1/*
2 * WPA Supplicant / Control interface (shared code for all backends)
3 * Copyright (c) 2004-2020, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9#include "utils/includes.h"
10#ifdef CONFIG_TESTING_OPTIONS
11#include <netinet/ip.h>
12#endif /* CONFIG_TESTING_OPTIONS */
13
14#include "utils/common.h"
15#include "utils/eloop.h"
16#include "utils/uuid.h"
17#include "utils/module_tests.h"
18#include "common/version.h"
19#include "common/ieee802_11_defs.h"
20#include "common/ieee802_11_common.h"
21#include "common/wpa_ctrl.h"
22#ifdef CONFIG_DPP
23#include "common/dpp.h"
24#endif /* CONFIG_DPP */
25#include "common/ptksa_cache.h"
26#include "crypto/tls.h"
27#include "ap/hostapd.h"
28#include "eap_peer/eap.h"
29#include "eapol_supp/eapol_supp_sm.h"
30#include "rsn_supp/wpa.h"
31#include "rsn_supp/preauth.h"
32#include "rsn_supp/pmksa_cache.h"
33#include "l2_packet/l2_packet.h"
34#include "wps/wps.h"
35#include "fst/fst.h"
36#include "fst/fst_ctrl_iface.h"
37#include "config.h"
38#include "wpa_supplicant_i.h"
39#include "driver_i.h"
40#include "wps_supplicant.h"
41#include "ibss_rsn.h"
42#include "wpas_glue.h"
43#include "ap.h"
44#include "p2p_supplicant.h"
45#include "p2p/p2p.h"
46#include "hs20_supplicant.h"
47#include "wifi_display.h"
48#include "notify.h"
49#include "bss.h"
50#include "scan.h"
51#include "ctrl_iface.h"
52#include "interworking.h"
53#include "bssid_ignore.h"
54#include "autoscan.h"
55#include "wnm_sta.h"
56#include "offchannel.h"
57#include "drivers/driver.h"
58#include "mesh.h"
59#include "dpp_supplicant.h"
60#include "sme.h"
61
62#ifdef __NetBSD__
63#include <net/if_ether.h>
64#elif !defined(__CYGWIN__) && !defined(CONFIG_NATIVE_WINDOWS)
65#include <net/ethernet.h>
66#endif
67
68static int wpa_supplicant_global_iface_list(struct wpa_global *global,
69					    char *buf, int len);
70static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
71						  const char *input,
72						  char *buf, int len);
73static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s,
74					char *val);
75
76
77static int set_bssid_filter(struct wpa_supplicant *wpa_s, char *val)
78{
79	char *pos;
80	u8 addr[ETH_ALEN], *filter = NULL, *n;
81	size_t count = 0;
82
83	pos = val;
84	while (pos) {
85		if (*pos == '\0')
86			break;
87		if (hwaddr_aton(pos, addr)) {
88			os_free(filter);
89			return -1;
90		}
91		n = os_realloc_array(filter, count + 1, ETH_ALEN);
92		if (n == NULL) {
93			os_free(filter);
94			return -1;
95		}
96		filter = n;
97		os_memcpy(filter + count * ETH_ALEN, addr, ETH_ALEN);
98		count++;
99
100		pos = os_strchr(pos, ' ');
101		if (pos)
102			pos++;
103	}
104
105	wpa_hexdump(MSG_DEBUG, "bssid_filter", filter, count * ETH_ALEN);
106	os_free(wpa_s->bssid_filter);
107	wpa_s->bssid_filter = filter;
108	wpa_s->bssid_filter_count = count;
109
110	return 0;
111}
112
113
114static int set_disallow_aps(struct wpa_supplicant *wpa_s, char *val)
115{
116	char *pos;
117	u8 addr[ETH_ALEN], *bssid = NULL, *n;
118	struct wpa_ssid_value *ssid = NULL, *ns;
119	size_t count = 0, ssid_count = 0;
120	struct wpa_ssid *c;
121
122	/*
123	 * disallow_list ::= <ssid_spec> | <bssid_spec> | <disallow_list> | ""
124	 * SSID_SPEC ::= ssid <SSID_HEX>
125	 * BSSID_SPEC ::= bssid <BSSID_HEX>
126	 */
127
128	pos = val;
129	while (pos) {
130		if (*pos == '\0')
131			break;
132		if (os_strncmp(pos, "bssid ", 6) == 0) {
133			int res;
134			pos += 6;
135			res = hwaddr_aton2(pos, addr);
136			if (res < 0) {
137				os_free(ssid);
138				os_free(bssid);
139				wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
140					   "BSSID value '%s'", pos);
141				return -1;
142			}
143			pos += res;
144			n = os_realloc_array(bssid, count + 1, ETH_ALEN);
145			if (n == NULL) {
146				os_free(ssid);
147				os_free(bssid);
148				return -1;
149			}
150			bssid = n;
151			os_memcpy(bssid + count * ETH_ALEN, addr, ETH_ALEN);
152			count++;
153		} else if (os_strncmp(pos, "ssid ", 5) == 0) {
154			char *end;
155			pos += 5;
156
157			end = pos;
158			while (*end) {
159				if (*end == '\0' || *end == ' ')
160					break;
161				end++;
162			}
163
164			ns = os_realloc_array(ssid, ssid_count + 1,
165					      sizeof(struct wpa_ssid_value));
166			if (ns == NULL) {
167				os_free(ssid);
168				os_free(bssid);
169				return -1;
170			}
171			ssid = ns;
172
173			if ((end - pos) & 0x01 ||
174			    end - pos > 2 * SSID_MAX_LEN ||
175			    hexstr2bin(pos, ssid[ssid_count].ssid,
176				       (end - pos) / 2) < 0) {
177				os_free(ssid);
178				os_free(bssid);
179				wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
180					   "SSID value '%s'", pos);
181				return -1;
182			}
183			ssid[ssid_count].ssid_len = (end - pos) / 2;
184			wpa_hexdump_ascii(MSG_DEBUG, "disallow_aps SSID",
185					  ssid[ssid_count].ssid,
186					  ssid[ssid_count].ssid_len);
187			ssid_count++;
188			pos = end;
189		} else {
190			wpa_printf(MSG_DEBUG, "Unexpected disallow_aps value "
191				   "'%s'", pos);
192			os_free(ssid);
193			os_free(bssid);
194			return -1;
195		}
196
197		pos = os_strchr(pos, ' ');
198		if (pos)
199			pos++;
200	}
201
202	wpa_hexdump(MSG_DEBUG, "disallow_aps_bssid", bssid, count * ETH_ALEN);
203	os_free(wpa_s->disallow_aps_bssid);
204	wpa_s->disallow_aps_bssid = bssid;
205	wpa_s->disallow_aps_bssid_count = count;
206
207	wpa_printf(MSG_DEBUG, "disallow_aps_ssid_count %d", (int) ssid_count);
208	os_free(wpa_s->disallow_aps_ssid);
209	wpa_s->disallow_aps_ssid = ssid;
210	wpa_s->disallow_aps_ssid_count = ssid_count;
211
212	if (!wpa_s->current_ssid || wpa_s->wpa_state < WPA_AUTHENTICATING)
213		return 0;
214
215	c = wpa_s->current_ssid;
216	if (c->mode != WPAS_MODE_INFRA && c->mode != WPAS_MODE_IBSS)
217		return 0;
218
219	if (!disallowed_bssid(wpa_s, wpa_s->bssid) &&
220	    !disallowed_ssid(wpa_s, c->ssid, c->ssid_len))
221		return 0;
222
223	wpa_printf(MSG_DEBUG, "Disconnect and try to find another network "
224		   "because current AP was marked disallowed");
225
226#ifdef CONFIG_SME
227	wpa_s->sme.prev_bssid_set = 0;
228#endif /* CONFIG_SME */
229	wpa_s->reassociate = 1;
230	wpa_s->own_disconnect_req = 1;
231	wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
232	wpa_supplicant_req_scan(wpa_s, 0, 0);
233
234	return 0;
235}
236
237
238#ifndef CONFIG_NO_CONFIG_BLOBS
239static int wpas_ctrl_set_blob(struct wpa_supplicant *wpa_s, char *pos)
240{
241	char *name = pos;
242	struct wpa_config_blob *blob;
243	size_t len;
244
245	pos = os_strchr(pos, ' ');
246	if (pos == NULL)
247		return -1;
248	*pos++ = '\0';
249	len = os_strlen(pos);
250	if (len & 1)
251		return -1;
252
253	wpa_printf(MSG_DEBUG, "CTRL: Set blob '%s'", name);
254	blob = os_zalloc(sizeof(*blob));
255	if (blob == NULL)
256		return -1;
257	blob->name = os_strdup(name);
258	blob->data = os_malloc(len / 2);
259	if (blob->name == NULL || blob->data == NULL) {
260		wpa_config_free_blob(blob);
261		return -1;
262	}
263
264	if (hexstr2bin(pos, blob->data, len / 2) < 0) {
265		wpa_printf(MSG_DEBUG, "CTRL: Invalid blob hex data");
266		wpa_config_free_blob(blob);
267		return -1;
268	}
269	blob->len = len / 2;
270
271	wpa_config_set_blob(wpa_s->conf, blob);
272
273	return 0;
274}
275#endif /* CONFIG_NO_CONFIG_BLOBS */
276
277
278static int wpas_ctrl_pno(struct wpa_supplicant *wpa_s, char *cmd)
279{
280	char *params;
281	char *pos;
282	int *freqs = NULL;
283	int ret;
284
285	if (atoi(cmd)) {
286		params = os_strchr(cmd, ' ');
287		os_free(wpa_s->manual_sched_scan_freqs);
288		if (params) {
289			params++;
290			pos = os_strstr(params, "freq=");
291			if (pos)
292				freqs = freq_range_to_channel_list(wpa_s,
293								   pos + 5);
294		}
295		wpa_s->manual_sched_scan_freqs = freqs;
296		ret = wpas_start_pno(wpa_s);
297	} else {
298		ret = wpas_stop_pno(wpa_s);
299	}
300	return ret;
301}
302
303
304static int wpas_ctrl_set_band(struct wpa_supplicant *wpa_s, char *bands)
305{
306	union wpa_event_data event;
307	u32 setband_mask = WPA_SETBAND_AUTO;
308
309	/*
310	 * For example:
311	 *  SET setband 2G,6G
312	 *  SET setband 5G
313	 *  SET setband AUTO
314	 */
315	if (!os_strstr(bands, "AUTO")) {
316		if (os_strstr(bands, "5G"))
317			setband_mask |= WPA_SETBAND_5G;
318		if (os_strstr(bands, "6G"))
319			setband_mask |= WPA_SETBAND_6G;
320		if (os_strstr(bands, "2G"))
321			setband_mask |= WPA_SETBAND_2G;
322		if (setband_mask == WPA_SETBAND_AUTO)
323			return -1;
324	}
325
326	wpa_s->setband_mask = setband_mask;
327	if (wpa_drv_setband(wpa_s, wpa_s->setband_mask) == 0) {
328		os_memset(&event, 0, sizeof(event));
329		event.channel_list_changed.initiator = REGDOM_SET_BY_USER;
330		event.channel_list_changed.type = REGDOM_TYPE_UNKNOWN;
331		wpa_supplicant_event(wpa_s, EVENT_CHANNEL_LIST_CHANGED, &event);
332	}
333
334	return 0;
335}
336
337
338static int wpas_ctrl_iface_set_lci(struct wpa_supplicant *wpa_s,
339				   const char *cmd)
340{
341	struct wpabuf *lci;
342
343	if (*cmd == '\0' || os_strcmp(cmd, "\"\"") == 0) {
344		wpabuf_free(wpa_s->lci);
345		wpa_s->lci = NULL;
346		return 0;
347	}
348
349	lci = wpabuf_parse_bin(cmd);
350	if (!lci)
351		return -1;
352
353	if (os_get_reltime(&wpa_s->lci_time)) {
354		wpabuf_free(lci);
355		return -1;
356	}
357
358	wpabuf_free(wpa_s->lci);
359	wpa_s->lci = lci;
360
361	return 0;
362}
363
364
365static int
366wpas_ctrl_set_relative_rssi(struct wpa_supplicant *wpa_s, const char *cmd)
367{
368	int relative_rssi;
369
370	if (os_strcmp(cmd, "disable") == 0) {
371		wpa_s->srp.relative_rssi_set = 0;
372		return 0;
373	}
374
375	relative_rssi = atoi(cmd);
376	if (relative_rssi < 0 || relative_rssi > 100)
377		return -1;
378	wpa_s->srp.relative_rssi = relative_rssi;
379	wpa_s->srp.relative_rssi_set = 1;
380	return 0;
381}
382
383
384static int wpas_ctrl_set_relative_band_adjust(struct wpa_supplicant *wpa_s,
385					      const char *cmd)
386{
387	char *pos;
388	int adjust_rssi;
389
390	/* <band>:adjust_value */
391	pos = os_strchr(cmd, ':');
392	if (!pos)
393		return -1;
394	pos++;
395	adjust_rssi = atoi(pos);
396	if (adjust_rssi < -100 || adjust_rssi > 100)
397		return -1;
398
399	if (os_strncmp(cmd, "2G", 2) == 0)
400		wpa_s->srp.relative_adjust_band = WPA_SETBAND_2G;
401	else if (os_strncmp(cmd, "5G", 2) == 0)
402		wpa_s->srp.relative_adjust_band = WPA_SETBAND_5G;
403	else
404		return -1;
405
406	wpa_s->srp.relative_adjust_rssi = adjust_rssi;
407
408	return 0;
409}
410
411
412static int wpas_ctrl_iface_set_ric_ies(struct wpa_supplicant *wpa_s,
413				   const char *cmd)
414{
415	struct wpabuf *ric_ies;
416
417	if (*cmd == '\0' || os_strcmp(cmd, "\"\"") == 0) {
418		wpabuf_free(wpa_s->ric_ies);
419		wpa_s->ric_ies = NULL;
420		return 0;
421	}
422
423	ric_ies = wpabuf_parse_bin(cmd);
424	if (!ric_ies)
425		return -1;
426
427	wpabuf_free(wpa_s->ric_ies);
428	wpa_s->ric_ies = ric_ies;
429
430	return 0;
431}
432
433
434#ifdef CONFIG_TESTING_OPTIONS
435static int wpas_ctrl_iface_set_dso(struct wpa_supplicant *wpa_s,
436				   const char *val)
437{
438	u8 bssid[ETH_ALEN];
439	const char *pos = val;
440	struct driver_signal_override *dso = NULL, *tmp, parsed;
441
442	if (hwaddr_aton(pos, bssid))
443		return -1;
444	pos = os_strchr(pos, ' ');
445
446	dl_list_for_each(tmp, &wpa_s->drv_signal_override,
447			 struct driver_signal_override, list) {
448		if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
449			dso = tmp;
450			break;
451		}
452	}
453
454	if (!pos) {
455		/* Remove existing entry */
456		if (dso) {
457			dl_list_del(&dso->list);
458			os_free(dso);
459		}
460		return 0;
461	}
462	pos++;
463
464	/* Update an existing entry or add a new one */
465	os_memset(&parsed, 0, sizeof(parsed));
466	if (sscanf(pos, "%d %d %d %d %d",
467		   &parsed.si_current_signal,
468		   &parsed.si_avg_signal,
469		   &parsed.si_avg_beacon_signal,
470		   &parsed.si_current_noise,
471		   &parsed.scan_level) != 5)
472		return -1;
473
474	if (!dso) {
475		dso = os_zalloc(sizeof(*dso));
476		if (!dso)
477			return -1;
478		os_memcpy(dso->bssid, bssid, ETH_ALEN);
479		dl_list_add(&wpa_s->drv_signal_override, &dso->list);
480	}
481	dso->si_current_signal = parsed.si_current_signal;
482	dso->si_avg_signal = parsed.si_avg_signal;
483	dso->si_avg_beacon_signal = parsed.si_avg_beacon_signal;
484	dso->si_current_noise = parsed.si_current_noise;
485	dso->scan_level = parsed.scan_level;
486
487	return 0;
488}
489#endif /* CONFIG_TESTING_OPTIONS */
490
491
492static int wpa_supplicant_ctrl_iface_set(struct wpa_supplicant *wpa_s,
493					 char *cmd)
494{
495	char *value;
496	int ret = 0;
497
498	value = os_strchr(cmd, ' ');
499	if (value == NULL)
500		return -1;
501	*value++ = '\0';
502
503	wpa_printf(MSG_DEBUG, "CTRL_IFACE SET '%s'='%s'", cmd, value);
504	if (os_strcasecmp(cmd, "EAPOL::heldPeriod") == 0) {
505		eapol_sm_configure(wpa_s->eapol,
506				   atoi(value), -1, -1, -1);
507	} else if (os_strcasecmp(cmd, "EAPOL::authPeriod") == 0) {
508		eapol_sm_configure(wpa_s->eapol,
509				   -1, atoi(value), -1, -1);
510	} else if (os_strcasecmp(cmd, "EAPOL::startPeriod") == 0) {
511		eapol_sm_configure(wpa_s->eapol,
512				   -1, -1, atoi(value), -1);
513	} else if (os_strcasecmp(cmd, "EAPOL::maxStart") == 0) {
514		eapol_sm_configure(wpa_s->eapol,
515				   -1, -1, -1, atoi(value));
516#ifdef CONFIG_TESTING_OPTIONS
517	} else if (os_strcasecmp(cmd, "EAPOL::portControl") == 0) {
518		if (os_strcmp(value, "Auto") == 0)
519			eapol_sm_notify_portControl(wpa_s->eapol, Auto);
520		else if (os_strcmp(value, "ForceUnauthorized") == 0)
521			eapol_sm_notify_portControl(wpa_s->eapol,
522						    ForceUnauthorized);
523		else if (os_strcmp(value, "ForceAuthorized") == 0)
524			eapol_sm_notify_portControl(wpa_s->eapol,
525						    ForceAuthorized);
526		else
527			ret = -1;
528#endif /* CONFIG_TESTING_OPTIONS */
529	} else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKLifetime") == 0) {
530		if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
531				     atoi(value))) {
532			ret = -1;
533		} else {
534			value[-1] = '=';
535			wpa_config_process_global(wpa_s->conf, cmd, -1);
536		}
537	} else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKReauthThreshold") ==
538		   0) {
539		if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
540				     atoi(value))) {
541			ret = -1;
542		} else {
543			value[-1] = '=';
544			wpa_config_process_global(wpa_s->conf, cmd, -1);
545		}
546	} else if (os_strcasecmp(cmd, "dot11RSNAConfigSATimeout") == 0) {
547		if (wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
548				     atoi(value))) {
549			ret = -1;
550		} else {
551			value[-1] = '=';
552			wpa_config_process_global(wpa_s->conf, cmd, -1);
553		}
554	} else if (os_strcasecmp(cmd, "wps_fragment_size") == 0) {
555		wpa_s->wps_fragment_size = atoi(value);
556#ifdef CONFIG_WPS_TESTING
557	} else if (os_strcasecmp(cmd, "wps_version_number") == 0) {
558		long int val;
559		val = strtol(value, NULL, 0);
560		if (val < 0 || val > 0xff) {
561			ret = -1;
562			wpa_printf(MSG_DEBUG, "WPS: Invalid "
563				   "wps_version_number %ld", val);
564		} else {
565			wps_version_number = val;
566			wpa_printf(MSG_DEBUG, "WPS: Testing - force WPS "
567				   "version %u.%u",
568				   (wps_version_number & 0xf0) >> 4,
569				   wps_version_number & 0x0f);
570		}
571	} else if (os_strcasecmp(cmd, "wps_testing_stub_cred") == 0) {
572		wps_testing_stub_cred = atoi(value);
573		wpa_printf(MSG_DEBUG, "WPS: Testing - stub_cred=%d",
574			   wps_testing_stub_cred);
575	} else if (os_strcasecmp(cmd, "wps_corrupt_pkhash") == 0) {
576		wps_corrupt_pkhash = atoi(value);
577		wpa_printf(MSG_DEBUG, "WPS: Testing - wps_corrupt_pkhash=%d",
578			   wps_corrupt_pkhash);
579	} else if (os_strcasecmp(cmd, "wps_force_auth_types") == 0) {
580		if (value[0] == '\0') {
581			wps_force_auth_types_in_use = 0;
582		} else {
583			wps_force_auth_types = strtol(value, NULL, 0);
584			wps_force_auth_types_in_use = 1;
585		}
586	} else if (os_strcasecmp(cmd, "wps_force_encr_types") == 0) {
587		if (value[0] == '\0') {
588			wps_force_encr_types_in_use = 0;
589		} else {
590			wps_force_encr_types = strtol(value, NULL, 0);
591			wps_force_encr_types_in_use = 1;
592		}
593#endif /* CONFIG_WPS_TESTING */
594	} else if (os_strcasecmp(cmd, "ampdu") == 0) {
595		if (wpa_drv_ampdu(wpa_s, atoi(value)) < 0)
596			ret = -1;
597#ifdef CONFIG_TDLS
598#ifdef CONFIG_TDLS_TESTING
599	} else if (os_strcasecmp(cmd, "tdls_testing") == 0) {
600		tdls_testing = strtol(value, NULL, 0);
601		wpa_printf(MSG_DEBUG, "TDLS: tdls_testing=0x%x", tdls_testing);
602#endif /* CONFIG_TDLS_TESTING */
603	} else if (os_strcasecmp(cmd, "tdls_disabled") == 0) {
604		int disabled = atoi(value);
605		wpa_printf(MSG_DEBUG, "TDLS: tdls_disabled=%d", disabled);
606		if (disabled) {
607			if (wpa_drv_tdls_oper(wpa_s, TDLS_DISABLE, NULL) < 0)
608				ret = -1;
609		} else if (wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL) < 0)
610			ret = -1;
611		wpa_tdls_enable(wpa_s->wpa, !disabled);
612#endif /* CONFIG_TDLS */
613	} else if (os_strcasecmp(cmd, "pno") == 0) {
614		ret = wpas_ctrl_pno(wpa_s, value);
615	} else if (os_strcasecmp(cmd, "radio_disabled") == 0) {
616		int disabled = atoi(value);
617		if (wpa_drv_radio_disable(wpa_s, disabled) < 0)
618			ret = -1;
619		else if (disabled)
620			wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
621	} else if (os_strcasecmp(cmd, "uapsd") == 0) {
622		if (os_strcmp(value, "disable") == 0)
623			wpa_s->set_sta_uapsd = 0;
624		else {
625			int be, bk, vi, vo;
626			char *pos;
627			/* format: BE,BK,VI,VO;max SP Length */
628			be = atoi(value);
629			pos = os_strchr(value, ',');
630			if (pos == NULL)
631				return -1;
632			pos++;
633			bk = atoi(pos);
634			pos = os_strchr(pos, ',');
635			if (pos == NULL)
636				return -1;
637			pos++;
638			vi = atoi(pos);
639			pos = os_strchr(pos, ',');
640			if (pos == NULL)
641				return -1;
642			pos++;
643			vo = atoi(pos);
644			/* ignore max SP Length for now */
645
646			wpa_s->set_sta_uapsd = 1;
647			wpa_s->sta_uapsd = 0;
648			if (be)
649				wpa_s->sta_uapsd |= BIT(0);
650			if (bk)
651				wpa_s->sta_uapsd |= BIT(1);
652			if (vi)
653				wpa_s->sta_uapsd |= BIT(2);
654			if (vo)
655				wpa_s->sta_uapsd |= BIT(3);
656		}
657	} else if (os_strcasecmp(cmd, "ps") == 0) {
658		ret = wpa_drv_set_p2p_powersave(wpa_s, atoi(value), -1, -1);
659#ifdef CONFIG_WIFI_DISPLAY
660	} else if (os_strcasecmp(cmd, "wifi_display") == 0) {
661		int enabled = !!atoi(value);
662		if (enabled && !wpa_s->global->p2p)
663			ret = -1;
664		else
665			wifi_display_enable(wpa_s->global, enabled);
666#endif /* CONFIG_WIFI_DISPLAY */
667	} else if (os_strcasecmp(cmd, "bssid_filter") == 0) {
668		ret = set_bssid_filter(wpa_s, value);
669	} else if (os_strcasecmp(cmd, "disallow_aps") == 0) {
670		ret = set_disallow_aps(wpa_s, value);
671	} else if (os_strcasecmp(cmd, "no_keep_alive") == 0) {
672		wpa_s->no_keep_alive = !!atoi(value);
673#ifdef CONFIG_DPP
674	} else if (os_strcasecmp(cmd, "dpp_configurator_params") == 0) {
675		os_free(wpa_s->dpp_configurator_params);
676		wpa_s->dpp_configurator_params = os_strdup(value);
677	} else if (os_strcasecmp(cmd, "dpp_init_max_tries") == 0) {
678		wpa_s->dpp_init_max_tries = atoi(value);
679	} else if (os_strcasecmp(cmd, "dpp_init_retry_time") == 0) {
680		wpa_s->dpp_init_retry_time = atoi(value);
681	} else if (os_strcasecmp(cmd, "dpp_resp_wait_time") == 0) {
682		wpa_s->dpp_resp_wait_time = atoi(value);
683	} else if (os_strcasecmp(cmd, "dpp_resp_max_tries") == 0) {
684		wpa_s->dpp_resp_max_tries = atoi(value);
685	} else if (os_strcasecmp(cmd, "dpp_resp_retry_time") == 0) {
686		wpa_s->dpp_resp_retry_time = atoi(value);
687#ifdef CONFIG_TESTING_OPTIONS
688	} else if (os_strcasecmp(cmd, "dpp_pkex_own_mac_override") == 0) {
689		if (hwaddr_aton(value, dpp_pkex_own_mac_override))
690			ret = -1;
691	} else if (os_strcasecmp(cmd, "dpp_pkex_peer_mac_override") == 0) {
692		if (hwaddr_aton(value, dpp_pkex_peer_mac_override))
693			ret = -1;
694	} else if (os_strcasecmp(cmd, "dpp_pkex_ephemeral_key_override") == 0) {
695		size_t hex_len = os_strlen(value);
696
697		if (hex_len >
698		    2 * sizeof(dpp_pkex_ephemeral_key_override))
699			ret = -1;
700		else if (hexstr2bin(value, dpp_pkex_ephemeral_key_override,
701				    hex_len / 2))
702			ret = -1;
703		else
704			dpp_pkex_ephemeral_key_override_len = hex_len / 2;
705	} else if (os_strcasecmp(cmd, "dpp_protocol_key_override") == 0) {
706		size_t hex_len = os_strlen(value);
707
708		if (hex_len > 2 * sizeof(dpp_protocol_key_override))
709			ret = -1;
710		else if (hexstr2bin(value, dpp_protocol_key_override,
711				    hex_len / 2))
712			ret = -1;
713		else
714			dpp_protocol_key_override_len = hex_len / 2;
715	} else if (os_strcasecmp(cmd, "dpp_nonce_override") == 0) {
716		size_t hex_len = os_strlen(value);
717
718		if (hex_len > 2 * sizeof(dpp_nonce_override))
719			ret = -1;
720		else if (hexstr2bin(value, dpp_nonce_override, hex_len / 2))
721			ret = -1;
722		else
723			dpp_nonce_override_len = hex_len / 2;
724	} else if (os_strcasecmp(cmd, "dpp_version_override") == 0) {
725		dpp_version_override = atoi(value);
726#endif /* CONFIG_TESTING_OPTIONS */
727#endif /* CONFIG_DPP */
728#ifdef CONFIG_TESTING_OPTIONS
729	} else if (os_strcasecmp(cmd, "ext_mgmt_frame_handling") == 0) {
730		wpa_s->ext_mgmt_frame_handling = !!atoi(value);
731	} else if (os_strcasecmp(cmd, "ext_eapol_frame_io") == 0) {
732		wpa_s->ext_eapol_frame_io = !!atoi(value);
733#ifdef CONFIG_AP
734		if (wpa_s->ap_iface) {
735			wpa_s->ap_iface->bss[0]->ext_eapol_frame_io =
736				wpa_s->ext_eapol_frame_io;
737		}
738#endif /* CONFIG_AP */
739	} else if (os_strcasecmp(cmd, "extra_roc_dur") == 0) {
740		wpa_s->extra_roc_dur = atoi(value);
741	} else if (os_strcasecmp(cmd, "test_failure") == 0) {
742		wpa_s->test_failure = atoi(value);
743	} else if (os_strcasecmp(cmd, "p2p_go_csa_on_inv") == 0) {
744		wpa_s->p2p_go_csa_on_inv = !!atoi(value);
745	} else if (os_strcasecmp(cmd, "ignore_auth_resp") == 0) {
746		wpa_s->ignore_auth_resp = !!atoi(value);
747	} else if (os_strcasecmp(cmd, "ignore_assoc_disallow") == 0) {
748		wpa_s->ignore_assoc_disallow = !!atoi(value);
749		wpa_drv_ignore_assoc_disallow(wpa_s,
750					      wpa_s->ignore_assoc_disallow);
751	} else if (os_strcasecmp(cmd, "disable_sa_query") == 0) {
752		wpa_s->disable_sa_query = !!atoi(value);
753	} else if (os_strcasecmp(cmd, "ignore_sae_h2e_only") == 0) {
754		wpa_s->ignore_sae_h2e_only = !!atoi(value);
755	} else if (os_strcasecmp(cmd, "extra_sae_rejected_groups") == 0) {
756		char *pos;
757
758		os_free(wpa_s->extra_sae_rejected_groups);
759		wpa_s->extra_sae_rejected_groups = NULL;
760		pos = value;
761		while (pos && pos[0]) {
762			int group;
763
764			group = atoi(pos);
765			wpa_printf(MSG_DEBUG,
766				   "TESTING: Extra rejection of SAE group %d",
767				   group);
768			if (group)
769				int_array_add_unique(
770					&wpa_s->extra_sae_rejected_groups,
771					group);
772			pos = os_strchr(pos, ' ');
773			if (!pos)
774				break;
775			pos++;
776		}
777	} else if (os_strcasecmp(cmd, "ft_rsnxe_used") == 0) {
778		wpa_s->ft_rsnxe_used = atoi(value);
779	} else if (os_strcasecmp(cmd, "oci_freq_override_eapol") == 0) {
780		wpa_s->oci_freq_override_eapol = atoi(value);
781	} else if (os_strcasecmp(cmd, "oci_freq_override_saquery_req") == 0) {
782		wpa_s->oci_freq_override_saquery_req = atoi(value);
783	} else if (os_strcasecmp(cmd, "oci_freq_override_saquery_resp") == 0) {
784		wpa_s->oci_freq_override_saquery_resp = atoi(value);
785	} else if (os_strcasecmp(cmd, "oci_freq_override_eapol_g2") == 0) {
786		wpa_s->oci_freq_override_eapol_g2 = atoi(value);
787		/* Populate value to wpa_sm if already associated. */
788		wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_OCI_FREQ_EAPOL_G2,
789				 wpa_s->oci_freq_override_eapol_g2);
790	} else if (os_strcasecmp(cmd, "oci_freq_override_ft_assoc") == 0) {
791		wpa_s->oci_freq_override_ft_assoc = atoi(value);
792		/* Populate value to wpa_sm if already associated. */
793		wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_OCI_FREQ_FT_ASSOC,
794				 wpa_s->oci_freq_override_ft_assoc);
795	} else if (os_strcasecmp(cmd, "oci_freq_override_fils_assoc") == 0) {
796		wpa_s->oci_freq_override_fils_assoc = atoi(value);
797	} else if (os_strcasecmp(cmd, "oci_freq_override_wnm_sleep") == 0) {
798		wpa_s->oci_freq_override_wnm_sleep = atoi(value);
799	} else if (os_strcasecmp(cmd, "rsne_override_eapol") == 0) {
800		wpabuf_free(wpa_s->rsne_override_eapol);
801		if (os_strcmp(value, "NULL") == 0)
802			wpa_s->rsne_override_eapol = NULL;
803		else
804			wpa_s->rsne_override_eapol = wpabuf_parse_bin(value);
805	} else if (os_strcasecmp(cmd, "rsnxe_override_assoc") == 0) {
806		wpabuf_free(wpa_s->rsnxe_override_assoc);
807		if (os_strcmp(value, "NULL") == 0)
808			wpa_s->rsnxe_override_assoc = NULL;
809		else
810			wpa_s->rsnxe_override_assoc = wpabuf_parse_bin(value);
811	} else if (os_strcasecmp(cmd, "rsnxe_override_eapol") == 0) {
812		wpabuf_free(wpa_s->rsnxe_override_eapol);
813		if (os_strcmp(value, "NULL") == 0)
814			wpa_s->rsnxe_override_eapol = NULL;
815		else
816			wpa_s->rsnxe_override_eapol = wpabuf_parse_bin(value);
817	} else if (os_strcasecmp(cmd, "reject_btm_req_reason") == 0) {
818		wpa_s->reject_btm_req_reason = atoi(value);
819	} else if (os_strcasecmp(cmd, "get_pref_freq_list_override") == 0) {
820		os_free(wpa_s->get_pref_freq_list_override);
821		if (!value[0])
822			wpa_s->get_pref_freq_list_override = NULL;
823		else
824			wpa_s->get_pref_freq_list_override = os_strdup(value);
825	} else if (os_strcasecmp(cmd, "sae_commit_override") == 0) {
826		wpabuf_free(wpa_s->sae_commit_override);
827		if (value[0] == '\0')
828			wpa_s->sae_commit_override = NULL;
829		else
830			wpa_s->sae_commit_override = wpabuf_parse_bin(value);
831	} else if (os_strcasecmp(cmd, "driver_signal_override") == 0) {
832		ret = wpas_ctrl_iface_set_dso(wpa_s, value);
833	} else if (os_strcasecmp(cmd, "disable_scs_support") == 0) {
834		wpa_s->disable_scs_support = !!atoi(value);
835	} else if (os_strcasecmp(cmd, "disable_mscs_support") == 0) {
836		wpa_s->disable_mscs_support = !!atoi(value);
837#ifdef CONFIG_DPP
838	} else if (os_strcasecmp(cmd, "dpp_config_obj_override") == 0) {
839		os_free(wpa_s->dpp_config_obj_override);
840		if (value[0] == '\0')
841			wpa_s->dpp_config_obj_override = NULL;
842		else
843			wpa_s->dpp_config_obj_override = os_strdup(value);
844	} else if (os_strcasecmp(cmd, "dpp_discovery_override") == 0) {
845		os_free(wpa_s->dpp_discovery_override);
846		if (value[0] == '\0')
847			wpa_s->dpp_discovery_override = NULL;
848		else
849			wpa_s->dpp_discovery_override = os_strdup(value);
850	} else if (os_strcasecmp(cmd, "dpp_groups_override") == 0) {
851		os_free(wpa_s->dpp_groups_override);
852		if (value[0] == '\0')
853			wpa_s->dpp_groups_override = NULL;
854		else
855			wpa_s->dpp_groups_override = os_strdup(value);
856	} else if (os_strcasecmp(cmd,
857				 "dpp_ignore_netaccesskey_mismatch") == 0) {
858		wpa_s->dpp_ignore_netaccesskey_mismatch = atoi(value);
859	} else if (os_strcasecmp(cmd, "dpp_test") == 0) {
860		dpp_test = atoi(value);
861#endif /* CONFIG_DPP */
862#endif /* CONFIG_TESTING_OPTIONS */
863#ifdef CONFIG_FILS
864	} else if (os_strcasecmp(cmd, "disable_fils") == 0) {
865		wpa_s->disable_fils = !!atoi(value);
866		wpa_drv_disable_fils(wpa_s, wpa_s->disable_fils);
867		wpa_supplicant_set_default_scan_ies(wpa_s);
868#endif /* CONFIG_FILS */
869#ifndef CONFIG_NO_CONFIG_BLOBS
870	} else if (os_strcmp(cmd, "blob") == 0) {
871		ret = wpas_ctrl_set_blob(wpa_s, value);
872#endif /* CONFIG_NO_CONFIG_BLOBS */
873	} else if (os_strcasecmp(cmd, "setband") == 0) {
874		ret = wpas_ctrl_set_band(wpa_s, value);
875#ifdef CONFIG_MBO
876	} else if (os_strcasecmp(cmd, "non_pref_chan") == 0) {
877		ret = wpas_mbo_update_non_pref_chan(wpa_s, value);
878		if (ret == 0) {
879			value[-1] = '=';
880			wpa_config_process_global(wpa_s->conf, cmd, -1);
881		}
882	} else if (os_strcasecmp(cmd, "mbo_cell_capa") == 0) {
883		wpas_mbo_update_cell_capa(wpa_s, atoi(value));
884	} else if (os_strcasecmp(cmd, "oce") == 0) {
885		wpa_s->conf->oce = atoi(value);
886		if (wpa_s->conf->oce) {
887			if ((wpa_s->conf->oce & OCE_STA) &&
888			    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OCE_STA))
889				wpa_s->enable_oce = OCE_STA;
890
891			if ((wpa_s->conf->oce & OCE_STA_CFON) &&
892			    (wpa_s->drv_flags &
893			     WPA_DRIVER_FLAGS_OCE_STA_CFON)) {
894				/* TODO: Need to add STA-CFON support */
895				wpa_printf(MSG_ERROR,
896					   "OCE STA-CFON feature is not yet supported");
897				return -1;
898			}
899		} else {
900			wpa_s->enable_oce = 0;
901		}
902		wpa_supplicant_set_default_scan_ies(wpa_s);
903#endif /* CONFIG_MBO */
904	} else if (os_strcasecmp(cmd, "lci") == 0) {
905		ret = wpas_ctrl_iface_set_lci(wpa_s, value);
906	} else if (os_strcasecmp(cmd, "tdls_trigger_control") == 0) {
907		ret = wpa_drv_set_tdls_mode(wpa_s, atoi(value));
908	} else if (os_strcasecmp(cmd, "relative_rssi") == 0) {
909		ret = wpas_ctrl_set_relative_rssi(wpa_s, value);
910	} else if (os_strcasecmp(cmd, "relative_band_adjust") == 0) {
911		ret = wpas_ctrl_set_relative_band_adjust(wpa_s, value);
912	} else if (os_strcasecmp(cmd, "ric_ies") == 0) {
913		ret = wpas_ctrl_iface_set_ric_ies(wpa_s, value);
914	} else if (os_strcasecmp(cmd, "roaming") == 0) {
915		ret = wpa_drv_roaming(wpa_s, atoi(value), NULL);
916#ifdef CONFIG_WNM
917	} else if (os_strcasecmp(cmd, "coloc_intf_elems") == 0) {
918		struct wpabuf *elems;
919
920		elems = wpabuf_parse_bin(value);
921		if (!elems)
922			return -1;
923		wnm_set_coloc_intf_elems(wpa_s, elems);
924#endif /* CONFIG_WNM */
925	} else if (os_strcasecmp(cmd, "enable_dscp_policy_capa") == 0) {
926		wpa_s->enable_dscp_policy_capa = !!atoi(value);
927	} else {
928		value[-1] = '=';
929		ret = wpa_config_process_global(wpa_s->conf, cmd, -1);
930		if (ret == 0)
931			wpa_supplicant_update_config(wpa_s);
932		else if (ret == 1)
933			ret = 0;
934	}
935
936	return ret;
937}
938
939
940static int wpa_supplicant_ctrl_iface_get(struct wpa_supplicant *wpa_s,
941					 char *cmd, char *buf, size_t buflen)
942{
943	int res = -1;
944
945	wpa_printf(MSG_DEBUG, "CTRL_IFACE GET '%s'", cmd);
946
947	if (os_strcmp(cmd, "version") == 0) {
948		res = os_snprintf(buf, buflen, "%s", VERSION_STR);
949	} else if (os_strcasecmp(cmd, "max_command_len") == 0) {
950		res = os_snprintf(buf, buflen, "%u", CTRL_IFACE_MAX_LEN);
951	} else if (os_strcasecmp(cmd, "country") == 0) {
952		if (wpa_s->conf->country[0] && wpa_s->conf->country[1])
953			res = os_snprintf(buf, buflen, "%c%c",
954					  wpa_s->conf->country[0],
955					  wpa_s->conf->country[1]);
956#ifdef CONFIG_WIFI_DISPLAY
957	} else if (os_strcasecmp(cmd, "wifi_display") == 0) {
958		int enabled;
959		if (wpa_s->global->p2p == NULL ||
960		    wpa_s->global->p2p_disabled)
961			enabled = 0;
962		else
963			enabled = wpa_s->global->wifi_display;
964		res = os_snprintf(buf, buflen, "%d", enabled);
965#endif /* CONFIG_WIFI_DISPLAY */
966#ifdef CONFIG_TESTING_GET_GTK
967	} else if (os_strcmp(cmd, "gtk") == 0) {
968		if (wpa_s->last_gtk_len == 0)
969			return -1;
970		res = wpa_snprintf_hex(buf, buflen, wpa_s->last_gtk,
971				       wpa_s->last_gtk_len);
972		return res;
973#endif /* CONFIG_TESTING_GET_GTK */
974	} else if (os_strcmp(cmd, "tls_library") == 0) {
975		res = tls_get_library_version(buf, buflen);
976#ifdef CONFIG_TESTING_OPTIONS
977	} else if (os_strcmp(cmd, "anonce") == 0) {
978		return wpa_snprintf_hex(buf, buflen,
979					wpa_sm_get_anonce(wpa_s->wpa),
980					WPA_NONCE_LEN);
981	} else if (os_strcasecmp(cmd, "last_tk_key_idx") == 0) {
982		res = os_snprintf(buf, buflen, "%d", wpa_s->last_tk_key_idx);
983#endif /* CONFIG_TESTING_OPTIONS */
984	} else {
985		res = wpa_config_get_value(cmd, wpa_s->conf, buf, buflen);
986	}
987
988	if (os_snprintf_error(buflen, res))
989		return -1;
990	return res;
991}
992
993
994#ifdef IEEE8021X_EAPOL
995static int wpa_supplicant_ctrl_iface_preauth(struct wpa_supplicant *wpa_s,
996					     char *addr)
997{
998	u8 bssid[ETH_ALEN];
999	struct wpa_ssid *ssid = wpa_s->current_ssid;
1000
1001	if (hwaddr_aton(addr, bssid)) {
1002		wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH: invalid address "
1003			   "'%s'", addr);
1004		return -1;
1005	}
1006
1007	wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH " MACSTR, MAC2STR(bssid));
1008	rsn_preauth_deinit(wpa_s->wpa);
1009	if (rsn_preauth_init(wpa_s->wpa, bssid, ssid ? &ssid->eap : NULL))
1010		return -1;
1011
1012	return 0;
1013}
1014#endif /* IEEE8021X_EAPOL */
1015
1016
1017#ifdef CONFIG_TDLS
1018
1019static int wpa_supplicant_ctrl_iface_tdls_discover(
1020	struct wpa_supplicant *wpa_s, char *addr)
1021{
1022	u8 peer[ETH_ALEN];
1023	int ret;
1024
1025	if (hwaddr_aton(addr, peer)) {
1026		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER: invalid "
1027			   "address '%s'", addr);
1028		return -1;
1029	}
1030
1031	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER " MACSTR,
1032		   MAC2STR(peer));
1033
1034	if (wpa_tdls_is_external_setup(wpa_s->wpa))
1035		ret = wpa_tdls_send_discovery_request(wpa_s->wpa, peer);
1036	else
1037		ret = wpa_drv_tdls_oper(wpa_s, TDLS_DISCOVERY_REQ, peer);
1038
1039	return ret;
1040}
1041
1042
1043static int wpa_supplicant_ctrl_iface_tdls_setup(
1044	struct wpa_supplicant *wpa_s, char *addr)
1045{
1046	u8 peer[ETH_ALEN];
1047	int ret;
1048
1049	if (hwaddr_aton(addr, peer)) {
1050		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP: invalid "
1051			   "address '%s'", addr);
1052		return -1;
1053	}
1054
1055	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP " MACSTR,
1056		   MAC2STR(peer));
1057
1058	if ((wpa_s->conf->tdls_external_control) &&
1059	    wpa_tdls_is_external_setup(wpa_s->wpa))
1060		return wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
1061
1062	wpa_tdls_remove(wpa_s->wpa, peer);
1063
1064	if (wpa_tdls_is_external_setup(wpa_s->wpa))
1065		ret = wpa_tdls_start(wpa_s->wpa, peer);
1066	else
1067		ret = wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
1068
1069	return ret;
1070}
1071
1072
1073static int wpa_supplicant_ctrl_iface_tdls_teardown(
1074	struct wpa_supplicant *wpa_s, char *addr)
1075{
1076	u8 peer[ETH_ALEN];
1077	int ret;
1078
1079	if (os_strcmp(addr, "*") == 0) {
1080		/* remove everyone */
1081		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN *");
1082		wpa_tdls_teardown_peers(wpa_s->wpa);
1083		return 0;
1084	}
1085
1086	if (hwaddr_aton(addr, peer)) {
1087		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN: invalid "
1088			   "address '%s'", addr);
1089		return -1;
1090	}
1091
1092	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN " MACSTR,
1093		   MAC2STR(peer));
1094
1095	if ((wpa_s->conf->tdls_external_control) &&
1096	    wpa_tdls_is_external_setup(wpa_s->wpa))
1097		return wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
1098
1099	if (wpa_tdls_is_external_setup(wpa_s->wpa))
1100		ret = wpa_tdls_teardown_link(
1101			wpa_s->wpa, peer,
1102			WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
1103	else
1104		ret = wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
1105
1106	return ret;
1107}
1108
1109
1110static int ctrl_iface_get_capability_tdls(
1111	struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
1112{
1113	int ret;
1114
1115	ret = os_snprintf(buf, buflen, "%s\n",
1116			  wpa_s->drv_flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT ?
