict, &capa,
3907						       buf, buflen);
3908
3909	if (os_strcmp(field, "channels") == 0)
3910		return ctrl_iface_get_capability_channels(wpa_s, buf, buflen);
3911
3912	if (os_strcmp(field, "freq") == 0)
3913		return ctrl_iface_get_capability_freq(wpa_s, buf, buflen);
3914
3915#ifdef CONFIG_TDLS
3916	if (os_strcmp(field, "tdls") == 0)
3917		return ctrl_iface_get_capability_tdls(wpa_s, buf, buflen);
3918#endif /* CONFIG_TDLS */
3919
3920#ifdef CONFIG_ERP
3921	if (os_strcmp(field, "erp") == 0) {
3922		res = os_snprintf(buf, buflen, "ERP");
3923		if (os_snprintf_error(buflen, res))
3924			return -1;
3925		return res;
3926	}
3927#endif /* CONFIG_EPR */
3928
3929#ifdef CONFIG_FIPS
3930	if (os_strcmp(field, "fips") == 0) {
3931		res = os_snprintf(buf, buflen, "FIPS");
3932		if (os_snprintf_error(buflen, res))
3933			return -1;
3934		return res;
3935	}
3936#endif /* CONFIG_FIPS */
3937
3938	wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown GET_CAPABILITY field '%s'",
3939		   field);
3940
3941	return -1;
3942}
3943
3944
3945#ifdef CONFIG_INTERWORKING
3946static char * anqp_add_hex(char *pos, char *end, const char *title,
3947			   struct wpabuf *data)
3948{
3949	char *start = pos;
3950	size_t i;
3951	int ret;
3952	const u8 *d;
3953
3954	if (data == NULL)
3955		return start;
3956
3957	ret = os_snprintf(pos, end - pos, "%s=", title);
3958	if (os_snprintf_error(end - pos, ret))
3959		return start;
3960	pos += ret;
3961
3962	d = wpabuf_head_u8(data);
3963	for (i = 0; i < wpabuf_len(data); i++) {
3964		ret = os_snprintf(pos, end - pos, "%02x", *d++);
3965		if (os_snprintf_error(end - pos, ret))
3966			return start;
3967		pos += ret;
3968	}
3969
3970	ret = os_snprintf(pos, end - pos, "\n");
3971	if (os_snprintf_error(end - pos, ret))
3972		return start;
3973	pos += ret;
3974
3975	return pos;
3976}
3977#endif /* CONFIG_INTERWORKING */
3978
3979
3980static int print_bss_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
3981			  unsigned long mask, char *buf, size_t buflen)
3982{
3983	size_t i;
3984	int ret;
3985	char *pos, *end;
3986	const u8 *ie, *ie2, *osen_ie;
3987
3988	pos = buf;
3989	end = buf + buflen;
3990
3991	if (mask & WPA_BSS_MASK_ID) {
3992		ret = os_snprintf(pos, end - pos, "id=%u\n", bss->id);
3993		if (os_snprintf_error(end - pos, ret))
3994			return 0;
3995		pos += ret;
3996	}
3997
3998	if (mask & WPA_BSS_MASK_BSSID) {
3999		ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
4000				  MAC2STR(bss->bssid));
4001		if (os_snprintf_error(end - pos, ret))
4002			return 0;
4003		pos += ret;
4004	}
4005
4006	if (mask & WPA_BSS_MASK_FREQ) {
4007		ret = os_snprintf(pos, end - pos, "freq=%d\n", bss->freq);
4008		if (os_snprintf_error(end - pos, ret))
4009			return 0;
4010		pos += ret;
4011	}
4012
4013	if (mask & WPA_BSS_MASK_BEACON_INT) {
4014		ret = os_snprintf(pos, end - pos, "beacon_int=%d\n",
4015				  bss->beacon_int);
4016		if (os_snprintf_error(end - pos, ret))
4017			return 0;
4018		pos += ret;
4019	}
4020
4021	if (mask & WPA_BSS_MASK_CAPABILITIES) {
4022		ret = os_snprintf(pos, end - pos, "capabilities=0x%04x\n",
4023				  bss->caps);
4024		if (os_snprintf_error(end - pos, ret))
4025			return 0;
4026		pos += ret;
4027	}
4028
4029	if (mask & WPA_BSS_MASK_QUAL) {
4030		ret = os_snprintf(pos, end - pos, "qual=%d\n", bss->qual);
4031		if (os_snprintf_error(end - pos, ret))
4032			return 0;
4033		pos += ret;
4034	}
4035
4036	if (mask & WPA_BSS_MASK_NOISE) {
4037		ret = os_snprintf(pos, end - pos, "noise=%d\n", bss->noise);
4038		if (os_snprintf_error(end - pos, ret))
4039			return 0;
4040		pos += ret;
4041	}
4042
4043	if (mask & WPA_BSS_MASK_LEVEL) {
4044		ret = os_snprintf(pos, end - pos, "level=%d\n", bss->level);
4045		if (os_snprintf_error(end - pos, ret))
4046			return 0;
4047		pos += ret;
4048	}
4049
4050	if (mask & WPA_BSS_MASK_TSF) {
4051		ret = os_snprintf(pos, end - pos, "tsf=%016llu\n",
4052				  (unsigned long long) bss->tsf);
4053		if (os_snprintf_error(end - pos, ret))
4054			return 0;
4055		pos += ret;
4056	}
4057
4058	if (mask & WPA_BSS_MASK_AGE) {
4059		struct os_reltime now;
4060
4061		os_get_reltime(&now);
4062		ret = os_snprintf(pos, end - pos, "age=%d\n",
4063				  (int) (now.sec - bss->last_update.sec));
4064		if (os_snprintf_error(end - pos, ret))
4065			return 0;
4066		pos += ret;
4067	}
4068
4069	if (mask & WPA_BSS_MASK_IE) {
4070		ret = os_snprintf(pos, end - pos, "ie=");
4071		if (os_snprintf_error(end - pos, ret))
4072			return 0;
4073		pos += ret;
4074
4075		ie = (const u8 *) (bss + 1);
4076		for (i = 0; i < bss->ie_len; i++) {
4077			ret = os_snprintf(pos, end - pos, "%02x", *ie++);
4078			if (os_snprintf_error(end - pos, ret))
4079				return 0;
4080			pos += ret;
4081		}
4082
4083		ret = os_snprintf(pos, end - pos, "\n");
4084		if (os_snprintf_error(end - pos, ret))
4085			return 0;
4086		pos += ret;
4087	}
4088
4089	if (mask & WPA_BSS_MASK_FLAGS) {
4090		ret = os_snprintf(pos, end - pos, "flags=");
4091		if (os_snprintf_error(end - pos, ret))
4092			return 0;
4093		pos += ret;
4094
4095		ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
4096		if (ie)
4097			pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie,
4098						    2 + ie[1]);
4099		ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
4100		if (ie2)
4101			pos = wpa_supplicant_ie_txt(pos, end, "WPA2", ie2,
4102						    2 + ie2[1]);
4103		osen_ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
4104		if (osen_ie)
4105			pos = wpa_supplicant_ie_txt(pos, end, "OSEN",
4106						    osen_ie, 2 + osen_ie[1]);
4107		pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
4108		if (!ie && !ie2 && !osen_ie &&
4109		    (bss->caps & IEEE80211_CAP_PRIVACY)) {
4110			ret = os_snprintf(pos, end - pos, "[WEP]");
4111			if (os_snprintf_error(end - pos, ret))
4112				return 0;
4113			pos += ret;
4114		}
4115		if (bss_is_dmg(bss)) {
4116			const char *s;
4117			ret = os_snprintf(pos, end - pos, "[DMG]");
4118			if (os_snprintf_error(end - pos, ret))
4119				return 0;
4120			pos += ret;
4121			switch (bss->caps & IEEE80211_CAP_DMG_MASK) {
4122			case IEEE80211_CAP_DMG_IBSS:
4123				s = "[IBSS]";
4124				break;
4125			case IEEE80211_CAP_DMG_AP:
4126				s = "[ESS]";
4127				break;
4128			case IEEE80211_CAP_DMG_PBSS:
4129				s = "[PBSS]";
4130				break;
4131			default:
4132				s = "";
4133				break;
4134			}
4135			ret = os_snprintf(pos, end - pos, "%s", s);
4136			if (os_snprintf_error(end - pos, ret))
4137				return 0;
4138			pos += ret;
4139		} else {
4140			if (bss->caps & IEEE80211_CAP_IBSS) {
4141				ret = os_snprintf(pos, end - pos, "[IBSS]");
4142				if (os_snprintf_error(end - pos, ret))
4143					return 0;
4144				pos += ret;
4145			}
4146			if (bss->caps & IEEE80211_CAP_ESS) {
4147				ret = os_snprintf(pos, end - pos, "[ESS]");
4148				if (os_snprintf_error(end - pos, ret))
4149					return 0;
4150				pos += ret;
4151			}
4152		}
4153		if (wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE) ||
4154		    wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE)) {
4155			ret = os_snprintf(pos, end - pos, "[P2P]");
4156			if (os_snprintf_error(end - pos, ret))
4157				return 0;
4158			pos += ret;
4159		}
4160#ifdef CONFIG_HS20
4161		if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
4162			ret = os_snprintf(pos, end - pos, "[HS20]");
4163			if (os_snprintf_error(end - pos, ret))
4164				return 0;
4165			pos += ret;
4166		}
4167#endif /* CONFIG_HS20 */
4168
4169		ret = os_snprintf(pos, end - pos, "\n");
4170		if (os_snprintf_error(end - pos, ret))
4171			return 0;
4172		pos += ret;
4173	}
4174
4175	if (mask & WPA_BSS_MASK_SSID) {
4176		ret = os_snprintf(pos, end - pos, "ssid=%s\n",
4177				  wpa_ssid_txt(bss->ssid, bss->ssid_len));
4178		if (os_snprintf_error(end - pos, ret))
4179			return 0;
4180		pos += ret;
4181	}
4182
4183#ifdef CONFIG_WPS
4184	if (mask & WPA_BSS_MASK_WPS_SCAN) {
4185		ie = (const u8 *) (bss + 1);
4186		ret = wpas_wps_scan_result_text(ie, bss->ie_len, pos, end);
4187		if (ret >= end - pos)
4188			return 0;
4189		if (ret > 0)
4190			pos += ret;
4191	}
4192#endif /* CONFIG_WPS */
4193
4194#ifdef CONFIG_P2P
4195	if (mask & WPA_BSS_MASK_P2P_SCAN) {
4196		ie = (const u8 *) (bss + 1);
4197		ret = wpas_p2p_scan_result_text(ie, bss->ie_len, pos, end);
4198		if (ret < 0 || ret >= end - pos)
4199			return 0;
4200		pos += ret;
4201	}
4202#endif /* CONFIG_P2P */
4203
4204#ifdef CONFIG_WIFI_DISPLAY
4205	if (mask & WPA_BSS_MASK_WIFI_DISPLAY) {
4206		struct wpabuf *wfd;
4207		ie = (const u8 *) (bss + 1);
4208		wfd = ieee802_11_vendor_ie_concat(ie, bss->ie_len,
4209						  WFD_IE_VENDOR_TYPE);
4210		if (wfd) {
4211			ret = os_snprintf(pos, end - pos, "wfd_subelems=");
4212			if (os_snprintf_error(end - pos, ret)) {
4213				wpabuf_free(wfd);
4214				return 0;
4215			}
4216			pos += ret;
4217
4218			pos += wpa_snprintf_hex(pos, end - pos,
4219						wpabuf_head(wfd),
4220						wpabuf_len(wfd));
4221			wpabuf_free(wfd);
4222
4223			ret = os_snprintf(pos, end - pos, "\n");
4224			if (os_snprintf_error(end - pos, ret))
4225				return 0;
4226			pos += ret;
4227		}
4228	}
4229#endif /* CONFIG_WIFI_DISPLAY */
4230
4231#ifdef CONFIG_INTERWORKING
4232	if ((mask & WPA_BSS_MASK_INTERNETW) && bss->anqp) {
4233		struct wpa_bss_anqp *anqp = bss->anqp;
4234		pos = anqp_add_hex(pos, end, "anqp_capability_list",
4235				   anqp->capability_list);
4236		pos = anqp_add_hex(pos, end, "anqp_venue_name",
4237				   anqp->venue_name);
4238		pos = anqp_add_hex(pos, end, "anqp_network_auth_type",
4239				   anqp->network_auth_type);
4240		pos = anqp_add_hex(pos, end, "anqp_roaming_consortium",
4241				   anqp->roaming_consortium);
4242		pos = anqp_add_hex(pos, end, "anqp_ip_addr_type_availability",
4243				   anqp->ip_addr_type_availability);
4244		pos = anqp_add_hex(pos, end, "anqp_nai_realm",
4245				   anqp->nai_realm);
4246		pos = anqp_add_hex(pos, end, "anqp_3gpp", anqp->anqp_3gpp);
4247		pos = anqp_add_hex(pos, end, "anqp_domain_name",
4248				   anqp->domain_name);
4249#ifdef CONFIG_HS20
4250		pos = anqp_add_hex(pos, end, "hs20_capability_list",
4251				   anqp->hs20_capability_list);
4252		pos = anqp_add_hex(pos, end, "hs20_operator_friendly_name",
4253				   anqp->hs20_operator_friendly_name);
4254		pos = anqp_add_hex(pos, end, "hs20_wan_metrics",
4255				   anqp->hs20_wan_metrics);
4256		pos = anqp_add_hex(pos, end, "hs20_connection_capability",
4257				   anqp->hs20_connection_capability);
4258		pos = anqp_add_hex(pos, end, "hs20_operating_class",
4259				   anqp->hs20_operating_class);
4260		pos = anqp_add_hex(pos, end, "hs20_osu_providers_list",
4261				   anqp->hs20_osu_providers_list);
4262#endif /* CONFIG_HS20 */
4263	}
4264#endif /* CONFIG_INTERWORKING */
4265
4266#ifdef CONFIG_MESH
4267	if (mask & WPA_BSS_MASK_MESH_SCAN) {
4268		ie = (const u8 *) (bss + 1);
4269		ret = wpas_mesh_scan_result_text(ie, bss->ie_len, pos, end);
4270		if (ret < 0 || ret >= end - pos)
4271			return 0;
4272		pos += ret;
4273	}
4274#endif /* CONFIG_MESH */
4275
4276	if (mask & WPA_BSS_MASK_SNR) {
4277		ret = os_snprintf(pos, end - pos, "snr=%d\n", bss->snr);
4278		if (os_snprintf_error(end - pos, ret))
4279			return 0;
4280		pos += ret;
4281	}
4282
4283	if (mask & WPA_BSS_MASK_EST_THROUGHPUT) {
4284		ret = os_snprintf(pos, end - pos, "est_throughput=%d\n",
4285				  bss->est_throughput);
4286		if (os_snprintf_error(end - pos, ret))
4287			return 0;
4288		pos += ret;
4289	}
4290
4291#ifdef CONFIG_FST
4292	if (mask & WPA_BSS_MASK_FST) {
4293		ret = fst_ctrl_iface_mb_info(bss->bssid, pos, end - pos);
4294		if (ret < 0 || ret >= end - pos)
4295			return 0;
4296		pos += ret;
4297	}
4298#endif /* CONFIG_FST */
4299
4300	if (mask & WPA_BSS_MASK_DELIM) {
4301		ret = os_snprintf(pos, end - pos, "====\n");
4302		if (os_snprintf_error(end - pos, ret))
4303			return 0;
4304		pos += ret;
4305	}
4306
4307	return pos - buf;
4308}
4309
4310
4311static int wpa_supplicant_ctrl_iface_bss(struct wpa_supplicant *wpa_s,
4312					 const char *cmd, char *buf,
4313					 size_t buflen)
4314{
4315	u8 bssid[ETH_ALEN];
4316	size_t i;
4317	struct wpa_bss *bss;
4318	struct wpa_bss *bsslast = NULL;
4319	struct dl_list *next;
4320	int ret = 0;
4321	int len;
4322	char *ctmp, *end = buf + buflen;
4323	unsigned long mask = WPA_BSS_MASK_ALL;
4324
4325	if (os_strncmp(cmd, "RANGE=", 6) == 0) {
4326		if (os_strncmp(cmd + 6, "ALL", 3) == 0) {
4327			bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss,
4328					    list_id);
4329			bsslast = dl_list_last(&wpa_s->bss_id, struct wpa_bss,
4330					       list_id);
4331		} else { /* N1-N2 */
4332			unsigned int id1, id2;
4333
4334			if ((ctmp = os_strchr(cmd + 6, '-')) == NULL) {
4335				wpa_printf(MSG_INFO, "Wrong BSS range "
4336					   "format");
4337				return 0;
4338			}
4339
4340			if (*(cmd + 6) == '-')
4341				id1 = 0;
4342			else
4343				id1 = atoi(cmd + 6);
4344			ctmp++;
4345			if (*ctmp >= '0' && *ctmp <= '9')
4346				id2 = atoi(ctmp);
4347			else
4348				id2 = (unsigned int) -1;
4349			bss = wpa_bss_get_id_range(wpa_s, id1, id2);
4350			if (id2 == (unsigned int) -1)
4351				bsslast = dl_list_last(&wpa_s->bss_id,
4352						       struct wpa_bss,
4353						       list_id);
4354			else {
4355				bsslast = wpa_bss_get_id(wpa_s, id2);
4356				if (bsslast == NULL && bss && id2 > id1) {
4357					struct wpa_bss *tmp = bss;
4358					for (;;) {
4359						next = tmp->list_id.next;
4360						if (next == &wpa_s->bss_id)
4361							break;
4362						tmp = dl_list_entry(
4363							next, struct wpa_bss,
4364							list_id);
4365						if (tmp->id > id2)
4366							break;
4367						bsslast = tmp;
4368					}
4369				}
4370			}
4371		}
4372	} else if (os_strncmp(cmd, "FIRST", 5) == 0)
4373		bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss, list_id);
4374	else if (os_strncmp(cmd, "LAST", 4) == 0)
4375		bss = dl_list_last(&wpa_s->bss_id, struct wpa_bss, list_id);
4376	else if (os_strncmp(cmd, "ID-", 3) == 0) {
4377		i = atoi(cmd + 3);
4378		bss = wpa_bss_get_id(wpa_s, i);
4379	} else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
4380		i = atoi(cmd + 5);
4381		bss = wpa_bss_get_id(wpa_s, i);
4382		if (bss) {
4383			next = bss->list_id.next;
4384			if (next == &wpa_s->bss_id)
4385				bss = NULL;
4386			else
4387				bss = dl_list_entry(next, struct wpa_bss,
4388						    list_id);
4389		}
4390#ifdef CONFIG_P2P
4391	} else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
4392		if (hwaddr_aton(cmd + 13, bssid) == 0)
4393			bss = wpa_bss_get_p2p_dev_addr(wpa_s, bssid);
4394		else
4395			bss = NULL;
4396#endif /* CONFIG_P2P */
4397	} else if (hwaddr_aton(cmd, bssid) == 0)
4398		bss = wpa_bss_get_bssid(wpa_s, bssid);
4399	else {
4400		struct wpa_bss *tmp;
4401		i = atoi(cmd);
4402		bss = NULL;
4403		dl_list_for_each(tmp, &wpa_s->bss_id, struct wpa_bss, list_id)
4404		{
4405			if (i-- == 0) {
4406				bss = tmp;
4407				break;
4408			}
4409		}
4410	}
4411
4412	if ((ctmp = os_strstr(cmd, "MASK=")) != NULL) {
4413		mask = strtoul(ctmp + 5, NULL, 0x10);
4414		if (mask == 0)
4415			mask = WPA_BSS_MASK_ALL;
4416	}
4417
4418	if (bss == NULL)
4419		return 0;
4420
4421	if (bsslast == NULL)
4422		bsslast = bss;
4423	do {
4424		len = print_bss_info(wpa_s, bss, mask, buf, buflen);
4425		ret += len;
4426		buf += len;
4427		buflen -= len;
4428		if (bss == bsslast) {
4429			if ((mask & WPA_BSS_MASK_DELIM) && len &&
4430			    (bss == dl_list_last(&wpa_s->bss_id,
4431						 struct wpa_bss, list_id))) {
4432				int res;
4433
4434				res = os_snprintf(buf - 5, end - buf + 5,
4435						  "####\n");
4436				if (os_snprintf_error(end - buf + 5, res)) {
4437					wpa_printf(MSG_DEBUG,
4438						   "Could not add end delim");
4439				}
4440			}
4441			break;
4442		}
4443		next = bss->list_id.next;
4444		if (next == &wpa_s->bss_id)
4445			break;
4446		bss = dl_list_entry(next, struct wpa_bss, list_id);
4447	} while (bss && len);
4448
4449	return ret;
4450}
4451
4452
4453static int wpa_supplicant_ctrl_iface_ap_scan(
4454	struct wpa_supplicant *wpa_s, char *cmd)
4455{
4456	int ap_scan = atoi(cmd);
4457	return wpa_supplicant_set_ap_scan(wpa_s, ap_scan);
4458}
4459
4460
4461static int wpa_supplicant_ctrl_iface_scan_interval(
4462	struct wpa_supplicant *wpa_s, char *cmd)
4463{
4464	int scan_int = atoi(cmd);
4465	return wpa_supplicant_set_scan_interval(wpa_s, scan_int);
4466}
4467
4468
4469static int wpa_supplicant_ctrl_iface_bss_expire_age(
4470	struct wpa_supplicant *wpa_s, char *cmd)
4471{
4472	int expire_age = atoi(cmd);
4473	return wpa_supplicant_set_bss_expiration_age(wpa_s, expire_age);
4474}
4475
4476
4477static int wpa_supplicant_ctrl_iface_bss_expire_count(
4478	struct wpa_supplicant *wpa_s, char *cmd)
4479{
4480	int expire_count = atoi(cmd);
4481	return wpa_supplicant_set_bss_expiration_count(wpa_s, expire_count);
4482}
4483
4484
4485static void wpa_supplicant_ctrl_iface_bss_flush(
4486	struct wpa_supplicant *wpa_s, char *cmd)
4487{
4488	int flush_age = atoi(cmd);
4489
4490	if (flush_age == 0)
4491		wpa_bss_flush(wpa_s);
4492	else
4493		wpa_bss_flush_by_age(wpa_s, flush_age);
4494}
4495
4496
4497#ifdef CONFIG_TESTING_OPTIONS
4498static void wpa_supplicant_ctrl_iface_drop_sa(struct wpa_supplicant *wpa_s)
4499{
4500	wpa_printf(MSG_DEBUG, "Dropping SA without deauthentication");
4501	/* MLME-DELETEKEYS.request */
4502	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 0, 0, NULL, 0, NULL, 0);
4503	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 1, 0, NULL, 0, NULL, 0);
4504	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 2, 0, NULL, 0, NULL, 0);
4505	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 3, 0, NULL, 0, NULL, 0);
4506#ifdef CONFIG_IEEE80211W
4507	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 4, 0, NULL, 0, NULL, 0);
4508	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 5, 0, NULL, 0, NULL, 0);
4509#endif /* CONFIG_IEEE80211W */
4510
4511	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, wpa_s->bssid, 0, 0, NULL, 0, NULL,
4512			0);
4513	/* MLME-SETPROTECTION.request(None) */
4514	wpa_drv_mlme_setprotection(wpa_s, wpa_s->bssid,
4515				   MLME_SETPROTECTION_PROTECT_TYPE_NONE,
4516				   MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
4517	wpa_sm_drop_sa(wpa_s->wpa);
4518}
4519#endif /* CONFIG_TESTING_OPTIONS */
4520
4521
4522static int wpa_supplicant_ctrl_iface_roam(struct wpa_supplicant *wpa_s,
4523					  char *addr)
4524{
4525#ifdef CONFIG_NO_SCAN_PROCESSING
4526	return -1;
4527#else /* CONFIG_NO_SCAN_PROCESSING */
4528	u8 bssid[ETH_ALEN];
4529	struct wpa_bss *bss;
4530	struct wpa_ssid *ssid = wpa_s->current_ssid;
4531
4532	if (hwaddr_aton(addr, bssid)) {
4533		wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: invalid "
4534			   "address '%s'", addr);
4535		return -1;
4536	}
4537
4538	wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM " MACSTR, MAC2STR(bssid));
4539
4540	if (!ssid) {
4541		wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: No network "
4542			   "configuration known for the target AP");
4543		return -1;
4544	}
4545
4546	bss = wpa_bss_get(wpa_s, bssid, ssid->ssid, ssid->ssid_len);
4547	if (!bss) {
4548		wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: Target AP not found "
4549			   "from BSS table");
4550		return -1;
4551	}
4552
4553	/*
4554	 * TODO: Find best network configuration block from configuration to
4555	 * allow roaming to other networks
4556	 */
4557
4558	wpa_s->reassociate = 1;
4559	wpa_supplicant_connect(wpa_s, bss, ssid);
4560
4561	return 0;
4562#endif /* CONFIG_NO_SCAN_PROCESSING */
4563}
4564
4565
4566#ifdef CONFIG_P2P
4567static int p2p_ctrl_find(struct wpa_supplicant *wpa_s, char *cmd)
4568{
4569	unsigned int timeout = atoi(cmd);
4570	enum p2p_discovery_type type = P2P_FIND_START_WITH_FULL;
4571	u8 dev_id[ETH_ALEN], *_dev_id = NULL;
4572	u8 dev_type[WPS_DEV_TYPE_LEN], *_dev_type = NULL;
4573	char *pos;
4574	unsigned int search_delay;
4575	const char *_seek[P2P_MAX_QUERY_HASH + 1], **seek = NULL;
4576	u8 seek_count = 0;
4577	int freq = 0;
4578
4579	if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
4580		wpa_dbg(wpa_s, MSG_INFO,
4581			"Reject P2P_FIND since interface is disabled");
4582		return -1;
4583	}
4584	if (os_strstr(cmd, "type=social"))
4585		type = P2P_FIND_ONLY_SOCIAL;
4586	else if (os_strstr(cmd, "type=progressive"))
4587		type = P2P_FIND_PROGRESSIVE;
4588
4589	pos = os_strstr(cmd, "dev_id=");
4590	if (pos) {
4591		pos += 7;
4592		if (hwaddr_aton(pos, dev_id))
4593			return -1;
4594		_dev_id = dev_id;
4595	}
4596
4597	pos = os_strstr(cmd, "dev_type=");
4598	if (pos) {
4599		pos += 9;
4600		if (wps_dev_type_str2bin(pos, dev_type) < 0)
4601			return -1;
4602		_dev_type = dev_type;
4603	}
4604
4605	pos = os_strstr(cmd, "delay=");
4606	if (pos) {
4607		pos += 6;
4608		search_delay = atoi(pos);
4609	} else
4610		search_delay = wpas_p2p_search_delay(wpa_s);
4611
4612	pos = os_strstr(cmd, "freq=");
4613	if (pos) {
4614		pos += 5;
4615		freq = atoi(pos);
4616		if (freq <= 0)
4617			return -1;
4618	}
4619
4620	/* Must be searched for last, because it adds nul termination */
4621	pos = os_strstr(cmd, " seek=");
4622	if (pos)
4623		pos += 6;
4624	while (pos && seek_count < P2P_MAX_QUERY_HASH + 1) {
4625		char *term;
4626
4627		_seek[seek_count++] = pos;
4628		seek = _seek;
4629		term = os_strchr(pos, ' ');
4630		if (!term)
4631			break;
4632		*term = '\0';
4633		pos = os_strstr(term + 1, "seek=");
4634		if (pos)
4635			pos += 5;
4636	}
4637	if (seek_count > P2P_MAX_QUERY_HASH) {
4638		seek[0] = NULL;
4639		seek_count = 1;
4640	}
4641
4642	return wpas_p2p_find(wpa_s, timeout, type, _dev_type != NULL, _dev_type,
4643			     _dev_id, search_delay, seek_count, seek, freq);
4644}
4645
4646
4647static int p2ps_ctrl_parse_cpt_priority(const char *pos, u8 *cpt)
4648{
4649	const char *last = NULL;
4650	const char *token;
4651	long int token_len;
4652	unsigned int i;
4653
4654	/* Expected predefined CPT names delimited by ':' */
4655	for (i = 0; (token = cstr_token(pos, ": \t", &last)); i++) {
4656		if (i >= P2PS_FEATURE_CAPAB_CPT_MAX) {
4657			wpa_printf(MSG_ERROR,
4658				   "P2PS: CPT name list is too long, expected up to %d names",
4659				   P2PS_FEATURE_CAPAB_CPT_MAX);
4660			cpt[0] = 0;
4661			return -1;
4662		}
4663
4664		token_len = last - token;
4665
4666		if (token_len  == 3 &&
4667		    os_memcmp(token, "UDP", token_len) == 0) {
4668			cpt[i] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
4669		} else if (token_len == 3 &&
4670			   os_memcmp(token, "MAC", token_len) == 0) {
4671			cpt[i] = P2PS_FEATURE_CAPAB_MAC_TRANSPORT;
4672		} else {
4673			wpa_printf(MSG_ERROR,
4674				   "P2PS: Unsupported CPT name '%s'", token);
4675			cpt[0] = 0;
4676			return -1;
4677		}
4678
4679		if (isblank(*last)) {
4680			i++;
4681			break;
4682		}
4683	}
4684	cpt[i] = 0;
4685	return 0;
4686}
4687
4688
4689static struct p2ps_provision * p2p_parse_asp_provision_cmd(const char *cmd)
4690{
4691	struct p2ps_provision *p2ps_prov;
4692	char *pos;
4693	size_t info_len = 0;
4694	char *info = NULL;
4695	u8 role = P2PS_SETUP_NONE;
4696	long long unsigned val;
4697	int i;
4698
4699	pos = os_strstr(cmd, "info=");
4700	if (pos) {
4701		pos += 5;
4702		info_len = os_strlen(pos);
4703
4704		if (info_len) {
4705			info = os_malloc(info_len + 1);
4706			if (info) {
4707				info_len = utf8_unescape(pos, info_len,
4708							 info, info_len + 1);
4709			} else
4710				info_len = 0;
4711		}
4712	}
4713
4714	p2ps_prov = os_zalloc(sizeof(struct p2ps_provision) + info_len + 1);
4715	if (p2ps_prov == NULL) {
4716		os_free(info);
4717		return NULL;
4718	}
4719
4720	if (info) {
4721		os_memcpy(p2ps_prov->info, info, info_len);
4722		p2ps_prov->info[info_len] = '\0';
4723		os_free(info);
4724	}
4725
4726	pos = os_strstr(cmd, "status=");
4727	if (pos)
4728		p2ps_prov->status = atoi(pos + 7);
4729	else
4730		p2ps_prov->status = -1;
4731
4732	pos = os_strstr(cmd, "adv_id=");
4733	if (!pos || sscanf(pos + 7, "%llx", &val) != 1 || val > 0xffffffffULL)
4734		goto invalid_args;
4735	p2ps_prov->adv_id = val;
4736
4737	pos = os_strstr(cmd, "method=");
4738	if (pos)
4739		p2ps_prov->method = strtol(pos + 7, NULL, 16);
4740	else
4741		p2ps_prov->method = 0;
4742
4743	pos = os_strstr(cmd, "session=");
4744	if (!pos || sscanf(pos + 8, "%llx", &val) != 1 || val > 0xffffffffULL)
4745		goto invalid_args;
4746	p2ps_prov->session_id = val;
4747
4748	pos = os_strstr(cmd, "adv_mac=");
4749	if (!pos || hwaddr_aton(pos + 8, p2ps_prov->adv_mac))
4750		goto invalid_args;
4751
4752	pos = os_strstr(cmd, "session_mac=");
4753	if (!pos || hwaddr_aton(pos + 12, p2ps_prov->session_mac))
4754		goto invalid_args;
4755
4756	pos = os_strstr(cmd, "cpt=");
4757	if (pos) {
4758		if (p2ps_ctrl_parse_cpt_priority(pos + 4,
4759						 p2ps_prov->cpt_priority))
4760			goto invalid_args;
4761	} else {
4762		p2ps_prov->cpt_priority[0] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
4763	}
4764
4765	for (i = 0; p2ps_prov->cpt_priority[i]; i++)
4766		p2ps_prov->cpt_mask |= p2ps_prov->cpt_priority[i];
4767
4768	/* force conncap with tstCap (no sanity checks) */
4769	pos = os_strstr(cmd, "tstCap=");
4770	if (pos) {
4771		role = strtol(pos + 7, NULL, 16);
4772	} else {
4773		pos = os_strstr(cmd, "role=");
4774		if (pos) {
4775			role = strtol(pos + 5, NULL, 16);
4776			if (role != P2PS_SETUP_CLIENT &&
4777			    role != P2PS_SETUP_GROUP_OWNER)
4778				role = P2PS_SETUP_NONE;
4779		}
4780	}
4781	p2ps_prov->role = role;
4782
4783	return p2ps_prov;
4784
4785invalid_args:
4786	os_free(p2ps_prov);
4787	return NULL;
4788}
4789
4790
4791static int p2p_ctrl_asp_provision_resp(struct wpa_supplicant *wpa_s, char *cmd)
4792{
4793	u8 addr[ETH_ALEN];
4794	struct p2ps_provision *p2ps_prov;
4795	char *pos;
4796
4797	/* <addr> id=<adv_id> [role=<conncap>] [info=<infodata>] */
4798
4799	wpa_printf(MSG_DEBUG, "%s: %s", __func__, cmd);
4800
4801	if (hwaddr_aton(cmd, addr))
4802		return -1;
4803
4804	pos = cmd + 17;
4805	if (*pos != ' ')
4806		return -1;
4807
4808	p2ps_prov = p2p_parse_asp_provision_cmd(pos);
4809	if (!p2ps_prov)
4810		return -1;
4811
4812	if (p2ps_prov->status < 0) {
4813		os_free(p2ps_prov);
4814		return -1;
4815	}
4816
4817	return wpas_p2p_prov_disc(wpa_s, addr, NULL, WPAS_P2P_PD_FOR_ASP,
4818				  p2ps_prov);
4819}
4820
4821
4822static int p2p_ctrl_asp_provision(struct wpa_supplicant *wpa_s, char *cmd)
4823{
4824	u8 addr[ETH_ALEN];
4825	struct p2ps_provision *p2ps_prov;
4826	char *pos;
4827
4828	/* <addr> id=<adv_id> adv_mac=<adv_mac> conncap=<conncap>
4829	 *        session=<ses_id> mac=<ses_mac> [info=<infodata>]
4830	 */
4831
4832	wpa_printf(MSG_DEBUG, "%s: %s", __func__, cmd);
4833	if (hwaddr_aton(cmd, addr))
4834		return -1;
4835
4836	pos = cmd + 17;
4837	if (*pos != ' ')
4838		return -1;
4839
4840	p2ps_prov = p2p_parse_asp_provision_cmd(pos);
4841	if (!p2ps_prov)
4842		return -1;
4843
4844	p2ps_prov->pd_seeker = 1;
4845
4846	return wpas_p2p_prov_disc(wpa_s, addr, NULL, WPAS_P2P_PD_FOR_ASP,
4847				  p2ps_prov);
4848}
4849
4850
4851static int p2p_ctrl_connect(struct wpa_supplicant *wpa_s, char *cmd,
4852			    char *buf, size_t buflen)
4853{
4854	u8 addr[ETH_ALEN];
4855	char *pos, *pos2;
4856	char *pin = NULL;
4857	enum p2p_wps_method wps_method;
4858	int new_pin;
4859	int ret;
4860	int persistent_group, persistent_id = -1;
4861	int join;
4862	int auth;
4863	int automatic;
4864	int go_intent = -1;
4865	int freq = 0;
4866	int pd;
4867	int ht40, vht;
4868
4869	if (!wpa_s->global->p2p_init_wpa_s)
4870		return -1;
4871	if (wpa_s->global->p2p_init_wpa_s != wpa_s) {
4872		wpa_dbg(wpa_s, MSG_DEBUG, "Direct P2P_CONNECT command to %s",
4873			wpa_s->global->p2p_init_wpa_s->ifname);
4874		wpa_s = wpa_s->global->p2p_init_wpa_s;
4875	}
4876
4877	/* <addr> <"pbc" | "pin" | PIN> [label|display|keypad|p2ps]
4878	 * [persistent|persistent=<network id>]
4879	 * [join] [auth] [go_intent=<0..15>] [freq=<in MHz>] [provdisc]
4880	 * [ht40] [vht] [auto] */
4881
4882	if (hwaddr_aton(cmd, addr))
4883		return -1;
4884
4885	pos = cmd + 17;
4886	if (*pos != ' ')
4887		return -1;
4888	pos++;
4889
4890	persistent_group = os_strstr(pos, " persistent") != NULL;
4891	pos2 = os_strstr(pos, " persistent=");
4892	if (pos2) {
4893		struct wpa_ssid *ssid;
4894		persistent_id = atoi(pos2 + 12);
4895		ssid = wpa_config_get_network(wpa_s->conf, persistent_id);
4896		if (ssid == NULL || ssid->disabled != 2 ||
4897		    ssid->mode != WPAS_MODE_P2P_GO) {
4898			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
4899				   "SSID id=%d for persistent P2P group (GO)",
4900				   persistent_id);
4901			return -1;
4902		}
4903	}
4904	join = os_strstr(pos, " join") != NULL;
4905	auth = os_strstr(pos, " auth") != NULL;
4906	automatic = os_strstr(pos, " auto") != NULL;
4907	pd = os_strstr(pos, " provdisc") != NULL;
4908	vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
4909	ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
4910		vht;
4911
4912	pos2 = os_strstr(pos, " go_intent=");
4913	if (pos2) {
4914		pos2 += 11;
4915		go_intent = atoi(pos2);
4916		if (go_intent < 0 || go_intent > 15)
4917			return -1;
4918	}
4919
4920	pos2 = os_strstr(pos, " freq=");
4921	if (pos2) {
4922		pos2 += 6;
4923		freq = atoi(pos2);
4924		if (freq <= 0)
4925			return -1;
4926	}
4927
4928	if (os_strncmp(pos, "pin", 3) == 0) {
4929		/* Request random PIN (to be displayed) and enable the PIN */
4930		wps_method = WPS_PIN_DISPLAY;
4931	} else if (os_strncmp(pos, "pbc", 3) == 0) {
4932		wps_method = WPS_PBC;
4933	} else {
4934		pin = pos;
4935		pos = os_strchr(pin, ' ');
4936		wps_method = WPS_PIN_KEYPAD;
4937		if (pos) {
4938			*pos++ = '\0';
4939			if (os_strncmp(pos, "display", 7) == 0)
4940				wps_method = WPS_PIN_DISPLAY;
4941			else if (os_strncmp(pos, "p2ps", 4) == 0)
4942				wps_method = WPS_P2PS;
4943		}
4944		if (!wps_pin_str_valid(pin)) {
4945			os_memcpy(buf, "FAIL-INVALID-PIN\n", 17);
4946			return 17;
4947		}
4948	}
4949
4950	new_pin = wpas_p2p_connect(wpa_s, addr, pin, wps_method,
4951				   persistent_group, automatic, join,
4952				   auth, go_intent, freq, persistent_id, pd,
4953				   ht40, vht);
4954	if (new_pin == -2) {
4955		os_memcpy(buf, "FAIL-CHANNEL-UNAVAILABLE\n", 25);
4956		return 25;
4957	}
4958	if (new_pin == -3) {
4959		os_memcpy(buf, "FAIL-CHANNEL-UNSUPPORTED\n", 25);
4960		return 25;
4961	}
4962	if (new_pin < 0)
4963		return -1;
4964	if (wps_method == WPS_PIN_DISPLAY && pin == NULL) {
4965		ret = os_snprintf(buf, buflen, "%08d", new_pin);
4966		if (os_snprintf_error(buflen, ret))
4967			return -1;
4968		return ret;
4969	}
4970
4971	os_memcpy(buf, "OK\n", 3);
4972	return 3;
4973}
4974
4975
4976static int p2p_ctrl_listen(struct wpa_supplicant *wpa_s, char *cmd)
4977{
4978	unsigned int timeout = atoi(cmd);
4979	if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
4980		wpa_dbg(wpa_s, MSG_INFO,
4981			"Reject P2P_LISTEN since interface is disabled");
4982		return -1;
4983	}
4984	return wpas_p2p_listen(wpa_s, timeout);
4985}
4986
4987
4988static int p2p_ctrl_prov_disc(struct wpa_supplicant *wpa_s, char *cmd)
4989{
4990	u8 addr[ETH_ALEN];
4991	char *pos;
4992	enum wpas_p2p_prov_disc_use use = WPAS_P2P_PD_FOR_GO_NEG;
4993
4994	/* <addr> <config method> [join|auto] */
4995
4996	if (hwaddr_aton(cmd, addr))
4997		return -1;
4998
4999	pos = cmd + 17;
5000	if (*pos != ' ')
5001		return -1;
5002	pos++;
5003
5004	if (os_strstr(pos, " join") != NULL)
5005		use = WPAS_P2P_PD_FOR_JOIN;
5006	else if (os_strstr(pos, " auto") != NULL)
5007		use = WPAS_P2P_PD_AUTO;
5008
5009	return wpas_p2p_prov_disc(wpa_s, addr, pos, use, NULL);
5010}
5011
5012
5013static int p2p_get_passphrase(struct wpa_supplicant *wpa_s, char *buf,
5014			      size_t buflen)
5015{
5016	struct wpa_ssid *ssid = wpa_s->current_ssid;
5017
5018	if (ssid == NULL || ssid->mode != WPAS_MODE_P2P_GO ||
5019	    ssid->passphrase == NULL)
5020		return -1;
5021
5022	os_strlcpy(buf, ssid->passphrase, buflen);
5023	return os_strlen(buf);
5024}
5025
5026
5027static int p2p_ctrl_serv_disc_req(struct wpa_supplicant *wpa_s, char *cmd,
5028				  char *buf, size_t buflen)
5029{
5030	u64 ref;
5031	int res;
5032	u8 dst_buf[ETH_ALEN], *dst;
5033	struct wpabuf *tlvs;
5034	char *pos;
5035	size_t len;
5036
5037	if (hwaddr_aton(cmd, dst_buf))
5038		return -1;
5039	dst = dst_buf;
5040	if (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
5041	    dst[3] == 0 && dst[4] == 0 && dst[5] == 0)
5042		dst = NULL;
5043	pos = cmd + 17;
5044	if (*pos != ' ')
5045		return -1;
5046	pos++;
5047
5048	if (os_strncmp(pos, "upnp ", 5) == 0) {
5049		u8 version;
5050		pos += 5;
5051		if (hexstr2bin(pos, &version, 1) < 0)
5052			return -1;
5053		pos += 2;
5054		if (*pos != ' ')
5055			return -1;
5056		pos++;
5057		ref = wpas_p2p_sd_request_upnp(wpa_s, dst, version, pos);
5058#ifdef CONFIG_WIFI_DISPLAY
5059	} else if (os_strncmp(pos, "wifi-display ", 13) == 0) {
5060		ref = wpas_p2p_sd_request_wifi_display(wpa_s, dst, pos + 13);
5061#endif /* CONFIG_WIFI_DISPLAY */
5062	} else if (os_strncmp(pos, "asp ", 4) == 0) {
5063		char *svc_str;
5064		char *svc_info = NULL;
5065		u32 id;
5066
5067		pos += 4;
5068		if (sscanf(pos, "%x", &id) != 1 || id > 0xff)
5069			return -1;
5070
5071		pos = os_strchr(pos, ' ');
5072		if (pos == NULL || pos[1] == '\0' || pos[1] == ' ')
5073			return -1;
5074
5075		svc_str = pos + 1;
5076
5077		pos = os_strchr(svc_str, ' ');
5078
5079		if (pos)
5080			*pos++ = '\0';
5081
5082		/* All remaining data is the svc_info string */
5083		if (pos && pos[0] && pos[0] != ' ') {
5084			len = os_strlen(pos);
5085
5086			/* Unescape in place */
5087			len = utf8_unescape(pos, len, pos, len);
5088			if (len > 0xff)
5089				return -1;
5090
5091			svc_info = pos;
5092		}
5093
5094		ref = wpas_p2p_sd_request_asp(wpa_s, dst, (u8) id,
5095					      svc_str, svc_info);
5096	} else {
5097		len = os_strlen(pos);
5098		if (len & 1)
5099			return -1;
5100		len /= 2;
5101		tlvs = wpabuf_alloc(len);
5102		if (tlvs == NULL)
5103			return -1;
5104		if (hexstr2bin(pos, wpabuf_put(tlvs, len), len) < 0) {
5105			wpabuf_free(tlvs);
5106			return -1;
5107		}
5108
5109		ref = wpas_p2p_sd_request(wpa_s, dst, tlvs);
5110		wpabuf_free(tlvs);
5111	}
5112	if (ref == 0)
5113		return -1;
5114	res = os_snprintf(buf, buflen, "%llx", (long long unsigned) ref);
5115	if (os_snprintf_error(buflen, res))
5116		return -1;
5117	return res;
5118}
5119
5120
5121static int p2p_ctrl_serv_disc_cancel_req(struct wpa_supplicant *wpa_s,
5122					 char *cmd)
5123{
5124	long long unsigned val;
5125	u64 req;
5126	if (sscanf(cmd, "%llx", &val) != 1)
5127		return -1;
5128	req = val;
5129	return wpas_p2p_sd_cancel_request(wpa_s, req);
5130}
5131
5132
5133static int p2p_ctrl_serv_disc_resp(struct wpa_supplicant *wpa_s, char *cmd)
5134{
5135	int freq;
5136	u8 dst[ETH_ALEN];
5137	u8 dialog_token;
5138	struct wpabuf *resp_tlvs;
5139	char *pos, *pos2;
5140	size_t len;
5141
5142	pos = os_strchr(cmd, ' ');
5143	if (pos == NULL)
5144		return -1;
5145	*pos++ = '\0';
5146	freq = atoi(cmd);
5147	if (freq == 0)
5148		return -1;
5149
5150	if (hwaddr_aton(pos, dst))
5151		return -1;
5152	pos += 17;
5153	if (*pos != ' ')
5154		return -1;
5155	pos++;
5156
5157	pos2 = os_strchr(pos, ' ');
5158	if (pos2 == NULL)
5159		return -1;
5160	*pos2++ = '\0';
5161	dialog_token = atoi(pos);
5162
5163	len = os_strlen(pos2);
5164	if (len & 1)
5165		return -1;
5166	len /= 2;
5167	resp_tlvs = wpabuf_alloc(len);
5168	if (resp_tlvs == NULL)
5169		return -1;
5170	if (hexstr2bin(pos2, wpabuf_put(resp_tlvs, len), len) < 0) {
5171		wpabuf_free(resp_tlvs);
5172		return -1;
5173	}
5174
5175	wpas_p2p_sd_response(wpa_s, freq, dst, dialog_token, resp_tlvs);
5176	wpabuf_free(resp_tlvs);
5177	return 0;
5178}
5179
5180
5181static int p2p_ctrl_serv_disc_external(struct wpa_supplicant *wpa_s,
5182				       char *cmd)
5183{
5184	if (os_strcmp(cmd, "0") && os_strcmp(cmd, "1"))
5185		return -1;
5186	wpa_s->p2p_sd_over_ctrl_iface = atoi(cmd);
5187	return 0;
5188}
5189
5190
5191static int p2p_ctrl_service_add_bonjour(struct wpa_supplicant *wpa_s,
5192					char *cmd)
5193{
5194	char *pos;
5195	size_t len;
5196	struct wpabuf *query, *resp;
5197
5198	pos = os_strchr(cmd, ' ');
5199	if (pos == NULL)
5200		return -1;
5201	*pos++ = '\0';
5202
5203	len = os_strlen(cmd);
5204	if (len & 1)
5205		return -1;
5206	len /= 2;
5207	query = wpabuf_alloc(len);
5208	if (query == NULL)
5209		return -1;
5210	if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
5211		wpabuf_free(query);
5212		return -1;
5213	}
5214
5215	len = os_strlen(pos);
5216	if (len & 1) {
5217		wpabuf_free(query);
5218		return -1;
5219	}
5220	len /= 2;
5221	resp = wpabuf_alloc(len);
5222	if (resp == NULL) {
5223		wpabuf_free(query);
5224		return -1;
5225	}
5226	if (hexstr2bin(pos, wpabuf_put(resp, len), len) < 0) {
5227		wpabuf_free(query);
5228		wpabuf_free(resp);
5229		return -1;
5230	}
5231
5232	if (wpas_p2p_service_add_bonjour(wpa_s, query, resp) < 0) {
5233		wpabuf_free(query);
5234		wpabuf_free(resp);
5235		return -1;
5236	}
5237	return 0;
5238}
5239
5240
5241static int p2p_ctrl_service_add_upnp(struct wpa_supplicant *wpa_s, char *cmd)
5242{
5243	char *pos;
5244	u8 version;
5245
5246	pos = os_strchr(cmd, ' ');
5247	if (pos == NULL)
5248		return -1;
5249	*pos++ = '\0';
5250
5251	if (hexstr2bin(cmd, &version, 1) < 0)
5252		return -1;
5253
5254	return wpas_p2p_service_add_upnp(wpa_s, version, pos);
5255}
5256
5257
5258static int p2p_ctrl_service_add_asp(struct wpa_supplicant *wpa_s,
5259				    u8 replace, char *cmd)
5260{
5261	char *pos;
5262	char *adv_str;
5263	u32 auto_accept, adv_id, svc_state, config_methods;
5264	char *svc_info = NULL;
5265	char *cpt_prio_str;
5266	u8 cpt_prio[P2PS_FEATURE_CAPAB_CPT_MAX + 1];
5267
5268	pos = os_strchr(cmd, ' ');
5269	if (pos == NULL)
5270		return -1;
5271	*pos++ = '\0';
5272
5273	/* Auto-Accept value is mandatory, and must be one of the
5274	 * single values (0, 1, 2, 4) */
5275	auto_accept = atoi(cmd);
5276	switch (auto_accept) {
5277	case P2PS_SETUP_NONE: /* No auto-accept */
5278	case P2PS_SETUP_NEW:
5279	case P2PS_SETUP_CLIENT:
5280	case P2PS_SETUP_GROUP_OWNER:
5281		break;
5282	default:
5283		return -1;
5284	}
5285
5286	/* Advertisement ID is mandatory */
5287	cmd = pos;
5288	pos = os_strchr(cmd, ' ');
5289	if (pos == NULL)
5290		return -1;
5291	*pos++ = '\0';
5292
5293	/* Handle Adv_ID == 0 (wildcard "org.wi-fi.wfds") internally. */
5294	if (sscanf(cmd, "%x", &adv_id) != 1 || adv_id == 0)
5295		return -1;
5296
5297	/* Only allow replacements if exist, and adds if not */
5298	if (wpas_p2p_service_p2ps_id_exists(wpa_s, adv_id)) {
5299		if (!replace)
5300			return -1;
5301	} else {
5302		if (replace)
5303			return -1;
5304	}
5305
5306	/* svc_state between 0 - 0xff is mandatory */
5307	if (sscanf(pos, "%x", &svc_state) != 1 || svc_state > 0xff)
5308		return -1;
5309
5310	pos = os_strchr(pos, ' ');
5311	if (pos == NULL)
5312		return -1;
5313
5314	/* config_methods is mandatory */
5315	pos++;
5316	if (sscanf(pos, "%x", &config_methods) != 1)
5317		return -1;
5318
5319	if (!(config_methods &
5320	      (WPS_CONFIG_DISPLAY | WPS_CONFIG_KEYPAD | WPS_CONFIG_P2PS)))
5321		return -1;
5322
5323	pos = os_strchr(pos, ' ');
5324	if (pos == NULL)
5325		return -1;
5326
5327	pos++;
5328	adv_str = pos;
5329
5330	/* Advertisement string is mandatory */
5331	if (!pos[0] || pos[0] == ' ')
5332		return -1;
5333
5334	/* Terminate svc string */
5335	pos = os_strchr(pos, ' ');
5336	if (pos != NULL)
5337		*pos++ = '\0';
5338
5339	cpt_prio_str = (pos && pos[0]) ? os_strstr(pos, "cpt=") : NULL;
5340	if (cpt_prio_str) {
5341		pos = os_strchr(pos, ' ');
5342		if (pos != NULL)
5343			*pos++ = '\0';
5344
5345		if (p2ps_ctrl_parse_cpt_priority(cpt_prio_str + 4, cpt_prio))
5346			return -1;
5347	} else {
5348		cpt_prio[0] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
5349		cpt_prio[1] = 0;
5350	}
5351
5352	/* Service and Response Information are optional */
5353	if (pos && pos[0]) {
5354		size_t len;
5355
5356		/* Note the bare ' included, which cannot exist legally
5357		 * in unescaped string. */
5358		svc_info = os_strstr(pos, "svc_info='");
5359
5360		if (svc_info) {
5361			svc_info += 9;
5362			len = os_strlen(svc_info);
5363			utf8_unescape(svc_info, len, svc_info, len);
5364		}
5365	}
5366
5367	return wpas_p2p_service_add_asp(wpa_s, auto_accept, adv_id, adv_str,
5368					(u8) svc_state, (u16) config_methods,
5369					svc_info, cpt_prio);
5370}
5371
5372
5373static int p2p_ctrl_service_add(struct wpa_supplicant *wpa_s, char *cmd)
5374{
5375	char *pos;
5376
5377	pos = os_strchr(cmd, ' ');
5378	if (pos == NULL)
5379		return -1;
5380	*pos++ = '\0';
5381
5382	if (os_strcmp(cmd, "bonjour") == 0)
5383		return p2p_ctrl_service_add_bonjour(wpa_s, pos);
5384	if (os_strcmp(cmd, "upnp") == 0)
5385		return p2p_ctrl_service_add_upnp(wpa_s, pos);
5386	if (os_strcmp(cmd, "asp") == 0)
5387		return p2p_ctrl_service_add_asp(wpa_s, 0, pos);
5388	wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
5389	return -1;
5390}
5391
5392
5393static int p2p_ctrl_service_del_bonjour(struct wpa_supplicant *wpa_s,
5394					char *cmd)
5395{
5396	size_t len;
5397	struct wpabuf *query;
5398	int ret;
5399
5400	len = os_strlen(cmd);
5401	if (len & 1)
5402		return -1;
5403	len /= 2;
5404	query = wpabuf_alloc(len);
5405	if (query == NULL)
5406		return -1;
5407	if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
5408		wpabuf_free(query);
5409		return -1;
5410	}
5411
5412	ret = wpas_p2p_service_del_bonjour(wpa_s, query);
5413	wpabuf_free(query);
5414	return ret;
5415}
5416
5417
5418static int p2p_ctrl_service_del_upnp(struct wpa_supplicant *wpa_s, char *cmd)
5419{
5420	char *pos;
5421	u8 version;
5422
5423	pos = os_strchr(cmd, ' ');
5424	if (pos == NULL)
5425		return -1;
5426	*pos++ = '\0';
5427
5428	if (hexstr2bin(cmd, &version, 1) < 0)
5429		return -1;
5430
5431	return wpas_p2p_service_del_upnp(wpa_s, version, pos);
5432}
5433
5434
5435static int p2p_ctrl_service_del_asp(struct wpa_supplicant *wpa_s, char *cmd)
5436{
5437	u32 adv_id;
5438
5439	if (os_strcmp(cmd, "all") == 0) {
5440		wpas_p2p_service_flush_asp(wpa_s);
5441		return 0;
5442	}
5443
5444	if (sscanf(cmd, "%x", &adv_id) != 1)
5445		return -1;
5446
5447	return wpas_p2p_service_del_asp(wpa_s, adv_id);
5448}
5449
5450
5451static int p2p_ctrl_service_del(struct wpa_supplicant *wpa_s, char *cmd)
5452{
5453	char *pos;
5454
5455	pos = os_strchr(cmd, ' ');
5456	if (pos == NULL)
5457		return -1;
5458	*pos++ = '\0';
5459
5460	if (os_strcmp(cmd, "bonjour") == 0)
5461		return p2p_ctrl_service_del_bonjour(wpa_s, pos);
5462	if (os_strcmp(cmd, "upnp") == 0)
5463		return p2p_ctrl_service_del_upnp(wpa_s, pos);
5464	if (os_strcmp(cmd, "asp") == 0)
5465		return p2p_ctrl_service_del_asp(wpa_s, pos);
5466	wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
5467	return -1;
5468}
5469
5470
5471static int p2p_ctrl_service_replace(struct wpa_supplicant *wpa_s, char *cmd)
5472{
5473	char *pos;
5474
5475	pos = os_strchr(cmd, ' ');
5476	if (pos == NULL)
5477		return -1;
5478	*pos++ = '\0';
5479
5480	if (os_strcmp(cmd, "asp") == 0)
5481		return p2p_ctrl_service_add_asp(wpa_s, 1, pos);
5482
5483	wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
5484	return -1;
5485}
5486
5487
5488static int p2p_ctrl_reject(struct wpa_supplicant *wpa_s, char *cmd)
5489{
5490	u8 addr[ETH_ALEN];
5491
5492	/* <addr> */
5493
5494	if (hwaddr_aton(cmd, addr))
5495		return -1;
5496
5497	return wpas_p2p_reject(wpa_s, addr);
5498}
5499
5500