1117			  (wpa_s->drv_flags &
1118			   WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP ?
1119			   "EXTERNAL" : "INTERNAL") : "UNSUPPORTED");
1120	if (os_snprintf_error(buflen, ret))
1121		return -1;
1122	return ret;
1123}
1124
1125
1126static int wpa_supplicant_ctrl_iface_tdls_chan_switch(
1127	struct wpa_supplicant *wpa_s, char *cmd)
1128{
1129	u8 peer[ETH_ALEN];
1130	struct hostapd_freq_params freq_params;
1131	u8 oper_class;
1132	char *pos, *end;
1133
1134	if (!wpa_tdls_is_external_setup(wpa_s->wpa)) {
1135		wpa_printf(MSG_INFO,
1136			   "tdls_chanswitch: Only supported with external setup");
1137		return -1;
1138	}
1139
1140	os_memset(&freq_params, 0, sizeof(freq_params));
1141
1142	pos = os_strchr(cmd, ' ');
1143	if (pos == NULL)
1144		return -1;
1145	*pos++ = '\0';
1146
1147	oper_class = strtol(pos, &end, 10);
1148	if (pos == end) {
1149		wpa_printf(MSG_INFO,
1150			   "tdls_chanswitch: Invalid op class provided");
1151		return -1;
1152	}
1153
1154	pos = end;
1155	freq_params.freq = atoi(pos);
1156	if (freq_params.freq == 0) {
1157		wpa_printf(MSG_INFO, "tdls_chanswitch: Invalid freq provided");
1158		return -1;
1159	}
1160
1161#define SET_FREQ_SETTING(str) \
1162	do { \
1163		const char *pos2 = os_strstr(pos, " " #str "="); \
1164		if (pos2) { \
1165			pos2 += sizeof(" " #str "=") - 1; \
1166			freq_params.str = atoi(pos2); \
1167		} \
1168	} while (0)
1169
1170	SET_FREQ_SETTING(center_freq1);
1171	SET_FREQ_SETTING(center_freq2);
1172	SET_FREQ_SETTING(bandwidth);
1173	SET_FREQ_SETTING(sec_channel_offset);
1174#undef SET_FREQ_SETTING
1175
1176	freq_params.ht_enabled = !!os_strstr(pos, " ht");
1177	freq_params.vht_enabled = !!os_strstr(pos, " vht");
1178
1179	if (hwaddr_aton(cmd, peer)) {
1180		wpa_printf(MSG_DEBUG,
1181			   "CTRL_IFACE TDLS_CHAN_SWITCH: Invalid address '%s'",
1182			   cmd);
1183		return -1;
1184	}
1185
1186	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_CHAN_SWITCH " MACSTR
1187		   " OP CLASS %d FREQ %d CENTER1 %d CENTER2 %d BW %d SEC_OFFSET %d%s%s",
1188		   MAC2STR(peer), oper_class, freq_params.freq,
1189		   freq_params.center_freq1, freq_params.center_freq2,
1190		   freq_params.bandwidth, freq_params.sec_channel_offset,
1191		   freq_params.ht_enabled ? " HT" : "",
1192		   freq_params.vht_enabled ? " VHT" : "");
1193
1194	return wpa_tdls_enable_chan_switch(wpa_s->wpa, peer, oper_class,
1195					   &freq_params);
1196}
1197
1198
1199static int wpa_supplicant_ctrl_iface_tdls_cancel_chan_switch(
1200	struct wpa_supplicant *wpa_s, char *cmd)
1201{
1202	u8 peer[ETH_ALEN];
1203
1204	if (!wpa_tdls_is_external_setup(wpa_s->wpa)) {
1205		wpa_printf(MSG_INFO,
1206			   "tdls_chanswitch: Only supported with external setup");
1207		return -1;
1208	}
1209
1210	if (hwaddr_aton(cmd, peer)) {
1211		wpa_printf(MSG_DEBUG,
1212			   "CTRL_IFACE TDLS_CANCEL_CHAN_SWITCH: Invalid address '%s'",
1213			   cmd);
1214		return -1;
1215	}
1216
1217	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_CANCEL_CHAN_SWITCH " MACSTR,
1218		   MAC2STR(peer));
1219
1220	return wpa_tdls_disable_chan_switch(wpa_s->wpa, peer);
1221}
1222
1223
1224static int wpa_supplicant_ctrl_iface_tdls_link_status(
1225	struct wpa_supplicant *wpa_s, const char *addr,
1226	char *buf, size_t buflen)
1227{
1228	u8 peer[ETH_ALEN];
1229	const char *tdls_status;
1230	int ret;
1231
1232	if (hwaddr_aton(addr, peer)) {
1233		wpa_printf(MSG_DEBUG,
1234			   "CTRL_IFACE TDLS_LINK_STATUS: Invalid address '%s'",
1235			   addr);
1236		return -1;
1237	}
1238	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_LINK_STATUS " MACSTR,
1239		   MAC2STR(peer));
1240
1241	tdls_status = wpa_tdls_get_link_status(wpa_s->wpa, peer);
1242	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_LINK_STATUS: %s", tdls_status);
1243	ret = os_snprintf(buf, buflen, "TDLS link status: %s\n", tdls_status);
1244	if (os_snprintf_error(buflen, ret))
1245		return -1;
1246
1247	return ret;
1248}
1249
1250#endif /* CONFIG_TDLS */
1251
1252
1253static int wmm_ac_ctrl_addts(struct wpa_supplicant *wpa_s, char *cmd)
1254{
1255	char *token, *context = NULL;
1256	struct wmm_ac_ts_setup_params params = {
1257		.tsid = 0xff,
1258		.direction = 0xff,
1259	};
1260
1261	while ((token = str_token(cmd, " ", &context))) {
1262		if (sscanf(token, "tsid=%i", &params.tsid) == 1 ||
1263		    sscanf(token, "up=%i", &params.user_priority) == 1 ||
1264		    sscanf(token, "nominal_msdu_size=%i",
1265			   &params.nominal_msdu_size) == 1 ||
1266		    sscanf(token, "mean_data_rate=%i",
1267			   &params.mean_data_rate) == 1 ||
1268		    sscanf(token, "min_phy_rate=%i",
1269			   &params.minimum_phy_rate) == 1 ||
1270		    sscanf(token, "sba=%i",
1271			   &params.surplus_bandwidth_allowance) == 1)
1272			continue;
1273
1274		if (os_strcasecmp(token, "downlink") == 0) {
1275			params.direction = WMM_TSPEC_DIRECTION_DOWNLINK;
1276		} else if (os_strcasecmp(token, "uplink") == 0) {
1277			params.direction = WMM_TSPEC_DIRECTION_UPLINK;
1278		} else if (os_strcasecmp(token, "bidi") == 0) {
1279			params.direction = WMM_TSPEC_DIRECTION_BI_DIRECTIONAL;
1280		} else if (os_strcasecmp(token, "fixed_nominal_msdu") == 0) {
1281			params.fixed_nominal_msdu = 1;
1282		} else {
1283			wpa_printf(MSG_DEBUG,
1284				   "CTRL: Invalid WMM_AC_ADDTS parameter: '%s'",
1285				   token);
1286			return -1;
1287		}
1288
1289	}
1290
1291	return wpas_wmm_ac_addts(wpa_s, &params);
1292}
1293
1294
1295static int wmm_ac_ctrl_delts(struct wpa_supplicant *wpa_s, char *cmd)
1296{
1297	u8 tsid = atoi(cmd);
1298
1299	return wpas_wmm_ac_delts(wpa_s, tsid);
1300}
1301
1302
1303#ifdef CONFIG_IEEE80211R
1304static int wpa_supplicant_ctrl_iface_ft_ds(
1305	struct wpa_supplicant *wpa_s, char *addr)
1306{
1307	u8 target_ap[ETH_ALEN];
1308	struct wpa_bss *bss;
1309	const u8 *mdie;
1310
1311	if (hwaddr_aton(addr, target_ap)) {
1312		wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS: invalid "
1313			   "address '%s'", addr);
1314		return -1;
1315	}
1316
1317	wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS " MACSTR, MAC2STR(target_ap));
1318
1319	bss = wpa_bss_get_bssid(wpa_s, target_ap);
1320	if (bss)
1321		mdie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1322	else
1323		mdie = NULL;
1324
1325	return wpa_ft_start_over_ds(wpa_s->wpa, target_ap, mdie);
1326}
1327#endif /* CONFIG_IEEE80211R */
1328
1329
1330#ifdef CONFIG_WPS
1331static int wpa_supplicant_ctrl_iface_wps_pbc(struct wpa_supplicant *wpa_s,
1332					     char *cmd)
1333{
1334	u8 bssid[ETH_ALEN], *_bssid = bssid;
1335#ifdef CONFIG_P2P
1336	u8 p2p_dev_addr[ETH_ALEN];
1337#endif /* CONFIG_P2P */
1338#ifdef CONFIG_AP
1339	u8 *_p2p_dev_addr = NULL;
1340#endif /* CONFIG_AP */
1341	char *pos;
1342	int multi_ap = 0;
1343
1344	if (!cmd || os_strcmp(cmd, "any") == 0 ||
1345	    os_strncmp(cmd, "any ", 4) == 0) {
1346		_bssid = NULL;
1347#ifdef CONFIG_P2P
1348	} else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
1349		if (hwaddr_aton(cmd + 13, p2p_dev_addr)) {
1350			wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid "
1351				   "P2P Device Address '%s'",
1352				   cmd + 13);
1353			return -1;
1354		}
1355		_p2p_dev_addr = p2p_dev_addr;
1356#endif /* CONFIG_P2P */
1357	} else if (os_strncmp(cmd, "multi_ap=", 9) == 0) {
1358		_bssid = NULL;
1359		multi_ap = atoi(cmd + 9);
1360	} else if (hwaddr_aton(cmd, bssid)) {
1361		wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid BSSID '%s'",
1362			   cmd);
1363		return -1;
1364	}
1365
1366	if (cmd) {
1367		pos = os_strstr(cmd, " multi_ap=");
1368		if (pos) {
1369			pos += 10;
1370			multi_ap = atoi(pos);
1371		}
1372	}
1373
1374#ifdef CONFIG_AP
1375	if (wpa_s->ap_iface)
1376		return wpa_supplicant_ap_wps_pbc(wpa_s, _bssid, _p2p_dev_addr);
1377#endif /* CONFIG_AP */
1378
1379	return wpas_wps_start_pbc(wpa_s, _bssid, 0, multi_ap);
1380}
1381
1382
1383static int wpa_supplicant_ctrl_iface_wps_pin(struct wpa_supplicant *wpa_s,
1384					     char *cmd, char *buf,
1385					     size_t buflen)
1386{
1387	u8 bssid[ETH_ALEN], *_bssid = bssid;
1388	char *pin;
1389	int ret;
1390
1391	pin = os_strchr(cmd, ' ');
1392	if (pin)
1393		*pin++ = '\0';
1394
1395	if (os_strcmp(cmd, "any") == 0)
1396		_bssid = NULL;
1397	else if (os_strcmp(cmd, "get") == 0) {
1398		if (wps_generate_pin((unsigned int *) &ret) < 0)
1399			return -1;
1400		goto done;
1401	} else if (hwaddr_aton(cmd, bssid)) {
1402		wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PIN: invalid BSSID '%s'",
1403			   cmd);
1404		return -1;
1405	}
1406
1407#ifdef CONFIG_AP
1408	if (wpa_s->ap_iface) {
1409		int timeout = 0;
1410		char *pos;
1411
1412		if (pin) {
1413			pos = os_strchr(pin, ' ');
1414			if (pos) {
1415				*pos++ = '\0';
1416				timeout = atoi(pos);
1417			}
1418		}
1419
1420		return wpa_supplicant_ap_wps_pin(wpa_s, _bssid, pin,
1421						 buf, buflen, timeout);
1422	}
1423#endif /* CONFIG_AP */
1424
1425	if (pin) {
1426		ret = wpas_wps_start_pin(wpa_s, _bssid, pin, 0,
1427					 DEV_PW_DEFAULT);
1428		if (ret < 0)
1429			return -1;
1430		ret = os_snprintf(buf, buflen, "%s", pin);
1431		if (os_snprintf_error(buflen, ret))
1432			return -1;
1433		return ret;
1434	}
1435
1436	ret = wpas_wps_start_pin(wpa_s, _bssid, NULL, 0, DEV_PW_DEFAULT);
1437	if (ret < 0)
1438		return -1;
1439
1440done:
1441	/* Return the generated PIN */
1442	ret = os_snprintf(buf, buflen, "%08d", ret);
1443	if (os_snprintf_error(buflen, ret))
1444		return -1;
1445	return ret;
1446}
1447
1448
1449static int wpa_supplicant_ctrl_iface_wps_check_pin(
1450	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
1451{
1452	char pin[9];
1453	size_t len;
1454	char *pos;
1455	int ret;
1456
1457	wpa_hexdump_ascii_key(MSG_DEBUG, "WPS_CHECK_PIN",
1458			      (u8 *) cmd, os_strlen(cmd));
1459	for (pos = cmd, len = 0; *pos != '\0'; pos++) {
1460		if (*pos < '0' || *pos > '9')
1461			continue;
1462		pin[len++] = *pos;
1463		if (len == 9) {
1464			wpa_printf(MSG_DEBUG, "WPS: Too long PIN");
1465			return -1;
1466		}
1467	}
1468	if (len != 4 && len != 8) {
1469		wpa_printf(MSG_DEBUG, "WPS: Invalid PIN length %d", (int) len);
1470		return -1;
1471	}
1472	pin[len] = '\0';
1473
1474	if (len == 8) {
1475		unsigned int pin_val;
1476		pin_val = atoi(pin);
1477		if (!wps_pin_valid(pin_val)) {
1478			wpa_printf(MSG_DEBUG, "WPS: Invalid checksum digit");
1479			ret = os_snprintf(buf, buflen, "FAIL-CHECKSUM\n");
1480			if (os_snprintf_error(buflen, ret))
1481				return -1;
1482			return ret;
1483		}
1484	}
1485
1486	ret = os_snprintf(buf, buflen, "%s", pin);
1487	if (os_snprintf_error(buflen, ret))
1488		return -1;
1489
1490	return ret;
1491}
1492
1493
1494#ifdef CONFIG_WPS_NFC
1495
1496static int wpa_supplicant_ctrl_iface_wps_nfc(struct wpa_supplicant *wpa_s,
1497					     char *cmd)
1498{
1499	u8 bssid[ETH_ALEN], *_bssid = bssid;
1500
1501	if (cmd == NULL || cmd[0] == '\0')
1502		_bssid = NULL;
1503	else if (hwaddr_aton(cmd, bssid))
1504		return -1;
1505
1506	return wpas_wps_start_nfc(wpa_s, NULL, _bssid, NULL, 0, 0, NULL, NULL,
1507				  0, 0);
1508}
1509
1510
1511static int wpa_supplicant_ctrl_iface_wps_nfc_config_token(
1512	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1513{
1514	int ndef;
1515	struct wpabuf *buf;
1516	int res;
1517	char *pos;
1518
1519	pos = os_strchr(cmd, ' ');
1520	if (pos)
1521		*pos++ = '\0';
1522	if (os_strcmp(cmd, "WPS") == 0)
1523		ndef = 0;
1524	else if (os_strcmp(cmd, "NDEF") == 0)
1525		ndef = 1;
1526	else
1527		return -1;
1528
1529	buf = wpas_wps_nfc_config_token(wpa_s, ndef, pos);
1530	if (buf == NULL)
1531		return -1;
1532
1533	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1534					 wpabuf_len(buf));
1535	reply[res++] = '\n';
1536	reply[res] = '\0';
1537
1538	wpabuf_free(buf);
1539
1540	return res;
1541}
1542
1543
1544static int wpa_supplicant_ctrl_iface_wps_nfc_token(
1545	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1546{
1547	int ndef;
1548	struct wpabuf *buf;
1549	int res;
1550
1551	if (os_strcmp(cmd, "WPS") == 0)
1552		ndef = 0;
1553	else if (os_strcmp(cmd, "NDEF") == 0)
1554		ndef = 1;
1555	else
1556		return -1;
1557
1558	buf = wpas_wps_nfc_token(wpa_s, ndef);
1559	if (buf == NULL)
1560		return -1;
1561
1562	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1563					 wpabuf_len(buf));
1564	reply[res++] = '\n';
1565	reply[res] = '\0';
1566
1567	wpabuf_free(buf);
1568
1569	return res;
1570}
1571
1572
1573static int wpa_supplicant_ctrl_iface_wps_nfc_tag_read(
1574	struct wpa_supplicant *wpa_s, char *pos)
1575{
1576	size_t len;
1577	struct wpabuf *buf;
1578	int ret;
1579	char *freq;
1580	int forced_freq = 0;
1581
1582	freq = strstr(pos, " freq=");
1583	if (freq) {
1584		*freq = '\0';
1585		freq += 6;
1586		forced_freq = atoi(freq);
1587	}
1588
1589	len = os_strlen(pos);
1590	if (len & 0x01)
1591		return -1;
1592	len /= 2;
1593
1594	buf = wpabuf_alloc(len);
1595	if (buf == NULL)
1596		return -1;
1597	if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
1598		wpabuf_free(buf);
1599		return -1;
1600	}
1601
1602	ret = wpas_wps_nfc_tag_read(wpa_s, buf, forced_freq);
1603	wpabuf_free(buf);
1604
1605	return ret;
1606}
1607
1608
1609static int wpas_ctrl_nfc_get_handover_req_wps(struct wpa_supplicant *wpa_s,
1610					      char *reply, size_t max_len,
1611					      int ndef)
1612{
1613	struct wpabuf *buf;
1614	int res;
1615
1616	buf = wpas_wps_nfc_handover_req(wpa_s, ndef);
1617	if (buf == NULL)
1618		return -1;
1619
1620	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1621					 wpabuf_len(buf));
1622	reply[res++] = '\n';
1623	reply[res] = '\0';
1624
1625	wpabuf_free(buf);
1626
1627	return res;
1628}
1629
1630
1631#ifdef CONFIG_P2P
1632static int wpas_ctrl_nfc_get_handover_req_p2p(struct wpa_supplicant *wpa_s,
1633					      char *reply, size_t max_len,
1634					      int ndef)
1635{
1636	struct wpabuf *buf;
1637	int res;
1638
1639	buf = wpas_p2p_nfc_handover_req(wpa_s, ndef);
1640	if (buf == NULL) {
1641		wpa_printf(MSG_DEBUG, "P2P: Could not generate NFC handover request");
1642		return -1;
1643	}
1644
1645	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1646					 wpabuf_len(buf));
1647	reply[res++] = '\n';
1648	reply[res] = '\0';
1649
1650	wpabuf_free(buf);
1651
1652	return res;
1653}
1654#endif /* CONFIG_P2P */
1655
1656
1657static int wpas_ctrl_nfc_get_handover_req(struct wpa_supplicant *wpa_s,
1658					  char *cmd, char *reply,
1659					  size_t max_len)
1660{
1661	char *pos;
1662	int ndef;
1663
1664	pos = os_strchr(cmd, ' ');
1665	if (pos == NULL)
1666		return -1;
1667	*pos++ = '\0';
1668
1669	if (os_strcmp(cmd, "WPS") == 0)
1670		ndef = 0;
1671	else if (os_strcmp(cmd, "NDEF") == 0)
1672		ndef = 1;
1673	else
1674		return -1;
1675
1676	if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1677		if (!ndef)
1678			return -1;
1679		return wpas_ctrl_nfc_get_handover_req_wps(
1680			wpa_s, reply, max_len, ndef);
1681	}
1682
1683#ifdef CONFIG_P2P
1684	if (os_strcmp(pos, "P2P-CR") == 0) {
1685		return wpas_ctrl_nfc_get_handover_req_p2p(
1686			wpa_s, reply, max_len, ndef);
1687	}
1688#endif /* CONFIG_P2P */
1689
1690	return -1;
1691}
1692
1693
1694static int wpas_ctrl_nfc_get_handover_sel_wps(struct wpa_supplicant *wpa_s,
1695					      char *reply, size_t max_len,
1696					      int ndef, int cr, char *uuid)
1697{
1698	struct wpabuf *buf;
1699	int res;
1700
1701	buf = wpas_wps_nfc_handover_sel(wpa_s, ndef, cr, uuid);
1702	if (buf == NULL)
1703		return -1;
1704
1705	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1706					 wpabuf_len(buf));
1707	reply[res++] = '\n';
1708	reply[res] = '\0';
1709
1710	wpabuf_free(buf);
1711
1712	return res;
1713}
1714
1715
1716#ifdef CONFIG_P2P
1717static int wpas_ctrl_nfc_get_handover_sel_p2p(struct wpa_supplicant *wpa_s,
1718					      char *reply, size_t max_len,
1719					      int ndef, int tag)
1720{
1721	struct wpabuf *buf;
1722	int res;
1723
1724	buf = wpas_p2p_nfc_handover_sel(wpa_s, ndef, tag);
1725	if (buf == NULL)
1726		return -1;
1727
1728	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1729					 wpabuf_len(buf));
1730	reply[res++] = '\n';
1731	reply[res] = '\0';
1732
1733	wpabuf_free(buf);
1734
1735	return res;
1736}
1737#endif /* CONFIG_P2P */
1738
1739
1740static int wpas_ctrl_nfc_get_handover_sel(struct wpa_supplicant *wpa_s,
1741					  char *cmd, char *reply,
1742					  size_t max_len)
1743{
1744	char *pos, *pos2;
1745	int ndef;
1746
1747	pos = os_strchr(cmd, ' ');
1748	if (pos == NULL)
1749		return -1;
1750	*pos++ = '\0';
1751
1752	if (os_strcmp(cmd, "WPS") == 0)
1753		ndef = 0;
1754	else if (os_strcmp(cmd, "NDEF") == 0)
1755		ndef = 1;
1756	else
1757		return -1;
1758
1759	pos2 = os_strchr(pos, ' ');
1760	if (pos2)
1761		*pos2++ = '\0';
1762	if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1763		if (!ndef)
1764			return -1;
1765		return wpas_ctrl_nfc_get_handover_sel_wps(
1766			wpa_s, reply, max_len, ndef,
1767			os_strcmp(pos, "WPS-CR") == 0, pos2);
1768	}
1769
1770#ifdef CONFIG_P2P
1771	if (os_strcmp(pos, "P2P-CR") == 0) {
1772		return wpas_ctrl_nfc_get_handover_sel_p2p(
1773			wpa_s, reply, max_len, ndef, 0);
1774	}
1775
1776	if (os_strcmp(pos, "P2P-CR-TAG") == 0) {
1777		return wpas_ctrl_nfc_get_handover_sel_p2p(
1778			wpa_s, reply, max_len, ndef, 1);
1779	}
1780#endif /* CONFIG_P2P */
1781
1782	return -1;
1783}
1784
1785
1786static int wpas_ctrl_nfc_report_handover(struct wpa_supplicant *wpa_s,
1787					 char *cmd)
1788{
1789	size_t len;
1790	struct wpabuf *req, *sel;
1791	int ret;
1792	char *pos, *role, *type, *pos2;
1793#ifdef CONFIG_P2P
1794	char *freq;
1795	int forced_freq = 0;
1796
1797	freq = strstr(cmd, " freq=");
1798	if (freq) {
1799		*freq = '\0';
1800		freq += 6;
1801		forced_freq = atoi(freq);
1802	}
1803#endif /* CONFIG_P2P */
1804
1805	role = cmd;
1806	pos = os_strchr(role, ' ');
1807	if (pos == NULL) {
1808		wpa_printf(MSG_DEBUG, "NFC: Missing type in handover report");
1809		return -1;
1810	}
1811	*pos++ = '\0';
1812
1813	type = pos;
1814	pos = os_strchr(type, ' ');
1815	if (pos == NULL) {
1816		wpa_printf(MSG_DEBUG, "NFC: Missing request message in handover report");
1817		return -1;
1818	}
1819	*pos++ = '\0';
1820
1821	pos2 = os_strchr(pos, ' ');
1822	if (pos2 == NULL) {
1823		wpa_printf(MSG_DEBUG, "NFC: Missing select message in handover report");
1824		return -1;
1825	}
1826	*pos2++ = '\0';
1827
1828	len = os_strlen(pos);
1829	if (len & 0x01) {
1830		wpa_printf(MSG_DEBUG, "NFC: Invalid request message length in handover report");
1831		return -1;
1832	}
1833	len /= 2;
1834
1835	req = wpabuf_alloc(len);
1836	if (req == NULL) {
1837		wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for request message");
1838		return -1;
1839	}
1840	if (hexstr2bin(pos, wpabuf_put(req, len), len) < 0) {
1841		wpa_printf(MSG_DEBUG, "NFC: Invalid request message hexdump in handover report");
1842		wpabuf_free(req);
1843		return -1;
1844	}
1845
1846	len = os_strlen(pos2);
1847	if (len & 0x01) {
1848		wpa_printf(MSG_DEBUG, "NFC: Invalid select message length in handover report");
1849		wpabuf_free(req);
1850		return -1;
1851	}
1852	len /= 2;
1853
1854	sel = wpabuf_alloc(len);
1855	if (sel == NULL) {
1856		wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for select message");
1857		wpabuf_free(req);
1858		return -1;
1859	}
1860	if (hexstr2bin(pos2, wpabuf_put(sel, len), len) < 0) {
1861		wpa_printf(MSG_DEBUG, "NFC: Invalid select message hexdump in handover report");
1862		wpabuf_free(req);
1863		wpabuf_free(sel);
1864		return -1;
1865	}
1866
1867	wpa_printf(MSG_DEBUG, "NFC: Connection handover reported - role=%s type=%s req_len=%d sel_len=%d",
1868		   role, type, (int) wpabuf_len(req), (int) wpabuf_len(sel));
1869
1870	if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "WPS") == 0) {
1871		ret = wpas_wps_nfc_report_handover(wpa_s, req, sel);
1872#ifdef CONFIG_AP
1873	} else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "WPS") == 0)
1874	{
1875		ret = wpas_ap_wps_nfc_report_handover(wpa_s, req, sel);
1876		if (ret < 0)
1877			ret = wpas_er_wps_nfc_report_handover(wpa_s, req, sel);
1878#endif /* CONFIG_AP */
1879#ifdef CONFIG_P2P
1880	} else if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "P2P") == 0)
1881	{
1882		ret = wpas_p2p_nfc_report_handover(wpa_s, 1, req, sel, 0);
1883	} else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "P2P") == 0)
1884	{
1885		ret = wpas_p2p_nfc_report_handover(wpa_s, 0, req, sel,
1886						   forced_freq);
1887#endif /* CONFIG_P2P */
1888	} else {
1889		wpa_printf(MSG_DEBUG, "NFC: Unsupported connection handover "
1890			   "reported: role=%s type=%s", role, type);
1891		ret = -1;
1892	}
1893	wpabuf_free(req);
1894	wpabuf_free(sel);
1895
1896	if (ret)
1897		wpa_printf(MSG_DEBUG, "NFC: Failed to process reported handover messages");
1898
1899	return ret;
1900}
1901
1902#endif /* CONFIG_WPS_NFC */
1903
1904
1905static int wpa_supplicant_ctrl_iface_wps_reg(struct wpa_supplicant *wpa_s,
1906					     char *cmd)
1907{
1908	u8 bssid[ETH_ALEN];
1909	char *pin;
1910	char *new_ssid;
1911	char *new_auth;
1912	char *new_encr;
1913	char *new_key;
1914	struct wps_new_ap_settings ap;
1915
1916	pin = os_strchr(cmd, ' ');
1917	if (pin == NULL)
1918		return -1;
1919	*pin++ = '\0';
1920
1921	if (hwaddr_aton(cmd, bssid)) {
1922		wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_REG: invalid BSSID '%s'",
1923			   cmd);
1924		return -1;
1925	}
1926
1927	new_ssid = os_strchr(pin, ' ');
1928	if (new_ssid == NULL)
1929		return wpas_wps_start_reg(wpa_s, bssid, pin, NULL);
1930	*new_ssid++ = '\0';
1931
1932	new_auth = os_strchr(new_ssid, ' ');
1933	if (new_auth == NULL)
1934		return -1;
1935	*new_auth++ = '\0';
1936
1937	new_encr = os_strchr(new_auth, ' ');
1938	if (new_encr == NULL)
1939		return -1;
1940	*new_encr++ = '\0';
1941
1942	new_key = os_strchr(new_encr, ' ');
1943	if (new_key == NULL)
1944		return -1;
1945	*new_key++ = '\0';
1946
1947	os_memset(&ap, 0, sizeof(ap));
1948	ap.ssid_hex = new_ssid;
1949	ap.auth = new_auth;
1950	ap.encr = new_encr;
1951	ap.key_hex = new_key;
1952	return wpas_wps_start_reg(wpa_s, bssid, pin, &ap);
1953}
1954
1955
1956#ifdef CONFIG_AP
1957static int wpa_supplicant_ctrl_iface_wps_ap_pin(struct wpa_supplicant *wpa_s,
1958						char *cmd, char *buf,
1959						size_t buflen)
1960{
1961	int timeout = 300;
1962	char *pos;
1963	const char *pin_txt;
1964
1965	if (!wpa_s->ap_iface)
1966		return -1;
1967
1968	pos = os_strchr(cmd, ' ');
1969	if (pos)
1970		*pos++ = '\0';
1971
1972	if (os_strcmp(cmd, "disable") == 0) {
1973		wpas_wps_ap_pin_disable(wpa_s);
1974		return os_snprintf(buf, buflen, "OK\n");
1975	}
1976
1977	if (os_strcmp(cmd, "random") == 0) {
1978		if (pos)
1979			timeout = atoi(pos);
1980		pin_txt = wpas_wps_ap_pin_random(wpa_s, timeout);
1981		if (pin_txt == NULL)
1982			return -1;
1983		return os_snprintf(buf, buflen, "%s", pin_txt);
1984	}
1985
1986	if (os_strcmp(cmd, "get") == 0) {
1987		pin_txt = wpas_wps_ap_pin_get(wpa_s);
1988		if (pin_txt == NULL)
1989			return -1;
1990		return os_snprintf(buf, buflen, "%s", pin_txt);
1991	}
1992
1993	if (os_strcmp(cmd, "set") == 0) {
1994		char *pin;
1995		if (pos == NULL)
1996			return -1;
1997		pin = pos;
1998		pos = os_strchr(pos, ' ');
1999		if (pos) {
2000			*pos++ = '\0';
2001			timeout = atoi(pos);
2002		}
2003		if (os_strlen(pin) > buflen)
2004			return -1;
2005		if (wpas_wps_ap_pin_set(wpa_s, pin, timeout) < 0)
2006			return -1;
2007		return os_snprintf(buf, buflen, "%s", pin);
2008	}
2009
2010	return -1;
2011}
2012#endif /* CONFIG_AP */
2013
2014
2015#ifdef CONFIG_WPS_ER
2016static int wpa_supplicant_ctrl_iface_wps_er_pin(struct wpa_supplicant *wpa_s,
2017						char *cmd)
2018{
2019	char *uuid = cmd, *pin, *pos;
2020	u8 addr_buf[ETH_ALEN], *addr = NULL;
2021	pin = os_strchr(uuid, ' ');
2022	if (pin == NULL)
2023		return -1;
2024	*pin++ = '\0';
2025	pos = os_strchr(pin, ' ');
2026	if (pos) {
2027		*pos++ = '\0';
2028		if (hwaddr_aton(pos, addr_buf) == 0)
2029			addr = addr_buf;
2030	}
2031	return wpas_wps_er_add_pin(wpa_s, addr, uuid, pin);
2032}
2033
2034
2035static int wpa_supplicant_ctrl_iface_wps_er_learn(struct wpa_supplicant *wpa_s,
2036						  char *cmd)
2037{
2038	char *uuid = cmd, *pin;
2039	pin = os_strchr(uuid, ' ');
2040	if (pin == NULL)
2041		return -1;
2042	*pin++ = '\0';
2043	return wpas_wps_er_learn(wpa_s, uuid, pin);
2044}
2045
2046
2047static int wpa_supplicant_ctrl_iface_wps_er_set_config(
2048	struct wpa_supplicant *wpa_s, char *cmd)
2049{
2050	char *uuid = cmd, *id;
2051	id = os_strchr(uuid, ' ');
2052	if (id == NULL)
2053		return -1;
2054	*id++ = '\0';
2055	return wpas_wps_er_set_config(wpa_s, uuid, atoi(id));
2056}
2057
2058
2059static int wpa_supplicant_ctrl_iface_wps_er_config(
2060	struct wpa_supplicant *wpa_s, char *cmd)
2061{
2062	char *pin;
2063	char *new_ssid;
2064	char *new_auth;
2065	char *new_encr;
2066	char *new_key;
2067	struct wps_new_ap_settings ap;
2068
2069	pin = os_strchr(cmd, ' ');
2070	if (pin == NULL)
2071		return -1;
2072	*pin++ = '\0';
2073
2074	new_ssid = os_strchr(pin, ' ');
2075	if (new_ssid == NULL)
2076		return -1;
2077	*new_ssid++ = '\0';
2078
2079	new_auth = os_strchr(new_ssid, ' ');
2080	if (new_auth == NULL)
2081		return -1;
2082	*new_auth++ = '\0';
2083
2084	new_encr = os_strchr(new_auth, ' ');
2085	if (new_encr == NULL)
2086		return -1;
2087	*new_encr++ = '\0';
2088
2089	new_key = os_strchr(new_encr, ' ');
2090	if (new_key == NULL)
2091		return -1;
2092	*new_key++ = '\0';
2093
2094	os_memset(&ap, 0, sizeof(ap));
2095	ap.ssid_hex = new_ssid;
2096	ap.auth = new_auth;
2097	ap.encr = new_encr;
2098	ap.key_hex = new_key;
2099	return wpas_wps_er_config(wpa_s, cmd, pin, &ap);
2100}
2101
2102
2103#ifdef CONFIG_WPS_NFC
2104static int wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
2105	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
2106{
2107	int ndef;
2108	struct wpabuf *buf;
2109	int res;
2110	char *uuid;
2111
2112	uuid = os_strchr(cmd, ' ');
2113	if (uuid == NULL)
2114		return -1;
2115	*uuid++ = '\0';
2116
2117	if (os_strcmp(cmd, "WPS") == 0)
2118		ndef = 0;
2119	else if (os_strcmp(cmd, "NDEF") == 0)
2120		ndef = 1;
2121	else
2122		return -1;
2123
2124	buf = wpas_wps_er_nfc_config_token(wpa_s, ndef, uuid);
2125	if (buf == NULL)
2126		return -1;
2127
2128	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
2129					 wpabuf_len(buf));
2130	reply[res++] = '\n';
2131	reply[res] = '\0';
2132
2133	wpabuf_free(buf);
2134
2135	return res;
2136}
2137#endif /* CONFIG_WPS_NFC */
2138#endif /* CONFIG_WPS_ER */
2139
2140#endif /* CONFIG_WPS */
2141
2142
2143#ifdef CONFIG_IBSS_RSN
2144static int wpa_supplicant_ctrl_iface_ibss_rsn(
2145	struct wpa_supplicant *wpa_s, char *addr)
2146{
2147	u8 peer[ETH_ALEN];
2148
2149	if (hwaddr_aton(addr, peer)) {
2150		wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN: invalid "
2151			   "address '%s'", addr);
2152		return -1;
2153	}
2154
2155	wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN " MACSTR,
2156		   MAC2STR(peer));
2157
2158	return ibss_rsn_start(wpa_s->ibss_rsn, peer);
2159}
2160#endif /* CONFIG_IBSS_RSN */
2161
2162
2163static int wpa_supplicant_ctrl_iface_ctrl_rsp(struct wpa_supplicant *wpa_s,
2164					      char *rsp)
2165{
2166#ifdef IEEE8021X_EAPOL
2167	char *pos, *id_pos;
2168	int id;
2169	struct wpa_ssid *ssid;
2170
2171	pos = os_strchr(rsp, '-');
2172	if (pos == NULL)
2173		return -1;
2174	*pos++ = '\0';
2175	id_pos = pos;
2176	pos = os_strchr(pos, ':');
2177	if (pos == NULL)
2178		return -1;
2179	*pos++ = '\0';
2180	id = atoi(id_pos);
2181	wpa_printf(MSG_DEBUG, "CTRL_IFACE: field=%s id=%d", rsp, id);
2182	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
2183			      (u8 *) pos, os_strlen(pos));
2184
2185	ssid = wpa_config_get_network(wpa_s->conf, id);
2186	if (ssid == NULL) {
2187		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
2188			   "to update", id);
2189		return -1;
2190	}
2191
2192	return wpa_supplicant_ctrl_iface_ctrl_rsp_handle(wpa_s, ssid, rsp,
2193							 pos);
2194#else /* IEEE8021X_EAPOL */
2195	wpa_printf(MSG_DEBUG, "CTRL_IFACE: 802.1X not included");
2196	return -1;
2197#endif /* IEEE8021X_EAPOL */
2198}
2199
2200
2201static int wpa_supplicant_ctrl_iface_status(struct wpa_supplicant *wpa_s,
2202					    const char *params,
2203					    char *buf, size_t buflen)
2204{
2205	char *pos, *end, tmp[30];
2206	int res, verbose, wps, ret;
2207#ifdef CONFIG_HS20
2208	const u8 *hs20;
2209#endif /* CONFIG_HS20 */
2210	const u8 *sess_id;
2211	size_t sess_id_len;
2212
2213	if (os_strcmp(params, "-DRIVER") == 0)
2214		return wpa_drv_status(wpa_s, buf, buflen);
2215	verbose = os_strcmp(params, "-VERBOSE") == 0;
2216	wps = os_strcmp(params, "-WPS") == 0;
2217	pos = buf;
2218	end = buf + buflen;
2219	if (wpa_s->wpa_state >= WPA_ASSOCIATED) {
2220		struct wpa_ssid *ssid = wpa_s->current_ssid;
2221		ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
2222				  MAC2STR(wpa_s->bssid));
2223		if (os_snprintf_error(end - pos, ret))
2224			return pos - buf;
2225		pos += ret;
2226		ret = os_snprintf(pos, end - pos, "freq=%u\n",
2227				  wpa_s->assoc_freq);
2228		if (os_snprintf_error(end - pos, ret))
2229			return pos - buf;
2230		pos += ret;
2231		if (ssid) {
2232			u8 *_ssid = ssid->ssid;
2233			size_t ssid_len = ssid->ssid_len;
2234			u8 ssid_buf[SSID_MAX_LEN];
2235			if (ssid_len == 0) {
2236				int _res = wpa_drv_get_ssid(wpa_s, ssid_buf);
2237				if (_res < 0)
2238					ssid_len = 0;
2239				else
2240					ssid_len = _res;
2241				_ssid = ssid_buf;
2242			}
2243			ret = os_snprintf(pos, end - pos, "ssid=%s\nid=%d\n",
2244					  wpa_ssid_txt(_ssid, ssid_len),
2245					  ssid->id);
2246			if (os_snprintf_error(end - pos, ret))
2247				return pos - buf;
2248			pos += ret;
2249
2250			if (wps && ssid->passphrase &&
2251			    wpa_key_mgmt_wpa_psk(ssid->key_mgmt) &&
2252			    (ssid->mode == WPAS_MODE_AP ||
2253			     ssid->mode == WPAS_MODE_P2P_GO)) {
2254				ret = os_snprintf(pos, end - pos,
2255						  "passphrase=%s\n",
2256						  ssid->passphrase);
2257				if (os_snprintf_error(end - pos, ret))
2258					return pos - buf;
2259				pos += ret;
2260			}
2261			if (ssid->id_str) {
2262				ret = os_snprintf(pos, end - pos,
2263						  "id_str=%s\n",
2264						  ssid->id_str);
2265				if (os_snprintf_error(end - pos, ret))
2266					return pos - buf;
2267				pos += ret;
2268			}
2269
2270			switch (ssid->mode) {
2271			case WPAS_MODE_INFRA:
2272				ret = os_snprintf(pos, end - pos,
2273						  "mode=station\n");
2274				break;
2275			case WPAS_MODE_IBSS:
2276				ret = os_snprintf(pos, end - pos,
2277						  "mode=IBSS\n");
2278				break;
2279			case WPAS_MODE_AP:
2280				ret = os_snprintf(pos, end - pos,
2281						  "mode=AP\n");
2282				break;
2283			case WPAS_MODE_P2P_GO:
2284				ret = os_snprintf(pos, end - pos,
2285						  "mode=P2P GO\n");
2286				break;
2287			case WPAS_MODE_P2P_GROUP_FORMATION:
2288				ret = os_snprintf(pos, end - pos,
2289						  "mode=P2P GO - group "
2290						  "formation\n");
2291				break;
2292			case WPAS_MODE_MESH:
2293				ret = os_snprintf(pos, end - pos,
2294						  "mode=mesh\n");
2295				break;
2296			default:
2297				ret = 0;
2298				break;
2299			}
2300			if (os_snprintf_error(end - pos, ret))
2301				return pos - buf;
2302			pos += ret;
2303		}
2304
2305		if (wpa_s->connection_set &&
2306		    (wpa_s->connection_ht || wpa_s->connection_vht ||
2307		     wpa_s->connection_he)) {
2308			ret = os_snprintf(pos, end - pos,
2309					  "wifi_generation=%u\n",
2310					  wpa_s->connection_he ? 6 :
2311					  (wpa_s->connection_vht ? 5 : 4));
2312			if (os_snprintf_error(end - pos, ret))
2313				return pos - buf;
2314			pos += ret;
2315		}
2316
2317#ifdef CONFIG_AP
2318		if (wpa_s->ap_iface) {
2319			pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
2320							    end - pos,
2321							    verbose);
2322		} else
2323#endif /* CONFIG_AP */
2324		pos += wpa_sm_get_status(wpa_s->wpa, pos, end - pos, verbose);
2325	}
2326#ifdef CONFIG_SME
2327#ifdef CONFIG_SAE
2328	if (wpa_s->wpa_state >= WPA_ASSOCIATED &&
2329#ifdef CONFIG_AP
2330	    !wpa_s->ap_iface &&
2331#endif /* CONFIG_AP */
2332	    wpa_s->sme.sae.state == SAE_ACCEPTED) {
2333		ret = os_snprintf(pos, end - pos, "sae_group=%d\n"
2334				  "sae_h2e=%d\n"
2335				  "sae_pk=%d\n",
2336				  wpa_s->sme.sae.group,
2337				  wpa_s->sme.sae.h2e,
2338				  wpa_s->sme.sae.pk);
2339		if (os_snprintf_error(end - pos, ret))
2340			return pos - buf;
2341		pos += ret;
2342	}
2343#endif /* CONFIG_SAE */
2344#endif /* CONFIG_SME */
2345	ret = os_snprintf(pos, end - pos, "wpa_state=%s\n",
2346			  wpa_supplicant_state_txt(wpa_s->wpa_state));
2347	if (os_snprintf_error(end - pos, ret))
2348		return pos - buf;
2349	pos += ret;
2350
2351	if (wpa_s->l2 &&
2352	    l2_packet_get_ip_addr(wpa_s->l2, tmp, sizeof(tmp)) >= 0) {
2353		ret = os_snprintf(pos, end - pos, "ip_address=%s\n", tmp);
2354		if (os_snprintf_error(end - pos, ret))
2355			return pos - buf;
2356		pos += ret;
2357	}
2358
2359#ifdef CONFIG_P2P
2360	if (wpa_s->global->p2p) {
2361		ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
2362				  "\n", MAC2STR(wpa_s->global->p2p_dev_addr));
2363		if (os_snprintf_error(end - pos, ret))
2364			return pos - buf;
2365		pos += ret;
2366	}
2367#endif /* CONFIG_P2P */
2368
2369	ret = os_snprintf(pos, end - pos, "address=" MACSTR "\n",
2370			  MAC2STR(wpa_s->own_addr));
2371	if (os_snprintf_error(end - pos, ret))
2372		return pos - buf;
2373	pos += ret;
2374
2375#ifdef CONFIG_HS20
2376	if (wpa_s->current_bss &&
2377	    (hs20 = wpa_bss_get_vendor_ie(wpa_s->current_bss,
2378					  HS20_IE_VENDOR_TYPE)) &&
2379	    wpa_s->wpa_proto == WPA_PROTO_RSN &&
2380	    wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
2381		int release = 1;
2382		if (hs20[1] >= 5) {
2383			u8 rel_num = (hs20[6] & 0xf0) >> 4;
2384			release = rel_num + 1;
2385		}
2386		ret = os_snprintf(pos, end - pos, "hs20=%d\n", release);
2387		if (os_snprintf_error(end - pos, ret))
2388			return pos - buf;
2389		pos += ret;
2390	}
2391
2392	if (wpa_s->current_ssid) {
2393		struct wpa_cred *cred;
2394		char *type;
2395
2396		for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
2397			size_t i;
2398
2399			if (wpa_s->current_ssid->parent_cred != cred)
2400				continue;
2401
2402			if (cred->provisioning_sp) {
2403				ret = os_snprintf(pos, end - pos,
2404						  "provisioning_sp=%s\n",
2405						  cred->provisioning_sp);
2406				if (os_snprintf_error(end - pos, ret))
2407					return pos - buf;
2408				pos += ret;
2409			}
2410
2411			if (!cred->domain)
2412				goto no_domain;
2413
2414			i = 0;
2415			if (wpa_s->current_bss && wpa_s->current_bss->anqp) {
2416				struct wpabuf *names =
2417					wpa_s->current_bss->anqp->domain_name;
2418				for (i = 0; names && i < cred->num_domain; i++)
2419				{
2420					if (domain_name_list_contains(
2421						    names, cred->domain[i], 1))
2422						break;
2423				}
2424				if (i == cred->num_domain)
2425					i = 0; /* show first entry by default */
2426			}
2427			ret = os_snprintf(pos, end - pos, "home_sp=%s\n",
2428					  cred->domain[i]);
2429			if (os_snprintf_error(end - pos, ret))
2430				return pos - buf;
2431			pos += ret;
2432
2433		no_domain:
2434			if (wpa_s->current_bss == NULL ||
2435			    wpa_s->current_bss->anqp == NULL)
2436				res = -1;
2437			else
2438				res = interworking_home_sp_cred(
2439					wpa_s, cred,
2440					wpa_s->current_bss->anqp->domain_name);
2441			if (res > 0)
2442				type = "home";
2443			else if (res == 0)
2444				type = "roaming";
2445			else
2446				type = "unknown";
2447
2448			ret = os_snprintf(pos, end - pos, "sp_type=%s\n", type);
2449			if (os_snprintf_error(end - pos, ret))
2450				return pos - buf;
2451			pos += ret;
2452
2453			break;
2454		}
2455	}
2456#endif /* CONFIG_HS20 */
2457
2458	if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
2459	    wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2460		res = eapol_sm_get_status(wpa_s->eapol, pos, end - pos,
2461					  verbose);
2462		if (res >= 0)
2463			pos += res;
2464	}
2465
2466#ifdef CONFIG_MACSEC
2467	res = ieee802_1x_kay_get_status(wpa_s->kay, pos, end - pos);
2468	if (res > 0)
2469		pos += res;
2470#endif /* CONFIG_MACSEC */
2471
2472	sess_id = eapol_sm_get_session_id(wpa_s->eapol, &sess_id_len);
2473	if (sess_id) {
2474		char *start = pos;
2475
2476		ret = os_snprintf(pos, end - pos, "eap_session_id=");
2477		if (os_snprintf_error(end - pos, ret))
2478			return start - buf;
2479		pos += ret;
2480		ret = wpa_snprintf_hex(pos, end - pos, sess_id, sess_id_len);
2481		if (ret <= 0)
2482			return start - buf;
2483		pos += ret;
2484		ret = os_snprintf(pos, end - pos, "\n");
2485		if (os_snprintf_error(end - pos, ret))
2486			return start - buf;
2487		pos += ret;
2488	}
2489
2490	res = rsn_preauth_get_status(wpa_s->wpa, pos, end - pos, verbose);
2491	if (res >= 0)
2492		pos += res;
2493
2494#ifdef CONFIG_WPS
2495	{
2496		char uuid_str[100];
2497		uuid_bin2str(wpa_s->wps->uuid, uuid_str, sizeof(uuid_str));
2498		ret = os_snprintf(pos, end - pos, "uuid=%s\n", uuid_str);
2499		if (os_snprintf_error(end - pos, ret))
2500			return pos - buf;
2501		pos += ret;
2502	}
2503#endif /* CONFIG_WPS */
2504
2505	if (wpa_s->ieee80211ac) {
2506		ret = os_snprintf(pos, end - pos, "ieee80211ac=1\n");
2507		if (os_snprintf_error(end - pos, ret))
2508			return pos - buf;
2509		pos += ret;
2510	}
2511
2512#ifdef ANDROID
2513	/*
2514	 * Allow using the STATUS command with default behavior, say for debug,
2515	 * i.e., don't generate a "fake" CONNECTION and SUPPLICANT_STATE_CHANGE
2516	 * events with STATUS-NO_EVENTS.
2517	 */
2518	if (os_strcmp(params, "-NO_EVENTS")) {
2519		wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_STATE_CHANGE
2520			     "id=%d state=%d BSSID=" MACSTR " SSID=%s",
2521			     wpa_s->current_ssid ? wpa_s->current_ssid->id : -1,
2522			     wpa_s->wpa_state,
2523			     MAC2STR(wpa_s->bssid),
2524			     wpa_s->current_ssid && wpa_s->current_ssid->ssid ?
2525			     wpa_ssid_txt(wpa_s->current_ssid->ssid,
2526					  wpa_s->current_ssid->ssid_len) : "");
2527		if (wpa_s->wpa_state == WPA_COMPLETED) {
2528			struct wpa_ssid *ssid = wpa_s->current_ssid;
2529			wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED
2530				     "- connection to " MACSTR
2531				     " completed %s [id=%d id_str=%s]",
2532				     MAC2STR(wpa_s->bssid), "(auth)",
2533				     ssid ? ssid->id : -1,
2534				     ssid && ssid->id_str ? ssid->id_str : "");
2535		}
2536	}
2537#endif /* ANDROID */
2538
2539	return pos - buf;
2540}
2541
2542
2543static int wpa_supplicant_ctrl_iface_bssid(struct wpa_supplicant *wpa_s,
2544					   char *cmd)
2545{
2546	char *pos;
2547	int id;
2548	struct wpa_ssid *ssid;
2549	u8 bssid[ETH_ALEN];
2550
2551	/* cmd: "<network id> <BSSID>" */
2552	pos = os_strchr(cmd, ' ');
2553	if (pos == NULL)
2554		return -1;
2555	*pos++ = '\0';
2556	id = atoi(cmd);
2557	wpa_printf(MSG_DEBUG, "CTRL_IFACE: id=%d bssid='%s'", id, pos);
2558	if (hwaddr_aton(pos, bssid)) {
2559		wpa_printf(MSG_DEBUG ,"CTRL_IFACE: invalid BSSID '%s'", pos);
2560		return -1;
2561	}
2562
2563	ssid = wpa_config_get_network(wpa_s->conf, id);
2564	if (ssid == NULL) {
2565		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
2566			   "to update", id);
2567		return -1;
2568	}
2569
2570	os_memcpy(ssid->bssid, bssid, ETH_ALEN);
2571	ssid->bssid_set = !is_zero_ether_addr(bssid);
2572
2573	return 0;
2574}
2575
2576
2577static int wpa_supplicant_ctrl_iface_bssid_ignore(struct wpa_supplicant *wpa_s,
2578						  char *cmd, char *buf,
2579						  size_t buflen)
2580{
2581	u8 bssid[ETH_ALEN];
2582	struct wpa_bssid_ignore *e;
2583	char *pos, *end;
2584	int ret;
2585
2586	/* cmd: "BSSID_IGNORE [<BSSID>]" */
2587	if (*cmd == '\0') {
2588		pos = buf;
2589		end = buf + buflen;
2590		e = wpa_s->bssid_ignore;
2591		while (e) {
2592			ret = os_snprintf(pos, end - pos, MACSTR "\n",
2593					  MAC2STR(e->bssid));
2594			if (os_snprintf_error(end - pos, ret))
2595				return pos - buf;
2596			pos += ret;
2597			e = e->next;
2598		}
2599		return pos - buf;
2600	}
2601
2602	cmd++;
2603	if (os_strncmp(cmd, "clear", 5) == 0) {
2604		wpa_bssid_ignore_clear(wpa_s);
2605		os_memcpy(buf, "OK\n", 3);
2606		return 3;
2607	}
2608
2609	wpa_printf(MSG_DEBUG, "CTRL_IFACE: BSSID_IGNORE bssid='%s'", cmd);
2610	if (hwaddr_aton(cmd, bssid)) {
2611		wpa_printf(MSG_DEBUG, "CTRL_IFACE: invalid BSSID '%s'", cmd);
2612		return -1;
2613	}
2614
2615	/*
2616	 * Add the BSSID twice, so its count will be 2, causing it to be
2617	 * skipped when processing scan results.
2618	 */
2619	ret = wpa_bssid_ignore_add(wpa_s, bssid);
2620	if (ret < 0)
2621		return -1;
2622	ret = wpa_bssid_ignore_add(wpa_s, bssid);
2623	if (ret < 0)
2624		return -1;
2625	os_memcpy(buf, "OK\n", 3);
2626	return 3;
2627}
2628
2629
2630static int wpa_supplicant_ctrl_iface_log_level(struct wpa_supplicant *wpa_s,
2631					       char *cmd, char *buf,
2632					       size_t buflen)
2633{
2634	char *pos, *end, *stamp;
2635	int ret;
2636
2637	/* cmd: "LOG_LEVEL [<level>]" */
2638	if (*cmd == '\0') {
2639		pos = buf;
2640		end = buf + buflen;
2641		ret = os_snprintf(pos, end - pos, "Current level: %s\n"
2642				  "Timestamp: %d\n",
2643				  debug_level_str(wpa_debug_level),
2644				  wpa_debug_timestamp);
2645		if (os_snprintf_error(end - pos, ret))
2646			ret = 0;
2647
2648		return ret;
2649	}
2650
2651	while (*cmd == ' ')
2652		cmd++;
2653
2654	stamp = os_strchr(cmd, ' ');
2655	if (stamp) {
2656		*stamp++ = '\0';
2657		while (*stamp == ' ') {
2658			stamp++;
2659		}
2660	}
2661
2662	if (os_strlen(cmd)) {
2663		int level = str_to_debug_level(cmd);
2664		if (level < 0)
2665			return -1;
2666		wpa_debug_level = level;
2667	}
2668
2669	if (stamp && os_strlen(stamp))
2670		wpa_debug_timestamp = atoi(stamp);
2671
2672	os_memcpy(buf, "OK\n", 3);
2673	return 3;
2674}
2675
2676
2677static int wpa_supplicant_ctrl_iface_list_networks(
2678	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
2679{
2680	char *pos, *end, *prev;
2681	struct wpa_ssid *ssid;
2682	int ret;
2683
2684	pos = buf;
2685	end = buf + buflen;
2686	ret = os_snprintf(pos, end - pos,
2687			  "network id / ssid / bssid / flags\n");
2688	if (os_snprintf_error(end - pos, ret))
2689		return pos - buf;
2690	pos += ret;
2691
2692	ssid = wpa_s->conf->ssid;
2693
2694	/* skip over ssids until we find next one */
2695	if (cmd != NULL && os_strncmp(cmd, "LAST_ID=", 8) == 0) {
2696		int last_id = atoi(cmd + 8);
2697		if (last_id != -1) {
2698			while (ssid != NULL && ssid->id <= last_id) {
2699				ssid = ssid->next;
2700			}
2701		}
2702	}
2703
2704	while (ssid) {
2705		prev = pos;
2706		ret = os_snprintf(pos, end - pos, "%d\t%s",
2707				  ssid->id,
2708				  wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2709		if (os_snprintf_error(end - pos, ret))
2710			return prev - buf;
2711		pos += ret;
2712		if (ssid->bssid_set) {
2713			ret = os_snprintf(pos, end - pos, "\t" MACSTR,
2714					  MAC2STR(ssid->bssid));
2715		} else {
2716			ret = os_snprintf(pos, end - pos, "\tany");
2717		}
2718		if (os_snprintf_error(end - pos, ret))
2719			return prev - buf;
2720		pos += ret;
2721		ret = os_snprintf(pos, end - pos, "\t%s%s%s%s",
2722				  ssid == wpa_s->current_ssid ?
2723				  "[CURRENT]" : "",
2724				  ssid->disabled ? "[DISABLED]" : "",
2725				  ssid->disabled_until.sec ?
2726				  "[TEMP-DISABLED]" : "",
2727				  ssid->disabled == 2 ? "[P2P-PERSISTENT]" :
2728				  "");
2729		if (os_snprintf_error(end - pos, ret))
2730			return prev - buf;
2731		pos += ret;
2732		ret = os_snprintf(pos, end - pos, "\n");
2733		if (os_snprintf_error(end - pos, ret))
2734			return prev - buf;
2735		pos += ret;
2736
2737		ssid = ssid->next;
2738	}
2739
2740	return pos - buf;
2741}
2742
2743
2744static char * wpa_supplicant_cipher_txt(char *pos, char *end, int cipher)
2745{
2746	int ret;
2747	ret = os_snprintf(pos, end - pos, "-");
2748	if (os_snprintf_error(end - pos, ret))
2749		return pos;
2750	pos += ret;
2751	ret = wpa_write_ciphers(pos, end, cipher, "+");
2752	if (ret < 0)
2753		return pos;
2754	pos += ret;
2755	return pos;
2756}
2757
2758
2759static char * wpa_supplicant_ie_txt(char *pos, char *end, const char *proto,
2760				    const u8 *ie, size_t ie_len)
2761{
2762	struct wpa_ie_data data;
2763	char *start;
2764	int ret;
2765
2766	ret = os_snprintf(pos, end - pos, "[%s-", proto);
2767	if (os_snprintf_error(end - pos, ret))
2768		return pos;
2769	pos += ret;
2770
2771	if (wpa_parse_wpa_ie(ie, ie_len, &data) < 0) {
2772		ret = os_snprintf(pos, end - pos, "?]");
2773		if (os_snprintf_error(end - pos, ret))
2774			return pos;
2775		pos += ret;
2776		return pos;
2777	}
2778
2779	start = pos;
2780	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
2781		ret = os_snprintf(pos, end - pos, "%sEAP",
2782				  pos == start ? "" : "+");
2783		if (os_snprintf_error(end - pos, ret))
2784			return pos;
2785		pos += ret;
2786	}
2787	if (data.key_mgmt & WPA_KEY_MGMT_PSK) {
2788		ret = os_snprintf(pos, end - pos, "%sPSK",
2789				  pos == start ? "" : "+");
2790		if (os_snprintf_error(end - pos, ret))
2791			return pos;
2792		pos += ret;
2793	}
2794	if (data.key_mgmt & WPA_KEY_MGMT_WPA_NONE) {
2795		ret = os_snprintf(pos, end - pos, "%sNone",
2796				  pos == start ? "" : "+");
2797		if (os_snprintf_error(end - pos, ret))
2798			return pos;
2799		pos += ret;
2800	}
2801	if (data.key_mgmt & WPA_KEY_MGMT_SAE) {
2802		ret = os_snprintf(pos, end - pos, "%sSAE",
2803				  pos == start ? "" : "+");
2804		if (os_snprintf_error(end - pos, ret))
2805			return pos;
2806		pos += ret;
2807	}
2808#ifdef CONFIG_IEEE80211R
2809	if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
2810		ret = os_snprintf(pos, end - pos, "%sFT/EAP",
2811				  pos == start ? "" : "+");
2812		if (os_snprintf_error(end - pos, ret))
2813			return pos;
2814		pos += ret;
2815	}
2816	if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK) {
2817		ret = os_snprintf(pos, end - pos, "%sFT/PSK",
2818				  pos == start ? "" : "+");
2819		if (os_snprintf_error(end - pos, ret))
2820			return pos;
2821		pos += ret;
2822	}
2823	if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE) {
2824		ret = os_snprintf(pos, end - pos, "%sFT/SAE",
2825				  pos == start ? "" : "+");
2826		if (os_snprintf_error(end - pos, ret))
2827			return pos;
2828		pos += ret;
2829	}
2830#endif /* CONFIG_IEEE80211R */
2831	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
2832		ret = os_snprintf(pos, end - pos, "%sEAP-SHA256",
2833				  pos == start ? "" : "+");
2834		if (os_snprintf_error(end - pos, ret))
2835			return pos;
2836		pos += ret;
2837	}
2838	if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
2839		ret = os_snprintf(pos, end - pos, "%sPSK-SHA256",
2840				  pos == start ? "" : "+");
2841		if (os_snprintf_error(end - pos, ret))
2842			return pos;
2843		pos += ret;
2844	}
2845
2846#ifdef CONFIG_SUITEB
2847	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
2848		ret = os_snprintf(pos, end - pos, "%sEAP-SUITE-B",
2849				  pos == start ? "" : "+");
2850		if (os_snprintf_error(end - pos, ret))
2851			return pos;
2852		pos += ret;
2853	}
2854#endif /* CONFIG_SUITEB */
2855
2856#ifdef CONFIG_SUITEB192
2857	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
2858		ret = os_snprintf(pos, end - pos, "%sEAP-SUITE-B-192",
2859				  pos == start ? "" : "+");
2860		if (os_snprintf_error(end - pos, ret))
2861			return pos;
2862		pos += ret;
2863	}
2864#endif /* CONFIG_SUITEB192 */
2865
2866#ifdef CONFIG_FILS
2867	if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA256) {
2868		ret = os_snprintf(pos, end - pos, "%sFILS-SHA256",
2869				  pos == start ? "" : "+");
2870		if (os_snprintf_error(end - pos, ret))
2871			return pos;
2872		pos += ret;
2873	}
2874	if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA384) {
2875		ret = os_snprintf(pos, end - pos, "%sFILS-SHA384",
2876				  pos == start ? "" : "+");
2877		if (os_snprintf_error(end - pos, ret))
2878			return pos;
2879		pos += ret;
2880	}
2881#ifdef CONFIG_IEEE80211R
2882	if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) {
2883		ret = os_snprintf(pos, end - pos, "%sFT-FILS-SHA256",
2884				  pos == start ? "" : "+");
2885		if (os_snprintf_error(end - pos, ret))
2886			return pos;
2887		pos += ret;
2888	}
2889	if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) {
2890		ret = os_snprintf(pos, end - pos, "%sFT-FILS-SHA384",
2891				  pos == start ? "" : "+");
2892		if (os_snprintf_error(end - pos, ret))
2893			return pos;
2894		pos += ret;
2895	}
2896#endif /* CONFIG_IEEE80211R */
2897#endif /* CONFIG_FILS */
2898
2899#ifdef CONFIG_OWE
2900	if (data.key_mgmt & WPA_KEY_MGMT_OWE) {
2901		ret = os_snprintf(pos, end - pos, "%sOWE",
2902				  pos == start ? "" : "+");
2903		if (os_snprintf_error(end - pos, ret))
2904			return pos;
2905		pos += ret;
2906	}
2907#endif /* CONFIG_OWE */
2908
2909#ifdef CONFIG_DPP
2910	if (data.key_mgmt & WPA_KEY_MGMT_DPP) {
2911		ret = os_snprintf(pos, end - pos, "%sDPP",
2912				  pos == start ? "" : "+");
2913		if (os_snprintf_error(end - pos, ret))
2914			return pos;
2915		pos += ret;
2916	}
2917#endif /* CONFIG_DPP */
2918
2919	if (data.key_mgmt & WPA_KEY_MGMT_OSEN) {
2920		ret = os_snprintf(pos, end - pos, "%sOSEN",
2921				  pos == start ? "" : "+");
2922		if (os_snprintf_error(end - pos, ret))
2923			return pos;
2924		pos += ret;
2925	}
2926
2927	pos = wpa_supplicant_cipher_txt(pos, end, data.pairwise_cipher);
2928
2929	if (data.capabilities & WPA_CAPABILITY_PREAUTH) {
2930		ret = os_snprintf(pos, end - pos, "-preauth");
2931		if (os_snprintf_error(end - pos, ret))
2932			return pos;
2933		pos += ret;
2934	}
2935
2936	ret = os_snprintf(pos, end - pos, "]");
2937	if (os_snprintf_error(end - pos, ret))
2938		return pos;
2939	pos += ret;
2940
2941	return pos;
2942}
2943
2944
2945#ifdef CONFIG_WPS
2946static char * wpa_supplicant_wps_ie_txt_buf(struct wpa_supplicant *wpa_s,
2947					    char *pos, char *end,
2948					    struct wpabuf *wps_ie)
2949{
2950	int ret;
2951	const char *txt;
2952
2953	if (wps_ie == NULL)
2954		return pos;
2955	if (wps_is_selected_pbc_registrar(wps_ie))
2956		txt = "[WPS-PBC]";
2957	else if (wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 0))
2958		txt = "[WPS-AUTH]";
2959	else if (wps_is_selected_pin_registrar(wps_ie))
2960		txt = "[WPS-PIN]";
2961	else
2962		txt = "[WPS]";
2963
2964	ret = os_snprintf(pos, end - pos, "%s", txt);
2965	if (!os_snprintf_error(end - pos, ret))
2966		pos += ret;
2967	wpabuf_free(wps_ie);
2968	return pos;
2969}
2970#endif /* CONFIG_WPS */
2971
2972
2973static char * wpa_supplicant_wps_ie_txt(struct wpa_supplicant *wpa_s,
2974					char *pos, char *end,
2975					const struct wpa_bss *bss)
2976{
2977#ifdef CONFIG_WPS
2978	struct wpabuf *wps_ie;
2979	wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
2980	return wpa_supplicant_wps_ie_txt_buf(wpa_s, pos, end, wps_ie);
2981#else /* CONFIG_WPS */
2982	return pos;
2983#endif /* CONFIG_WPS */
2984}
2985
2986
2987/* Format one result on one text line into a buffer. */
2988static int wpa_supplicant_ctrl_iface_scan_result(
2989	struct wpa_supplicant *wpa_s,
2990	const struct wpa_bss *bss, char *buf, size_t buflen)
2991{
2992	char *pos, *end;
2993	int ret;
2994	const u8 *ie, *ie2, *osen_ie, *p2p, *mesh, *owe, *rsnxe;
2995
2996	mesh = wpa_bss_get_ie(bss, WLAN_EID_MESH_ID);
2997	p2p = wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE);
2998	if (!p2p)
2999		p2p = wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE);
3000	if (p2p && bss->ssid_len == P2P_WILDCARD_SSID_LEN &&
3001	    os_memcmp(bss->ssid, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) ==
3002	    0)
3003		return 0; /* Do not show P2P listen discovery results here */
3004
3005	pos = buf;
3006	end = buf + buflen;
3007
3008	ret = os_snprintf(pos, end - pos, MACSTR "\t%d\t%d\t",
3009			  MAC2STR(bss->bssid), bss->freq, bss->level);
3010	if (os_snprintf_error(end - pos, ret))
3011		return -1;
3012	pos += ret;
3013	ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
3014	if (ie)
3015		pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie, 2 + ie[1]);
3016	ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
3017	if (ie2) {
3018		pos = wpa_supplicant_ie_txt(pos, end, mesh ? "RSN" : "WPA2",
3019					    ie2, 2 + ie2[1]);
3020	}
3021	rsnxe = wpa_bss_get_ie(bss, WLAN_EID_RSNX);
3022	if (ieee802_11_rsnx_capab(rsnxe, WLAN_RSNX_CAPAB_SAE_H2E)) {
3023		ret = os_snprintf(pos, end - pos, "[SAE-H2E]");
3024		if (os_snprintf_error(end - pos, ret))
3025			return -1;
3026		pos += ret;
3027	}
3028	if (ieee802_11_rsnx_capab(rsnxe, WLAN_RSNX_CAPAB_SAE_PK)) {
3029		ret = os_snprintf(pos, end - pos, "[SAE-PK]");
3030		if (os_snprintf_error(end - pos, ret))
3031			return -1;
3032		pos += ret;
3033	}
3034	osen_ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
3035	if (osen_ie)
3036		pos = wpa_supplicant_ie_txt(pos, end, "OSEN",
3037					    osen_ie, 2 + osen_ie[1]);
3038	owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
3039	if (owe) {
3040		ret = os_snprintf(pos, end - pos,
3041				  ie2 ? "[OWE-TRANS]" : "[OWE-TRANS-OPEN]");
3042		if (os_snprintf_error(end - pos, ret))
3043			return -1;
3044		pos += ret;
3045	}
3046	pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
3047	if (!ie && !ie2 && !osen_ie && (bss->caps & IEEE80211_CAP_PRIVACY)) {
3048		ret = os_snprintf(pos, end - pos, "[WEP]");
3049		if (os_snprintf_error(end - pos, ret))
3050			return -1;
3051		pos += ret;
3052	}
3053	if (mesh) {
3054		ret = os_snprintf(pos, end - pos, "[MESH]");
3055		if (os_snprintf_error(end - pos, ret))
3056			return -1;
3057		pos += ret;
3058	}
3059	if (bss_is_dmg(bss)) {
3060		const char *s;
3061
3062		if (wpa_bss_get_ie_ext(bss, WLAN_EID_EXT_EDMG_OPERATION)) {
3063			ret = os_snprintf(pos, end - pos, "[EDMG]");
3064			if (os_snprintf_error(end - pos, ret))
3065				return -1;
3066			pos += ret;
3067		}
3068
3069		ret = os_snprintf(pos, end - pos, "[DMG]");
3070		if (os_snprintf_error(end - pos, ret))
3071			return -1;
3072		pos += ret;
3073		switch (bss->caps & IEEE80211_CAP_DMG_MASK) {
3074		case IEEE80211_CAP_DMG_IBSS:
3075			s = "[IBSS]";
3076			break;
3077		case IEEE80211_CAP_DMG_AP:
3078			s = "[ESS]";
3079			break;
3080		case IEEE80211_CAP_DMG_PBSS:
3081			s = "[PBSS]";
3082			break;
3083		default:
3084			s = "";
3085			break;
3086		}
3087		ret = os_snprintf(pos, end - pos, "%s", s);
3088		if (os_snprintf_error(end - pos, ret))
3089			return -1;
3090		pos += ret;
3091	} else {
3092		if (bss->caps & IEEE80211_CAP_IBSS) {
3093			ret = os_snprintf(pos, end - pos, "[IBSS]");
3094			if (os_snprintf_error(end - pos, ret))
3095				return -1;
3096			pos += ret;
3097		}
3098		if (bss->caps & IEEE80211_CAP_ESS) {
3099			ret = os_snprintf(pos, end - pos, "[ESS]");
3100			if (os_snprintf_error(end - pos, ret))
3101				return -1;
3102			pos += ret;
3103		}
3104	}
3105	if (p2p) {
3106		ret = os_snprintf(pos, end - pos, "[P2P]");
3107		if (os_snprintf_error(end - pos, ret))
3108			return -1;
3109		pos += ret;
3110	}
3111#ifdef CONFIG_HS20
3112	if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE) && ie2) {
3113		ret = os_snprintf(pos, end - pos, "[HS20]");
3114		if (os_snprintf_error(end - pos, ret))
3115			return -1;
3116		pos += ret;
3117	}
3118#endif /* CONFIG_HS20 */
3119#ifdef CONFIG_FILS
3120	if (wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION)) {
3121		ret = os_snprintf(pos, end - pos, "[FILS]");
3122		if (os_snprintf_error(end - pos, ret))
3123			return -1;
3124		pos += ret;
3125	}
3126#endif /* CONFIG_FILS */
3127#ifdef CONFIG_FST
3128	if (wpa_bss_get_ie(bss, WLAN_EID_MULTI_BAND)) {
3129		ret = os_snprintf(pos, end - pos, "[FST]");
3130		if (os_snprintf_error(end - pos, ret))
3131			return -1;
3132		pos += ret;
3133	}
3134#endif /* CONFIG_FST */
3135	if (wpa_bss_ext_capab(bss, WLAN_EXT_CAPAB_UTF_8_SSID)) {
3136		ret = os_snprintf(pos, end - pos, "[UTF-8]");
3137		if (os_snprintf_error(end - pos, ret))
3138			return -1;
3139		pos += ret;
3140	}
3141
3142	ret = os_snprintf(pos, end - pos, "\t%s",
3143			  wpa_ssid_txt(bss->ssid, bss->ssid_len));
3144	if (os_snprintf_error(end - pos, ret))
3145		return -1;
3146	pos += ret;
3147
3148	ret = os_snprintf(pos, end - pos, "\n");
3149	if (os_snprintf_error(end - pos, ret))
3150		return -1;
3151	pos += ret;
3152
3153	return pos - buf;
3154}
3155
3156
3157static int wpa_supplicant_ctrl_iface_scan_results(
3158	struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
3159{
3160	char *pos, *end;
3161	struct wpa_bss *bss;
3162	int ret;
3163
3164	pos = buf;
3165	end = buf + buflen;
3166	ret = os_snprintf(pos, end - pos, "bssid / frequency / signal level / "
3167			  "flags / ssid\n");
3168	if (os_snprintf_error(end - pos, ret))
3169		return pos - buf;
3170	pos += ret;
3171
3172	dl_list_for_each(bss, &wpa_s->bss_id, struct wpa_bss, list_id) {
3173		ret = wpa_supplicant_ctrl_iface_scan_result(wpa_s, bss, pos,
3174							    end - pos);
3175		if (ret < 0 || ret >= end - pos)
3176			return pos - buf;
3177		pos += ret;
3178	}
3179
3180	return pos - buf;
3181}
3182
3183
3184#ifdef CONFIG_MESH
3185
3186static int wpa_supplicant_ctrl_iface_mesh_interface_add(
3187	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
3188{
3189	char *pos, ifname[IFNAMSIZ + 1];
3190
3191	ifname[0] = '\0';
3192
3193	pos = os_strstr(cmd, "ifname=");
3194	if (pos) {
3195		pos += 7;
3196		os_strlcpy(ifname, pos, sizeof(ifname));
3197	}
3198
3199	if (wpas_mesh_add_interface(wpa_s, ifname, sizeof(ifname)) < 0)
3200		return -1;
3201
3202	os_strlcpy(reply, ifname, max_len);
3203	return os_strlen(ifname);
3204}
3205
3206
3207static int wpa_supplicant_ctrl_iface_mesh_group_add(
3208	struct wpa_supplicant *wpa_s, char *cmd)
3209{
3210	int id;
3211	struct wpa_ssid *ssid;
3212
3213	id = atoi(cmd);
3214	wpa_printf(MSG_DEBUG, "CTRL_IFACE: MESH_GROUP_ADD id=%d", id);
3215
3216	ssid = wpa_config_get_network(wpa_s->conf, id);
3217	if (ssid == NULL) {
3218		wpa_printf(MSG_DEBUG,
3219			   "CTRL_IFACE: Could not find network id=%d", id);
3220		return -1;
3221	}
3222	if (ssid->mode != WPAS_MODE_MESH) {
3223		wpa_printf(MSG_DEBUG,
3224			   "CTRL_IFACE: Cannot use MESH_GROUP_ADD on a non mesh network");
3225		return -1;
3226	}
3227	if (ssid->key_mgmt != WPA_KEY_MGMT_NONE &&
3228	    ssid->key_mgmt != WPA_KEY_MGMT_SAE) {
3229		wpa_printf(MSG_ERROR,
3230			   "CTRL_IFACE: key_mgmt for mesh network should be open or SAE");
3231		return -1;
3232	}
3233
3234	/*
3235	 * TODO: If necessary write our own group_add function,
3236	 * for now we can reuse select_network
3237	 */
3238	wpa_supplicant_select_network(wpa_s, ssid);
3239
3240	return 0;
3241}
3242
3243
3244static int wpa_supplicant_ctrl_iface_mesh_group_remove(
3245	struct wpa_supplicant *wpa_s, char *cmd)
3246{
3247	struct wpa_supplicant *orig;
3248	struct wpa_global *global;
3249	int found = 0;
3250
3251	wpa_printf(MSG_DEBUG, "CTRL_IFACE: MESH_GROUP_REMOVE ifname=%s", cmd);
3252
3253	global = wpa_s->global;
3254	orig = wpa_s;
3255
3256	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
3257		if (os_strcmp(wpa_s->ifname, cmd) == 0) {
3258			found = 1;
3259			break;
3260		}
3261	}
3262	if (!found) {
3263		wpa_printf(MSG_ERROR,
3264			   "CTRL_IFACE: MESH_GROUP_REMOVE ifname=%s not found",
3265			   cmd);
3266		return -1;
3267	}
3268	if (wpa_s->mesh_if_created && wpa_s == orig) {
3269		wpa_printf(MSG_ERROR,
3270			   "CTRL_IFACE: MESH_GROUP_REMOVE can't remove itself");
3271		return -1;
3272	}
3273
3274	wpa_s->reassociate = 0;
3275	wpa_s->disconnected = 1;
3276	wpa_supplicant_cancel_sched_scan(wpa_s);
3277	wpa_supplicant_cancel_scan(wpa_s);
3278
3279	/*
3280	 * TODO: If necessary write our own group_remove function,
3281	 * for now we can reuse deauthenticate
3282	 */
3283	wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
3284
3285	if (wpa_s->mesh_if_created)
3286		wpa_supplicant_remove_iface(global, wpa_s, 0);
3287
3288	return 0;
3289}
3290
3291
3292static int wpa_supplicant_ctrl_iface_mesh_peer_remove(
3293	struct wpa_supplicant *wpa_s, char *cmd)
3294{
3295	u8 addr[ETH_ALEN];
3296
3297	if (hwaddr_aton(cmd, addr) < 0)
3298		return -1;
3299
3300	return wpas_mesh_peer_remove(wpa_s, addr);
3301}
3302
3303
3304static int wpa_supplicant_ctrl_iface_mesh_peer_add(
3305	struct wpa_supplicant *wpa_s, char *cmd)
3306{
3307	u8 addr[ETH_ALEN];
3308	int duration;
3309	char *pos;
3310
3311	pos = os_strstr(cmd, " duration=");
3312	if (pos) {
3313		*pos = '\0';
3314		duration = atoi(pos + 10);
3315	} else {
3316		duration = -1;
3317	}
3318
3319	if (hwaddr_aton(cmd, addr))
3320		return -1;
3321
3322	return wpas_mesh_peer_add(wpa_s, addr, duration);
3323}
3324
3325
3326static int wpa_supplicant_ctrl_iface_mesh_link_probe(
3327	struct wpa_supplicant *wpa_s, char *cmd)
3328{
3329	struct ether_header *eth;
3330	u8 addr[ETH_ALEN];
3331	u8 *buf;
3332	char *pos;
3333	size_t payload_len = 0, len;
3334	int ret = -1;
3335
3336	if (hwaddr_aton(cmd, addr))
3337		return -1;
3338
3339	pos = os_strstr(cmd, " payload=");
3340	if (pos) {
3341		pos = pos + 9;
3342		payload_len = os_strlen(pos);
3343		if (payload_len & 1)
3344			return -1;
3345
3346		payload_len /= 2;
3347	}
3348
3349	len = ETH_HLEN + payload_len;
3350	buf = os_malloc(len);
3351	if (!buf)
3352		return -1;
3353
3354	eth = (struct ether_header *) buf;
3355	os_memcpy(eth->ether_dhost, addr, ETH_ALEN);
3356	os_memcpy(eth->ether_shost, wpa_s->own_addr, ETH_ALEN);
3357	eth->ether_type = htons(ETH_P_802_3);
3358
3359	if (payload_len && hexstr2bin(pos, buf + ETH_HLEN, payload_len) < 0)
3360		goto fail;
3361
3362	ret = wpa_drv_mesh_link_probe(wpa_s, addr, buf, len);
3363fail:
3364	os_free(buf);
3365	return -ret;
3366}
3367
3368#endif /* CONFIG_MESH */
3369
3370
3371static int wpa_supplicant_ctrl_iface_select_network(
3372	struct wpa_supplicant *wpa_s, char *cmd)
3373{
3374	int id;
3375	struct wpa_ssid *ssid;
3376	char *pos;
3377
3378	/* cmd: "<network id>" or "any" */
3379	if (os_strncmp(cmd, "any", 3) == 0) {
3380		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK any");
3381		ssid = NULL;
3382	} else {
3383		id = atoi(cmd);
3384		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK id=%d", id);
3385
3386		ssid = wpa_config_get_network(wpa_s->conf, id);
3387		if (ssid == NULL) {
3388			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3389				   "network id=%d", id);
3390			return -1;
3391		}
3392		if (ssid->disabled == 2) {
3393			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
3394				   "SELECT_NETWORK with persistent P2P group");
3395			return -1;
3396		}
3397	}
3398
3399	pos = os_strstr(cmd, " freq=");
3400	if (pos) {
3401		int *freqs = freq_range_to_channel_list(wpa_s, pos + 6);
3402		if (freqs) {
3403			os_free(wpa_s->select_network_scan_freqs);
3404			wpa_s->select_network_scan_freqs = freqs;
3405		}
3406	}
3407
3408	wpa_s->scan_min_time.sec = 0;
3409	wpa_s->scan_min_time.usec = 0;
3410	wpa_supplicant_select_network(wpa_s, ssid);
3411
3412	return 0;
3413}
3414
3415
3416static int wpa_supplicant_ctrl_iface_enable_network(
3417	struct wpa_supplicant *wpa_s, char *cmd)
3418{
3419	int id;
3420	struct wpa_ssid *ssid;
3421
3422	/* cmd: "<network id>" or "all" */
3423	if (os_strcmp(cmd, "all") == 0) {
3424		wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK all");
3425		ssid = NULL;
3426	} else {
3427		id = atoi(cmd);
3428		wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK id=%d", id);
3429
3430		ssid = wpa_config_get_network(wpa_s->conf, id);
3431		if (ssid == NULL) {
3432			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3433				   "network id=%d", id);
3434			return -1;
3435		}
3436		if (ssid->disabled == 2) {
3437			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
3438				   "ENABLE_NETWORK with persistent P2P group");
3439			return -1;
3440		}
3441
3442		if (os_strstr(cmd, " no-connect")) {
3443			ssid->disabled = 0;
3444			return 0;
3445		}
3446	}
3447	wpa_s->scan_min_time.sec = 0;
3448	wpa_s->scan_min_time.usec = 0;
3449	wpa_supplicant_enable_network(wpa_s, ssid);
3450
3451	return 0;
3452}
3453
3454
3455static int wpa_supplicant_ctrl_iface_disable_network(
3456	struct wpa_supplicant *wpa_s, char *cmd)
3457{
3458	int id;
3459	struct wpa_ssid *ssid;
3460
3461	/* cmd: "<network id>" or "all" */
3462	if (os_strcmp(cmd, "all") == 0) {
3463		wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK all");
3464		ssid = NULL;
3465	} else {
3466		id = atoi(cmd);
3467		wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK id=%d", id);
3468
3469		ssid = wpa_config_get_network(wpa_s->conf, id);
3470		if (ssid == NULL) {
3471			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3472				   "network id=%d", id);
3473			return -1;
3474		}
3475		if (ssid->disabled == 2) {
3476			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
3477				   "DISABLE_NETWORK with persistent P2P "
3478				   "group");
3479			return -1;
3480		}
3481	}
3482	wpa_supplicant_disable_network(wpa_s, ssid);
3483
3484	return 0;
3485}
3486
3487
3488static int wpa_supplicant_ctrl_iface_add_network(
3489	struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
3490{
3491	struct wpa_ssid *ssid;
3492	int ret;
3493
3494	wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_NETWORK");
3495
3496	ssid = wpa_supplicant_add_network(wpa_s);
3497	if (ssid == NULL)
3498		return -1;
3499
3500	ret = os_snprintf(buf, buflen, "%d\n", ssid->id);
3501	if (os_snprintf_error(buflen, ret))
3502		return -1;
3503	return ret;
3504}
3505
3506
3507static int wpa_supplicant_ctrl_iface_remove_network(
3508	struct wpa_supplicant *wpa_s, char *cmd)
3509{
3510	int id;
3511	int result;
3512
3513	/* cmd: "<network id>" or "all" */
3514	if (os_strcmp(cmd, "all") == 0) {
3515		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK all");
3516		return wpa_supplicant_remove_all_networks(wpa_s);
3517	}
3518
3519	id = atoi(cmd);
3520	wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK id=%d", id);
3521
3522	result = wpa_supplicant_remove_network(wpa_s, id);
3523	if (result == -1) {
3524		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
3525			   "id=%d", id);
3526		return -1;
3527	}
3528	if (result == -2) {
3529		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Not able to remove the "
3530			   "network id=%d", id);
3531		return -1;
3532	}
3533	return 0;
3534}
3535
3536
3537static int wpa_supplicant_ctrl_iface_update_network(
3538	struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3539	char *name, char *value)
3540{
3541	int ret;
3542
3543	ret = wpa_config_set(ssid, name, value, 0);
3544	if (ret < 0) {
3545		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set network "
3546			   "variable '%s'", name);
3547		return -1;
3548	}
3549	if (ret == 1)
3550		return 0; /* No change to the previously configured value */
3551
3552#ifdef CONFIG_BGSCAN
3553	if (os_strcmp(name, "bgscan") == 0) {
3554		/*
3555		 * Reset the bgscan parameters for the current network and
3556		 * return. There's no need to flush caches for bgscan parameter
3557		 * changes.