5501static int p2p_ctrl_invite_persistent(struct wpa_supplicant *wpa_s, char *cmd)
5502{
5503	char *pos;
5504	int id;
5505	struct wpa_ssid *ssid;
5506	u8 *_peer = NULL, peer[ETH_ALEN];
5507	int freq = 0, pref_freq = 0;
5508	int ht40, vht;
5509
5510	id = atoi(cmd);
5511	pos = os_strstr(cmd, " peer=");
5512	if (pos) {
5513		pos += 6;
5514		if (hwaddr_aton(pos, peer))
5515			return -1;
5516		_peer = peer;
5517	}
5518	ssid = wpa_config_get_network(wpa_s->conf, id);
5519	if (ssid == NULL || ssid->disabled != 2) {
5520		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
5521			   "for persistent P2P group",
5522			   id);
5523		return -1;
5524	}
5525
5526	pos = os_strstr(cmd, " freq=");
5527	if (pos) {
5528		pos += 6;
5529		freq = atoi(pos);
5530		if (freq <= 0)
5531			return -1;
5532	}
5533
5534	pos = os_strstr(cmd, " pref=");
5535	if (pos) {
5536		pos += 6;
5537		pref_freq = atoi(pos);
5538		if (pref_freq <= 0)
5539			return -1;
5540	}
5541
5542	vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
5543	ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
5544		vht;
5545
5546	return wpas_p2p_invite(wpa_s, _peer, ssid, NULL, freq, ht40, vht,
5547			       pref_freq);
5548}
5549
5550
5551static int p2p_ctrl_invite_group(struct wpa_supplicant *wpa_s, char *cmd)
5552{
5553	char *pos;
5554	u8 peer[ETH_ALEN], go_dev_addr[ETH_ALEN], *go_dev = NULL;
5555
5556	pos = os_strstr(cmd, " peer=");
5557	if (!pos)
5558		return -1;
5559
5560	*pos = '\0';
5561	pos += 6;
5562	if (hwaddr_aton(pos, peer)) {
5563		wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'", pos);
5564		return -1;
5565	}
5566
5567	pos = os_strstr(pos, " go_dev_addr=");
5568	if (pos) {
5569		pos += 13;
5570		if (hwaddr_aton(pos, go_dev_addr)) {
5571			wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'",
5572				   pos);
5573			return -1;
5574		}
5575		go_dev = go_dev_addr;
5576	}
5577
5578	return wpas_p2p_invite_group(wpa_s, cmd, peer, go_dev);
5579}
5580
5581
5582static int p2p_ctrl_invite(struct wpa_supplicant *wpa_s, char *cmd)
5583{
5584	if (os_strncmp(cmd, "persistent=", 11) == 0)
5585		return p2p_ctrl_invite_persistent(wpa_s, cmd + 11);
5586	if (os_strncmp(cmd, "group=", 6) == 0)
5587		return p2p_ctrl_invite_group(wpa_s, cmd + 6);
5588
5589	return -1;
5590}
5591
5592
5593static int p2p_ctrl_group_add_persistent(struct wpa_supplicant *wpa_s,
5594					 int id, int freq, int ht40, int vht)
5595{
5596	struct wpa_ssid *ssid;
5597
5598	ssid = wpa_config_get_network(wpa_s->conf, id);
5599	if (ssid == NULL || ssid->disabled != 2) {
5600		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
5601			   "for persistent P2P group",
5602			   id);
5603		return -1;
5604	}
5605
5606	return wpas_p2p_group_add_persistent(wpa_s, ssid, 0, freq, 0, ht40, vht,
5607					     NULL, 0, 0);
5608}
5609
5610
5611static int p2p_ctrl_group_add(struct wpa_supplicant *wpa_s, char *cmd)
5612{
5613	int freq = 0, persistent = 0, group_id = -1;
5614	int vht = wpa_s->conf->p2p_go_vht;
5615	int ht40 = wpa_s->conf->p2p_go_ht40 || vht;
5616	char *token, *context = NULL;
5617
5618	while ((token = str_token(cmd, " ", &context))) {
5619		if (sscanf(token, "freq=%d", &freq) == 1 ||
5620		    sscanf(token, "persistent=%d", &group_id) == 1) {
5621			continue;
5622		} else if (os_strcmp(token, "ht40") == 0) {
5623			ht40 = 1;
5624		} else if (os_strcmp(token, "vht") == 0) {
5625			vht = 1;
5626			ht40 = 1;
5627		} else if (os_strcmp(token, "persistent") == 0) {
5628			persistent = 1;
5629		} else {
5630			wpa_printf(MSG_DEBUG,
5631				   "CTRL: Invalid P2P_GROUP_ADD parameter: '%s'",
5632				   token);
5633			return -1;
5634		}
5635	}
5636
5637	if (group_id >= 0)
5638		return p2p_ctrl_group_add_persistent(wpa_s, group_id,
5639						     freq, ht40, vht);
5640
5641	return wpas_p2p_group_add(wpa_s, persistent, freq, ht40, vht);
5642}
5643
5644
5645static int p2p_ctrl_peer(struct wpa_supplicant *wpa_s, char *cmd,
5646			 char *buf, size_t buflen)
5647{
5648	u8 addr[ETH_ALEN], *addr_ptr;
5649	int next, res;
5650	const struct p2p_peer_info *info;
5651	char *pos, *end;
5652	char devtype[WPS_DEV_TYPE_BUFSIZE];
5653	struct wpa_ssid *ssid;
5654	size_t i;
5655
5656	if (!wpa_s->global->p2p)
5657		return -1;
5658
5659	if (os_strcmp(cmd, "FIRST") == 0) {
5660		addr_ptr = NULL;
5661		next = 0;
5662	} else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
5663		if (hwaddr_aton(cmd + 5, addr) < 0)
5664			return -1;
5665		addr_ptr = addr;
5666		next = 1;
5667	} else {
5668		if (hwaddr_aton(cmd, addr) < 0)
5669			return -1;
5670		addr_ptr = addr;
5671		next = 0;
5672	}
5673
5674	info = p2p_get_peer_info(wpa_s->global->p2p, addr_ptr, next);
5675	if (info == NULL)
5676		return -1;
5677
5678	pos = buf;
5679	end = buf + buflen;
5680
5681	res = os_snprintf(pos, end - pos, MACSTR "\n"
5682			  "pri_dev_type=%s\n"
5683			  "device_name=%s\n"
5684			  "manufacturer=%s\n"
5685			  "model_name=%s\n"
5686			  "model_number=%s\n"
5687			  "serial_number=%s\n"
5688			  "config_methods=0x%x\n"
5689			  "dev_capab=0x%x\n"
5690			  "group_capab=0x%x\n"
5691			  "level=%d\n",
5692			  MAC2STR(info->p2p_device_addr),
5693			  wps_dev_type_bin2str(info->pri_dev_type,
5694					       devtype, sizeof(devtype)),
5695			  info->device_name,
5696			  info->manufacturer,
5697			  info->model_name,
5698			  info->model_number,
5699			  info->serial_number,
5700			  info->config_methods,
5701			  info->dev_capab,
5702			  info->group_capab,
5703			  info->level);
5704	if (os_snprintf_error(end - pos, res))
5705		return pos - buf;
5706	pos += res;
5707
5708	for (i = 0; i < info->wps_sec_dev_type_list_len / WPS_DEV_TYPE_LEN; i++)
5709	{
5710		const u8 *t;
5711		t = &info->wps_sec_dev_type_list[i * WPS_DEV_TYPE_LEN];
5712		res = os_snprintf(pos, end - pos, "sec_dev_type=%s\n",
5713				  wps_dev_type_bin2str(t, devtype,
5714						       sizeof(devtype)));
5715		if (os_snprintf_error(end - pos, res))
5716			return pos - buf;
5717		pos += res;
5718	}
5719
5720	ssid = wpas_p2p_get_persistent(wpa_s, info->p2p_device_addr, NULL, 0);
5721	if (ssid) {
5722		res = os_snprintf(pos, end - pos, "persistent=%d\n", ssid->id);
5723		if (os_snprintf_error(end - pos, res))
5724			return pos - buf;
5725		pos += res;
5726	}
5727
5728	res = p2p_get_peer_info_txt(info, pos, end - pos);
5729	if (res < 0)
5730		return pos - buf;
5731	pos += res;
5732
5733	if (info->vendor_elems) {
5734		res = os_snprintf(pos, end - pos, "vendor_elems=");
5735		if (os_snprintf_error(end - pos, res))
5736			return pos - buf;
5737		pos += res;
5738
5739		pos += wpa_snprintf_hex(pos, end - pos,
5740					wpabuf_head(info->vendor_elems),
5741					wpabuf_len(info->vendor_elems));
5742
5743		res = os_snprintf(pos, end - pos, "\n");
5744		if (os_snprintf_error(end - pos, res))
5745			return pos - buf;
5746		pos += res;
5747	}
5748
5749	return pos - buf;
5750}
5751
5752
5753static int p2p_ctrl_disallow_freq(struct wpa_supplicant *wpa_s,
5754				  const char *param)
5755{
5756	unsigned int i;
5757
5758	if (wpa_s->global->p2p == NULL)
5759		return -1;
5760
5761	if (freq_range_list_parse(&wpa_s->global->p2p_disallow_freq, param) < 0)
5762		return -1;
5763
5764	for (i = 0; i < wpa_s->global->p2p_disallow_freq.num; i++) {
5765		struct wpa_freq_range *freq;
5766		freq = &wpa_s->global->p2p_disallow_freq.range[i];
5767		wpa_printf(MSG_DEBUG, "P2P: Disallowed frequency range %u-%u",
5768			   freq->min, freq->max);
5769	}
5770
5771	wpas_p2p_update_channel_list(wpa_s, WPAS_P2P_CHANNEL_UPDATE_DISALLOW);
5772	return 0;
5773}
5774
5775
5776static int p2p_ctrl_set(struct wpa_supplicant *wpa_s, char *cmd)
5777{
5778	char *param;
5779
5780	if (wpa_s->global->p2p == NULL)
5781		return -1;
5782
5783	param = os_strchr(cmd, ' ');
5784	if (param == NULL)
5785		return -1;
5786	*param++ = '\0';
5787
5788	if (os_strcmp(cmd, "discoverability") == 0) {
5789		p2p_set_client_discoverability(wpa_s->global->p2p,
5790					       atoi(param));
5791		return 0;
5792	}
5793
5794	if (os_strcmp(cmd, "managed") == 0) {
5795		p2p_set_managed_oper(wpa_s->global->p2p, atoi(param));
5796		return 0;
5797	}
5798
5799	if (os_strcmp(cmd, "listen_channel") == 0) {
5800		return p2p_set_listen_channel(wpa_s->global->p2p, 81,
5801					      atoi(param), 1);
5802	}
5803
5804	if (os_strcmp(cmd, "ssid_postfix") == 0) {
5805		return p2p_set_ssid_postfix(wpa_s->global->p2p, (u8 *) param,
5806					    os_strlen(param));
5807	}
5808
5809	if (os_strcmp(cmd, "noa") == 0) {
5810		char *pos;
5811		int count, start, duration;
5812		/* GO NoA parameters: count,start_offset(ms),duration(ms) */
5813		count = atoi(param);
5814		pos = os_strchr(param, ',');
5815		if (pos == NULL)
5816			return -1;
5817		pos++;
5818		start = atoi(pos);
5819		pos = os_strchr(pos, ',');
5820		if (pos == NULL)
5821			return -1;
5822		pos++;
5823		duration = atoi(pos);
5824		if (count < 0 || count > 255 || start < 0 || duration < 0)
5825			return -1;
5826		if (count == 0 && duration > 0)
5827			return -1;
5828		wpa_printf(MSG_DEBUG, "CTRL_IFACE: P2P_SET GO NoA: count=%d "
5829			   "start=%d duration=%d", count, start, duration);
5830		return wpas_p2p_set_noa(wpa_s, count, start, duration);
5831	}
5832
5833	if (os_strcmp(cmd, "ps") == 0)
5834		return wpa_drv_set_p2p_powersave(wpa_s, atoi(param), -1, -1);
5835
5836	if (os_strcmp(cmd, "oppps") == 0)
5837		return wpa_drv_set_p2p_powersave(wpa_s, -1, atoi(param), -1);
5838
5839	if (os_strcmp(cmd, "ctwindow") == 0)
5840		return wpa_drv_set_p2p_powersave(wpa_s, -1, -1, atoi(param));
5841
5842	if (os_strcmp(cmd, "disabled") == 0) {
5843		wpa_s->global->p2p_disabled = atoi(param);
5844		wpa_printf(MSG_DEBUG, "P2P functionality %s",
5845			   wpa_s->global->p2p_disabled ?
5846			   "disabled" : "enabled");
5847		if (wpa_s->global->p2p_disabled) {
5848			wpas_p2p_stop_find(wpa_s);
5849			os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
5850			p2p_flush(wpa_s->global->p2p);
5851		}
5852		return 0;
5853	}
5854
5855	if (os_strcmp(cmd, "conc_pref") == 0) {
5856		if (os_strcmp(param, "sta") == 0)
5857			wpa_s->global->conc_pref = WPA_CONC_PREF_STA;
5858		else if (os_strcmp(param, "p2p") == 0)
5859			wpa_s->global->conc_pref = WPA_CONC_PREF_P2P;
5860		else {
5861			wpa_printf(MSG_INFO, "Invalid conc_pref value");
5862			return -1;
5863		}
5864		wpa_printf(MSG_DEBUG, "Single channel concurrency preference: "
5865			   "%s", param);
5866		return 0;
5867	}
5868
5869	if (os_strcmp(cmd, "force_long_sd") == 0) {
5870		wpa_s->force_long_sd = atoi(param);
5871		return 0;
5872	}
5873
5874	if (os_strcmp(cmd, "peer_filter") == 0) {
5875		u8 addr[ETH_ALEN];
5876		if (hwaddr_aton(param, addr))
5877			return -1;
5878		p2p_set_peer_filter(wpa_s->global->p2p, addr);
5879		return 0;
5880	}
5881
5882	if (os_strcmp(cmd, "cross_connect") == 0)
5883		return wpas_p2p_set_cross_connect(wpa_s, atoi(param));
5884
5885	if (os_strcmp(cmd, "go_apsd") == 0) {
5886		if (os_strcmp(param, "disable") == 0)
5887			wpa_s->set_ap_uapsd = 0;
5888		else {
5889			wpa_s->set_ap_uapsd = 1;
5890			wpa_s->ap_uapsd = atoi(param);
5891		}
5892		return 0;
5893	}
5894
5895	if (os_strcmp(cmd, "client_apsd") == 0) {
5896		if (os_strcmp(param, "disable") == 0)
5897			wpa_s->set_sta_uapsd = 0;
5898		else {
5899			int be, bk, vi, vo;
5900			char *pos;
5901			/* format: BE,BK,VI,VO;max SP Length */
5902			be = atoi(param);
5903			pos = os_strchr(param, ',');
5904			if (pos == NULL)
5905				return -1;
5906			pos++;
5907			bk = atoi(pos);
5908			pos = os_strchr(pos, ',');
5909			if (pos == NULL)
5910				return -1;
5911			pos++;
5912			vi = atoi(pos);
5913			pos = os_strchr(pos, ',');
5914			if (pos == NULL)
5915				return -1;
5916			pos++;
5917			vo = atoi(pos);
5918			/* ignore max SP Length for now */
5919
5920			wpa_s->set_sta_uapsd = 1;
5921			wpa_s->sta_uapsd = 0;
5922			if (be)
5923				wpa_s->sta_uapsd |= BIT(0);
5924			if (bk)
5925				wpa_s->sta_uapsd |= BIT(1);
5926			if (vi)
5927				wpa_s->sta_uapsd |= BIT(2);
5928			if (vo)
5929				wpa_s->sta_uapsd |= BIT(3);
5930		}
5931		return 0;
5932	}
5933
5934	if (os_strcmp(cmd, "disallow_freq") == 0)
5935		return p2p_ctrl_disallow_freq(wpa_s, param);
5936
5937	if (os_strcmp(cmd, "disc_int") == 0) {
5938		int min_disc_int, max_disc_int, max_disc_tu;
5939		char *pos;
5940
5941		pos = param;
5942
5943		min_disc_int = atoi(pos);
5944		pos = os_strchr(pos, ' ');
5945		if (pos == NULL)
5946			return -1;
5947		*pos++ = '\0';
5948
5949		max_disc_int = atoi(pos);
5950		pos = os_strchr(pos, ' ');
5951		if (pos == NULL)
5952			return -1;
5953		*pos++ = '\0';
5954
5955		max_disc_tu = atoi(pos);
5956
5957		return p2p_set_disc_int(wpa_s->global->p2p, min_disc_int,
5958					max_disc_int, max_disc_tu);
5959	}
5960
5961	if (os_strcmp(cmd, "per_sta_psk") == 0) {
5962		wpa_s->global->p2p_per_sta_psk = !!atoi(param);
5963		return 0;
5964	}
5965
5966#ifdef CONFIG_WPS_NFC
5967	if (os_strcmp(cmd, "nfc_tag") == 0)
5968		return wpas_p2p_nfc_tag_enabled(wpa_s, !!atoi(param));
5969#endif /* CONFIG_WPS_NFC */
5970
5971	if (os_strcmp(cmd, "disable_ip_addr_req") == 0) {
5972		wpa_s->p2p_disable_ip_addr_req = !!atoi(param);
5973		return 0;
5974	}
5975
5976	wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown P2P_SET field value '%s'",
5977		   cmd);
5978
5979	return -1;
5980}
5981
5982
5983static void p2p_ctrl_flush(struct wpa_supplicant *wpa_s)
5984{
5985	os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
5986	wpa_s->force_long_sd = 0;
5987	wpas_p2p_stop_find(wpa_s);
5988	wpa_s->parent->p2ps_method_config_any = 0;
5989	if (wpa_s->global->p2p)
5990		p2p_flush(wpa_s->global->p2p);
5991}
5992
5993
5994static int p2p_ctrl_presence_req(struct wpa_supplicant *wpa_s, char *cmd)
5995{
5996	char *pos, *pos2;
5997	unsigned int dur1 = 0, int1 = 0, dur2 = 0, int2 = 0;
5998
5999	if (cmd[0]) {
6000		pos = os_strchr(cmd, ' ');
6001		if (pos == NULL)
6002			return -1;
6003		*pos++ = '\0';
6004		dur1 = atoi(cmd);
6005
6006		pos2 = os_strchr(pos, ' ');
6007		if (pos2)
6008			*pos2++ = '\0';
6009		int1 = atoi(pos);
6010	} else
6011		pos2 = NULL;
6012
6013	if (pos2) {
6014		pos = os_strchr(pos2, ' ');
6015		if (pos == NULL)
6016			return -1;
6017		*pos++ = '\0';
6018		dur2 = atoi(pos2);
6019		int2 = atoi(pos);
6020	}
6021
6022	return wpas_p2p_presence_req(wpa_s, dur1, int1, dur2, int2);
6023}
6024
6025
6026static int p2p_ctrl_ext_listen(struct wpa_supplicant *wpa_s, char *cmd)
6027{
6028	char *pos;
6029	unsigned int period = 0, interval = 0;
6030
6031	if (cmd[0]) {
6032		pos = os_strchr(cmd, ' ');
6033		if (pos == NULL)
6034			return -1;
6035		*pos++ = '\0';
6036		period = atoi(cmd);
6037		interval = atoi(pos);
6038	}
6039
6040	return wpas_p2p_ext_listen(wpa_s, period, interval);
6041}
6042
6043
6044static int p2p_ctrl_remove_client(struct wpa_supplicant *wpa_s, const char *cmd)
6045{
6046	const char *pos;
6047	u8 peer[ETH_ALEN];
6048	int iface_addr = 0;
6049
6050	pos = cmd;
6051	if (os_strncmp(pos, "iface=", 6) == 0) {
6052		iface_addr = 1;
6053		pos += 6;
6054	}
6055	if (hwaddr_aton(pos, peer))
6056		return -1;
6057
6058	wpas_p2p_remove_client(wpa_s, peer, iface_addr);
6059	return 0;
6060}
6061
6062#endif /* CONFIG_P2P */
6063
6064
6065static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s, char *val)
6066{
6067	struct wpa_freq_range_list ranges;
6068	int *freqs = NULL;
6069	struct hostapd_hw_modes *mode;
6070	u16 i;
6071
6072	if (wpa_s->hw.modes == NULL)
6073		return NULL;
6074
6075	os_memset(&ranges, 0, sizeof(ranges));
6076	if (freq_range_list_parse(&ranges, val) < 0)
6077		return NULL;
6078
6079	for (i = 0; i < wpa_s->hw.num_modes; i++) {
6080		int j;
6081
6082		mode = &wpa_s->hw.modes[i];
6083		for (j = 0; j < mode->num_channels; j++) {
6084			unsigned int freq;
6085
6086			if (mode->channels[j].flag & HOSTAPD_CHAN_DISABLED)
6087				continue;
6088
6089			freq = mode->channels[j].freq;
6090			if (!freq_range_list_includes(&ranges, freq))
6091				continue;
6092
6093			int_array_add_unique(&freqs, freq);
6094		}
6095	}
6096
6097	os_free(ranges.range);
6098	return freqs;
6099}
6100
6101
6102#ifdef CONFIG_INTERWORKING
6103
6104static int ctrl_interworking_select(struct wpa_supplicant *wpa_s, char *param)
6105{
6106	int auto_sel = 0;
6107	int *freqs = NULL;
6108
6109	if (param) {
6110		char *pos;
6111
6112		auto_sel = os_strstr(param, "auto") != NULL;
6113
6114		pos = os_strstr(param, "freq=");
6115		if (pos) {
6116			freqs = freq_range_to_channel_list(wpa_s, pos + 5);
6117			if (freqs == NULL)
6118				return -1;
6119		}
6120
6121	}
6122
6123	return interworking_select(wpa_s, auto_sel, freqs);
6124}
6125
6126
6127static int ctrl_interworking_connect(struct wpa_supplicant *wpa_s, char *dst,
6128				     int only_add)
6129{
6130	u8 bssid[ETH_ALEN];
6131	struct wpa_bss *bss;
6132
6133	if (hwaddr_aton(dst, bssid)) {
6134		wpa_printf(MSG_DEBUG, "Invalid BSSID '%s'", dst);
6135		return -1;
6136	}
6137
6138	bss = wpa_bss_get_bssid(wpa_s, bssid);
6139	if (bss == NULL) {
6140		wpa_printf(MSG_DEBUG, "Could not find BSS " MACSTR,
6141			   MAC2STR(bssid));
6142		return -1;
6143	}
6144
6145	if (bss->ssid_len == 0) {
6146		int found = 0;
6147
6148		wpa_printf(MSG_DEBUG, "Selected BSS entry for " MACSTR
6149			   " does not have SSID information", MAC2STR(bssid));
6150
6151		dl_list_for_each_reverse(bss, &wpa_s->bss, struct wpa_bss,
6152					 list) {
6153			if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0 &&
6154			    bss->ssid_len > 0) {
6155				found = 1;
6156				break;
6157			}
6158		}
6159
6160		if (!found)
6161			return -1;
6162		wpa_printf(MSG_DEBUG,
6163			   "Found another matching BSS entry with SSID");
6164	}
6165
6166	return interworking_connect(wpa_s, bss, only_add);
6167}
6168
6169
6170static int get_anqp(struct wpa_supplicant *wpa_s, char *dst)
6171{
6172	u8 dst_addr[ETH_ALEN];
6173	int used;
6174	char *pos;
6175#define MAX_ANQP_INFO_ID 100
6176	u16 id[MAX_ANQP_INFO_ID];
6177	size_t num_id = 0;
6178	u32 subtypes = 0;
6179
6180	used = hwaddr_aton2(dst, dst_addr);
6181	if (used < 0)
6182		return -1;
6183	pos = dst + used;
6184	if (*pos == ' ')
6185		pos++;
6186	while (num_id < MAX_ANQP_INFO_ID) {
6187		if (os_strncmp(pos, "hs20:", 5) == 0) {
6188#ifdef CONFIG_HS20
6189			int num = atoi(pos + 5);
6190			if (num <= 0 || num > 31)
6191				return -1;
6192			subtypes |= BIT(num);
6193#else /* CONFIG_HS20 */
6194			return -1;
6195#endif /* CONFIG_HS20 */
6196		} else {
6197			id[num_id] = atoi(pos);
6198			if (id[num_id])
6199				num_id++;
6200		}
6201		pos = os_strchr(pos + 1, ',');
6202		if (pos == NULL)
6203			break;
6204		pos++;
6205	}
6206
6207	if (num_id == 0)
6208		return -1;
6209
6210	return anqp_send_req(wpa_s, dst_addr, id, num_id, subtypes);
6211}
6212
6213
6214static int gas_request(struct wpa_supplicant *wpa_s, char *cmd)
6215{
6216	u8 dst_addr[ETH_ALEN];
6217	struct wpabuf *advproto, *query = NULL;
6218	int used, ret = -1;
6219	char *pos, *end;
6220	size_t len;
6221
6222	used = hwaddr_aton2(cmd, dst_addr);
6223	if (used < 0)
6224		return -1;
6225
6226	pos = cmd + used;
6227	while (*pos == ' ')
6228		pos++;
6229
6230	/* Advertisement Protocol ID */
6231	end = os_strchr(pos, ' ');
6232	if (end)
6233		len = end - pos;
6234	else
6235		len = os_strlen(pos);
6236	if (len & 0x01)
6237		return -1;
6238	len /= 2;
6239	if (len == 0)
6240		return -1;
6241	advproto = wpabuf_alloc(len);
6242	if (advproto == NULL)
6243		return -1;
6244	if (hexstr2bin(pos, wpabuf_put(advproto, len), len) < 0)
6245		goto fail;
6246
6247	if (end) {
6248		/* Optional Query Request */
6249		pos = end + 1;
6250		while (*pos == ' ')
6251			pos++;
6252
6253		len = os_strlen(pos);
6254		if (len) {
6255			if (len & 0x01)
6256				goto fail;
6257			len /= 2;
6258			if (len == 0)
6259				goto fail;
6260			query = wpabuf_alloc(len);
6261			if (query == NULL)
6262				goto fail;
6263			if (hexstr2bin(pos, wpabuf_put(query, len), len) < 0)
6264				goto fail;
6265		}
6266	}
6267
6268	ret = gas_send_request(wpa_s, dst_addr, advproto, query);
6269
6270fail:
6271	wpabuf_free(advproto);
6272	wpabuf_free(query);
6273
6274	return ret;
6275}
6276
6277
6278static int gas_response_get(struct wpa_supplicant *wpa_s, char *cmd, char *buf,
6279			    size_t buflen)
6280{
6281	u8 addr[ETH_ALEN];
6282	int dialog_token;
6283	int used;
6284	char *pos;
6285	size_t resp_len, start, requested_len;
6286	struct wpabuf *resp;
6287	int ret;
6288
6289	used = hwaddr_aton2(cmd, addr);
6290	if (used < 0)
6291		return -1;
6292
6293	pos = cmd + used;
6294	while (*pos == ' ')
6295		pos++;
6296	dialog_token = atoi(pos);
6297
6298	if (wpa_s->last_gas_resp &&
6299	    os_memcmp(addr, wpa_s->last_gas_addr, ETH_ALEN) == 0 &&
6300	    dialog_token == wpa_s->last_gas_dialog_token)
6301		resp = wpa_s->last_gas_resp;
6302	else if (wpa_s->prev_gas_resp &&
6303		 os_memcmp(addr, wpa_s->prev_gas_addr, ETH_ALEN) == 0 &&
6304		 dialog_token == wpa_s->prev_gas_dialog_token)
6305		resp = wpa_s->prev_gas_resp;
6306	else
6307		return -1;
6308
6309	resp_len = wpabuf_len(resp);
6310	start = 0;
6311	requested_len = resp_len;
6312
6313	pos = os_strchr(pos, ' ');
6314	if (pos) {
6315		start = atoi(pos);
6316		if (start > resp_len)
6317			return os_snprintf(buf, buflen, "FAIL-Invalid range");
6318		pos = os_strchr(pos, ',');
6319		if (pos == NULL)
6320			return -1;
6321		pos++;
6322		requested_len = atoi(pos);
6323		if (start + requested_len > resp_len)
6324			return os_snprintf(buf, buflen, "FAIL-Invalid range");
6325	}
6326
6327	if (requested_len * 2 + 1 > buflen)
6328		return os_snprintf(buf, buflen, "FAIL-Too long response");
6329
6330	ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(resp) + start,
6331			       requested_len);
6332
6333	if (start + requested_len == resp_len) {
6334		/*
6335		 * Free memory by dropping the response after it has been
6336		 * fetched.