3558		 */
3559		if (wpa_s->current_ssid == ssid &&
3560		    wpa_s->wpa_state == WPA_COMPLETED)
3561			wpa_supplicant_reset_bgscan(wpa_s);
3562		return 0;
3563	}
3564#endif /* CONFIG_BGSCAN */
3565
3566	if (os_strcmp(name, "bssid") != 0 &&
3567	    os_strcmp(name, "bssid_hint") != 0 &&
3568	    os_strcmp(name, "priority") != 0) {
3569		wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
3570
3571		if (wpa_s->current_ssid == ssid ||
3572		    wpa_s->current_ssid == NULL) {
3573			/*
3574			 * Invalidate the EAP session cache if anything in the
3575			 * current or previously used configuration changes.
3576			 */
3577			eapol_sm_invalidate_cached_session(wpa_s->eapol);
3578		}
3579	}
3580
3581	if ((os_strcmp(name, "psk") == 0 &&
3582	     value[0] == '"' && ssid->ssid_len) ||
3583	    (os_strcmp(name, "ssid") == 0 && ssid->passphrase))
3584		wpa_config_update_psk(ssid);
3585	else if (os_strcmp(name, "priority") == 0)
3586		wpa_config_update_prio_list(wpa_s->conf);
3587
3588	return 0;
3589}
3590
3591
3592static int wpa_supplicant_ctrl_iface_set_network(
3593	struct wpa_supplicant *wpa_s, char *cmd)
3594{
3595	int id, ret, prev_bssid_set, prev_disabled;
3596	struct wpa_ssid *ssid;
3597	char *name, *value;
3598	u8 prev_bssid[ETH_ALEN];
3599
3600	/* cmd: "<network id> <variable name> <value>" */
3601	name = os_strchr(cmd, ' ');
3602	if (name == NULL)
3603		return -1;
3604	*name++ = '\0';
3605
3606	value = os_strchr(name, ' ');
3607	if (value == NULL)
3608		return -1;
3609	*value++ = '\0';
3610
3611	id = atoi(cmd);
3612	wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_NETWORK id=%d name='%s'",
3613		   id, name);
3614	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
3615			      (u8 *) value, os_strlen(value));
3616
3617	ssid = wpa_config_get_network(wpa_s->conf, id);
3618	if (ssid == NULL) {
3619		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
3620			   "id=%d", id);
3621		return -1;
3622	}
3623
3624	prev_bssid_set = ssid->bssid_set;
3625	prev_disabled = ssid->disabled;
3626	os_memcpy(prev_bssid, ssid->bssid, ETH_ALEN);
3627	ret = wpa_supplicant_ctrl_iface_update_network(wpa_s, ssid, name,
3628						       value);
3629	if (ret == 0 &&
3630	    (ssid->bssid_set != prev_bssid_set ||
3631	     os_memcmp(ssid->bssid, prev_bssid, ETH_ALEN) != 0))
3632		wpas_notify_network_bssid_set_changed(wpa_s, ssid);
3633
3634	if (prev_disabled != ssid->disabled &&
3635	    (prev_disabled == 2 || ssid->disabled == 2))
3636		wpas_notify_network_type_changed(wpa_s, ssid);
3637
3638	return ret;
3639}
3640
3641
3642static int wpa_supplicant_ctrl_iface_get_network(
3643	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
3644{
3645	int id;
3646	size_t res;
3647	struct wpa_ssid *ssid;
3648	char *name, *value;
3649
3650	/* cmd: "<network id> <variable name>" */
3651	name = os_strchr(cmd, ' ');
3652	if (name == NULL || buflen == 0)
3653		return -1;
3654	*name++ = '\0';
3655
3656	id = atoi(cmd);
3657	wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: GET_NETWORK id=%d name='%s'",
3658		   id, name);
3659
3660	ssid = wpa_config_get_network(wpa_s->conf, id);
3661	if (ssid == NULL) {
3662		wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: Could not find network "
3663			   "id=%d", id);
3664		return -1;
3665	}
3666
3667	value = wpa_config_get_no_key(ssid, name);
3668	if (value == NULL) {
3669		wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: Failed to get network "
3670			   "variable '%s'", name);
3671		return -1;
3672	}
3673
3674	res = os_strlcpy(buf, value, buflen);
3675	if (res >= buflen) {
3676		os_free(value);
3677		return -1;
3678	}
3679
3680	os_free(value);
3681
3682	return res;
3683}
3684
3685
3686static int wpa_supplicant_ctrl_iface_dup_network(
3687	struct wpa_supplicant *wpa_s, char *cmd,
3688	struct wpa_supplicant *dst_wpa_s)
3689{
3690	struct wpa_ssid *ssid_s, *ssid_d;
3691	char *name, *id, *value;
3692	int id_s, id_d, ret;
3693
3694	/* cmd: "<src network id> <dst network id> <variable name>" */
3695	id = os_strchr(cmd, ' ');
3696	if (id == NULL)
3697		return -1;
3698	*id++ = '\0';
3699
3700	name = os_strchr(id, ' ');
3701	if (name == NULL)
3702		return -1;
3703	*name++ = '\0';
3704
3705	id_s = atoi(cmd);
3706	id_d = atoi(id);
3707
3708	wpa_printf(MSG_DEBUG,
3709		   "CTRL_IFACE: DUP_NETWORK ifname=%s->%s id=%d->%d name='%s'",
3710		   wpa_s->ifname, dst_wpa_s->ifname, id_s, id_d, name);
3711
3712	ssid_s = wpa_config_get_network(wpa_s->conf, id_s);
3713	if (ssid_s == NULL) {
3714		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3715			   "network id=%d", id_s);
3716		return -1;
3717	}
3718
3719	ssid_d = wpa_config_get_network(dst_wpa_s->conf, id_d);
3720	if (ssid_d == NULL) {
3721		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3722			   "network id=%d", id_d);
3723		return -1;
3724	}
3725
3726	value = wpa_config_get(ssid_s, name);
3727	if (value == NULL) {
3728		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get network "
3729			   "variable '%s'", name);
3730		return -1;
3731	}
3732
3733	ret = wpa_supplicant_ctrl_iface_update_network(dst_wpa_s, ssid_d, name,
3734						       value);
3735
3736	os_free(value);
3737
3738	return ret;
3739}
3740
3741
3742static int wpa_supplicant_ctrl_iface_list_creds(struct wpa_supplicant *wpa_s,
3743						char *buf, size_t buflen)
3744{
3745	char *pos, *end;
3746	struct wpa_cred *cred;
3747	int ret;
3748
3749	pos = buf;
3750	end = buf + buflen;
3751	ret = os_snprintf(pos, end - pos,
3752			  "cred id / realm / username / domain / imsi\n");
3753	if (os_snprintf_error(end - pos, ret))
3754		return pos - buf;
3755	pos += ret;
3756
3757	cred = wpa_s->conf->cred;
3758	while (cred) {
3759		ret = os_snprintf(pos, end - pos, "%d\t%s\t%s\t%s\t%s\n",
3760				  cred->id, cred->realm ? cred->realm : "",
3761				  cred->username ? cred->username : "",
3762				  cred->domain ? cred->domain[0] : "",
3763				  cred->imsi ? cred->imsi : "");
3764		if (os_snprintf_error(end - pos, ret))
3765			return pos - buf;
3766		pos += ret;
3767
3768		cred = cred->next;
3769	}
3770
3771	return pos - buf;
3772}
3773
3774
3775static int wpa_supplicant_ctrl_iface_add_cred(struct wpa_supplicant *wpa_s,
3776					      char *buf, size_t buflen)
3777{
3778	struct wpa_cred *cred;
3779	int ret;
3780
3781	wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_CRED");
3782
3783	cred = wpa_config_add_cred(wpa_s->conf);
3784	if (cred == NULL)
3785		return -1;
3786
3787	wpa_msg(wpa_s, MSG_INFO, CRED_ADDED "%d", cred->id);
3788
3789	ret = os_snprintf(buf, buflen, "%d\n", cred->id);
3790	if (os_snprintf_error(buflen, ret))
3791		return -1;
3792	return ret;
3793}
3794
3795
3796static int wpa_supplicant_ctrl_iface_remove_cred(struct wpa_supplicant *wpa_s,
3797						 char *cmd)
3798{
3799	int id;
3800	struct wpa_cred *cred, *prev;
3801
3802	/* cmd: "<cred id>", "all", "sp_fqdn=<FQDN>", or
3803	 * "provisioning_sp=<FQDN> */
3804	if (os_strcmp(cmd, "all") == 0) {
3805		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED all");
3806		return wpas_remove_all_creds(wpa_s);
3807	}
3808
3809	if (os_strncmp(cmd, "sp_fqdn=", 8) == 0) {
3810		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED SP FQDN '%s'",
3811			   cmd + 8);
3812		cred = wpa_s->conf->cred;
3813		while (cred) {
3814			prev = cred;
3815			cred = cred->next;
3816			if (prev->domain) {
3817				size_t i;
3818				for (i = 0; i < prev->num_domain; i++) {
3819					if (os_strcmp(prev->domain[i], cmd + 8)
3820					    != 0)
3821						continue;
3822					wpas_remove_cred(wpa_s, prev);
3823					break;
3824				}
3825			}
3826		}
3827		return 0;
3828	}
3829
3830	if (os_strncmp(cmd, "provisioning_sp=", 16) == 0) {
3831		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED provisioning SP FQDN '%s'",
3832			   cmd + 16);
3833		cred = wpa_s->conf->cred;
3834		while (cred) {
3835			prev = cred;
3836			cred = cred->next;
3837			if (prev->provisioning_sp &&
3838			    os_strcmp(prev->provisioning_sp, cmd + 16) == 0)
3839				wpas_remove_cred(wpa_s, prev);
3840		}
3841		return 0;
3842	}
3843
3844	id = atoi(cmd);
3845	wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED id=%d", id);
3846
3847	cred = wpa_config_get_cred(wpa_s->conf, id);
3848	return wpas_remove_cred(wpa_s, cred);
3849}
3850
3851
3852static int wpa_supplicant_ctrl_iface_set_cred(struct wpa_supplicant *wpa_s,
3853					      char *cmd)
3854{
3855	int id;
3856	struct wpa_cred *cred;
3857	char *name, *value;
3858
3859	/* cmd: "<cred id> <variable name> <value>" */
3860	name = os_strchr(cmd, ' ');
3861	if (name == NULL)
3862		return -1;
3863	*name++ = '\0';
3864
3865	value = os_strchr(name, ' ');
3866	if (value == NULL)
3867		return -1;
3868	*value++ = '\0';
3869
3870	id = atoi(cmd);
3871	wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_CRED id=%d name='%s'",
3872		   id, name);
3873	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
3874			      (u8 *) value, os_strlen(value));
3875
3876	cred = wpa_config_get_cred(wpa_s->conf, id);
3877	if (cred == NULL) {
3878		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
3879			   id);
3880		return -1;
3881	}
3882
3883	if (wpa_config_set_cred(cred, name, value, 0) < 0) {
3884		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set cred "
3885			   "variable '%s'", name);
3886		return -1;
3887	}
3888
3889	wpa_msg(wpa_s, MSG_INFO, CRED_MODIFIED "%d %s", cred->id, name);
3890
3891	return 0;
3892}
3893
3894
3895static int wpa_supplicant_ctrl_iface_get_cred(struct wpa_supplicant *wpa_s,
3896					      char *cmd, char *buf,
3897					      size_t buflen)
3898{
3899	int id;
3900	size_t res;
3901	struct wpa_cred *cred;
3902	char *name, *value;
3903
3904	/* cmd: "<cred id> <variable name>" */
3905	name = os_strchr(cmd, ' ');
3906	if (name == NULL)
3907		return -1;
3908	*name++ = '\0';
3909
3910	id = atoi(cmd);
3911	wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CRED id=%d name='%s'",
3912		   id, name);
3913
3914	cred = wpa_config_get_cred(wpa_s->conf, id);
3915	if (cred == NULL) {
3916		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
3917			   id);
3918		return -1;
3919	}
3920
3921	value = wpa_config_get_cred_no_key(cred, name);
3922	if (value == NULL) {
3923		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get cred variable '%s'",
3924			   name);
3925		return -1;
3926	}
3927
3928	res = os_strlcpy(buf, value, buflen);
3929	if (res >= buflen) {
3930		os_free(value);
3931		return -1;
3932	}
3933
3934	os_free(value);
3935
3936	return res;
3937}
3938
3939
3940#ifndef CONFIG_NO_CONFIG_WRITE
3941static int wpa_supplicant_ctrl_iface_save_config(struct wpa_supplicant *wpa_s)
3942{
3943	int ret;
3944
3945	if (!wpa_s->conf->update_config) {
3946		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed "
3947			   "to update configuration (update_config=0)");
3948		return -1;
3949	}
3950
3951	ret = wpa_config_write(wpa_s->confname, wpa_s->conf);
3952	if (ret) {
3953		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to "
3954			   "update configuration");
3955	} else {
3956		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration"
3957			   " updated");
3958	}
3959
3960	return ret;
3961}
3962#endif /* CONFIG_NO_CONFIG_WRITE */
3963
3964
3965struct cipher_info {
3966	unsigned int capa;
3967	const char *name;
3968	int group_only;
3969};
3970
3971static const struct cipher_info ciphers[] = {
3972	{ WPA_DRIVER_CAPA_ENC_CCMP_256, "CCMP-256", 0 },
3973	{ WPA_DRIVER_CAPA_ENC_GCMP_256, "GCMP-256", 0 },
3974	{ WPA_DRIVER_CAPA_ENC_CCMP, "CCMP", 0 },
3975	{ WPA_DRIVER_CAPA_ENC_GCMP, "GCMP", 0 },
3976#ifndef CONFIG_NO_TKIP
3977	{ WPA_DRIVER_CAPA_ENC_TKIP, "TKIP", 0 },
3978#endif /* CONFIG_NO_TKIP */
3979	{ WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE, "NONE", 0 },
3980#ifdef CONFIG_WEP
3981	{ WPA_DRIVER_CAPA_ENC_WEP104, "WEP104", 1 },
3982	{ WPA_DRIVER_CAPA_ENC_WEP40, "WEP40", 1 }
3983#endif /* CONFIG_WEP */
3984};
3985
3986static const struct cipher_info ciphers_group_mgmt[] = {
3987	{ WPA_DRIVER_CAPA_ENC_BIP, "AES-128-CMAC", 1 },
3988	{ WPA_DRIVER_CAPA_ENC_BIP_GMAC_128, "BIP-GMAC-128", 1 },
3989	{ WPA_DRIVER_CAPA_ENC_BIP_GMAC_256, "BIP-GMAC-256", 1 },
3990	{ WPA_DRIVER_CAPA_ENC_BIP_CMAC_256, "BIP-CMAC-256", 1 },
3991};
3992
3993
3994static int ctrl_iface_get_capability_pairwise(int res, bool strict,
3995					      struct wpa_driver_capa *capa,
3996					      char *buf, size_t buflen)
3997{
3998	int ret;
3999	char *pos, *end;
4000	size_t len;
4001	unsigned int i;
4002
4003	pos = buf;
4004	end = pos + buflen;
4005
4006	if (res < 0) {
4007		if (strict)
4008			return 0;
4009#ifdef CONFIG_NO_TKIP
4010		len = os_strlcpy(buf, "CCMP NONE", buflen);
4011#else /* CONFIG_NO_TKIP */
4012		len = os_strlcpy(buf, "CCMP TKIP NONE", buflen);
4013#endif /* CONFIG_NO_TKIP */
4014		if (len >= buflen)
4015			return -1;
4016		return len;
4017	}
4018
4019	for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
4020		if (!ciphers[i].group_only && capa->enc & ciphers[i].capa) {
4021			ret = os_snprintf(pos, end - pos, "%s%s",
4022					  pos == buf ? "" : " ",
4023					  ciphers[i].name);
4024			if (os_snprintf_error(end - pos, ret))
4025				return pos - buf;
4026			pos += ret;
4027		}
4028	}
4029
4030	return pos - buf;
4031}
4032
4033
4034static int ctrl_iface_get_capability_group(int res, bool strict,
4035					   struct wpa_driver_capa *capa,
4036					   char *buf, size_t buflen)
4037{
4038	int ret;
4039	char *pos, *end;
4040	size_t len;
4041	unsigned int i;
4042
4043	pos = buf;
4044	end = pos + buflen;
4045
4046	if (res < 0) {
4047		if (strict)
4048			return 0;
4049#ifdef CONFIG_WEP
4050#ifdef CONFIG_NO_TKIP
4051		len = os_strlcpy(buf, "CCMP WEP104 WEP40", buflen);
4052#else /* CONFIG_NO_TKIP */
4053		len = os_strlcpy(buf, "CCMP TKIP WEP104 WEP40", buflen);
4054#endif /* CONFIG_NO_TKIP */
4055#else /* CONFIG_WEP */
4056#ifdef CONFIG_NO_TKIP
4057		len = os_strlcpy(buf, "CCMP", buflen);
4058#else /* CONFIG_NO_TKIP */
4059		len = os_strlcpy(buf, "CCMP TKIP", buflen);
4060#endif /* CONFIG_NO_TKIP */
4061#endif /* CONFIG_WEP */
4062		if (len >= buflen)
4063			return -1;
4064		return len;
4065	}
4066
4067	for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
4068		if (capa->enc & ciphers[i].capa) {
4069			ret = os_snprintf(pos, end - pos, "%s%s",
4070					  pos == buf ? "" : " ",
4071					  ciphers[i].name);
4072			if (os_snprintf_error(end - pos, ret))
4073				return pos - buf;
4074			pos += ret;
4075		}
4076	}
4077
4078	return pos - buf;
4079}
4080
4081
4082static int ctrl_iface_get_capability_group_mgmt(int res, bool strict,
4083						struct wpa_driver_capa *capa,
4084						char *buf, size_t buflen)
4085{
4086	int ret;
4087	char *pos, *end;
4088	unsigned int i;
4089
4090	pos = buf;
4091	end = pos + buflen;
4092
4093	if (res < 0)
4094		return 0;
4095
4096	for (i = 0; i < ARRAY_SIZE(ciphers_group_mgmt); i++) {
4097		if (capa->enc & ciphers_group_mgmt[i].capa) {
4098			ret = os_snprintf(pos, end - pos, "%s%s",
4099					  pos == buf ? "" : " ",
4100					  ciphers_group_mgmt[i].name);
4101			if (os_snprintf_error(end - pos, ret))
4102				return pos - buf;
4103			pos += ret;
4104		}
4105	}
4106
4107	return pos - buf;
4108}
4109
4110
4111static int iftype_str_to_index(const char *iftype_str)
4112{
4113	if (!iftype_str)
4114		return WPA_IF_MAX;
4115
4116	if (os_strcmp(iftype_str, "STATION") == 0)
4117		return WPA_IF_STATION;
4118
4119	if (os_strcmp(iftype_str, "AP_VLAN") == 0)
4120		return WPA_IF_AP_VLAN;
4121
4122	if (os_strcmp(iftype_str, "AP") == 0)
4123		return WPA_IF_AP_BSS;
4124
4125	if (os_strcmp(iftype_str, "P2P_GO") == 0)
4126		return WPA_IF_P2P_GO;
4127
4128	if (os_strcmp(iftype_str, "P2P_CLIENT") == 0)
4129		return WPA_IF_P2P_CLIENT;
4130
4131	if (os_strcmp(iftype_str, "P2P_DEVICE") == 0)
4132		return WPA_IF_P2P_DEVICE;
4133
4134	if (os_strcmp(iftype_str, "MESH") == 0)
4135		return WPA_IF_MESH;
4136
4137	if (os_strcmp(iftype_str, "IBSS") == 0)
4138		return WPA_IF_IBSS;
4139
4140	if (os_strcmp(iftype_str, "NAN") == 0)
4141		return WPA_IF_NAN;
4142
4143	return WPA_IF_MAX;
4144}
4145
4146
4147static int ctrl_iface_get_capability_key_mgmt(int res, bool strict,
4148					      struct wpa_driver_capa *capa,
4149					      const char *iftype_str,
4150					      char *buf, size_t buflen)
4151{
4152	int ret;
4153	unsigned int key_mgmt;
4154	char *pos, *end;
4155	size_t len;
4156
4157	pos = buf;
4158	end = pos + buflen;
4159
4160	if (res < 0) {
4161		if (strict)
4162			return 0;
4163		len = os_strlcpy(buf, "WPA-PSK WPA-EAP IEEE8021X WPA-NONE "
4164				 "NONE", buflen);
4165		if (len >= buflen)
4166			return -1;
4167		return len;
4168	}
4169
4170	if (iftype_str) {
4171		enum wpa_driver_if_type iftype;
4172
4173		iftype = iftype_str_to_index(iftype_str);
4174		if (iftype == WPA_IF_MAX)
4175			return -1;
4176		key_mgmt = capa->key_mgmt_iftype[iftype];
4177	} else {
4178		key_mgmt = capa->key_mgmt;
4179	}
4180
4181	ret = os_snprintf(pos, end - pos, "NONE IEEE8021X");
4182	if (os_snprintf_error(end - pos, ret))
4183		return pos - buf;
4184	pos += ret;
4185
4186	if (key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
4187			WPA_DRIVER_CAPA_KEY_MGMT_WPA2)) {
4188		ret = os_snprintf(pos, end - pos, " WPA-EAP");
4189		if (os_snprintf_error(end - pos, ret))
4190			return pos - buf;
4191		pos += ret;
4192	}
4193
4194	if (key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
4195			WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
4196		ret = os_snprintf(pos, end - pos, " WPA-PSK");
4197		if (os_snprintf_error(end - pos, ret))
4198			return pos - buf;
4199		pos += ret;
4200	}
4201
4202	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE) {
4203		ret = os_snprintf(pos, end - pos, " WPA-NONE");
4204		if (os_snprintf_error(end - pos, ret))
4205			return pos - buf;
4206		pos += ret;
4207	}
4208
4209	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WAPI_PSK) {
4210		ret = os_snprintf(pos, end - pos, " WAPI-PSK");
4211		if (os_snprintf_error(end - pos, ret))
4212			return pos - buf;
4213		pos += ret;
4214	}
4215
4216	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_TPK_HANDSHAKE) {
4217		ret = os_snprintf(pos, end - pos, " TPK-HANDSHAKE");
4218		if (os_snprintf_error(end - pos, ret))
4219			return pos - buf;
4220		pos += ret;
4221	}
4222
4223	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_CCKM) {
4224		ret = os_snprintf(pos, end - pos, " CCKM");
4225		if (os_snprintf_error(end - pos, ret))
4226			return pos - buf;
4227		pos += ret;
4228	}
4229
4230#ifdef CONFIG_SUITEB
4231	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B) {
4232		ret = os_snprintf(pos, end - pos, " WPA-EAP-SUITE-B");
4233		if (os_snprintf_error(end - pos, ret))
4234			return pos - buf;
4235		pos += ret;
4236	}
4237#endif /* CONFIG_SUITEB */
4238#ifdef CONFIG_SUITEB192
4239	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B_192) {
4240		ret = os_snprintf(pos, end - pos, " WPA-EAP-SUITE-B-192");
4241		if (os_snprintf_error(end - pos, ret))
4242			return pos - buf;
4243		pos += ret;
4244	}
4245#endif /* CONFIG_SUITEB192 */
4246#ifdef CONFIG_OWE
4247	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_OWE) {
4248		ret = os_snprintf(pos, end - pos, " OWE");
4249		if (os_snprintf_error(end - pos, ret))
4250			return pos - buf;
4251		pos += ret;
4252	}
4253#endif /* CONFIG_OWE */
4254#ifdef CONFIG_DPP
4255	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_DPP) {
4256		ret = os_snprintf(pos, end - pos, " DPP");
4257		if (os_snprintf_error(end - pos, ret))
4258			return pos - buf;
4259		pos += ret;
4260	}
4261#endif /* CONFIG_DPP */
4262#ifdef CONFIG_FILS
4263	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA256) {
4264		ret = os_snprintf(pos, end - pos, " FILS-SHA256");
4265		if (os_snprintf_error(end - pos, ret))
4266			return pos - buf;
4267		pos += ret;
4268	}
4269	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA384) {
4270		ret = os_snprintf(pos, end - pos, " FILS-SHA384");
4271		if (os_snprintf_error(end - pos, ret))
4272			return pos - buf;
4273		pos += ret;
4274	}
4275#ifdef CONFIG_IEEE80211R
4276	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT_FILS_SHA256) {
4277		ret = os_snprintf(pos, end - pos, " FT-FILS-SHA256");
4278		if (os_snprintf_error(end - pos, ret))
4279			return pos - buf;
4280		pos += ret;
4281	}
4282	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT_FILS_SHA384) {
4283		ret = os_snprintf(pos, end - pos, " FT-FILS-SHA384");
4284		if (os_snprintf_error(end - pos, ret))
4285			return pos - buf;
4286		pos += ret;
4287	}
4288#endif /* CONFIG_IEEE80211R */
4289#endif /* CONFIG_FILS */
4290#ifdef CONFIG_IEEE80211R
4291	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK) {
4292		ret = os_snprintf(pos, end - pos, " FT-PSK");
4293		if (os_snprintf_error(end - pos, ret))
4294			return pos - buf;
4295		pos += ret;
4296	}
4297	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT) {
4298		ret = os_snprintf(pos, end - pos, " FT-EAP");
4299		if (os_snprintf_error(end - pos, ret))
4300			return pos - buf;
4301		pos += ret;
4302	}
4303#ifdef CONFIG_SAE
4304	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT_SAE) {
4305		ret = os_snprintf(pos, end - pos, " FT-SAE");
4306		if (os_snprintf_error(end - pos, ret))
4307			return pos - buf;
4308		pos += ret;
4309	}
4310#endif /* CONFIG_SAE */
4311#ifdef CONFIG_SHA384
4312	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT_802_1X_SHA384) {
4313		ret = os_snprintf(pos, end - pos, " FT-EAP-SHA384");
4314		if (os_snprintf_error(end - pos, ret))
4315			return pos - buf;
4316		pos += ret;
4317	}
4318#endif /* CONFIG_SHA384 */
4319#endif /* CONFIG_IEEE80211R */
4320#ifdef CONFIG_SAE
4321	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SAE) {
4322		ret = os_snprintf(pos, end - pos, " SAE");
4323		if (os_snprintf_error(end - pos, ret))
4324			return pos - buf;
4325		pos += ret;
4326	}
4327#endif /* CONFIG_SAE */
4328#ifdef CONFIG_SHA256
4329	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_802_1X_SHA256) {
4330		ret = os_snprintf(pos, end - pos, " WPA-EAP-SHA256");
4331		if (os_snprintf_error(end - pos, ret))
4332			return pos - buf;
4333		pos += ret;
4334	}
4335
4336	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_PSK_SHA256) {
4337		ret = os_snprintf(pos, end - pos, " WPA-PSK-SHA256");
4338		if (os_snprintf_error(end - pos, ret))
4339			return pos - buf;
4340		pos += ret;
4341	}
4342#endif /* CONFIG_SHA256 */
4343#ifdef CONFIG_HS20
4344	if (key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_OSEN) {
4345		ret = os_snprintf(pos, end - pos, " OSEN");
4346		if (os_snprintf_error(end - pos, ret))
4347			return pos - buf;
4348		pos += ret;
4349	}
4350#endif /* CONFIG_HS20 */
4351
4352	return pos - buf;
4353}
4354
4355
4356static int ctrl_iface_get_capability_proto(int res, bool strict,
4357					   struct wpa_driver_capa *capa,
4358					   char *buf, size_t buflen)
4359{
4360	int ret;
4361	char *pos, *end;
4362	size_t len;
4363
4364	pos = buf;
4365	end = pos + buflen;
4366
4367	if (res < 0) {
4368		if (strict)
4369			return 0;
4370		len = os_strlcpy(buf, "RSN WPA", buflen);
4371		if (len >= buflen)
4372			return -1;
4373		return len;
4374	}
4375
4376	if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
4377			      WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
4378		ret = os_snprintf(pos, end - pos, "%sRSN",
4379				  pos == buf ? "" : " ");
4380		if (os_snprintf_error(end - pos, ret))
4381			return pos - buf;
4382		pos += ret;
4383	}
4384
4385	if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
4386			      WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK)) {
4387		ret = os_snprintf(pos, end - pos, "%sWPA",
4388				  pos == buf ? "" : " ");
4389		if (os_snprintf_error(end - pos, ret))
4390			return pos - buf;
4391		pos += ret;
4392	}
4393
4394	return pos - buf;
4395}
4396
4397
4398static int ctrl_iface_get_capability_auth_alg(struct wpa_supplicant *wpa_s,
4399					      int res, bool strict,
4400					      struct wpa_driver_capa *capa,
4401					      char *buf, size_t buflen)
4402{
4403	int ret;
4404	char *pos, *end;
4405	size_t len;
4406
4407	pos = buf;
4408	end = pos + buflen;
4409
4410	if (res < 0) {
4411		if (strict)
4412			return 0;
4413		len = os_strlcpy(buf, "OPEN SHARED LEAP", buflen);
4414		if (len >= buflen)
4415			return -1;
4416		return len;
4417	}
4418
4419	if (capa->auth & (WPA_DRIVER_AUTH_OPEN)) {
4420		ret = os_snprintf(pos, end - pos, "%sOPEN",
4421				  pos == buf ? "" : " ");
4422		if (os_snprintf_error(end - pos, ret))
4423			return pos - buf;
4424		pos += ret;
4425	}
4426
4427	if (capa->auth & (WPA_DRIVER_AUTH_SHARED)) {
4428		ret = os_snprintf(pos, end - pos, "%sSHARED",
4429				  pos == buf ? "" : " ");
4430		if (os_snprintf_error(end - pos, ret))
4431			return pos - buf;
4432		pos += ret;
4433	}
4434
4435	if (capa->auth & (WPA_DRIVER_AUTH_LEAP)) {
4436		ret = os_snprintf(pos, end - pos, "%sLEAP",
4437				  pos == buf ? "" : " ");
4438		if (os_snprintf_error(end - pos, ret))
4439			return pos - buf;
4440		pos += ret;
4441	}
4442
4443#ifdef CONFIG_SAE
4444	if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE) {
4445		ret = os_snprintf(pos, end - pos, "%sSAE",
4446				  pos == buf ? "" : " ");
4447		if (os_snprintf_error(end - pos, ret))
4448			return pos - buf;
4449		pos += ret;
4450	}
4451#endif /* CONFIG_SAE */
4452
4453#ifdef CONFIG_FILS
4454	if (wpa_is_fils_supported(wpa_s)) {
4455		ret = os_snprintf(pos, end - pos, "%sFILS_SK_WITHOUT_PFS",
4456				  pos == buf ? "" : " ");
4457		if (os_snprintf_error(end - pos, ret))
4458			return pos - buf;
4459		pos += ret;
4460	}
4461
4462#ifdef CONFIG_FILS_SK_PFS
4463	if (wpa_is_fils_sk_pfs_supported(wpa_s)) {
4464		ret = os_snprintf(pos, end - pos, "%sFILS_SK_WITH_PFS",
4465				  pos == buf ? "" : " ");
4466		if (os_snprintf_error(end - pos, ret))
4467			return pos - buf;
4468		pos += ret;
4469	}
4470#endif /* CONFIG_FILS_SK_PFS */
4471#endif /* CONFIG_FILS */
4472
4473#ifdef CONFIG_PASN
4474	ret = os_snprintf(pos, end - pos, "%sPASN",
4475			  pos == buf ? "" : " ");
4476	if (os_snprintf_error(end - pos, ret))
4477		return pos - buf;
4478	pos += ret;
4479
4480#endif /* CONFIG_PASN */
4481
4482	return pos - buf;
4483}
4484
4485
4486static int ctrl_iface_get_capability_modes(int res, bool strict,
4487					   struct wpa_driver_capa *capa,
4488					   char *buf, size_t buflen)
4489{
4490	int ret;
4491	char *pos, *end;
4492	size_t len;
4493
4494	pos = buf;
4495	end = pos + buflen;
4496
4497	if (res < 0) {
4498		if (strict)
4499			return 0;
4500		len = os_strlcpy(buf, "IBSS AP", buflen);
4501		if (len >= buflen)
4502			return -1;
4503		return len;
4504	}
4505
4506	if (capa->flags & WPA_DRIVER_FLAGS_IBSS) {
4507		ret = os_snprintf(pos, end - pos, "%sIBSS",
4508				  pos == buf ? "" : " ");
4509		if (os_snprintf_error(end - pos, ret))
4510			return pos - buf;
4511		pos += ret;
4512	}
4513
4514	if (capa->flags & WPA_DRIVER_FLAGS_AP) {
4515		ret = os_snprintf(pos, end - pos, "%sAP",
4516				  pos == buf ? "" : " ");
4517		if (os_snprintf_error(end - pos, ret))
4518			return pos - buf;
4519		pos += ret;
4520	}
4521
4522#ifdef CONFIG_MESH
4523	if (capa->flags & WPA_DRIVER_FLAGS_MESH) {
4524		ret = os_snprintf(pos, end - pos, "%sMESH",
4525				  pos == buf ? "" : " ");
4526		if (os_snprintf_error(end - pos, ret))
4527			return pos - buf;
4528		pos += ret;
4529	}
4530#endif /* CONFIG_MESH */
4531
4532	return pos - buf;
4533}
4534
4535
4536static int ctrl_iface_get_capability_channels(struct wpa_supplicant *wpa_s,
4537					      char *buf, size_t buflen)
4538{
4539	struct hostapd_channel_data *chnl;
4540	int ret, i, j;
4541	char *pos, *end, *hmode;
4542
4543	pos = buf;
4544	end = pos + buflen;
4545
4546	for (j = 0; j < wpa_s->hw.num_modes; j++) {
4547		switch (wpa_s->hw.modes[j].mode) {
4548		case HOSTAPD_MODE_IEEE80211B:
4549			hmode = "B";
4550			break;
4551		case HOSTAPD_MODE_IEEE80211G:
4552			hmode = "G";
4553			break;
4554		case HOSTAPD_MODE_IEEE80211A:
4555			hmode = "A";
4556			break;
4557		case HOSTAPD_MODE_IEEE80211AD:
4558			hmode = "AD";
4559			break;
4560		default:
4561			continue;
4562		}
4563		ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:", hmode);
4564		if (os_snprintf_error(end - pos, ret))
4565			return pos - buf;
4566		pos += ret;
4567		chnl = wpa_s->hw.modes[j].channels;
4568		for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
4569			if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
4570				continue;
4571			ret = os_snprintf(pos, end - pos, " %d", chnl[i].chan);
4572			if (os_snprintf_error(end - pos, ret))
4573				return pos - buf;
4574			pos += ret;
4575		}
4576		ret = os_snprintf(pos, end - pos, "\n");
4577		if (os_snprintf_error(end - pos, ret))
4578			return pos - buf;
4579		pos += ret;
4580	}
4581
4582	return pos - buf;
4583}
4584
4585
4586static int ctrl_iface_get_capability_freq(struct wpa_supplicant *wpa_s,
4587					  char *buf, size_t buflen)
4588{
4589	struct hostapd_channel_data *chnl;
4590	int ret, i, j;
4591	char *pos, *end, *hmode;
4592
4593	pos = buf;
4594	end = pos + buflen;
4595
4596	for (j = 0; j < wpa_s->hw.num_modes; j++) {
4597		switch (wpa_s->hw.modes[j].mode) {
4598		case HOSTAPD_MODE_IEEE80211B:
4599			hmode = "B";
4600			break;
4601		case HOSTAPD_MODE_IEEE80211G:
4602			hmode = "G";
4603			break;
4604		case HOSTAPD_MODE_IEEE80211A:
4605			hmode = "A";
4606			break;
4607		case HOSTAPD_MODE_IEEE80211AD:
4608			hmode = "AD";
4609			break;
4610		default:
4611			continue;
4612		}
4613		ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:\n",
4614				  hmode);
4615		if (os_snprintf_error(end - pos, ret))
4616			return pos - buf;
4617		pos += ret;
4618		chnl = wpa_s->hw.modes[j].channels;
4619		for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
4620			if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
4621				continue;
4622			ret = os_snprintf(pos, end - pos, " %d = %d MHz%s%s\n",
4623					  chnl[i].chan, chnl[i].freq,
4624					  chnl[i].flag & HOSTAPD_CHAN_NO_IR ?
4625					  " (NO_IR)" : "",
4626					  chnl[i].flag & HOSTAPD_CHAN_RADAR ?
4627					  " (DFS)" : "");
4628
4629			if (os_snprintf_error(end - pos, ret))
4630				return pos - buf;
4631			pos += ret;
4632		}
4633		ret = os_snprintf(pos, end - pos, "\n");
4634		if (os_snprintf_error(end - pos, ret))
4635			return pos - buf;
4636		pos += ret;
4637	}
4638
4639	return pos - buf;
4640}
4641
4642
4643static int wpa_supplicant_ctrl_iface_get_capability(
4644	struct wpa_supplicant *wpa_s, const char *_field, char *buf,
4645	size_t buflen)
4646{
4647	struct wpa_driver_capa capa;
4648	int res;
4649	char *next_param, *curr_param, *iftype = NULL;
4650	bool strict = false;
4651	char field[50];
4652	size_t len;
4653
4654	/* Determine whether or not strict checking was requested */
4655	len = os_strlcpy(field, _field, sizeof(field));
4656	if (len >= sizeof(field))
4657		return -1;
4658
4659	next_param = os_strchr(field, ' ');
4660	while (next_param) {
4661		*next_param++ = '\0';
4662		curr_param = next_param;
4663		next_param = os_strchr(next_param, ' ');
4664
4665		if (next_param)
4666			*next_param = '\0';
4667
4668		if (os_strcmp(curr_param, "strict") == 0)
4669			strict = true;
4670		else if (os_strncmp(curr_param, "iftype=", 7) == 0)
4671			iftype = curr_param + 7;
4672		else
4673			return -1;
4674	}
4675
4676	wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CAPABILITY '%s'%s%s%s",
4677		   field, iftype ? " iftype=" : "", iftype ? iftype : "",
4678		   strict ? " strict" : "");
4679
4680	if (os_strcmp(field, "eap") == 0) {
4681		return eap_get_names(buf, buflen);
4682	}
4683
4684	res = wpa_drv_get_capa(wpa_s, &capa);
4685
4686	if (os_strcmp(field, "pairwise") == 0)
4687		return ctrl_iface_get_capability_pairwise(res, strict, &capa,
4688							  buf, buflen);
4689
4690	if (os_strcmp(field, "group") == 0)
4691		return ctrl_iface_get_capability_group(res, strict, &capa,
4692						       buf, buflen);
4693
4694	if (os_strcmp(field, "group_mgmt") == 0)
4695		return ctrl_iface_get_capability_group_mgmt(res, strict, &capa,
4696							    buf, buflen);
4697
4698	if (os_strcmp(field, "key_mgmt") == 0)
4699		return ctrl_iface_get_capability_key_mgmt(res, strict, &capa,
4700							  iftype, buf, buflen);
4701
4702	if (os_strcmp(field, "proto") == 0)
4703		return ctrl_iface_get_capability_proto(res, strict, &capa,
4704						       buf, buflen);
4705
4706	if (os_strcmp(field, "auth_alg") == 0)
4707		return ctrl_iface_get_capability_auth_alg(wpa_s, res, strict,
4708							  &capa, buf, buflen);
4709
4710	if (os_strcmp(field, "modes") == 0)
4711		return ctrl_iface_get_capability_modes(res, strict, &capa,
4712						       buf, buflen);
4713
4714	if (os_strcmp(field, "channels") == 0)
4715		return ctrl_iface_get_capability_channels(wpa_s, buf, buflen);
4716
4717	if (os_strcmp(field, "freq") == 0)
4718		return ctrl_iface_get_capability_freq(wpa_s, buf, buflen);
4719
4720#ifdef CONFIG_TDLS
4721	if (os_strcmp(field, "tdls") == 0)
4722		return ctrl_iface_get_capability_tdls(wpa_s, buf, buflen);
4723#endif /* CONFIG_TDLS */
4724
4725#ifdef CONFIG_ERP
4726	if (os_strcmp(field, "erp") == 0) {
4727		res = os_snprintf(buf, buflen, "ERP");
4728		if (os_snprintf_error(buflen, res))
4729			return -1;
4730		return res;
4731	}
4732#endif /* CONFIG_EPR */
4733
4734#ifdef CONFIG_FIPS
4735	if (os_strcmp(field, "fips") == 0) {
4736		res = os_snprintf(buf, buflen, "FIPS");
4737		if (os_snprintf_error(buflen, res))
4738			return -1;
4739		return res;
4740	}
4741#endif /* CONFIG_FIPS */
4742
4743#ifdef CONFIG_ACS
4744	if (os_strcmp(field, "acs") == 0) {
4745		res = os_snprintf(buf, buflen, "ACS");
4746		if (os_snprintf_error(buflen, res))
4747			return -1;
4748		return res;
4749	}
4750#endif /* CONFIG_ACS */
4751
4752#ifdef CONFIG_FILS
4753	if (os_strcmp(field, "fils") == 0) {
4754#ifdef CONFIG_FILS_SK_PFS
4755		if (wpa_is_fils_supported(wpa_s) &&
4756		    wpa_is_fils_sk_pfs_supported(wpa_s)) {
4757			res = os_snprintf(buf, buflen, "FILS FILS-SK-PFS");
4758			if (os_snprintf_error(buflen, res))
4759				return -1;
4760			return res;
4761		}
4762#endif /* CONFIG_FILS_SK_PFS */
4763
4764		if (wpa_is_fils_supported(wpa_s)) {
4765			res = os_snprintf(buf, buflen, "FILS");
4766			if (os_snprintf_error(buflen, res))
4767				return -1;
4768			return res;
4769		}
4770	}
4771#endif /* CONFIG_FILS */
4772
4773	if (os_strcmp(field, "multibss") == 0 && wpa_s->multi_bss_support) {
4774		res = os_snprintf(buf, buflen, "MULTIBSS-STA");
4775		if (os_snprintf_error(buflen, res))
4776			return -1;
4777		return res;
4778	}
4779
4780#ifdef CONFIG_DPP
4781	if (os_strcmp(field, "dpp") == 0) {
4782#ifdef CONFIG_DPP3
4783		res = os_snprintf(buf, buflen, "DPP=3");
4784#elif defined(CONFIG_DPP2)
4785		res = os_snprintf(buf, buflen, "DPP=2");
4786#else /* CONFIG_DPP2 */
4787		res = os_snprintf(buf, buflen, "DPP=1");
4788#endif /* CONFIG_DPP2 */
4789		if (os_snprintf_error(buflen, res))
4790			return -1;
4791		return res;
4792	}
4793#endif /* CONFIG_DPP */
4794
4795#ifdef CONFIG_SAE
4796	if (os_strcmp(field, "sae") == 0 &&
4797	    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE)) {
4798#ifdef CONFIG_SAE_PK
4799		res = os_snprintf(buf, buflen, "H2E PK");
4800#else /* CONFIG_SAE_PK */
4801		res = os_snprintf(buf, buflen, "H2E");
4802#endif /* CONFIG_SAE_PK */
4803		if (os_snprintf_error(buflen, res))
4804			return -1;
4805		return res;
4806	}
4807#endif /* CONFIG_SAE */
4808
4809#ifdef CONFIG_OCV
4810	if (os_strcmp(field, "ocv") == 0) {
4811		if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
4812		    (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_OCV))
4813			res = os_snprintf(buf, buflen, "supported");
4814		else
4815			res = os_snprintf(buf, buflen, "not supported");
4816		if (os_snprintf_error(buflen, res))
4817			return -1;
4818		return res;
4819	}
4820#endif /* CONFIG_OCV */
4821
4822	if (os_strcmp(field, "beacon_prot") == 0) {
4823		if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_BEACON_PROTECTION) ||
4824		    (wpa_s->drv_flags2 &
4825		     WPA_DRIVER_FLAGS2_BEACON_PROTECTION_CLIENT))
4826			res = os_snprintf(buf, buflen, "supported");
4827		else
4828			res = os_snprintf(buf, buflen, "not supported");
4829		if (os_snprintf_error(buflen, res))
4830			return -1;
4831		return res;
4832	}
4833
4834	wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown GET_CAPABILITY field '%s'",
4835		   field);
4836
4837	return -1;
4838}
4839
4840
4841#ifdef CONFIG_INTERWORKING
4842static char * anqp_add_hex(char *pos, char *end, const char *title,
4843			   struct wpabuf *data)
4844{
4845	char *start = pos;
4846	size_t i;
4847	int ret;
4848	const u8 *d;
4849
4850	if (data == NULL)
4851		return start;
4852
4853	ret = os_snprintf(pos, end - pos, "%s=", title);
4854	if (os_snprintf_error(end - pos, ret))
4855		return start;
4856	pos += ret;
4857
4858	d = wpabuf_head_u8(data);
4859	for (i = 0; i < wpabuf_len(data); i++) {
4860		ret = os_snprintf(pos, end - pos, "%02x", *d++);
4861		if (os_snprintf_error(end - pos, ret))
4862			return start;
4863		pos += ret;
4864	}
4865
4866	ret = os_snprintf(pos, end - pos, "\n");
4867	if (os_snprintf_error(end - pos, ret))
4868		return start;
4869	pos += ret;
4870
4871	return pos;
4872}
4873#endif /* CONFIG_INTERWORKING */
4874
4875
4876#ifdef CONFIG_FILS
4877static int print_fils_indication(struct wpa_bss *bss, char *pos, char *end)
4878{
4879	char *start = pos;
4880	const u8 *ie, *ie_end;
4881	u16 info, realms;
4882	int ret;
4883
4884	ie = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
4885	if (!ie)
4886		return 0;
4887	ie_end = ie + 2 + ie[1];
4888	ie += 2;
4889	if (ie_end - ie < 2)
4890		return -1;
4891
4892	info = WPA_GET_LE16(ie);
4893	ie += 2;
4894	ret = os_snprintf(pos, end - pos, "fils_info=%04x\n", info);
4895	if (os_snprintf_error(end - pos, ret))
4896		return 0;
4897	pos += ret;
4898
4899	if (info & BIT(7)) {
4900		/* Cache Identifier Included */
4901		if (ie_end - ie < 2)
4902			return -1;
4903		ret = os_snprintf(pos, end - pos, "fils_cache_id=%02x%02x\n",
4904				  ie[0], ie[1]);
4905		if (os_snprintf_error(end - pos, ret))
4906			return 0;
4907		pos += ret;
4908		ie += 2;
4909	}
4910
4911	if (info & BIT(8)) {
4912		/* HESSID Included */
4913		if (ie_end - ie < ETH_ALEN)
4914			return -1;
4915		ret = os_snprintf(pos, end - pos, "fils_hessid=" MACSTR "\n",
4916				  MAC2STR(ie));
4917		if (os_snprintf_error(end - pos, ret))
4918			return 0;
4919		pos += ret;
4920		ie += ETH_ALEN;
4921	}
4922
4923	realms = (info & (BIT(3) | BIT(4) | BIT(5))) >> 3;
4924	if (realms) {
4925		if (ie_end - ie < realms * 2)
4926			return -1;
4927		ret = os_snprintf(pos, end - pos, "fils_realms=");
4928		if (os_snprintf_error(end - pos, ret))
4929			return 0;
4930		pos += ret;
4931
4932		ret = wpa_snprintf_hex(pos, end - pos, ie, realms * 2);
4933		if (ret <= 0)
4934			return 0;
4935		pos += ret;
4936		ie += realms * 2;
4937		ret = os_snprintf(pos, end - pos, "\n");
4938		if (os_snprintf_error(end - pos, ret))
4939			return 0;
4940		pos += ret;
4941	}
4942
4943	return pos - start;
4944}
4945#endif /* CONFIG_FILS */
4946
4947
4948static int print_bss_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
4949			  unsigned long mask, char *buf, size_t buflen)
4950{
4951	size_t i;
4952	int ret;
4953	char *pos, *end;
4954	const u8 *ie, *ie2, *osen_ie, *mesh, *owe, *rsnxe;
4955
4956	pos = buf;
4957	end = buf + buflen;
4958
4959	if (mask & WPA_BSS_MASK_ID) {
4960		ret = os_snprintf(pos, end - pos, "id=%u\n", bss->id);
4961		if (os_snprintf_error(end - pos, ret))
4962			return 0;
4963		pos += ret;
4964	}
4965
4966	if (mask & WPA_BSS_MASK_BSSID) {
4967		ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
4968				  MAC2STR(bss->bssid));
4969		if (os_snprintf_error(end - pos, ret))
4970			return 0;
4971		pos += ret;
4972	}
4973
4974	if (mask & WPA_BSS_MASK_FREQ) {
4975		ret = os_snprintf(pos, end - pos, "freq=%d\n", bss->freq);
4976		if (os_snprintf_error(end - pos, ret))
4977			return 0;
4978		pos += ret;
4979	}
4980
4981	if (mask & WPA_BSS_MASK_BEACON_INT) {
4982		ret = os_snprintf(pos, end - pos, "beacon_int=%d\n",
4983				  bss->beacon_int);
4984		if (os_snprintf_error(end - pos, ret))
4985			return 0;
4986		pos += ret;
4987	}
4988
4989	if (mask & WPA_BSS_MASK_CAPABILITIES) {
4990		ret = os_snprintf(pos, end - pos, "capabilities=0x%04x\n",
4991				  bss->caps);
4992		if (os_snprintf_error(end - pos, ret))
4993			return 0;
4994		pos += ret;
4995	}
4996
4997	if (mask & WPA_BSS_MASK_QUAL) {
4998		ret = os_snprintf(pos, end - pos, "qual=%d\n", bss->qual);
4999		if (os_snprintf_error(end - pos, ret))
5000			return 0;
5001		pos += ret;
5002	}
5003
5004	if (mask & WPA_BSS_MASK_NOISE) {
5005		ret = os_snprintf(pos, end - pos, "noise=%d\n", bss->noise);
5006		if (os_snprintf_error(end - pos, ret))
5007			return 0;
5008		pos += ret;
5009	}
5010
5011	if (mask & WPA_BSS_MASK_LEVEL) {
5012		ret = os_snprintf(pos, end - pos, "level=%d\n", bss->level);
5013		if (os_snprintf_error(end - pos, ret))
5014			return 0;
5015		pos += ret;
5016	}
5017
5018	if (mask & WPA_BSS_MASK_TSF) {
5019		ret = os_snprintf(pos, end - pos, "tsf=%016llu\n",
5020				  (unsigned long long) bss->tsf);
5021		if (os_snprintf_error(end - pos, ret))
5022			return 0;
5023		pos += ret;
5024	}
5025
5026	if (mask & WPA_BSS_MASK_AGE) {
5027		struct os_reltime now;
5028
5029		os_get_reltime(&now);
5030		ret = os_snprintf(pos, end - pos, "age=%d\n",
5031				  (int) (now.sec - bss->last_update.sec));
5032		if (os_snprintf_error(end - pos, ret))
5033			return 0;
5034		pos += ret;
5035	}
5036
5037	if (mask & WPA_BSS_MASK_IE) {
5038		ret = os_snprintf(pos, end - pos, "ie=");
5039		if (os_snprintf_error(end - pos, ret))
5040			return 0;
5041		pos += ret;
5042
5043		ie = wpa_bss_ie_ptr(bss);
5044		for (i = 0; i < bss->ie_len; i++) {
5045			ret = os_snprintf(pos, end - pos, "%02x", *ie++);
5046			if (os_snprintf_error(end - pos, ret))
5047				return 0;
5048			pos += ret;
5049		}
5050
5051		ret = os_snprintf(pos, end - pos, "\n");
5052		if (os_snprintf_error(end - pos, ret))
5053			return 0;
5054		pos += ret;
5055	}
5056
5057	if (mask & WPA_BSS_MASK_FLAGS) {
5058		ret = os_snprintf(pos, end - pos, "flags=");
5059		if (os_snprintf_error(end - pos, ret))
5060			return 0;
5061		pos += ret;
5062
5063		mesh = wpa_bss_get_ie(bss, WLAN_EID_MESH_ID);
5064
5065		ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
5066		if (ie)
5067			pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie,
5068						    2 + ie[1]);
5069		ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
5070		if (ie2)
5071			pos = wpa_supplicant_ie_txt(pos, end,
5072						    mesh ? "RSN" : "WPA2", ie2,
5073						    2 + ie2[1]);
5074		rsnxe = wpa_bss_get_ie(bss, WLAN_EID_RSNX);
5075		if (ieee802_11_rsnx_capab(rsnxe, WLAN_RSNX_CAPAB_SAE_H2E)) {
5076			ret = os_snprintf(pos, end - pos, "[SAE-H2E]");
5077			if (os_snprintf_error(end - pos, ret))
5078				return -1;
5079			pos += ret;
5080		}
5081		if (ieee802_11_rsnx_capab(rsnxe, WLAN_RSNX_CAPAB_SAE_PK)) {
5082			ret = os_snprintf(pos, end - pos, "[SAE-PK]");
5083			if (os_snprintf_error(end - pos, ret))
5084				return -1;
5085			pos += ret;
5086		}
5087		osen_ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
5088		if (osen_ie)
5089			pos = wpa_supplicant_ie_txt(pos, end, "OSEN",
5090						    osen_ie, 2 + osen_ie[1]);
5091		owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
5092		if (owe) {
5093			ret = os_snprintf(
5094				pos, end - pos,
5095				ie2 ? "[OWE-TRANS]" : "[OWE-TRANS-OPEN]");
5096			if (os_snprintf_error(end - pos, ret))
5097				return 0;
5098			pos += ret;
5099		}
5100		pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
5101		if (!ie && !ie2 && !osen_ie &&
5102		    (bss->caps & IEEE80211_CAP_PRIVACY)) {
5103			ret = os_snprintf(pos, end - pos, "[WEP]");
5104			if (os_snprintf_error(end - pos, ret))
5105				return 0;
5106			pos += ret;
5107		}
5108
5109		if (mesh) {
5110			ret = os_snprintf(pos, end - pos, "[MESH]");
5111			if (os_snprintf_error(end - pos, ret))
5112				return 0;
5113			pos += ret;
5114		}
5115
5116		if (bss_is_dmg(bss)) {
5117			const char *s;
5118			ret = os_snprintf(pos, end - pos, "[DMG]");
5119			if (os_snprintf_error(end - pos, ret))
5120				return 0;
5121			pos += ret;
5122			switch (bss->caps & IEEE80211_CAP_DMG_MASK) {
5123			case IEEE80211_CAP_DMG_IBSS:
5124				s = "[IBSS]";
5125				break;
5126			case IEEE80211_CAP_DMG_AP:
5127				s = "[ESS]";
5128				break;
5129			case IEEE80211_CAP_DMG_PBSS:
5130				s = "[PBSS]";
5131				break;
5132			default:
5133				s = "";
5134				break;
5135			}
5136			ret = os_snprintf(pos, end - pos, "%s", s);
5137			if (os_snprintf_error(end - pos, ret))
5138				return 0;
5139			pos += ret;
5140		} else {
5141			if (bss->caps & IEEE80211_CAP_IBSS) {
5142				ret = os_snprintf(pos, end - pos, "[IBSS]");
5143				if (os_snprintf_error(end - pos, ret))
5144					return 0;
5145				pos += ret;
5146			}
5147			if (bss->caps & IEEE80211_CAP_ESS) {
5148				ret = os_snprintf(pos, end - pos, "[ESS]");
5149				if (os_snprintf_error(end - pos, ret))
5150					return 0;
5151				pos += ret;
5152			}
5153		}
5154		if (wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE) ||
5155		    wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE)) {
5156			ret = os_snprintf(pos, end - pos, "[P2P]");
5157			if (os_snprintf_error(end - pos, ret))
5158				return 0;
5159			pos += ret;
5160		}
5161#ifdef CONFIG_HS20
5162		if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
5163			ret = os_snprintf(pos, end - pos, "[HS20]");
5164			if (os_snprintf_error(end - pos, ret))
5165				return 0;
5166			pos += ret;
5167		}
5168#endif /* CONFIG_HS20 */
5169#ifdef CONFIG_FILS
5170		if (wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION)) {
5171			ret = os_snprintf(pos, end - pos, "[FILS]");
5172			if (os_snprintf_error(end - pos, ret))
5173				return 0;
5174			pos += ret;
5175		}
5176#endif /* CONFIG_FILS */
5177#ifdef CONFIG_FST
5178		if (wpa_bss_get_ie(bss, WLAN_EID_MULTI_BAND)) {
5179			ret = os_snprintf(pos, end - pos, "[FST]");
5180			if (os_snprintf_error(end - pos, ret))
5181				return 0;
5182			pos += ret;
5183		}
5184#endif /* CONFIG_FST */
5185		if (wpa_bss_ext_capab(bss, WLAN_EXT_CAPAB_UTF_8_SSID)) {
5186			ret = os_snprintf(pos, end - pos, "[UTF-8]");
5187			if (os_snprintf_error(end - pos, ret))
5188				return 0;
5189			pos += ret;
5190		}
5191
5192		ret = os_snprintf(pos, end - pos, "\n");
5193		if (os_snprintf_error(end - pos, ret))
5194			return 0;
5195		pos += ret;
5196	}
5197
5198	if (mask & WPA_BSS_MASK_SSID) {
5199		ret = os_snprintf(pos, end - pos, "ssid=%s\n",
5200				  wpa_ssid_txt(bss->ssid, bss->ssid_len));
5201		if (os_snprintf_error(end - pos, ret))
5202			return 0;
5203		pos += ret;
5204	}
5205
5206#ifdef CONFIG_WPS
5207	if (mask & WPA_BSS_MASK_WPS_SCAN) {
5208		ie = wpa_bss_ie_ptr(bss);
5209		ret = wpas_wps_scan_result_text(ie, bss->ie_len, pos, end);
5210		if (ret >= end - pos)
5211			return 0;
5212		if (ret > 0)
5213			pos += ret;
5214	}
5215#endif /* CONFIG_WPS */
5216
5217#ifdef CONFIG_P2P
5218	if (mask & WPA_BSS_MASK_P2P_SCAN) {
5219		ie = wpa_bss_ie_ptr(bss);
5220		ret = wpas_p2p_scan_result_text(ie, bss->ie_len, pos, end);
5221		if (ret >= end - pos)
5222			return 0;
5223		if (ret > 0)
5224			pos += ret;
5225	}
5226#endif /* CONFIG_P2P */
5227
5228#ifdef CONFIG_WIFI_DISPLAY
5229	if (mask & WPA_BSS_MASK_WIFI_DISPLAY) {
5230		struct wpabuf *wfd;
5231
5232		ie = wpa_bss_ie_ptr(bss);
5233		wfd = ieee802_11_vendor_ie_concat(ie, bss->ie_len,
5234						  WFD_IE_VENDOR_TYPE);
5235		if (wfd) {
5236			ret = os_snprintf(pos, end - pos, "wfd_subelems=");
5237			if (os_snprintf_error(end - pos, ret)) {
5238				wpabuf_free(wfd);
5239				return 0;
5240			}
5241			pos += ret;
5242
5243			pos += wpa_snprintf_hex(pos, end - pos,
5244						wpabuf_head(wfd),
5245						wpabuf_len(wfd));
5246			wpabuf_free(wfd);
5247
5248			ret = os_snprintf(pos, end - pos, "\n");
5249			if (os_snprintf_error(end - pos, ret))
5250				return 0;
5251			pos += ret;
5252		}
5253	}
5254#endif /* CONFIG_WIFI_DISPLAY */
5255
5256#ifdef CONFIG_INTERWORKING
5257	if ((mask & WPA_BSS_MASK_INTERNETW) && bss->anqp) {
5258		struct wpa_bss_anqp *anqp = bss->anqp;
5259		struct wpa_bss_anqp_elem *elem;
5260
5261		pos = anqp_add_hex(pos, end, "anqp_capability_list",
5262				   anqp->capability_list);
5263		pos = anqp_add_hex(pos, end, "anqp_venue_name",
5264				   anqp->venue_name);
5265		pos = anqp_add_hex(pos, end, "anqp_network_auth_type",
5266				   anqp->network_auth_type);
5267		pos = anqp_add_hex(pos, end, "anqp_roaming_consortium",
5268				   anqp->roaming_consortium);
5269		pos = anqp_add_hex(pos, end, "anqp_ip_addr_type_availability",
5270				   anqp->ip_addr_type_availability);
5271		pos = anqp_add_hex(pos, end, "anqp_nai_realm",
5272				   anqp->nai_realm);
5273		pos = anqp_add_hex(pos, end, "anqp_3gpp", anqp->anqp_3gpp);
5274		pos = anqp_add_hex(pos, end, "anqp_domain_name",
5275				   anqp->domain_name);
5276		pos = anqp_add_hex(pos, end, "anqp_fils_realm_info",
5277				   anqp->fils_realm_info);
5278#ifdef CONFIG_HS20
5279		pos = anqp_add_hex(pos, end, "hs20_capability_list",
5280				   anqp->hs20_capability_list);
5281		pos = anqp_add_hex(pos, end, "hs20_operator_friendly_name",
5282				   anqp->hs20_operator_friendly_name);
5283		pos = anqp_add_hex(pos, end, "hs20_wan_metrics",
5284				   anqp->hs20_wan_metrics);
5285		pos = anqp_add_hex(pos, end, "hs20_connection_capability",
5286				   anqp->hs20_connection_capability);
5287		pos = anqp_add_hex(pos, end, "hs20_operating_class",
5288				   anqp->hs20_operating_class);
5289		pos = anqp_add_hex(pos, end, "hs20_osu_providers_list",
5290				   anqp->hs20_osu_providers_list);
5291		pos = anqp_add_hex(pos, end, "hs20_operator_icon_metadata",
5292				   anqp->hs20_operator_icon_metadata);
5293		pos = anqp_add_hex(pos, end, "hs20_osu_providers_nai_list",
5294				   anqp->hs20_osu_providers_nai_list);
5295#endif /* CONFIG_HS20 */
5296
5297		dl_list_for_each(elem, &anqp->anqp_elems,
5298				 struct wpa_bss_anqp_elem, list) {
5299			char title[20];
5300
5301			os_snprintf(title, sizeof(title), "anqp[%u]",
5302				    elem->infoid);
5303			pos = anqp_add_hex(pos, end, title, elem->payload);
5304			if (elem->protected_response) {
5305				ret = os_snprintf(pos, end - pos,
5306						  "protected-anqp-info[%u]=1\n",
5307						  elem->infoid);
5308				if (os_snprintf_error(end - pos, ret))
5309					return 0;
5310				pos += ret;
5311			}
5312		}
5313	}
5314#endif /* CONFIG_INTERWORKING */
5315
5316#ifdef CONFIG_MESH