6337		 */
6338		if (resp == wpa_s->prev_gas_resp) {
6339			wpabuf_free(wpa_s->prev_gas_resp);
6340			wpa_s->prev_gas_resp = NULL;
6341		} else {
6342			wpabuf_free(wpa_s->last_gas_resp);
6343			wpa_s->last_gas_resp = NULL;
6344		}
6345	}
6346
6347	return ret;
6348}
6349#endif /* CONFIG_INTERWORKING */
6350
6351
6352#ifdef CONFIG_HS20
6353
6354static int get_hs20_anqp(struct wpa_supplicant *wpa_s, char *dst)
6355{
6356	u8 dst_addr[ETH_ALEN];
6357	int used;
6358	char *pos;
6359	u32 subtypes = 0;
6360
6361	used = hwaddr_aton2(dst, dst_addr);
6362	if (used < 0)
6363		return -1;
6364	pos = dst + used;
6365	if (*pos == ' ')
6366		pos++;
6367	for (;;) {
6368		int num = atoi(pos);
6369		if (num <= 0 || num > 31)
6370			return -1;
6371		subtypes |= BIT(num);
6372		pos = os_strchr(pos + 1, ',');
6373		if (pos == NULL)
6374			break;
6375		pos++;
6376	}
6377
6378	if (subtypes == 0)
6379		return -1;
6380
6381	return hs20_anqp_send_req(wpa_s, dst_addr, subtypes, NULL, 0);
6382}
6383
6384
6385static int hs20_nai_home_realm_list(struct wpa_supplicant *wpa_s,
6386				    const u8 *addr, const char *realm)
6387{
6388	u8 *buf;
6389	size_t rlen, len;
6390	int ret;
6391
6392	rlen = os_strlen(realm);
6393	len = 3 + rlen;
6394	buf = os_malloc(len);
6395	if (buf == NULL)
6396		return -1;
6397	buf[0] = 1; /* NAI Home Realm Count */
6398	buf[1] = 0; /* Formatted in accordance with RFC 4282 */
6399	buf[2] = rlen;
6400	os_memcpy(buf + 3, realm, rlen);
6401
6402	ret = hs20_anqp_send_req(wpa_s, addr,
6403				 BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
6404				 buf, len);
6405
6406	os_free(buf);
6407
6408	return ret;
6409}
6410
6411
6412static int hs20_get_nai_home_realm_list(struct wpa_supplicant *wpa_s,
6413					char *dst)
6414{
6415	struct wpa_cred *cred = wpa_s->conf->cred;
6416	u8 dst_addr[ETH_ALEN];
6417	int used;
6418	u8 *buf;
6419	size_t len;
6420	int ret;
6421
6422	used = hwaddr_aton2(dst, dst_addr);
6423	if (used < 0)
6424		return -1;
6425
6426	while (dst[used] == ' ')
6427		used++;
6428	if (os_strncmp(dst + used, "realm=", 6) == 0)
6429		return hs20_nai_home_realm_list(wpa_s, dst_addr,
6430						dst + used + 6);
6431
6432	len = os_strlen(dst + used);
6433
6434	if (len == 0 && cred && cred->realm)
6435		return hs20_nai_home_realm_list(wpa_s, dst_addr, cred->realm);
6436
6437	if (len & 1)
6438		return -1;
6439	len /= 2;
6440	buf = os_malloc(len);
6441	if (buf == NULL)
6442		return -1;
6443	if (hexstr2bin(dst + used, buf, len) < 0) {
6444		os_free(buf);
6445		return -1;
6446	}
6447
6448	ret = hs20_anqp_send_req(wpa_s, dst_addr,
6449				 BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
6450				 buf, len);
6451	os_free(buf);
6452
6453	return ret;
6454}
6455
6456
6457static int hs20_icon_request(struct wpa_supplicant *wpa_s, char *cmd)
6458{
6459	u8 dst_addr[ETH_ALEN];
6460	int used;
6461	char *icon;
6462
6463	used = hwaddr_aton2(cmd, dst_addr);
6464	if (used < 0)
6465		return -1;
6466
6467	while (cmd[used] == ' ')
6468		used++;
6469	icon = &cmd[used];
6470
6471	wpa_s->fetch_osu_icon_in_progress = 0;
6472	return hs20_anqp_send_req(wpa_s, dst_addr, BIT(HS20_STYPE_ICON_REQUEST),
6473				  (u8 *) icon, os_strlen(icon));
6474}
6475
6476#endif /* CONFIG_HS20 */
6477
6478
6479#ifdef CONFIG_AUTOSCAN
6480
6481static int wpa_supplicant_ctrl_iface_autoscan(struct wpa_supplicant *wpa_s,
6482					      char *cmd)
6483{
6484	enum wpa_states state = wpa_s->wpa_state;
6485	char *new_params = NULL;
6486
6487	if (os_strlen(cmd) > 0) {
6488		new_params = os_strdup(cmd);
6489		if (new_params == NULL)
6490			return -1;
6491	}
6492
6493	os_free(wpa_s->conf->autoscan);
6494	wpa_s->conf->autoscan = new_params;
6495
6496	if (wpa_s->conf->autoscan == NULL)
6497		autoscan_deinit(wpa_s);
6498	else if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
6499		autoscan_init(wpa_s, 1);
6500	else if (state == WPA_SCANNING)
6501		wpa_supplicant_reinit_autoscan(wpa_s);
6502
6503	return 0;
6504}
6505
6506#endif /* CONFIG_AUTOSCAN */
6507
6508
6509#ifdef CONFIG_WNM
6510
6511static int wpas_ctrl_iface_wnm_sleep(struct wpa_supplicant *wpa_s, char *cmd)
6512{
6513	int enter;
6514	int intval = 0;
6515	char *pos;
6516	int ret;
6517	struct wpabuf *tfs_req = NULL;
6518
6519	if (os_strncmp(cmd, "enter", 5) == 0)
6520		enter = 1;
6521	else if (os_strncmp(cmd, "exit", 4) == 0)
6522		enter = 0;
6523	else
6524		return -1;
6525
6526	pos = os_strstr(cmd, " interval=");
6527	if (pos)
6528		intval = atoi(pos + 10);
6529
6530	pos = os_strstr(cmd, " tfs_req=");
6531	if (pos) {
6532		char *end;
6533		size_t len;
6534		pos += 9;
6535		end = os_strchr(pos, ' ');
6536		if (end)
6537			len = end - pos;
6538		else
6539			len = os_strlen(pos);
6540		if (len & 1)
6541			return -1;
6542		len /= 2;
6543		tfs_req = wpabuf_alloc(len);
6544		if (tfs_req == NULL)
6545			return -1;
6546		if (hexstr2bin(pos, wpabuf_put(tfs_req, len), len) < 0) {
6547			wpabuf_free(tfs_req);
6548			return -1;
6549		}
6550	}
6551
6552	ret = ieee802_11_send_wnmsleep_req(wpa_s, enter ? WNM_SLEEP_MODE_ENTER :
6553					   WNM_SLEEP_MODE_EXIT, intval,
6554					   tfs_req);
6555	wpabuf_free(tfs_req);
6556
6557	return ret;
6558}
6559
6560
6561static int wpas_ctrl_iface_wnm_bss_query(struct wpa_supplicant *wpa_s, char *cmd)
6562{
6563	int query_reason;
6564
6565	query_reason = atoi(cmd);
6566
6567	wpa_printf(MSG_DEBUG, "CTRL_IFACE: WNM_BSS_QUERY query_reason=%d",
6568		   query_reason);
6569
6570	return wnm_send_bss_transition_mgmt_query(wpa_s, query_reason);
6571}
6572
6573#endif /* CONFIG_WNM */
6574
6575
6576static int wpa_supplicant_signal_poll(struct wpa_supplicant *wpa_s, char *buf,
6577				      size_t buflen)
6578{
6579	struct wpa_signal_info si;
6580	int ret;
6581	char *pos, *end;
6582
6583	ret = wpa_drv_signal_poll(wpa_s, &si);
6584	if (ret)
6585		return -1;
6586
6587	pos = buf;
6588	end = buf + buflen;
6589
6590	ret = os_snprintf(pos, end - pos, "RSSI=%d\nLINKSPEED=%d\n"
6591			  "NOISE=%d\nFREQUENCY=%u\n",
6592			  si.current_signal, si.current_txrate / 1000,
6593			  si.current_noise, si.frequency);
6594	if (os_snprintf_error(end - pos, ret))
6595		return -1;
6596	pos += ret;
6597
6598	if (si.chanwidth != CHAN_WIDTH_UNKNOWN) {
6599		ret = os_snprintf(pos, end - pos, "WIDTH=%s\n",
6600				  channel_width_to_string(si.chanwidth));
6601		if (os_snprintf_error(end - pos, ret))
6602			return -1;
6603		pos += ret;
6604	}
6605
6606	if (si.center_frq1 > 0 && si.center_frq2 > 0) {
6607		ret = os_snprintf(pos, end - pos,
6608				  "CENTER_FRQ1=%d\nCENTER_FRQ2=%d\n",
6609				  si.center_frq1, si.center_frq2);
6610		if (os_snprintf_error(end - pos, ret))
6611			return -1;
6612		pos += ret;
6613	}
6614
6615	if (si.avg_signal) {
6616		ret = os_snprintf(pos, end - pos,
6617				  "AVG_RSSI=%d\n", si.avg_signal);
6618		if (os_snprintf_error(end - pos, ret))
6619			return -1;
6620		pos += ret;
6621	}
6622
6623	if (si.avg_beacon_signal) {
6624		ret = os_snprintf(pos, end - pos,
6625				  "AVG_BEACON_RSSI=%d\n", si.avg_beacon_signal);
6626		if (os_snprintf_error(end - pos, ret))
6627			return -1;
6628		pos += ret;
6629	}
6630
6631	return pos - buf;
6632}
6633
6634
6635static int wpas_ctrl_iface_get_pref_freq_list(
6636	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
6637{
6638	unsigned int freq_list[100], num = 100, i;
6639	int ret;
6640	enum wpa_driver_if_type iface_type;
6641	char *pos, *end;
6642
6643	pos = buf;
6644	end = buf + buflen;
6645
6646	/* buf: "<interface_type>" */
6647	if (os_strcmp(cmd, "STATION") == 0)
6648		iface_type = WPA_IF_STATION;
6649	else if (os_strcmp(cmd, "AP") == 0)
6650		iface_type = WPA_IF_AP_BSS;
6651	else if (os_strcmp(cmd, "P2P_GO") == 0)
6652		iface_type = WPA_IF_P2P_GO;
6653	else if (os_strcmp(cmd, "P2P_CLIENT") == 0)
6654		iface_type = WPA_IF_P2P_CLIENT;
6655	else if (os_strcmp(cmd, "IBSS") == 0)
6656		iface_type = WPA_IF_IBSS;
6657	else if (os_strcmp(cmd, "TDLS") == 0)
6658		iface_type = WPA_IF_TDLS;
6659	else
6660		return -1;
6661
6662	wpa_printf(MSG_DEBUG,
6663		   "CTRL_IFACE: GET_PREF_FREQ_LIST iface_type=%d (%s)",
6664		   iface_type, buf);
6665
6666	ret = wpa_drv_get_pref_freq_list(wpa_s, iface_type, &num, freq_list);
6667	if (ret)
6668		return -1;
6669
6670	for (i = 0; i < num; i++) {
6671		ret = os_snprintf(pos, end - pos, "%s%u",
6672				  i > 0 ? "," : "", freq_list[i]);
6673		if (os_snprintf_error(end - pos, ret))
6674			return -1;
6675		pos += ret;
6676	}
6677
6678	return pos - buf;
6679}
6680
6681
6682static int wpa_supplicant_pktcnt_poll(struct wpa_supplicant *wpa_s, char *buf,
6683				      size_t buflen)
6684{
6685	struct hostap_sta_driver_data sta;
6686	int ret;
6687
6688	ret = wpa_drv_pktcnt_poll(wpa_s, &sta);
6689	if (ret)
6690		return -1;
6691
6692	ret = os_snprintf(buf, buflen, "TXGOOD=%lu\nTXBAD=%lu\nRXGOOD=%lu\n",
6693			  sta.tx_packets, sta.tx_retry_failed, sta.rx_packets);
6694	if (os_snprintf_error(buflen, ret))
6695		return -1;
6696	return ret;
6697}
6698
6699
6700#ifdef ANDROID
6701static int wpa_supplicant_driver_cmd(struct wpa_supplicant *wpa_s, char *cmd,
6702				     char *buf, size_t buflen)
6703{
6704	int ret;
6705
6706	ret = wpa_drv_driver_cmd(wpa_s, cmd, buf, buflen);
6707	if (ret == 0) {
6708		if (os_strncasecmp(cmd, "COUNTRY", 7) == 0) {
6709			struct p2p_data *p2p = wpa_s->global->p2p;
6710			if (p2p) {
6711				char country[3];
6712				country[0] = cmd[8];
6713				country[1] = cmd[9];
6714				country[2] = 0x04;
6715				p2p_set_country(p2p, country);
6716			}
6717		}
6718		ret = os_snprintf(buf, buflen, "%s\n", "OK");
6719		if (os_snprintf_error(buflen, ret))
6720			ret = -1;
6721	}
6722	return ret;
6723}
6724#endif /* ANDROID */
6725
6726
6727static int wpa_supplicant_vendor_cmd(struct wpa_supplicant *wpa_s, char *cmd,
6728				     char *buf, size_t buflen)
6729{
6730	int ret;
6731	char *pos;
6732	u8 *data = NULL;
6733	unsigned int vendor_id, subcmd;
6734	struct wpabuf *reply;
6735	size_t data_len = 0;
6736
6737	/* cmd: <vendor id> <subcommand id> [<hex formatted data>] */
6738	vendor_id = strtoul(cmd, &pos, 16);
6739	if (!isblank(*pos))
6740		return -EINVAL;
6741
6742	subcmd = strtoul(pos, &pos, 10);
6743
6744	if (*pos != '\0') {
6745		if (!isblank(*pos++))
6746			return -EINVAL;
6747		data_len = os_strlen(pos);
6748	}
6749
6750	if (data_len) {
6751		data_len /= 2;
6752		data = os_malloc(data_len);
6753		if (!data)
6754			return -1;
6755
6756		if (hexstr2bin(pos, data, data_len)) {
6757			wpa_printf(MSG_DEBUG,
6758				   "Vendor command: wrong parameter format");
6759			os_free(data);
6760			return -EINVAL;
6761		}
6762	}
6763
6764	reply = wpabuf_alloc((buflen - 1) / 2);
6765	if (!reply) {
6766		os_free(data);
6767		return -1;
6768	}
6769
6770	ret = wpa_drv_vendor_cmd(wpa_s, vendor_id, subcmd, data, data_len,
6771				 reply);
6772
6773	if (ret == 0)
6774		ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(reply),
6775				       wpabuf_len(reply));
6776
6777	wpabuf_free(reply);
6778	os_free(data);
6779
6780	return ret;
6781}
6782
6783
6784static void wpa_supplicant_ctrl_iface_flush(struct wpa_supplicant *wpa_s)
6785{
6786#ifdef CONFIG_P2P
6787	struct wpa_supplicant *p2p_wpa_s = wpa_s->global->p2p_init_wpa_s ?