5317	if (mask & WPA_BSS_MASK_MESH_SCAN) {
5318		ie = wpa_bss_ie_ptr(bss);
5319		ret = wpas_mesh_scan_result_text(ie, bss->ie_len, pos, end);
5320		if (ret >= end - pos)
5321			return 0;
5322		if (ret > 0)
5323			pos += ret;
5324	}
5325#endif /* CONFIG_MESH */
5326
5327	if (mask & WPA_BSS_MASK_SNR) {
5328		ret = os_snprintf(pos, end - pos, "snr=%d\n", bss->snr);
5329		if (os_snprintf_error(end - pos, ret))
5330			return 0;
5331		pos += ret;
5332	}
5333
5334	if (mask & WPA_BSS_MASK_EST_THROUGHPUT) {
5335		ret = os_snprintf(pos, end - pos, "est_throughput=%d\n",
5336				  bss->est_throughput);
5337		if (os_snprintf_error(end - pos, ret))
5338			return 0;
5339		pos += ret;
5340	}
5341
5342#ifdef CONFIG_FST
5343	if (mask & WPA_BSS_MASK_FST) {
5344		ret = fst_ctrl_iface_mb_info(bss->bssid, pos, end - pos);
5345		if (ret < 0 || ret >= end - pos)
5346			return 0;
5347		pos += ret;
5348	}
5349#endif /* CONFIG_FST */
5350
5351	if (mask & WPA_BSS_MASK_UPDATE_IDX) {
5352		ret = os_snprintf(pos, end - pos, "update_idx=%u\n",
5353				  bss->last_update_idx);
5354		if (os_snprintf_error(end - pos, ret))
5355			return 0;
5356		pos += ret;
5357	}
5358
5359	if ((mask & WPA_BSS_MASK_BEACON_IE) && bss->beacon_ie_len) {
5360		ret = os_snprintf(pos, end - pos, "beacon_ie=");
5361		if (os_snprintf_error(end - pos, ret))
5362			return 0;
5363		pos += ret;
5364
5365		ie = wpa_bss_ie_ptr(bss);
5366		ie += bss->ie_len;
5367		for (i = 0; i < bss->beacon_ie_len; i++) {
5368			ret = os_snprintf(pos, end - pos, "%02x", *ie++);
5369			if (os_snprintf_error(end - pos, ret))
5370				return 0;
5371			pos += ret;
5372		}
5373
5374		ret = os_snprintf(pos, end - pos, "\n");
5375		if (os_snprintf_error(end - pos, ret))
5376			return 0;
5377		pos += ret;
5378	}
5379
5380#ifdef CONFIG_FILS
5381	if (mask & WPA_BSS_MASK_FILS_INDICATION) {
5382		ret = print_fils_indication(bss, pos, end);
5383		if (ret < 0)
5384			return 0;
5385		pos += ret;
5386	}
5387#endif /* CONFIG_FILS */
5388
5389	if (mask & WPA_BSS_MASK_DELIM) {
5390		ret = os_snprintf(pos, end - pos, "====\n");
5391		if (os_snprintf_error(end - pos, ret))
5392			return 0;
5393		pos += ret;
5394	}
5395
5396	return pos - buf;
5397}
5398
5399
5400static int wpa_supplicant_ctrl_iface_bss(struct wpa_supplicant *wpa_s,
5401					 const char *cmd, char *buf,
5402					 size_t buflen)
5403{
5404	u8 bssid[ETH_ALEN];
5405	size_t i;
5406	struct wpa_bss *bss;
5407	struct wpa_bss *bsslast = NULL;
5408	struct dl_list *next;
5409	int ret = 0;
5410	int len;
5411	char *ctmp, *end = buf + buflen;
5412	unsigned long mask = WPA_BSS_MASK_ALL;
5413
5414	if (os_strncmp(cmd, "RANGE=", 6) == 0) {
5415		if (os_strncmp(cmd + 6, "ALL", 3) == 0) {
5416			bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss,
5417					    list_id);
5418			bsslast = dl_list_last(&wpa_s->bss_id, struct wpa_bss,
5419					       list_id);
5420		} else { /* N1-N2 */
5421			unsigned int id1, id2;
5422
5423			if ((ctmp = os_strchr(cmd + 6, '-')) == NULL) {
5424				wpa_printf(MSG_INFO, "Wrong BSS range "
5425					   "format");
5426				return 0;
5427			}
5428
5429			if (*(cmd + 6) == '-')
5430				id1 = 0;
5431			else
5432				id1 = atoi(cmd + 6);
5433			ctmp++;
5434			if (*ctmp >= '0' && *ctmp <= '9')
5435				id2 = atoi(ctmp);
5436			else
5437				id2 = (unsigned int) -1;
5438			bss = wpa_bss_get_id_range(wpa_s, id1, id2);
5439			if (id2 == (unsigned int) -1)
5440				bsslast = dl_list_last(&wpa_s->bss_id,
5441						       struct wpa_bss,
5442						       list_id);
5443			else {
5444				bsslast = wpa_bss_get_id(wpa_s, id2);
5445				if (bsslast == NULL && bss && id2 > id1) {
5446					struct wpa_bss *tmp = bss;
5447					for (;;) {
5448						next = tmp->list_id.next;
5449						if (next == &wpa_s->bss_id)
5450							break;
5451						tmp = dl_list_entry(
5452							next, struct wpa_bss,
5453							list_id);
5454						if (tmp->id > id2)
5455							break;
5456						bsslast = tmp;
5457					}
5458				}
5459			}
5460		}
5461	} else if (os_strncmp(cmd, "FIRST", 5) == 0)
5462		bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss, list_id);
5463	else if (os_strncmp(cmd, "LAST", 4) == 0)
5464		bss = dl_list_last(&wpa_s->bss_id, struct wpa_bss, list_id);
5465	else if (os_strncmp(cmd, "ID-", 3) == 0) {
5466		i = atoi(cmd + 3);
5467		bss = wpa_bss_get_id(wpa_s, i);
5468	} else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
5469		i = atoi(cmd + 5);
5470		bss = wpa_bss_get_id(wpa_s, i);
5471		if (bss) {
5472			next = bss->list_id.next;
5473			if (next == &wpa_s->bss_id)
5474				bss = NULL;
5475			else
5476				bss = dl_list_entry(next, struct wpa_bss,
5477						    list_id);
5478		}
5479	} else if (os_strncmp(cmd, "CURRENT", 7) == 0) {
5480		bss = wpa_s->current_bss;
5481#ifdef CONFIG_P2P
5482	} else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
5483		if (hwaddr_aton(cmd + 13, bssid) == 0)
5484			bss = wpa_bss_get_p2p_dev_addr(wpa_s, bssid);
5485		else
5486			bss = NULL;
5487#endif /* CONFIG_P2P */
5488	} else if (hwaddr_aton(cmd, bssid) == 0)
5489		bss = wpa_bss_get_bssid(wpa_s, bssid);
5490	else {
5491		struct wpa_bss *tmp;
5492		i = atoi(cmd);
5493		bss = NULL;
5494		dl_list_for_each(tmp, &wpa_s->bss_id, struct wpa_bss, list_id)
5495		{
5496			if (i == 0) {
5497				bss = tmp;
5498				break;
5499			}
5500			i--;
5501		}
5502	}
5503
5504	if ((ctmp = os_strstr(cmd, "MASK=")) != NULL) {
5505		mask = strtoul(ctmp + 5, NULL, 0x10);
5506		if (mask == 0)
5507			mask = WPA_BSS_MASK_ALL;
5508	}
5509
5510	if (bss == NULL)
5511		return 0;
5512
5513	if (bsslast == NULL)
5514		bsslast = bss;
5515	do {
5516		len = print_bss_info(wpa_s, bss, mask, buf, buflen);
5517		ret += len;
5518		buf += len;
5519		buflen -= len;
5520		if (bss == bsslast) {
5521			if ((mask & WPA_BSS_MASK_DELIM) && len &&
5522			    (bss == dl_list_last(&wpa_s->bss_id,
5523						 struct wpa_bss, list_id))) {
5524				int res;
5525
5526				res = os_snprintf(buf - 5, end - buf + 5,
5527						  "####\n");
5528				if (os_snprintf_error(end - buf + 5, res)) {
5529					wpa_printf(MSG_DEBUG,
5530						   "Could not add end delim");
5531				}
5532			}
5533			break;
5534		}
5535		next = bss->list_id.next;
5536		if (next == &wpa_s->bss_id)
5537			break;
5538		bss = dl_list_entry(next, struct wpa_bss, list_id);
5539	} while (bss && len);
5540
5541	return ret;
5542}
5543
5544
5545static int wpa_supplicant_ctrl_iface_ap_scan(
5546	struct wpa_supplicant *wpa_s, char *cmd)
5547{
5548	int ap_scan = atoi(cmd);
5549	return wpa_supplicant_set_ap_scan(wpa_s, ap_scan);
5550}
5551
5552
5553static int wpa_supplicant_ctrl_iface_scan_interval(
5554	struct wpa_supplicant *wpa_s, char *cmd)
5555{
5556	int scan_int = atoi(cmd);
5557	return wpa_supplicant_set_scan_interval(wpa_s, scan_int);
5558}
5559
5560
5561static int wpa_supplicant_ctrl_iface_bss_expire_age(
5562	struct wpa_supplicant *wpa_s, char *cmd)
5563{
5564	int expire_age = atoi(cmd);
5565	return wpa_supplicant_set_bss_expiration_age(wpa_s, expire_age);
5566}
5567
5568
5569static int wpa_supplicant_ctrl_iface_bss_expire_count(
5570	struct wpa_supplicant *wpa_s, char *cmd)
5571{
5572	int expire_count = atoi(cmd);
5573	return wpa_supplicant_set_bss_expiration_count(wpa_s, expire_count);
5574}
5575
5576
5577static void wpa_supplicant_ctrl_iface_bss_flush(
5578	struct wpa_supplicant *wpa_s, char *cmd)
5579{
5580	int flush_age = atoi(cmd);
5581
5582	if (flush_age == 0)
5583		wpa_bss_flush(wpa_s);
5584	else
5585		wpa_bss_flush_by_age(wpa_s, flush_age);
5586}
5587
5588
5589#ifdef CONFIG_TESTING_OPTIONS
5590static void wpa_supplicant_ctrl_iface_drop_sa(struct wpa_supplicant *wpa_s)
5591{
5592	wpa_printf(MSG_DEBUG, "Dropping SA without deauthentication");
5593	/* MLME-DELETEKEYS.request */
5594	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 0, 0, NULL, 0, NULL,
5595			0, KEY_FLAG_GROUP);
5596	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 1, 0, NULL, 0, NULL,
5597			0, KEY_FLAG_GROUP);
5598	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 2, 0, NULL, 0, NULL,
5599			0, KEY_FLAG_GROUP);
5600	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 3, 0, NULL, 0, NULL,
5601			0, KEY_FLAG_GROUP);
5602	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 4, 0, NULL, 0, NULL,
5603			0, KEY_FLAG_GROUP);
5604	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 5, 0, NULL, 0, NULL,
5605			0, KEY_FLAG_GROUP);
5606
5607	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, wpa_s->bssid, 0, 0, NULL, 0, NULL,
5608			0, KEY_FLAG_PAIRWISE);
5609	if (wpa_sm_ext_key_id(wpa_s->wpa))
5610		wpa_drv_set_key(wpa_s, WPA_ALG_NONE, wpa_s->bssid, 1, 0,
5611				NULL, 0, NULL, 0, KEY_FLAG_PAIRWISE);
5612	/* MLME-SETPROTECTION.request(None) */
5613	wpa_drv_mlme_setprotection(wpa_s, wpa_s->bssid,
5614				   MLME_SETPROTECTION_PROTECT_TYPE_NONE,
5615				   MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
5616	wpa_sm_drop_sa(wpa_s->wpa);
5617}
5618#endif /* CONFIG_TESTING_OPTIONS */
5619
5620
5621static int wpa_supplicant_ctrl_iface_roam(struct wpa_supplicant *wpa_s,
5622					  char *addr)
5623{
5624#ifdef CONFIG_NO_SCAN_PROCESSING
5625	return -1;
5626#else /* CONFIG_NO_SCAN_PROCESSING */
5627	u8 bssid[ETH_ALEN];
5628	struct wpa_bss *bss;
5629	struct wpa_ssid *ssid = wpa_s->current_ssid;
5630	struct wpa_radio_work *already_connecting;
5631
5632	if (hwaddr_aton(addr, bssid)) {
5633		wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: invalid "
5634			   "address '%s'", addr);
5635		return -1;
5636	}
5637
5638	wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM " MACSTR, MAC2STR(bssid));
5639
5640	if (!ssid) {
5641		wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: No network "
5642			   "configuration known for the target AP");
5643		return -1;
5644	}
5645
5646	bss = wpa_bss_get(wpa_s, bssid, ssid->ssid, ssid->ssid_len);
5647	if (!bss) {
5648		wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: Target AP not found "
5649			   "from BSS table");
5650		return -1;
5651	}
5652
5653	/*
5654	 * TODO: Find best network configuration block from configuration to
5655	 * allow roaming to other networks
5656	 */
5657
5658	already_connecting = radio_work_pending(wpa_s, "sme-connect");
5659	wpa_s->reassociate = 1;
5660	wpa_supplicant_connect(wpa_s, bss, ssid);
5661
5662	/*
5663	 * Indicate that an explicitly requested roam is in progress so scan
5664	 * results that come in before the 'sme-connect' radio work gets
5665	 * executed do not override the original connection attempt.
5666	 */
5667	if (!already_connecting && radio_work_pending(wpa_s, "sme-connect"))
5668		wpa_s->roam_in_progress = true;
5669
5670	return 0;
5671#endif /* CONFIG_NO_SCAN_PROCESSING */
5672}
5673
5674
5675#ifdef CONFIG_P2P
5676static int p2p_ctrl_find(struct wpa_supplicant *wpa_s, char *cmd)
5677{
5678	unsigned int timeout = atoi(cmd);
5679	enum p2p_discovery_type type = P2P_FIND_START_WITH_FULL;
5680	u8 dev_id[ETH_ALEN], *_dev_id = NULL;
5681	u8 dev_type[WPS_DEV_TYPE_LEN], *_dev_type = NULL;
5682	char *pos;
5683	unsigned int search_delay;
5684	const char *_seek[P2P_MAX_QUERY_HASH + 1], **seek = NULL;
5685	u8 seek_count = 0;
5686	int freq = 0;
5687	bool include_6ghz = false;
5688
5689	if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
5690		wpa_dbg(wpa_s, MSG_INFO,
5691			"Reject P2P_FIND since interface is disabled");
5692		return -1;
5693	}
5694
5695	if (os_strstr(cmd, " include_6ghz"))
5696		include_6ghz = true;
5697	if (os_strstr(cmd, "type=social"))
5698		type = P2P_FIND_ONLY_SOCIAL;
5699	else if (os_strstr(cmd, "type=progressive"))
5700		type = P2P_FIND_PROGRESSIVE;
5701
5702	pos = os_strstr(cmd, "dev_id=");
5703	if (pos) {
5704		pos += 7;
5705		if (hwaddr_aton(pos, dev_id))
5706			return -1;
5707		_dev_id = dev_id;
5708	}
5709
5710	pos = os_strstr(cmd, "dev_type=");
5711	if (pos) {
5712		pos += 9;
5713		if (wps_dev_type_str2bin(pos, dev_type) < 0)
5714			return -1;
5715		_dev_type = dev_type;
5716	}
5717
5718	pos = os_strstr(cmd, "delay=");
5719	if (pos) {
5720		pos += 6;
5721		search_delay = atoi(pos);
5722	} else
5723		search_delay = wpas_p2p_search_delay(wpa_s);
5724
5725	pos = os_strstr(cmd, "freq=");
5726	if (pos) {
5727		pos += 5;
5728		freq = atoi(pos);
5729		if (freq <= 0)
5730			return -1;
5731	}
5732
5733	/* Must be searched for last, because it adds nul termination */
5734	pos = os_strstr(cmd, " seek=");
5735	if (pos)
5736		pos += 6;
5737	while (pos && seek_count < P2P_MAX_QUERY_HASH + 1) {
5738		char *term;
5739
5740		_seek[seek_count++] = pos;
5741		seek = _seek;
5742		term = os_strchr(pos, ' ');
5743		if (!term)
5744			break;
5745		*term = '\0';
5746		pos = os_strstr(term + 1, "seek=");
5747		if (pos)
5748			pos += 5;
5749	}
5750	if (seek_count > P2P_MAX_QUERY_HASH) {
5751		seek[0] = NULL;
5752		seek_count = 1;
5753	}
5754
5755	return wpas_p2p_find(wpa_s, timeout, type, _dev_type != NULL, _dev_type,
5756			     _dev_id, search_delay, seek_count, seek, freq,
5757			     include_6ghz);
5758}
5759
5760
5761static int p2ps_ctrl_parse_cpt_priority(const char *pos, u8 *cpt)
5762{
5763	const char *last = NULL;
5764	const char *token;
5765	long int token_len;
5766	unsigned int i;
5767
5768	/* Expected predefined CPT names delimited by ':' */
5769	for (i = 0; (token = cstr_token(pos, ": \t", &last)); i++) {
5770		if (i >= P2PS_FEATURE_CAPAB_CPT_MAX) {
5771			wpa_printf(MSG_ERROR,
5772				   "P2PS: CPT name list is too long, expected up to %d names",
5773				   P2PS_FEATURE_CAPAB_CPT_MAX);
5774			cpt[0] = 0;
5775			return -1;
5776		}
5777
5778		token_len = last - token;
5779
5780		if (token_len  == 3 &&
5781		    os_memcmp(token, "UDP", token_len) == 0) {
5782			cpt[i] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
5783		} else if (token_len == 3 &&
5784			   os_memcmp(token, "MAC", token_len) == 0) {
5785			cpt[i] = P2PS_FEATURE_CAPAB_MAC_TRANSPORT;
5786		} else {
5787			wpa_printf(MSG_ERROR,
5788				   "P2PS: Unsupported CPT name '%s'", token);
5789			cpt[0] = 0;
5790			return -1;
5791		}
5792
5793		if (isblank((unsigned char) *last)) {
5794			i++;
5795			break;
5796		}
5797	}
5798	cpt[i] = 0;
5799	return 0;
5800}
5801
5802
5803static struct p2ps_provision * p2p_parse_asp_provision_cmd(const char *cmd)
5804{
5805	struct p2ps_provision *p2ps_prov;
5806	char *pos;
5807	size_t info_len = 0;
5808	char *info = NULL;
5809	u8 role = P2PS_SETUP_NONE;
5810	long long unsigned val;
5811	int i;
5812
5813	pos = os_strstr(cmd, "info=");
5814	if (pos) {
5815		pos += 5;
5816		info_len = os_strlen(pos);
5817
5818		if (info_len) {
5819			info = os_malloc(info_len + 1);
5820			if (info) {
5821				info_len = utf8_unescape(pos, info_len,
5822							 info, info_len + 1);
5823			} else
5824				info_len = 0;
5825		}
5826	}
5827
5828	p2ps_prov = os_zalloc(sizeof(struct p2ps_provision) + info_len + 1);
5829	if (p2ps_prov == NULL) {
5830		os_free(info);
5831		return NULL;
5832	}
5833
5834	if (info) {
5835		os_memcpy(p2ps_prov->info, info, info_len);
5836		p2ps_prov->info[info_len] = '\0';
5837		os_free(info);
5838	}
5839
5840	pos = os_strstr(cmd, "status=");
5841	if (pos)
5842		p2ps_prov->status = atoi(pos + 7);
5843	else
5844		p2ps_prov->status = -1;
5845
5846	pos = os_strstr(cmd, "adv_id=");
5847	if (!pos || sscanf(pos + 7, "%llx", &val) != 1 || val > 0xffffffffULL)
5848		goto invalid_args;
5849	p2ps_prov->adv_id = val;
5850
5851	pos = os_strstr(cmd, "method=");
5852	if (pos)
5853		p2ps_prov->method = strtol(pos + 7, NULL, 16);
5854	else
5855		p2ps_prov->method = 0;
5856
5857	pos = os_strstr(cmd, "session=");
5858	if (!pos || sscanf(pos + 8, "%llx", &val) != 1 || val > 0xffffffffULL)
5859		goto invalid_args;
5860	p2ps_prov->session_id = val;
5861
5862	pos = os_strstr(cmd, "adv_mac=");
5863	if (!pos || hwaddr_aton(pos + 8, p2ps_prov->adv_mac))
5864		goto invalid_args;
5865
5866	pos = os_strstr(cmd, "session_mac=");
5867	if (!pos || hwaddr_aton(pos + 12, p2ps_prov->session_mac))
5868		goto invalid_args;
5869
5870	pos = os_strstr(cmd, "cpt=");
5871	if (pos) {
5872		if (p2ps_ctrl_parse_cpt_priority(pos + 4,
5873						 p2ps_prov->cpt_priority))
5874			goto invalid_args;
5875	} else {
5876		p2ps_prov->cpt_priority[0] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
5877	}
5878
5879	for (i = 0; p2ps_prov->cpt_priority[i]; i++)
5880		p2ps_prov->cpt_mask |= p2ps_prov->cpt_priority[i];
5881
5882	/* force conncap with tstCap (no validity checks) */
5883	pos = os_strstr(cmd, "tstCap=");
5884	if (pos) {
5885		role = strtol(pos + 7, NULL, 16);
5886	} else {
5887		pos = os_strstr(cmd, "role=");
5888		if (pos) {
5889			role = strtol(pos + 5, NULL, 16);
5890			if (role != P2PS_SETUP_CLIENT &&
5891			    role != P2PS_SETUP_GROUP_OWNER)
5892				role = P2PS_SETUP_NONE;
5893		}
5894	}
5895	p2ps_prov->role = role;
5896
5897	return p2ps_prov;
5898
5899invalid_args:
5900	os_free(p2ps_prov);
5901	return NULL;
5902}
5903
5904
5905static int p2p_ctrl_asp_provision_resp(struct wpa_supplicant *wpa_s, char *cmd)
5906{
5907	u8 addr[ETH_ALEN];
5908	struct p2ps_provision *p2ps_prov;
5909	char *pos;
5910
5911	/* <addr> id=<adv_id> [role=<conncap>] [info=<infodata>] */
5912
5913	wpa_printf(MSG_DEBUG, "%s: %s", __func__, cmd);
5914
5915	if (hwaddr_aton(cmd, addr))
5916		return -1;
5917
5918	pos = cmd + 17;
5919	if (*pos != ' ')
5920		return -1;
5921
5922	p2ps_prov = p2p_parse_asp_provision_cmd(pos);
5923	if (!p2ps_prov)
5924		return -1;
5925
5926	if (p2ps_prov->status < 0) {
5927		os_free(p2ps_prov);
5928		return -1;
5929	}
5930
5931	return wpas_p2p_prov_disc(wpa_s, addr, NULL, WPAS_P2P_PD_FOR_ASP,
5932				  p2ps_prov);
5933}
5934
5935
5936static int p2p_ctrl_asp_provision(struct wpa_supplicant *wpa_s, char *cmd)
5937{
5938	u8 addr[ETH_ALEN];
5939	struct p2ps_provision *p2ps_prov;
5940	char *pos;
5941
5942	/* <addr> id=<adv_id> adv_mac=<adv_mac> conncap=<conncap>
5943	 *        session=<ses_id> mac=<ses_mac> [info=<infodata>]
5944	 */
5945
5946	wpa_printf(MSG_DEBUG, "%s: %s", __func__, cmd);
5947	if (hwaddr_aton(cmd, addr))
5948		return -1;
5949
5950	pos = cmd + 17;
5951	if (*pos != ' ')
5952		return -1;
5953
5954	p2ps_prov = p2p_parse_asp_provision_cmd(pos);
5955	if (!p2ps_prov)
5956		return -1;
5957
5958	p2ps_prov->pd_seeker = 1;
5959
5960	return wpas_p2p_prov_disc(wpa_s, addr, NULL, WPAS_P2P_PD_FOR_ASP,
5961				  p2ps_prov);
5962}
5963
5964
5965static int parse_freq(int chwidth, int freq2)
5966{
5967	if (freq2 < 0)
5968		return -1;
5969	if (freq2)
5970		return CHANWIDTH_80P80MHZ;
5971
5972	switch (chwidth) {
5973	case 0:
5974	case 20:
5975	case 40:
5976		return CHANWIDTH_USE_HT;
5977	case 80:
5978		return CHANWIDTH_80MHZ;
5979	case 160:
5980		return CHANWIDTH_160MHZ;
5981	default:
5982		wpa_printf(MSG_DEBUG, "Unknown max oper bandwidth: %d",
5983			   chwidth);
5984		return -1;
5985	}
5986}
5987
5988
5989static int p2p_ctrl_connect(struct wpa_supplicant *wpa_s, char *cmd,
5990			    char *buf, size_t buflen)
5991{
5992	u8 addr[ETH_ALEN];
5993	char *pos, *pos2;
5994	char *pin = NULL;
5995	enum p2p_wps_method wps_method;
5996	int new_pin;
5997	int ret;
5998	int persistent_group, persistent_id = -1;
5999	int join;
6000	int auth;
6001	int automatic;
6002	int go_intent = -1;
6003	int freq = 0;
6004	int pd;
6005	int ht40, vht, max_oper_chwidth, chwidth = 0, freq2 = 0;
6006	int edmg;
6007	u8 _group_ssid[SSID_MAX_LEN], *group_ssid = NULL;
6008	size_t group_ssid_len = 0;
6009	int he;
6010	bool allow_6ghz;
6011
6012	if (!wpa_s->global->p2p_init_wpa_s)
6013		return -1;
6014	if (wpa_s->global->p2p_init_wpa_s != wpa_s) {
6015		wpa_dbg(wpa_s, MSG_DEBUG, "Direct P2P_CONNECT command to %s",
6016			wpa_s->global->p2p_init_wpa_s->ifname);
6017		wpa_s = wpa_s->global->p2p_init_wpa_s;
6018	}
6019
6020	/* <addr> <"pbc" | "pin" | PIN> [label|display|keypad|p2ps]
6021	 * [persistent|persistent=<network id>]
6022	 * [join] [auth] [go_intent=<0..15>] [freq=<in MHz>] [provdisc]
6023	 * [ht40] [vht] [he] [edmg] [auto] [ssid=<hexdump>] */
6024
6025	if (hwaddr_aton(cmd, addr))
6026		return -1;
6027
6028	pos = cmd + 17;
6029	if (*pos != ' ')
6030		return -1;
6031	pos++;
6032
6033	persistent_group = os_strstr(pos, " persistent") != NULL;
6034	pos2 = os_strstr(pos, " persistent=");
6035	if (pos2) {
6036		struct wpa_ssid *ssid;
6037		persistent_id = atoi(pos2 + 12);
6038		ssid = wpa_config_get_network(wpa_s->conf, persistent_id);
6039		if (ssid == NULL || ssid->disabled != 2 ||
6040		    ssid->mode != WPAS_MODE_P2P_GO) {
6041			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
6042				   "SSID id=%d for persistent P2P group (GO)",
6043				   persistent_id);
6044			return -1;
6045		}
6046	}
6047	join = os_strstr(pos, " join") != NULL;
6048	allow_6ghz = os_strstr(pos, " allow_6ghz") != NULL;
6049	auth = os_strstr(pos, " auth") != NULL;
6050	automatic = os_strstr(pos, " auto") != NULL;
6051	pd = os_strstr(pos, " provdisc") != NULL;
6052	vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
6053	ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
6054		vht;
6055	he = (os_strstr(cmd, " he") != NULL) || wpa_s->conf->p2p_go_he;
6056	edmg = (os_strstr(cmd, " edmg") != NULL) || wpa_s->conf->p2p_go_edmg;
6057
6058	pos2 = os_strstr(pos, " go_intent=");
6059	if (pos2) {
6060		pos2 += 11;
6061		go_intent = atoi(pos2);
6062		if (go_intent < 0 || go_intent > 15)
6063			return -1;
6064	}
6065
6066	pos2 = os_strstr(pos, " freq=");
6067	if (pos2) {
6068		pos2 += 6;
6069		freq = atoi(pos2);
6070		if (freq <= 0)
6071			return -1;
6072	}
6073
6074	pos2 = os_strstr(pos, " freq2=");
6075	if (pos2)
6076		freq2 = atoi(pos2 + 7);
6077
6078	pos2 = os_strstr(pos, " max_oper_chwidth=");
6079	if (pos2)
6080		chwidth = atoi(pos2 + 18);
6081
6082	max_oper_chwidth = parse_freq(chwidth, freq2);
6083	if (max_oper_chwidth < 0)
6084		return -1;
6085
6086	if (allow_6ghz && chwidth == 40)
6087		max_oper_chwidth = CHANWIDTH_40MHZ_6GHZ;
6088
6089	pos2 = os_strstr(pos, " ssid=");
6090	if (pos2) {
6091		char *end;
6092
6093		pos2 += 6;
6094		end = os_strchr(pos2, ' ');
6095		if (!end)
6096			group_ssid_len = os_strlen(pos2) / 2;
6097		else
6098			group_ssid_len = (end - pos2) / 2;
6099		if (group_ssid_len == 0 || group_ssid_len > SSID_MAX_LEN ||
6100		    hexstr2bin(pos2, _group_ssid, group_ssid_len) < 0)
6101			return -1;
6102		group_ssid = _group_ssid;
6103	}
6104
6105	if (os_strncmp(pos, "pin", 3) == 0) {
6106		/* Request random PIN (to be displayed) and enable the PIN */
6107		wps_method = WPS_PIN_DISPLAY;
6108	} else if (os_strncmp(pos, "pbc", 3) == 0) {
6109		wps_method = WPS_PBC;
6110	} else if (os_strstr(pos, "p2ps") != NULL) {
6111		wps_method = WPS_P2PS;
6112	} else {
6113		pin = pos;
6114		pos = os_strchr(pin, ' ');
6115		wps_method = WPS_PIN_KEYPAD;
6116		if (pos) {
6117			*pos++ = '\0';
6118			if (os_strncmp(pos, "display", 7) == 0)
6119				wps_method = WPS_PIN_DISPLAY;
6120		}
6121		if (!wps_pin_str_valid(pin)) {
6122			os_memcpy(buf, "FAIL-INVALID-PIN\n", 17);
6123			return 17;
6124		}
6125	}
6126
6127	new_pin = wpas_p2p_connect(wpa_s, addr, pin, wps_method,
6128				   persistent_group, automatic, join,
6129				   auth, go_intent, freq, freq2, persistent_id,
6130				   pd, ht40, vht, max_oper_chwidth, he, edmg,
6131				   group_ssid, group_ssid_len, allow_6ghz);
6132	if (new_pin == -2) {
6133		os_memcpy(buf, "FAIL-CHANNEL-UNAVAILABLE\n", 25);
6134		return 25;
6135	}
6136	if (new_pin == -3) {
6137		os_memcpy(buf, "FAIL-CHANNEL-UNSUPPORTED\n", 25);
6138		return 25;
6139	}
6140	if (new_pin < 0)
6141		return -1;
6142	if (wps_method == WPS_PIN_DISPLAY && pin == NULL) {
6143		ret = os_snprintf(buf, buflen, "%08d", new_pin);
6144		if (os_snprintf_error(buflen, ret))
6145			return -1;
6146		return ret;
6147	}
6148
6149	os_memcpy(buf, "OK\n", 3);
6150	return 3;
6151}
6152
6153
6154static int p2p_ctrl_listen(struct wpa_supplicant *wpa_s, char *cmd)
6155{
6156	unsigned int timeout = atoi(cmd);
6157	if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
6158		wpa_dbg(wpa_s, MSG_INFO,
6159			"Reject P2P_LISTEN since interface is disabled");
6160		return -1;
6161	}
6162	return wpas_p2p_listen(wpa_s, timeout);
6163}
6164
6165
6166static int p2p_ctrl_prov_disc(struct wpa_supplicant *wpa_s, char *cmd)
6167{
6168	u8 addr[ETH_ALEN];
6169	char *pos;
6170	enum wpas_p2p_prov_disc_use use = WPAS_P2P_PD_FOR_GO_NEG;
6171
6172	/* <addr> <config method> [join|auto] */
6173
6174	if (hwaddr_aton(cmd, addr))
6175		return -1;
6176
6177	pos = cmd + 17;
6178	if (*pos != ' ')
6179		return -1;
6180	pos++;
6181
6182	if (os_strstr(pos, " join") != NULL)
6183		use = WPAS_P2P_PD_FOR_JOIN;
6184	else if (os_strstr(pos, " auto") != NULL)
6185		use = WPAS_P2P_PD_AUTO;
6186
6187	return wpas_p2p_prov_disc(wpa_s, addr, pos, use, NULL);
6188}
6189
6190
6191static int p2p_get_passphrase(struct wpa_supplicant *wpa_s, char *buf,
6192			      size_t buflen)
6193{
6194	struct wpa_ssid *ssid = wpa_s->current_ssid;
6195
6196	if (ssid == NULL || ssid->mode != WPAS_MODE_P2P_GO ||
6197	    ssid->passphrase == NULL)
6198		return -1;
6199
6200	os_strlcpy(buf, ssid->passphrase, buflen);
6201	return os_strlen(buf);
6202}
6203
6204
6205static int p2p_ctrl_serv_disc_req(struct wpa_supplicant *wpa_s, char *cmd,
6206				  char *buf, size_t buflen)
6207{
6208	u64 ref;
6209	int res;
6210	u8 dst_buf[ETH_ALEN], *dst;
6211	struct wpabuf *tlvs;
6212	char *pos;
6213	size_t len;
6214
6215	if (hwaddr_aton(cmd, dst_buf))
6216		return -1;
6217	dst = dst_buf;
6218	if (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
6219	    dst[3] == 0 && dst[4] == 0 && dst[5] == 0)
6220		dst = NULL;
6221	pos = cmd + 17;
6222	if (*pos != ' ')
6223		return -1;
6224	pos++;
6225
6226	if (os_strncmp(pos, "upnp ", 5) == 0) {
6227		u8 version;
6228		pos += 5;
6229		if (hexstr2bin(pos, &version, 1) < 0)
6230			return -1;
6231		pos += 2;
6232		if (*pos != ' ')
6233			return -1;
6234		pos++;
6235		ref = wpas_p2p_sd_request_upnp(wpa_s, dst, version, pos);
6236#ifdef CONFIG_WIFI_DISPLAY
6237	} else if (os_strncmp(pos, "wifi-display ", 13) == 0) {
6238		ref = wpas_p2p_sd_request_wifi_display(wpa_s, dst, pos + 13);
6239#endif /* CONFIG_WIFI_DISPLAY */
6240	} else if (os_strncmp(pos, "asp ", 4) == 0) {
6241		char *svc_str;
6242		char *svc_info = NULL;
6243		u32 id;
6244
6245		pos += 4;
6246		if (sscanf(pos, "%x", &id) != 1 || id > 0xff)
6247			return -1;
6248
6249		pos = os_strchr(pos, ' ');
6250		if (pos == NULL || pos[1] == '\0' || pos[1] == ' ')
6251			return -1;
6252
6253		svc_str = pos + 1;
6254
6255		pos = os_strchr(svc_str, ' ');
6256
6257		if (pos)
6258			*pos++ = '\0';
6259
6260		/* All remaining data is the svc_info string */
6261		if (pos && pos[0] && pos[0] != ' ') {
6262			len = os_strlen(pos);
6263
6264			/* Unescape in place */
6265			len = utf8_unescape(pos, len, pos, len);
6266			if (len > 0xff)
6267				return -1;
6268
6269			svc_info = pos;
6270		}
6271
6272		ref = wpas_p2p_sd_request_asp(wpa_s, dst, (u8) id,
6273					      svc_str, svc_info);
6274	} else {
6275		len = os_strlen(pos);
6276		if (len & 1)
6277			return -1;
6278		len /= 2;
6279		tlvs = wpabuf_alloc(len);
6280		if (tlvs == NULL)
6281			return -1;
6282		if (hexstr2bin(pos, wpabuf_put(tlvs, len), len) < 0) {
6283			wpabuf_free(tlvs);
6284			return -1;
6285		}
6286
6287		ref = wpas_p2p_sd_request(wpa_s, dst, tlvs);
6288		wpabuf_free(tlvs);
6289	}
6290	if (ref == 0)
6291		return -1;
6292	res = os_snprintf(buf, buflen, "%llx", (long long unsigned) ref);
6293	if (os_snprintf_error(buflen, res))
6294		return -1;
6295	return res;
6296}
6297
6298
6299static int p2p_ctrl_serv_disc_cancel_req(struct wpa_supplicant *wpa_s,
6300					 char *cmd)
6301{
6302	long long unsigned val;
6303	u64 req;
6304	if (sscanf(cmd, "%llx", &val) != 1)
6305		return -1;
6306	req = val;
6307	return wpas_p2p_sd_cancel_request(wpa_s, req);
6308}
6309
6310
6311static int p2p_ctrl_serv_disc_resp(struct wpa_supplicant *wpa_s, char *cmd)
6312{
6313	int freq;
6314	u8 dst[ETH_ALEN];
6315	u8 dialog_token;
6316	struct wpabuf *resp_tlvs;
6317	char *pos, *pos2;
6318	size_t len;
6319
6320	pos = os_strchr(cmd, ' ');
6321	if (pos == NULL)
6322		return -1;
6323	*pos++ = '\0';
6324	freq = atoi(cmd);
6325	if (freq == 0)
6326		return -1;
6327
6328	if (hwaddr_aton(pos, dst))
6329		return -1;
6330	pos += 17;
6331	if (*pos != ' ')
6332		return -1;
6333	pos++;
6334
6335	pos2 = os_strchr(pos, ' ');
6336	if (pos2 == NULL)
6337		return -1;
6338	*pos2++ = '\0';
6339	dialog_token = atoi(pos);
6340
6341	len = os_strlen(pos2);
6342	if (len & 1)
6343		return -1;
6344	len /= 2;
6345	resp_tlvs = wpabuf_alloc(len);
6346	if (resp_tlvs == NULL)
6347		return -1;
6348	if (hexstr2bin(pos2, wpabuf_put(resp_tlvs, len), len) < 0) {
6349		wpabuf_free(resp_tlvs);
6350		return -1;
6351	}
6352
6353	wpas_p2p_sd_response(wpa_s, freq, dst, dialog_token, resp_tlvs);
6354	wpabuf_free(resp_tlvs);
6355	return 0;
6356}
6357
6358
6359static int p2p_ctrl_serv_disc_external(struct wpa_supplicant *wpa_s,
6360				       char *cmd)
6361{
6362	if (os_strcmp(cmd, "0") && os_strcmp(cmd, "1"))
6363		return -1;
6364	wpa_s->p2p_sd_over_ctrl_iface = atoi(cmd);
6365	return 0;
6366}
6367
6368
6369static int p2p_ctrl_service_add_bonjour(struct wpa_supplicant *wpa_s,
6370					char *cmd)
6371{
6372	char *pos;
6373	size_t len;
6374	struct wpabuf *query, *resp;
6375
6376	pos = os_strchr(cmd, ' ');
6377	if (pos == NULL)
6378		return -1;
6379	*pos++ = '\0';
6380
6381	len = os_strlen(cmd);
6382	if (len & 1)
6383		return -1;
6384	len /= 2;
6385	query = wpabuf_alloc(len);
6386	if (query == NULL)
6387		return -1;
6388	if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
6389		wpabuf_free(query);
6390		return -1;
6391	}
6392
6393	len = os_strlen(pos);
6394	if (len & 1) {
6395		wpabuf_free(query);
6396		return -1;
6397	}
6398	len /= 2;
6399	resp = wpabuf_alloc(len);
6400	if (resp == NULL) {
6401		wpabuf_free(query);
6402		return -1;
6403	}
6404	if (hexstr2bin(pos, wpabuf_put(resp, len), len) < 0) {
6405		wpabuf_free(query);
6406		wpabuf_free(resp);
6407		return -1;
6408	}
6409
6410	if (wpas_p2p_service_add_bonjour(wpa_s, query, resp) < 0) {
6411		wpabuf_free(query);
6412		wpabuf_free(resp);
6413		return -1;
6414	}
6415	return 0;
6416}
6417
6418
6419static int p2p_ctrl_service_add_upnp(struct wpa_supplicant *wpa_s, char *cmd)
6420{
6421	char *pos;
6422	u8 version;
6423
6424	pos = os_strchr(cmd, ' ');
6425	if (pos == NULL)
6426		return -1;
6427	*pos++ = '\0';
6428
6429	if (hexstr2bin(cmd, &version, 1) < 0)
6430		return -1;
6431
6432	return wpas_p2p_service_add_upnp(wpa_s, version, pos);
6433}
6434
6435
6436static int p2p_ctrl_service_add_asp(struct wpa_supplicant *wpa_s,
6437				    u8 replace, char *cmd)
6438{
6439	char *pos;
6440	char *adv_str;
6441	u32 auto_accept, adv_id, svc_state, config_methods;
6442	char *svc_info = NULL;
6443	char *cpt_prio_str;
6444	u8 cpt_prio[P2PS_FEATURE_CAPAB_CPT_MAX + 1];
6445
6446	pos = os_strchr(cmd, ' ');
6447	if (pos == NULL)
6448		return -1;
6449	*pos++ = '\0';
6450
6451	/* Auto-Accept value is mandatory, and must be one of the
6452	 * single values (0, 1, 2, 4) */
6453	auto_accept = atoi(cmd);
6454	switch (auto_accept) {
6455	case P2PS_SETUP_NONE: /* No auto-accept */
6456	case P2PS_SETUP_NEW:
6457	case P2PS_SETUP_CLIENT:
6458	case P2PS_SETUP_GROUP_OWNER:
6459		break;
6460	default:
6461		return -1;
6462	}
6463
6464	/* Advertisement ID is mandatory */
6465	cmd = pos;
6466	pos = os_strchr(cmd, ' ');
6467	if (pos == NULL)
6468		return -1;
6469	*pos++ = '\0';
6470
6471	/* Handle Adv_ID == 0 (wildcard "org.wi-fi.wfds") internally. */
6472	if (sscanf(cmd, "%x", &adv_id) != 1 || adv_id == 0)
6473		return -1;
6474
6475	/* Only allow replacements if exist, and adds if not */
6476	if (wpas_p2p_service_p2ps_id_exists(wpa_s, adv_id)) {
6477		if (!replace)
6478			return -1;
6479	} else {
6480		if (replace)
6481			return -1;
6482	}
6483
6484	/* svc_state between 0 - 0xff is mandatory */
6485	if (sscanf(pos, "%x", &svc_state) != 1 || svc_state > 0xff)
6486		return -1;
6487
6488	pos = os_strchr(pos, ' ');
6489	if (pos == NULL)
6490		return -1;
6491
6492	/* config_methods is mandatory */
6493	pos++;
6494	if (sscanf(pos, "%x", &config_methods) != 1)
6495		return -1;
6496
6497	if (!(config_methods &
6498	      (WPS_CONFIG_DISPLAY | WPS_CONFIG_KEYPAD | WPS_CONFIG_P2PS)))
6499		return -1;
6500
6501	pos = os_strchr(pos, ' ');
6502	if (pos == NULL)
6503		return -1;
6504
6505	pos++;
6506	adv_str = pos;
6507
6508	/* Advertisement string is mandatory */
6509	if (!pos[0] || pos[0] == ' ')
6510		return -1;
6511
6512	/* Terminate svc string */
6513	pos = os_strchr(pos, ' ');
6514	if (pos != NULL)
6515		*pos++ = '\0';
6516
6517	cpt_prio_str = (pos && pos[0]) ? os_strstr(pos, "cpt=") : NULL;
6518	if (cpt_prio_str) {
6519		pos = os_strchr(pos, ' ');
6520		if (pos != NULL)
6521			*pos++ = '\0';
6522
6523		if (p2ps_ctrl_parse_cpt_priority(cpt_prio_str + 4, cpt_prio))
6524			return -1;
6525	} else {
6526		cpt_prio[0] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
6527		cpt_prio[1] = 0;
6528	}
6529
6530	/* Service and Response Information are optional */
6531	if (pos && pos[0]) {
6532		size_t len;
6533
6534		/* Note the bare ' included, which cannot exist legally
6535		 * in unescaped string. */
6536		svc_info = os_strstr(pos, "svc_info='");
6537
6538		if (svc_info) {
6539			svc_info += 9;
6540			len = os_strlen(svc_info);
6541			utf8_unescape(svc_info, len, svc_info, len);
6542		}
6543	}
6544
6545	return wpas_p2p_service_add_asp(wpa_s, auto_accept, adv_id, adv_str,
6546					(u8) svc_state, (u16) config_methods,
6547					svc_info, cpt_prio);
6548}
6549
6550
6551static int p2p_ctrl_service_add(struct wpa_supplicant *wpa_s, char *cmd)
6552{
6553	char *pos;
6554
6555	pos = os_strchr(cmd, ' ');
6556	if (pos == NULL)
6557		return -1;
6558	*pos++ = '\0';
6559
6560	if (os_strcmp(cmd, "bonjour") == 0)
6561		return p2p_ctrl_service_add_bonjour(wpa_s, pos);
6562	if (os_strcmp(cmd, "upnp") == 0)
6563		return p2p_ctrl_service_add_upnp(wpa_s, pos);
6564	if (os_strcmp(cmd, "asp") == 0)
6565		return p2p_ctrl_service_add_asp(wpa_s, 0, pos);
6566	wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
6567	return -1;
6568}
6569
6570
6571static int p2p_ctrl_service_del_bonjour(struct wpa_supplicant *wpa_s,
6572					char *cmd)
6573{
6574	size_t len;
6575	struct wpabuf *query;
6576	int ret;
6577
6578	len = os_strlen(cmd);
6579	if (len & 1)
6580		return -1;
6581	len /= 2;
6582	query = wpabuf_alloc(len);
6583	if (query == NULL)
6584		return -1;
6585	if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
6586		wpabuf_free(query);
6587		return -1;
6588	}
6589
6590	ret = wpas_p2p_service_del_bonjour(wpa_s, query);
6591	wpabuf_free(query);
6592	return ret;
6593}
6594
6595
6596static int p2p_ctrl_service_del_upnp(struct wpa_supplicant *wpa_s, char *cmd)
6597{
6598	char *pos;
6599	u8 version;
6600
6601	pos = os_strchr(cmd, ' ');
6602	if (pos == NULL)
6603		return -1;
6604	*pos++ = '\0';
6605
6606	if (hexstr2bin(cmd, &version, 1) < 0)
6607		return -1;
6608
6609	return wpas_p2p_service_del_upnp(wpa_s, version, pos);
6610}
6611
6612
6613static int p2p_ctrl_service_del_asp(struct wpa_supplicant *wpa_s, char *cmd)
6614{
6615	u32 adv_id;
6616
6617	if (os_strcmp(cmd, "all") == 0) {
6618		wpas_p2p_service_flush_asp(wpa_s);
6619		return 0;
6620	}
6621
6622	if (sscanf(cmd, "%x", &adv_id) != 1)
6623		return -1;
6624
6625	return wpas_p2p_service_del_asp(wpa_s, adv_id);
6626}
6627
6628
6629static int p2p_ctrl_service_del(struct wpa_supplicant *wpa_s, char *cmd)
6630{
6631	char *pos;
6632
6633	pos = os_strchr(cmd, ' ');
6634	if (pos == NULL)
6635		return -1;
6636	*pos++ = '\0';
6637
6638	if (os_strcmp(cmd, "bonjour") == 0)
6639		return p2p_ctrl_service_del_bonjour(wpa_s, pos);
6640	if (os_strcmp(cmd, "upnp") == 0)
6641		return p2p_ctrl_service_del_upnp(wpa_s, pos);
6642	if (os_strcmp(cmd, "asp") == 0)
6643		return p2p_ctrl_service_del_asp(wpa_s, pos);
6644	wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
6645	return -1;
6646}
6647
6648
6649static int p2p_ctrl_service_replace(struct wpa_supplicant *wpa_s, char *cmd)
6650{
6651	char *pos;
6652
6653	pos = os_strchr(cmd, ' ');
6654	if (pos == NULL)
6655		return -1;
6656	*pos++ = '\0';
6657
6658	if (os_strcmp(cmd, "asp") == 0)
6659		return p2p_ctrl_service_add_asp(wpa_s, 1, pos);
6660
6661	wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
6662	return -1;
6663}
6664
6665
6666static int p2p_ctrl_reject(struct wpa_supplicant *wpa_s, char *cmd)
6667{
6668	u8 addr[ETH_ALEN];
6669
6670	/* <addr> */
6671
6672	if (hwaddr_aton(cmd, addr))
6673		return -1;
6674
6675	return wpas_p2p_reject(wpa_s, addr);
6676}
6677
6678
6679static int p2p_ctrl_invite_persistent(struct wpa_supplicant *wpa_s, char *cmd)
6680{
6681	char *pos;
6682	int id;
6683	struct wpa_ssid *ssid;
6684	u8 *_peer = NULL, peer[ETH_ALEN];
6685	int freq = 0, pref_freq = 0;
6686	int ht40, vht, he, max_oper_chwidth, chwidth = 0, freq2 = 0;
6687	int edmg;
6688	bool allow_6ghz;
6689
6690	id = atoi(cmd);
6691	pos = os_strstr(cmd, " peer=");
6692	if (pos) {
6693		pos += 6;
6694		if (hwaddr_aton(pos, peer))
6695			return -1;
6696		_peer = peer;
6697	}
6698	ssid = wpa_config_get_network(wpa_s->conf, id);
6699	if (ssid == NULL || ssid->disabled != 2) {
6700		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
6701			   "for persistent P2P group",
6702			   id);
6703		return -1;
6704	}
6705
6706	pos = os_strstr(cmd, " freq=");
6707	if (pos) {
6708		pos += 6;
6709		freq = atoi(pos);
6710		if (freq <= 0)
6711			return -1;
6712	}
6713
6714	pos = os_strstr(cmd, " pref=");
6715	if (pos) {
6716		pos += 6;
6717		pref_freq = atoi(pos);
6718		if (pref_freq <= 0)
6719			return -1;
6720	}
6721
6722	vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
6723	ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
6724		vht;
6725	he = (os_strstr(cmd, " he") != NULL) || wpa_s->conf->p2p_go_he;
6726	edmg = (os_strstr(cmd, " edmg") != NULL) || wpa_s->conf->p2p_go_edmg;
6727
6728	pos = os_strstr(cmd, "freq2=");
6729	if (pos)
6730		freq2 = atoi(pos + 6);
6731
6732	pos = os_strstr(cmd, " max_oper_chwidth=");
6733	if (pos)
6734		chwidth = atoi(pos + 18);
6735
6736	max_oper_chwidth = parse_freq(chwidth, freq2);
6737	if (max_oper_chwidth < 0)
6738		return -1;
6739
6740	allow_6ghz = os_strstr(cmd, " allow_6ghz") != NULL;
6741
6742	if (allow_6ghz && chwidth == 40)
6743		max_oper_chwidth = CHANWIDTH_40MHZ_6GHZ;
6744
6745	return wpas_p2p_invite(wpa_s, _peer, ssid, NULL, freq, freq2, ht40, vht,
6746			       max_oper_chwidth, pref_freq, he, edmg,
6747			       allow_6ghz);
6748}
6749
6750
6751static int p2p_ctrl_invite_group(struct wpa_supplicant *wpa_s, char *cmd)
6752{
6753	char *pos;
6754	u8 peer[ETH_ALEN], go_dev_addr[ETH_ALEN], *go_dev = NULL;
6755	bool allow_6ghz;
6756
6757	pos = os_strstr(cmd, " peer=");
6758	if (!pos)
6759		return -1;
6760
6761	*pos = '\0';
6762	pos += 6;
6763	if (hwaddr_aton(pos, peer)) {
6764		wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'", pos);
6765		return -1;
6766	}
6767
6768	allow_6ghz = os_strstr(pos, " allow_6ghz") != NULL;
6769
6770	pos = os_strstr(pos, " go_dev_addr=");
6771	if (pos) {
6772		pos += 13;
6773		if (hwaddr_aton(pos, go_dev_addr)) {
6774			wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'",
6775				   pos);
6776			return -1;
6777		}
6778		go_dev = go_dev_addr;
6779	}
6780
6781	return wpas_p2p_invite_group(wpa_s, cmd, peer, go_dev, allow_6ghz);
6782}
6783
6784
6785static int p2p_ctrl_invite(struct wpa_supplicant *wpa_s, char *cmd)
6786{
6787	if (os_strncmp(cmd, "persistent=", 11) == 0)
6788		return p2p_ctrl_invite_persistent(wpa_s, cmd + 11);
6789	if (os_strncmp(cmd, "group=", 6) == 0)
6790		return p2p_ctrl_invite_group(wpa_s, cmd + 6);
6791
6792	return -1;
6793}
6794
6795
6796static int p2p_ctrl_group_add_persistent(struct wpa_supplicant *wpa_s,
6797					 int id, int freq, int vht_center_freq2,
6798					 int ht40, int vht, int vht_chwidth,
6799					 int he, int edmg, bool allow_6ghz)
6800{
6801	struct wpa_ssid *ssid;
6802
6803	ssid = wpa_config_get_network(wpa_s->conf, id);
6804	if (ssid == NULL || ssid->disabled != 2) {
6805		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
6806			   "for persistent P2P group",
6807			   id);
6808		return -1;
6809	}
6810
6811	return wpas_p2p_group_add_persistent(wpa_s, ssid, 0, freq,
6812					     vht_center_freq2, 0, ht40, vht,
6813					     vht_chwidth, he, edmg,
6814					     NULL, 0, 0, allow_6ghz);
6815}
6816
6817
6818static int p2p_ctrl_group_add(struct wpa_supplicant *wpa_s, char *cmd)
6819{
6820	int freq = 0, persistent = 0, group_id = -1;
6821	bool allow_6ghz = false;
6822	int vht = wpa_s->conf->p2p_go_vht;
6823	int ht40 = wpa_s->conf->p2p_go_ht40 || vht;
6824	int he = wpa_s->conf->p2p_go_he;
6825	int edmg = wpa_s->conf->p2p_go_edmg;
6826	int max_oper_chwidth, chwidth = 0, freq2 = 0;
6827	char *token, *context = NULL;
6828#ifdef CONFIG_ACS
6829	int acs = 0;
6830#endif /* CONFIG_ACS */
6831
6832	while ((token = str_token(cmd, " ", &context))) {
6833		if (sscanf(token, "freq2=%d", &freq2) == 1 ||
6834		    sscanf(token, "persistent=%d", &group_id) == 1 ||
6835		    sscanf(token, "max_oper_chwidth=%d", &chwidth) == 1) {
6836			continue;
6837#ifdef CONFIG_ACS
6838		} else if (os_strcmp(token, "freq=acs") == 0) {
6839			acs = 1;
6840#endif /* CONFIG_ACS */
6841		} else if (sscanf(token, "freq=%d", &freq) == 1) {
6842			continue;
6843		} else if (os_strcmp(token, "ht40") == 0) {
6844			ht40 = 1;
6845		} else if (os_strcmp(token, "vht") == 0) {
6846			vht = 1;
6847			ht40 = 1;
6848		} else if (os_strcmp(token, "he") == 0) {
6849			he = 1;
6850		} else if (os_strcmp(token, "edmg") == 0) {
6851			edmg = 1;
6852		} else if (os_strcmp(token, "persistent") == 0) {
6853			persistent = 1;
6854		} else if (os_strcmp(token, "allow_6ghz") == 0) {
6855			allow_6ghz = true;
6856		} else {
6857			wpa_printf(MSG_DEBUG,
6858				   "CTRL: Invalid P2P_GROUP_ADD parameter: '%s'",
6859				   token);
6860			return -1;
6861		}
6862	}
6863
6864#ifdef CONFIG_ACS
6865	if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_ACS_OFFLOAD) &&
6866	    (acs || freq == 2 || freq == 5)) {
6867		if (freq == 2 && wpa_s->best_24_freq <= 0) {
6868			wpa_s->p2p_go_acs_band = HOSTAPD_MODE_IEEE80211G;
6869			wpa_s->p2p_go_do_acs = 1;
6870			freq = 0;
6871		} else if (freq == 5 && wpa_s->best_5_freq <= 0) {
6872			wpa_s->p2p_go_acs_band = HOSTAPD_MODE_IEEE80211A;
6873			wpa_s->p2p_go_do_acs = 1;
6874			freq = 0;
6875		} else {
6876			wpa_s->p2p_go_acs_band = HOSTAPD_MODE_IEEE80211ANY;
6877			wpa_s->p2p_go_do_acs = 1;
6878		}
6879	} else {
6880		wpa_s->p2p_go_do_acs = 0;
6881	}
6882#endif /* CONFIG_ACS */
6883
6884	max_oper_chwidth = parse_freq(chwidth, freq2);
6885	if (max_oper_chwidth < 0)
6886		return -1;
6887
6888	if (allow_6ghz && chwidth == 40)
6889		max_oper_chwidth = CHANWIDTH_40MHZ_6GHZ;
6890
6891	/* Allow DFS to be used for Autonomous GO */
6892	wpa_s->p2p_go_allow_dfs = !!(wpa_s->drv_flags &
6893				     WPA_DRIVER_FLAGS_DFS_OFFLOAD);
6894
6895	if (group_id >= 0)
6896		return p2p_ctrl_group_add_persistent(wpa_s, group_id,
6897						     freq, freq2, ht40, vht,
6898						     max_oper_chwidth, he,
6899						     edmg, allow_6ghz);
6900
6901	return wpas_p2p_group_add(wpa_s, persistent, freq, freq2, ht40, vht,
6902				  max_oper_chwidth, he, edmg, allow_6ghz);
6903}
6904
6905
6906static int p2p_ctrl_group_member(struct wpa_supplicant *wpa_s, const char *cmd,
6907				 char *buf, size_t buflen)
6908{
6909	u8 dev_addr[ETH_ALEN];
6910	struct wpa_ssid *ssid;
6911	int res;
6912	const u8 *iaddr;
6913
6914	ssid = wpa_s->current_ssid;
6915	if (!wpa_s->global->p2p || !ssid || ssid->mode != WPAS_MODE_P2P_GO ||
6916	    hwaddr_aton(cmd, dev_addr))
6917		return -1;
6918
6919	iaddr = p2p_group_get_client_interface_addr(wpa_s->p2p_group, dev_addr);
6920	if (!iaddr)
6921		return -1;
6922	res = os_snprintf(buf, buflen, MACSTR, MAC2STR(iaddr));
6923	if (os_snprintf_error(buflen, res))
6924		return -1;
6925	return res;
6926}
6927
6928
6929static int wpas_find_p2p_dev_addr_bss(struct wpa_global *global,
6930				      const u8 *p2p_dev_addr)
6931{
6932	struct wpa_supplicant *wpa_s;
6933
6934	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
6935		if (wpa_bss_get_p2p_dev_addr(wpa_s, p2p_dev_addr))
6936			return 1;
6937	}
6938
6939	return 0;
6940}
6941
6942
6943static int p2p_ctrl_peer(struct wpa_supplicant *wpa_s, char *cmd,
6944			 char *buf, size_t buflen)
6945{
6946	u8 addr[ETH_ALEN], *addr_ptr, group_capab;
6947	int next, res;
6948	const struct p2p_peer_info *info;
6949	char *pos, *end;
6950	char devtype[WPS_DEV_TYPE_BUFSIZE];
6951	struct wpa_ssid *ssid;
6952	size_t i;
6953
6954	if (!wpa_s->global->p2p)
6955		return -1;
6956
6957	if (os_strcmp(cmd, "FIRST") == 0) {
6958		addr_ptr = NULL;
6959		next = 0;
6960	} else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
6961		if (hwaddr_aton(cmd + 5, addr) < 0)
6962			return -1;
6963		addr_ptr = addr;
6964		next = 1;
6965	} else {
6966		if (hwaddr_aton(cmd, addr) < 0)
6967			return -1;
6968		addr_ptr = addr;
6969		next = 0;
6970	}
6971
6972	info = p2p_get_peer_info(wpa_s->global->p2p, addr_ptr, next);
6973	if (info == NULL)
6974		return -1;
6975	group_capab = info->group_capab;
6976
6977	if (group_capab &&
6978	    !wpas_find_p2p_dev_addr_bss(wpa_s->global, info->p2p_device_addr)) {
6979		wpa_printf(MSG_DEBUG,
6980			   "P2P: Could not find any BSS with p2p_dev_addr "
6981			   MACSTR ", hence override group_capab from 0x%x to 0",
6982			   MAC2STR(info->p2p_device_addr), group_capab);
6983		group_capab = 0;
6984	}
6985
6986	pos = buf;
6987	end = buf + buflen;
6988
6989	res = os_snprintf(pos, end - pos, MACSTR "\n"
6990			  "pri_dev_type=%s\n"
6991			  "device_name=%s\n"
6992			  "manufacturer=%s\n"
6993			  "model_name=%s\n"
6994			  "model_number=%s\n"
6995			  "serial_number=%s\n"
6996			  "config_methods=0x%x\n"
6997			  "dev_capab=0x%x\n"
6998			  "group_capab=0x%x\n"
6999			  "level=%d\n",
7000			  MAC2STR(info->p2p_device_addr),
7001			  wps_dev_type_bin2str(info->pri_dev_type,
7002					       devtype, sizeof(devtype)),
7003			  info->device_name,
7004			  info->manufacturer,
7005			  info->model_name,
7006			  info->model_number,
7007			  info->serial_number,
7008			  info->config_methods,
7009			  info->dev_capab,
7010			  group_capab,
7011			  info->level);
7012	if (os_snprintf_error(end - pos, res))
7013		return pos - buf;
7014	pos += res;
7015
7016	for (i = 0; i < info->wps_sec_dev_type_list_len / WPS_DEV_TYPE_LEN; i++)
7017	{
7018		const u8 *t;
7019		t = &info->wps_sec_dev_type_list[i * WPS_DEV_TYPE_LEN];
7020		res = os_snprintf(pos, end - pos, "sec_dev_type=%s\n",
7021				  wps_dev_type_bin2str(t, devtype,
7022						       sizeof(devtype)));
7023		if (os_snprintf_error(end - pos, res))
7024			return pos - buf;
7025		pos += res;
7026	}
7027
7028	ssid = wpas_p2p_get_persistent(wpa_s, info->p2p_device_addr, NULL, 0);
7029	if (ssid) {
7030		res = os_snprintf(pos, end - pos, "persistent=%d\n", ssid->id);
7031		if (os_snprintf_error(end - pos, res))
7032			return pos - buf;
7033		pos += res;
7034	}
7035
7036	res = p2p_get_peer_info_txt(info, pos, end - pos);
7037	if (res < 0)
7038		return pos - buf;
7039	pos += res;
7040
7041	if (info->vendor_elems) {
7042		res = os_snprintf(pos, end - pos, "vendor_elems=");
7043		if (os_snprintf_error(end - pos, res))
7044			return pos - buf;
7045		pos += res;
7046
7047		pos += wpa_snprintf_hex(pos, end - pos,
7048					wpabuf_head(info->vendor_elems),
7049					wpabuf_len(info->vendor_elems));
7050
7051		res = os_snprintf(pos, end - pos, "\n");
7052		if (os_snprintf_error(end - pos, res))
7053			return pos - buf;
7054		pos += res;
7055	}
7056
7057	return pos - buf;
7058}
7059
7060
7061static int p2p_ctrl_disallow_freq(struct wpa_supplicant *wpa_s,
7062				  const char *param)
7063{
7064	unsigned int i;
7065
7066	if (wpa_s->global->p2p == NULL)
7067		return -1;
7068
7069	if (freq_range_list_parse(&wpa_s->global->p2p_disallow_freq, param) < 0)
7070		return -1;
7071
7072	for (i = 0; i < wpa_s->global->p2p_disallow_freq.num; i++) {
7073		struct wpa_freq_range *freq;
7074		freq = &wpa_s->global->p2p_disallow_freq.range[i];
7075		wpa_printf(MSG_DEBUG, "P2P: Disallowed frequency range %u-%u",
7076			   freq->min, freq->max);
7077	}
7078
7079	wpas_p2p_update_channel_list(wpa_s, WPAS_P2P_CHANNEL_UPDATE_DISALLOW);
7080	return 0;
7081}
7082
7083
7084static int p2p_ctrl_set(struct wpa_supplicant *wpa_s, char *cmd)
7085{
7086	char *param;
7087
7088	if (wpa_s->global->p2p == NULL)
7089		return -1;
7090
7091	param = os_strchr(cmd, ' ');
7092	if (param == NULL)
7093		return -1;
7094	*param++ = '\0';
7095
7096	if (os_strcmp(cmd, "discoverability") == 0) {
7097		p2p_set_client_discoverability(wpa_s->global->p2p,
7098					       atoi(param));
7099		return 0;
7100	}
7101
7102	if (os_strcmp(cmd, "managed") == 0) {
7103		p2p_set_managed_oper(wpa_s->global->p2p, atoi(param));
7104		return 0;
7105	}
7106
7107	if (os_strcmp(cmd, "listen_channel") == 0) {
7108		char *pos;
7109		u8 channel, op_class;
7110
7111		channel = atoi(param);
7112		pos = os_strchr(param, ' ');
7113		op_class = pos ? atoi(pos) : 81;
7114
7115		return p2p_set_listen_channel(wpa_s->global->p2p, op_class,
7116					      channel, 1);
7117	}
7118
7119	if (os_strcmp(cmd, "ssid_postfix") == 0) {
7120		return p2p_set_ssid_postfix(wpa_s->global->p2p, (u8 *) param,
7121					    os_strlen(param));
7122	}
7123
7124	if (os_strcmp(cmd, "noa") == 0) {
7125		char *pos;
7126		int count, start, duration;
7127		/* GO NoA parameters: count,start_offset(ms),duration(ms) */
7128		count = atoi(param);
7129		pos = os_strchr(param, ',');
7130		if (pos == NULL)
7131			return -1;
7132		pos++;
7133		start = atoi(pos);
7134		pos = os_strchr(pos, ',');
7135		if (pos == NULL)
7136			return -1;
7137		pos++;
7138		duration = atoi(pos);
7139		if (count < 0 || count > 255 || start < 0 || duration < 0)
7140			return -1;
7141		if (count == 0 && duration > 0)
7142			return -1;
7143		wpa_printf(MSG_DEBUG, "CTRL_IFACE: P2P_SET GO NoA: count=%d "
7144			   "start=%d duration=%d", count, start, duration);
7145		return wpas_p2p_set_noa(wpa_s, count, start, duration);
7146	}
7147
7148	if (os_strcmp(cmd, "ps") == 0)
7149		return wpa_drv_set_p2p_powersave(wpa_s, atoi(param), -1, -1);
7150
7151	if (os_strcmp(cmd, "oppps") == 0)
7152		return wpa_drv_set_p2p_powersave(wpa_s, -1, atoi(param), -1);
7153
7154	if (os_strcmp(cmd, "ctwindow") == 0)
7155		return wpa_drv_set_p2p_powersave(wpa_s, -1, -1, atoi(param));
7156
7157	if (os_strcmp(cmd, "disabled") == 0) {
7158		wpa_s->global->p2p_disabled = atoi(param);
7159		wpa_printf(MSG_DEBUG, "P2P functionality %s",
7160			   wpa_s->global->p2p_disabled ?
7161			   "disabled" : "enabled");
7162		if (wpa_s->global->p2p_disabled) {
7163			wpas_p2p_stop_find(wpa_s);
7164			os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
7165			p2p_flush(wpa_s->global->p2p);
7166		}
7167		return 0;
7168	}
7169
7170	if (os_strcmp(cmd, "conc_pref") == 0) {
7171		if (os_strcmp(param, "sta") == 0)
7172			wpa_s->global->conc_pref = WPA_CONC_PREF_STA;
7173		else if (os_strcmp(param, "p2p") == 0)
7174			wpa_s->global->conc_pref = WPA_CONC_PREF_P2P;
7175		else {
7176			wpa_printf(MSG_INFO, "Invalid conc_pref value");
7177			return -1;
7178		}
7179		wpa_printf(MSG_DEBUG, "Single channel concurrency preference: "
7180			   "%s", param);
7181		return 0;
7182	}
7183
7184	if (os_strcmp(cmd, "force_long_sd") == 0) {
7185		wpa_s->force_long_sd = atoi(param);
7186		return 0;
7187	}
7188
7189	if (os_strcmp(cmd, "peer_filter") == 0) {
7190		u8 addr[ETH_ALEN];
7191		if (hwaddr_aton(param, addr))
7192			return -1;
7193		p2p_set_peer_filter(wpa_s->global->p2p, addr);
7194		return 0;
7195	}
7196
7197	if (os_strcmp(cmd, "cross_connect") == 0)
7198		return wpas_p2p_set_cross_connect(wpa_s, atoi(param));
7199
7200	if (os_strcmp(cmd, "go_apsd") == 0) {
7201		if (os_strcmp(param, "disable") == 0)
7202			wpa_s->set_ap_uapsd = 0;
7203		else {
7204			wpa_s->set_ap_uapsd = 1;
7205			wpa_s->ap_uapsd = atoi(param);
7206		}
7207		return 0;
7208	}
7209
7210	if (os_strcmp(cmd, "client_apsd") == 0) {
7211		if (os_strcmp(param, "disable") == 0)
7212			wpa_s->set_sta_uapsd = 0;
7213		else {
7214			int be, bk, vi, vo;
7215			char *pos;
7216			/* format: BE,BK,VI,VO;max SP Length */
7217			be = atoi(param);
7218			pos = os_strchr(param, ',');
7219			if (pos == NULL)
7220				return -1;
7221			pos++;
7222			bk = atoi(pos);
7223			pos = os_strchr(pos, ',');
7224			if (pos == NULL)
7225				return -1;
7226			pos++;
7227			vi = atoi(pos);
7228			pos = os_strchr(pos, ',');
7229			if (pos == NULL)
7230				return -1;
7231			pos++;
7232			vo = atoi(pos);
7233			/* ignore max SP Length for now */
7234
7235			wpa_s->set_sta_uapsd = 1;
7236			wpa_s->sta_uapsd = 0;
7237			if (be)
7238				wpa_s->sta_uapsd |= BIT(0);
7239			if (bk)
7240				wpa_s->sta_uapsd |= BIT(1);
7241			if (vi)
7242				wpa_s->sta_uapsd |= BIT(2);
7243			if (vo)
7244				wpa_s->sta_uapsd |= BIT(3);
7245		}
7246		return 0;
7247	}
7248
7249	if (os_strcmp(cmd, "disallow_freq") == 0)
7250		return p2p_ctrl_disallow_freq(wpa_s, param);
7251
7252	if (os_strcmp(cmd, "disc_int") == 0) {
7253		int min_disc_int, max_disc_int, max_disc_tu;
7254		char *pos;
7255
7256		pos = param;
7257
7258		min_disc_int = atoi(pos);
7259		pos = os_strchr(pos, ' ');
7260		if (pos == NULL)
7261			return -1;
7262		*pos++ = '\0';
7263
7264		max_disc_int = atoi(pos);
7265		pos = os_strchr(pos, ' ');
7266		if (pos == NULL)
7267			return -1;
7268		*pos++ = '\0';
7269
7270		max_disc_tu = atoi(pos);
7271
7272		return p2p_set_disc_int(wpa_s->global->p2p, min_disc_int,
7273					max_disc_int, max_disc_tu);
7274	}
7275
7276	if (os_strcmp(cmd, "per_sta_psk") == 0) {
7277		wpa_s->global->p2p_per_sta_psk = !!atoi(param);
7278		return 0;
7279	}
7280
7281#ifdef CONFIG_WPS_NFC
7282	if (os_strcmp(cmd, "nfc_tag") == 0)
7283		return wpas_p2p_nfc_tag_enabled(wpa_s, !!atoi(param));
7284#endif /* CONFIG_WPS_NFC */
7285
7286	if (os_strcmp(cmd, "disable_ip_addr_req") == 0) {
7287		wpa_s->p2p_disable_ip_addr_req = !!atoi(param);
7288		return 0;
7289	}
7290
7291	if (os_strcmp(cmd, "override_pref_op_chan") == 0) {
7292		int op_class, chan;
7293
7294		op_class = atoi(param);
7295		param = os_strchr(param, ':');
7296		if (!param)
7297			return -1;
7298		param++;
7299		chan = atoi(param);
7300		p2p_set_override_pref_op_chan(wpa_s->global->p2p, op_class,
7301					      chan);
7302		return 0;
7303	}
7304
7305	wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown P2P_SET field value '%s'",
7306		   cmd);
7307
7308	return -1;
7309}
7310
7311
7312static void p2p_ctrl_flush(struct wpa_supplicant *wpa_s)
7313{
7314	os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
7315	wpa_s->force_long_sd = 0;
7316
7317#ifdef CONFIG_TESTING_OPTIONS
7318	os_free(wpa_s->get_pref_freq_list_override);
7319	wpa_s->get_pref_freq_list_override = NULL;
7320#endif /* CONFIG_TESTING_OPTIONS */
7321
7322	wpas_p2p_stop_find(wpa_s);
7323	wpa_s->parent->p2ps_method_config_any = 0;
7324	if (wpa_s->global->p2p)
7325		p2p_flush(wpa_s->global->p2p);
7326}
7327
7328
7329static int p2p_ctrl_presence_req(struct wpa_supplicant *wpa_s, char *cmd)
7330{
7331	char *pos, *pos2;
7332	unsigned int dur1 = 0, int1 = 0, dur2 = 0, int2 = 0;
7333
7334	if (cmd[0]) {
7335		pos = os_strchr(cmd, ' ');
7336		if (pos == NULL)
7337			return -1;
7338		*pos++ = '\0';
7339		dur1 = atoi(cmd);
7340
7341		pos2 = os_strchr(pos, ' ');
7342		if (pos2)
7343			*pos2++ = '\0';
7344		int1 = atoi(pos);
7345	} else
7346		pos2 = NULL;
7347
7348	if (pos2) {
7349		pos = os_strchr(pos2, ' ');
7350		if (pos == NULL)
7351			return -1;
7352		*pos++ = '\0';
7353		dur2 = atoi(pos2);
7354		int2 = atoi(pos);
7355	}
7356
7357	return wpas_p2p_presence_req(wpa_s, dur1, int1, dur2, int2);
7358}
7359
7360
7361static int p2p_ctrl_ext_listen(struct wpa_supplicant *wpa_s, char *cmd)
7362{
7363	char *pos;
7364	unsigned int period = 0, interval = 0;
7365
7366	if (cmd[0]) {
7367		pos = os_strchr(cmd, ' ');
7368		if (pos == NULL)
7369			return -1;
7370		*pos++ = '\0';
7371		period = atoi(cmd);
7372		interval = atoi(pos);
7373	}
7374
7375	return wpas_p2p_ext_listen(wpa_s, period, interval);
7376}
7377
7378
7379static int p2p_ctrl_remove_client(struct wpa_supplicant *wpa_s, const char *cmd)
7380{
7381	const char *pos;
7382	u8 peer[ETH_ALEN];
7383	int iface_addr = 0;
7384
7385	pos = cmd;
7386	if (os_strncmp(pos, "iface=", 6) == 0) {
7387		iface_addr = 1;
7388		pos += 6;
7389	}
7390	if (hwaddr_aton(pos, peer))
7391		return -1;
7392
7393	wpas_p2p_remove_client(wpa_s, peer, iface_addr);
7394	return 0;
7395}
7396
7397
7398static int p2p_ctrl_iface_p2p_lo_start(struct wpa_supplicant *wpa_s, char *cmd)
7399{
7400	int freq = 0, period = 0, interval = 0, count = 0;
7401
7402	if (sscanf(cmd, "%d %d %d %d", &freq, &period, &interval, &count) != 4)
7403	{
7404		wpa_printf(MSG_DEBUG,
7405			   "CTRL: Invalid P2P LO Start parameter: '%s'", cmd);
7406		return -1;
7407	}
7408
7409	return wpas_p2p_lo_start(wpa_s, freq, period, interval, count);
7410}
7411
7412#endif /* CONFIG_P2P */
7413
7414
7415static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s, char *val)
7416{
7417	struct wpa_freq_range_list ranges;
7418	int *freqs = NULL;
7419	struct hostapd_hw_modes *mode;
7420	u16 i;
7421
7422	if (wpa_s->hw.modes == NULL)
7423		return NULL;
7424
7425	os_memset(&ranges, 0, sizeof(ranges));
7426	if (freq_range_list_parse(&ranges, val) < 0)
7427		return NULL;
7428
7429	for (i = 0; i < wpa_s->hw.num_modes; i++) {
7430		int j;
7431
7432		mode = &wpa_s->hw.modes[i];
7433		for (j = 0; j < mode->num_channels; j++) {
7434			unsigned int freq;
7435
7436			if (mode->channels[j].flag & HOSTAPD_CHAN_DISABLED)
7437				continue;
7438
7439			freq = mode->channels[j].freq;
7440			if (!freq_range_list_includes(&ranges, freq))
7441				continue;
7442
7443			int_array_add_unique(&freqs, freq);
7444		}
7445	}
7446
7447	os_free(ranges.range);
7448	return freqs;
7449}
7450
7451
7452#ifdef CONFIG_INTERWORKING
7453
7454static int ctrl_interworking_select(struct wpa_supplicant *wpa_s, char *param)
7455{
7456	int auto_sel = 0;
7457	int *freqs = NULL;
7458
7459	if (param) {
7460		char *pos;
7461
7462		auto_sel = os_strstr(param, "auto") != NULL;
7463
7464		pos = os_strstr(param, "freq=");
7465		if (pos) {
7466			freqs = freq_range_to_channel_list(wpa_s, pos + 5);
7467			if (freqs == NULL)
7468				return -1;
7469		}
7470
7471	}
7472
7473	return interworking_select(wpa_s, auto_sel, freqs);
7474}
7475
7476
7477static int ctrl_interworking_connect(struct wpa_supplicant *wpa_s, char *dst,
7478				     int only_add)
7479{
7480	u8 bssid[ETH_ALEN];
7481	struct wpa_bss *bss;
7482
7483	if (hwaddr_aton(dst, bssid)) {
7484		wpa_printf(MSG_DEBUG, "Invalid BSSID '%s'", dst);
7485		return -1;
7486	}
7487
7488	bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
7489	if (bss == NULL) {
7490		wpa_printf(MSG_DEBUG, "Could not find BSS " MACSTR,
7491			   MAC2STR(bssid));
7492		return -1;
7493	}
7494
7495	if (bss->ssid_len == 0) {
7496		int found = 0;
7497
7498		wpa_printf(MSG_DEBUG, "Selected BSS entry for " MACSTR
7499			   " does not have SSID information", MAC2STR(bssid));
7500
7501		dl_list_for_each_reverse(bss, &wpa_s->bss, struct wpa_bss,
7502					 list) {
7503			if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0 &&
7504			    bss->ssid_len > 0) {
7505				found = 1;
7506				break;
7507			}
7508		}
7509
7510		if (!found)
7511			return -1;
7512		wpa_printf(MSG_DEBUG,
7513			   "Found another matching BSS entry with SSID");
7514	}
7515
7516	return interworking_connect(wpa_s, bss, only_add);
7517}
7518
7519
7520static int get_anqp(struct wpa_supplicant *wpa_s, char *dst)
7521{
7522	u8 dst_addr[ETH_ALEN];
7523	int used, freq = 0;
7524	char *pos;
7525#define MAX_ANQP_INFO_ID 100
7526	u16 id[MAX_ANQP_INFO_ID];
7527	size_t num_id = 0;
7528	u32 subtypes = 0;
7529	u32 mbo_subtypes = 0;
7530
7531	used = hwaddr_aton2(dst, dst_addr);
7532	if (used < 0)
7533		return -1;
7534	pos = dst + used;
7535	if (*pos == ' ')
7536		pos++;
7537
7538	if (os_strncmp(pos, "freq=", 5) == 0) {
7539		freq = atoi(pos + 5);
7540		pos = os_strchr(pos, ' ');
7541		if (!pos)
7542			return -1;
7543		pos++;
7544	}
7545
7546	while (num_id < MAX_ANQP_INFO_ID) {
7547		if (os_strncmp(pos, "hs20:", 5) == 0) {
7548#ifdef CONFIG_HS20
7549			int num = atoi(pos + 5);
7550			if (num <= 0 || num > 31)
7551				return -1;
7552			subtypes |= BIT(num);
7553#else /* CONFIG_HS20 */
7554			return -1;
7555#endif /* CONFIG_HS20 */
7556		} else if (os_strncmp(pos, "mbo:", 4) == 0) {
7557#ifdef CONFIG_MBO
7558			int num = atoi(pos + 4);
7559
7560			if (num <= 0 || num > MAX_MBO_ANQP_SUBTYPE)
7561				return -1;
7562			mbo_subtypes |= BIT(num);
7563#else /* CONFIG_MBO */
7564			return -1;
7565#endif /* CONFIG_MBO */
7566		} else {
7567			id[num_id] = atoi(pos);
7568			if (id[num_id])
7569				num_id++;
7570		}
7571		pos = os_strchr(pos + 1, ',');
7572		if (pos == NULL)
7573			break;
7574		pos++;
7575	}
7576
7577	if (num_id == 0 && !subtypes && !mbo_subtypes)
7578		return -1;
7579
7580	return anqp_send_req(wpa_s, dst_addr, freq, id, num_id, subtypes,
7581			     mbo_subtypes);
7582}
7583
7584
7585static int gas_request(struct wpa_supplicant *wpa_s, char *cmd)
7586{
7587	u8 dst_addr[ETH_ALEN];
7588	struct wpabuf *advproto, *query = NULL;
7589	int used, ret = -1;
7590	char *pos, *end;
7591	size_t len;
7592
7593	used = hwaddr_aton2(cmd, dst_addr);
7594	if (used < 0)
7595		return -1;
7596
7597	pos = cmd + used;
7598	while (*pos == ' ')
7599		pos++;
7600
7601	/* Advertisement Protocol ID */
7602	end = os_strchr(pos, ' ');
7603	if (end)
7604		len = end - pos;
7605	else
7606		len = os_strlen(pos);
7607	if (len & 0x01)
7608		return -1;
7609	len /= 2;
7610	if (len == 0)
7611		return -1;
7612	advproto = wpabuf_alloc(len);
7613	if (advproto == NULL)
7614		return -1;
7615	if (hexstr2bin(pos, wpabuf_put(advproto, len), len) < 0)
7616		goto fail;
7617
7618	if (end) {
7619		/* Optional Query Request */
7620		pos = end + 1;
7621		while (*pos == ' ')
7622			pos++;
7623
7624		len = os_strlen(pos);
7625		if (len) {
7626			if (len & 0x01)
7627				goto fail;
7628			len /= 2;
7629			if (len == 0)
7630				goto fail;
7631			query = wpabuf_alloc(len);
7632			if (query == NULL)
7633				goto fail;
7634			if (hexstr2bin(pos, wpabuf_put(query, len), len) < 0)
7635				goto fail;
7636		}
7637	}
7638
7639	ret = gas_send_request(wpa_s, dst_addr, advproto, query);
7640
7641fail:
7642	wpabuf_free(advproto);
7643	wpabuf_free(query);
7644
7645	return ret;
7646}
7647
7648
7649static int gas_response_get(struct wpa_supplicant *wpa_s, char *cmd, char *buf,
7650			    size_t buflen)
7651{
7652	u8 addr[ETH_ALEN];
7653	int dialog_token;
7654	int used;
7655	char *pos;
7656	size_t resp_len, start, requested_len;
7657	struct wpabuf *resp;
7658	int ret;
7659
7660	used = hwaddr_aton2(cmd, addr);
7661	if (used < 0)
7662		return -1;
7663
7664	pos = cmd + used;
7665	while (*pos == ' ')
7666		pos++;
7667	dialog_token = atoi(pos);
7668
7669	if (wpa_s->last_gas_resp &&
7670	    os_memcmp(addr, wpa_s->last_gas_addr, ETH_ALEN) == 0 &&
7671	    dialog_token == wpa_s->last_gas_dialog_token)
7672		resp = wpa_s->last_gas_resp;
7673	else if (wpa_s->prev_gas_resp &&
7674		 os_memcmp(addr, wpa_s->prev_gas_addr, ETH_ALEN) == 0 &&
7675		 dialog_token == wpa_s->prev_gas_dialog_token)
7676		resp = wpa_s->prev_gas_resp;
7677	else
7678		return -1;
7679
7680	resp_len = wpabuf_len(resp);
7681	start = 0;
7682	requested_len = resp_len;
7683
7684	pos = os_strchr(pos, ' ');
7685	if (pos) {
7686		start = atoi(pos);
7687		if (start > resp_len)
7688			return os_snprintf(buf, buflen, "FAIL-Invalid range");
7689		pos = os_strchr(pos, ',');
7690		if (pos == NULL)
7691			return -1;
7692		pos++;
7693		requested_len = atoi(pos);
7694		if (start + requested_len > resp_len)
7695			return os_snprintf(buf, buflen, "FAIL-Invalid range");
7696	}
7697
7698	if (requested_len * 2 + 1 > buflen)
7699		return os_snprintf(buf, buflen, "FAIL-Too long response");
7700
7701	ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(resp) + start,
7702			       requested_len);
7703
7704	if (start + requested_len == resp_len) {
7705		/*
7706		 * Free memory by dropping the response after it has been
7707		 * fetched.
7708		 */
7709		if (resp == wpa_s->prev_gas_resp) {
7710			wpabuf_free(wpa_s->prev_gas_resp);
7711			wpa_s->prev_gas_resp = NULL;
7712		} else {
7713			wpabuf_free(wpa_s->last_gas_resp);
7714			wpa_s->last_gas_resp = NULL;
7715		}
7716	}
7717
7718	return ret;
7719}
7720#endif /* CONFIG_INTERWORKING */
7721
7722
7723#ifdef CONFIG_HS20
7724
7725static int get_hs20_anqp(struct wpa_supplicant *wpa_s, char *dst)
7726{
7727	u8 dst_addr[ETH_ALEN];
7728	int used;
7729	char *pos;
7730	u32 subtypes = 0;
7731
7732	used = hwaddr_aton2(dst, dst_addr);
7733	if (used < 0)
7734		return -1;
7735	pos = dst + used;
7736	if (*pos == ' ')
7737		pos++;
7738	for (;;) {
7739		int num = atoi(pos);
7740		if (num <= 0 || num > 31)
7741			return -1;
7742		subtypes |= BIT(num);
7743		pos = os_strchr(pos + 1, ',');
7744		if (pos == NULL)
7745			break;
7746		pos++;
7747	}
7748
7749	if (subtypes == 0)
7750		return -1;
7751
7752	return hs20_anqp_send_req(wpa_s, dst_addr, subtypes, NULL, 0, 0);
7753}
7754
7755
7756static int hs20_nai_home_realm_list(struct wpa_supplicant *wpa_s,
7757				    const u8 *addr, const char *realm)
7758{
7759	u8 *buf;
7760	size_t rlen, len;
7761	int ret;
7762
7763	rlen = os_strlen(realm);
7764	len = 3 + rlen;
7765	buf = os_malloc(len);
7766	if (buf == NULL)
7767		return -1;
7768	buf[0] = 1; /* NAI Home Realm Count */
7769	buf[1] = 0; /* Formatted in accordance with RFC 4282 */
7770	buf[2] = rlen;
7771	os_memcpy(buf + 3, realm, rlen);
7772
7773	ret = hs20_anqp_send_req(wpa_s, addr,
7774				 BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
7775				 buf, len, 0);
7776
7777	os_free(buf);
7778
7779	return ret;
7780}
7781
7782
7783static int hs20_get_nai_home_realm_list(struct wpa_supplicant *wpa_s,
7784					char *dst)
7785{
7786	struct wpa_cred *cred = wpa_s->conf->cred;
7787	u8 dst_addr[ETH_ALEN];
7788	int used;
7789	u8 *buf;
7790	size_t len;
7791	int ret;
7792
7793	used = hwaddr_aton2(dst, dst_addr);
7794	if (used < 0)
7795		return -1;
7796
7797	while (dst[used] == ' ')
7798		used++;
7799	if (os_strncmp(dst + used, "realm=", 6) == 0)
7800		return hs20_nai_home_realm_list(wpa_s, dst_addr,
7801						dst + used + 6);
7802
7803	len = os_strlen(dst + used);
7804
7805	if (len == 0 && cred && cred->realm)
7806		return hs20_nai_home_realm_list(wpa_s, dst_addr, cred->realm);
7807
7808	if (len & 1)
7809		return -1;
7810	len /= 2;
7811	buf = os_malloc(len);
7812	if (buf == NULL)
7813		return -1;
7814	if (hexstr2bin(dst + used, buf, len) < 0) {
7815		os_free(buf);
7816		return -1;
7817	}
7818
7819	ret = hs20_anqp_send_req(wpa_s, dst_addr,
7820				 BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
7821				 buf, len, 0);
7822	os_free(buf);
7823
7824	return ret;
7825}
7826
7827
7828static int get_hs20_icon(struct wpa_supplicant *wpa_s, char *cmd, char *reply,
7829			 int buflen)
7830{
7831	u8 dst_addr[ETH_ALEN];
7832	int used;
7833	char *ctx = NULL, *icon, *poffset, *psize;
7834
7835	used = hwaddr_aton2(cmd, dst_addr);
7836	if (used < 0)
7837		return -1;
7838	cmd += used;
7839
7840	icon = str_token(cmd, " ", &ctx);
7841	poffset = str_token(cmd, " ", &ctx);
7842	psize = str_token(cmd, " ", &ctx);
7843	if (!icon || !poffset || !psize)
7844		return -1;
7845
7846	wpa_s->fetch_osu_icon_in_progress = 0;
7847	return hs20_get_icon(wpa_s, dst_addr, icon, atoi(poffset), atoi(psize),
7848			     reply, buflen);
7849}
7850
7851
7852static int del_hs20_icon(struct wpa_supplicant *wpa_s, char *cmd)
7853{
7854	u8 dst_addr[ETH_ALEN];
7855	int used;
7856	char *icon;
7857
7858	if (!cmd[0])
7859		return hs20_del_icon(wpa_s, NULL, NULL);
7860
7861	used = hwaddr_aton2(cmd, dst_addr);
7862	if (used < 0)
7863		return -1;
7864
7865	while (cmd[used] == ' ')
7866		used++;
7867	icon = cmd[used] ? &cmd[used] : NULL;
7868
7869	return hs20_del_icon(wpa_s, dst_addr, icon);
7870}
7871
7872
7873static int hs20_icon_request(struct wpa_supplicant *wpa_s, char *cmd, int inmem)
7874{
7875	u8 dst_addr[ETH_ALEN];
7876	int used;
7877	char *icon;
7878
7879	used = hwaddr_aton2(cmd, dst_addr);
7880	if (used < 0)
7881		return -1;
7882
7883	while (cmd[used] == ' ')
7884		used++;
7885	icon = &cmd[used];
7886
7887	wpa_s->fetch_osu_icon_in_progress = 0;
7888	return hs20_anqp_send_req(wpa_s, dst_addr, BIT(HS20_STYPE_ICON_REQUEST),
7889				  (u8 *) icon, os_strlen(icon), inmem);
7890}
7891
7892#endif /* CONFIG_HS20 */
7893
7894
7895#ifdef CONFIG_AUTOSCAN
7896
7897static int wpa_supplicant_ctrl_iface_autoscan(struct wpa_supplicant *wpa_s,
7898					      char *cmd)
7899{
7900	enum wpa_states state = wpa_s->wpa_state;
7901	char *new_params = NULL;
7902
7903	if (os_strlen(cmd) > 0) {
7904		new_params = os_strdup(cmd);
7905		if (new_params == NULL)
7906			return -1;
7907	}
7908
7909	os_free(wpa_s->conf->autoscan);
7910	wpa_s->conf->autoscan = new_params;
7911
7912	if (wpa_s->conf->autoscan == NULL)
7913		autoscan_deinit(wpa_s);
7914	else if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
7915		autoscan_init(wpa_s, 1);
7916	else if (state == WPA_SCANNING)
7917		wpa_supplicant_reinit_autoscan(wpa_s);
7918	else
7919		wpa_printf(MSG_DEBUG, "No autoscan update in state %s",
7920			   wpa_supplicant_state_txt(state));
7921
7922	return 0;
7923}
7924
7925#endif /* CONFIG_AUTOSCAN */
7926
7927
7928#ifdef CONFIG_WNM
7929
7930static int wpas_ctrl_iface_wnm_sleep(struct wpa_supplicant *wpa_s, char *cmd)
7931{
7932	int enter;
7933	int intval = 0;
7934	char *pos;
7935	int ret;
7936	struct wpabuf *tfs_req = NULL;
7937
7938	if (os_strncmp(cmd, "enter", 5) == 0)
7939		enter = 1;
7940	else if (os_strncmp(cmd, "exit", 4) == 0)
7941		enter = 0;
7942	else
7943		return -1;
7944
7945	pos = os_strstr(cmd, " interval=");
7946	if (pos)
7947		intval = atoi(pos + 10);
7948
7949	pos = os_strstr(cmd, " tfs_req=");
7950	if (pos) {
7951		char *end;
7952		size_t len;
7953		pos += 9;
7954		end = os_strchr(pos, ' ');
7955		if (end)
7956			len = end - pos;
7957		else
7958			len = os_strlen(pos);
7959		if (len & 1)
7960			return -1;
7961		len /= 2;
7962		tfs_req = wpabuf_alloc(len);
7963		if (tfs_req == NULL)
7964			return -1;
7965		if (hexstr2bin(pos, wpabuf_put(tfs_req, len), len) < 0) {
7966			wpabuf_free(tfs_req);
7967			return -1;
7968		}
7969	}
7970
7971	ret = ieee802_11_send_wnmsleep_req(wpa_s, enter ? WNM_SLEEP_MODE_ENTER :
7972					   WNM_SLEEP_MODE_EXIT, intval,
7973					   tfs_req);
7974	wpabuf_free(tfs_req);
7975
7976	return ret;
7977}
7978
7979
7980static int wpas_ctrl_iface_wnm_bss_query(struct wpa_supplicant *wpa_s, char *cmd)
7981{
7982	int query_reason, list = 0;
7983	char *btm_candidates = NULL;
7984
7985	query_reason = atoi(cmd);
7986
7987	cmd = os_strchr(cmd, ' ');
7988	if (cmd) {
7989		if (os_strncmp(cmd, " list", 5) == 0)
7990			list = 1;
7991		else
7992			btm_candidates = cmd;
7993	}
7994
7995	wpa_printf(MSG_DEBUG,
7996		   "CTRL_IFACE: WNM_BSS_QUERY query_reason=%d%s",
7997		   query_reason, list ? " candidate list" : "");
7998
7999	return wnm_send_bss_transition_mgmt_query(wpa_s, query_reason,
8000						  btm_candidates,
8001						  list);
8002}
8003
8004
8005static int wpas_ctrl_iface_coloc_intf_report(struct wpa_supplicant *wpa_s,
8006					     char *cmd)
8007{
8008	struct wpabuf *elems;
8009	int ret;
8010
8011	elems = wpabuf_parse_bin(cmd);
8012	if (!elems)
8013		return -1;
8014
8015	ret = wnm_send_coloc_intf_report(wpa_s, 0, elems);
8016	wpabuf_free(elems);
8017	return ret;
8018}
8019
8020#endif /* CONFIG_WNM */
8021
8022
8023static int wpa_supplicant_signal_poll(struct wpa_supplicant *wpa_s, char *buf,
8024				      size_t buflen)
8025{
8026	struct wpa_signal_info si;
8027	int ret;
8028	char *pos, *end;
8029
8030	ret = wpa_drv_signal_poll(wpa_s, &si);
8031	if (ret)
8032		return -1;
8033
8034	pos = buf;
8035	end = buf + buflen;
8036
8037	ret = os_snprintf(pos, end - pos, "RSSI=%d\nLINKSPEED=%d\n"
8038			  "NOISE=%d\nFREQUENCY=%u\n",
8039			  si.current_signal, si.current_txrate / 1000,
8040			  si.current_noise, si.frequency);
8041	if (os_snprintf_error(end - pos, ret))
8042		return -1;
8043	pos += ret;
8044
8045	if (si.chanwidth != CHAN_WIDTH_UNKNOWN) {
8046		ret = os_snprintf(pos, end - pos, "WIDTH=%s\n",
8047				  channel_width_to_string(si.chanwidth));
8048		if (os_snprintf_error(end - pos, ret))
8049			return -1;
8050		pos += ret;
8051	}
8052
8053	if (si.center_frq1 > 0) {
8054		ret = os_snprintf(pos, end - pos, "CENTER_FRQ1=%d\n",
8055				  si.center_frq1);
8056		if (os_snprintf_error(end - pos, ret))
8057			return -1;
8058		pos += ret;
8059	}
8060
8061	if (si.center_frq2 > 0) {
8062		ret = os_snprintf(pos, end - pos, "CENTER_FRQ2=%d\n",
8063				  si.center_frq2);
8064		if (os_snprintf_error(end - pos, ret))
8065			return -1;
8066		pos += ret;
8067	}
8068
8069	if (si.avg_signal) {
8070		ret = os_snprintf(pos, end - pos,
8071				  "AVG_RSSI=%d\n", si.avg_signal);
8072		if (os_snprintf_error(end - pos, ret))
8073			return -1;
8074		pos += ret;
8075	}
8076
8077	if (si.avg_beacon_signal) {
8078		ret = os_snprintf(pos, end - pos,
8079				  "AVG_BEACON_RSSI=%d\n", si.avg_beacon_signal);
8080		if (os_snprintf_error(end - pos, ret))
8081			return -1;
8082		pos += ret;
8083	}
8084
8085	return pos - buf;
8086}
8087
8088
8089static int wpas_ctrl_iface_signal_monitor(struct wpa_supplicant *wpa_s,
8090					  const char *cmd)
8091{
8092	const char *pos;
8093	int threshold = 0;
8094	int hysteresis = 0;
8095
8096	if (wpa_s->bgscan && wpa_s->bgscan_priv) {
8097		wpa_printf(MSG_DEBUG,
8098			   "Reject SIGNAL_MONITOR command - bgscan is active");
8099		return -1;
8100	}
8101	pos = os_strstr(cmd, "THRESHOLD=");
8102	if (pos)
8103		threshold = atoi(pos + 10);
8104	pos = os_strstr(cmd, "HYSTERESIS=");
8105	if (pos)
8106		hysteresis = atoi(pos + 11);
8107	return wpa_drv_signal_monitor(wpa_s, threshold, hysteresis);
8108}
8109
8110
8111#ifdef CONFIG_TESTING_OPTIONS
8112int wpas_ctrl_iface_get_pref_freq_list_override(struct wpa_supplicant *wpa_s,
8113						enum wpa_driver_if_type if_type,
8114						unsigned int *num,
8115						unsigned int *freq_list)
8116{
8117	char *pos = wpa_s->get_pref_freq_list_override;
8118	char *end;
8119	unsigned int count = 0;
8120
8121	/* Override string format:
8122	 *  <if_type1>:<freq1>,<freq2>,... <if_type2>:... */
8123
8124	while (pos) {
8125		if (atoi(pos) == (int) if_type)
8126			break;
8127		pos = os_strchr(pos, ' ');
8128		if (pos)
8129			pos++;
8130	}
8131	if (!pos)
8132		return -1;
8133	pos = os_strchr(pos, ':');
8134	if (!pos)
8135		return -1;
8136	pos++;
8137	end = os_strchr(pos, ' ');
8138	while (pos && (!end || pos < end) && count < *num) {
8139		freq_list[count++] = atoi(pos);
8140		pos = os_strchr(pos, ',');
8141		if (pos)
8142			pos++;
8143	}
8144
8145	*num = count;
8146	return 0;
8147}
8148#endif /* CONFIG_TESTING_OPTIONS */
8149
8150
8151static int wpas_ctrl_iface_get_pref_freq_list(
8152	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
8153{
8154	unsigned int freq_list[100], num = 100, i;
8155	int ret;
8156	enum wpa_driver_if_type iface_type;
8157	char *pos, *end;
8158
8159	pos = buf;
8160	end = buf + buflen;
8161
8162	/* buf: "<interface_type>" */
8163	if (os_strcmp(cmd, "STATION") == 0)
8164		iface_type = WPA_IF_STATION;
8165	else if (os_strcmp(cmd, "AP") == 0)
8166		iface_type = WPA_IF_AP_BSS;
8167	else if (os_strcmp(cmd, "P2P_GO") == 0)
8168		iface_type = WPA_IF_P2P_GO;
8169	else if (os_strcmp(cmd, "P2P_CLIENT") == 0)
8170		iface_type = WPA_IF_P2P_CLIENT;
8171	else if (os_strcmp(cmd, "IBSS") == 0)
8172		iface_type = WPA_IF_IBSS;
8173	else if (os_strcmp(cmd, "TDLS") == 0)
8174		iface_type = WPA_IF_TDLS;
8175	else
8176		return -1;
8177
8178	wpa_printf(MSG_DEBUG,
8179		   "CTRL_IFACE: GET_PREF_FREQ_LIST iface_type=%d (%s)",
8180		   iface_type, cmd);
8181
8182	ret = wpa_drv_get_pref_freq_list(wpa_s, iface_type, &num, freq_list);
8183	if (ret)
8184		return -1;
8185
8186	for (i = 0; i < num; i++) {
8187		ret = os_snprintf(pos, end - pos, "%s%u",
8188				  i > 0 ? "," : "", freq_list[i]);
8189		if (os_snprintf_error(end - pos, ret))
8190			return -1;
8191		pos += ret;
8192	}
8193
8194	return pos - buf;
8195}
8196
8197
8198static int wpas_ctrl_iface_driver_flags(struct wpa_supplicant *wpa_s,
8199					char *buf, size_t buflen)
8200{
8201	int ret, i;
8202	char *pos, *end;
8203
8204	ret = os_snprintf(buf, buflen, "%016llX:\n",
8205			  (long long unsigned) wpa_s->drv_flags);
8206	if (os_snprintf_error(buflen, ret))
8207		return -1;
8208
8209	pos = buf + ret;
8210	end = buf + buflen;
8211
8212	for (i = 0; i < 64; i++) {
8213		if (wpa_s->drv_flags & (1LLU << i)) {
8214			ret = os_snprintf(pos, end - pos, "%s\n",
8215					  driver_flag_to_string(1LLU << i));
8216			if (os_snprintf_error(end - pos, ret))
8217				return -1;
8218			pos += ret;
8219		}
8220	}
8221
8222	return pos - buf;
8223}
8224
8225
8226static int wpas_ctrl_iface_driver_flags2(struct wpa_supplicant *wpa_s,
8227					 char *buf, size_t buflen)
8228{
8229	int ret, i;
8230	char *pos, *end;
8231
8232	ret = os_snprintf(buf, buflen, "%016llX:\n",
8233			  (long long unsigned) wpa_s->drv_flags2);
8234	if (os_snprintf_error(buflen, ret))
8235		return -1;
8236
8237	pos = buf + ret;
8238	end = buf + buflen;
8239
8240	for (i = 0; i < 64; i++) {
8241		if (wpa_s->drv_flags2 & (1LLU << i)) {
8242			ret = os_snprintf(pos, end - pos, "%s\n",
8243					  driver_flag2_to_string(1LLU << i));
8244			if (os_snprintf_error(end - pos, ret))
8245				return -1;
8246			pos += ret;
8247		}
8248	}
8249
8250	return pos - buf;
8251}
8252
8253
8254static int wpa_supplicant_pktcnt_poll(struct wpa_supplicant *wpa_s, char *buf,
8255				      size_t buflen)
8256{
8257	struct hostap_sta_driver_data sta;
8258	int ret;
8259
8260	ret = wpa_drv_pktcnt_poll(wpa_s, &sta);
8261	if (ret)
8262		return -1;
8263
8264	ret = os_snprintf(buf, buflen, "TXGOOD=%lu\nTXBAD=%lu\nRXGOOD=%lu\n",
8265			  sta.tx_packets, sta.tx_retry_failed, sta.rx_packets);
8266	if (os_snprintf_error(buflen, ret))
8267		return -1;
8268	return ret;
8269}
8270
8271
8272#ifdef ANDROID
8273static int wpa_supplicant_driver_cmd(struct wpa_supplicant *wpa_s, char *cmd,
8274				     char *buf, size_t buflen)
8275{
8276	int ret;
8277
8278	ret = wpa_drv_driver_cmd(wpa_s, cmd, buf, buflen);
8279	if (ret == 0) {
8280		if (os_strncasecmp(cmd, "COUNTRY", 7) == 0) {
8281			struct p2p_data *p2p = wpa_s->global->p2p;
8282			if (p2p) {
8283				char country[3];
8284				country[0] = cmd[8];
8285				country[1] = cmd[9];
8286				country[2] = 0x04;
8287				p2p_set_country(p2p, country);
8288			}
8289		}
8290		ret = os_snprintf(buf, buflen, "%s\n", "OK");
8291		if (os_snprintf_error(buflen, ret))
8292			ret = -1;
8293	}
8294	return ret;
8295}
8296#endif /* ANDROID */
8297
8298
8299static int wpa_supplicant_vendor_cmd(struct wpa_supplicant *wpa_s, char *cmd,
8300				     char *buf, size_t buflen)
8301{
8302	int ret;
8303	char *pos, *temp = NULL;
8304	u8 *data = NULL;
8305	unsigned int vendor_id, subcmd;
8306	enum nested_attr nested_attr_flag = NESTED_ATTR_UNSPECIFIED;
8307	struct wpabuf *reply;
8308	size_t data_len = 0;
8309
8310	/**
8311	 * cmd: <vendor id> <subcommand id> [<hex formatted data>]
8312	 * [nested=<0|1>]
8313	 */
8314	vendor_id = strtoul(cmd, &pos, 16);
8315	if (!isblank((unsigned char) *pos))
8316		return -EINVAL;
8317
8318	subcmd = strtoul(pos, &pos, 10);
8319
8320	if (*pos != '\0') {
8321		if (!isblank((unsigned char) *pos++))
8322			return -EINVAL;
8323
8324		temp = os_strchr(pos, ' ');
8325		data_len = temp ? (size_t) (temp - pos) : os_strlen(pos);
8326	}
8327
8328	if (data_len) {
8329		data_len /= 2;
8330		data = os_malloc(data_len);
8331		if (!data)
8332			return -1;
8333
8334		if (hexstr2bin(pos, data, data_len)) {
8335			wpa_printf(MSG_DEBUG,
8336				   "Vendor command: wrong parameter format");
8337			os_free(data);
8338			return -EINVAL;
8339		}
8340	}
8341
8342	pos = os_strstr(cmd, "nested=");
8343	if (pos)
8344		nested_attr_flag = atoi(pos + 7) ? NESTED_ATTR_USED :
8345			NESTED_ATTR_NOT_USED;
8346
8347	reply = wpabuf_alloc((buflen - 1) / 2);
8348	if (!reply) {
8349		os_free(data);
8350		return -1;
8351	}
8352
8353	ret = wpa_drv_vendor_cmd(wpa_s, vendor_id, subcmd, data, data_len,
8354				 nested_attr_flag, reply);
8355
8356	if (ret == 0)
8357		ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(reply),
8358				       wpabuf_len(reply));
8359
8360	wpabuf_free(reply);
8361	os_free(data);
8362
8363	return ret;
8364}
8365
8366
8367static void wpa_supplicant_ctrl_iface_flush(struct wpa_supplicant *wpa_s)
8368{
8369#ifdef CONFIG_P2P
8370	struct wpa_supplicant *p2p_wpa_s = wpa_s->global->p2p_init_wpa_s ?
8371		wpa_s->global->p2p_init_wpa_s : wpa_s;
8372#endif /* CONFIG_P2P */
8373
8374	wpa_dbg(wpa_s, MSG_DEBUG, "Flush all wpa_supplicant state");
8375
8376	if (wpas_abort_ongoing_scan(wpa_s) == 0)
8377		wpa_s->ignore_post_flush_scan_res = 1;
8378
8379	if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
8380		/*
8381		 * Avoid possible auto connect re-connection on getting
8382		 * disconnected due to state flush.
8383		 */
8384		wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
8385	}
8386
8387#ifdef CONFIG_P2P
8388	wpas_p2p_group_remove(p2p_wpa_s, "*");
8389	wpas_p2p_cancel(p2p_wpa_s);
8390	p2p_ctrl_flush(p2p_wpa_s);
8391	wpas_p2p_service_flush(p2p_wpa_s);
8392	p2p_wpa_s->global->p2p_disabled = 0;
8393	p2p_wpa_s->global->p2p_per_sta_psk = 0;
8394	p2p_wpa_s->conf->num_sec_device_types = 0;
8395	p2p_wpa_s->p2p_disable_ip_addr_req = 0;
8396	os_free(p2p_wpa_s->global->p2p_go_avoid_freq.range);
8397	p2p_wpa_s->global->p2p_go_avoid_freq.range = NULL;
8398	p2p_wpa_s->global->p2p_go_avoid_freq.num = 0;
8399	p2p_wpa_s->global->pending_p2ps_group = 0;
8400	p2p_wpa_s->global->pending_p2ps_group_freq = 0;
8401#endif /* CONFIG_P2P */
8402
8403#ifdef CONFIG_WPS_TESTING
8404	wps_version_number = 0x20;
8405	wps_testing_stub_cred = 0;
8406	wps_corrupt_pkhash = 0;
8407	wps_force_auth_types_in_use = 0;
8408	wps_force_encr_types_in_use = 0;
8409#endif /* CONFIG_WPS_TESTING */
8410#ifdef CONFIG_WPS
8411	wpa_s->wps_fragment_size = 0;
8412	wpas_wps_cancel(wpa_s);
8413	wps_registrar_flush(wpa_s->wps->registrar);
8414#endif /* CONFIG_WPS */
8415	wpa_s->after_wps = 0;
8416	wpa_s->known_wps_freq = 0;
8417
8418#ifdef CONFIG_DPP
8419	wpas_dpp_deinit(wpa_s);
8420	wpa_s->dpp_init_max_tries = 0;
8421	wpa_s->dpp_init_retry_time = 0;
8422	wpa_s->dpp_resp_wait_time = 0;
8423	wpa_s->dpp_resp_max_tries = 0;
8424	wpa_s->dpp_resp_retry_time = 0;
8425#ifdef CONFIG_DPP2
8426	wpas_dpp_chirp_stop(wpa_s);
8427	wpa_s->dpp_pfs_fallback = 0;
8428#endif /* CONFIG_DPP2 */
8429#ifdef CONFIG_TESTING_OPTIONS
8430	os_memset(dpp_pkex_own_mac_override, 0, ETH_ALEN);
8431	os_memset(dpp_pkex_peer_mac_override, 0, ETH_ALEN);
8432	dpp_pkex_ephemeral_key_override_len = 0;
8433	dpp_protocol_key_override_len = 0;
8434	dpp_nonce_override_len = 0;
8435#ifdef CONFIG_DPP3
8436	dpp_version_override = 3;
8437#elif defined(CONFIG_DPP2)
8438	dpp_version_override = 2;
8439#else /* CONFIG_DPP2 */
8440	dpp_version_override = 1;
8441#endif /* CONFIG_DPP2 */
8442#endif /* CONFIG_TESTING_OPTIONS */
8443#endif /* CONFIG_DPP */
8444
8445#ifdef CONFIG_TDLS
8446#ifdef CONFIG_TDLS_TESTING
8447	tdls_testing = 0;
8448#endif /* CONFIG_TDLS_TESTING */
8449	wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL);
8450	wpa_tdls_enable(wpa_s->wpa, 1);
8451#endif /* CONFIG_TDLS */
8452
8453	eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
8454	wpa_supplicant_stop_countermeasures(wpa_s, NULL);
8455	wpa_s->last_michael_mic_error.sec = 0;
8456
8457	wpa_s->no_keep_alive = 0;
8458	wpa_s->own_disconnect_req = 0;
8459	wpa_s->own_reconnect_req = 0;
8460	wpa_s->deny_ptk0_rekey = 0;
8461
8462	os_free(wpa_s->disallow_aps_bssid);
8463	wpa_s->disallow_aps_bssid = NULL;
8464	wpa_s->disallow_aps_bssid_count = 0;
8465	os_free(wpa_s->disallow_aps_ssid);
8466	wpa_s->disallow_aps_ssid = NULL;
8467	wpa_s->disallow_aps_ssid_count = 0;
8468
8469	wpa_s->set_sta_uapsd = 0;
8470	wpa_s->sta_uapsd = 0;
8471
8472	wpa_s->consecutive_conn_failures = 0;
8473
8474	wpa_drv_radio_disable(wpa_s, 0);
8475	wpa_bssid_ignore_clear(wpa_s);
8476	wpa_supplicant_ctrl_iface_remove_network(wpa_s, "all");
8477	wpa_supplicant_ctrl_iface_remove_cred(wpa_s, "all");
8478	wpa_config_flush_blobs(wpa_s->conf);
8479	wpa_s->conf->auto_interworking = 0;
8480	wpa_s->conf->okc = 0;
8481
8482	ptksa_cache_flush(wpa_s->ptksa, NULL, WPA_CIPHER_NONE);
8483	wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
8484	rsn_preauth_deinit(wpa_s->wpa);
8485
8486	wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME, 43200);
8487	wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD, 70);
8488	wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT, 60);
8489	eapol_sm_notify_logoff(wpa_s->eapol, false);
8490
8491	radio_remove_works(wpa_s, NULL, 1);
8492	wpa_s->ext_work_in_progress = 0;
8493
8494	wpa_s->next_ssid = NULL;
8495
8496#ifdef CONFIG_INTERWORKING
8497#ifdef CONFIG_HS20
8498	hs20_cancel_fetch_osu(wpa_s);
8499	hs20_del_icon(wpa_s, NULL, NULL);
8500#endif /* CONFIG_HS20 */
8501#endif /* CONFIG_INTERWORKING */
8502
8503	wpa_s->ext_mgmt_frame_handling = 0;
8504	wpa_s->ext_eapol_frame_io = 0;
8505#ifdef CONFIG_TESTING_OPTIONS
8506	wpa_s->extra_roc_dur = 0;
8507	wpa_s->test_failure = WPAS_TEST_FAILURE_NONE;
8508	wpa_s->p2p_go_csa_on_inv = 0;
8509	wpa_s->ignore_auth_resp = 0;
8510	wpa_s->ignore_assoc_disallow = 0;
8511	wpa_s->disable_sa_query = 0;
8512	wpa_s->testing_resend_assoc = 0;
8513	wpa_s->ignore_sae_h2e_only = 0;
8514	wpa_s->ft_rsnxe_used = 0;
8515	wpa_s->reject_btm_req_reason = 0;
8516	wpa_sm_set_test_assoc_ie(wpa_s->wpa, NULL);
8517	os_free(wpa_s->get_pref_freq_list_override);
8518	wpa_s->get_pref_freq_list_override = NULL;
8519	wpabuf_free(wpa_s->sae_commit_override);
8520	wpa_s->sae_commit_override = NULL;
8521	os_free(wpa_s->extra_sae_rejected_groups);
8522	wpa_s->extra_sae_rejected_groups = NULL;
8523	wpabuf_free(wpa_s->rsne_override_eapol);
8524	wpa_s->rsne_override_eapol = NULL;
8525	wpabuf_free(wpa_s->rsnxe_override_assoc);
8526	wpa_s->rsnxe_override_assoc = NULL;
8527	wpabuf_free(wpa_s->rsnxe_override_eapol);
8528	wpa_s->rsnxe_override_eapol = NULL;
8529	wpas_clear_driver_signal_override(wpa_s);
8530	wpa_s->disable_scs_support = 0;
8531	wpa_s->disable_mscs_support = 0;
8532	wpa_s->enable_dscp_policy_capa = 0;
8533	wpa_s->oci_freq_override_eapol = 0;
8534	wpa_s->oci_freq_override_saquery_req = 0;
8535	wpa_s->oci_freq_override_saquery_resp = 0;
8536	wpa_s->oci_freq_override_eapol_g2 = 0;
8537	wpa_s->oci_freq_override_ft_assoc = 0;
8538	wpa_s->oci_freq_override_fils_assoc = 0;
8539	wpa_s->oci_freq_override_wnm_sleep = 0;
8540#ifdef CONFIG_DPP
8541	os_free(wpa_s->dpp_config_obj_override);
8542	wpa_s->dpp_config_obj_override = NULL;
8543	os_free(wpa_s->dpp_discovery_override);
8544	wpa_s->dpp_discovery_override = NULL;
8545	os_free(wpa_s->dpp_groups_override);
8546	wpa_s->dpp_groups_override = NULL;
8547	dpp_test = DPP_TEST_DISABLED;
8548#endif /* CONFIG_DPP */
8549#endif /* CONFIG_TESTING_OPTIONS */
8550
8551	wpa_s->disconnected = 0;
8552	os_free(wpa_s->next_scan_freqs);
8553	wpa_s->next_scan_freqs = NULL;
8554	os_memset(wpa_s->next_scan_bssid, 0, ETH_ALEN);
8555	wpa_s->next_scan_bssid_wildcard_ssid = 0;
8556	os_free(wpa_s->select_network_scan_freqs);
8557	wpa_s->select_network_scan_freqs = NULL;
8558	os_memset(&wpa_s->robust_av, 0, sizeof(struct robust_av_data));
8559
8560	wpa_bss_flush(wpa_s);
8561	if (!dl_list_empty(&wpa_s->bss)) {
8562		wpa_printf(MSG_DEBUG,
8563			   "BSS table not empty after flush: %u entries, current_bss=%p bssid="
8564			   MACSTR " pending_bssid=" MACSTR,
8565			   dl_list_len(&wpa_s->bss), wpa_s->current_bss,
8566			   MAC2STR(wpa_s->bssid),
8567			   MAC2STR(wpa_s->pending_bssid));
8568	}
8569
8570	eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
8571	wpa_s->wnmsleep_used = 0;
8572
8573#ifdef CONFIG_SME
8574	wpa_s->sme.last_unprot_disconnect.sec = 0;
8575	wpa_s->sme.auth_alg = 0;
8576#endif /* CONFIG_SME */
8577
8578	wpabuf_free(wpa_s->ric_ies);
8579	wpa_s->ric_ies = NULL;
8580
8581	wpa_supplicant_update_channel_list(wpa_s, NULL);
8582
8583	free_bss_tmp_disallowed(wpa_s);
8584
8585	os_memset(&wpa_s->robust_av, 0, sizeof(struct robust_av_data));
8586
8587#ifdef CONFIG_PASN
8588	wpas_pasn_auth_stop(wpa_s);
8589#endif /* CONFIG_PASN */
8590
8591	if (wpa_s->mac_addr_changed && wpa_s->conf->mac_addr == 0)
8592		wpas_restore_permanent_mac_addr(wpa_s);
8593}
8594
8595
8596static int wpas_ctrl_radio_work_show(struct wpa_supplicant *wpa_s,
8597				     char *buf, size_t buflen)
8598{
8599	struct wpa_radio_work *work;
8600	char *pos, *end;
8601	struct os_reltime now, diff;
8602
8603	pos = buf;
8604	end = buf + buflen;
8605
8606	os_get_reltime(&now);
8607
8608	dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
8609	{
8610		int ret;
8611
8612		os_reltime_sub(&now, &work->time, &diff);
8613		ret = os_snprintf(pos, end - pos, "%s@%s:%u:%u:%ld.%06ld\n",
8614				  work->type, work->wpa_s->ifname, work->freq,
8615				  work->started, diff.sec, diff.usec);
8616		if (os_snprintf_error(end - pos, ret))
8617			break;
8618		pos += ret;
8619	}
8620
8621	return pos - buf;
8622}
8623
8624
8625static void wpas_ctrl_radio_work_timeout(void *eloop_ctx, void *timeout_ctx)
8626{
8627	struct wpa_radio_work *work = eloop_ctx;
8628	struct wpa_external_work *ework = work->ctx;
8629
8630	wpa_dbg(work->wpa_s, MSG_DEBUG,
8631		"Timing out external radio work %u (%s)",
8632		ework->id, work->type);
8633	wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_TIMEOUT "%u", ework->id);
8634	work->wpa_s->ext_work_in_progress = 0;
8635	radio_work_done(work);
8636	os_free(ework);
8637}
8638
8639
8640static void wpas_ctrl_radio_work_cb(struct wpa_radio_work *work, int deinit)
8641{
8642	struct wpa_external_work *ework = work->ctx;
8643
8644	if (deinit) {
8645		if (work->started)
8646			eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
8647					     work, NULL);
8648
8649		/*
8650		 * work->type points to a buffer in ework, so need to replace
8651		 * that here with a fixed string to avoid use of freed memory
8652		 * in debug prints.