6788		wpa_s->global->p2p_init_wpa_s : wpa_s;
6789#endif /* CONFIG_P2P */
6790
6791	wpa_dbg(wpa_s, MSG_DEBUG, "Flush all wpa_supplicant state");
6792
6793#ifdef CONFIG_P2P
6794	wpas_p2p_cancel(p2p_wpa_s);
6795	p2p_ctrl_flush(p2p_wpa_s);
6796	wpas_p2p_group_remove(p2p_wpa_s, "*");
6797	wpas_p2p_service_flush(p2p_wpa_s);
6798	p2p_wpa_s->global->p2p_disabled = 0;
6799	p2p_wpa_s->global->p2p_per_sta_psk = 0;
6800	p2p_wpa_s->conf->num_sec_device_types = 0;
6801	p2p_wpa_s->p2p_disable_ip_addr_req = 0;
6802	os_free(p2p_wpa_s->global->p2p_go_avoid_freq.range);
6803	p2p_wpa_s->global->p2p_go_avoid_freq.range = NULL;
6804	p2p_wpa_s->global->p2p_go_avoid_freq.num = 0;
6805	p2p_wpa_s->global->pending_p2ps_group = 0;
6806#endif /* CONFIG_P2P */
6807
6808#ifdef CONFIG_WPS_TESTING
6809	wps_version_number = 0x20;
6810	wps_testing_dummy_cred = 0;
6811	wps_corrupt_pkhash = 0;
6812#endif /* CONFIG_WPS_TESTING */
6813#ifdef CONFIG_WPS
6814	wpa_s->wps_fragment_size = 0;
6815	wpas_wps_cancel(wpa_s);
6816	wps_registrar_flush(wpa_s->wps->registrar);
6817#endif /* CONFIG_WPS */
6818	wpa_s->after_wps = 0;
6819	wpa_s->known_wps_freq = 0;
6820
6821#ifdef CONFIG_TDLS
6822#ifdef CONFIG_TDLS_TESTING
6823	extern unsigned int tdls_testing;
6824	tdls_testing = 0;
6825#endif /* CONFIG_TDLS_TESTING */
6826	wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL);
6827	wpa_tdls_enable(wpa_s->wpa, 1);
6828#endif /* CONFIG_TDLS */
6829
6830	eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
6831	wpa_supplicant_stop_countermeasures(wpa_s, NULL);
6832
6833	wpa_s->no_keep_alive = 0;
6834	wpa_s->own_disconnect_req = 0;
6835
6836	os_free(wpa_s->disallow_aps_bssid);
6837	wpa_s->disallow_aps_bssid = NULL;
6838	wpa_s->disallow_aps_bssid_count = 0;
6839	os_free(wpa_s->disallow_aps_ssid);
6840	wpa_s->disallow_aps_ssid = NULL;
6841	wpa_s->disallow_aps_ssid_count = 0;
6842
6843	wpa_s->set_sta_uapsd = 0;
6844	wpa_s->sta_uapsd = 0;
6845
6846	wpa_drv_radio_disable(wpa_s, 0);
6847	wpa_blacklist_clear(wpa_s);
6848	wpa_s->extra_blacklist_count = 0;
6849	wpa_supplicant_ctrl_iface_remove_network(wpa_s, "all");
6850	wpa_supplicant_ctrl_iface_remove_cred(wpa_s, "all");
6851	wpa_config_flush_blobs(wpa_s->conf);
6852	wpa_s->conf->auto_interworking = 0;
6853	wpa_s->conf->okc = 0;
6854
6855	wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
6856	rsn_preauth_deinit(wpa_s->wpa);
6857
6858	wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME, 43200);
6859	wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD, 70);
6860	wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT, 60);
6861	eapol_sm_notify_logoff(wpa_s->eapol, FALSE);
6862
6863	radio_remove_works(wpa_s, NULL, 1);
6864	wpa_s->ext_work_in_progress = 0;
6865
6866	wpa_s->next_ssid = NULL;
6867
6868#ifdef CONFIG_INTERWORKING
6869	hs20_cancel_fetch_osu(wpa_s);
6870#endif /* CONFIG_INTERWORKING */
6871
6872	wpa_s->ext_mgmt_frame_handling = 0;
6873	wpa_s->ext_eapol_frame_io = 0;
6874#ifdef CONFIG_TESTING_OPTIONS
6875	wpa_s->extra_roc_dur = 0;
6876	wpa_s->test_failure = WPAS_TEST_FAILURE_NONE;
6877#endif /* CONFIG_TESTING_OPTIONS */
6878
6879	wpa_s->disconnected = 0;
6880	os_free(wpa_s->next_scan_freqs);
6881	wpa_s->next_scan_freqs = NULL;
6882
6883	wpa_bss_flush(wpa_s);
6884	if (!dl_list_empty(&wpa_s->bss)) {
6885		wpa_printf(MSG_DEBUG,
6886			   "BSS table not empty after flush: %u entries, current_bss=%p bssid="
6887			   MACSTR " pending_bssid=" MACSTR,
6888			   dl_list_len(&wpa_s->bss), wpa_s->current_bss,
6889			   MAC2STR(wpa_s->bssid),
6890			   MAC2STR(wpa_s->pending_bssid));
6891	}
6892
6893	eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
6894	wpa_s->wnmsleep_used = 0;
6895}
6896
6897
6898static int wpas_ctrl_radio_work_show(struct wpa_supplicant *wpa_s,
6899				     char *buf, size_t buflen)
6900{
6901	struct wpa_radio_work *work;
6902	char *pos, *end;
6903	struct os_reltime now, diff;
6904
6905	pos = buf;
6906	end = buf + buflen;
6907
6908	os_get_reltime(&now);
6909
6910	dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
6911	{
6912		int ret;
6913
6914		os_reltime_sub(&now, &work->time, &diff);
6915		ret = os_snprintf(pos, end - pos, "%s@%s:%u:%u:%ld.%06ld\n",
6916				  work->type, work->wpa_s->ifname, work->freq,
6917				  work->started, diff.sec, diff.usec);
6918		if (os_snprintf_error(end - pos, ret))
6919			break;
6920		pos += ret;
6921	}
6922
6923	return pos - buf;
6924}
6925
6926
6927static void wpas_ctrl_radio_work_timeout(void *eloop_ctx, void *timeout_ctx)
6928{
6929	struct wpa_radio_work *work = eloop_ctx;
6930	struct wpa_external_work *ework = work->ctx;
6931
6932	wpa_dbg(work->wpa_s, MSG_DEBUG,
6933		"Timing out external radio work %u (%s)",
6934		ework->id, work->type);
6935	wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_TIMEOUT "%u", ework->id);
6936	work->wpa_s->ext_work_in_progress = 0;
6937	radio_work_done(work);
6938	os_free(ework);
6939}
6940
6941
6942static void wpas_ctrl_radio_work_cb(struct wpa_radio_work *work, int deinit)
6943{
6944	struct wpa_external_work *ework = work->ctx;
6945
6946	if (deinit) {
6947		if (work->started)
6948			eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
6949					     work, NULL);
6950
6951		os_free(ework);
6952		return;
6953	}
6954
6955	wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting external radio work %u (%s)",
6956		ework->id, ework->type);
6957	wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_START "%u", ework->id);
6958	work->wpa_s->ext_work_in_progress = 1;
6959	if (!ework->timeout)
6960		ework->timeout = 10;
6961	eloop_register_timeout(ework->timeout, 0, wpas_ctrl_radio_work_timeout,
6962			       work, NULL);
6963}
6964
6965
6966static int wpas_ctrl_radio_work_add(struct wpa_supplicant *wpa_s, char *cmd,
6967				    char *buf, size_t buflen)
6968{
6969	struct wpa_external_work *ework;
6970	char *pos, *pos2;
6971	size_t type_len;
6972	int ret;
6973	unsigned int freq = 0;
6974
6975	/* format: <name> [freq=<MHz>] [timeout=<seconds>] */
6976
6977	ework = os_zalloc(sizeof(*ework));
6978	if (ework == NULL)
6979		return -1;
6980
6981	pos = os_strchr(cmd, ' ');
6982	if (pos) {
6983		type_len = pos - cmd;
6984		pos++;
6985
6986		pos2 = os_strstr(pos, "freq=");
6987		if (pos2)
6988			freq = atoi(pos2 + 5);
6989
6990		pos2 = os_strstr(pos, "timeout=");
6991		if (pos2)
6992			ework->timeout = atoi(pos2 + 8);
6993	} else {
6994		type_len = os_strlen(cmd);
6995	}
6996	if (4 + type_len >= sizeof(ework->type))
6997		type_len = sizeof(ework->type) - 4 - 1;
6998	os_strlcpy(ework->type, "ext:", sizeof(ework->type));
6999	os_memcpy(ework->type + 4, cmd, type_len);
7000	ework->type[4 + type_len] = '\0';
7001
7002	wpa_s->ext_work_id++;
7003	if (wpa_s->ext_work_id == 0)
7004		wpa_s->ext_work_id++;
7005	ework->id = wpa_s->ext_work_id;
7006
7007	if (radio_add_work(wpa_s, freq, ework->type, 0, wpas_ctrl_radio_work_cb,
7008			   ework) < 0) {
7009		os_free(ework);
7010		return -1;
7011	}
7012
7013	ret = os_snprintf(buf, buflen, "%u", ework->id);
7014	if (os_snprintf_error(buflen, ret))
7015		return -1;
7016	return ret;
7017}
7018
7019
7020static int wpas_ctrl_radio_work_done(struct wpa_supplicant *wpa_s, char *cmd)
7021{
7022	struct wpa_radio_work *work;
7023	unsigned int id = atoi(cmd);
7024
7025	dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
7026	{
7027		struct wpa_external_work *ework;
7028
7029		if (os_strncmp(work->type, "ext:", 4) != 0)
7030			continue;
7031		ework = work->ctx;
7032		if (id && ework->id != id)
7033			continue;
7034		wpa_dbg(wpa_s, MSG_DEBUG,
7035			"Completed external radio work %u (%s)",
7036			ework->id, ework->type);
7037		eloop_cancel_timeout(wpas_ctrl_radio_work_timeout, work, NULL);
7038		wpa_s->ext_work_in_progress = 0;
7039		radio_work_done(work);
7040		os_free(ework);
7041		return 3; /* "OK\n" */
7042	}
7043
7044	return -1;
7045}
7046
7047
7048static int wpas_ctrl_radio_work(struct wpa_supplicant *wpa_s, char *cmd,
7049				char *buf, size_t buflen)
7050{
7051	if (os_strcmp(cmd, "show") == 0)
7052		return wpas_ctrl_radio_work_show(wpa_s, buf, buflen);
7053	if (os_strncmp(cmd, "add ", 4) == 0)
7054		return wpas_ctrl_radio_work_add(wpa_s, cmd + 4, buf, buflen);
7055	if (os_strncmp(cmd, "done ", 5) == 0)
7056		return wpas_ctrl_radio_work_done(wpa_s, cmd + 4);
7057	return -1;
7058}
7059
7060
7061void wpas_ctrl_radio_work_flush(struct wpa_supplicant *wpa_s)
7062{
7063	struct wpa_radio_work *work, *tmp;
7064
7065	if (!wpa_s || !wpa_s->radio)
7066		return;
7067
7068	dl_list_for_each_safe(work, tmp, &wpa_s->radio->work,
7069			      struct wpa_radio_work, list) {
7070		struct wpa_external_work *ework;
7071
7072		if (os_strncmp(work->type, "ext:", 4) != 0)
7073			continue;
7074		ework = work->ctx;
7075		wpa_dbg(wpa_s, MSG_DEBUG,
7076			"Flushing%s external radio work %u (%s)",
7077			work->started ? " started" : "", ework->id,
7078			ework->type);
7079		if (work->started)
7080			eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
7081					     work, NULL);
7082		radio_work_done(work);
7083		os_free(ework);
7084	}
7085}
7086
7087
7088static void wpas_ctrl_eapol_response(void *eloop_ctx, void *timeout_ctx)
7089{
7090	struct wpa_supplicant *wpa_s = eloop_ctx;
7091	eapol_sm_notify_ctrl_response(wpa_s->eapol);
7092}
7093
7094
7095static int scan_id_list_parse(struct wpa_supplicant *wpa_s, const char *value,
7096			      unsigned int *scan_id_count, int scan_id[])
7097{
7098	const char *pos = value;
7099
7100	while (pos) {
7101		if (*pos == ' ' || *pos == '\0')
7102			break;
7103		if (*scan_id_count == MAX_SCAN_ID)
7104			return -1;
7105		scan_id[(*scan_id_count)++] = atoi(pos);
7106		pos = os_strchr(pos, ',');
7107		if (pos)
7108			pos++;
7109	}
7110
7111	return 0;
7112}
7113
7114
7115static void wpas_ctrl_scan(struct wpa_supplicant *wpa_s, char *params,
7116			   char *reply, int reply_size, int *reply_len)
7117{
7118	char *pos;
7119	unsigned int manual_scan_passive = 0;
7120	unsigned int manual_scan_use_id = 0;
7121	unsigned int manual_scan_only_new = 0;
7122	unsigned int scan_only = 0;
7123	unsigned int scan_id_count = 0;
7124	int scan_id[MAX_SCAN_ID];
7125	void (*scan_res_handler)(struct wpa_supplicant *wpa_s,
7126				 struct wpa_scan_results *scan_res);
7127	int *manual_scan_freqs = NULL;
7128	struct wpa_ssid_value *ssid = NULL, *ns;
7129	unsigned int ssid_count = 0;
7130
7131	if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
7132		*reply_len = -1;
7133		return;
7134	}
7135
7136	if (radio_work_pending(wpa_s, "scan")) {
7137		wpa_printf(MSG_DEBUG,
7138			   "Pending scan scheduled - reject new request");
7139		*reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
7140		return;
7141	}
7142
7143#ifdef CONFIG_INTERWORKING
7144	if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select) {
7145		wpa_printf(MSG_DEBUG,
7146			   "Interworking select in progress - reject new scan");
7147		*reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
7148		return;
7149	}
7150#endif /* CONFIG_INTERWORKING */
7151
7152	if (params) {
7153		if (os_strncasecmp(params, "TYPE=ONLY", 9) == 0)
7154			scan_only = 1;
7155
7156		pos = os_strstr(params, "freq=");
7157		if (pos) {
7158			manual_scan_freqs = freq_range_to_channel_list(wpa_s,
7159								       pos + 5);
7160			if (manual_scan_freqs == NULL) {
7161				*reply_len = -1;
7162				goto done;
7163			}
7164		}
7165
7166		pos = os_strstr(params, "passive=");
7167		if (pos)
7168			manual_scan_passive = !!atoi(pos + 8);
7169
7170		pos = os_strstr(params, "use_id=");
7171		if (pos)
7172			manual_scan_use_id = atoi(pos + 7);
7173
7174		pos = os_strstr(params, "only_new=1");
7175		if (pos)
7176			manual_scan_only_new = 1;
7177
7178		pos = os_strstr(params, "scan_id=");
7179		if (pos && scan_id_list_parse(wpa_s, pos + 8, &scan_id_count,
7180					      scan_id) < 0) {
7181			*reply_len = -1;
7182			goto done;
7183		}
7184
7185		pos = params;
7186		while (pos && *pos != '\0') {
7187			if (os_strncmp(pos, "ssid ", 5) == 0) {
7188				char *end;
7189
7190				pos += 5;
7191				end = pos;
7192				while (*end) {
7193					if (*end == '\0' || *end == ' ')
7194						break;
7195					end++;
7196				}
7197
7198				ns = os_realloc_array(
7199					ssid, ssid_count + 1,
7200					sizeof(struct wpa_ssid_value));
7201				if (ns == NULL) {
7202					*reply_len = -1;
7203					goto done;
7204				}
7205				ssid = ns;
7206
7207				if ((end - pos) & 0x01 ||
7208				    end - pos > 2 * SSID_MAX_LEN ||
7209				    hexstr2bin(pos, ssid[ssid_count].ssid,
7210					       (end - pos) / 2) < 0) {
7211					wpa_printf(MSG_DEBUG,
7212						   "Invalid SSID value '%s'",
7213						   pos);
7214					*reply_len = -1;
7215					goto done;
7216				}
7217				ssid[ssid_count].ssid_len = (end - pos) / 2;
7218				wpa_hexdump_ascii(MSG_DEBUG, "scan SSID",
7219						  ssid[ssid_count].ssid,
7220						  ssid[ssid_count].ssid_len);
7221				ssid_count++;
7222				pos = end;
7223			}
7224
7225			pos = os_strchr(pos, ' ');
7226			if (pos)
7227				pos++;
7228		}
7229	}
7230
7231	wpa_s->num_ssids_from_scan_req = ssid_count;
7232	os_free(wpa_s->ssids_from_scan_req);
7233	if (ssid_count) {
7234		wpa_s->ssids_from_scan_req = ssid;
7235		ssid = NULL;
7236	} else {
7237		wpa_s->ssids_from_scan_req = NULL;
7238	}
7239
7240	if (scan_only)
7241		scan_res_handler = scan_only_handler;
7242	else if (wpa_s->scan_res_handler == scan_only_handler)
7243		scan_res_handler = NULL;
7244	else
7245		scan_res_handler = wpa_s->scan_res_handler;
7246
7247	if (!wpa_s->sched_scanning && !wpa_s->scanning &&
7248	    ((wpa_s->wpa_state <= WPA_SCANNING) ||
7249	     (wpa_s->wpa_state == WPA_COMPLETED))) {
7250		wpa_s->manual_scan_passive = manual_scan_passive;
7251		wpa_s->manual_scan_use_id = manual_scan_use_id;
7252		wpa_s->manual_scan_only_new = manual_scan_only_new;
7253		wpa_s->scan_id_count = scan_id_count;
7254		os_memcpy(wpa_s->scan_id, scan_id, scan_id_count * sizeof(int));
7255		wpa_s->scan_res_handler = scan_res_handler;
7256		os_free(wpa_s->manual_scan_freqs);
7257		wpa_s->manual_scan_freqs = manual_scan_freqs;
7258		manual_scan_freqs = NULL;
7259
7260		wpa_s->normal_scans = 0;
7261		wpa_s->scan_req = MANUAL_SCAN_REQ;
7262		wpa_s->after_wps = 0;
7263		wpa_s->known_wps_freq = 0;
7264		wpa_supplicant_req_scan(wpa_s, 0, 0);
7265		if (wpa_s->manual_scan_use_id) {
7266			wpa_s->manual_scan_id++;
7267			wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
7268				wpa_s->manual_scan_id);
7269			*reply_len = os_snprintf(reply, reply_size, "%u\n",
7270						 wpa_s->manual_scan_id);
7271		}
7272	} else if (wpa_s->sched_scanning) {
7273		wpa_s->manual_scan_passive = manual_scan_passive;
7274		wpa_s->manual_scan_use_id = manual_scan_use_id;
7275		wpa_s->manual_scan_only_new = manual_scan_only_new;
7276		wpa_s->scan_id_count = scan_id_count;
7277		os_memcpy(wpa_s->scan_id, scan_id, scan_id_count * sizeof(int));
7278		wpa_s->scan_res_handler = scan_res_handler;
7279		os_free(wpa_s->manual_scan_freqs);
7280		wpa_s->manual_scan_freqs = manual_scan_freqs;
7281		manual_scan_freqs = NULL;
7282
7283		wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to allow requested full scan to proceed");
7284		wpa_supplicant_cancel_sched_scan(wpa_s);
7285		wpa_s->scan_req = MANUAL_SCAN_REQ;
7286		wpa_supplicant_req_scan(wpa_s, 0, 0);
7287		if (wpa_s->manual_scan_use_id) {
7288			wpa_s->manual_scan_id++;
7289			*reply_len = os_snprintf(reply, reply_size, "%u\n",
7290						 wpa_s->manual_scan_id);
7291			wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
7292				wpa_s->manual_scan_id);
7293		}
7294	} else {
7295		wpa_printf(MSG_DEBUG, "Ongoing scan action - reject new request");
7296		*reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
7297	}
7298
7299done:
7300	os_free(manual_scan_freqs);
7301	os_free(ssid);
7302}
7303
7304
7305#ifdef CONFIG_TESTING_OPTIONS
7306
7307static void wpas_ctrl_iface_mgmt_tx_cb(struct wpa_supplicant *wpa_s,
7308				       unsigned int freq, const u8 *dst,
7309				       const u8 *src, const u8 *bssid,
7310				       const u8 *data, size_t data_len,
7311				       enum offchannel_send_action_result
7312				       result)
7313{
7314	wpa_msg(wpa_s, MSG_INFO, "MGMT-TX-STATUS freq=%u dst=" MACSTR
7315		" src=" MACSTR " bssid=" MACSTR " result=%s",
7316		freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid),
7317		result == OFFCHANNEL_SEND_ACTION_SUCCESS ?
7318		"SUCCESS" : (result == OFFCHANNEL_SEND_ACTION_NO_ACK ?
7319			     "NO_ACK" : "FAILED"));
7320}
7321
7322
7323static int wpas_ctrl_iface_mgmt_tx(struct wpa_supplicant *wpa_s, char *cmd)
7324{
7325	char *pos, *param;
7326	size_t len;
7327	u8 *buf, da[ETH_ALEN], bssid[ETH_ALEN];
7328	int res, used;
7329	int freq = 0, no_cck = 0, wait_time = 0;
7330
7331	/* <DA> <BSSID> [freq=<MHz>] [wait_time=<ms>] [no_cck=1]
7332	 *    <action=Action frame payload> */
7333
7334	wpa_printf(MSG_DEBUG, "External MGMT TX: %s", cmd);
7335
7336	pos = cmd;
7337	used = hwaddr_aton2(pos, da);
7338	if (used < 0)
7339		return -1;
7340	pos += used;
7341	while (*pos == ' ')
7342		pos++;
7343	used = hwaddr_aton2(pos, bssid);
7344	if (used < 0)
7345		return -1;
7346	pos += used;
7347
7348	param = os_strstr(pos, " freq=");
7349	if (param) {
7350		param += 6;
7351		freq = atoi(param);
7352	}
7353
7354	param = os_strstr(pos, " no_cck=");
7355	if (param) {
7356		param += 8;
7357		no_cck = atoi(param);
7358	}
7359
7360	param = os_strstr(pos, " wait_time=");
7361	if (param) {
7362		param += 11;
7363		wait_time = atoi(param);
7364	}
7365
7366	param = os_strstr(pos, " action=");
7367	if (param == NULL)
7368		return -1;
7369	param += 8;
7370
7371	len = os_strlen(param);
7372	if (len & 1)
7373		return -1;
7374	len /= 2;
7375
7376	buf = os_malloc(len);
7377	if (buf == NULL)
7378		return -1;
7379
7380	if (hexstr2bin(param, buf, len) < 0) {
7381		os_free(buf);
7382		return -1;
7383	}
7384
7385	res = offchannel_send_action(wpa_s, freq, da, wpa_s->own_addr, bssid,
7386				     buf, len, wait_time,
7387				     wpas_ctrl_iface_mgmt_tx_cb, no_cck);
7388	os_free(buf);
7389	return res;
7390}
7391
7392
7393static void wpas_ctrl_iface_mgmt_tx_done(struct wpa_supplicant *wpa_s)
7394{
7395	wpa_printf(MSG_DEBUG, "External MGMT TX - done waiting");
7396	offchannel_send_action_done(wpa_s);
7397}
7398
7399
7400static int wpas_ctrl_iface_driver_event(struct wpa_supplicant *wpa_s, char *cmd)
7401{
7402	char *pos, *param;
7403	union wpa_event_data event;
7404	enum wpa_event_type ev;
7405
7406	/* <event name> [parameters..] */
7407
7408	wpa_dbg(wpa_s, MSG_DEBUG, "Testing - external driver event: %s", cmd);
7409
7410	pos = cmd;
7411	param = os_strchr(pos, ' ');
7412	if (param)
7413		*param++ = '\0';
7414
7415	os_memset(&event, 0, sizeof(event));
7416
7417	if (os_strcmp(cmd, "INTERFACE_ENABLED") == 0) {
7418		ev = EVENT_INTERFACE_ENABLED;
7419	} else if (os_strcmp(cmd, "INTERFACE_DISABLED") == 0) {
7420		ev = EVENT_INTERFACE_DISABLED;
7421	} else if (os_strcmp(cmd, "AVOID_FREQUENCIES") == 0) {
7422		ev = EVENT_AVOID_FREQUENCIES;
7423		if (param == NULL)
7424			param = "";
7425		if (freq_range_list_parse(&event.freq_range, param) < 0)
7426			return -1;
7427		wpa_supplicant_event(wpa_s, ev, &event);
7428		os_free(event.freq_range.range);
7429		return 0;
7430	} else {
7431		wpa_dbg(wpa_s, MSG_DEBUG, "Testing - unknown driver event: %s",
7432			cmd);
7433		return -1;
7434	}
7435
7436	wpa_supplicant_event(wpa_s, ev, &event);
7437
7438	return 0;
7439}
7440
7441
7442static int wpas_ctrl_iface_eapol_rx(struct wpa_supplicant *wpa_s, char *cmd)
7443{
7444	char *pos;
7445	u8 src[ETH_ALEN], *buf;
7446	int used;
7447	size_t len;
7448
7449	wpa_printf(MSG_DEBUG, "External EAPOL RX: %s", cmd);
7450
7451	pos = cmd;
7452	used = hwaddr_aton2(pos, src);
7453	if (used < 0)
7454		return -1;
7455	pos += used;
7456	while (*pos == ' ')
7457		pos++;
7458
7459	len = os_strlen(pos);
7460	if (len & 1)
7461		return -1;
7462	len /= 2;
7463
7464	buf = os_malloc(len);
7465	if (buf == NULL)
7466		return -1;
7467
7468	if (hexstr2bin(pos, buf, len) < 0) {
7469		os_free(buf);
7470		return -1;
7471	}
7472
7473	wpa_supplicant_rx_eapol(wpa_s, src, buf, len);
7474	os_free(buf);
7475
7476	return 0;
7477}
7478
7479
7480static u16 ipv4_hdr_checksum(const void *buf, size_t len)
7481{
7482	size_t i;
7483	u32 sum = 0;
7484	const u16 *pos = buf;
7485
7486	for (i = 0; i < len / 2; i++)
7487		sum += *pos++;
7488
7489	while (sum >> 16)
7490		sum = (sum & 0xffff) + (sum >> 16);
7491
7492	return sum ^ 0xffff;
7493}
7494
7495
7496#define HWSIM_PACKETLEN 1500
7497#define HWSIM_IP_LEN (HWSIM_PACKETLEN - sizeof(struct ether_header))
7498
7499void wpas_data_test_rx(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
7500{
7501	struct wpa_supplicant *wpa_s = ctx;
7502	const struct ether_header *eth;
7503	struct iphdr ip;
7504	const u8 *pos;
7505	unsigned int i;
7506
7507	if (len != HWSIM_PACKETLEN)
7508		return;
7509
7510	eth = (const struct ether_header *) buf;
7511	os_memcpy(&ip, eth + 1, sizeof(ip));
7512	pos = &buf[sizeof(*eth) + sizeof(ip)];
7513
7514	if (ip.ihl != 5 || ip.version != 4 ||
7515	    ntohs(ip.tot_len) != HWSIM_IP_LEN)
7516		return;
7517
7518	for (i = 0; i < HWSIM_IP_LEN - sizeof(ip); i++) {
7519		if (*pos != (u8) i)
7520			return;
7521		pos++;
7522	}
7523
7524	wpa_msg(wpa_s, MSG_INFO, "DATA-TEST-RX " MACSTR " " MACSTR,
7525		MAC2STR(eth->ether_dhost), MAC2STR(eth->ether_shost));
7526}
7527
7528
7529static int wpas_ctrl_iface_data_test_config(struct wpa_supplicant *wpa_s,
7530					    char *cmd)
7531{
7532	int enabled = atoi(cmd);
7533
7534	if (!enabled) {
7535		if (wpa_s->l2_test) {
7536			l2_packet_deinit(wpa_s->l2_test);
7537			wpa_s->l2_test = NULL;
7538			wpa_dbg(wpa_s, MSG_DEBUG, "test data: Disabled");
7539		}
7540		return 0;
7541	}
7542
7543	if (wpa_s->l2_test)
7544		return 0;
7545
7546	wpa_s->l2_test = l2_packet_init(wpa_s->ifname, wpa_s->own_addr,
7547					ETHERTYPE_IP, wpas_data_test_rx,
7548					wpa_s, 1);
7549	if (wpa_s->l2_test == NULL)
7550		return -1;
7551
7552	wpa_dbg(wpa_s, MSG_DEBUG, "test data: Enabled");
7553
7554	return 0;
7555}
7556
7557
7558static int wpas_ctrl_iface_data_test_tx(struct wpa_supplicant *wpa_s, char *cmd)
7559{
7560	u8 dst[ETH_ALEN], src[ETH_ALEN];
7561	char *pos;
7562	int used;
7563	long int val;
7564	u8 tos;
7565	u8 buf[2 + HWSIM_PACKETLEN];
7566	struct ether_header *eth;
7567	struct iphdr *ip;
7568	u8 *dpos;
7569	unsigned int i;
7570
7571	if (wpa_s->l2_test == NULL)
7572		return -1;
7573
7574	/* format: <dst> <src> <tos> */
7575
7576	pos = cmd;
7577	used = hwaddr_aton2(pos, dst);
7578	if (used < 0)
7579		return -1;
7580	pos += used;
7581	while (*pos == ' ')
7582		pos++;
7583	used = hwaddr_aton2(pos, src);
7584	if (used < 0)
7585		return -1;
7586	pos += used;
7587
7588	val = strtol(pos, NULL, 0);
7589	if (val < 0 || val > 0xff)
7590		return -1;
7591	tos = val;
7592
7593	eth = (struct ether_header *) &buf[2];
7594	os_memcpy(eth->ether_dhost, dst, ETH_ALEN);
7595	os_memcpy(eth->ether_shost, src, ETH_ALEN);
7596	eth->ether_type = htons(ETHERTYPE_IP);
7597	ip = (struct iphdr *) (eth + 1);
7598	os_memset(ip, 0, sizeof(*ip));
7599	ip->ihl = 5;
7600	ip->version = 4;
7601	ip->ttl = 64;
7602	ip->tos = tos;
7603	ip->tot_len = htons(HWSIM_IP_LEN);
7604	ip->protocol = 1;
7605	ip->saddr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 1);
7606	ip->daddr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 2);
7607	ip->check = ipv4_hdr_checksum(ip, sizeof(*ip));
7608	dpos = (u8 *) (ip + 1);
7609	for (i = 0; i < HWSIM_IP_LEN - sizeof(*ip); i++)
7610		*dpos++ = i;
7611
7612	if (l2_packet_send(wpa_s->l2_test, dst, ETHERTYPE_IP, &buf[2],
7613			   HWSIM_PACKETLEN) < 0)
7614		return -1;
7615
7616	wpa_dbg(wpa_s, MSG_DEBUG, "test data: TX dst=" MACSTR " src=" MACSTR
7617		" tos=0x%x", MAC2STR(dst), MAC2STR(src), tos);
7618
7619	return 0;
7620}
7621
7622
7623static int wpas_ctrl_iface_data_test_frame(struct wpa_supplicant *wpa_s,
7624					   char *cmd)
7625{
7626	u8 *buf;
7627	struct ether_header *eth;
7628	struct l2_packet_data *l2 = NULL;
7629	size_t len;
7630	u16 ethertype;
7631	int res = -1;
7632
7633	len = os_strlen(cmd);
7634	if (len & 1 || len < ETH_HLEN * 2)
7635		return -1;
7636	len /= 2;
7637
7638	buf = os_malloc(len);
7639	if (buf == NULL)
7640		return -1;
7641
7642	if (hexstr2bin(cmd, buf, len) < 0)
7643		goto done;
7644
7645	eth = (struct ether_header *) buf;
7646	ethertype = ntohs(eth->ether_type);
7647
7648	l2 = l2_packet_init(wpa_s->ifname, wpa_s->own_addr, ethertype,
7649			    wpas_data_test_rx, wpa_s, 1);
7650	if (l2 == NULL)
7651		goto done;
7652
7653	res = l2_packet_send(l2, eth->ether_dhost, ethertype, buf, len);
7654	wpa_dbg(wpa_s, MSG_DEBUG, "test data: TX frame res=%d", res);
7655done:
7656	if (l2)
7657		l2_packet_deinit(l2);
7658	os_free(buf);
7659
7660	return res < 0 ? -1 : 0;
7661}
7662
7663
7664static int wpas_ctrl_test_alloc_fail(struct wpa_supplicant *wpa_s, char *cmd)
7665{
7666#ifdef WPA_TRACE_BFD
7667	extern char wpa_trace_fail_func[256];
7668	extern unsigned int wpa_trace_fail_after;
7669	char *pos;
7670
7671	wpa_trace_fail_after = atoi(cmd);
7672	pos = os_strchr(cmd, ':');
7673	if (pos) {
7674		pos++;
7675		os_strlcpy(wpa_trace_fail_func, pos,
7676			   sizeof(wpa_trace_fail_func));
7677	} else {
7678		wpa_trace_fail_after = 0;
7679	}
7680	return 0;
7681#else /* WPA_TRACE_BFD */
7682	return -1;
7683#endif /* WPA_TRACE_BFD */
7684}
7685
7686
7687static int wpas_ctrl_get_alloc_fail(struct wpa_supplicant *wpa_s,
7688				    char *buf, size_t buflen)
7689{
7690#ifdef WPA_TRACE_BFD
7691	extern char wpa_trace_fail_func[256];
7692	extern unsigned int wpa_trace_fail_after;
7693
7694	return os_snprintf(buf, buflen, "%u:%s", wpa_trace_fail_after,
7695			   wpa_trace_fail_func);
7696#else /* WPA_TRACE_BFD */
7697	return -1;
7698#endif /* WPA_TRACE_BFD */
7699}
7700
7701
7702static int wpas_ctrl_test_fail(struct wpa_supplicant *wpa_s, char *cmd)
7703{
7704#ifdef WPA_TRACE_BFD
7705	extern char wpa_trace_test_fail_func[256];
7706	extern unsigned int wpa_trace_test_fail_after;
7707	char *pos;
7708
7709	wpa_trace_test_fail_after = atoi(cmd);
7710	pos = os_strchr(cmd, ':');
7711	if (pos) {
7712		pos++;
7713		os_strlcpy(wpa_trace_test_fail_func, pos,
7714			   sizeof(wpa_trace_test_fail_func));
7715	} else {
7716		wpa_trace_test_fail_after = 0;
7717	}
7718	return 0;
7719#else /* WPA_TRACE_BFD */
7720	return -1;
7721#endif /* WPA_TRACE_BFD */
7722}
7723
7724
7725static int wpas_ctrl_get_fail(struct wpa_supplicant *wpa_s,
7726				    char *buf, size_t buflen)
7727{
7728#ifdef WPA_TRACE_BFD
7729	extern char wpa_trace_test_fail_func[256];
7730	extern unsigned int wpa_trace_test_fail_after;
7731
7732	return os_snprintf(buf, buflen, "%u:%s", wpa_trace_test_fail_after,
7733			   wpa_trace_test_fail_func);
7734#else /* WPA_TRACE_BFD */
7735	return -1;
7736#endif /* WPA_TRACE_BFD */
7737}
7738
7739#endif /* CONFIG_TESTING_OPTIONS */
7740
7741
7742static void wpas_ctrl_vendor_elem_update(struct wpa_supplicant *wpa_s)
7743{
7744	unsigned int i;
7745	char buf[30];
7746
7747	wpa_printf(MSG_DEBUG, "Update vendor elements");
7748
7749	for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
7750		if (wpa_s->vendor_elem[i]) {
7751			int res;
7752
7753			res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
7754			if (!os_snprintf_error(sizeof(buf), res)) {
7755				wpa_hexdump_buf(MSG_DEBUG, buf,
7756						wpa_s->vendor_elem[i]);
7757			}
7758		}
7759	}
7760
7761#ifdef CONFIG_P2P
7762	if (wpa_s->parent == wpa_s &&
7763	    wpa_s->global->p2p &&
7764	    !wpa_s->global->p2p_disabled)
7765		p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
7766#endif /* CONFIG_P2P */
7767}
7768
7769
7770static struct wpa_supplicant *
7771wpas_ctrl_vendor_elem_iface(struct wpa_supplicant *wpa_s,
7772			    enum wpa_vendor_elem_frame frame)
7773{
7774	switch (frame) {
7775#ifdef CONFIG_P2P
7776	case VENDOR_ELEM_PROBE_REQ_P2P:
7777	case VENDOR_ELEM_PROBE_RESP_P2P:
7778	case VENDOR_ELEM_PROBE_RESP_P2P_GO:
7779	case VENDOR_ELEM_BEACON_P2P_GO:
7780	case VENDOR_ELEM_P2P_PD_REQ:
7781	case VENDOR_ELEM_P2P_PD_RESP:
7782	case VENDOR_ELEM_P2P_GO_NEG_REQ:
7783	case VENDOR_ELEM_P2P_GO_NEG_RESP:
7784	case VENDOR_ELEM_P2P_GO_NEG_CONF:
7785	case VENDOR_ELEM_P2P_INV_REQ:
7786	case VENDOR_ELEM_P2P_INV_RESP:
7787	case VENDOR_ELEM_P2P_ASSOC_REQ:
7788		return wpa_s->parent;
7789#endif /* CONFIG_P2P */
7790	default:
7791		return wpa_s;
7792	}
7793}
7794
7795
7796static int wpas_ctrl_vendor_elem_add(struct wpa_supplicant *wpa_s, char *cmd)
7797{
7798	char *pos = cmd;
7799	int frame;
7800	size_t len;
7801	struct wpabuf *buf;
7802	struct ieee802_11_elems elems;
7803
7804	frame = atoi(pos);
7805	if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
7806		return -1;
7807	wpa_s = wpas_ctrl_vendor_elem_iface(wpa_s, frame);
7808
7809	pos = os_strchr(pos, ' ');
7810	if (pos == NULL)
7811		return -1;
7812	pos++;
7813
7814	len = os_strlen(pos);
7815	if (len == 0)
7816		return 0;
7817	if (len & 1)
7818		return -1;
7819	len /= 2;
7820
7821	buf = wpabuf_alloc(len);
7822	if (buf == NULL)
7823		return -1;
7824
7825	if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
7826		wpabuf_free(buf);
7827		return -1;
7828	}
7829
7830	if (ieee802_11_parse_elems(wpabuf_head_u8(buf), len, &elems, 0) ==
7831	    ParseFailed) {
7832		wpabuf_free(buf);
7833		return -1;
7834	}
7835
7836	if (wpa_s->vendor_elem[frame] == NULL) {
7837		wpa_s->vendor_elem[frame] = buf;
7838		wpas_ctrl_vendor_elem_update(wpa_s);
7839		return 0;
7840	}
7841
7842	if (wpabuf_resize(&wpa_s->vendor_elem[frame], len) < 0) {
7843		wpabuf_free(buf);
7844		return -1;
7845	}
7846
7847	wpabuf_put_buf(wpa_s->vendor_elem[frame], buf);
7848	wpabuf_free(buf);
7849	wpas_ctrl_vendor_elem_update(wpa_s);
7850
7851	return 0;
7852}
7853
7854
7855static int wpas_ctrl_vendor_elem_get(struct wpa_supplicant *wpa_s, char *cmd,
7856				     char *buf, size_t buflen)
7857{
7858	int frame = atoi(cmd);
7859
7860	if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
7861		return -1;
7862	wpa_s = wpas_ctrl_vendor_elem_iface(wpa_s, frame);
7863
7864	if (wpa_s->vendor_elem[frame] == NULL)
7865		return 0;
7866
7867	return wpa_snprintf_hex(buf, buflen,
7868				wpabuf_head_u8(wpa_s->vendor_elem[frame]),
7869				wpabuf_len(wpa_s->vendor_elem[frame]));
7870}
7871
7872
7873static int wpas_ctrl_vendor_elem_remove(struct wpa_supplicant *wpa_s, char *cmd)
7874{
7875	char *pos = cmd;
7876	int frame;
7877	size_t len;
7878	u8 *buf;
7879	struct ieee802_11_elems elems;
7880	u8 *ie, *end;
7881
7882	frame = atoi(pos);
7883	if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
7884		return -1;
7885	wpa_s = wpas_ctrl_vendor_elem_iface(wpa_s, frame);
7886
7887	pos = os_strchr(pos, ' ');
7888	if (pos == NULL)
7889		return -1;
7890	pos++;
7891
7892	if (*pos == '*') {
7893		wpabuf_free(wpa_s->vendor_elem[frame]);
7894		wpa_s->vendor_elem[frame] = NULL;
7895		wpas_ctrl_vendor_elem_update(wpa_s);
7896		return 0;
7897	}
7898
7899	if (wpa_s->vendor_elem[frame] == NULL)
7900		return -1;
7901
7902	len = os_strlen(pos);
7903	if (len == 0)
7904		return 0;
7905	if (len & 1)
7906		return -1;
7907	len /= 2;
7908
7909	buf = os_malloc(len);
7910	if (buf == NULL)
7911		return -1;
7912
7913	if (hexstr2bin(pos, buf, len) < 0) {
7914		os_free(buf);
7915		return -1;
7916	}
7917
7918	if (ieee802_11_parse_elems(buf, len, &elems, 0) == ParseFailed) {
7919		os_free(buf);
7920		return -1;
7921	}
7922
7923	ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
7924	end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
7925
7926	for (; ie + 1 < end; ie += 2 + ie[1]) {
7927		if (ie + len > end)
7928			break;
7929		if (os_memcmp(ie, buf, len) != 0)
7930			continue;
7931
7932		if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
7933			wpabuf_free(wpa_s->vendor_elem[frame]);
7934			wpa_s->vendor_elem[frame] = NULL;
7935		} else {
7936			os_memmove(ie, ie + len,
7937				   end - (ie + len));
7938			wpa_s->vendor_elem[frame]->used -= len;
7939		}
7940		os_free(buf);
7941		wpas_ctrl_vendor_elem_update(wpa_s);
7942		return 0;
7943	}
7944
7945	os_free(buf);
7946
7947	return -1;
7948}
7949
7950
7951static void wpas_ctrl_neighbor_rep_cb(void *ctx, struct wpabuf *neighbor_rep)
7952{
7953	struct wpa_supplicant *wpa_s = ctx;
7954
7955	if (neighbor_rep) {
7956		wpa_msg_ctrl(wpa_s, MSG_INFO, RRM_EVENT_NEIGHBOR_REP_RXED
7957			     "length=%u",
7958			     (unsigned int) wpabuf_len(neighbor_rep));
7959		wpabuf_free(neighbor_rep);
7960	} else {
7961		wpa_msg_ctrl(wpa_s, MSG_INFO, RRM_EVENT_NEIGHBOR_REP_FAILED);
7962	}
7963}
7964
7965
7966static int wpas_ctrl_iface_send_neigbor_rep(struct wpa_supplicant *wpa_s,
7967					    char *cmd)
7968{
7969	struct wpa_ssid ssid;
7970	struct wpa_ssid *ssid_p = NULL;
7971	int ret = 0;
7972
7973	if (os_strncmp(cmd, " ssid=", 6) == 0) {
7974		ssid.ssid_len = os_strlen(cmd + 6);
7975		if (ssid.ssid_len > SSID_MAX_LEN)
7976			return -1;
7977		ssid.ssid = (u8 *) (cmd + 6);
7978		ssid_p = &ssid;
7979	}
7980
7981	ret = wpas_rrm_send_neighbor_rep_request(wpa_s, ssid_p,
7982						 wpas_ctrl_neighbor_rep_cb,
7983						 wpa_s);
7984
7985	return ret;
7986}
7987
7988
7989static int wpas_ctrl_iface_erp_flush(struct wpa_supplicant *wpa_s)
7990{
7991	eapol_sm_erp_flush(wpa_s->eapol);
7992	return 0;
7993}
7994
7995
7996static int wpas_ctrl_iface_mac_rand_scan(struct wpa_supplicant *wpa_s,
7997					 char *cmd)
7998{
7999	char *token, *context = NULL;
8000	unsigned int enable = ~0, type = 0;
8001	u8 _addr[ETH_ALEN], _mask[ETH_ALEN];
8002	u8 *addr = NULL, *mask = NULL;
8003
8004	while ((token = str_token(cmd, " ", &context))) {
8005		if (os_strcasecmp(token, "scan") == 0) {
8006			type |= MAC_ADDR_RAND_SCAN;
8007		} else if (os_strcasecmp(token, "sched") == 0) {
8008			type |= MAC_ADDR_RAND_SCHED_SCAN;
8009		} else if (os_strcasecmp(token, "pno") == 0) {
8010			type |= MAC_ADDR_RAND_PNO;
8011		} else if (os_strcasecmp(token, "all") == 0) {
8012			type = wpa_s->mac_addr_rand_supported;
8013		} else if (os_strncasecmp(token, "enable=", 7) == 0) {
8014			enable = atoi(token + 7);
8015		} else if (os_strncasecmp(token, "addr=", 5) == 0) {
8016			addr = _addr;
8017			if (hwaddr_aton(token + 5, addr)) {
8018				wpa_printf(MSG_INFO,
8019					   "CTRL: Invalid MAC address: %s",
8020					   token);
8021				return -1;
8022			}
8023		} else if (os_strncasecmp(token, "mask=", 5) == 0) {
8024			mask = _mask;
8025			if (hwaddr_aton(token + 5, mask)) {
8026				wpa_printf(MSG_INFO,
8027					   "CTRL: Invalid MAC address mask: %s",
8028					   token);
8029				return -1;
8030			}
8031		} else {
8032			wpa_printf(MSG_INFO,
8033				   "CTRL: Invalid MAC_RAND_SCAN parameter: %s",
8034				   token);
8035			return -1;
8036		}
8037	}
8038
8039	if (!type) {
8040		wpa_printf(MSG_INFO, "CTRL: MAC_RAND_SCAN no type specified");
8041		return -1;
8042	}
8043
8044	if ((wpa_s->mac_addr_rand_supported & type) != type) {
8045		wpa_printf(MSG_INFO,
8046			   "CTRL: MAC_RAND_SCAN types=%u != supported=%u",
8047			   type, wpa_s->mac_addr_rand_supported);
8048		return -1;
8049	}
8050
8051	if (enable > 1) {
8052		wpa_printf(MSG_INFO,
8053			   "CTRL: MAC_RAND_SCAN enable=<0/1> not specified");
8054		return -1;
8055	}
8056
8057	if (!enable) {
8058		wpas_mac_addr_rand_scan_clear(wpa_s, type);
8059		if (wpa_s->pno) {
8060			if (type & MAC_ADDR_RAND_PNO) {
8061				wpas_stop_pno(wpa_s);
8062				wpas_start_pno(wpa_s);
8063			}
8064		} else if (wpa_s->sched_scanning &&
8065			   (type & MAC_ADDR_RAND_SCHED_SCAN)) {
8066			/* simulate timeout to restart the sched scan */
8067			wpa_s->sched_scan_timed_out = 1;
8068			wpa_s->prev_sched_ssid = NULL;
8069			wpa_supplicant_cancel_sched_scan(wpa_s);
8070		}
8071		return 0;
8072	}
8073
8074	if ((addr && !mask) || (!addr && mask)) {
8075		wpa_printf(MSG_INFO,
8076			   "CTRL: MAC_RAND_SCAN invalid addr/mask combination");
8077		return -1;
8078	}
8079
8080	if (addr && mask && (!(mask[0] & 0x01) || (addr[0] & 0x01))) {
8081		wpa_printf(MSG_INFO,
8082			   "CTRL: MAC_RAND_SCAN cannot allow multicast address");
8083		return -1;
8084	}
8085
8086	if (type & MAC_ADDR_RAND_SCAN) {
8087		wpas_mac_addr_rand_scan_set(wpa_s, MAC_ADDR_RAND_SCAN,
8088					    addr, mask);
8089	}
8090
8091	if (type & MAC_ADDR_RAND_SCHED_SCAN) {
8092		wpas_mac_addr_rand_scan_set(wpa_s, MAC_ADDR_RAND_SCHED_SCAN,
8093					    addr, mask);
8094
8095		if (wpa_s->sched_scanning && !wpa_s->pno) {
8096			/* simulate timeout to restart the sched scan */
8097			wpa_s->sched_scan_timed_out = 1;
8098			wpa_s->prev_sched_ssid = NULL;
8099			wpa_supplicant_cancel_sched_scan(wpa_s);
8100		}
8101	}
8102
8103	if (type & MAC_ADDR_RAND_PNO) {
8104		wpas_mac_addr_rand_scan_set(wpa_s, MAC_ADDR_RAND_PNO,
8105					    addr, mask);
8106		if (wpa_s->pno) {
8107			wpas_stop_pno(wpa_s);
8108			wpas_start_pno(wpa_s);
8109		}
8110	}
8111
8112	return 0;
8113}
8114
8115
8116static int wpas_ctrl_cmd_debug_level(const char *cmd)
8117{
8118	if (os_strcmp(cmd, "PING") == 0 ||
8119	    os_strncmp(cmd, "BSS ", 4) == 0 ||
8120	    os_strncmp(cmd, "GET_NETWORK ", 12) == 0 ||
8121	    os_strncmp(cmd, "STATUS", 6) == 0 ||
8122	    os_strncmp(cmd, "STA ", 4) == 0 ||
8123	    os_strncmp(cmd, "STA-", 4) == 0)
8124		return MSG_EXCESSIVE;
8125	return MSG_DEBUG;
8126}
8127
8128
8129char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
8130					 char *buf, size_t *resp_len)
8131{
8132	char *reply;
8133	const int reply_size = 4096;
8134	int reply_len;
8135
8136	if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0 ||
8137	    os_strncmp(buf, "SET_NETWORK ", 12) == 0) {
8138		if (wpa_debug_show_keys)
8139			wpa_dbg(wpa_s, MSG_DEBUG,
8140				"Control interface command '%s'", buf);
8141		else
8142			wpa_dbg(wpa_s, MSG_DEBUG,
8143				"Control interface command '%s [REMOVED]'",
8144				os_strncmp(buf, WPA_CTRL_RSP,
8145					   os_strlen(WPA_CTRL_RSP)) == 0 ?
8146				WPA_CTRL_RSP : "SET_NETWORK");
8147	} else if (os_strncmp(buf, "WPS_NFC_TAG_READ", 16) == 0 ||
8148		   os_strncmp(buf, "NFC_REPORT_HANDOVER", 19) == 0) {
8149		wpa_hexdump_ascii_key(MSG_DEBUG, "RX ctrl_iface",
8150				      (const u8 *) buf, os_strlen(buf));
8151	} else {
8152		int level = wpas_ctrl_cmd_debug_level(buf);
8153		wpa_dbg(wpa_s, level, "Control interface command '%s'", buf);
8154	}
8155
8156	reply = os_malloc(reply_size);
8157	if (reply == NULL) {
8158		*resp_len = 1;
8159		return NULL;
8160	}
8161
8162	os_memcpy(reply, "OK\n", 3);
8163	reply_len = 3;
8164
8165	if (os_strcmp(buf, "PING") == 0) {
8166		os_memcpy(reply, "PONG\n", 5);
8167		reply_len = 5;
8168	} else if (os_strcmp(buf, "IFNAME") == 0) {
8169		reply_len = os_strlen(wpa_s->ifname);
8170		os_memcpy(reply, wpa_s->ifname, reply_len);
8171	} else if (os_strncmp(buf, "RELOG", 5) == 0) {
8172		if (wpa_debug_reopen_file() < 0)
8173			reply_len = -1;
8174	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
8175		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
8176	} else if (os_strcmp(buf, "MIB") == 0) {
8177		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
8178		if (reply_len >= 0) {
8179			reply_len += eapol_sm_get_mib(wpa_s->eapol,
8180						      reply + reply_len,
8181						      reply_size - reply_len);
8182		}
8183	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
8184		reply_len = wpa_supplicant_ctrl_iface_status(
8185			wpa_s, buf + 6, reply, reply_size);
8186	} else if (os_strcmp(buf, "PMKSA") == 0) {
8187		reply_len = wpa_sm_pmksa_cache_list(wpa_s->wpa, reply,
8188						    reply_size);
8189	} else if (os_strcmp(buf, "PMKSA_FLUSH") == 0) {
8190		wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
8191	} else if (os_strncmp(buf, "SET ", 4) == 0) {
8192		if (wpa_supplicant_ctrl_iface_set(wpa_s, buf + 4))
8193			reply_len = -1;
8194	} else if (os_strncmp(buf, "DUMP", 4) == 0) {
8195		reply_len = wpa_config_dump_values(wpa_s->conf,
8196						   reply, reply_size);
8197	} else if (os_strncmp(buf, "GET ", 4) == 0) {
8198		reply_len = wpa_supplicant_ctrl_iface_get(wpa_s, buf + 4,
8199							  reply, reply_size);
8200	} else if (os_strcmp(buf, "LOGON") == 0) {
8201		eapol_sm_notify_logoff(wpa_s->eapol, FALSE);
8202	} else if (os_strcmp(buf, "LOGOFF") == 0) {
8203		eapol_sm_notify_logoff(wpa_s->eapol, TRUE);
8204	} else if (os_strcmp(buf, "REASSOCIATE") == 0) {
8205		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
8206			reply_len = -1;
8207		else
8208			wpas_request_connection(wpa_s);
8209	} else if (os_strcmp(buf, "REATTACH") == 0) {
8210		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED ||
8211		    !wpa_s->current_ssid)
8212			reply_len = -1;
8213		else {
8214			wpa_s->reattach = 1;
8215			wpas_request_connection(wpa_s);
8216		}
8217	} else if (os_strcmp(buf, "RECONNECT") == 0) {
8218		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
8219			reply_len = -1;
8220		else if (wpa_s->disconnected)
8221			wpas_request_connection(wpa_s);
8222#ifdef IEEE8021X_EAPOL
8223	} else if (os_strncmp(buf, "PREAUTH ", 8) == 0) {
8224		if (wpa_supplicant_ctrl_iface_preauth(wpa_s, buf + 8))
8225			reply_len = -1;
8226#endif /* IEEE8021X_EAPOL */
8227#ifdef CONFIG_PEERKEY
8228	} else if (os_strncmp(buf, "STKSTART ", 9) == 0) {
8229		if (wpa_supplicant_ctrl_iface_stkstart(wpa_s, buf + 9))
8230			reply_len = -1;
8231#endif /* CONFIG_PEERKEY */
8232#ifdef CONFIG_IEEE80211R
8233	} else if (os_strncmp(buf, "FT_DS ", 6) == 0) {
8234		if (wpa_supplicant_ctrl_iface_ft_ds(wpa_s, buf + 6))
8235			reply_len = -1;
8236#endif /* CONFIG_IEEE80211R */
8237#ifdef CONFIG_WPS
8238	} else if (os_strcmp(buf, "WPS_PBC") == 0) {
8239		int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, NULL);
8240		if (res == -2) {
8241			os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
8242			reply_len = 17;
8243		} else if (res)
8244			reply_len = -1;
8245	} else if (os_strncmp(buf, "WPS_PBC ", 8) == 0) {
8246		int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, buf + 8);
8247		if (res == -2) {
8248			os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
8249			reply_len = 17;
8250		} else if (res)
8251			reply_len = -1;
8252	} else if (os_strncmp(buf, "WPS_PIN ", 8) == 0) {
8253		reply_len = wpa_supplicant_ctrl_iface_wps_pin(wpa_s, buf + 8,
8254							      reply,
8255							      reply_size);
8256	} else if (os_strncmp(buf, "WPS_CHECK_PIN ", 14) == 0) {
8257		reply_len = wpa_supplicant_ctrl_iface_wps_check_pin(
8258			wpa_s, buf + 14, reply, reply_size);
8259	} else if (os_strcmp(buf, "WPS_CANCEL") == 0) {
8260		if (wpas_wps_cancel(wpa_s))
8261			reply_len = -1;
8262#ifdef CONFIG_WPS_NFC
8263	} else if (os_strcmp(buf, "WPS_NFC") == 0) {
8264		if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, NULL))
8265			reply_len = -1;
8266	} else if (os_strncmp(buf, "WPS_NFC ", 8) == 0) {
8267		if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, buf + 8))
8268			reply_len = -1;
8269	} else if (os_strncmp(buf, "WPS_NFC_CONFIG_TOKEN ", 21) == 0) {