8653		 */
8654		work->type = "freed-ext-work";
8655		work->ctx = NULL;
8656		os_free(ework);
8657		return;
8658	}
8659
8660	wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting external radio work %u (%s)",
8661		ework->id, ework->type);
8662	wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_START "%u", ework->id);
8663	work->wpa_s->ext_work_in_progress = 1;
8664	if (!ework->timeout)
8665		ework->timeout = 10;
8666	eloop_register_timeout(ework->timeout, 0, wpas_ctrl_radio_work_timeout,
8667			       work, NULL);
8668}
8669
8670
8671static int wpas_ctrl_radio_work_add(struct wpa_supplicant *wpa_s, char *cmd,
8672				    char *buf, size_t buflen)
8673{
8674	struct wpa_external_work *ework;
8675	char *pos, *pos2;
8676	size_t type_len;
8677	int ret;
8678	unsigned int freq = 0;
8679
8680	/* format: <name> [freq=<MHz>] [timeout=<seconds>] */
8681
8682	ework = os_zalloc(sizeof(*ework));
8683	if (ework == NULL)
8684		return -1;
8685
8686	pos = os_strchr(cmd, ' ');
8687	if (pos) {
8688		type_len = pos - cmd;
8689		pos++;
8690
8691		pos2 = os_strstr(pos, "freq=");
8692		if (pos2)
8693			freq = atoi(pos2 + 5);
8694
8695		pos2 = os_strstr(pos, "timeout=");
8696		if (pos2)
8697			ework->timeout = atoi(pos2 + 8);
8698	} else {
8699		type_len = os_strlen(cmd);
8700	}
8701	if (4 + type_len >= sizeof(ework->type))
8702		type_len = sizeof(ework->type) - 4 - 1;
8703	os_strlcpy(ework->type, "ext:", sizeof(ework->type));
8704	os_memcpy(ework->type + 4, cmd, type_len);
8705	ework->type[4 + type_len] = '\0';
8706
8707	wpa_s->ext_work_id++;
8708	if (wpa_s->ext_work_id == 0)
8709		wpa_s->ext_work_id++;
8710	ework->id = wpa_s->ext_work_id;
8711
8712	if (radio_add_work(wpa_s, freq, ework->type, 0, wpas_ctrl_radio_work_cb,
8713			   ework) < 0) {
8714		os_free(ework);
8715		return -1;
8716	}
8717
8718	ret = os_snprintf(buf, buflen, "%u", ework->id);
8719	if (os_snprintf_error(buflen, ret))
8720		return -1;
8721	return ret;
8722}
8723
8724
8725static int wpas_ctrl_radio_work_done(struct wpa_supplicant *wpa_s, char *cmd)
8726{
8727	struct wpa_radio_work *work;
8728	unsigned int id = atoi(cmd);
8729
8730	dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
8731	{
8732		struct wpa_external_work *ework;
8733
8734		if (os_strncmp(work->type, "ext:", 4) != 0)
8735			continue;
8736		ework = work->ctx;
8737		if (id && ework->id != id)
8738			continue;
8739		wpa_dbg(wpa_s, MSG_DEBUG,
8740			"Completed external radio work %u (%s)",
8741			ework->id, ework->type);
8742		eloop_cancel_timeout(wpas_ctrl_radio_work_timeout, work, NULL);
8743		wpa_s->ext_work_in_progress = 0;
8744		radio_work_done(work);
8745		os_free(ework);
8746		return 3; /* "OK\n" */
8747	}
8748
8749	return -1;
8750}
8751
8752
8753static int wpas_ctrl_radio_work(struct wpa_supplicant *wpa_s, char *cmd,
8754				char *buf, size_t buflen)
8755{
8756	if (os_strcmp(cmd, "show") == 0)
8757		return wpas_ctrl_radio_work_show(wpa_s, buf, buflen);
8758	if (os_strncmp(cmd, "add ", 4) == 0)
8759		return wpas_ctrl_radio_work_add(wpa_s, cmd + 4, buf, buflen);
8760	if (os_strncmp(cmd, "done ", 5) == 0)
8761		return wpas_ctrl_radio_work_done(wpa_s, cmd + 4);
8762	return -1;
8763}
8764
8765
8766void wpas_ctrl_radio_work_flush(struct wpa_supplicant *wpa_s)
8767{
8768	struct wpa_radio_work *work, *tmp;
8769
8770	if (!wpa_s || !wpa_s->radio)
8771		return;
8772
8773	dl_list_for_each_safe(work, tmp, &wpa_s->radio->work,
8774			      struct wpa_radio_work, list) {
8775		struct wpa_external_work *ework;
8776
8777		if (os_strncmp(work->type, "ext:", 4) != 0)
8778			continue;
8779		ework = work->ctx;
8780		wpa_dbg(wpa_s, MSG_DEBUG,
8781			"Flushing%s external radio work %u (%s)",
8782			work->started ? " started" : "", ework->id,
8783			ework->type);
8784		if (work->started)
8785			eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
8786					     work, NULL);
8787		radio_work_done(work);
8788		os_free(ework);
8789	}
8790}
8791
8792
8793static void wpas_ctrl_eapol_response(void *eloop_ctx, void *timeout_ctx)
8794{
8795	struct wpa_supplicant *wpa_s = eloop_ctx;
8796	eapol_sm_notify_ctrl_response(wpa_s->eapol);
8797}
8798
8799
8800static int scan_id_list_parse(struct wpa_supplicant *wpa_s, const char *value,
8801			      unsigned int *scan_id_count, int scan_id[])
8802{
8803	const char *pos = value;
8804
8805	while (pos) {
8806		if (*pos == ' ' || *pos == '\0')
8807			break;
8808		if (*scan_id_count == MAX_SCAN_ID)
8809			return -1;
8810		scan_id[(*scan_id_count)++] = atoi(pos);
8811		pos = os_strchr(pos, ',');
8812		if (pos)
8813			pos++;
8814	}
8815
8816	return 0;
8817}
8818
8819
8820static void wpas_ctrl_scan(struct wpa_supplicant *wpa_s, char *params,
8821			   char *reply, int reply_size, int *reply_len)
8822{
8823	char *pos;
8824	unsigned int manual_scan_passive = 0;
8825	unsigned int manual_scan_use_id = 0;
8826	unsigned int manual_scan_only_new = 0;
8827	unsigned int scan_only = 0;
8828	unsigned int scan_id_count = 0;
8829	int scan_id[MAX_SCAN_ID];
8830	void (*scan_res_handler)(struct wpa_supplicant *wpa_s,
8831				 struct wpa_scan_results *scan_res);
8832	int *manual_scan_freqs = NULL;
8833	struct wpa_ssid_value *ssid = NULL, *ns;
8834	unsigned int ssid_count = 0;
8835
8836	if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
8837		*reply_len = -1;
8838		return;
8839	}
8840
8841	if (radio_work_pending(wpa_s, "scan")) {
8842		wpa_printf(MSG_DEBUG,
8843			   "Pending scan scheduled - reject new request");
8844		*reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
8845		return;
8846	}
8847
8848#ifdef CONFIG_INTERWORKING
8849	if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select) {
8850		wpa_printf(MSG_DEBUG,
8851			   "Interworking select in progress - reject new scan");
8852		*reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
8853		return;
8854	}
8855#endif /* CONFIG_INTERWORKING */
8856
8857	if (params) {
8858		if (os_strncasecmp(params, "TYPE=ONLY", 9) == 0)
8859			scan_only = 1;
8860
8861		pos = os_strstr(params, "freq=");
8862		if (pos) {
8863			manual_scan_freqs = freq_range_to_channel_list(wpa_s,
8864								       pos + 5);
8865			if (manual_scan_freqs == NULL) {
8866				*reply_len = -1;
8867				goto done;
8868			}
8869		}
8870
8871		pos = os_strstr(params, "passive=");
8872		if (pos)
8873			manual_scan_passive = !!atoi(pos + 8);
8874
8875		pos = os_strstr(params, "use_id=");
8876		if (pos)
8877			manual_scan_use_id = atoi(pos + 7);
8878
8879		pos = os_strstr(params, "only_new=1");
8880		if (pos)
8881			manual_scan_only_new = 1;
8882
8883		pos = os_strstr(params, "scan_id=");
8884		if (pos && scan_id_list_parse(wpa_s, pos + 8, &scan_id_count,
8885					      scan_id) < 0) {
8886			*reply_len = -1;
8887			goto done;
8888		}
8889
8890		pos = os_strstr(params, "bssid=");
8891		if (pos) {
8892			u8 bssid[ETH_ALEN];
8893
8894			pos += 6;
8895			if (hwaddr_aton(pos, bssid)) {
8896				wpa_printf(MSG_ERROR, "Invalid BSSID %s", pos);
8897				*reply_len = -1;
8898				goto done;
8899			}
8900			os_memcpy(wpa_s->next_scan_bssid, bssid, ETH_ALEN);
8901
8902			wpa_s->next_scan_bssid_wildcard_ssid =
8903				os_strstr(params, "wildcard_ssid=1") != NULL;
8904		}
8905
8906		pos = params;
8907		while (pos && *pos != '\0') {
8908			if (os_strncmp(pos, "ssid ", 5) == 0) {
8909				char *end;
8910
8911				pos += 5;
8912				end = pos;
8913				while (*end) {
8914					if (*end == '\0' || *end == ' ')
8915						break;
8916					end++;
8917				}
8918
8919				ns = os_realloc_array(
8920					ssid, ssid_count + 1,
8921					sizeof(struct wpa_ssid_value));
8922				if (ns == NULL) {
8923					*reply_len = -1;
8924					goto done;
8925				}
8926				ssid = ns;
8927
8928				if ((end - pos) & 0x01 ||
8929				    end - pos > 2 * SSID_MAX_LEN ||
8930				    hexstr2bin(pos, ssid[ssid_count].ssid,
8931					       (end - pos) / 2) < 0) {
8932					wpa_printf(MSG_DEBUG,
8933						   "Invalid SSID value '%s'",
8934						   pos);
8935					*reply_len = -1;
8936					goto done;
8937				}
8938				ssid[ssid_count].ssid_len = (end - pos) / 2;
8939				wpa_hexdump_ascii(MSG_DEBUG, "scan SSID",
8940						  ssid[ssid_count].ssid,
8941						  ssid[ssid_count].ssid_len);
8942				ssid_count++;
8943				pos = end;
8944			}
8945
8946			pos = os_strchr(pos, ' ');
8947			if (pos)
8948				pos++;
8949		}
8950	}
8951
8952	wpa_s->num_ssids_from_scan_req = ssid_count;
8953	os_free(wpa_s->ssids_from_scan_req);
8954	if (ssid_count) {
8955		wpa_s->ssids_from_scan_req = ssid;
8956		ssid = NULL;
8957	} else {
8958		wpa_s->ssids_from_scan_req = NULL;
8959	}
8960
8961	if (scan_only)
8962		scan_res_handler = scan_only_handler;
8963	else if (wpa_s->scan_res_handler == scan_only_handler)
8964		scan_res_handler = NULL;
8965	else
8966		scan_res_handler = wpa_s->scan_res_handler;
8967
8968	if (!wpa_s->sched_scanning && !wpa_s->scanning &&
8969	    ((wpa_s->wpa_state <= WPA_SCANNING) ||
8970	     (wpa_s->wpa_state == WPA_COMPLETED))) {
8971		wpa_s->manual_scan_passive = manual_scan_passive;
8972		wpa_s->manual_scan_use_id = manual_scan_use_id;
8973		wpa_s->manual_scan_only_new = manual_scan_only_new;
8974		wpa_s->scan_id_count = scan_id_count;
8975		os_memcpy(wpa_s->scan_id, scan_id, scan_id_count * sizeof(int));
8976		wpa_s->scan_res_handler = scan_res_handler;
8977		os_free(wpa_s->manual_scan_freqs);
8978		wpa_s->manual_scan_freqs = manual_scan_freqs;
8979		manual_scan_freqs = NULL;
8980
8981		wpa_s->normal_scans = 0;
8982		wpa_s->scan_req = MANUAL_SCAN_REQ;
8983		wpa_s->after_wps = 0;
8984		wpa_s->known_wps_freq = 0;
8985		wpa_supplicant_req_scan(wpa_s, 0, 0);
8986		if (wpa_s->manual_scan_use_id) {
8987			wpa_s->manual_scan_id++;
8988			wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
8989				wpa_s->manual_scan_id);
8990			*reply_len = os_snprintf(reply, reply_size, "%u\n",
8991						 wpa_s->manual_scan_id);
8992		}
8993	} else if (wpa_s->sched_scanning) {
8994		wpa_s->manual_scan_passive = manual_scan_passive;
8995		wpa_s->manual_scan_use_id = manual_scan_use_id;
8996		wpa_s->manual_scan_only_new = manual_scan_only_new;
8997		wpa_s->scan_id_count = scan_id_count;
8998		os_memcpy(wpa_s->scan_id, scan_id, scan_id_count * sizeof(int));
8999		wpa_s->scan_res_handler = scan_res_handler;
9000		os_free(wpa_s->manual_scan_freqs);
9001		wpa_s->manual_scan_freqs = manual_scan_freqs;
9002		manual_scan_freqs = NULL;
9003
9004		wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to allow requested full scan to proceed");
9005		wpa_supplicant_cancel_sched_scan(wpa_s);
9006		wpa_s->scan_req = MANUAL_SCAN_REQ;
9007		wpa_supplicant_req_scan(wpa_s, 0, 0);
9008		if (wpa_s->manual_scan_use_id) {
9009			wpa_s->manual_scan_id++;
9010			*reply_len = os_snprintf(reply, reply_size, "%u\n",
9011						 wpa_s->manual_scan_id);
9012			wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
9013				wpa_s->manual_scan_id);
9014		}
9015	} else {
9016		wpa_printf(MSG_DEBUG, "Ongoing scan action - reject new request");
9017		*reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
9018	}
9019
9020done:
9021	os_free(manual_scan_freqs);
9022	os_free(ssid);
9023}
9024
9025
9026#ifdef CONFIG_TESTING_OPTIONS
9027
9028static void wpas_ctrl_iface_mgmt_tx_cb(struct wpa_supplicant *wpa_s,
9029				       unsigned int freq, const u8 *dst,
9030				       const u8 *src, const u8 *bssid,
9031				       const u8 *data, size_t data_len,
9032				       enum offchannel_send_action_result
9033				       result)
9034{
9035	wpa_msg(wpa_s, MSG_INFO, "MGMT-TX-STATUS freq=%u dst=" MACSTR
9036		" src=" MACSTR " bssid=" MACSTR " result=%s",
9037		freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid),
9038		result == OFFCHANNEL_SEND_ACTION_SUCCESS ?
9039		"SUCCESS" : (result == OFFCHANNEL_SEND_ACTION_NO_ACK ?
9040			     "NO_ACK" : "FAILED"));
9041}
9042
9043
9044static int wpas_ctrl_iface_mgmt_tx(struct wpa_supplicant *wpa_s, char *cmd)
9045{
9046	char *pos, *param;
9047	size_t len;
9048	u8 *buf, da[ETH_ALEN], bssid[ETH_ALEN];
9049	int res, used;
9050	int freq = 0, no_cck = 0, wait_time = 0;
9051
9052	/* <DA> <BSSID> [freq=<MHz>] [wait_time=<ms>] [no_cck=1]
9053	 *    <action=Action frame payload> */
9054
9055	wpa_printf(MSG_DEBUG, "External MGMT TX: %s", cmd);
9056
9057	pos = cmd;
9058	used = hwaddr_aton2(pos, da);
9059	if (used < 0)
9060		return -1;
9061	pos += used;
9062	while (*pos == ' ')
9063		pos++;
9064	used = hwaddr_aton2(pos, bssid);
9065	if (used < 0)
9066		return -1;
9067	pos += used;
9068
9069	param = os_strstr(pos, " freq=");
9070	if (param) {
9071		param += 6;
9072		freq = atoi(param);
9073	}
9074
9075	param = os_strstr(pos, " no_cck=");
9076	if (param) {
9077		param += 8;
9078		no_cck = atoi(param);
9079	}
9080
9081	param = os_strstr(pos, " wait_time=");
9082	if (param) {
9083		param += 11;
9084		wait_time = atoi(param);
9085	}
9086
9087	param = os_strstr(pos, " action=");
9088	if (param == NULL)
9089		return -1;
9090	param += 8;
9091
9092	len = os_strlen(param);
9093	if (len & 1)
9094		return -1;
9095	len /= 2;
9096
9097	buf = os_malloc(len);
9098	if (buf == NULL)
9099		return -1;
9100
9101	if (hexstr2bin(param, buf, len) < 0) {
9102		os_free(buf);
9103		return -1;
9104	}
9105
9106	res = offchannel_send_action(wpa_s, freq, da, wpa_s->own_addr, bssid,
9107				     buf, len, wait_time,
9108				     wpas_ctrl_iface_mgmt_tx_cb, no_cck);
9109	os_free(buf);
9110	return res;
9111}
9112
9113
9114static void wpas_ctrl_iface_mgmt_tx_done(struct wpa_supplicant *wpa_s)
9115{
9116	wpa_printf(MSG_DEBUG, "External MGMT TX - done waiting");
9117	offchannel_send_action_done(wpa_s);
9118}
9119
9120
9121static int wpas_ctrl_iface_mgmt_rx_process(struct wpa_supplicant *wpa_s,
9122					   char *cmd)
9123{
9124	char *pos, *param;
9125	size_t len;
9126	u8 *buf;
9127	int freq = 0, datarate = 0, ssi_signal = 0;
9128	union wpa_event_data event;
9129
9130	if (!wpa_s->ext_mgmt_frame_handling)
9131		return -1;
9132
9133	/* freq=<MHz> datarate=<val> ssi_signal=<val> frame=<frame hexdump> */
9134
9135	wpa_printf(MSG_DEBUG, "External MGMT RX process: %s", cmd);
9136
9137	pos = cmd;
9138	param = os_strstr(pos, "freq=");
9139	if (param) {
9140		param += 5;
9141		freq = atoi(param);
9142	}
9143
9144	param = os_strstr(pos, " datarate=");
9145	if (param) {
9146		param += 10;
9147		datarate = atoi(param);
9148	}
9149
9150	param = os_strstr(pos, " ssi_signal=");
9151	if (param) {
9152		param += 12;
9153		ssi_signal = atoi(param);
9154	}
9155
9156	param = os_strstr(pos, " frame=");
9157	if (param == NULL)
9158		return -1;
9159	param += 7;
9160
9161	len = os_strlen(param);
9162	if (len & 1)
9163		return -1;
9164	len /= 2;
9165
9166	buf = os_malloc(len);
9167	if (buf == NULL)
9168		return -1;
9169
9170	if (hexstr2bin(param, buf, len) < 0) {
9171		os_free(buf);
9172		return -1;
9173	}
9174
9175	os_memset(&event, 0, sizeof(event));
9176	event.rx_mgmt.freq = freq;
9177	event.rx_mgmt.frame = buf;
9178	event.rx_mgmt.frame_len = len;
9179	event.rx_mgmt.ssi_signal = ssi_signal;
9180	event.rx_mgmt.datarate = datarate;
9181	wpa_s->ext_mgmt_frame_handling = 0;
9182	wpa_supplicant_event(wpa_s, EVENT_RX_MGMT, &event);
9183	wpa_s->ext_mgmt_frame_handling = 1;
9184
9185	os_free(buf);
9186
9187	return 0;
9188}
9189
9190
9191static int wpas_ctrl_iface_driver_scan_res(struct wpa_supplicant *wpa_s,
9192					   char *param)
9193{
9194	struct wpa_scan_res *res;
9195	struct os_reltime now;
9196	char *pos, *end;
9197	int ret = -1;
9198
9199	if (!param)
9200		return -1;
9201
9202	if (os_strcmp(param, "START") == 0) {
9203		wpa_bss_update_start(wpa_s);
9204		return 0;
9205	}
9206
9207	if (os_strcmp(param, "END") == 0) {
9208		wpa_bss_update_end(wpa_s, NULL, 1);
9209		return 0;
9210	}
9211
9212	if (os_strncmp(param, "BSS ", 4) != 0)
9213		return -1;
9214	param += 3;
9215
9216	res = os_zalloc(sizeof(*res) + os_strlen(param) / 2);
9217	if (!res)
9218		return -1;
9219
9220	pos = os_strstr(param, " flags=");
9221	if (pos)
9222		res->flags = strtol(pos + 7, NULL, 16);
9223
9224	pos = os_strstr(param, " bssid=");
9225	if (pos && hwaddr_aton(pos + 7, res->bssid))
9226		goto fail;
9227
9228	pos = os_strstr(param, " freq=");
9229	if (pos)
9230		res->freq = atoi(pos + 6);
9231
9232	pos = os_strstr(param, " beacon_int=");
9233	if (pos)
9234		res->beacon_int = atoi(pos + 12);
9235
9236	pos = os_strstr(param, " caps=");
9237	if (pos)
9238		res->caps = strtol(pos + 6, NULL, 16);
9239
9240	pos = os_strstr(param, " qual=");
9241	if (pos)
9242		res->qual = atoi(pos + 6);
9243
9244	pos = os_strstr(param, " noise=");
9245	if (pos)
9246		res->noise = atoi(pos + 7);
9247
9248	pos = os_strstr(param, " level=");
9249	if (pos)
9250		res->level = atoi(pos + 7);
9251
9252	pos = os_strstr(param, " tsf=");
9253	if (pos)
9254		res->tsf = strtoll(pos + 5, NULL, 16);
9255
9256	pos = os_strstr(param, " age=");
9257	if (pos)
9258		res->age = atoi(pos + 5);
9259
9260	pos = os_strstr(param, " est_throughput=");
9261	if (pos)
9262		res->est_throughput = atoi(pos + 16);
9263
9264	pos = os_strstr(param, " snr=");
9265	if (pos)
9266		res->snr = atoi(pos + 5);
9267
9268	pos = os_strstr(param, " parent_tsf=");
9269	if (pos)
9270		res->parent_tsf = strtoll(pos + 7, NULL, 16);
9271
9272	pos = os_strstr(param, " tsf_bssid=");
9273	if (pos && hwaddr_aton(pos + 11, res->tsf_bssid))
9274		goto fail;
9275
9276	pos = os_strstr(param, " ie=");
9277	if (pos) {
9278		pos += 4;
9279		end = os_strchr(pos, ' ');
9280		if (!end)
9281			end = pos + os_strlen(pos);
9282		res->ie_len = (end - pos) / 2;
9283		if (hexstr2bin(pos, (u8 *) (res + 1), res->ie_len))
9284			goto fail;
9285	}
9286
9287	pos = os_strstr(param, " beacon_ie=");
9288	if (pos) {
9289		pos += 11;
9290		end = os_strchr(pos, ' ');
9291		if (!end)
9292			end = pos + os_strlen(pos);
9293		res->beacon_ie_len = (end - pos) / 2;
9294		if (hexstr2bin(pos, ((u8 *) (res + 1)) + res->ie_len,
9295			       res->beacon_ie_len))
9296			goto fail;
9297	}
9298
9299	os_get_reltime(&now);
9300	wpa_bss_update_scan_res(wpa_s, res, &now);
9301	ret = 0;
9302fail:
9303	os_free(res);
9304
9305	return ret;
9306}
9307
9308
9309static int wpas_ctrl_iface_driver_event_assoc(struct wpa_supplicant *wpa_s,
9310					      char *param)
9311{
9312	union wpa_event_data event;
9313	struct assoc_info *ai;
9314	char *ctx = NULL;
9315	int ret = -1;
9316	struct wpabuf *req_ies = NULL;
9317	struct wpabuf *resp_ies = NULL;
9318	struct wpabuf *resp_frame = NULL;
9319	struct wpabuf *beacon_ies = NULL;
9320	struct wpabuf *key_replay_ctr = NULL;
9321	struct wpabuf *ptk_kck = NULL;
9322	struct wpabuf *ptk_kek = NULL;
9323	struct wpabuf *fils_pmk = NULL;
9324	char *str, *pos;
9325	u8 addr[ETH_ALEN];
9326	u8 fils_pmkid[PMKID_LEN];
9327
9328	os_memset(&event, 0, sizeof(event));
9329	ai = &event.assoc_info;
9330
9331	while ((str = str_token(param, " ", &ctx))) {
9332		pos = os_strchr(str, '=');
9333		if (!pos)
9334			goto fail;
9335		*pos++ = '\0';
9336
9337		if (os_strcmp(str, "reassoc") == 0) {
9338			ai->reassoc = atoi(pos);
9339		} else if (os_strcmp(str, "req_ies") == 0) {
9340			wpabuf_free(req_ies);
9341			req_ies = wpabuf_parse_bin(pos);
9342			if (!req_ies)
9343				goto fail;
9344			ai->req_ies = wpabuf_head(req_ies);
9345			ai->req_ies_len = wpabuf_len(req_ies);
9346		} else if (os_strcmp(str, "resp_ies") == 0) {
9347			wpabuf_free(resp_ies);
9348			resp_ies = wpabuf_parse_bin(pos);
9349			if (!resp_ies)
9350				goto fail;
9351			ai->resp_ies = wpabuf_head(resp_ies);
9352			ai->resp_ies_len = wpabuf_len(resp_ies);
9353		} else if (os_strcmp(str, "resp_frame") == 0) {
9354			wpabuf_free(resp_frame);
9355			resp_frame = wpabuf_parse_bin(pos);
9356			if (!resp_frame)
9357				goto fail;
9358			ai->resp_frame = wpabuf_head(resp_frame);
9359			ai->resp_frame_len = wpabuf_len(resp_frame);
9360		} else if (os_strcmp(str, "beacon_ies") == 0) {
9361			wpabuf_free(beacon_ies);
9362			beacon_ies = wpabuf_parse_bin(pos);
9363			if (!beacon_ies)
9364				goto fail;
9365			ai->beacon_ies = wpabuf_head(beacon_ies);
9366			ai->beacon_ies_len = wpabuf_len(beacon_ies);
9367		} else if (os_strcmp(str, "freq") == 0) {
9368			ai->freq = atoi(pos);
9369		} else if (os_strcmp(str, "wmm::info_bitmap") == 0) {
9370			ai->wmm_params.info_bitmap = atoi(pos);
9371		} else if (os_strcmp(str, "wmm::uapsd_queues") == 0) {
9372			ai->wmm_params.uapsd_queues = atoi(pos);
9373		} else if (os_strcmp(str, "addr") == 0) {
9374			if (hwaddr_aton(pos, addr))
9375				goto fail;
9376			ai->addr = addr;
9377		} else if (os_strcmp(str, "authorized") == 0) {
9378			ai->authorized = atoi(pos);
9379		} else if (os_strcmp(str, "key_replay_ctr") == 0) {
9380			wpabuf_free(key_replay_ctr);
9381			key_replay_ctr = wpabuf_parse_bin(pos);
9382			if (!key_replay_ctr)
9383				goto fail;
9384			ai->key_replay_ctr = wpabuf_head(key_replay_ctr);
9385			ai->key_replay_ctr_len = wpabuf_len(key_replay_ctr);
9386		} else if (os_strcmp(str, "ptk_kck") == 0) {
9387			wpabuf_free(ptk_kck);
9388			ptk_kck = wpabuf_parse_bin(pos);
9389			if (!ptk_kck)
9390				goto fail;
9391			ai->ptk_kck = wpabuf_head(ptk_kck);
9392			ai->ptk_kck_len = wpabuf_len(ptk_kck);
9393		} else if (os_strcmp(str, "ptk_kek") == 0) {
9394			wpabuf_free(ptk_kek);
9395			ptk_kek = wpabuf_parse_bin(pos);
9396			if (!ptk_kek)
9397				goto fail;
9398			ai->ptk_kek = wpabuf_head(ptk_kek);
9399			ai->ptk_kek_len = wpabuf_len(ptk_kek);
9400		} else if (os_strcmp(str, "subnet_status") == 0) {
9401			ai->subnet_status = atoi(pos);
9402		} else if (os_strcmp(str, "fils_erp_next_seq_num") == 0) {
9403			ai->fils_erp_next_seq_num = atoi(pos);
9404		} else if (os_strcmp(str, "fils_pmk") == 0) {
9405			wpabuf_free(fils_pmk);
9406			fils_pmk = wpabuf_parse_bin(pos);
9407			if (!fils_pmk)
9408				goto fail;
9409			ai->fils_pmk = wpabuf_head(fils_pmk);
9410			ai->fils_pmk_len = wpabuf_len(fils_pmk);
9411		} else if (os_strcmp(str, "fils_pmkid") == 0) {
9412			if (hexstr2bin(pos, fils_pmkid, PMKID_LEN) < 0)
9413				goto fail;
9414			ai->fils_pmkid = fils_pmkid;
9415		} else {
9416			goto fail;
9417		}
9418	}
9419
9420	wpa_supplicant_event(wpa_s, EVENT_ASSOC, &event);
9421	ret = 0;
9422fail:
9423	wpabuf_free(req_ies);
9424	wpabuf_free(resp_ies);
9425	wpabuf_free(resp_frame);
9426	wpabuf_free(beacon_ies);
9427	wpabuf_free(key_replay_ctr);
9428	wpabuf_free(ptk_kck);
9429	wpabuf_free(ptk_kek);
9430	wpabuf_free(fils_pmk);
9431	return ret;
9432}
9433
9434
9435static int wpas_ctrl_iface_driver_event(struct wpa_supplicant *wpa_s, char *cmd)
9436{
9437	char *pos, *param;
9438	union wpa_event_data event;
9439	enum wpa_event_type ev;
9440
9441	/* <event name> [parameters..] */
9442
9443	wpa_dbg(wpa_s, MSG_DEBUG, "Testing - external driver event: %s", cmd);
9444
9445	pos = cmd;
9446	param = os_strchr(pos, ' ');
9447	if (param)
9448		*param++ = '\0';
9449
9450	os_memset(&event, 0, sizeof(event));
9451
9452	if (os_strcmp(cmd, "INTERFACE_ENABLED") == 0) {
9453		ev = EVENT_INTERFACE_ENABLED;
9454	} else if (os_strcmp(cmd, "INTERFACE_DISABLED") == 0) {
9455		ev = EVENT_INTERFACE_DISABLED;
9456	} else if (os_strcmp(cmd, "AVOID_FREQUENCIES") == 0) {
9457		ev = EVENT_AVOID_FREQUENCIES;
9458		if (param == NULL)
9459			param = "";
9460		if (freq_range_list_parse(&event.freq_range, param) < 0)
9461			return -1;
9462		wpa_supplicant_event(wpa_s, ev, &event);
9463		os_free(event.freq_range.range);
9464		return 0;
9465	} else if (os_strcmp(cmd, "SCAN_RES") == 0) {
9466		return wpas_ctrl_iface_driver_scan_res(wpa_s, param);
9467	} else if (os_strcmp(cmd, "ASSOC") == 0) {
9468		return wpas_ctrl_iface_driver_event_assoc(wpa_s, param);
9469	} else {
9470		wpa_dbg(wpa_s, MSG_DEBUG, "Testing - unknown driver event: %s",
9471			cmd);
9472		return -1;
9473	}
9474
9475	wpa_supplicant_event(wpa_s, ev, &event);
9476
9477	return 0;
9478}
9479
9480
9481static int wpas_ctrl_iface_eapol_rx(struct wpa_supplicant *wpa_s, char *cmd)
9482{
9483	char *pos;
9484	u8 src[ETH_ALEN], *buf;
9485	int used;
9486	size_t len;
9487
9488	wpa_printf(MSG_DEBUG, "External EAPOL RX: %s", cmd);
9489
9490	pos = cmd;
9491	used = hwaddr_aton2(pos, src);
9492	if (used < 0)
9493		return -1;
9494	pos += used;
9495	while (*pos == ' ')
9496		pos++;
9497
9498	len = os_strlen(pos);
9499	if (len & 1)
9500		return -1;
9501	len /= 2;
9502
9503	buf = os_malloc(len);
9504	if (buf == NULL)
9505		return -1;
9506
9507	if (hexstr2bin(pos, buf, len) < 0) {
9508		os_free(buf);
9509		return -1;
9510	}
9511
9512	wpa_supplicant_rx_eapol(wpa_s, src, buf, len);
9513	os_free(buf);
9514
9515	return 0;
9516}
9517
9518
9519static int wpas_ctrl_iface_eapol_tx(struct wpa_supplicant *wpa_s, char *cmd)
9520{
9521	char *pos;
9522	u8 dst[ETH_ALEN], *buf;
9523	int used, ret;
9524	size_t len;
9525	unsigned int prev;
9526
9527	wpa_printf(MSG_DEBUG, "External EAPOL TX: %s", cmd);
9528
9529	pos = cmd;
9530	used = hwaddr_aton2(pos, dst);
9531	if (used < 0)
9532		return -1;
9533	pos += used;
9534	while (*pos == ' ')
9535		pos++;
9536
9537	len = os_strlen(pos);
9538	if (len & 1)
9539		return -1;
9540	len /= 2;
9541
9542	buf = os_malloc(len);
9543	if (!buf || hexstr2bin(pos, buf, len) < 0) {
9544		os_free(buf);
9545		return -1;
9546	}
9547
9548	prev = wpa_s->ext_eapol_frame_io;
9549	wpa_s->ext_eapol_frame_io = 0;
9550	ret = wpa_ether_send(wpa_s, dst, ETH_P_EAPOL, buf, len);
9551	wpa_s->ext_eapol_frame_io = prev;
9552	os_free(buf);
9553
9554	return ret;
9555}
9556
9557
9558static u16 ipv4_hdr_checksum(const void *buf, size_t len)
9559{
9560	size_t i;
9561	u32 sum = 0;
9562	const u16 *pos = buf;
9563
9564	for (i = 0; i < len / 2; i++)
9565		sum += *pos++;
9566
9567	while (sum >> 16)
9568		sum = (sum & 0xffff) + (sum >> 16);
9569
9570	return sum ^ 0xffff;
9571}
9572
9573
9574#define HWSIM_PACKETLEN 1500
9575#define HWSIM_IP_LEN (HWSIM_PACKETLEN - sizeof(struct ether_header))
9576
9577static void wpas_data_test_rx(void *ctx, const u8 *src_addr, const u8 *buf,
9578			      size_t len)
9579{
9580	struct wpa_supplicant *wpa_s = ctx;
9581	const struct ether_header *eth;
9582	struct ip ip;
9583	const u8 *pos;
9584	unsigned int i;
9585	char extra[30];
9586
9587	if (len < sizeof(*eth) + sizeof(ip) || len > HWSIM_PACKETLEN) {
9588		wpa_printf(MSG_DEBUG,
9589			   "test data: RX - ignore unexpected length %d",
9590			   (int) len);
9591		return;
9592	}
9593
9594	eth = (const struct ether_header *) buf;
9595	os_memcpy(&ip, eth + 1, sizeof(ip));
9596	pos = &buf[sizeof(*eth) + sizeof(ip)];
9597
9598	if (ip.ip_hl != 5 || ip.ip_v != 4 || ntohs(ip.ip_len) > HWSIM_IP_LEN) {
9599		wpa_printf(MSG_DEBUG,
9600			   "test data: RX - ignore unexpected IP header");
9601		return;
9602	}
9603
9604	for (i = 0; i < ntohs(ip.ip_len) - sizeof(ip); i++) {
9605		if (*pos != (u8) i) {
9606			wpa_printf(MSG_DEBUG,
9607				   "test data: RX - ignore mismatching payload");
9608			return;
9609		}
9610		pos++;
9611	}
9612	extra[0] = '\0';
9613	if (ntohs(ip.ip_len) != HWSIM_IP_LEN)
9614		os_snprintf(extra, sizeof(extra), " len=%d", ntohs(ip.ip_len));
9615	wpa_msg(wpa_s, MSG_INFO, "DATA-TEST-RX " MACSTR " " MACSTR "%s",
9616		MAC2STR(eth->ether_dhost), MAC2STR(eth->ether_shost), extra);
9617}
9618
9619
9620static int wpas_ctrl_iface_data_test_config(struct wpa_supplicant *wpa_s,
9621					    char *cmd)
9622{
9623	int enabled = atoi(cmd);
9624	char *pos;
9625	const char *ifname;
9626
9627	if (!enabled) {
9628		if (wpa_s->l2_test) {
9629			l2_packet_deinit(wpa_s->l2_test);
9630			wpa_s->l2_test = NULL;
9631			wpa_dbg(wpa_s, MSG_DEBUG, "test data: Disabled");
9632		}
9633		return 0;
9634	}
9635
9636	if (wpa_s->l2_test)
9637		return 0;
9638
9639	pos = os_strstr(cmd, " ifname=");
9640	if (pos)
9641		ifname = pos + 8;
9642	else
9643		ifname = wpa_s->ifname;
9644
9645	wpa_s->l2_test = l2_packet_init(ifname, wpa_s->own_addr,
9646					ETHERTYPE_IP, wpas_data_test_rx,
9647					wpa_s, 1);
9648	if (wpa_s->l2_test == NULL)
9649		return -1;
9650
9651	wpa_dbg(wpa_s, MSG_DEBUG, "test data: Enabled");
9652
9653	return 0;
9654}
9655
9656
9657static int wpas_ctrl_iface_data_test_tx(struct wpa_supplicant *wpa_s, char *cmd)
9658{
9659	u8 dst[ETH_ALEN], src[ETH_ALEN];
9660	char *pos, *pos2;
9661	int used;
9662	long int val;
9663	u8 tos;
9664	u8 buf[2 + HWSIM_PACKETLEN];
9665	struct ether_header *eth;
9666	struct ip *ip;
9667	u8 *dpos;
9668	unsigned int i;
9669	size_t send_len = HWSIM_IP_LEN;
9670
9671	if (wpa_s->l2_test == NULL)
9672		return -1;
9673
9674	/* format: <dst> <src> <tos> [len=<length>] */
9675
9676	pos = cmd;
9677	used = hwaddr_aton2(pos, dst);
9678	if (used < 0)
9679		return -1;
9680	pos += used;
9681	while (*pos == ' ')
9682		pos++;
9683	used = hwaddr_aton2(pos, src);
9684	if (used < 0)
9685		return -1;
9686	pos += used;
9687
9688	val = strtol(pos, &pos2, 0);
9689	if (val < 0 || val > 0xff)
9690		return -1;
9691	tos = val;
9692
9693	pos = os_strstr(pos2, " len=");
9694	if (pos) {
9695		i = atoi(pos + 5);
9696		if (i < sizeof(*ip) || i > HWSIM_IP_LEN)
9697			return -1;
9698		send_len = i;
9699	}
9700
9701	eth = (struct ether_header *) &buf[2];
9702	os_memcpy(eth->ether_dhost, dst, ETH_ALEN);
9703	os_memcpy(eth->ether_shost, src, ETH_ALEN);
9704	eth->ether_type = htons(ETHERTYPE_IP);
9705	ip = (struct ip *) (eth + 1);
9706	os_memset(ip, 0, sizeof(*ip));
9707	ip->ip_hl = 5;
9708	ip->ip_v = 4;
9709	ip->ip_ttl = 64;
9710	ip->ip_tos = tos;
9711	ip->ip_len = htons(send_len);
9712	ip->ip_p = 1;
9713	ip->ip_src.s_addr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 1);
9714	ip->ip_dst.s_addr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 2);
9715	ip->ip_sum = ipv4_hdr_checksum(ip, sizeof(*ip));
9716	dpos = (u8 *) (ip + 1);
9717	for (i = 0; i < send_len - sizeof(*ip); i++)
9718		*dpos++ = i;
9719
9720	if (l2_packet_send(wpa_s->l2_test, dst, ETHERTYPE_IP, &buf[2],
9721			   sizeof(struct ether_header) + send_len) < 0)
9722		return -1;
9723
9724	wpa_dbg(wpa_s, MSG_DEBUG, "test data: TX dst=" MACSTR " src=" MACSTR
9725		" tos=0x%x", MAC2STR(dst), MAC2STR(src), tos);
9726
9727	return 0;
9728}
9729
9730
9731static int wpas_ctrl_iface_data_test_frame(struct wpa_supplicant *wpa_s,
9732					   char *cmd)
9733{
9734	u8 *buf;
9735	struct ether_header *eth;
9736	struct l2_packet_data *l2 = NULL;
9737	size_t len;
9738	u16 ethertype;
9739	int res = -1;
9740
9741	len = os_strlen(cmd);
9742	if (len & 1 || len < ETH_HLEN * 2)
9743		return -1;
9744	len /= 2;
9745
9746	buf = os_malloc(len);
9747	if (buf == NULL)
9748		return -1;
9749
9750	if (hexstr2bin(cmd, buf, len) < 0)
9751		goto done;
9752
9753	eth = (struct ether_header *) buf;
9754	ethertype = ntohs(eth->ether_type);
9755
9756	l2 = l2_packet_init(wpa_s->ifname, wpa_s->own_addr, ethertype,
9757			    wpas_data_test_rx, wpa_s, 1);
9758	if (l2 == NULL)
9759		goto done;
9760
9761	res = l2_packet_send(l2, eth->ether_dhost, ethertype, buf, len);
9762	wpa_dbg(wpa_s, MSG_DEBUG, "test data: TX frame res=%d", res);
9763done:
9764	if (l2)
9765		l2_packet_deinit(l2);
9766	os_free(buf);
9767
9768	return res < 0 ? -1 : 0;
9769}
9770
9771
9772static int wpas_ctrl_test_alloc_fail(struct wpa_supplicant *wpa_s, char *cmd)
9773{
9774#ifdef WPA_TRACE_BFD
9775	char *pos;
9776
9777	wpa_trace_fail_after = atoi(cmd);
9778	pos = os_strchr(cmd, ':');
9779	if (pos) {
9780		pos++;
9781		os_strlcpy(wpa_trace_fail_func, pos,
9782			   sizeof(wpa_trace_fail_func));
9783	} else {
9784		wpa_trace_fail_after = 0;
9785	}
9786	return 0;
9787#else /* WPA_TRACE_BFD */
9788	return -1;
9789#endif /* WPA_TRACE_BFD */
9790}
9791
9792
9793static int wpas_ctrl_get_alloc_fail(struct wpa_supplicant *wpa_s,
9794				    char *buf, size_t buflen)
9795{
9796#ifdef WPA_TRACE_BFD
9797	return os_snprintf(buf, buflen, "%u:%s", wpa_trace_fail_after,
9798			   wpa_trace_fail_func);
9799#else /* WPA_TRACE_BFD */
9800	return -1;
9801#endif /* WPA_TRACE_BFD */
9802}
9803
9804
9805static int wpas_ctrl_test_fail(struct wpa_supplicant *wpa_s, char *cmd)
9806{
9807#ifdef WPA_TRACE_BFD
9808	char *pos;
9809
9810	wpa_trace_test_fail_after = atoi(cmd);
9811	pos = os_strchr(cmd, ':');
9812	if (pos) {
9813		pos++;
9814		os_strlcpy(wpa_trace_test_fail_func, pos,
9815			   sizeof(wpa_trace_test_fail_func));
9816	} else {
9817		wpa_trace_test_fail_after = 0;
9818	}
9819	return 0;
9820#else /* WPA_TRACE_BFD */
9821	return -1;
9822#endif /* WPA_TRACE_BFD */
9823}
9824
9825
9826static int wpas_ctrl_get_fail(struct wpa_supplicant *wpa_s,
9827				    char *buf, size_t buflen)
9828{
9829#ifdef WPA_TRACE_BFD
9830	return os_snprintf(buf, buflen, "%u:%s", wpa_trace_test_fail_after,
9831			   wpa_trace_test_fail_func);
9832#else /* WPA_TRACE_BFD */
9833	return -1;
9834#endif /* WPA_TRACE_BFD */
9835}
9836
9837
9838static void wpas_ctrl_event_test_cb(void *eloop_ctx, void *timeout_ctx)
9839{
9840	struct wpa_supplicant *wpa_s = eloop_ctx;
9841	int i, count = (intptr_t) timeout_ctx;
9842
9843	wpa_printf(MSG_DEBUG, "TEST: Send %d control interface event messages",
9844		   count);
9845	for (i = 0; i < count; i++) {
9846		wpa_msg_ctrl(wpa_s, MSG_INFO, "TEST-EVENT-MESSAGE %d/%d",
9847			     i + 1, count);
9848	}
9849}
9850
9851
9852static int wpas_ctrl_event_test(struct wpa_supplicant *wpa_s, const char *cmd)
9853{
9854	int count;
9855
9856	count = atoi(cmd);
9857	if (count <= 0)
9858		return -1;
9859
9860	return eloop_register_timeout(0, 0, wpas_ctrl_event_test_cb, wpa_s,
9861				      (void *) (intptr_t) count);
9862}
9863
9864
9865static int wpas_ctrl_test_assoc_ie(struct wpa_supplicant *wpa_s,
9866				   const char *cmd)
9867{
9868	struct wpabuf *buf;
9869	size_t len;
9870
9871	len = os_strlen(cmd);
9872	if (len & 1)
9873		return -1;
9874	len /= 2;
9875
9876	if (len == 0) {
9877		buf = NULL;
9878	} else {
9879		buf = wpabuf_alloc(len);
9880		if (buf == NULL)
9881			return -1;
9882
9883		if (hexstr2bin(cmd, wpabuf_put(buf, len), len) < 0) {
9884			wpabuf_free(buf);
9885			return -1;
9886		}
9887	}
9888
9889	wpa_sm_set_test_assoc_ie(wpa_s->wpa, buf);
9890	return 0;
9891}
9892
9893
9894static int wpas_ctrl_reset_pn(struct wpa_supplicant *wpa_s)
9895{
9896	u8 zero[WPA_TK_MAX_LEN];
9897
9898	if (wpa_s->last_tk_alg == WPA_ALG_NONE)
9899		return -1;
9900
9901	wpa_printf(MSG_INFO, "TESTING: Reset PN");
9902	os_memset(zero, 0, sizeof(zero));
9903
9904	/* First, use a zero key to avoid any possible duplicate key avoidance
9905	 * in the driver. */
9906	if (wpa_drv_set_key(wpa_s, wpa_s->last_tk_alg, wpa_s->last_tk_addr,
9907			    wpa_s->last_tk_key_idx, 1, zero, 6,
9908			    zero, wpa_s->last_tk_len,
9909			    KEY_FLAG_PAIRWISE_RX_TX) < 0)
9910		return -1;
9911
9912	/* Set the previously configured key to reset its TSC/RSC */
9913	return wpa_drv_set_key(wpa_s, wpa_s->last_tk_alg, wpa_s->last_tk_addr,
9914			       wpa_s->last_tk_key_idx, 1, zero, 6,
9915			       wpa_s->last_tk, wpa_s->last_tk_len,
9916			       KEY_FLAG_PAIRWISE_RX_TX);
9917}
9918
9919
9920static int wpas_ctrl_key_request(struct wpa_supplicant *wpa_s, const char *cmd)
9921{
9922	const char *pos = cmd;
9923	int error, pairwise;
9924
9925	error = atoi(pos);
9926	pos = os_strchr(pos, ' ');
9927	if (!pos)
9928		return -1;
9929	pairwise = atoi(pos);
9930	wpa_sm_key_request(wpa_s->wpa, error, pairwise);
9931	return 0;
9932}
9933
9934
9935static int wpas_ctrl_resend_assoc(struct wpa_supplicant *wpa_s)
9936{
9937#ifdef CONFIG_SME
9938	struct wpa_driver_associate_params params;
9939	int ret;
9940
9941	os_memset(&params, 0, sizeof(params));
9942	params.bssid = wpa_s->bssid;
9943	params.ssid = wpa_s->sme.ssid;
9944	params.ssid_len = wpa_s->sme.ssid_len;
9945	params.freq.freq = wpa_s->sme.freq;
9946	if (wpa_s->last_assoc_req_wpa_ie) {
9947		params.wpa_ie = wpabuf_head(wpa_s->last_assoc_req_wpa_ie);
9948		params.wpa_ie_len = wpabuf_len(wpa_s->last_assoc_req_wpa_ie);
9949	}
9950	params.pairwise_suite = wpa_s->pairwise_cipher;
9951	params.group_suite = wpa_s->group_cipher;
9952	params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
9953	params.key_mgmt_suite = wpa_s->key_mgmt;
9954	params.wpa_proto = wpa_s->wpa_proto;
9955	params.mgmt_frame_protection = wpa_s->sme.mfp;
9956	params.rrm_used = wpa_s->rrm.rrm_used;
9957	if (wpa_s->sme.prev_bssid_set)
9958		params.prev_bssid = wpa_s->sme.prev_bssid;
9959	wpa_printf(MSG_INFO, "TESTING: Resend association request");
9960	ret = wpa_drv_associate(wpa_s, &params);
9961	wpa_s->testing_resend_assoc = 1;
9962	return ret;
9963#else /* CONFIG_SME */
9964	return -1;
9965#endif /* CONFIG_SME */
9966}
9967
9968
9969static int wpas_ctrl_iface_send_twt_setup(struct wpa_supplicant *wpa_s,
9970					  const char *cmd)
9971{
9972	u8 dtok = 1;
9973	int exponent = 10;
9974	int mantissa = 8192;
9975	u8 min_twt = 255;
9976	unsigned long long twt = 0;
9977	bool requestor = true;
9978	int setup_cmd = 0;
9979	bool trigger = true;
9980	bool implicit = true;
9981	bool flow_type = true;
9982	int flow_id = 0;
9983	bool protection = false;
9984	u8 twt_channel = 0;
9985	u8 control = BIT(4); /* Control field (IEEE P802.11ax/D8.0 Figure
9986			      * 9-687): B4 = TWT Information Frame Disabled */
9987	const char *tok_s;
9988
9989	tok_s = os_strstr(cmd, " dialog=");
9990	if (tok_s)
9991		dtok = atoi(tok_s + os_strlen(" dialog="));
9992
9993	tok_s = os_strstr(cmd, " exponent=");
9994	if (tok_s)
9995		exponent = atoi(tok_s + os_strlen(" exponent="));
9996
9997	tok_s = os_strstr(cmd, " mantissa=");
9998	if (tok_s)
9999		mantissa = atoi(tok_s + os_strlen(" mantissa="));
10000
10001	tok_s = os_strstr(cmd, " min_twt=");
10002	if (tok_s)
10003		min_twt = atoi(tok_s + os_strlen(" min_twt="));
10004
10005	tok_s = os_strstr(cmd, " setup_cmd=");
10006	if (tok_s)
10007		setup_cmd = atoi(tok_s + os_strlen(" setup_cmd="));
10008
10009	tok_s = os_strstr(cmd, " twt=");
10010	if (tok_s)
10011		sscanf(tok_s + os_strlen(" twt="), "%llu", &twt);
10012
10013	tok_s = os_strstr(cmd, " requestor=");
10014	if (tok_s)
10015		requestor = atoi(tok_s + os_strlen(" requestor="));
10016
10017	tok_s = os_strstr(cmd, " trigger=");
10018	if (tok_s)
10019		trigger = atoi(tok_s + os_strlen(" trigger="));
10020
10021	tok_s = os_strstr(cmd, " implicit=");
10022	if (tok_s)
10023		implicit = atoi(tok_s + os_strlen(" implicit="));
10024
10025	tok_s = os_strstr(cmd, " flow_type=");
10026	if (tok_s)
10027		flow_type = atoi(tok_s + os_strlen(" flow_type="));
10028
10029	tok_s = os_strstr(cmd, " flow_id=");
10030	if (tok_s)
10031		flow_id = atoi(tok_s + os_strlen(" flow_id="));
10032
10033	tok_s = os_strstr(cmd, " protection=");
10034	if (tok_s)
10035		protection = atoi(tok_s + os_strlen(" protection="));
10036
10037	tok_s = os_strstr(cmd, " twt_channel=");
10038	if (tok_s)
10039		twt_channel = atoi(tok_s + os_strlen(" twt_channel="));
10040
10041	tok_s = os_strstr(cmd, " control=");
10042	if (tok_s)
10043		control = atoi(tok_s + os_strlen(" control="));
10044
10045	return wpas_twt_send_setup(wpa_s, dtok, exponent, mantissa, min_twt,
10046				   setup_cmd, twt, requestor, trigger, implicit,
10047				   flow_type, flow_id, protection, twt_channel,
10048				   control);
10049}
10050
10051
10052static int wpas_ctrl_iface_send_twt_teardown(struct wpa_supplicant *wpa_s,
10053					     const char *cmd)
10054{
10055	u8 flags = 0x1;
10056	const char *tok_s;
10057
10058	tok_s = os_strstr(cmd, " flags=");
10059	if (tok_s)
10060		flags = atoi(tok_s + os_strlen(" flags="));
10061
10062	return wpas_twt_send_teardown(wpa_s, flags);
10063}
10064
10065#endif /* CONFIG_TESTING_OPTIONS */
10066
10067
10068static int wpas_ctrl_vendor_elem_add(struct wpa_supplicant *wpa_s, char *cmd)
10069{
10070	char *pos = cmd;
10071	int frame;
10072	size_t len;
10073	struct wpabuf *buf;
10074	struct ieee802_11_elems elems;
10075
10076	frame = atoi(pos);
10077	if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
10078		return -1;
10079	wpa_s = wpas_vendor_elem(wpa_s, frame);
10080
10081	pos = os_strchr(pos, ' ');
10082	if (pos == NULL)
10083		return -1;
10084	pos++;
10085
10086	len = os_strlen(pos);
10087	if (len == 0)
10088		return 0;
10089	if (len & 1)
10090		return -1;
10091	len /= 2;
10092
10093	buf = wpabuf_alloc(len);
10094	if (buf == NULL)
10095		return -1;
10096
10097	if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
10098		wpabuf_free(buf);
10099		return -1;
10100	}
10101
10102	if (ieee802_11_parse_elems(wpabuf_head_u8(buf), len, &elems, 0) ==
10103	    ParseFailed) {
10104		wpabuf_free(buf);
10105		return -1;
10106	}
10107
10108	if (wpa_s->vendor_elem[frame] == NULL) {
10109		wpa_s->vendor_elem[frame] = buf;
10110		goto update_ies;
10111	}
10112
10113	if (wpabuf_resize(&wpa_s->vendor_elem[frame], len) < 0) {
10114		wpabuf_free(buf);
10115		return -1;
10116	}
10117
10118	wpabuf_put_buf(wpa_s->vendor_elem[frame], buf);
10119	wpabuf_free(buf);
10120
10121update_ies:
10122	wpas_vendor_elem_update(wpa_s);
10123
10124	if (frame == VENDOR_ELEM_PROBE_REQ ||
10125	    frame == VENDOR_ELEM_PROBE_REQ_P2P)
10126		wpa_supplicant_set_default_scan_ies(wpa_s);
10127
10128	return 0;
10129}
10130
10131
10132static int wpas_ctrl_vendor_elem_get(struct wpa_supplicant *wpa_s, char *cmd,
10133				     char *buf, size_t buflen)
10134{
10135	int frame = atoi(cmd);
10136
10137	if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
10138		return -1;
10139	wpa_s = wpas_vendor_elem(wpa_s, frame);
10140
10141	if (wpa_s->vendor_elem[frame] == NULL)
10142		return 0;
10143
10144	return wpa_snprintf_hex(buf, buflen,
10145				wpabuf_head_u8(wpa_s->vendor_elem[frame]),
10146				wpabuf_len(wpa_s->vendor_elem[frame]));
10147}
10148
10149
10150static int wpas_ctrl_vendor_elem_remove(struct wpa_supplicant *wpa_s, char *cmd)
10151{
10152	char *pos = cmd;
10153	int frame;
10154	size_t len;
10155	u8 *buf;
10156	struct ieee802_11_elems elems;
10157	int res;
10158
10159	frame = atoi(pos);
10160	if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
10161		return -1;
10162	wpa_s = wpas_vendor_elem(wpa_s, frame);
10163
10164	pos = os_strchr(pos, ' ');
10165	if (pos == NULL)
10166		return -1;
10167	pos++;
10168
10169	if (*pos == '*') {
10170		wpabuf_free(wpa_s->vendor_elem[frame]);
10171		wpa_s->vendor_elem[frame] = NULL;
10172		wpas_vendor_elem_update(wpa_s);
10173		return 0;
10174	}
10175
10176	if (wpa_s->vendor_elem[frame] == NULL)
10177		return -1;
10178
10179	len = os_strlen(pos);
10180	if (len == 0)
10181		return 0;
10182	if (len & 1)
10183		return -1;
10184	len /= 2;
10185
10186	buf = os_malloc(len);
10187	if (buf == NULL)
10188		return -1;
10189
10190	if (hexstr2bin(pos, buf, len) < 0) {
10191		os_free(buf);
10192		return -1;
10193	}
10194
10195	if (ieee802_11_parse_elems(buf, len, &elems, 0) == ParseFailed) {
10196		os_free(buf);
10197		return -1;
10198	}
10199
10200	res = wpas_vendor_elem_remove(wpa_s, frame, buf, len);
10201	os_free(buf);
10202	return res;
10203}
10204
10205
10206static void wpas_ctrl_neighbor_rep_cb(void *ctx, struct wpabuf *neighbor_rep)
10207{
10208	struct wpa_supplicant *wpa_s = ctx;
10209	size_t len;
10210	const u8 *data;
10211
10212	/*
10213	 * Neighbor Report element (IEEE P802.11-REVmc/D5.0)
10214	 * BSSID[6]
10215	 * BSSID Information[4]
10216	 * Operating Class[1]
10217	 * Channel Number[1]
10218	 * PHY Type[1]
10219	 * Optional Subelements[variable]
10220	 */
10221#define NR_IE_MIN_LEN (ETH_ALEN + 4 + 1 + 1 + 1)
10222
10223	if (!neighbor_rep || wpabuf_len(neighbor_rep) == 0) {
10224		wpa_msg_ctrl(wpa_s, MSG_INFO, RRM_EVENT_NEIGHBOR_REP_FAILED);
10225		goto out;
10226	}
10227
10228	data = wpabuf_head_u8(neighbor_rep);
10229	len = wpabuf_len(neighbor_rep);
10230
10231	while (len >= 2 + NR_IE_MIN_LEN) {
10232		const u8 *nr;
10233		char lci[256 * 2 + 1];
10234		char civic[256 * 2 + 1];
10235		u8 nr_len = data[1];
10236		const u8 *pos = data, *end;
10237
10238		if (pos[0] != WLAN_EID_NEIGHBOR_REPORT ||
10239		    nr_len < NR_IE_MIN_LEN) {
10240			wpa_dbg(wpa_s, MSG_DEBUG,
10241				"CTRL: Invalid Neighbor Report element: id=%u len=%u",
10242				data[0], nr_len);
10243			goto out;
10244		}
10245
10246		if (2U + nr_len > len) {
10247			wpa_dbg(wpa_s, MSG_DEBUG,
10248				"CTRL: Invalid Neighbor Report element: id=%u len=%zu nr_len=%u",
10249				data[0], len, nr_len);
10250			goto out;
10251		}
10252		pos += 2;
10253		end = pos + nr_len;
10254
10255		nr = pos;
10256		pos += NR_IE_MIN_LEN;
10257
10258		lci[0] = '\0';
10259		civic[0] = '\0';
10260		while (end - pos > 2) {
10261			u8 s_id, s_len;
10262
10263			s_id = *pos++;
10264			s_len = *pos++;
10265			if (s_len > end - pos)
10266				goto out;
10267			if (s_id == WLAN_EID_MEASURE_REPORT && s_len > 3) {
10268				/* Measurement Token[1] */
10269				/* Measurement Report Mode[1] */
10270				/* Measurement Type[1] */
10271				/* Measurement Report[variable] */
10272				switch (pos[2]) {
10273				case MEASURE_TYPE_LCI:
10274					if (lci[0])
10275						break;
10276					wpa_snprintf_hex(lci, sizeof(lci),
10277							 pos, s_len);
10278					break;
10279				case MEASURE_TYPE_LOCATION_CIVIC:
10280					if (civic[0])
10281						break;
10282					wpa_snprintf_hex(civic, sizeof(civic),
10283							 pos, s_len);
10284					break;
10285				}
10286			}
10287
10288			pos += s_len;
10289		}
10290
10291		wpa_msg(wpa_s, MSG_INFO, RRM_EVENT_NEIGHBOR_REP_RXED
10292			"bssid=" MACSTR
10293			" info=0x%x op_class=%u chan=%u phy_type=%u%s%s%s%s",
10294			MAC2STR(nr), WPA_GET_LE32(nr + ETH_ALEN),
10295			nr[ETH_ALEN + 4], nr[ETH_ALEN + 5],
10296			nr[ETH_ALEN + 6],
10297			lci[0] ? " lci=" : "", lci,
10298			civic[0] ? " civic=" : "", civic);
10299
10300		data = end;
10301		len -= 2 + nr_len;
10302	}
10303
10304out:
10305	wpabuf_free(neighbor_rep);
10306}
10307
10308
10309static int wpas_ctrl_iface_send_neighbor_rep(struct wpa_supplicant *wpa_s,
10310					     char *cmd)
10311{
10312	struct wpa_ssid_value ssid, *ssid_p = NULL;
10313	int ret, lci = 0, civic = 0;
10314	char *ssid_s;
10315
10316	ssid_s = os_strstr(cmd, "ssid=");
10317	if (ssid_s) {
10318		if (ssid_parse(ssid_s + 5, &ssid)) {
10319			wpa_msg(wpa_s, MSG_INFO,
10320				"CTRL: Send Neighbor Report: bad SSID");
10321			return -1;
10322		}
10323
10324		ssid_p = &ssid;
10325
10326		/*
10327		 * Move cmd after the SSID text that may include "lci" or
10328		 * "civic".
10329		 */
10330		cmd = os_strchr(ssid_s + 6, ssid_s[5] == '"' ? '"' : ' ');
10331		if (cmd)
10332			cmd++;
10333
10334	}
10335
10336	if (cmd && os_strstr(cmd, "lci"))
10337		lci = 1;
10338
10339	if (cmd && os_strstr(cmd, "civic"))
10340		civic = 1;
10341
10342	ret = wpas_rrm_send_neighbor_rep_request(wpa_s, ssid_p, lci, civic,
10343						 wpas_ctrl_neighbor_rep_cb,
10344						 wpa_s);
10345
10346	return ret;
10347}
10348
10349
10350static int wpas_ctrl_iface_erp_flush(struct wpa_supplicant *wpa_s)
10351{
10352	eapol_sm_erp_flush(wpa_s->eapol);
10353	return 0;
10354}
10355
10356
10357static int wpas_ctrl_iface_mac_rand_scan(struct wpa_supplicant *wpa_s,
10358					 char *cmd)
10359{
10360	char *token, *context = NULL;
10361	unsigned int enable = ~0, type = 0;
10362	u8 _addr[ETH_ALEN], _mask[ETH_ALEN];
10363	u8 *addr = NULL, *mask = NULL;
10364
10365	while ((token = str_token(cmd, " ", &context))) {
10366		if (os_strcasecmp(token, "scan") == 0) {
10367			type |= MAC_ADDR_RAND_SCAN;
10368		} else if (os_strcasecmp(token, "sched") == 0) {
10369			type |= MAC_ADDR_RAND_SCHED_SCAN;
10370		} else if (os_strcasecmp(token, "pno") == 0) {
10371			type |= MAC_ADDR_RAND_PNO;
10372		} else if (os_strcasecmp(token, "all") == 0) {
10373			type = wpa_s->mac_addr_rand_supported;
10374		} else if (os_strncasecmp(token, "enable=", 7) == 0) {
10375			enable = atoi(token + 7);
10376		} else if (os_strncasecmp(token, "addr=", 5) == 0) {
10377			addr = _addr;
10378			if (hwaddr_aton(token + 5, addr)) {
10379				wpa_printf(MSG_INFO,
10380					   "CTRL: Invalid MAC address: %s",
10381					   token);
10382				return -1;
10383			}
10384		} else if (os_strncasecmp(token, "mask=", 5) == 0) {
10385			mask = _mask;
10386			if (hwaddr_aton(token + 5, mask)) {
10387				wpa_printf(MSG_INFO,
10388					   "CTRL: Invalid MAC address mask: %s",
10389					   token);
10390				return -1;
10391			}
10392		} else {
10393			wpa_printf(MSG_INFO,
10394				   "CTRL: Invalid MAC_RAND_SCAN parameter: %s",
10395				   token);
10396			return -1;
10397		}
10398	}
10399
10400	if (!type) {
10401		wpa_printf(MSG_INFO, "CTRL: MAC_RAND_SCAN no type specified");
10402		return -1;
10403	}
10404
10405	if (enable > 1) {
10406		wpa_printf(MSG_INFO,
10407			   "CTRL: MAC_RAND_SCAN enable=<0/1> not specified");
10408		return -1;
10409	}
10410
10411	if (!enable)
10412		return wpas_disable_mac_addr_randomization(wpa_s, type);
10413
10414	return wpas_enable_mac_addr_randomization(wpa_s, type, addr, mask);
10415}
10416
10417
10418static int wpas_ctrl_iface_pmksa(struct wpa_supplicant *wpa_s,
10419				 char *buf, size_t buflen)
10420{
10421	size_t reply_len;
10422
10423	reply_len = wpa_sm_pmksa_cache_list(wpa_s->wpa, buf, buflen);
10424#ifdef CONFIG_AP
10425	reply_len += wpas_ap_pmksa_cache_list(wpa_s, &buf[reply_len],
10426					      buflen - reply_len);
10427#endif /* CONFIG_AP */
10428	return reply_len;
10429}
10430
10431
10432static void wpas_ctrl_iface_pmksa_flush(struct wpa_supplicant *wpa_s)
10433{
10434	ptksa_cache_flush(wpa_s->ptksa, NULL, WPA_CIPHER_NONE);
10435	wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
10436#ifdef CONFIG_AP
10437	wpas_ap_pmksa_cache_flush(wpa_s);
10438#endif /* CONFIG_AP */
10439}
10440
10441
10442#ifdef CONFIG_PMKSA_CACHE_EXTERNAL
10443
10444static int wpas_ctrl_iface_pmksa_get(struct wpa_supplicant *wpa_s,
10445				     const char *cmd, char *buf, size_t buflen)
10446{
10447	struct rsn_pmksa_cache_entry *entry;
10448	struct wpa_ssid *ssid;
10449	char *pos, *pos2, *end;
10450	int ret;
10451	struct os_reltime now;
10452
10453	ssid = wpa_config_get_network(wpa_s->conf, atoi(cmd));
10454	if (!ssid)
10455		return -1;
10456
10457	pos = buf;
10458	end = buf + buflen;
10459
10460	os_get_reltime(&now);
10461
10462	/*
10463	 * Entry format:
10464	 * <BSSID> <PMKID> <PMK> <reauth_time in seconds>
10465	 * <expiration in seconds> <akmp> <opportunistic>
10466	 * [FILS Cache Identifier]
10467	 */
10468
10469	for (entry = wpa_sm_pmksa_cache_head(wpa_s->wpa); entry;
10470	     entry = entry->next) {
10471		if (entry->network_ctx != ssid)
10472			continue;
10473
10474		pos2 = pos;
10475		ret = os_snprintf(pos2, end - pos2, MACSTR " ",
10476				  MAC2STR(entry->aa));
10477		if (os_snprintf_error(end - pos2, ret))
10478			break;
10479		pos2 += ret;
10480
10481		pos2 += wpa_snprintf_hex(pos2, end - pos2, entry->pmkid,
10482					 PMKID_LEN);
10483
10484		ret = os_snprintf(pos2, end - pos2, " ");
10485		if (os_snprintf_error(end - pos2, ret))
10486			break;
10487		pos2 += ret;
10488
10489		pos2 += wpa_snprintf_hex(pos2, end - pos2, entry->pmk,
10490					 entry->pmk_len);
10491
10492		ret = os_snprintf(pos2, end - pos2, " %d %d %d %d",
10493				  (int) (entry->reauth_time - now.sec),
10494				  (int) (entry->expiration - now.sec),
10495				  entry->akmp,
10496				  entry->opportunistic);
10497		if (os_snprintf_error(end - pos2, ret))
10498			break;
10499		pos2 += ret;
10500
10501		if (entry->fils_cache_id_set) {
10502			ret = os_snprintf(pos2, end - pos2, " %02x%02x",
10503					  entry->fils_cache_id[0],
10504					  entry->fils_cache_id[1]);
10505			if (os_snprintf_error(end - pos2, ret))
10506				break;
10507			pos2 += ret;
10508		}
10509
10510		ret = os_snprintf(pos2, end - pos2, "\n");
10511		if (os_snprintf_error(end - pos2, ret))
10512			break;
10513		pos2 += ret;
10514
10515		pos = pos2;
10516	}
10517
10518	return pos - buf;
10519}
10520
10521
10522static int wpas_ctrl_iface_pmksa_add(struct wpa_supplicant *wpa_s,
10523				     char *cmd)
10524{
10525	struct rsn_pmksa_cache_entry *entry;
10526	struct wpa_ssid *ssid;
10527	char *pos, *pos2;
10528	int ret = -1;
10529	struct os_reltime now;
10530	int reauth_time = 0, expiration = 0, i;
10531
10532	/*
10533	 * Entry format:
10534	 * <network_id> <BSSID> <PMKID> <PMK> <reauth_time in seconds>
10535	 * <expiration in seconds> <akmp> <opportunistic>
10536	 * [FILS Cache Identifier]
10537	 */
10538
10539	ssid = wpa_config_get_network(wpa_s->conf, atoi(cmd));
10540	if (!ssid)
10541		return -1;
10542
10543	pos = os_strchr(cmd, ' ');
10544	if (!pos)
10545		return -1;
10546	pos++;
10547
10548	entry = os_zalloc(sizeof(*entry));
10549	if (!entry)
10550		return -1;
10551
10552	if (hwaddr_aton(pos, entry->aa))
10553		goto fail;
10554
10555	pos = os_strchr(pos, ' ');
10556	if (!pos)
10557		goto fail;
10558	pos++;
10559
10560	if (hexstr2bin(pos, entry->pmkid, PMKID_LEN) < 0)
10561		goto fail;
10562
10563	pos = os_strchr(pos, ' ');
10564	if (!pos)
10565		goto fail;
10566	pos++;
10567
10568	pos2 = os_strchr(pos, ' ');
10569	if (!pos2)
10570		goto fail;
10571	entry->pmk_len = (pos2 - pos) / 2;
10572	if (entry->pmk_len < PMK_LEN || entry->pmk_len > PMK_LEN_MAX ||
10573	    hexstr2bin(pos, entry->pmk, entry->pmk_len) < 0)
10574		goto fail;
10575
10576	pos = os_strchr(pos, ' ');
10577	if (!pos)
10578		goto fail;
10579	pos++;
10580
10581	if (sscanf(pos, "%d %d %d %d", &reauth_time, &expiration,
10582		   &entry->akmp, &entry->opportunistic) != 4)
10583		goto fail;
10584	if (reauth_time > expiration)
10585		goto fail;
10586	for (i = 0; i < 4; i++) {
10587		pos = os_strchr(pos, ' ');
10588		if (!pos) {
10589			if (i < 3)
10590				goto fail;
10591			break;
10592		}
10593		pos++;
10594	}
10595	if (pos) {
10596		if (hexstr2bin(pos, entry->fils_cache_id,
10597			       FILS_CACHE_ID_LEN) < 0)
10598			goto fail;
10599		entry->fils_cache_id_set = 1;
10600	}
10601	os_get_reltime(&now);
10602	entry->expiration = now.sec + expiration;
10603	entry->reauth_time = now.sec + reauth_time;
10604
10605	entry->network_ctx = ssid;
10606
10607	entry->external = true;
10608
10609	wpa_sm_pmksa_cache_add_entry(wpa_s->wpa, entry);
10610	entry = NULL;
10611	ret = 0;
10612fail:
10613	os_free(entry);
10614	return ret;
10615}
10616
10617
10618#ifdef CONFIG_MESH
10619
10620static int wpas_ctrl_iface_mesh_pmksa_get(struct wpa_supplicant *wpa_s,
10621					  const char *cmd, char *buf,
10622					  size_t buflen)
10623{
10624	u8 spa[ETH_ALEN];
10625
10626	if (!wpa_s->ifmsh)
10627		return -1;
10628
10629	if (os_strcasecmp(cmd, "any") == 0)
10630		return wpas_ap_pmksa_cache_list_mesh(wpa_s, NULL, buf, buflen);
10631
10632	if (hwaddr_aton(cmd, spa))
10633		return -1;
10634
10635	return wpas_ap_pmksa_cache_list_mesh(wpa_s, spa, buf, buflen);
10636}
10637
10638
10639static int wpas_ctrl_iface_mesh_pmksa_add(struct wpa_supplicant *wpa_s,
10640					  char *cmd)
10641{
10642	/*
10643	 * We do not check mesh interface existence because PMKSA should be
10644	 * stored before wpa_s->ifmsh creation to suppress commit message
10645	 * creation.
10646	 */
10647	return wpas_ap_pmksa_cache_add_external(wpa_s, cmd);
10648}
10649
10650#endif /* CONFIG_MESH */
10651#endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
10652
10653
10654#ifdef CONFIG_FILS
10655static int wpas_ctrl_iface_fils_hlp_req_add(struct wpa_supplicant *wpa_s,
10656					    const char *cmd)
10657{
10658	struct fils_hlp_req *req;
10659	const char *pos;
10660
10661	/* format: <dst> <packet starting from ethertype> */
10662
10663	req = os_zalloc(sizeof(*req));
10664	if (!req)
10665		return -1;
10666
10667	if (hwaddr_aton(cmd, req->dst))
10668		goto fail;
10669
10670	pos = os_strchr(cmd, ' ');
10671	if (!pos)
10672		goto fail;
10673	pos++;
10674	req->pkt = wpabuf_parse_bin(pos);
10675	if (!req->pkt)
10676		goto fail;
10677
10678	dl_list_add_tail(&wpa_s->fils_hlp_req, &req->list);
10679	return 0;
10680fail:
10681	wpabuf_free(req->pkt);
10682	os_free(req);
10683	return -1;
10684}
10685#endif /* CONFIG_FILS */
10686
10687
10688static int wpas_ctrl_cmd_debug_level(const char *cmd)
10689{
10690	if (os_strcmp(cmd, "PING") == 0 ||
10691	    os_strncmp(cmd, "BSS ", 4) == 0 ||
10692	    os_strncmp(cmd, "GET_NETWORK ", 12) == 0 ||
10693	    os_strncmp(cmd, "STATUS", 6) == 0 ||
10694	    os_strncmp(cmd, "STA ", 4) == 0 ||
10695	    os_strncmp(cmd, "STA-", 4) == 0)
10696		return MSG_EXCESSIVE;
10697	return MSG_DEBUG;
10698}
10699
10700
10701static int wpas_ctrl_iface_configure_mscs(struct wpa_supplicant *wpa_s,
10702					  const char *cmd)
10703{
10704	size_t frame_classifier_len;
10705	const char *pos, *end;
10706	struct robust_av_data *robust_av = &wpa_s->robust_av;
10707	int val;
10708
10709	/*
10710	 * format:
10711	 * <add|remove|change> [up_bitmap=<hex byte>] [up_limit=<integer>]
10712	 * [stream_timeout=<in TUs>] [frame_classifier=<hex bytes>]
10713	 */
10714	os_memset(robust_av, 0, sizeof(struct robust_av_data));
10715	if (os_strncmp(cmd, "add ", 4) == 0) {
10716		robust_av->request_type = SCS_REQ_ADD;
10717	} else if (os_strcmp(cmd, "remove") == 0) {
10718		robust_av->request_type = SCS_REQ_REMOVE;
10719		robust_av->valid_config = false;
10720		return wpas_send_mscs_req(wpa_s);
10721	} else if (os_strncmp(cmd, "change ", 7) == 0) {
10722		robust_av->request_type = SCS_REQ_CHANGE;
10723	} else {
10724		return -1;
10725	}
10726
10727	pos = os_strstr(cmd, "up_bitmap=");
10728	if (!pos)
10729		return -1;
10730
10731	val = hex2byte(pos + 10);
10732	if (val < 0)
10733		return -1;
10734	robust_av->up_bitmap = val;
10735
10736	pos = os_strstr(cmd, "up_limit=");
10737	if (!pos)
10738		return -1;
10739
10740	robust_av->up_limit = atoi(pos + 9);
10741
10742	pos = os_strstr(cmd, "stream_timeout=");
10743	if (!pos)
10744		return -1;
10745
10746	robust_av->stream_timeout = atoi(pos + 15);
10747	if (robust_av->stream_timeout == 0)
10748		return -1;
10749
10750	pos = os_strstr(cmd, "frame_classifier=");
10751	if (!pos)
10752		return -1;
10753
10754	pos += 17;
10755	end = os_strchr(pos, ' ');
10756	if (!end)
10757		end = pos + os_strlen(pos);
10758
10759	frame_classifier_len = (end - pos) / 2;
10760	if (frame_classifier_len > sizeof(robust_av->frame_classifier) ||
10761	    hexstr2bin(pos, robust_av->frame_classifier, frame_classifier_len))
10762		return -1;
10763
10764	robust_av->frame_classifier_len = frame_classifier_len;
10765	robust_av->valid_config = true;
10766
10767	return wpas_send_mscs_req(wpa_s);
10768}
10769
10770
10771#ifdef CONFIG_PASN
10772static int wpas_ctrl_iface_pasn_start(struct wpa_supplicant *wpa_s, char *cmd)
10773{
10774	char *token, *context = NULL;
10775	u8 bssid[ETH_ALEN];
10776	int akmp = -1, cipher = -1, got_bssid = 0;
10777	u16 group = 0xFFFF;
10778	u8 *comeback = NULL;
10779	size_t comeback_len = 0;
10780	int id = 0, ret = -1;
10781
10782	/*
10783	 * Entry format: bssid=<BSSID> akmp=<AKMP> cipher=<CIPHER> group=<group>
10784	 *    [comeback=<hexdump>]
10785	 */
10786	while ((token = str_token(cmd, " ", &context))) {
10787		if (os_strncmp(token, "bssid=", 6) == 0) {
10788			if (hwaddr_aton(token + 6, bssid))
10789				goto out;
10790			got_bssid = 1;
10791		} else if (os_strcmp(token, "akmp=PASN") == 0) {
10792			akmp = WPA_KEY_MGMT_PASN;
10793#ifdef CONFIG_IEEE80211R
10794		} else if (os_strcmp(token, "akmp=FT-PSK") == 0) {
10795			akmp = WPA_KEY_MGMT_FT_PSK;
10796		} else if (os_strcmp(token, "akmp=FT-EAP-SHA384") == 0) {
10797			akmp = WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
10798		} else if (os_strcmp(token, "akmp=FT-EAP") == 0) {
10799			akmp = WPA_KEY_MGMT_FT_IEEE8021X;
10800#endif /* CONFIG_IEEE80211R */
10801#ifdef CONFIG_SAE
10802		} else if (os_strcmp(token, "akmp=SAE") == 0) {
10803			akmp = WPA_KEY_MGMT_SAE;
10804#endif /* CONFIG_SAE */
10805#ifdef CONFIG_FILS
10806		} else if (os_strcmp(token, "akmp=FILS-SHA256") == 0) {
10807			akmp = WPA_KEY_MGMT_FILS_SHA256;
10808		} else if (os_strcmp(token, "akmp=FILS-SHA384") == 0) {
10809			akmp = WPA_KEY_MGMT_FILS_SHA384;
10810#endif /* CONFIG_FILS */
10811		} else if (os_strcmp(token, "cipher=CCMP-256") == 0) {
10812			cipher = WPA_CIPHER_CCMP_256;
10813		} else if (os_strcmp(token, "cipher=GCMP-256") == 0) {
10814			cipher = WPA_CIPHER_GCMP_256;
10815		} else if (os_strcmp(token, "cipher=CCMP") == 0) {
10816			cipher = WPA_CIPHER_CCMP;
10817		} else if (os_strcmp(token, "cipher=GCMP") == 0) {
10818			cipher = WPA_CIPHER_GCMP;
10819		} else if (os_strncmp(token, "group=", 6) == 0) {
10820			group = atoi(token + 6);
10821		} else if (os_strncmp(token, "nid=", 4) == 0) {
10822			id = atoi(token + 4);
10823		} else if (os_strncmp(token, "comeback=", 9) == 0) {
10824			comeback_len = os_strlen(token + 9);
10825			if (comeback || !comeback_len || comeback_len % 2)
10826				goto out;
10827
10828			comeback_len /= 2;
10829			comeback = os_malloc(comeback_len);
10830			if (!comeback ||
10831			    hexstr2bin(token + 9, comeback, comeback_len))
10832				goto out;
10833		} else {
10834			wpa_printf(MSG_DEBUG,
10835				   "CTRL: PASN Invalid parameter: '%s'",
10836				   token);
10837			goto out;
10838		}
10839	}
10840
10841	if (!got_bssid || akmp == -1 || cipher == -1 || group == 0xFFFF) {
10842		wpa_printf(MSG_DEBUG,"CTRL: PASN missing parameter");
10843		goto out;
10844	}
10845
10846	ret = wpas_pasn_auth_start(wpa_s, bssid, akmp, cipher, group, id,
10847				   comeback, comeback_len);
10848out:
10849	os_free(comeback);
10850	return ret;
10851}
10852
10853
10854static int wpas_ctrl_iface_pasn_deauthenticate(struct wpa_supplicant *wpa_s,
10855					       const char *cmd)
10856{
10857	u8 bssid[ETH_ALEN];
10858
10859	if (os_strncmp(cmd, "bssid=", 6) != 0 || hwaddr_aton(cmd + 6, bssid)) {
10860		wpa_printf(MSG_DEBUG,
10861			   "CTRL: PASN_DEAUTH without valid BSSID");
10862		return -1;
10863	}
10864
10865	return wpas_pasn_deauthenticate(wpa_s, bssid);
10866}
10867
10868#endif /* CONFIG_PASN */
10869
10870
10871static int set_type4_frame_classifier(const char *cmd,
10872				      struct type4_params *param)
10873{
10874	const char *pos, *end;
10875	u8 classifier_mask = 0;
10876	int ret;
10877	char addr[INET6_ADDRSTRLEN];
10878	size_t alen;
10879
10880	if (os_strstr(cmd, "ip_version=ipv4")) {
10881		param->ip_version = IPV4;
10882	} else if (os_strstr(cmd, "ip_version=ipv6")) {
10883		param->ip_version = IPV6;
10884	} else {
10885		wpa_printf(MSG_ERROR, "IP version missing/invalid");
10886		return -1;
10887	}
10888
10889	classifier_mask |= BIT(0);
10890
10891	pos = os_strstr(cmd, "src_ip=");
10892	if (pos) {
10893		pos += 7;
10894		end = os_strchr(pos, ' ');
10895		if (!end)
10896			end = pos + os_strlen(pos);
10897
10898		alen = end - pos;
10899		if (alen >= INET6_ADDRSTRLEN)
10900			return -1;
10901		os_memcpy(addr, pos, alen);
10902		addr[alen] = '\0';
10903		if (param->ip_version == IPV4)
10904			ret = inet_pton(AF_INET, addr,
10905					&param->ip_params.v4.src_ip);
10906		else
10907			ret = inet_pton(AF_INET6, addr,
10908					&param->ip_params.v6.src_ip);
10909
10910		if (ret != 1) {
10911			wpa_printf(MSG_ERROR,
10912				   "Error converting src IP address to binary ret=%d",
10913				   ret);
10914			return -1;
10915		}
10916
10917		classifier_mask |= BIT(1);
10918	}
10919
10920	pos = os_strstr(cmd, "dst_ip=");
10921	if (pos) {
10922		pos += 7;
10923		end = os_strchr(pos, ' ');
10924		if (!end)
10925			end = pos + os_strlen(pos);
10926
10927		alen = end - pos;
10928		if (alen >= INET6_ADDRSTRLEN)
10929			return -1;
10930		os_memcpy(addr, pos, alen);
10931		addr[alen] = '\0';
10932		if (param->ip_version == IPV4)
10933			ret = inet_pton(AF_INET, addr,
10934					&param->ip_params.v4.dst_ip);
10935		else
10936			ret = inet_pton(AF_INET6, addr,
10937					&param->ip_params.v6.dst_ip);
10938
10939		if (ret != 1) {
10940			wpa_printf(MSG_ERROR,
10941				   "Error converting dst IP address to binary ret=%d",
10942				   ret);
10943			return -1;
10944		}
10945
10946		classifier_mask |= BIT(2);
10947	}
10948
10949	pos = os_strstr(cmd, "src_port=");
10950	if (pos && atoi(pos + 9) > 0) {
10951		if (param->ip_version == IPV4)
10952			param->ip_params.v4.src_port = atoi(pos + 9);
10953		else
10954			param->ip_params.v6.src_port = atoi(pos + 9);
10955		classifier_mask |= BIT(3);
10956	}
10957
10958	pos = os_strstr(cmd, "dst_port=");
10959	if (pos && atoi(pos + 9) > 0) {
10960		if (param->ip_version == IPV4)
10961			param->ip_params.v4.dst_port = atoi(pos + 9);
10962		else
10963			param->ip_params.v6.dst_port = atoi(pos + 9);
10964		classifier_mask |= BIT(4);
10965	}
10966
10967	pos = os_strstr(cmd, "dscp=");
10968	if (pos && atoi(pos + 5) > 0) {
10969		if (param->ip_version == IPV4)
10970			param->ip_params.v4.dscp = atoi(pos + 5);
10971		else
10972			param->ip_params.v6.dscp = atoi(pos + 5);
10973		classifier_mask |= BIT(5);
10974	}
10975
10976	if (param->ip_version == IPV4) {
10977		pos = os_strstr(cmd, "protocol=");
10978		if (pos) {
10979			if (os_strstr(pos, "udp")) {
10980				param->ip_params.v4.protocol = 17;
10981			} else if (os_strstr(pos, "tcp")) {
10982				param->ip_params.v4.protocol = 6;
10983			} else if (os_strstr(pos, "esp")) {
10984				param->ip_params.v4.protocol = 50;
10985			} else {
10986				wpa_printf(MSG_ERROR, "Invalid protocol");
10987				return -1;
10988			}
10989			classifier_mask |= BIT(6);
10990		}
10991	} else {
10992		pos = os_strstr(cmd, "next_header=");
10993		if (pos) {
10994			if (os_strstr(pos, "udp")) {
10995				param->ip_params.v6.next_header = 17;
10996			} else if (os_strstr(pos, "tcp")) {
10997				param->ip_params.v6.next_header = 6;
10998			} else if (os_strstr(pos, "esp")) {
10999				param->ip_params.v6.next_header = 50;
11000			} else {
11001				wpa_printf(MSG_ERROR, "Invalid next header");
11002				return -1;
11003			}
11004
11005			classifier_mask |= BIT(6);
11006		}
11007
11008		pos = os_strstr(cmd, "flow_label=");
11009		if (pos) {
11010			pos += 11;
11011			end = os_strchr(pos, ' ');
11012			if (!end)
11013				end = pos + os_strlen(pos);
11014
11015			if (end - pos != 6 ||
11016			    hexstr2bin(pos, param->ip_params.v6.flow_label,
11017				       3) ||
11018			    param->ip_params.v6.flow_label[0] > 0x0F) {
11019				wpa_printf(MSG_ERROR, "Invalid flow label");
11020				return -1;
11021			}
11022
11023			classifier_mask |= BIT(7);
11024		}
11025	}
11026
11027	param->classifier_mask = classifier_mask;
11028	return 0;
11029}
11030
11031
11032static int set_type10_frame_classifier(const char *cmd,
11033				       struct type10_params *param)
11034{
11035	const char *pos, *end;
11036	size_t filter_len;
11037
11038	pos = os_strstr(cmd, "prot_instance=");
11039	if (!pos) {
11040		wpa_printf(MSG_ERROR, "Protocol instance missing");
11041		return -1;
11042	}
11043	param->prot_instance = atoi(pos + 14);
11044
11045	pos = os_strstr(cmd, "prot_number=");
11046	if (!pos) {
11047		wpa_printf(MSG_ERROR, "Protocol number missing");
11048		return -1;
11049	}
11050	if (os_strstr(pos, "udp")) {
11051		param->prot_number = 17;
11052	} else if (os_strstr(pos, "tcp")) {
11053		param->prot_number = 6;
11054	} else if (os_strstr(pos, "esp")) {
11055		param->prot_number = 50;
11056	} else {
11057		wpa_printf(MSG_ERROR, "Invalid protocol number");
11058		return -1;
11059	}
11060
11061	pos = os_strstr(cmd, "filter_value=");
11062	if (!pos) {
11063		wpa_printf(MSG_ERROR,
11064			   "Classifier parameter filter_value missing");
11065		return -1;
11066	}
11067
11068	pos += 13;
11069	end = os_strchr(pos, ' ');
11070	if (!end)
11071		end = pos + os_strlen(pos);
11072
11073	filter_len = (end - pos) / 2;
11074	param->filter_value = os_malloc(filter_len);
11075	if (!param->filter_value)
11076		return -1;
11077
11078	if (hexstr2bin(pos, param->filter_value, filter_len)) {
11079		wpa_printf(MSG_ERROR, "Invalid filter_value %s", pos);
11080		goto free;
11081	}
11082
11083	pos = os_strstr(cmd, "filter_mask=");
11084	if (!pos) {
11085		wpa_printf(MSG_ERROR,
11086			   "Classifier parameter filter_mask missing");
11087		goto free;
11088	}
11089
11090	pos += 12;
11091	end = os_strchr(pos, ' ');
11092	if (!end)
11093		end = pos + os_strlen(pos);
11094
11095	if (filter_len != (size_t) (end - pos) / 2) {
11096		wpa_printf(MSG_ERROR,
11097			   "Filter mask length mismatch expected=%zu received=%zu",
11098			   filter_len, (size_t) (end - pos) / 2);
11099		goto free;
11100	}
11101
11102	param->filter_mask = os_malloc(filter_len);
11103	if (!param->filter_mask)
11104		goto free;
11105
11106	if (hexstr2bin(pos, param->filter_mask, filter_len)) {
11107		wpa_printf(MSG_ERROR, "Invalid filter mask %s", pos);
11108		os_free(param->filter_mask);
11109		param->filter_mask = NULL;
11110		goto free;
11111	}
11112
11113	param->filter_len = filter_len;
11114	return 0;
11115free:
11116	os_free(param->filter_value);
11117	param->filter_value = NULL;
11118	return -1;
11119}
11120
11121
11122static int scs_parse_type4(struct tclas_element *elem, const char *pos)
11123{
11124	struct type4_params type4_param = { 0 };
11125
11126	if (set_type4_frame_classifier(pos, &type4_param) == -1) {
11127		wpa_printf(MSG_ERROR, "Failed to set frame_classifier 4");
11128		return -1;
11129	}
11130
11131	os_memcpy(&elem->frame_classifier.type4_param,
11132		  &type4_param, sizeof(struct type4_params));
11133	return 0;
11134}
11135
11136
11137static int scs_parse_type10(struct tclas_element *elem, const char *pos)
11138{
11139	struct type10_params type10_param = { 0 };
11140
11141	if (set_type10_frame_classifier(pos, &type10_param) == -1) {
11142		wpa_printf(MSG_ERROR, "Failed to set frame_classifier 10");
11143		return -1;
11144	}
11145
11146	os_memcpy(&elem->frame_classifier.type10_param,
11147		  &type10_param, sizeof(struct type10_params));
11148	return 0;
11149}
11150
11151
11152static int wpas_ctrl_iface_configure_scs(struct wpa_supplicant *wpa_s,
11153					 char *cmd)
11154{
11155	char *pos1, *pos;
11156	struct scs_robust_av_data *scs_data = &wpa_s->scs_robust_av_req;
11157	struct scs_desc_elem desc_elem = { 0 };
11158	int val;
11159	unsigned int num_scs_desc = 0;
11160
11161	if (wpa_s->ongoing_scs_req) {
11162		wpa_printf(MSG_ERROR, "%s: SCS Request already in queue",
11163			   __func__);
11164		return -1;
11165	}
11166
11167	/**
11168	 * format:
11169	 * [scs_id=<decimal number>] <add|remove|change> [scs_up=<0-7>]
11170	 * [classifier_type=<4|10>]
11171	 * [classifier params based on classifier type]
11172	 * [tclas_processing=<0|1>] [scs_id=<decimal number>] ...
11173	 */
11174	pos1 = os_strstr(cmd, "scs_id=");
11175	if (!pos1) {
11176		wpa_printf(MSG_ERROR, "SCSID not present");
11177		return -1;
11178	}
11179
11180	free_up_scs_desc(scs_data);
11181
11182	while (pos1) {
11183		struct scs_desc_elem *n1;
11184		struct active_scs_elem *active_scs_desc;
11185		char *next_scs_desc;
11186		unsigned int num_tclas_elem = 0;
11187		bool scsid_active = false;
11188
11189		desc_elem.scs_id = atoi(pos1 + 7);
11190		pos1 += 7;
11191
11192		next_scs_desc = os_strstr(pos1, "scs_id=");
11193		if (next_scs_desc) {
11194			char temp[20];
11195
11196			os_snprintf(temp, sizeof(temp), "scs_id=%d ",
11197				    desc_elem.scs_id);
11198			if (os_strstr(next_scs_desc, temp)) {
11199				wpa_printf(MSG_ERROR,
11200					   "Multiple SCS descriptors configured with same SCSID(=%d)",
11201					   desc_elem.scs_id);
11202				goto free_scs_desc;
11203			}
11204			pos1[next_scs_desc - pos1 - 1] = '\0';
11205		}
11206
11207		dl_list_for_each(active_scs_desc, &wpa_s->active_scs_ids,
11208				 struct active_scs_elem, list) {
11209			if (desc_elem.scs_id == active_scs_desc->scs_id) {
11210				scsid_active = true;
11211				break;
11212			}
11213		}
11214
11215		if (os_strstr(pos1, "add ")) {
11216			desc_elem.request_type = SCS_REQ_ADD;
11217			if (scsid_active) {
11218				wpa_printf(MSG_ERROR, "SCSID %d already active",
11219					   desc_elem.scs_id);
11220				return -1;
11221			}
11222		} else if (os_strstr(pos1, "remove")) {
11223			desc_elem.request_type = SCS_REQ_REMOVE;
11224			if (!scsid_active) {
11225				wpa_printf(MSG_ERROR, "SCSID %d not active",
11226					   desc_elem.scs_id);
11227				return -1;
11228			}
11229			goto scs_desc_end;
11230		} else if (os_strstr(pos1, "change ")) {
11231			desc_elem.request_type = SCS_REQ_CHANGE;
11232			if (!scsid_active) {
11233				wpa_printf(MSG_ERROR, "SCSID %d not active",
11234					   desc_elem.scs_id);
11235				return -1;
11236			}
11237		} else {
11238			wpa_printf(MSG_ERROR, "SCS Request type invalid");
11239			goto free_scs_desc;
11240		}
11241
11242		pos1 = os_strstr(pos1, "scs_up=");
11243		if (!pos1) {
11244			wpa_printf(MSG_ERROR,
11245				   "Intra-Access user priority not present");
11246			goto free_scs_desc;
11247		}
11248
11249		val = atoi(pos1 + 7);
11250		if (val < 0 || val > 7) {
11251			wpa_printf(MSG_ERROR,
11252				   "Intra-Access user priority invalid %d",
11253				   val);
11254			goto free_scs_desc;
11255		}
11256
11257		desc_elem.intra_access_priority = val;
11258		desc_elem.scs_up_avail = true;
11259
11260		pos = os_strstr(pos1, "classifier_type=");
11261		if (!pos) {
11262			wpa_printf(MSG_ERROR, "classifier type empty");
11263			goto free_scs_desc;
11264		}
11265
11266		while (pos) {
11267			struct tclas_element elem = { 0 }, *n;
11268			char *next_tclas_elem;
11269
11270			val = atoi(pos + 16);
11271			if (val != 4 && val != 10) {
11272				wpa_printf(MSG_ERROR,
11273					   "classifier type invalid %d", val);
11274				goto free_scs_desc;
11275			}
11276
11277			elem.classifier_type = val;
11278			pos += 16;
11279
11280			next_tclas_elem = os_strstr(pos, "classifier_type=");
11281			if (next_tclas_elem) {
11282				pos1 = next_tclas_elem;
11283				pos[next_tclas_elem - pos - 1] = '\0';
11284			}
11285
11286			switch (val) {
11287			case 4:
11288				if (scs_parse_type4(&elem, pos) < 0)
11289					goto free_scs_desc;
11290				break;
11291			case 10:
11292				if (scs_parse_type10(&elem, pos) < 0)
11293					goto free_scs_desc;
11294				break;
11295			}
11296
11297			n = os_realloc(desc_elem.tclas_elems,
11298				       (num_tclas_elem + 1) * sizeof(elem));
11299			if (!n)
11300				goto free_scs_desc;
11301
11302			desc_elem.tclas_elems = n;
11303			os_memcpy((u8 *) desc_elem.tclas_elems +
11304				  num_tclas_elem * sizeof(elem),
11305				  &elem, sizeof(elem));
11306			num_tclas_elem++;
11307			desc_elem.num_tclas_elem = num_tclas_elem;
11308			pos = next_tclas_elem;
11309		}
11310
11311		if (desc_elem.num_tclas_elem > 1) {
11312			pos1 = os_strstr(pos1, "tclas_processing=");
11313			if (!pos1) {
11314				wpa_printf(MSG_ERROR, "tclas_processing empty");
11315				goto free_scs_desc;
11316			}
11317
11318			val = atoi(pos1 + 17);
11319			if (val != 0 && val != 1) {
11320				wpa_printf(MSG_ERROR,
11321					   "tclas_processing invalid");
11322				goto free_scs_desc;
11323			}
11324
11325			desc_elem.tclas_processing = val;
11326		}
11327
11328scs_desc_end:
11329		n1 = os_realloc(scs_data->scs_desc_elems, (num_scs_desc + 1) *
11330				sizeof(struct scs_desc_elem));
11331		if (!n1)
11332			goto free_scs_desc;
11333
11334		scs_data->scs_desc_elems = n1;
11335		os_memcpy((u8 *) scs_data->scs_desc_elems + num_scs_desc *
11336			  sizeof(desc_elem), &desc_elem, sizeof(desc_elem));
11337		num_scs_desc++;
11338		scs_data->num_scs_desc = num_scs_desc;
11339		pos1 = next_scs_desc;
11340		os_memset(&desc_elem, 0, sizeof(desc_elem));
11341	}
11342
11343	return wpas_send_scs_req(wpa_s);
11344
11345free_scs_desc:
11346	free_up_tclas_elem(&desc_elem);
11347	free_up_scs_desc(scs_data);
11348	return -1;
11349}
11350
11351
11352static int wpas_ctrl_iface_send_dscp_resp(struct wpa_supplicant *wpa_s,
11353					  const char *cmd)
11354{
11355	char *pos;
11356	struct dscp_policy_status *policy = NULL, *n;
11357	int num_policies = 0, ret = -1;
11358	struct dscp_resp_data resp_data;
11359
11360	/*
11361	 * format:
11362	 * <[reset]>/<[solicited] [policy_id=1 status=0...]> [more]
11363	 */
11364
11365	os_memset(&resp_data, 0, sizeof(resp_data));
11366
11367	resp_data.more = os_strstr(cmd, "more") != NULL;
11368
11369	if (os_strstr(cmd, "reset")) {
11370		resp_data.reset = true;
11371		resp_data.solicited = false;
11372		goto send_resp;
11373	}
11374
11375	resp_data.solicited = os_strstr(cmd, "solicited") != NULL;
11376
11377	pos = os_strstr(cmd, "policy_id=");
11378	while (pos) {
11379		n = os_realloc(policy, (num_policies + 1) * sizeof(*policy));
11380		if (!n)
11381			goto fail;
11382
11383		policy = n;
11384		pos += 10;
11385		policy[num_policies].id = atoi(pos);
11386		if (policy[num_policies].id == 0) {
11387			wpa_printf(MSG_ERROR, "DSCP: Invalid policy id");
11388			goto fail;
11389		}
11390
11391		pos = os_strstr(pos, "status=");
11392		if (!pos) {
11393			wpa_printf(MSG_ERROR,
11394				   "DSCP: Status is not found for a policy");
11395			goto fail;
11396		}
11397
11398		pos += 7;
11399		policy[num_policies].status = atoi(pos);
11400		num_policies++;
11401
11402		pos = os_strstr(pos, "policy_id");
11403	}
11404
11405	resp_data.policy = policy;
11406	resp_data.num_policies = num_policies;
11407send_resp:
11408	ret = wpas_send_dscp_response(wpa_s, &resp_data);
11409	if (ret)
11410		wpa_printf(MSG_ERROR, "DSCP: Failed to send DSCP response");
11411fail:
11412	os_free(policy);
11413	return ret;
11414}
11415
11416
11417static int wpas_ctrl_iface_send_dscp_query(struct wpa_supplicant *wpa_s,
11418					   const char *cmd)
11419{
11420	char *pos;
11421
11422	/*
11423	 * format:
11424	 * Wildcard DSCP query
11425	 * <wildcard>
11426	 *
11427	 * DSCP query with a domain name attribute:
11428	 * [domain_name=<string>]
11429	 */
11430
11431	if (os_strstr(cmd, "wildcard")) {
11432		wpa_printf(MSG_DEBUG, "QM: Send wildcard DSCP policy query");
11433		return wpas_send_dscp_query(wpa_s, NULL, 0);
11434	}
11435
11436	pos = os_strstr(cmd, "domain_name=");
11437	if (!pos || !os_strlen(pos + 12)) {
11438		wpa_printf(MSG_ERROR, "QM: Domain name not preset");
11439		return -1;
11440	}
11441
11442	return wpas_send_dscp_query(wpa_s, pos + 12, os_strlen(pos + 12));
11443}
11444
11445
11446char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
11447					 char *buf, size_t *resp_len)
11448{
11449	char *reply;
11450	const int reply_size = 4096;
11451	int reply_len;
11452
11453	if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0 ||
11454	    os_strncmp(buf, "SET_NETWORK ", 12) == 0 ||
11455	    os_strncmp(buf, "PMKSA_ADD ", 10) == 0 ||
11456	    os_strncmp(buf, "MESH_PMKSA_ADD ", 15) == 0) {
11457		if (wpa_debug_show_keys)
11458			wpa_dbg(wpa_s, MSG_DEBUG,
11459				"Control interface command '%s'", buf);
11460		else
11461			wpa_dbg(wpa_s, MSG_DEBUG,
11462				"Control interface command '%s [REMOVED]'",
11463				os_strncmp(buf, WPA_CTRL_RSP,
11464					   os_strlen(WPA_CTRL_RSP)) == 0 ?
11465				WPA_CTRL_RSP :
11466				(os_strncmp(buf, "SET_NETWORK ", 12) == 0 ?
11467				 "SET_NETWORK" : "key-add"));
11468	} else if (os_strncmp(buf, "WPS_NFC_TAG_READ", 16) == 0 ||
11469		   os_strncmp(buf, "NFC_REPORT_HANDOVER", 19) == 0) {
11470		wpa_hexdump_ascii_key(MSG_DEBUG, "RX ctrl_iface",
11471				      (const u8 *) buf, os_strlen(buf));
11472	} else {
11473		int level = wpas_ctrl_cmd_debug_level(buf);
11474		wpa_dbg(wpa_s, level, "Control interface command '%s'", buf);
11475	}
11476
11477	reply = os_malloc(reply_size);
11478	if (reply == NULL) {
11479		*resp_len = 1;
11480		return NULL;
11481	}
11482
11483	os_memcpy(reply, "OK\n", 3);
11484	reply_len = 3;
11485
11486	if (os_strcmp(buf, "PING") == 0) {
11487		os_memcpy(reply, "PONG\n", 5);
11488		reply_len = 5;
11489	} else if (os_strcmp(buf, "IFNAME") == 0) {
11490		reply_len = os_strlen(wpa_s->ifname);
11491		os_memcpy(reply, wpa_s->ifname, reply_len);
11492	} else if (os_strncmp(buf, "RELOG", 5) == 0) {
11493		if (wpa_debug_reopen_file() < 0)
11494			reply_len = -1;
11495	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
11496		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
11497	} else if (os_strcmp(buf, "MIB") == 0) {
11498		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
11499		if (reply_len >= 0) {
11500			reply_len += eapol_sm_get_mib(wpa_s->eapol,
11501						      reply + reply_len,
11502						      reply_size - reply_len);
11503#ifdef CONFIG_MACSEC
11504			reply_len += ieee802_1x_kay_get_mib(
11505				wpa_s->kay, reply + reply_len,
11506				reply_size - reply_len);
11507#endif /* CONFIG_MACSEC */
11508		}
11509	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
11510		reply_len = wpa_supplicant_ctrl_iface_status(
11511			wpa_s, buf + 6, reply, reply_size);
11512	} else if (os_strcmp(buf, "PMKSA") == 0) {
11513		reply_len = wpas_ctrl_iface_pmksa(wpa_s, reply, reply_size);
11514	} else if (os_strcmp(buf, "PMKSA_FLUSH") == 0) {
11515		wpas_ctrl_iface_pmksa_flush(wpa_s);
11516#ifdef CONFIG_PMKSA_CACHE_EXTERNAL
11517	} else if (os_strncmp(buf, "PMKSA_GET ", 10) == 0) {
11518		reply_len = wpas_ctrl_iface_pmksa_get(wpa_s, buf + 10,
11519						      reply, reply_size);
11520	} else if (os_strncmp(buf, "PMKSA_ADD ", 10) == 0) {
11521		if (wpas_ctrl_iface_pmksa_add(wpa_s, buf + 10) < 0)
11522			reply_len = -1;
11523#ifdef CONFIG_MESH
11524	} else if (os_strncmp(buf, "MESH_PMKSA_GET ", 15) == 0) {
11525		reply_len = wpas_ctrl_iface_mesh_pmksa_get(wpa_s, buf + 15,
11526							   reply, reply_size);
11527	} else if (os_strncmp(buf, "MESH_PMKSA_ADD ", 15) == 0) {
11528		if (wpas_ctrl_iface_mesh_pmksa_add(wpa_s, buf + 15) < 0)
11529			reply_len = -1;
11530#endif /* CONFIG_MESH */
11531#endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
11532	} else if (os_strncmp(buf, "SET ", 4) == 0) {
11533		if (wpa_supplicant_ctrl_iface_set(wpa_s, buf + 4))
11534			reply_len = -1;
11535	} else if (os_strncmp(buf, "DUMP", 4) == 0) {
11536		reply_len = wpa_config_dump_values(wpa_s->conf,
11537						   reply, reply_size);
11538	} else if (os_strncmp(buf, "GET ", 4) == 0) {
11539		reply_len = wpa_supplicant_ctrl_iface_get(wpa_s, buf + 4,
11540							  reply, reply_size);
11541	} else if (os_strcmp(buf, "LOGON") == 0) {
11542		eapol_sm_notify_logoff(wpa_s->eapol, false);
11543	} else if (os_strcmp(buf, "LOGOFF") == 0) {
11544		eapol_sm_notify_logoff(wpa_s->eapol, true);
11545	} else if (os_strcmp(buf, "REASSOCIATE") == 0) {
11546		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
11547			reply_len = -1;
11548		else
11549			wpas_request_connection(wpa_s);
11550	} else if (os_strcmp(buf, "REATTACH") == 0) {
11551		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED ||
11552		    !wpa_s->current_ssid)
11553			reply_len = -1;
11554		else {
11555			wpa_s->reattach = 1;
11556			wpas_request_connection(wpa_s);
11557		}
11558	} else if (os_strcmp(buf, "RECONNECT") == 0) {
11559		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
11560			reply_len = -1;
11561		else if (wpa_s->disconnected)
11562			wpas_request_connection(wpa_s);
11563#ifdef IEEE8021X_EAPOL
11564	} else if (os_strncmp(buf, "PREAUTH ", 8) == 0) {
11565		if (wpa_supplicant_ctrl_iface_preauth(wpa_s, buf + 8))
11566			reply_len = -1;
11567#endif /* IEEE8021X_EAPOL */
11568#ifdef CONFIG_IEEE80211R
11569	} else if (os_strncmp(buf, "FT_DS ", 6) == 0) {
11570		if (wpa_supplicant_ctrl_iface_ft_ds(wpa_s, buf + 6))
11571			reply_len = -1;
11572#endif /* CONFIG_IEEE80211R */
11573#ifdef CONFIG_WPS
11574	} else if (os_strcmp(buf, "WPS_PBC") == 0) {
11575		int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, NULL);
11576		if (res == -2) {
11577			os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
11578			reply_len = 17;
11579		} else if (res)
11580			reply_len = -1;
11581	} else if (os_strncmp(buf, "WPS_PBC ", 8) == 0) {
11582		int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, buf + 8);
11583		if (res == -2) {
11584			os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
11585			reply_len = 17;
11586		} else if (res)
11587			reply_len = -1;
11588	} else if (os_strncmp(buf, "WPS_PIN ", 8) == 0) {
11589		reply_len = wpa_supplicant_ctrl_iface_wps_pin(wpa_s, buf + 8,
11590							      reply,
11591							      reply_size);
11592	} else if (os_strncmp(buf, "WPS_CHECK_PIN ", 14) == 0) {
11593		reply_len = wpa_supplicant_ctrl_iface_wps_check_pin(
11594			wpa_s, buf + 14, reply, reply_size);
11595	} else if (os_strcmp(buf, "WPS_CANCEL") == 0) {
11596		if (wpas_wps_cancel(wpa_s))
11597			reply_len = -1;
11598#ifdef CONFIG_WPS_NFC
11599	} else if (os_strcmp(buf, "WPS_NFC") == 0) {
11600		if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, NULL))
11601			reply_len = -1;
11602	} else if (os_strncmp(buf, "WPS_NFC ", 8) == 0) {
11603		if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, buf + 8))
11604			reply_len = -1;
11605	} else if (os_strncmp(buf, "WPS_NFC_CONFIG_TOKEN ", 21) == 0) {
11606		reply_len = wpa_supplicant_ctrl_iface_wps_nfc_config_token(
11607			wpa_s, buf + 21, reply, reply_size);
11608	} else if (os_strncmp(buf, "WPS_NFC_TOKEN ", 14) == 0) {
11609		reply_len = wpa_supplicant_ctrl_iface_wps_nfc_token(
11610			wpa_s, buf + 14, reply, reply_size);
11611	} else if (os_strncmp(buf, "WPS_NFC_TAG_READ ", 17) == 0) {
11612		if (wpa_supplicant_ctrl_iface_wps_nfc_tag_read(wpa_s,
11613							       buf + 17))
11614			reply_len = -1;
11615	} else if (os_strncmp(buf, "NFC_GET_HANDOVER_REQ ", 21) == 0) {
11616		reply_len = wpas_ctrl_nfc_get_handover_req(
11617			wpa_s, buf + 21, reply, reply_size);
11618	} else if (os_strncmp(buf, "NFC_GET_HANDOVER_SEL ", 21) == 0) {
11619		reply_len = wpas_ctrl_nfc_get_handover_sel(
11620			wpa_s, buf + 21, reply, reply_size);
11621	} else if (os_strncmp(buf, "NFC_REPORT_HANDOVER ", 20) == 0) {
11622		if (wpas_ctrl_nfc_report_handover(wpa_s, buf + 20))
11623			reply_len = -1;
11624#endif /* CONFIG_WPS_NFC */
11625	} else if (os_strncmp(buf, "WPS_REG ", 8) == 0) {
11626		if (wpa_supplicant_ctrl_iface_wps_reg(wpa_s, buf + 8))
11627			reply_len = -1;
11628#ifdef CONFIG_AP
11629	} else if (os_strncmp(buf, "WPS_AP_PIN ", 11) == 0) {
11630		reply_len = wpa_supplicant_ctrl_iface_wps_ap_pin(
11631			wpa_s, buf + 11, reply, reply_size);
11632#endif /* CONFIG_AP */
11633#ifdef CONFIG_WPS_ER
11634	} else if (os_strcmp(buf, "WPS_ER_START") == 0) {
11635		if (wpas_wps_er_start(wpa_s, NULL))
11636			reply_len = -1;
11637	} else if (os_strncmp(buf, "WPS_ER_START ", 13) == 0) {
11638		if (wpas_wps_er_start(wpa_s, buf + 13))
11639			reply_len = -1;
11640	} else if (os_strcmp(buf, "WPS_ER_STOP") == 0) {
11641		wpas_wps_er_stop(wpa_s);
11642	} else if (os_strncmp(buf, "WPS_ER_PIN ", 11) == 0) {
11643		if (wpa_supplicant_ctrl_iface_wps_er_pin(wpa_s, buf + 11))
11644			reply_len = -1;
11645	} else if (os_strncmp(buf, "WPS_ER_PBC ", 11) == 0) {
11646		int ret = wpas_wps_er_pbc(wpa_s, buf + 11);
11647		if (ret == -2) {
11648			os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
11649			reply_len = 17;
11650		} else if (ret == -3) {
11651			os_memcpy(reply, "FAIL-UNKNOWN-UUID\n", 18);
11652			reply_len = 18;
11653		} else if (ret == -4) {
11654			os_memcpy(reply, "FAIL-NO-AP-SETTINGS\n", 20);
11655			reply_len = 20;
11656		} else if (ret)
11657			reply_len = -1;
11658	} else if (os_strncmp(buf, "WPS_ER_LEARN ", 13) == 0) {
11659		if (wpa_supplicant_ctrl_iface_wps_er_learn(wpa_s, buf + 13))
11660			reply_len = -1;
11661	} else if (os_strncmp(buf, "WPS_ER_SET_CONFIG ", 18) == 0) {
11662		if (wpa_supplicant_ctrl_iface_wps_er_set_config(wpa_s,
11663								buf + 18))
11664			reply_len = -1;
11665	} else if (os_strncmp(buf, "WPS_ER_CONFIG ", 14) == 0) {
11666		if (wpa_supplicant_ctrl_iface_wps_er_config(wpa_s, buf + 14))
11667			reply_len = -1;
11668#ifdef CONFIG_WPS_NFC
11669	} else if (os_strncmp(buf, "WPS_ER_NFC_CONFIG_TOKEN ", 24) == 0) {
11670		reply_len = wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
11671			wpa_s, buf + 24, reply, reply_size);
11672#endif /* CONFIG_WPS_NFC */
11673#endif /* CONFIG_WPS_ER */
11674#endif /* CONFIG_WPS */
11675#ifdef CONFIG_IBSS_RSN
11676	} else if (os_strncmp(buf, "IBSS_RSN ", 9) == 0) {
11677		if (wpa_supplicant_ctrl_iface_ibss_rsn(wpa_s, buf + 9))
11678			reply_len = -1;
11679#endif /* CONFIG_IBSS_RSN */
11680#ifdef CONFIG_MESH
11681	} else if (os_strncmp(buf, "MESH_INTERFACE_ADD ", 19) == 0) {
11682		reply_len = wpa_supplicant_ctrl_iface_mesh_interface_add(
11683			wpa_s, buf + 19, reply, reply_size);
11684	} else if (os_strcmp(buf, "MESH_INTERFACE_ADD") == 0) {
11685		reply_len = wpa_supplicant_ctrl_iface_mesh_interface_add(
11686			wpa_s, "", reply, reply_size);
11687	} else if (os_strncmp(buf, "MESH_GROUP_ADD ", 15) == 0) {
11688		if (wpa_supplicant_ctrl_iface_mesh_group_add(wpa_s, buf + 15))
11689			reply_len = -1;
11690	} else if (os_strncmp(buf, "MESH_GROUP_REMOVE ", 18) == 0) {
11691		if (wpa_supplicant_ctrl_iface_mesh_group_remove(wpa_s,
11692								buf + 18))
11693			reply_len = -1;
11694	} else if (os_strncmp(buf, "MESH_PEER_REMOVE ", 17) == 0) {
11695		if (wpa_supplicant_ctrl_iface_mesh_peer_remove(wpa_s, buf + 17))
11696			reply_len = -1;
11697	} else if (os_strncmp(buf, "MESH_PEER_ADD ", 14) == 0) {
11698		if (wpa_supplicant_ctrl_iface_mesh_peer_add(wpa_s, buf + 14))
11699			reply_len = -1;
11700	} else if (os_strncmp(buf, "MESH_LINK_PROBE ", 16) == 0) {
11701		if (wpa_supplicant_ctrl_iface_mesh_link_probe(wpa_s, buf + 16))
11702			reply_len = -1;
11703#endif /* CONFIG_MESH */
11704#ifdef CONFIG_P2P
11705	} else if (os_strncmp(buf, "P2P_FIND ", 9) == 0) {
11706		if (p2p_ctrl_find(wpa_s, buf + 8))
11707			reply_len = -1;
11708	} else if (os_strcmp(buf, "P2P_FIND") == 0) {
11709		if (p2p_ctrl_find(wpa_s, ""))
11710			reply_len = -1;
11711	} else if (os_strcmp(buf, "P2P_STOP_FIND") == 0) {
11712		wpas_p2p_stop_find(wpa_s);
11713	} else if (os_strncmp(buf, "P2P_ASP_PROVISION ", 18) == 0) {
11714		if (p2p_ctrl_asp_provision(wpa_s, buf + 18))
11715			reply_len = -1;
11716	} else if (os_strncmp(buf, "P2P_ASP_PROVISION_RESP ", 23) == 0) {
11717		if (p2p_ctrl_asp_provision_resp(wpa_s, buf + 23))
11718			reply_len = -1;
11719	} else if (os_strncmp(buf, "P2P_CONNECT ", 12) == 0) {
11720		reply_len = p2p_ctrl_connect(wpa_s, buf + 12, reply,
11721					     reply_size);
11722	} else if (os_strncmp(buf, "P2P_LISTEN ", 11) == 0) {
11723		if (p2p_ctrl_listen(wpa_s, buf + 11))
11724			reply_len = -1;
11725	} else if (os_strcmp(buf, "P2P_LISTEN") == 0) {
11726		if (p2p_ctrl_listen(wpa_s, ""))
11727			reply_len = -1;
11728	} else if (os_strncmp(buf, "P2P_GROUP_REMOVE ", 17) == 0) {
11729		if (wpas_p2p_group_remove(wpa_s, buf + 17))
11730			reply_len = -1;
11731	} else if (os_strcmp(buf, "P2P_GROUP_ADD") == 0) {
11732		if (p2p_ctrl_group_add(wpa_s, ""))
11733			reply_len = -1;
11734	} else if (os_strncmp(buf, "P2P_GROUP_ADD ", 14) == 0) {
11735		if (p2p_ctrl_group_add(wpa_s, buf + 14))
11736			reply_len = -1;
11737	} else if (os_strncmp(buf, "P2P_GROUP_MEMBER ", 17) == 0) {
11738		reply_len = p2p_ctrl_group_member(wpa_s, buf + 17, reply,
11739						  reply_size);
11740	} else if (os_strncmp(buf, "P2P_PROV_DISC ", 14) == 0) {
11741		if (p2p_ctrl_prov_disc(wpa_s, buf + 14))
11742			reply_len = -1;
11743	} else if (os_strcmp(buf, "P2P_GET_PASSPHRASE") == 0) {
11744		reply_len = p2p_get_passphrase(wpa_s, reply, reply_size);
11745	} else if (os_strncmp(buf, "P2P_SERV_DISC_REQ ", 18) == 0) {
11746		reply_len = p2p_ctrl_serv_disc_req(wpa_s, buf + 18, reply,
11747						   reply_size);
11748	} else if (os_strncmp(buf, "P2P_SERV_DISC_CANCEL_REQ ", 25) == 0) {
11749		if (p2p_ctrl_serv_disc_cancel_req(wpa_s, buf + 25) < 0)
11750			reply_len = -1;
11751	} else if (os_strncmp(buf, "P2P_SERV_DISC_RESP ", 19) == 0) {
11752		if (p2p_ctrl_serv_disc_resp(wpa_s, buf + 19) < 0)
11753			reply_len = -1;
11754	} else if (os_strcmp(buf, "P2P_SERVICE_UPDATE") == 0) {
11755		wpas_p2p_sd_service_update(wpa_s);
11756	} else if (os_strncmp(buf, "P2P_SERV_DISC_EXTERNAL ", 23) == 0) {
11757		if (p2p_ctrl_serv_disc_external(wpa_s, buf + 23) < 0)
11758			reply_len = -1;
11759	} else if (os_strcmp(buf, "P2P_SERVICE_FLUSH") == 0) {
11760		wpas_p2p_service_flush(wpa_s);
11761	} else if (os_strncmp(buf, "P2P_SERVICE_ADD ", 16) == 0) {
11762		if (p2p_ctrl_service_add(wpa_s, buf + 16) < 0)
11763			reply_len = -1;
11764	} else if (os_strncmp(buf, "P2P_SERVICE_DEL ", 16) == 0) {
11765		if (p2p_ctrl_service_del(wpa_s, buf + 16) < 0)
11766			reply_len = -1;
11767	} else if (os_strncmp(buf, "P2P_SERVICE_REP ", 16) == 0) {
11768		if (p2p_ctrl_service_replace(wpa_s, buf + 16) < 0)
11769			reply_len = -1;
11770	} else if (os_strncmp(buf, "P2P_REJECT ", 11) == 0) {
11771		if (p2p_ctrl_reject(wpa_s, buf + 11) < 0)
11772			reply_len = -1;
11773	} else if (os_strncmp(buf, "P2P_INVITE ", 11) == 0) {
11774		if (p2p_ctrl_invite(wpa_s, buf + 11) < 0)
11775			reply_len = -1;
11776	} else if (os_strncmp(buf, "P2P_PEER ", 9) == 0) {
11777		reply_len = p2p_ctrl_peer(wpa_s, buf + 9, reply,
11778					      reply_size);
11779	} else if (os_strncmp(buf, "P2P_SET ", 8) == 0) {
11780		if (p2p_ctrl_set(wpa_s, buf + 8) < 0)
11781			reply_len = -1;
11782	} else if (os_strcmp(buf, "P2P_FLUSH") == 0) {
11783		p2p_ctrl_flush(wpa_s);
11784	} else if (os_strncmp(buf, "P2P_UNAUTHORIZE ", 16) == 0) {
11785		if (wpas_p2p_unauthorize(wpa_s, buf + 16) < 0)
11786			reply_len = -1;
11787	} else if (os_strcmp(buf, "P2P_CANCEL") == 0) {
11788		if (wpas_p2p_cancel(wpa_s))
11789			reply_len = -1;
11790	} else if (os_strncmp(buf, "P2P_PRESENCE_REQ ", 17) == 0) {
11791		if (p2p_ctrl_presence_req(wpa_s, buf + 17) < 0)
11792			reply_len = -1;
11793	} else if (os_strcmp(buf, "P2P_PRESENCE_REQ") == 0) {
11794		if (p2p_ctrl_presence_req(wpa_s, "") < 0)
11795			reply_len = -1;
11796	} else if (os_strncmp(buf, "P2P_EXT_LISTEN ", 15) == 0) {
11797		if (p2p_ctrl_ext_listen(wpa_s, buf + 15) < 0)
11798			reply_len = -1;
11799	} else if (os_strcmp(buf, "P2P_EXT_LISTEN") == 0) {
11800		if (p2p_ctrl_ext_listen(wpa_s, "") < 0)
11801			reply_len = -1;
11802	} else if (os_strncmp(buf, "P2P_REMOVE_CLIENT ", 18) == 0) {
11803		if (p2p_ctrl_remove_client(wpa_s, buf + 18) < 0)
11804			reply_len = -1;
11805	} else if (os_strncmp(buf, "P2P_LO_START ", 13) == 0) {
11806		if (p2p_ctrl_iface_p2p_lo_start(wpa_s, buf + 13))
11807			reply_len = -1;
11808	} else if (os_strcmp(buf, "P2P_LO_STOP") == 0) {
11809		if (wpas_p2p_lo_stop(wpa_s))
11810			reply_len = -1;
11811#endif /* CONFIG_P2P */
11812#ifdef CONFIG_WIFI_DISPLAY
11813	} else if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0) {
11814		if (wifi_display_subelem_set(wpa_s->global, buf + 16) < 0)
11815			reply_len = -1;
11816	} else if (os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0) {
11817		reply_len = wifi_display_subelem_get(wpa_s->global, buf + 16,
11818						     reply, reply_size);
11819#endif /* CONFIG_WIFI_DISPLAY */
11820#ifdef CONFIG_INTERWORKING
11821	} else if (os_strcmp(buf, "FETCH_ANQP") == 0) {
11822		if (interworking_fetch_anqp(wpa_s) < 0)
11823			reply_len = -1;
11824	} else if (os_strcmp(buf, "STOP_FETCH_ANQP") == 0) {
11825		interworking_stop_fetch_anqp(wpa_s);
11826	} else if (os_strcmp(buf, "INTERWORKING_SELECT") == 0) {
11827		if (ctrl_interworking_select(wpa_s, NULL) < 0)
11828			reply_len = -1;
11829	} else if (os_strncmp(buf, "INTERWORKING_SELECT ", 20) == 0) {
11830		if (ctrl_interworking_select(wpa_s, buf + 20) < 0)
11831			reply_len = -1;
11832	} else if (os_strncmp(buf, "INTERWORKING_CONNECT ", 21) == 0) {
11833		if (ctrl_interworking_connect(wpa_s, buf + 21, 0) < 0)
11834			reply_len = -1;
11835	} else if (os_strncmp(buf, "INTERWORKING_ADD_NETWORK ", 25) == 0) {
11836		int id;
11837
11838		id = ctrl_interworking_connect(wpa_s, buf + 25, 1);
11839		if (id < 0)
11840			reply_len = -1;
11841		else {
11842			reply_len = os_snprintf(reply, reply_size, "%d\n", id);
11843			if (os_snprintf_error(reply_size, reply_len))
11844				reply_len = -1;
11845		}
11846	} else if (os_strncmp(buf, "ANQP_GET ", 9) == 0) {
11847		if (get_anqp(wpa_s, buf + 9) < 0)
11848			reply_len = -1;
11849	} else if (os_strncmp(buf, "GAS_REQUEST ", 12) == 0) {
11850		if (gas_request(wpa_s, buf + 12) < 0)
11851			reply_len = -1;
11852	} else if (os_strncmp(buf, "GAS_RESPONSE_GET ", 17) == 0) {
11853		reply_len = gas_response_get(wpa_s, buf + 17, reply,
11854					     reply_size);
11855#endif /* CONFIG_INTERWORKING */
11856#ifdef CONFIG_HS20
11857	} else if (os_strncmp(buf, "HS20_ANQP_GET ", 14) == 0) {
11858		if (get_hs20_anqp(wpa_s, buf + 14) < 0)
11859			reply_len = -1;
11860	} else if (os_strncmp(buf, "HS20_GET_NAI_HOME_REALM_LIST ", 29) == 0) {
11861		if (hs20_get_nai_home_realm_list(wpa_s, buf + 29) < 0)
11862			reply_len = -1;
11863	} else if (os_strncmp(buf, "HS20_ICON_REQUEST ", 18) == 0) {
11864		if (hs20_icon_request(wpa_s, buf + 18, 0) < 0)
11865			reply_len = -1;
11866	} else if (os_strncmp(buf, "REQ_HS20_ICON ", 14) == 0) {
11867		if (hs20_icon_request(wpa_s, buf + 14, 1) < 0)
11868			reply_len = -1;
11869	} else if (os_strncmp(buf, "GET_HS20_ICON ", 14) == 0) {
11870		reply_len = get_hs20_icon(wpa_s, buf + 14, reply, reply_size);
11871	} else if (os_strncmp(buf, "DEL_HS20_ICON ", 14) == 0) {
11872		if (del_hs20_icon(wpa_s, buf + 14) < 0)
11873			reply_len = -1;
11874	} else if (os_strcmp(buf, "FETCH_OSU") == 0) {
11875		if (hs20_fetch_osu(wpa_s, 0) < 0)
11876			reply_len = -1;
11877	} else if (os_strcmp(buf, "FETCH_OSU no-scan") == 0) {
11878		if (hs20_fetch_osu(wpa_s, 1) < 0)
11879			reply_len = -1;
11880	} else if (os_strcmp(buf, "CANCEL_FETCH_OSU") == 0) {
11881		hs20_cancel_fetch_osu(wpa_s);
11882#endif /* CONFIG_HS20 */
11883	} else if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0)
11884	{
11885		if (wpa_supplicant_ctrl_iface_ctrl_rsp(
11886			    wpa_s, buf + os_strlen(WPA_CTRL_RSP)))
11887			reply_len = -1;
11888		else {
11889			/*
11890			 * Notify response from timeout to allow the control
11891			 * interface response to be sent first.