8270		reply_len = wpa_supplicant_ctrl_iface_wps_nfc_config_token(
8271			wpa_s, buf + 21, reply, reply_size);
8272	} else if (os_strncmp(buf, "WPS_NFC_TOKEN ", 14) == 0) {
8273		reply_len = wpa_supplicant_ctrl_iface_wps_nfc_token(
8274			wpa_s, buf + 14, reply, reply_size);
8275	} else if (os_strncmp(buf, "WPS_NFC_TAG_READ ", 17) == 0) {
8276		if (wpa_supplicant_ctrl_iface_wps_nfc_tag_read(wpa_s,
8277							       buf + 17))
8278			reply_len = -1;
8279	} else if (os_strncmp(buf, "NFC_GET_HANDOVER_REQ ", 21) == 0) {
8280		reply_len = wpas_ctrl_nfc_get_handover_req(
8281			wpa_s, buf + 21, reply, reply_size);
8282	} else if (os_strncmp(buf, "NFC_GET_HANDOVER_SEL ", 21) == 0) {
8283		reply_len = wpas_ctrl_nfc_get_handover_sel(
8284			wpa_s, buf + 21, reply, reply_size);
8285	} else if (os_strncmp(buf, "NFC_REPORT_HANDOVER ", 20) == 0) {
8286		if (wpas_ctrl_nfc_report_handover(wpa_s, buf + 20))
8287			reply_len = -1;
8288#endif /* CONFIG_WPS_NFC */
8289	} else if (os_strncmp(buf, "WPS_REG ", 8) == 0) {
8290		if (wpa_supplicant_ctrl_iface_wps_reg(wpa_s, buf + 8))
8291			reply_len = -1;
8292#ifdef CONFIG_AP
8293	} else if (os_strncmp(buf, "WPS_AP_PIN ", 11) == 0) {
8294		reply_len = wpa_supplicant_ctrl_iface_wps_ap_pin(
8295			wpa_s, buf + 11, reply, reply_size);
8296#endif /* CONFIG_AP */
8297#ifdef CONFIG_WPS_ER
8298	} else if (os_strcmp(buf, "WPS_ER_START") == 0) {
8299		if (wpas_wps_er_start(wpa_s, NULL))
8300			reply_len = -1;
8301	} else if (os_strncmp(buf, "WPS_ER_START ", 13) == 0) {
8302		if (wpas_wps_er_start(wpa_s, buf + 13))
8303			reply_len = -1;
8304	} else if (os_strcmp(buf, "WPS_ER_STOP") == 0) {
8305		wpas_wps_er_stop(wpa_s);
8306	} else if (os_strncmp(buf, "WPS_ER_PIN ", 11) == 0) {
8307		if (wpa_supplicant_ctrl_iface_wps_er_pin(wpa_s, buf + 11))
8308			reply_len = -1;
8309	} else if (os_strncmp(buf, "WPS_ER_PBC ", 11) == 0) {
8310		int ret = wpas_wps_er_pbc(wpa_s, buf + 11);
8311		if (ret == -2) {
8312			os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
8313			reply_len = 17;
8314		} else if (ret == -3) {
8315			os_memcpy(reply, "FAIL-UNKNOWN-UUID\n", 18);
8316			reply_len = 18;
8317		} else if (ret == -4) {
8318			os_memcpy(reply, "FAIL-NO-AP-SETTINGS\n", 20);
8319			reply_len = 20;
8320		} else if (ret)
8321			reply_len = -1;
8322	} else if (os_strncmp(buf, "WPS_ER_LEARN ", 13) == 0) {
8323		if (wpa_supplicant_ctrl_iface_wps_er_learn(wpa_s, buf + 13))
8324			reply_len = -1;
8325	} else if (os_strncmp(buf, "WPS_ER_SET_CONFIG ", 18) == 0) {
8326		if (wpa_supplicant_ctrl_iface_wps_er_set_config(wpa_s,
8327								buf + 18))
8328			reply_len = -1;
8329	} else if (os_strncmp(buf, "WPS_ER_CONFIG ", 14) == 0) {
8330		if (wpa_supplicant_ctrl_iface_wps_er_config(wpa_s, buf + 14))
8331			reply_len = -1;
8332#ifdef CONFIG_WPS_NFC
8333	} else if (os_strncmp(buf, "WPS_ER_NFC_CONFIG_TOKEN ", 24) == 0) {
8334		reply_len = wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
8335			wpa_s, buf + 24, reply, reply_size);
8336#endif /* CONFIG_WPS_NFC */
8337#endif /* CONFIG_WPS_ER */
8338#endif /* CONFIG_WPS */
8339#ifdef CONFIG_IBSS_RSN
8340	} else if (os_strncmp(buf, "IBSS_RSN ", 9) == 0) {
8341		if (wpa_supplicant_ctrl_iface_ibss_rsn(wpa_s, buf + 9))
8342			reply_len = -1;
8343#endif /* CONFIG_IBSS_RSN */
8344#ifdef CONFIG_MESH
8345	} else if (os_strncmp(buf, "MESH_INTERFACE_ADD ", 19) == 0) {
8346		reply_len = wpa_supplicant_ctrl_iface_mesh_interface_add(
8347			wpa_s, buf + 19, reply, reply_size);
8348	} else if (os_strcmp(buf, "MESH_INTERFACE_ADD") == 0) {
8349		reply_len = wpa_supplicant_ctrl_iface_mesh_interface_add(
8350			wpa_s, "", reply, reply_size);
8351	} else if (os_strncmp(buf, "MESH_GROUP_ADD ", 15) == 0) {
8352		if (wpa_supplicant_ctrl_iface_mesh_group_add(wpa_s, buf + 15))
8353			reply_len = -1;
8354	} else if (os_strncmp(buf, "MESH_GROUP_REMOVE ", 18) == 0) {
8355		if (wpa_supplicant_ctrl_iface_mesh_group_remove(wpa_s,
8356								buf + 18))
8357			reply_len = -1;
8358#endif /* CONFIG_MESH */
8359#ifdef CONFIG_P2P
8360	} else if (os_strncmp(buf, "P2P_FIND ", 9) == 0) {
8361		if (p2p_ctrl_find(wpa_s, buf + 8))
8362			reply_len = -1;
8363	} else if (os_strcmp(buf, "P2P_FIND") == 0) {
8364		if (p2p_ctrl_find(wpa_s, ""))
8365			reply_len = -1;
8366	} else if (os_strcmp(buf, "P2P_STOP_FIND") == 0) {
8367		wpas_p2p_stop_find(wpa_s);
8368	} else if (os_strncmp(buf, "P2P_ASP_PROVISION ", 18) == 0) {
8369		if (p2p_ctrl_asp_provision(wpa_s, buf + 18))
8370			reply_len = -1;
8371	} else if (os_strncmp(buf, "P2P_ASP_PROVISION_RESP ", 23) == 0) {
8372		if (p2p_ctrl_asp_provision_resp(wpa_s, buf + 23))
8373			reply_len = -1;
8374	} else if (os_strncmp(buf, "P2P_CONNECT ", 12) == 0) {
8375		reply_len = p2p_ctrl_connect(wpa_s, buf + 12, reply,
8376					     reply_size);
8377	} else if (os_strncmp(buf, "P2P_LISTEN ", 11) == 0) {
8378		if (p2p_ctrl_listen(wpa_s, buf + 11))
8379			reply_len = -1;
8380	} else if (os_strcmp(buf, "P2P_LISTEN") == 0) {
8381		if (p2p_ctrl_listen(wpa_s, ""))
8382			reply_len = -1;
8383	} else if (os_strncmp(buf, "P2P_GROUP_REMOVE ", 17) == 0) {
8384		if (wpas_p2p_group_remove(wpa_s, buf + 17))
8385			reply_len = -1;
8386	} else if (os_strcmp(buf, "P2P_GROUP_ADD") == 0) {
8387		if (p2p_ctrl_group_add(wpa_s, ""))
8388			reply_len = -1;
8389	} else if (os_strncmp(buf, "P2P_GROUP_ADD ", 14) == 0) {
8390		if (p2p_ctrl_group_add(wpa_s, buf + 14))
8391			reply_len = -1;
8392	} else if (os_strncmp(buf, "P2P_PROV_DISC ", 14) == 0) {
8393		if (p2p_ctrl_prov_disc(wpa_s, buf + 14))
8394			reply_len = -1;
8395	} else if (os_strcmp(buf, "P2P_GET_PASSPHRASE") == 0) {
8396		reply_len = p2p_get_passphrase(wpa_s, reply, reply_size);
8397	} else if (os_strncmp(buf, "P2P_SERV_DISC_REQ ", 18) == 0) {
8398		reply_len = p2p_ctrl_serv_disc_req(wpa_s, buf + 18, reply,
8399						   reply_size);
8400	} else if (os_strncmp(buf, "P2P_SERV_DISC_CANCEL_REQ ", 25) == 0) {
8401		if (p2p_ctrl_serv_disc_cancel_req(wpa_s, buf + 25) < 0)
8402			reply_len = -1;
8403	} else if (os_strncmp(buf, "P2P_SERV_DISC_RESP ", 19) == 0) {
8404		if (p2p_ctrl_serv_disc_resp(wpa_s, buf + 19) < 0)
8405			reply_len = -1;
8406	} else if (os_strcmp(buf, "P2P_SERVICE_UPDATE") == 0) {
8407		wpas_p2p_sd_service_update(wpa_s);
8408	} else if (os_strncmp(buf, "P2P_SERV_DISC_EXTERNAL ", 23) == 0) {
8409		if (p2p_ctrl_serv_disc_external(wpa_s, buf + 23) < 0)
8410			reply_len = -1;
8411	} else if (os_strcmp(buf, "P2P_SERVICE_FLUSH") == 0) {
8412		wpas_p2p_service_flush(wpa_s);
8413	} else if (os_strncmp(buf, "P2P_SERVICE_ADD ", 16) == 0) {
8414		if (p2p_ctrl_service_add(wpa_s, buf + 16) < 0)
8415			reply_len = -1;
8416	} else if (os_strncmp(buf, "P2P_SERVICE_DEL ", 16) == 0) {
8417		if (p2p_ctrl_service_del(wpa_s, buf + 16) < 0)
8418			reply_len = -1;
8419	} else if (os_strncmp(buf, "P2P_SERVICE_REP ", 16) == 0) {
8420		if (p2p_ctrl_service_replace(wpa_s, buf + 16) < 0)
8421			reply_len = -1;
8422	} else if (os_strncmp(buf, "P2P_REJECT ", 11) == 0) {
8423		if (p2p_ctrl_reject(wpa_s, buf + 11) < 0)
8424			reply_len = -1;
8425	} else if (os_strncmp(buf, "P2P_INVITE ", 11) == 0) {
8426		if (p2p_ctrl_invite(wpa_s, buf + 11) < 0)
8427			reply_len = -1;
8428	} else if (os_strncmp(buf, "P2P_PEER ", 9) == 0) {
8429		reply_len = p2p_ctrl_peer(wpa_s, buf + 9, reply,
8430					      reply_size);
8431	} else if (os_strncmp(buf, "P2P_SET ", 8) == 0) {
8432		if (p2p_ctrl_set(wpa_s, buf + 8) < 0)
8433			reply_len = -1;
8434	} else if (os_strcmp(buf, "P2P_FLUSH") == 0) {
8435		p2p_ctrl_flush(wpa_s);
8436	} else if (os_strncmp(buf, "P2P_UNAUTHORIZE ", 16) == 0) {
8437		if (wpas_p2p_unauthorize(wpa_s, buf + 16) < 0)
8438			reply_len = -1;
8439	} else if (os_strcmp(buf, "P2P_CANCEL") == 0) {
8440		if (wpas_p2p_cancel(wpa_s))
8441			reply_len = -1;
8442	} else if (os_strncmp(buf, "P2P_PRESENCE_REQ ", 17) == 0) {
8443		if (p2p_ctrl_presence_req(wpa_s, buf + 17) < 0)
8444			reply_len = -1;
8445	} else if (os_strcmp(buf, "P2P_PRESENCE_REQ") == 0) {
8446		if (p2p_ctrl_presence_req(wpa_s, "") < 0)
8447			reply_len = -1;
8448	} else if (os_strncmp(buf, "P2P_EXT_LISTEN ", 15) == 0) {
8449		if (p2p_ctrl_ext_listen(wpa_s, buf + 15) < 0)
8450			reply_len = -1;
8451	} else if (os_strcmp(buf, "P2P_EXT_LISTEN") == 0) {
8452		if (p2p_ctrl_ext_listen(wpa_s, "") < 0)
8453			reply_len = -1;
8454	} else if (os_strncmp(buf, "P2P_REMOVE_CLIENT ", 18) == 0) {
8455		if (p2p_ctrl_remove_client(wpa_s, buf + 18) < 0)
8456			reply_len = -1;
8457#endif /* CONFIG_P2P */
8458#ifdef CONFIG_WIFI_DISPLAY
8459	} else if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0) {
8460		if (wifi_display_subelem_set(wpa_s->global, buf + 16) < 0)
8461			reply_len = -1;
8462	} else if (os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0) {
8463		reply_len = wifi_display_subelem_get(wpa_s->global, buf + 16,
8464						     reply, reply_size);
8465#endif /* CONFIG_WIFI_DISPLAY */
8466#ifdef CONFIG_INTERWORKING
8467	} else if (os_strcmp(buf, "FETCH_ANQP") == 0) {
8468		if (interworking_fetch_anqp(wpa_s) < 0)
8469			reply_len = -1;
8470	} else if (os_strcmp(buf, "STOP_FETCH_ANQP") == 0) {
8471		interworking_stop_fetch_anqp(wpa_s);
8472	} else if (os_strcmp(buf, "INTERWORKING_SELECT") == 0) {
8473		if (ctrl_interworking_select(wpa_s, NULL) < 0)
8474			reply_len = -1;
8475	} else if (os_strncmp(buf, "INTERWORKING_SELECT ", 20) == 0) {
8476		if (ctrl_interworking_select(wpa_s, buf + 20) < 0)
8477			reply_len = -1;
8478	} else if (os_strncmp(buf, "INTERWORKING_CONNECT ", 21) == 0) {
8479		if (ctrl_interworking_connect(wpa_s, buf + 21, 0) < 0)
8480			reply_len = -1;
8481	} else if (os_strncmp(buf, "INTERWORKING_ADD_NETWORK ", 25) == 0) {
8482		int id;
8483
8484		id = ctrl_interworking_connect(wpa_s, buf + 25, 1);
8485		if (id < 0)
8486			reply_len = -1;
8487		else {
8488			reply_len = os_snprintf(reply, reply_size, "%d\n", id);
8489			if (os_snprintf_error(reply_size, reply_len))
8490				reply_len = -1;
8491		}
8492	} else if (os_strncmp(buf, "ANQP_GET ", 9) == 0) {
8493		if (get_anqp(wpa_s, buf + 9) < 0)
8494			reply_len = -1;
8495	} else if (os_strncmp(buf, "GAS_REQUEST ", 12) == 0) {
8496		if (gas_request(wpa_s, buf + 12) < 0)
8497			reply_len = -1;
8498	} else if (os_strncmp(buf, "GAS_RESPONSE_GET ", 17) == 0) {
8499		reply_len = gas_response_get(wpa_s, buf + 17, reply,
8500					     reply_size);
8501#endif /* CONFIG_INTERWORKING */
8502#ifdef CONFIG_HS20
8503	} else if (os_strncmp(buf, "HS20_ANQP_GET ", 14) == 0) {
8504		if (get_hs20_anqp(wpa_s, buf + 14) < 0)
8505			reply_len = -1;
8506	} else if (os_strncmp(buf, "HS20_GET_NAI_HOME_REALM_LIST ", 29) == 0) {
8507		if (hs20_get_nai_home_realm_list(wpa_s, buf + 29) < 0)
8508			reply_len = -1;
8509	} else if (os_strncmp(buf, "HS20_ICON_REQUEST ", 18) == 0) {
8510		if (hs20_icon_request(wpa_s, buf + 18) < 0)
8511			reply_len = -1;
8512	} else if (os_strcmp(buf, "FETCH_OSU") == 0) {
8513		if (hs20_fetch_osu(wpa_s) < 0)
8514			reply_len = -1;
8515	} else if (os_strcmp(buf, "CANCEL_FETCH_OSU") == 0) {
8516		hs20_cancel_fetch_osu(wpa_s);
8517#endif /* CONFIG_HS20 */
8518	} else if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0)
8519	{
8520		if (wpa_supplicant_ctrl_iface_ctrl_rsp(
8521			    wpa_s, buf + os_strlen(WPA_CTRL_RSP)))
8522			reply_len = -1;
8523		else {
8524			/*
8525			 * Notify response from timeout to allow the control
8526			 * interface response to be sent first.
8527			 */
8528			eloop_register_timeout(0, 0, wpas_ctrl_eapol_response,
8529					       wpa_s, NULL);
8530		}
8531	} else if (os_strcmp(buf, "RECONFIGURE") == 0) {
8532		if (wpa_supplicant_reload_configuration(wpa_s))
8533			reply_len = -1;
8534	} else if (os_strcmp(buf, "TERMINATE") == 0) {
8535		wpa_supplicant_terminate_proc(wpa_s->global);
8536	} else if (os_strncmp(buf, "BSSID ", 6) == 0) {
8537		if (wpa_supplicant_ctrl_iface_bssid(wpa_s, buf + 6))
8538			reply_len = -1;
8539	} else if (os_strncmp(buf, "BLACKLIST", 9) == 0) {
8540		reply_len = wpa_supplicant_ctrl_iface_blacklist(
8541			wpa_s, buf + 9, reply, reply_size);
8542	} else if (os_strncmp(buf, "LOG_LEVEL", 9) == 0) {
8543		reply_len = wpa_supplicant_ctrl_iface_log_level(
8544			wpa_s, buf + 9, reply, reply_size);
8545	} else if (os_strncmp(buf, "LIST_NETWORKS ", 14) == 0) {
8546		reply_len = wpa_supplicant_ctrl_iface_list_networks(
8547			wpa_s, buf + 14, reply, reply_size);
8548	} else if (os_strcmp(buf, "LIST_NETWORKS") == 0) {
8549		reply_len = wpa_supplicant_ctrl_iface_list_networks(
8550			wpa_s, NULL, reply, reply_size);
8551	} else if (os_strcmp(buf, "DISCONNECT") == 0) {
8552#ifdef CONFIG_SME
8553		wpa_s->sme.prev_bssid_set = 0;
8554#endif /* CONFIG_SME */
8555		wpa_s->reassociate = 0;
8556		wpa_s->disconnected = 1;
8557		wpa_supplicant_cancel_sched_scan(wpa_s);
8558		wpa_supplicant_cancel_scan(wpa_s);
8559		wpa_supplicant_deauthenticate(wpa_s,
8560					      WLAN_REASON_DEAUTH_LEAVING);
8561		eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
8562	} else if (os_strcmp(buf, "SCAN") == 0) {
8563		wpas_ctrl_scan(wpa_s, NULL, reply, reply_size, &reply_len);
8564	} else if (os_strncmp(buf, "SCAN ", 5) == 0) {
8565		wpas_ctrl_scan(wpa_s, buf + 5, reply, reply_size, &reply_len);
8566	} else if (os_strcmp(buf, "SCAN_RESULTS") == 0) {
8567		reply_len = wpa_supplicant_ctrl_iface_scan_results(
8568			wpa_s, reply, reply_size);
8569	} else if (os_strncmp(buf, "SELECT_NETWORK ", 15) == 0) {
8570		if (wpa_supplicant_ctrl_iface_select_network(wpa_s, buf + 15))
8571			reply_len = -1;
8572	} else if (os_strncmp(buf, "ENABLE_NETWORK ", 15) == 0) {
8573		if (wpa_supplicant_ctrl_iface_enable_network(wpa_s, buf + 15))
8574			reply_len = -1;
8575	} else if (os_strncmp(buf, "DISABLE_NETWORK ", 16) == 0) {
8576		if (wpa_supplicant_ctrl_iface_disable_network(wpa_s, buf + 16))
8577			reply_len = -1;
8578	} else if (os_strcmp(buf, "ADD_NETWORK") == 0) {
8579		reply_len = wpa_supplicant_ctrl_iface_add_network(
8580			wpa_s, reply, reply_size);
8581	} else if (os_strncmp(buf, "REMOVE_NETWORK ", 15) == 0) {
8582		if (wpa_supplicant_ctrl_iface_remove_network(wpa_s, buf + 15))
8583			reply_len = -1;
8584	} else if (os_strncmp(buf, "SET_NETWORK ", 12) == 0) {
8585		if (wpa_supplicant_ctrl_iface_set_network(wpa_s, buf + 12))
8586			reply_len = -1;
8587	} else if (os_strncmp(buf, "GET_NETWORK ", 12) == 0) {
8588		reply_len = wpa_supplicant_ctrl_iface_get_network(
8589			wpa_s, buf + 12, reply, reply_size);
8590	} else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
8591		if (wpa_supplicant_ctrl_iface_dup_network(wpa_s, buf + 12,
8592							  wpa_s))
8593			reply_len = -1;
8594	} else if (os_strcmp(buf, "LIST_CREDS") == 0) {
8595		reply_len = wpa_supplicant_ctrl_iface_list_creds(
8596			wpa_s, reply, reply_size);
8597	} else if (os_strcmp(buf, "ADD_CRED") == 0) {
8598		reply_len = wpa_supplicant_ctrl_iface_add_cred(
8599			wpa_s, reply, reply_size);
8600	} else if (os_strncmp(buf, "REMOVE_CRED ", 12) == 0) {
8601		if (wpa_supplicant_ctrl_iface_remove_cred(wpa_s, buf + 12))
8602			reply_len = -1;
8603	} else if (os_strncmp(buf, "SET_CRED ", 9) == 0) {
8604		if (wpa_supplicant_ctrl_iface_set_cred(wpa_s, buf + 9))
8605			reply_len = -1;
8606	} else if (os_strncmp(buf, "GET_CRED ", 9) == 0) {
8607		reply_len = wpa_supplicant_ctrl_iface_get_cred(wpa_s, buf + 9,
8608							       reply,
8609							       reply_size);
8610#ifndef CONFIG_NO_CONFIG_WRITE
8611	} else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
8612		if (wpa_supplicant_ctrl_iface_save_config(wpa_s))
8613			reply_len = -1;
8614#endif /* CONFIG_NO_CONFIG_WRITE */
8615	} else if (os_strncmp(buf, "GET_CAPABILITY ", 15) == 0) {
8616		reply_len = wpa_supplicant_ctrl_iface_get_capability(
8617			wpa_s, buf + 15, reply, reply_size);
8618	} else if (os_strncmp(buf, "AP_SCAN ", 8) == 0) {
8619		if (wpa_supplicant_ctrl_iface_ap_scan(wpa_s, buf + 8))
8620			reply_len = -1;
8621	} else if (os_strncmp(buf, "SCAN_INTERVAL ", 14) == 0) {
8622		if (wpa_supplicant_ctrl_iface_scan_interval(wpa_s, buf + 14))
8623			reply_len = -1;
8624	} else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
8625		reply_len = wpa_supplicant_global_iface_list(
8626			wpa_s->global, reply, reply_size);
8627	} else if (os_strcmp(buf, "INTERFACES") == 0) {
8628		reply_len = wpa_supplicant_global_iface_interfaces(
8629			wpa_s->global, reply, reply_size);
8630	} else if (os_strncmp(buf, "BSS ", 4) == 0) {
8631		reply_len = wpa_supplicant_ctrl_iface_bss(
8632			wpa_s, buf + 4, reply, reply_size);
8633#ifdef CONFIG_AP
8634	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
8635		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
8636	} else if (os_strncmp(buf, "STA ", 4) == 0) {
8637		reply_len = ap_ctrl_iface_sta(wpa_s, buf + 4, reply,
8638					      reply_size);
8639	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
8640		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
8641						   reply_size);
8642	} else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
8643		if (ap_ctrl_iface_sta_deauthenticate(wpa_s, buf + 15))
8644			reply_len = -1;
8645	} else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
8646		if (ap_ctrl_iface_sta_disassociate(wpa_s, buf + 13))
8647			reply_len = -1;
8648	} else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
8649		if (ap_ctrl_iface_chanswitch(wpa_s, buf + 12))
8650			reply_len = -1;
8651	} else if (os_strcmp(buf, "STOP_AP") == 0) {
8652		if (wpas_ap_stop_ap(wpa_s))
8653			reply_len = -1;
8654#endif /* CONFIG_AP */
8655	} else if (os_strcmp(buf, "SUSPEND") == 0) {
8656		wpas_notify_suspend(wpa_s->global);
8657	} else if (os_strcmp(buf, "RESUME") == 0) {
8658		wpas_notify_resume(wpa_s->global);
8659#ifdef CONFIG_TESTING_OPTIONS
8660	} else if (os_strcmp(buf, "DROP_SA") == 0) {
8661		wpa_supplicant_ctrl_iface_drop_sa(wpa_s);
8662#endif /* CONFIG_TESTING_OPTIONS */
8663	} else if (os_strncmp(buf, "ROAM ", 5) == 0) {
8664		if (wpa_supplicant_ctrl_iface_roam(wpa_s, buf + 5))
8665			reply_len = -1;
8666	} else if (os_strncmp(buf, "STA_AUTOCONNECT ", 16) == 0) {
8667		wpa_s->auto_reconnect_disabled = atoi(buf + 16) == 0;
8668	} else if (os_strncmp(buf, "BSS_EXPIRE_AGE ", 15) == 0) {
8669		if (wpa_supplicant_ctrl_iface_bss_expire_age(wpa_s, buf + 15))
8670			reply_len = -1;
8671	} else if (os_strncmp(buf, "BSS_EXPIRE_COUNT ", 17) == 0) {
8672		if (wpa_supplicant_ctrl_iface_bss_expire_count(wpa_s,
8673							       buf + 17))
8674			reply_len = -1;
8675	} else if (os_strncmp(buf, "BSS_FLUSH ", 10) == 0) {
8676		wpa_supplicant_ctrl_iface_bss_flush(wpa_s, buf + 10);
8677#ifdef CONFIG_TDLS
8678	} else if (os_strncmp(buf, "TDLS_DISCOVER ", 14) == 0) {
8679		if (wpa_supplicant_ctrl_iface_tdls_discover(wpa_s, buf + 14))
8680			reply_len = -1;
8681	} else if (os_strncmp(buf, "TDLS_SETUP ", 11) == 0) {
8682		if (wpa_supplicant_ctrl_iface_tdls_setup(wpa_s, buf + 11))
8683			reply_len = -1;
8684	} else if (os_strncmp(buf, "TDLS_TEARDOWN ", 14) == 0) {
8685		if (wpa_supplicant_ctrl_iface_tdls_teardown(wpa_s, buf + 14))
8686			reply_len = -1;
8687	} else if (os_strncmp(buf, "TDLS_CHAN_SWITCH ", 17) == 0) {
8688		if (wpa_supplicant_ctrl_iface_tdls_chan_switch(wpa_s,
8689							       buf + 17))
8690			reply_len = -1;
8691	} else if (os_strncmp(buf, "TDLS_CANCEL_CHAN_SWITCH ", 24) == 0) {
8692		if (wpa_supplicant_ctrl_iface_tdls_cancel_chan_switch(wpa_s,
8693								      buf + 24))
8694			reply_len = -1;
8695	} else if (os_strncmp(buf, "TDLS_LINK_STATUS ", 17) == 0) {
8696		reply_len = wpa_supplicant_ctrl_iface_tdls_link_status(
8697			wpa_s, buf + 17, reply, reply_size);
8698#endif /* CONFIG_TDLS */
8699	} else if (os_strcmp(buf, "WMM_AC_STATUS") == 0) {
8700		reply_len = wpas_wmm_ac_status(wpa_s, reply, reply_size);
8701	} else if (os_strncmp(buf, "WMM_AC_ADDTS ", 13) == 0) {
8702		if (wmm_ac_ctrl_addts(wpa_s, buf + 13))
8703			reply_len = -1;
8704	} else if (os_strncmp(buf, "WMM_AC_DELTS ", 13) == 0) {
8705		if (wmm_ac_ctrl_delts(wpa_s, buf + 13))
8706			reply_len = -1;
8707	} else if (os_strncmp(buf, "SIGNAL_POLL", 11) == 0) {
8708		reply_len = wpa_supplicant_signal_poll(wpa_s, reply,
8709						       reply_size);
8710	} else if (os_strncmp(buf, "PKTCNT_POLL", 11) == 0) {
8711		reply_len = wpa_supplicant_pktcnt_poll(wpa_s, reply,
8712						       reply_size);
8713#ifdef CONFIG_AUTOSCAN
8714	} else if (os_strncmp(buf, "AUTOSCAN ", 9) == 0) {
8715		if (wpa_supplicant_ctrl_iface_autoscan(wpa_s, buf + 9))
8716			reply_len = -1;
8717#endif /* CONFIG_AUTOSCAN */
8718#ifdef ANDROID
8719	} else if (os_strncmp(buf, "DRIVER ", 7) == 0) {
8720		reply_len = wpa_supplicant_driver_cmd(wpa_s, buf + 7, reply,
8721						      reply_size);
8722#endif /* ANDROID */
8723	} else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
8724		reply_len = wpa_supplicant_vendor_cmd(wpa_s, buf + 7, reply,
8725						      reply_size);
8726	} else if (os_strcmp(buf, "REAUTHENTICATE") == 0) {
8727		pmksa_cache_clear_current(wpa_s->wpa);
8728		eapol_sm_request_reauth(wpa_s->eapol);
8729#ifdef CONFIG_WNM
8730	} else if (os_strncmp(buf, "WNM_SLEEP ", 10) == 0) {
8731		if (wpas_ctrl_iface_wnm_sleep(wpa_s, buf + 10))
8732			reply_len = -1;
8733	} else if (os_strncmp(buf, "WNM_BSS_QUERY ", 14) == 0) {
8734		if (wpas_ctrl_iface_wnm_bss_query(wpa_s, buf + 14))
8735				reply_len = -1;
8736#endif /* CONFIG_WNM */
8737	} else if (os_strcmp(buf, "FLUSH") == 0) {
8738		wpa_supplicant_ctrl_iface_flush(wpa_s);
8739	} else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
8740		reply_len = wpas_ctrl_radio_work(wpa_s, buf + 11, reply,
8741						 reply_size);
8742#ifdef CONFIG_TESTING_OPTIONS
8743	} else if (os_strncmp(buf, "MGMT_TX ", 8) == 0) {
8744		if (wpas_ctrl_iface_mgmt_tx(wpa_s, buf + 8) < 0)
8745			reply_len = -1;
8746	} else if (os_strcmp(buf, "MGMT_TX_DONE") == 0) {
8747		wpas_ctrl_iface_mgmt_tx_done(wpa_s);
8748	} else if (os_strncmp(buf, "DRIVER_EVENT ", 13) == 0) {
8749		if (wpas_ctrl_iface_driver_event(wpa_s, buf + 13) < 0)
8750			reply_len = -1;
8751	} else if (os_strncmp(buf, "EAPOL_RX ", 9) == 0) {
8752		if (wpas_ctrl_iface_eapol_rx(wpa_s, buf + 9) < 0)
8753			reply_len = -1;
8754	} else if (os_strncmp(buf, "DATA_TEST_CONFIG ", 17) == 0) {
8755		if (wpas_ctrl_iface_data_test_config(wpa_s, buf + 17) < 0)
8756			reply_len = -1;
8757	} else if (os_strncmp(buf, "DATA_TEST_TX ", 13) == 0) {
8758		if (wpas_ctrl_iface_data_test_tx(wpa_s, buf + 13) < 0)
8759			reply_len = -1;
8760	} else if (os_strncmp(buf, "DATA_TEST_FRAME ", 16) == 0) {
8761		if (wpas_ctrl_iface_data_test_frame(wpa_s, buf + 16) < 0)
8762			reply_len = -1;
8763	} else if (os_strncmp(buf, "TEST_ALLOC_FAIL ", 16) == 0) {
8764		if (wpas_ctrl_test_alloc_fail(wpa_s, buf + 16) < 0)
8765			reply_len = -1;
8766	} else if (os_strcmp(buf, "GET_ALLOC_FAIL") == 0) {
8767		reply_len = wpas_ctrl_get_alloc_fail(wpa_s, reply, reply_size);
8768	} else if (os_strncmp(buf, "TEST_FAIL ", 10) == 0) {
8769		if (wpas_ctrl_test_fail(wpa_s, buf + 10) < 0)
8770			reply_len = -1;
8771	} else if (os_strcmp(buf, "GET_FAIL") == 0) {
8772		reply_len = wpas_ctrl_get_fail(wpa_s, reply, reply_size);
8773#endif /* CONFIG_TESTING_OPTIONS */
8774	} else if (os_strncmp(buf, "VENDOR_ELEM_ADD ", 16) == 0) {
8775		if (wpas_ctrl_vendor_elem_add(wpa_s, buf + 16) < 0)
8776			reply_len = -1;
8777	} else if (os_strncmp(buf, "VENDOR_ELEM_GET ", 16) == 0) {
8778		reply_len = wpas_ctrl_vendor_elem_get(wpa_s, buf + 16, reply,
8779						      reply_size);
8780	} else if (os_strncmp(buf, "VENDOR_ELEM_REMOVE ", 19) == 0) {
8781		if (wpas_ctrl_vendor_elem_remove(wpa_s, buf + 19) < 0)
8782			reply_len = -1;
8783	} else if (os_strncmp(buf, "NEIGHBOR_REP_REQUEST", 20) == 0) {
8784		if (wpas_ctrl_iface_send_neigbor_rep(wpa_s, buf + 20))
8785			reply_len = -1;
8786	} else if (os_strcmp(buf, "ERP_FLUSH") == 0) {
8787		wpas_ctrl_iface_erp_flush(wpa_s);
8788	} else if (os_strncmp(buf, "MAC_RAND_SCAN ", 14) == 0) {
8789		if (wpas_ctrl_iface_mac_rand_scan(wpa_s, buf + 14))
8790			reply_len = -1;
8791	} else if (os_strncmp(buf, "GET_PREF_FREQ_LIST ", 19) == 0) {
8792		reply_len = wpas_ctrl_iface_get_pref_freq_list(
8793			wpa_s, buf + 19, reply, reply_size);
8794	} else {
8795		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
8796		reply_len = 16;
8797	}
8798
8799	if (reply_len < 0) {
8800		os_memcpy(reply, "FAIL\n", 5);
8801		reply_len = 5;
8802	}
8803
8804	*resp_len = reply_len;
8805	return reply;
8806}
8807
8808
8809static int wpa_supplicant_global_iface_add(struct wpa_global *global,
8810					   char *cmd)
8811{
8812	struct wpa_interface iface;
8813	char *pos, *extra;
8814	struct wpa_supplicant *wpa_s;
8815	unsigned int create_iface = 0;
8816	u8 mac_addr[ETH_ALEN];
8817
8818	/*
8819	 * <ifname>TAB<confname>TAB<driver>TAB<ctrl_interface>TAB<driver_param>
8820	 * TAB<bridge_ifname>[TAB<create>]
8821	 */
8822	wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_ADD '%s'", cmd);
8823
8824	os_memset(&iface, 0, sizeof(iface));
8825
8826	do {
8827		iface.ifname = pos = cmd;
8828		pos = os_strchr(pos, '\t');
8829		if (pos)
8830			*pos++ = '\0';
8831		if (iface.ifname[0] == '\0')
8832			return -1;
8833		if (pos == NULL)
8834			break;
8835
8836		iface.confname = pos;
8837		pos = os_strchr(pos, '\t');
8838		if (pos)
8839			*pos++ = '\0';
8840		if (iface.confname[0] == '\0')
8841			iface.confname = NULL;
8842		if (pos == NULL)
8843			break;
8844
8845		iface.driver = pos;
8846		pos = os_strchr(pos, '\t');
8847		if (pos)
8848			*pos++ = '\0';
8849		if (iface.driver[0] == '\0')
8850			iface.driver = NULL;
8851		if (pos == NULL)
8852			break;
8853
8854		iface.ctrl_interface = pos;
8855		pos = os_strchr(pos, '\t');
8856		if (pos)
8857			*pos++ = '\0';
8858		if (iface.ctrl_interface[0] == '\0')
8859			iface.ctrl_interface = NULL;
8860		if (pos == NULL)
8861			break;
8862
8863		iface.driver_param = pos;
8864		pos = os_strchr(pos, '\t');
8865		if (pos)
8866			*pos++ = '\0';
8867		if (iface.driver_param[0] == '\0')
8868			iface.driver_param = NULL;
8869		if (pos == NULL)
8870			break;
8871
8872		iface.bridge_ifname = pos;
8873		pos = os_strchr(pos, '\t');
8874		if (pos)
8875			*pos++ = '\0';
8876		if (iface.bridge_ifname[0] == '\0')
8877			iface.bridge_ifname = NULL;
8878		if (pos == NULL)
8879			break;
8880
8881		extra = pos;
8882		pos = os_strchr(pos, '\t');
8883		if (pos)
8884			*pos++ = '\0';
8885		if (!extra[0])
8886			break;
8887
8888		if (os_strcmp(extra, "create") == 0)
8889			create_iface = 1;
8890		else {
8891			wpa_printf(MSG_DEBUG,
8892				   "INTERFACE_ADD unsupported extra parameter: '%s'",
8893				   extra);
8894			return -1;
8895		}
8896	} while (0);
8897
8898	if (create_iface) {
8899		wpa_printf(MSG_DEBUG, "CTRL_IFACE creating interface '%s'",
8900			   iface.ifname);
8901		if (!global->ifaces)
8902			return -1;
8903		if (wpa_drv_if_add(global->ifaces, WPA_IF_STATION, iface.ifname,
8904				   NULL, NULL, NULL, mac_addr, NULL) < 0) {
8905			wpa_printf(MSG_ERROR,
8906				   "CTRL_IFACE interface creation failed");
8907			return -1;
8908		}
8909
8910		wpa_printf(MSG_DEBUG,
8911			   "CTRL_IFACE interface '%s' created with MAC addr: "
8912			   MACSTR, iface.ifname, MAC2STR(mac_addr));
8913	}
8914
8915	if (wpa_supplicant_get_iface(global, iface.ifname))
8916		goto fail;
8917
8918	wpa_s = wpa_supplicant_add_iface(global, &iface, NULL);
8919	if (!wpa_s)
8920		goto fail;
8921	wpa_s->added_vif = create_iface;
8922	return 0;
8923
8924fail:
8925	if (create_iface)
8926		wpa_drv_if_remove(global->ifaces, WPA_IF_STATION, iface.ifname);
8927	return -1;
8928}
8929
8930
8931static int wpa_supplicant_global_iface_remove(struct wpa_global *global,
8932					      char *cmd)
8933{
8934	struct wpa_supplicant *wpa_s;
8935	int ret;
8936	unsigned int delete_iface;
8937
8938	wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_REMOVE '%s'", cmd);
8939
8940	wpa_s = wpa_supplicant_get_iface(global, cmd);
8941	if (wpa_s == NULL)
8942		return -1;
8943	delete_iface = wpa_s->added_vif;
8944	ret = wpa_supplicant_remove_iface(global, wpa_s, 0);
8945	if (!ret && delete_iface) {
8946		wpa_printf(MSG_DEBUG, "CTRL_IFACE deleting the interface '%s'",
8947			   cmd);
8948		ret = wpa_drv_if_remove(global->ifaces, WPA_IF_STATION, cmd);
8949	}
8950	return ret;
8951}
8952
8953
8954static void wpa_free_iface_info(struct wpa_interface_info *iface)
8955{
8956	struct wpa_interface_info *prev;
8957
8958	while (iface) {
8959		prev = iface;
8960		iface = iface->next;
8961
8962		os_free(prev->ifname);
8963		os_free(prev->desc);
8964		os_free(prev);
8965	}
8966}
8967
8968
8969static int wpa_supplicant_global_iface_list(struct wpa_global *global,
8970					    char *buf, int len)
8971{
8972	int i, res;
8973	struct wpa_interface_info *iface = NULL, *last = NULL, *tmp;
8974	char *pos, *end;
8975
8976	for (i = 0; wpa_drivers[i]; i++) {
8977		const struct wpa_driver_ops *drv = wpa_drivers[i];
8978		if (drv->get_interfaces == NULL)
8979			continue;
8980		tmp = drv->get_interfaces(global->drv_priv[i]);
8981		if (tmp == NULL)
8982			continue;
8983
8984		if (last == NULL)
8985			iface = last = tmp;
8986		else
8987			last->next = tmp;
8988		while (last->next)
8989			last = last->next;
8990	}
8991
8992	pos = buf;
8993	end = buf + len;
8994	for (tmp = iface; tmp; tmp = tmp->next) {
8995		res = os_snprintf(pos, end - pos, "%s\t%s\t%s\n",
8996				  tmp->drv_name, tmp->ifname,
8997				  tmp->desc ? tmp->desc : "");
8998		if (os_snprintf_error(end - pos, res)) {
8999			*pos = '\0';
9000			break;
9001		}
9002		pos += res;
9003	}
9004
9005	wpa_free_iface_info(iface);
9006
9007	return pos - buf;
9008}
9009
9010
9011static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
9012						  char *buf, int len)
9013{
9014	int res;
9015	char *pos, *end;
9016	struct wpa_supplicant *wpa_s;
9017
9018	wpa_s = global->ifaces;
9019	pos = buf;
9020	end = buf + len;
9021
9022	while (wpa_s) {
9023		res = os_snprintf(pos, end - pos, "%s\n", wpa_s->ifname);
9024		if (os_snprintf_error(end - pos, res)) {
9025			*pos = '\0';
9026			break;
9027		}
9028		pos += res;
9029		wpa_s = wpa_s->next;
9030	}
9031	return pos - buf;
9032}
9033
9034
9035static char * wpas_global_ctrl_iface_ifname(struct wpa_global *global,
9036					    const char *ifname,
9037					    char *cmd, size_t *resp_len)
9038{
9039	struct wpa_supplicant *wpa_s;
9040
9041	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
9042		if (os_strcmp(ifname, wpa_s->ifname) == 0)
9043			break;
9044	}
9045
9046	if (wpa_s == NULL) {
9047		char *resp = os_strdup("FAIL-NO-IFNAME-MATCH\n");
9048		if (resp)
9049			*resp_len = os_strlen(resp);
9050		else
9051			*resp_len = 1;
9052		return resp;
9053	}
9054
9055	return wpa_supplicant_ctrl_iface_process(wpa_s, cmd, resp_len);
9056}
9057
9058
9059static char * wpas_global_ctrl_iface_redir_p2p(struct wpa_global *global,
9060					       char *buf, size_t *resp_len)
9061{
9062#ifdef CONFIG_P2P
9063	static const char * cmd[] = {
9064		"LIST_NETWORKS",
9065		"P2P_FIND",
9066		"P2P_STOP_FIND",
9067		"P2P_LISTEN",
9068		"P2P_GROUP_ADD",
9069		"P2P_GET_PASSPHRASE",
9070		"P2P_SERVICE_UPDATE",
9071		"P2P_SERVICE_FLUSH",
9072		"P2P_FLUSH",
9073		"P2P_CANCEL",
9074		"P2P_PRESENCE_REQ",
9075		"P2P_EXT_LISTEN",
9076		NULL
9077	};
9078	static const char * prefix[] = {
9079#ifdef ANDROID
9080		"DRIVER ",
9081#endif /* ANDROID */
9082		"GET_NETWORK ",
9083		"REMOVE_NETWORK ",
9084		"P2P_FIND ",
9085		"P2P_CONNECT ",
9086		"P2P_LISTEN ",
9087		"P2P_GROUP_REMOVE ",
9088		"P2P_GROUP_ADD ",
9089		"P2P_PROV_DISC ",
9090		"P2P_SERV_DISC_REQ ",
9091		"P2P_SERV_DISC_CANCEL_REQ ",
9092		"P2P_SERV_DISC_RESP ",
9093		"P2P_SERV_DISC_EXTERNAL ",
9094		"P2P_SERVICE_ADD ",
9095		"P2P_SERVICE_DEL ",
9096		"P2P_SERVICE_REP ",
9097		"P2P_REJECT ",
9098		"P2P_INVITE ",
9099		"P2P_PEER ",
9100		"P2P_SET ",
9101		"P2P_UNAUTHORIZE ",
9102		"P2P_PRESENCE_REQ ",
9103		"P2P_EXT_LISTEN ",
9104		"P2P_REMOVE_CLIENT ",
9105		"WPS_NFC_TOKEN ",
9106		"WPS_NFC_TAG_READ ",
9107		"NFC_GET_HANDOVER_SEL ",
9108		"NFC_GET_HANDOVER_REQ ",
9109		"NFC_REPORT_HANDOVER ",
9110		"P2P_ASP_PROVISION ",
9111		"P2P_ASP_PROVISION_RESP ",
9112		NULL
9113	};
9114	int found = 0;
9115	int i;
9116
9117	if (global->p2p_init_wpa_s == NULL)
9118		return NULL;
9119
9120	for (i = 0; !found && cmd[i]; i++) {
9121		if (os_strcmp(buf, cmd[i]) == 0)
9122			found = 1;
9123	}
9124
9125	for (i = 0; !found && prefix[i]; i++) {
9126		if (os_strncmp(buf, prefix[i], os_strlen(prefix[i])) == 0)
9127			found = 1;
9128	}
9129
9130	if (found)
9131		return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
9132							 buf, resp_len);
9133#endif /* CONFIG_P2P */
9134	return NULL;
9135}
9136
9137
9138static char * wpas_global_ctrl_iface_redir_wfd(struct wpa_global *global,
9139					       char *buf, size_t *resp_len)
9140{
9141#ifdef CONFIG_WIFI_DISPLAY
9142	if (global->p2p_init_wpa_s == NULL)
9143		return NULL;
9144	if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0 ||
9145	    os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0)
9146		return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
9147							 buf, resp_len);
9148#endif /* CONFIG_WIFI_DISPLAY */
9149	return NULL;
9150}
9151
9152
9153static char * wpas_global_ctrl_iface_redir(struct wpa_global *global,
9154					   char *buf, size_t *resp_len)
9155{
9156	char *ret;
9157
9158	ret = wpas_global_ctrl_iface_redir_p2p(global, buf, resp_len);
9159	if (ret)
9160		return ret;
9161
9162	ret = wpas_global_ctrl_iface_redir_wfd(global, buf, resp_len);
9163	if (ret)
9164		return ret;
9165
9166	return NULL;
9167}
9168
9169
9170static int wpas_global_ctrl_iface_set(struct wpa_global *global, char *cmd)
9171{
9172	char *value;
9173
9174	value = os_strchr(cmd, ' ');
9175	if (value == NULL)
9176		return -1;
9177	*value++ = '\0';
9178
9179	wpa_printf(MSG_DEBUG, "GLOBAL_CTRL_IFACE SET '%s'='%s'", cmd, value);
9180
9181#ifdef CONFIG_WIFI_DISPLAY
9182	if (os_strcasecmp(cmd, "wifi_display") == 0) {
9183		wifi_display_enable(global, !!atoi(value));
9184		return 0;
9185	}
9186#endif /* CONFIG_WIFI_DISPLAY */
9187
9188	/* Restore cmd to its original value to allow redirection */
9189	value[-1] = ' ';
9190
9191	return -1;
9192}
9193
9194
9195static int wpas_global_ctrl_iface_dup_network(struct wpa_global *global,
9196					      char *cmd)
9197{
9198	struct wpa_supplicant *wpa_s[2]; /* src, dst */
9199	char *p;
9200	unsigned int i;
9201
9202	/* cmd: "<src ifname> <dst ifname> <src network id> <dst network id>
9203	 * <variable name> */
9204
9205	for (i = 0; i < ARRAY_SIZE(wpa_s) ; i++) {
9206		p = os_strchr(cmd, ' ');
9207		if (p == NULL)
9208			return -1;
9209		*p = '\0';
9210
9211		wpa_s[i] = global->ifaces;
9212		for (; wpa_s[i]; wpa_s[i] = wpa_s[i]->next) {
9213			if (os_strcmp(cmd, wpa_s[i]->ifname) == 0)
9214				break;
9215		}
9216
9217		if (!wpa_s[i]) {
9218			wpa_printf(MSG_DEBUG,
9219				   "CTRL_IFACE: Could not find iface=%s", cmd);
9220			return -1;
9221		}
9222
9223		cmd = p + 1;
9224	}
9225
9226	return wpa_supplicant_ctrl_iface_dup_network(wpa_s[0], cmd, wpa_s[1]);
9227}
9228
9229
9230#ifndef CONFIG_NO_CONFIG_WRITE
9231static int wpas_global_ctrl_iface_save_config(struct wpa_global *global)
9232{
9233	int ret = 0, saved = 0;
9234	struct wpa_supplicant *wpa_s;
9235
9236	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
9237		if (!wpa_s->conf->update_config) {
9238			wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed to update configuration (update_config=0)");
9239			continue;
9240		}
9241
9242		if (wpa_config_write(wpa_s->confname, wpa_s->conf)) {
9243			wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to update configuration");
9244			ret = 1;
9245		} else {
9246			wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration updated");
9247			saved++;
9248		}
9249	}
9250
9251	if (!saved && !ret) {
9252		wpa_dbg(wpa_s, MSG_DEBUG,
9253			"CTRL_IFACE: SAVE_CONFIG - No configuration files could be updated");
9254		ret = 1;
9255	}
9256
9257	return ret;
9258}
9259#endif /* CONFIG_NO_CONFIG_WRITE */
9260
9261
9262static int wpas_global_ctrl_iface_status(struct wpa_global *global,
9263					 char *buf, size_t buflen)
9264{
9265	char *pos, *end;
9266	int ret;
9267	struct wpa_supplicant *wpa_s;
9268
9269	pos = buf;
9270	end = buf + buflen;
9271
9272#ifdef CONFIG_P2P
9273	if (global->p2p && !global->p2p_disabled) {
9274		ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
9275				  "\n"
9276				  "p2p_state=%s\n",
9277				  MAC2STR(global->p2p_dev_addr),
9278				  p2p_get_state_txt(global->p2p));
9279		if (os_snprintf_error(end - pos, ret))
9280			return pos - buf;
9281		pos += ret;
9282	} else if (global->p2p) {
9283		ret = os_snprintf(pos, end - pos, "p2p_state=DISABLED\n");
9284		if (os_snprintf_error(end - pos, ret))
9285			return pos - buf;
9286		pos += ret;
9287	}
9288#endif /* CONFIG_P2P */
9289
9290#ifdef CONFIG_WIFI_DISPLAY
9291	ret = os_snprintf(pos, end - pos, "wifi_display=%d\n",
9292			  !!global->wifi_display);
9293	if (os_snprintf_error(end - pos, ret))
9294		return pos - buf;
9295	pos += ret;
9296#endif /* CONFIG_WIFI_DISPLAY */
9297
9298	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
9299		ret = os_snprintf(pos, end - pos, "ifname=%s\n"
9300				  "address=" MACSTR "\n",
9301				  wpa_s->ifname, MAC2STR(wpa_s->own_addr));
9302		if (os_snprintf_error(end - pos, ret))
9303			return pos - buf;
9304		pos += ret;
9305	}
9306
9307	return pos - buf;
9308}
9309
9310
9311#ifdef CONFIG_FST
9312
9313static int wpas_global_ctrl_iface_fst_attach(struct wpa_global *global,
9314					     char *cmd, char *buf,
9315					     size_t reply_size)
9316{
9317	char ifname[IFNAMSIZ + 1];
9318	struct fst_iface_cfg cfg;
9319	struct wpa_supplicant *wpa_s;
9320	struct fst_wpa_obj iface_obj;
9321
9322	if (!fst_parse_attach_command(cmd, ifname, sizeof(ifname), &cfg)) {
9323		wpa_s = wpa_supplicant_get_iface(global, ifname);
9324		if (wpa_s) {
9325			if (wpa_s->fst) {
9326				wpa_printf(MSG_INFO, "FST: Already attached");
9327				return -1;
9328			}
9329			fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
9330			wpa_s->fst = fst_attach(ifname, wpa_s->own_addr,
9331						&iface_obj, &cfg);
9332			if (wpa_s->fst)
9333				return os_snprintf(buf, reply_size, "OK\n");
9334		}
9335	}
9336
9337	return -1;
9338}
9339
9340
9341static int wpas_global_ctrl_iface_fst_detach(struct wpa_global *global,
9342					     char *cmd, char *buf,
9343					     size_t reply_size)
9344{
9345	char ifname[IFNAMSIZ + 1];
9346	struct wpa_supplicant *wpa_s;
9347
9348	if (!fst_parse_detach_command(cmd, ifname, sizeof(ifname))) {
9349		wpa_s = wpa_supplicant_get_iface(global, ifname);
9350		if (wpa_s) {
9351			if (!fst_iface_detach(ifname)) {
9352				wpa_s->fst = NULL;
9353				return os_snprintf(buf, reply_size, "OK\n");
9354			}
9355		}
9356	}
9357
9358	return -1;
9359}
9360
9361#endif /* CONFIG_FST */
9362
9363
9364char * wpa_supplicant_global_ctrl_iface_process(struct wpa_global *global,
9365						char *buf, size_t *resp_len)
9366{
9367	char *reply;
9368	const int reply_size = 2048;
9369	int reply_len;
9370	int level = MSG_DEBUG;
9371
9372	if (os_strncmp(buf, "IFNAME=", 7) == 0) {
9373		char *pos = os_strchr(buf + 7, ' ');
9374		if (pos) {
9375			*pos++ = '\0';
9376			return wpas_global_ctrl_iface_ifname(global,
9377							     buf + 7, pos,
9378							     resp_len);
9379		}
9380	}
9381
9382	reply = wpas_global_ctrl_iface_redir(global, buf, resp_len);
9383	if (reply)
9384		return reply;
9385
9386	if (os_strcmp(buf, "PING") == 0)
9387		level = MSG_EXCESSIVE;
9388	wpa_hexdump_ascii(level, "RX global ctrl_iface",
9389			  (const u8 *) buf, os_strlen(buf));
9390
9391	reply = os_malloc(reply_size);
9392	if (reply == NULL) {
9393		*resp_len = 1;
9394		return NULL;
9395	}
9396
9397	os_memcpy(reply, "OK\n", 3);
9398	reply_len = 3;
9399
9400	if (os_strcmp(buf, "PING") == 0) {
9401		os_memcpy(reply, "PONG\n", 5);
9402		reply_len = 5;
9403	} else if (os_strncmp(buf, "INTERFACE_ADD ", 14) == 0) {
9404		if (wpa_supplicant_global_iface_add(global, buf + 14))
9405			reply_len = -1;
9406	} else if (os_strncmp(buf, "INTERFACE_REMOVE ", 17) == 0) {
9407		if (wpa_supplicant_global_iface_remove(global, buf + 17))
9408			reply_len = -1;
9409	} else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
9410		reply_len = wpa_supplicant_global_iface_list(
9411			global, reply, reply_size);
9412	} else if (os_strcmp(buf, "INTERFACES") == 0) {
9413		reply_len = wpa_supplicant_global_iface_interfaces(
9414			global, reply, reply_size);
9415#ifdef CONFIG_FST
9416	} else if (os_strncmp(buf, "FST-ATTACH ", 11) == 0) {
9417		reply_len = wpas_global_ctrl_iface_fst_attach(global, buf + 11,
9418							      reply,
9419							      reply_size);
9420	} else if (os_strncmp(buf, "FST-DETACH ", 11) == 0) {
9421		reply_len = wpas_global_ctrl_iface_fst_detach(global, buf + 11,
9422							      reply,
9423							      reply_size);
9424	} else if (os_strncmp(buf, "FST-MANAGER ", 12) == 0) {
9425		reply_len = fst_ctrl_iface_receive(buf + 12, reply, reply_size);
9426#endif /* CONFIG_FST */
9427	} else if (os_strcmp(buf, "TERMINATE") == 0) {
9428		wpa_supplicant_terminate_proc(global);
9429	} else if (os_strcmp(buf, "SUSPEND") == 0) {
9430		wpas_notify_suspend(global);
9431	} else if (os_strcmp(buf, "RESUME") == 0) {
9432		wpas_notify_resume(global);
9433	} else if (os_strncmp(buf, "SET ", 4) == 0) {
9434		if (wpas_global_ctrl_iface_set(global, buf + 4)) {
9435#ifdef CONFIG_P2P
9436			if (global->p2p_init_wpa_s) {
9437				os_free(reply);
9438				/* Check if P2P redirection would work for this
9439				 * command. */
9440				return wpa_supplicant_ctrl_iface_process(
9441					global->p2p_init_wpa_s,
9442					buf, resp_len);
9443			}
9444#endif /* CONFIG_P2P */
9445			reply_len = -1;
9446		}
9447	} else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
9448		if (wpas_global_ctrl_iface_dup_network(global, buf + 12))
9449			reply_len = -1;
9450#ifndef CONFIG_NO_CONFIG_WRITE
9451	} else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
9452		if (wpas_global_ctrl_iface_save_config(global))
9453			reply_len = -1;
9454#endif /* CONFIG_NO_CONFIG_WRITE */
9455	} else if (os_strcmp(buf, "STATUS") == 0) {
9456		reply_len = wpas_global_ctrl_iface_status(global, reply,
9457							  reply_size);
9458#ifdef CONFIG_MODULE_TESTS
9459	} else if (os_strcmp(buf, "MODULE_TESTS") == 0) {
9460		int wpas_module_tests(void);
9461		if (wpas_module_tests() < 0)
9462			reply_len = -1;
9463#endif /* CONFIG_MODULE_TESTS */
9464	} else if (os_strncmp(buf, "RELOG", 5) == 0) {
9465		if (wpa_debug_reopen_file() < 0)
9466			reply_len = -1;
9467	} else {
9468		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
9469		reply_len = 16;
9470	}
9471
9472	if (reply_len < 0) {
9473		os_memcpy(reply, "FAIL\n", 5);
9474		reply_len = 5;
9475	}
9476
9477	*resp_len = reply_len;
9478	return reply;
9479}
9480