11892			 */
11893			eloop_register_timeout(0, 0, wpas_ctrl_eapol_response,
11894					       wpa_s, NULL);
11895		}
11896	} else if (os_strcmp(buf, "RECONFIGURE") == 0) {
11897		if (wpa_supplicant_reload_configuration(wpa_s))
11898			reply_len = -1;
11899	} else if (os_strcmp(buf, "TERMINATE") == 0) {
11900		wpa_supplicant_terminate_proc(wpa_s->global);
11901	} else if (os_strncmp(buf, "BSSID ", 6) == 0) {
11902		if (wpa_supplicant_ctrl_iface_bssid(wpa_s, buf + 6))
11903			reply_len = -1;
11904	} else if (os_strncmp(buf, "BSSID_IGNORE", 12) == 0) {
11905		reply_len = wpa_supplicant_ctrl_iface_bssid_ignore(
11906			wpa_s, buf + 12, reply, reply_size);
11907	} else if (os_strncmp(buf, "BLACKLIST", 9) == 0) {
11908		/* deprecated backwards compatibility alias for BSSID_IGNORE */
11909		reply_len = wpa_supplicant_ctrl_iface_bssid_ignore(
11910			wpa_s, buf + 9, reply, reply_size);
11911	} else if (os_strncmp(buf, "LOG_LEVEL", 9) == 0) {
11912		reply_len = wpa_supplicant_ctrl_iface_log_level(
11913			wpa_s, buf + 9, reply, reply_size);
11914	} else if (os_strncmp(buf, "LIST_NETWORKS ", 14) == 0) {
11915		reply_len = wpa_supplicant_ctrl_iface_list_networks(
11916			wpa_s, buf + 14, reply, reply_size);
11917	} else if (os_strcmp(buf, "LIST_NETWORKS") == 0) {
11918		reply_len = wpa_supplicant_ctrl_iface_list_networks(
11919			wpa_s, NULL, reply, reply_size);
11920	} else if (os_strcmp(buf, "DISCONNECT") == 0) {
11921		wpas_request_disconnection(wpa_s);
11922	} else if (os_strcmp(buf, "SCAN") == 0) {
11923		wpas_ctrl_scan(wpa_s, NULL, reply, reply_size, &reply_len);
11924	} else if (os_strncmp(buf, "SCAN ", 5) == 0) {
11925		wpas_ctrl_scan(wpa_s, buf + 5, reply, reply_size, &reply_len);
11926	} else if (os_strcmp(buf, "SCAN_RESULTS") == 0) {
11927		reply_len = wpa_supplicant_ctrl_iface_scan_results(
11928			wpa_s, reply, reply_size);
11929	} else if (os_strcmp(buf, "ABORT_SCAN") == 0) {
11930		if (wpas_abort_ongoing_scan(wpa_s) < 0)
11931			reply_len = -1;
11932	} else if (os_strncmp(buf, "SELECT_NETWORK ", 15) == 0) {
11933		if (wpa_supplicant_ctrl_iface_select_network(wpa_s, buf + 15))
11934			reply_len = -1;
11935	} else if (os_strncmp(buf, "ENABLE_NETWORK ", 15) == 0) {
11936		if (wpa_supplicant_ctrl_iface_enable_network(wpa_s, buf + 15))
11937			reply_len = -1;
11938	} else if (os_strncmp(buf, "DISABLE_NETWORK ", 16) == 0) {
11939		if (wpa_supplicant_ctrl_iface_disable_network(wpa_s, buf + 16))
11940			reply_len = -1;
11941	} else if (os_strcmp(buf, "ADD_NETWORK") == 0) {
11942		reply_len = wpa_supplicant_ctrl_iface_add_network(
11943			wpa_s, reply, reply_size);
11944	} else if (os_strncmp(buf, "REMOVE_NETWORK ", 15) == 0) {
11945		if (wpa_supplicant_ctrl_iface_remove_network(wpa_s, buf + 15))
11946			reply_len = -1;
11947	} else if (os_strncmp(buf, "SET_NETWORK ", 12) == 0) {
11948		if (wpa_supplicant_ctrl_iface_set_network(wpa_s, buf + 12))
11949			reply_len = -1;
11950	} else if (os_strncmp(buf, "GET_NETWORK ", 12) == 0) {
11951		reply_len = wpa_supplicant_ctrl_iface_get_network(
11952			wpa_s, buf + 12, reply, reply_size);
11953	} else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
11954		if (wpa_supplicant_ctrl_iface_dup_network(wpa_s, buf + 12,
11955							  wpa_s))
11956			reply_len = -1;
11957	} else if (os_strcmp(buf, "LIST_CREDS") == 0) {
11958		reply_len = wpa_supplicant_ctrl_iface_list_creds(
11959			wpa_s, reply, reply_size);
11960	} else if (os_strcmp(buf, "ADD_CRED") == 0) {
11961		reply_len = wpa_supplicant_ctrl_iface_add_cred(
11962			wpa_s, reply, reply_size);
11963	} else if (os_strncmp(buf, "REMOVE_CRED ", 12) == 0) {
11964		if (wpa_supplicant_ctrl_iface_remove_cred(wpa_s, buf + 12))
11965			reply_len = -1;
11966	} else if (os_strncmp(buf, "SET_CRED ", 9) == 0) {
11967		if (wpa_supplicant_ctrl_iface_set_cred(wpa_s, buf + 9))
11968			reply_len = -1;
11969	} else if (os_strncmp(buf, "GET_CRED ", 9) == 0) {
11970		reply_len = wpa_supplicant_ctrl_iface_get_cred(wpa_s, buf + 9,
11971							       reply,
11972							       reply_size);
11973#ifndef CONFIG_NO_CONFIG_WRITE
11974	} else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
11975		if (wpa_supplicant_ctrl_iface_save_config(wpa_s))
11976			reply_len = -1;
11977#endif /* CONFIG_NO_CONFIG_WRITE */
11978	} else if (os_strncmp(buf, "GET_CAPABILITY ", 15) == 0) {
11979		reply_len = wpa_supplicant_ctrl_iface_get_capability(
11980			wpa_s, buf + 15, reply, reply_size);
11981	} else if (os_strncmp(buf, "AP_SCAN ", 8) == 0) {
11982		if (wpa_supplicant_ctrl_iface_ap_scan(wpa_s, buf + 8))
11983			reply_len = -1;
11984	} else if (os_strncmp(buf, "SCAN_INTERVAL ", 14) == 0) {
11985		if (wpa_supplicant_ctrl_iface_scan_interval(wpa_s, buf + 14))
11986			reply_len = -1;
11987	} else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
11988		reply_len = wpa_supplicant_global_iface_list(
11989			wpa_s->global, reply, reply_size);
11990	} else if (os_strncmp(buf, "INTERFACES", 10) == 0) {
11991		reply_len = wpa_supplicant_global_iface_interfaces(
11992			wpa_s->global, buf + 10, reply, reply_size);
11993	} else if (os_strncmp(buf, "BSS ", 4) == 0) {
11994		reply_len = wpa_supplicant_ctrl_iface_bss(
11995			wpa_s, buf + 4, reply, reply_size);
11996#ifdef CONFIG_AP
11997	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
11998		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
11999	} else if (os_strncmp(buf, "STA ", 4) == 0) {
12000		reply_len = ap_ctrl_iface_sta(wpa_s, buf + 4, reply,
12001					      reply_size);
12002	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
12003		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
12004						   reply_size);
12005	} else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
12006		if (ap_ctrl_iface_sta_deauthenticate(wpa_s, buf + 15))
12007			reply_len = -1;
12008	} else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
12009		if (ap_ctrl_iface_sta_disassociate(wpa_s, buf + 13))
12010			reply_len = -1;
12011	} else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
12012		if (ap_ctrl_iface_chanswitch(wpa_s, buf + 12))
12013			reply_len = -1;
12014	} else if (os_strcmp(buf, "STOP_AP") == 0) {
12015		if (wpas_ap_stop_ap(wpa_s))
12016			reply_len = -1;
12017	} else if (os_strcmp(buf, "UPDATE_BEACON") == 0) {
12018		if (wpas_ap_update_beacon(wpa_s))
12019			reply_len = -1;
12020#endif /* CONFIG_AP */
12021	} else if (os_strcmp(buf, "SUSPEND") == 0) {
12022		wpas_notify_suspend(wpa_s->global);
12023	} else if (os_strcmp(buf, "RESUME") == 0) {
12024		wpas_notify_resume(wpa_s->global);
12025#ifdef CONFIG_TESTING_OPTIONS
12026	} else if (os_strcmp(buf, "DROP_SA") == 0) {
12027		wpa_supplicant_ctrl_iface_drop_sa(wpa_s);
12028#endif /* CONFIG_TESTING_OPTIONS */
12029	} else if (os_strncmp(buf, "ROAM ", 5) == 0) {
12030		if (wpa_supplicant_ctrl_iface_roam(wpa_s, buf + 5))
12031			reply_len = -1;
12032	} else if (os_strncmp(buf, "STA_AUTOCONNECT ", 16) == 0) {
12033		wpa_s->auto_reconnect_disabled = atoi(buf + 16) == 0;
12034	} else if (os_strncmp(buf, "BSS_EXPIRE_AGE ", 15) == 0) {
12035		if (wpa_supplicant_ctrl_iface_bss_expire_age(wpa_s, buf + 15))
12036			reply_len = -1;
12037	} else if (os_strncmp(buf, "BSS_EXPIRE_COUNT ", 17) == 0) {
12038		if (wpa_supplicant_ctrl_iface_bss_expire_count(wpa_s,
12039							       buf + 17))
12040			reply_len = -1;
12041	} else if (os_strncmp(buf, "BSS_FLUSH ", 10) == 0) {
12042		wpa_supplicant_ctrl_iface_bss_flush(wpa_s, buf + 10);
12043#ifdef CONFIG_TDLS
12044	} else if (os_strncmp(buf, "TDLS_DISCOVER ", 14) == 0) {
12045		if (wpa_supplicant_ctrl_iface_tdls_discover(wpa_s, buf + 14))
12046			reply_len = -1;
12047	} else if (os_strncmp(buf, "TDLS_SETUP ", 11) == 0) {
12048		if (wpa_supplicant_ctrl_iface_tdls_setup(wpa_s, buf + 11))
12049			reply_len = -1;
12050	} else if (os_strncmp(buf, "TDLS_TEARDOWN ", 14) == 0) {
12051		if (wpa_supplicant_ctrl_iface_tdls_teardown(wpa_s, buf + 14))
12052			reply_len = -1;
12053	} else if (os_strncmp(buf, "TDLS_CHAN_SWITCH ", 17) == 0) {
12054		if (wpa_supplicant_ctrl_iface_tdls_chan_switch(wpa_s,
12055							       buf + 17))
12056			reply_len = -1;
12057	} else if (os_strncmp(buf, "TDLS_CANCEL_CHAN_SWITCH ", 24) == 0) {
12058		if (wpa_supplicant_ctrl_iface_tdls_cancel_chan_switch(wpa_s,
12059								      buf + 24))
12060			reply_len = -1;
12061	} else if (os_strncmp(buf, "TDLS_LINK_STATUS ", 17) == 0) {
12062		reply_len = wpa_supplicant_ctrl_iface_tdls_link_status(
12063			wpa_s, buf + 17, reply, reply_size);
12064#endif /* CONFIG_TDLS */
12065	} else if (os_strcmp(buf, "WMM_AC_STATUS") == 0) {
12066		reply_len = wpas_wmm_ac_status(wpa_s, reply, reply_size);
12067	} else if (os_strncmp(buf, "WMM_AC_ADDTS ", 13) == 0) {
12068		if (wmm_ac_ctrl_addts(wpa_s, buf + 13))
12069			reply_len = -1;
12070	} else if (os_strncmp(buf, "WMM_AC_DELTS ", 13) == 0) {
12071		if (wmm_ac_ctrl_delts(wpa_s, buf + 13))
12072			reply_len = -1;
12073	} else if (os_strncmp(buf, "SIGNAL_POLL", 11) == 0) {
12074		reply_len = wpa_supplicant_signal_poll(wpa_s, reply,
12075						       reply_size);
12076	} else if (os_strncmp(buf, "SIGNAL_MONITOR", 14) == 0) {
12077		if (wpas_ctrl_iface_signal_monitor(wpa_s, buf + 14))
12078			reply_len = -1;
12079	} else if (os_strncmp(buf, "PKTCNT_POLL", 11) == 0) {
12080		reply_len = wpa_supplicant_pktcnt_poll(wpa_s, reply,
12081						       reply_size);
12082#ifdef CONFIG_AUTOSCAN
12083	} else if (os_strncmp(buf, "AUTOSCAN ", 9) == 0) {
12084		if (wpa_supplicant_ctrl_iface_autoscan(wpa_s, buf + 9))
12085			reply_len = -1;
12086#endif /* CONFIG_AUTOSCAN */
12087	} else if (os_strcmp(buf, "DRIVER_FLAGS") == 0) {
12088		reply_len = wpas_ctrl_iface_driver_flags(wpa_s, reply,
12089							 reply_size);
12090	} else if (os_strcmp(buf, "DRIVER_FLAGS2") == 0) {
12091		reply_len = wpas_ctrl_iface_driver_flags2(wpa_s, reply,
12092							  reply_size);
12093#ifdef ANDROID
12094	} else if (os_strncmp(buf, "DRIVER ", 7) == 0) {
12095		reply_len = wpa_supplicant_driver_cmd(wpa_s, buf + 7, reply,
12096						      reply_size);
12097#endif /* ANDROID */
12098	} else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
12099		reply_len = wpa_supplicant_vendor_cmd(wpa_s, buf + 7, reply,
12100						      reply_size);
12101	} else if (os_strcmp(buf, "REAUTHENTICATE") == 0) {
12102		pmksa_cache_clear_current(wpa_s->wpa);
12103		eapol_sm_request_reauth(wpa_s->eapol);
12104#ifdef CONFIG_WNM
12105	} else if (os_strncmp(buf, "WNM_SLEEP ", 10) == 0) {
12106		if (wpas_ctrl_iface_wnm_sleep(wpa_s, buf + 10))
12107			reply_len = -1;
12108	} else if (os_strncmp(buf, "WNM_BSS_QUERY ", 14) == 0) {
12109		if (wpas_ctrl_iface_wnm_bss_query(wpa_s, buf + 14))
12110				reply_len = -1;
12111	} else if (os_strncmp(buf, "COLOC_INTF_REPORT ", 18) == 0) {
12112		if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
12113			reply_len = -1;
12114#endif /* CONFIG_WNM */
12115	} else if (os_strcmp(buf, "FLUSH") == 0) {
12116		wpa_supplicant_ctrl_iface_flush(wpa_s);
12117	} else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
12118		reply_len = wpas_ctrl_radio_work(wpa_s, buf + 11, reply,
12119						 reply_size);
12120#ifdef CONFIG_TESTING_OPTIONS
12121	} else if (os_strncmp(buf, "MGMT_TX ", 8) == 0) {
12122		if (wpas_ctrl_iface_mgmt_tx(wpa_s, buf + 8) < 0)
12123			reply_len = -1;
12124	} else if (os_strcmp(buf, "MGMT_TX_DONE") == 0) {
12125		wpas_ctrl_iface_mgmt_tx_done(wpa_s);
12126	} else if (os_strncmp(buf, "MGMT_RX_PROCESS ", 16) == 0) {
12127		if (wpas_ctrl_iface_mgmt_rx_process(wpa_s, buf + 16) < 0)
12128			reply_len = -1;
12129	} else if (os_strncmp(buf, "DRIVER_EVENT ", 13) == 0) {
12130		if (wpas_ctrl_iface_driver_event(wpa_s, buf + 13) < 0)
12131			reply_len = -1;
12132	} else if (os_strncmp(buf, "EAPOL_RX ", 9) == 0) {
12133		if (wpas_ctrl_iface_eapol_rx(wpa_s, buf + 9) < 0)
12134			reply_len = -1;
12135	} else if (os_strncmp(buf, "EAPOL_TX ", 9) == 0) {
12136		if (wpas_ctrl_iface_eapol_tx(wpa_s, buf + 9) < 0)
12137			reply_len = -1;
12138	} else if (os_strncmp(buf, "DATA_TEST_CONFIG ", 17) == 0) {
12139		if (wpas_ctrl_iface_data_test_config(wpa_s, buf + 17) < 0)
12140			reply_len = -1;
12141	} else if (os_strncmp(buf, "DATA_TEST_TX ", 13) == 0) {
12142		if (wpas_ctrl_iface_data_test_tx(wpa_s, buf + 13) < 0)
12143			reply_len = -1;
12144	} else if (os_strncmp(buf, "DATA_TEST_FRAME ", 16) == 0) {
12145		if (wpas_ctrl_iface_data_test_frame(wpa_s, buf + 16) < 0)
12146			reply_len = -1;
12147	} else if (os_strncmp(buf, "TEST_ALLOC_FAIL ", 16) == 0) {
12148		if (wpas_ctrl_test_alloc_fail(wpa_s, buf + 16) < 0)
12149			reply_len = -1;
12150	} else if (os_strcmp(buf, "GET_ALLOC_FAIL") == 0) {
12151		reply_len = wpas_ctrl_get_alloc_fail(wpa_s, reply, reply_size);
12152	} else if (os_strncmp(buf, "TEST_FAIL ", 10) == 0) {
12153		if (wpas_ctrl_test_fail(wpa_s, buf + 10) < 0)
12154			reply_len = -1;
12155	} else if (os_strcmp(buf, "GET_FAIL") == 0) {
12156		reply_len = wpas_ctrl_get_fail(wpa_s, reply, reply_size);
12157	} else if (os_strncmp(buf, "EVENT_TEST ", 11) == 0) {
12158		if (wpas_ctrl_event_test(wpa_s, buf + 11) < 0)
12159			reply_len = -1;
12160	} else if (os_strncmp(buf, "TEST_ASSOC_IE ", 14) == 0) {
12161		if (wpas_ctrl_test_assoc_ie(wpa_s, buf + 14) < 0)
12162			reply_len = -1;
12163	} else if (os_strcmp(buf, "RESET_PN") == 0) {
12164		if (wpas_ctrl_reset_pn(wpa_s) < 0)
12165			reply_len = -1;
12166	} else if (os_strncmp(buf, "KEY_REQUEST ", 12) == 0) {
12167		if (wpas_ctrl_key_request(wpa_s, buf + 12) < 0)
12168			reply_len = -1;
12169	} else if (os_strcmp(buf, "RESEND_ASSOC") == 0) {
12170		if (wpas_ctrl_resend_assoc(wpa_s) < 0)
12171			reply_len = -1;
12172	} else if (os_strcmp(buf, "UNPROT_DEAUTH") == 0) {
12173		sme_event_unprot_disconnect(
12174			wpa_s, wpa_s->bssid, NULL,
12175			WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
12176	} else if (os_strncmp(buf, "TWT_SETUP ", 10) == 0) {
12177		if (wpas_ctrl_iface_send_twt_setup(wpa_s, buf + 9))
12178			reply_len = -1;
12179	} else if (os_strcmp(buf, "TWT_SETUP") == 0) {
12180		if (wpas_ctrl_iface_send_twt_setup(wpa_s, ""))
12181			reply_len = -1;
12182	} else if (os_strncmp(buf, "TWT_TEARDOWN ", 13) == 0) {
12183		if (wpas_ctrl_iface_send_twt_teardown(wpa_s, buf + 12))
12184			reply_len = -1;
12185	} else if (os_strcmp(buf, "TWT_TEARDOWN") == 0) {
12186		if (wpas_ctrl_iface_send_twt_teardown(wpa_s, ""))
12187			reply_len = -1;
12188#endif /* CONFIG_TESTING_OPTIONS */
12189	} else if (os_strncmp(buf, "VENDOR_ELEM_ADD ", 16) == 0) {
12190		if (wpas_ctrl_vendor_elem_add(wpa_s, buf + 16) < 0)
12191			reply_len = -1;
12192	} else if (os_strncmp(buf, "VENDOR_ELEM_GET ", 16) == 0) {
12193		reply_len = wpas_ctrl_vendor_elem_get(wpa_s, buf + 16, reply,
12194						      reply_size);
12195	} else if (os_strncmp(buf, "VENDOR_ELEM_REMOVE ", 19) == 0) {
12196		if (wpas_ctrl_vendor_elem_remove(wpa_s, buf + 19) < 0)
12197			reply_len = -1;
12198	} else if (os_strncmp(buf, "NEIGHBOR_REP_REQUEST", 20) == 0) {
12199		if (wpas_ctrl_iface_send_neighbor_rep(wpa_s, buf + 20))
12200			reply_len = -1;
12201	} else if (os_strcmp(buf, "ERP_FLUSH") == 0) {
12202		wpas_ctrl_iface_erp_flush(wpa_s);
12203	} else if (os_strncmp(buf, "MAC_RAND_SCAN ", 14) == 0) {
12204		if (wpas_ctrl_iface_mac_rand_scan(wpa_s, buf + 14))
12205			reply_len = -1;
12206	} else if (os_strncmp(buf, "GET_PREF_FREQ_LIST ", 19) == 0) {
12207		reply_len = wpas_ctrl_iface_get_pref_freq_list(
12208			wpa_s, buf + 19, reply, reply_size);
12209#ifdef CONFIG_FILS
12210	} else if (os_strncmp(buf, "FILS_HLP_REQ_ADD ", 17) == 0) {
12211		if (wpas_ctrl_iface_fils_hlp_req_add(wpa_s, buf + 17))
12212			reply_len = -1;
12213	} else if (os_strcmp(buf, "FILS_HLP_REQ_FLUSH") == 0) {
12214		wpas_flush_fils_hlp_req(wpa_s);
12215#endif /* CONFIG_FILS */
12216#ifdef CONFIG_DPP
12217	} else if (os_strncmp(buf, "DPP_QR_CODE ", 12) == 0) {
12218		int res;
12219
12220		res = wpas_dpp_qr_code(wpa_s, buf + 12);
12221		if (res < 0) {
12222			reply_len = -1;
12223		} else {
12224			reply_len = os_snprintf(reply, reply_size, "%d", res);
12225			if (os_snprintf_error(reply_size, reply_len))
12226				reply_len = -1;
12227		}
12228	} else if (os_strncmp(buf, "DPP_NFC_URI ", 12) == 0) {
12229		int res;
12230
12231		res = wpas_dpp_nfc_uri(wpa_s, buf + 12);
12232		if (res < 0) {
12233			reply_len = -1;
12234		} else {
12235			reply_len = os_snprintf(reply, reply_size, "%d", res);
12236			if (os_snprintf_error(reply_size, reply_len))
12237				reply_len = -1;
12238		}
12239	} else if (os_strncmp(buf, "DPP_NFC_HANDOVER_REQ ", 21) == 0) {
12240		int res;
12241
12242		res = wpas_dpp_nfc_handover_req(wpa_s, buf + 20);
12243		if (res < 0) {
12244			reply_len = -1;
12245		} else {
12246			reply_len = os_snprintf(reply, reply_size, "%d", res);
12247			if (os_snprintf_error(reply_size, reply_len))
12248				reply_len = -1;
12249		}
12250	} else if (os_strncmp(buf, "DPP_NFC_HANDOVER_SEL ", 21) == 0) {
12251		int res;
12252
12253		res = wpas_dpp_nfc_handover_sel(wpa_s, buf + 20);
12254		if (res < 0) {
12255			reply_len = -1;
12256		} else {
12257			reply_len = os_snprintf(reply, reply_size, "%d", res);
12258			if (os_snprintf_error(reply_size, reply_len))
12259				reply_len = -1;
12260		}
12261	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_GEN ", 18) == 0) {
12262		int res;
12263
12264		res = dpp_bootstrap_gen(wpa_s->dpp, buf + 18);
12265		if (res < 0) {
12266			reply_len = -1;
12267		} else {
12268			reply_len = os_snprintf(reply, reply_size, "%d", res);
12269			if (os_snprintf_error(reply_size, reply_len))
12270				reply_len = -1;
12271		}
12272	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_REMOVE ", 21) == 0) {
12273		if (dpp_bootstrap_remove(wpa_s->dpp, buf + 21) < 0)
12274			reply_len = -1;
12275	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_GET_URI ", 22) == 0) {
12276		const char *uri;
12277
12278		uri = dpp_bootstrap_get_uri(wpa_s->dpp, atoi(buf + 22));
12279		if (!uri) {
12280			reply_len = -1;
12281		} else {
12282			reply_len = os_snprintf(reply, reply_size, "%s", uri);
12283			if (os_snprintf_error(reply_size, reply_len))
12284				reply_len = -1;
12285		}
12286	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_INFO ", 19) == 0) {
12287		reply_len = dpp_bootstrap_info(wpa_s->dpp, atoi(buf + 19),
12288					       reply, reply_size);
12289	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_SET ", 18) == 0) {
12290		if (dpp_bootstrap_set(wpa_s->dpp, atoi(buf + 18),
12291				      os_strchr(buf + 18, ' ')) < 0)
12292			reply_len = -1;
12293	} else if (os_strncmp(buf, "DPP_AUTH_INIT ", 14) == 0) {
12294		if (wpas_dpp_auth_init(wpa_s, buf + 13) < 0)
12295			reply_len = -1;
12296	} else if (os_strncmp(buf, "DPP_LISTEN ", 11) == 0) {
12297		if (wpas_dpp_listen(wpa_s, buf + 11) < 0)
12298			reply_len = -1;
12299	} else if (os_strcmp(buf, "DPP_STOP_LISTEN") == 0) {
12300		wpas_dpp_stop(wpa_s);
12301		wpas_dpp_listen_stop(wpa_s);
12302	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_ADD", 20) == 0) {
12303		int res;
12304
12305		res = dpp_configurator_add(wpa_s->dpp, buf + 20);
12306		if (res < 0) {
12307			reply_len = -1;
12308		} else {
12309			reply_len = os_snprintf(reply, reply_size, "%d", res);
12310			if (os_snprintf_error(reply_size, reply_len))
12311				reply_len = -1;
12312		}
12313	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_REMOVE ", 24) == 0) {
12314		if (dpp_configurator_remove(wpa_s->dpp, buf + 24) < 0)
12315			reply_len = -1;
12316	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_SIGN ", 22) == 0) {
12317		if (wpas_dpp_configurator_sign(wpa_s, buf + 21) < 0)
12318			reply_len = -1;
12319	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_GET_KEY ", 25) == 0) {
12320		reply_len = dpp_configurator_get_key_id(wpa_s->dpp,
12321							atoi(buf + 25),
12322							reply, reply_size);
12323	} else if (os_strncmp(buf, "DPP_PKEX_ADD ", 13) == 0) {
12324		int res;
12325
12326		res = wpas_dpp_pkex_add(wpa_s, buf + 12);
12327		if (res < 0) {
12328			reply_len = -1;
12329		} else {
12330			reply_len = os_snprintf(reply, reply_size, "%d", res);
12331			if (os_snprintf_error(reply_size, reply_len))
12332				reply_len = -1;
12333		}
12334	} else if (os_strncmp(buf, "DPP_PKEX_REMOVE ", 16) == 0) {
12335		if (wpas_dpp_pkex_remove(wpa_s, buf + 16) < 0)
12336			reply_len = -1;
12337#ifdef CONFIG_DPP2
12338	} else if (os_strncmp(buf, "DPP_CONTROLLER_START ", 21) == 0) {
12339		if (wpas_dpp_controller_start(wpa_s, buf + 20) < 0)
12340			reply_len = -1;
12341	} else if (os_strcmp(buf, "DPP_CONTROLLER_START") == 0) {
12342		if (wpas_dpp_controller_start(wpa_s, NULL) < 0)
12343			reply_len = -1;
12344	} else if (os_strcmp(buf, "DPP_CONTROLLER_STOP") == 0) {
12345		dpp_controller_stop(wpa_s->dpp);
12346	} else if (os_strncmp(buf, "DPP_CHIRP ", 10) == 0) {
12347		if (wpas_dpp_chirp(wpa_s, buf + 9) < 0)
12348			reply_len = -1;
12349	} else if (os_strcmp(buf, "DPP_STOP_CHIRP") == 0) {
12350		wpas_dpp_chirp_stop(wpa_s);
12351	} else if (os_strncmp(buf, "DPP_RECONFIG ", 13) == 0) {
12352		if (wpas_dpp_reconfig(wpa_s, buf + 13) < 0)
12353			reply_len = -1;
12354	} else if (os_strncmp(buf, "DPP_CA_SET ", 11) == 0) {
12355		if (wpas_dpp_ca_set(wpa_s, buf + 10) < 0)
12356			reply_len = -1;
12357#endif /* CONFIG_DPP2 */
12358#endif /* CONFIG_DPP */
12359	} else if (os_strncmp(buf, "MSCS ", 5) == 0) {
12360		if (wpas_ctrl_iface_configure_mscs(wpa_s, buf + 5))
12361			reply_len = -1;
12362#ifdef CONFIG_PASN
12363	} else if (os_strncmp(buf, "PASN_START ", 11) == 0) {
12364		if (wpas_ctrl_iface_pasn_start(wpa_s, buf + 11) < 0)
12365			reply_len = -1;
12366	} else if (os_strcmp(buf, "PASN_STOP") == 0) {
12367		wpas_pasn_auth_stop(wpa_s);
12368	} else if (os_strcmp(buf, "PTKSA_CACHE_LIST") == 0) {
12369		reply_len = ptksa_cache_list(wpa_s->ptksa, reply, reply_size);
12370	} else if (os_strncmp(buf, "PASN_DEAUTH ", 12) == 0) {
12371		if (wpas_ctrl_iface_pasn_deauthenticate(wpa_s, buf + 12) < 0)
12372			reply_len = -1;
12373#endif /* CONFIG_PASN */
12374	} else if (os_strncmp(buf, "SCS ", 4) == 0) {
12375		if (wpas_ctrl_iface_configure_scs(wpa_s, buf + 4))
12376			reply_len = -1;
12377	} else if (os_strncmp(buf, "DSCP_RESP ", 10) == 0) {
12378		if (wpas_ctrl_iface_send_dscp_resp(wpa_s, buf + 10))
12379			reply_len = -1;
12380	} else if (os_strncmp(buf, "DSCP_QUERY ", 11) == 0) {
12381		if (wpas_ctrl_iface_send_dscp_query(wpa_s, buf + 11))
12382			reply_len = -1;
12383	} else {
12384		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
12385		reply_len = 16;
12386	}
12387
12388	if (reply_len < 0) {
12389		os_memcpy(reply, "FAIL\n", 5);
12390		reply_len = 5;
12391	}
12392
12393	*resp_len = reply_len;
12394	return reply;
12395}
12396
12397
12398static int wpa_supplicant_global_iface_add(struct wpa_global *global,
12399					   char *cmd)
12400{
12401	struct wpa_interface iface;
12402	char *pos, *extra;
12403	struct wpa_supplicant *wpa_s;
12404	unsigned int create_iface = 0;
12405	u8 mac_addr[ETH_ALEN];
12406	enum wpa_driver_if_type type = WPA_IF_STATION;
12407
12408	/*
12409	 * <ifname>TAB<confname>TAB<driver>TAB<ctrl_interface>TAB<driver_param>
12410	 * TAB<bridge_ifname>[TAB<create>[TAB<interface_type>]]
12411	 */
12412	wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_ADD '%s'", cmd);
12413
12414	os_memset(&iface, 0, sizeof(iface));
12415
12416	do {
12417		iface.ifname = pos = cmd;
12418		pos = os_strchr(pos, '\t');
12419		if (pos)
12420			*pos++ = '\0';
12421		if (iface.ifname[0] == '\0')
12422			return -1;
12423		if (pos == NULL)
12424			break;
12425
12426		iface.confname = pos;
12427		pos = os_strchr(pos, '\t');
12428		if (pos)
12429			*pos++ = '\0';
12430		if (iface.confname[0] == '\0')
12431			iface.confname = NULL;
12432		if (pos == NULL)
12433			break;
12434
12435		iface.driver = pos;
12436		pos = os_strchr(pos, '\t');
12437		if (pos)
12438			*pos++ = '\0';
12439		if (iface.driver[0] == '\0')
12440			iface.driver = NULL;
12441		if (pos == NULL)
12442			break;
12443
12444		iface.ctrl_interface = pos;
12445		pos = os_strchr(pos, '\t');
12446		if (pos)
12447			*pos++ = '\0';
12448		if (iface.ctrl_interface[0] == '\0')
12449			iface.ctrl_interface = NULL;
12450		if (pos == NULL)
12451			break;
12452
12453		iface.driver_param = pos;
12454		pos = os_strchr(pos, '\t');
12455		if (pos)
12456			*pos++ = '\0';
12457		if (iface.driver_param[0] == '\0')
12458			iface.driver_param = NULL;
12459		if (pos == NULL)
12460			break;
12461
12462		iface.bridge_ifname = pos;
12463		pos = os_strchr(pos, '\t');
12464		if (pos)
12465			*pos++ = '\0';
12466		if (iface.bridge_ifname[0] == '\0')
12467			iface.bridge_ifname = NULL;
12468		if (pos == NULL)
12469			break;
12470
12471		extra = pos;
12472		pos = os_strchr(pos, '\t');
12473		if (pos)
12474			*pos++ = '\0';
12475		if (!extra[0])
12476			break;
12477
12478		if (os_strcmp(extra, "create") == 0) {
12479			create_iface = 1;
12480			if (!pos)
12481				break;
12482
12483			if (os_strcmp(pos, "sta") == 0) {
12484				type = WPA_IF_STATION;
12485			} else if (os_strcmp(pos, "ap") == 0) {
12486				type = WPA_IF_AP_BSS;
12487			} else {
12488				wpa_printf(MSG_DEBUG,
12489					   "INTERFACE_ADD unsupported interface type: '%s'",
12490					   pos);
12491				return -1;
12492			}
12493		} else {
12494			wpa_printf(MSG_DEBUG,
12495				   "INTERFACE_ADD unsupported extra parameter: '%s'",
12496				   extra);
12497			return -1;
12498		}
12499	} while (0);
12500
12501	if (create_iface) {
12502		wpa_printf(MSG_DEBUG, "CTRL_IFACE creating interface '%s'",
12503			   iface.ifname);
12504		if (!global->ifaces)
12505			return -1;
12506		if (wpa_drv_if_add(global->ifaces, type, iface.ifname,
12507				   NULL, NULL, NULL, mac_addr, NULL) < 0) {
12508			wpa_printf(MSG_ERROR,
12509				   "CTRL_IFACE interface creation failed");
12510			return -1;
12511		}
12512
12513		wpa_printf(MSG_DEBUG,
12514			   "CTRL_IFACE interface '%s' created with MAC addr: "
12515			   MACSTR, iface.ifname, MAC2STR(mac_addr));
12516	}
12517
12518	if (wpa_supplicant_get_iface(global, iface.ifname))
12519		goto fail;
12520
12521	wpa_s = wpa_supplicant_add_iface(global, &iface, NULL);
12522	if (!wpa_s)
12523		goto fail;
12524	wpa_s->added_vif = create_iface;
12525	return 0;
12526
12527fail:
12528	if (create_iface)
12529		wpa_drv_if_remove(global->ifaces, WPA_IF_STATION, iface.ifname);
12530	return -1;
12531}
12532
12533
12534static int wpa_supplicant_global_iface_remove(struct wpa_global *global,
12535					      char *cmd)
12536{
12537	struct wpa_supplicant *wpa_s;
12538	int ret;
12539	unsigned int delete_iface;
12540
12541	wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_REMOVE '%s'", cmd);
12542
12543	wpa_s = wpa_supplicant_get_iface(global, cmd);
12544	if (wpa_s == NULL)
12545		return -1;
12546	delete_iface = wpa_s->added_vif;
12547	ret = wpa_supplicant_remove_iface(global, wpa_s, 0);
12548	if (!ret && delete_iface) {
12549		wpa_printf(MSG_DEBUG, "CTRL_IFACE deleting the interface '%s'",
12550			   cmd);
12551		ret = wpa_drv_if_remove(global->ifaces, WPA_IF_STATION, cmd);
12552	}
12553	return ret;
12554}
12555
12556
12557static void wpa_free_iface_info(struct wpa_interface_info *iface)
12558{
12559	struct wpa_interface_info *prev;
12560
12561	while (iface) {
12562		prev = iface;
12563		iface = iface->next;
12564
12565		os_free(prev->ifname);
12566		os_free(prev->desc);
12567		os_free(prev);
12568	}
12569}
12570
12571
12572static int wpa_supplicant_global_iface_list(struct wpa_global *global,
12573					    char *buf, int len)
12574{
12575	int i, res;
12576	struct wpa_interface_info *iface = NULL, *last = NULL, *tmp;
12577	char *pos, *end;
12578
12579	for (i = 0; wpa_drivers[i]; i++) {
12580		const struct wpa_driver_ops *drv = wpa_drivers[i];
12581		if (drv->get_interfaces == NULL)
12582			continue;
12583		tmp = drv->get_interfaces(global->drv_priv[i]);
12584		if (tmp == NULL)
12585			continue;
12586
12587		if (last == NULL)
12588			iface = last = tmp;
12589		else
12590			last->next = tmp;
12591		while (last->next)
12592			last = last->next;
12593	}
12594
12595	pos = buf;
12596	end = buf + len;
12597	for (tmp = iface; tmp; tmp = tmp->next) {
12598		res = os_snprintf(pos, end - pos, "%s\t%s\t%s\n",
12599				  tmp->drv_name, tmp->ifname,
12600				  tmp->desc ? tmp->desc : "");
12601		if (os_snprintf_error(end - pos, res)) {
12602			*pos = '\0';
12603			break;
12604		}
12605		pos += res;
12606	}
12607
12608	wpa_free_iface_info(iface);
12609
12610	return pos - buf;
12611}
12612
12613
12614static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
12615						  const char *input,
12616						  char *buf, int len)
12617{
12618	int res;
12619	char *pos, *end;
12620	struct wpa_supplicant *wpa_s;
12621	int show_ctrl = 0;
12622
12623	if (input)
12624		show_ctrl = !!os_strstr(input, "ctrl");
12625
12626	wpa_s = global->ifaces;
12627	pos = buf;
12628	end = buf + len;
12629
12630	while (wpa_s) {
12631		if (show_ctrl)
12632			res = os_snprintf(pos, end - pos, "%s ctrl_iface=%s\n",
12633					  wpa_s->ifname,
12634					  wpa_s->conf->ctrl_interface ?
12635					  wpa_s->conf->ctrl_interface : "N/A");
12636		else
12637			res = os_snprintf(pos, end - pos, "%s\n",
12638					  wpa_s->ifname);
12639
12640		if (os_snprintf_error(end - pos, res)) {
12641			*pos = '\0';
12642			break;
12643		}
12644		pos += res;
12645		wpa_s = wpa_s->next;
12646	}
12647	return pos - buf;
12648}
12649
12650
12651static char * wpas_global_ctrl_iface_ifname(struct wpa_global *global,
12652					    const char *ifname,
12653					    char *cmd, size_t *resp_len)
12654{
12655	struct wpa_supplicant *wpa_s;
12656
12657	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
12658		if (os_strcmp(ifname, wpa_s->ifname) == 0)
12659			break;
12660	}
12661
12662	if (wpa_s == NULL) {
12663		char *resp = os_strdup("FAIL-NO-IFNAME-MATCH\n");
12664		if (resp)
12665			*resp_len = os_strlen(resp);
12666		else
12667			*resp_len = 1;
12668		return resp;
12669	}
12670
12671	return wpa_supplicant_ctrl_iface_process(wpa_s, cmd, resp_len);
12672}
12673
12674
12675static char * wpas_global_ctrl_iface_redir_p2p(struct wpa_global *global,
12676					       char *buf, size_t *resp_len)
12677{
12678#ifdef CONFIG_P2P
12679	static const char * cmd[] = {
12680		"LIST_NETWORKS",
12681		"P2P_FIND",
12682		"P2P_STOP_FIND",
12683		"P2P_LISTEN",
12684		"P2P_GROUP_ADD",
12685		"P2P_GET_PASSPHRASE",
12686		"P2P_SERVICE_UPDATE",
12687		"P2P_SERVICE_FLUSH",
12688		"P2P_FLUSH",
12689		"P2P_CANCEL",
12690		"P2P_PRESENCE_REQ",
12691		"P2P_EXT_LISTEN",
12692#ifdef CONFIG_AP
12693		"STA-FIRST",
12694#endif /* CONFIG_AP */
12695		NULL
12696	};
12697	static const char * prefix[] = {
12698#ifdef ANDROID
12699		"DRIVER ",
12700#endif /* ANDROID */
12701		"GET_CAPABILITY ",
12702		"GET_NETWORK ",
12703		"REMOVE_NETWORK ",
12704		"P2P_FIND ",
12705		"P2P_CONNECT ",
12706		"P2P_LISTEN ",
12707		"P2P_GROUP_REMOVE ",
12708		"P2P_GROUP_ADD ",
12709		"P2P_GROUP_MEMBER ",
12710		"P2P_PROV_DISC ",
12711		"P2P_SERV_DISC_REQ ",
12712		"P2P_SERV_DISC_CANCEL_REQ ",
12713		"P2P_SERV_DISC_RESP ",
12714		"P2P_SERV_DISC_EXTERNAL ",
12715		"P2P_SERVICE_ADD ",
12716		"P2P_SERVICE_DEL ",
12717		"P2P_SERVICE_REP ",
12718		"P2P_REJECT ",
12719		"P2P_INVITE ",
12720		"P2P_PEER ",
12721		"P2P_SET ",
12722		"P2P_UNAUTHORIZE ",
12723		"P2P_PRESENCE_REQ ",
12724		"P2P_EXT_LISTEN ",
12725		"P2P_REMOVE_CLIENT ",
12726		"WPS_NFC_TOKEN ",
12727		"WPS_NFC_TAG_READ ",
12728		"NFC_GET_HANDOVER_SEL ",
12729		"NFC_GET_HANDOVER_REQ ",
12730		"NFC_REPORT_HANDOVER ",
12731		"P2P_ASP_PROVISION ",
12732		"P2P_ASP_PROVISION_RESP ",
12733#ifdef CONFIG_AP
12734		"STA ",
12735		"STA-NEXT ",
12736#endif /* CONFIG_AP */
12737		NULL
12738	};
12739	int found = 0;
12740	int i;
12741
12742	if (global->p2p_init_wpa_s == NULL)
12743		return NULL;
12744
12745	for (i = 0; !found && cmd[i]; i++) {
12746		if (os_strcmp(buf, cmd[i]) == 0)
12747			found = 1;
12748	}
12749
12750	for (i = 0; !found && prefix[i]; i++) {
12751		if (os_strncmp(buf, prefix[i], os_strlen(prefix[i])) == 0)
12752			found = 1;
12753	}
12754
12755	if (found)
12756		return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
12757							 buf, resp_len);
12758#endif /* CONFIG_P2P */
12759	return NULL;
12760}
12761
12762
12763static char * wpas_global_ctrl_iface_redir_wfd(struct wpa_global *global,
12764					       char *buf, size_t *resp_len)
12765{
12766#ifdef CONFIG_WIFI_DISPLAY
12767	if (global->p2p_init_wpa_s == NULL)
12768		return NULL;
12769	if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0 ||
12770	    os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0)
12771		return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
12772							 buf, resp_len);
12773#endif /* CONFIG_WIFI_DISPLAY */
12774	return NULL;
12775}
12776
12777
12778static char * wpas_global_ctrl_iface_redir(struct wpa_global *global,
12779					   char *buf, size_t *resp_len)
12780{
12781	char *ret;
12782
12783	ret = wpas_global_ctrl_iface_redir_p2p(global, buf, resp_len);
12784	if (ret)
12785		return ret;
12786
12787	ret = wpas_global_ctrl_iface_redir_wfd(global, buf, resp_len);
12788	if (ret)
12789		return ret;
12790
12791	return NULL;
12792}
12793
12794
12795static int wpas_global_ctrl_iface_set(struct wpa_global *global, char *cmd)
12796{
12797	char *value;
12798
12799	value = os_strchr(cmd, ' ');
12800	if (value == NULL)
12801		return -1;
12802	*value++ = '\0';
12803
12804	wpa_printf(MSG_DEBUG, "GLOBAL_CTRL_IFACE SET '%s'='%s'", cmd, value);
12805
12806#ifdef CONFIG_WIFI_DISPLAY
12807	if (os_strcasecmp(cmd, "wifi_display") == 0) {
12808		wifi_display_enable(global, !!atoi(value));
12809		return 0;
12810	}
12811#endif /* CONFIG_WIFI_DISPLAY */
12812
12813	/* Restore cmd to its original value to allow redirection */
12814	value[-1] = ' ';
12815
12816	return -1;
12817}
12818
12819
12820static int wpas_global_ctrl_iface_dup_network(struct wpa_global *global,
12821					      char *cmd)
12822{
12823	struct wpa_supplicant *wpa_s[2]; /* src, dst */
12824	char *p;
12825	unsigned int i;
12826
12827	/* cmd: "<src ifname> <dst ifname> <src network id> <dst network id>
12828	 * <variable name> */
12829
12830	for (i = 0; i < ARRAY_SIZE(wpa_s) ; i++) {
12831		p = os_strchr(cmd, ' ');
12832		if (p == NULL)
12833			return -1;
12834		*p = '\0';
12835
12836		wpa_s[i] = global->ifaces;
12837		for (; wpa_s[i]; wpa_s[i] = wpa_s[i]->next) {
12838			if (os_strcmp(cmd, wpa_s[i]->ifname) == 0)
12839				break;
12840		}
12841
12842		if (!wpa_s[i]) {
12843			wpa_printf(MSG_DEBUG,
12844				   "CTRL_IFACE: Could not find iface=%s", cmd);
12845			return -1;
12846		}
12847
12848		cmd = p + 1;
12849	}
12850
12851	return wpa_supplicant_ctrl_iface_dup_network(wpa_s[0], cmd, wpa_s[1]);
12852}
12853
12854
12855#ifndef CONFIG_NO_CONFIG_WRITE
12856static int wpas_global_ctrl_iface_save_config(struct wpa_global *global)
12857{
12858	int ret = 0, saved = 0;
12859	struct wpa_supplicant *wpa_s;
12860
12861	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
12862		if (!wpa_s->conf->update_config) {
12863			wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed to update configuration (update_config=0)");
12864			continue;
12865		}
12866
12867		if (wpa_config_write(wpa_s->confname, wpa_s->conf)) {
12868			wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to update configuration");
12869			ret = 1;
12870		} else {
12871			wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration updated");
12872			saved++;
12873		}
12874	}
12875
12876	if (!saved && !ret) {
12877		wpa_dbg(wpa_s, MSG_DEBUG,
12878			"CTRL_IFACE: SAVE_CONFIG - No configuration files could be updated");
12879		ret = 1;
12880	}
12881
12882	return ret;
12883}
12884#endif /* CONFIG_NO_CONFIG_WRITE */
12885
12886
12887static int wpas_global_ctrl_iface_status(struct wpa_global *global,
12888					 char *buf, size_t buflen)
12889{
12890	char *pos, *end;
12891	int ret;
12892	struct wpa_supplicant *wpa_s;
12893
12894	pos = buf;
12895	end = buf + buflen;
12896
12897#ifdef CONFIG_P2P
12898	if (global->p2p && !global->p2p_disabled) {
12899		ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
12900				  "\n"
12901				  "p2p_state=%s\n",
12902				  MAC2STR(global->p2p_dev_addr),
12903				  p2p_get_state_txt(global->p2p));
12904		if (os_snprintf_error(end - pos, ret))
12905			return pos - buf;
12906		pos += ret;
12907	} else if (global->p2p) {
12908		ret = os_snprintf(pos, end - pos, "p2p_state=DISABLED\n");
12909		if (os_snprintf_error(end - pos, ret))
12910			return pos - buf;
12911		pos += ret;
12912	}
12913#endif /* CONFIG_P2P */
12914
12915#ifdef CONFIG_WIFI_DISPLAY
12916	ret = os_snprintf(pos, end - pos, "wifi_display=%d\n",
12917			  !!global->wifi_display);
12918	if (os_snprintf_error(end - pos, ret))
12919		return pos - buf;
12920	pos += ret;
12921#endif /* CONFIG_WIFI_DISPLAY */
12922
12923	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
12924		ret = os_snprintf(pos, end - pos, "ifname=%s\n"
12925				  "address=" MACSTR "\n",
12926				  wpa_s->ifname, MAC2STR(wpa_s->own_addr));
12927		if (os_snprintf_error(end - pos, ret))
12928			return pos - buf;
12929		pos += ret;
12930	}
12931
12932	return pos - buf;
12933}
12934
12935
12936#ifdef CONFIG_FST
12937
12938static int wpas_global_ctrl_iface_fst_attach(struct wpa_global *global,
12939					     char *cmd, char *buf,
12940					     size_t reply_size)
12941{
12942	char ifname[IFNAMSIZ + 1];
12943	struct fst_iface_cfg cfg;
12944	struct wpa_supplicant *wpa_s;
12945	struct fst_wpa_obj iface_obj;
12946
12947	if (!fst_parse_attach_command(cmd, ifname, sizeof(ifname), &cfg)) {
12948		wpa_s = wpa_supplicant_get_iface(global, ifname);
12949		if (wpa_s) {
12950			if (wpa_s->fst) {
12951				wpa_printf(MSG_INFO, "FST: Already attached");
12952				return -1;
12953			}
12954			fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
12955			wpa_s->fst = fst_attach(ifname, wpa_s->own_addr,
12956						&iface_obj, &cfg);
12957			if (wpa_s->fst)
12958				return os_snprintf(buf, reply_size, "OK\n");
12959		}
12960	}
12961
12962	return -1;
12963}
12964
12965
12966static int wpas_global_ctrl_iface_fst_detach(struct wpa_global *global,
12967					     char *cmd, char *buf,
12968					     size_t reply_size)
12969{
12970	char ifname[IFNAMSIZ + 1];
12971	struct wpa_supplicant *wpa_s;
12972
12973	if (!fst_parse_detach_command(cmd, ifname, sizeof(ifname))) {
12974		wpa_s = wpa_supplicant_get_iface(global, ifname);
12975		if (wpa_s) {
12976			if (!fst_iface_detach(ifname)) {
12977				wpa_s->fst = NULL;
12978				return os_snprintf(buf, reply_size, "OK\n");
12979			}
12980		}
12981	}
12982
12983	return -1;
12984}
12985
12986#endif /* CONFIG_FST */
12987
12988
12989char * wpa_supplicant_global_ctrl_iface_process(struct wpa_global *global,
12990						char *buf, size_t *resp_len)
12991{
12992	char *reply;
12993	const int reply_size = 2048;
12994	int reply_len;
12995	int level = MSG_DEBUG;
12996
12997	if (os_strncmp(buf, "IFNAME=", 7) == 0) {
12998		char *pos = os_strchr(buf + 7, ' ');
12999		if (pos) {
13000			*pos++ = '\0';
13001			return wpas_global_ctrl_iface_ifname(global,
13002							     buf + 7, pos,
13003							     resp_len);
13004		}
13005	}
13006
13007	reply = wpas_global_ctrl_iface_redir(global, buf, resp_len);
13008	if (reply)
13009		return reply;
13010
13011	if (os_strcmp(buf, "PING") == 0)
13012		level = MSG_EXCESSIVE;
13013	wpa_hexdump_ascii(level, "RX global ctrl_iface",
13014			  (const u8 *) buf, os_strlen(buf));
13015
13016	reply = os_malloc(reply_size);
13017	if (reply == NULL) {
13018		*resp_len = 1;
13019		return NULL;
13020	}
13021
13022	os_memcpy(reply, "OK\n", 3);
13023	reply_len = 3;
13024
13025	if (os_strcmp(buf, "PING") == 0) {
13026		os_memcpy(reply, "PONG\n", 5);
13027		reply_len = 5;
13028	} else if (os_strncmp(buf, "INTERFACE_ADD ", 14) == 0) {
13029		if (wpa_supplicant_global_iface_add(global, buf + 14))
13030			reply_len = -1;
13031	} else if (os_strncmp(buf, "INTERFACE_REMOVE ", 17) == 0) {
13032		if (wpa_supplicant_global_iface_remove(global, buf + 17))
13033			reply_len = -1;
13034	} else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
13035		reply_len = wpa_supplicant_global_iface_list(
13036			global, reply, reply_size);
13037	} else if (os_strncmp(buf, "INTERFACES", 10) == 0) {
13038		reply_len = wpa_supplicant_global_iface_interfaces(
13039			global, buf + 10, reply, reply_size);
13040#ifdef CONFIG_FST
13041	} else if (os_strncmp(buf, "FST-ATTACH ", 11) == 0) {
13042		reply_len = wpas_global_ctrl_iface_fst_attach(global, buf + 11,
13043							      reply,
13044							      reply_size);
13045	} else if (os_strncmp(buf, "FST-DETACH ", 11) == 0) {
13046		reply_len = wpas_global_ctrl_iface_fst_detach(global, buf + 11,
13047							      reply,
13048							      reply_size);
13049	} else if (os_strncmp(buf, "FST-MANAGER ", 12) == 0) {
13050		reply_len = fst_ctrl_iface_receive(buf + 12, reply, reply_size);
13051#endif /* CONFIG_FST */
13052	} else if (os_strcmp(buf, "TERMINATE") == 0) {
13053		wpa_supplicant_terminate_proc(global);
13054	} else if (os_strcmp(buf, "SUSPEND") == 0) {
13055		wpas_notify_suspend(global);
13056	} else if (os_strcmp(buf, "RESUME") == 0) {
13057		wpas_notify_resume(global);
13058	} else if (os_strncmp(buf, "SET ", 4) == 0) {
13059		if (wpas_global_ctrl_iface_set(global, buf + 4)) {
13060#ifdef CONFIG_P2P
13061			if (global->p2p_init_wpa_s) {
13062				os_free(reply);
13063				/* Check if P2P redirection would work for this
13064				 * command. */
13065				return wpa_supplicant_ctrl_iface_process(
13066					global->p2p_init_wpa_s,
13067					buf, resp_len);
13068			}
13069#endif /* CONFIG_P2P */
13070			reply_len = -1;
13071		}
13072	} else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
13073		if (wpas_global_ctrl_iface_dup_network(global, buf + 12))
13074			reply_len = -1;
13075#ifndef CONFIG_NO_CONFIG_WRITE
13076	} else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
13077		if (wpas_global_ctrl_iface_save_config(global))
13078			reply_len = -1;
13079#endif /* CONFIG_NO_CONFIG_WRITE */
13080	} else if (os_strcmp(buf, "STATUS") == 0) {
13081		reply_len = wpas_global_ctrl_iface_status(global, reply,
13082							  reply_size);
13083#ifdef CONFIG_MODULE_TESTS
13084	} else if (os_strcmp(buf, "MODULE_TESTS") == 0) {
13085		if (wpas_module_tests() < 0)
13086			reply_len = -1;
13087#endif /* CONFIG_MODULE_TESTS */
13088	} else if (os_strncmp(buf, "RELOG", 5) == 0) {
13089		if (wpa_debug_reopen_file() < 0)
13090			reply_len = -1;
13091	} else {
13092		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
13093		reply_len = 16;
13094	}
13095
13096	if (reply_len < 0) {
13097		os_memcpy(reply, "FAIL\n", 5);
13098		reply_len = 5;
13099	}
13100
13101	*resp_len = reply_len;
13102	return reply;
13103}
13104