1 /*
2 * Driver interaction with Linux nl80211/cfg80211 - Scanning
3 * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
5 * Copyright (c) 2009-2010, Atheros Communications
6 *
7 * This software may be distributed under the terms of the BSD license.
8 * See README for more details.
9 */
10
11 #include "includes.h"
12 #include <netlink/genl/genl.h>
13
14 #include "utils/common.h"
15 #include "utils/eloop.h"
16 #include "common/ieee802_11_defs.h"
17 #include "driver_nl80211.h"
18
19
get_noise_for_scan_results(struct nl_msg * msg,void * arg)20 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
21 {
22 struct nlattr *tb[NL80211_ATTR_MAX + 1];
23 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
24 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
25 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
26 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
27 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
28 };
29 struct wpa_scan_results *scan_results = arg;
30 struct wpa_scan_res *scan_res;
31 size_t i;
32
33 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
34 genlmsg_attrlen(gnlh, 0), NULL);
35
36 if (!tb[NL80211_ATTR_SURVEY_INFO]) {
37 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
38 return NL_SKIP;
39 }
40
41 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
42 tb[NL80211_ATTR_SURVEY_INFO],
43 survey_policy)) {
44 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
45 "attributes");
46 return NL_SKIP;
47 }
48
49 if (!sinfo[NL80211_SURVEY_INFO_NOISE])
50 return NL_SKIP;
51
52 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
53 return NL_SKIP;
54
55 for (i = 0; i < scan_results->num; ++i) {
56 scan_res = scan_results->res[i];
57 if (!scan_res)
58 continue;
59 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
60 scan_res->freq)
61 continue;
62 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
63 continue;
64 scan_res->noise = (s8)
65 nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
66 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
67 }
68
69 return NL_SKIP;
70 }
71
72
nl80211_get_noise_for_scan_results(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * scan_res)73 static int nl80211_get_noise_for_scan_results(
74 struct wpa_driver_nl80211_data *drv,
75 struct wpa_scan_results *scan_res)
76 {
77 struct nl_msg *msg;
78
79 msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
80 return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
81 scan_res);
82 }
83
84
85 /**
86 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
87 * @eloop_ctx: Driver private data
88 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
89 *
90 * This function can be used as registered timeout when starting a scan to
91 * generate a scan completed event if the driver does not report this.
92 */
wpa_driver_nl80211_scan_timeout(void * eloop_ctx,void * timeout_ctx)93 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
94 {
95 struct wpa_driver_nl80211_data *drv = eloop_ctx;
96 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
97 wpa_driver_nl80211_set_mode(drv->first_bss,
98 drv->ap_scan_as_station);
99 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
100 }
101 wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
102 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
103 }
104
105
106 static struct nl_msg *
nl80211_scan_common(struct i802_bss * bss,u8 cmd,struct wpa_driver_scan_params * params)107 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
108 struct wpa_driver_scan_params *params)
109 {
110 struct wpa_driver_nl80211_data *drv = bss->drv;
111 struct nl_msg *msg;
112 size_t i;
113 u32 scan_flags = 0;
114
115 msg = nl80211_cmd_msg(bss, 0, cmd);
116 if (!msg)
117 return NULL;
118
119 if (params->num_ssids) {
120 struct nlattr *ssids;
121
122 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
123 if (ssids == NULL)
124 goto fail;
125 for (i = 0; i < params->num_ssids; i++) {
126 wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
127 params->ssids[i].ssid,
128 params->ssids[i].ssid_len);
129 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
130 params->ssids[i].ssid))
131 goto fail;
132 }
133 nla_nest_end(msg, ssids);
134 }
135
136 if (params->extra_ies) {
137 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
138 params->extra_ies, params->extra_ies_len);
139 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
140 params->extra_ies))
141 goto fail;
142 }
143
144 if (params->freqs) {
145 struct nlattr *freqs;
146 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
147 if (freqs == NULL)
148 goto fail;
149 for (i = 0; params->freqs[i]; i++) {
150 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
151 "MHz", params->freqs[i]);
152 if (nla_put_u32(msg, i + 1, params->freqs[i]))
153 goto fail;
154 }
155 nla_nest_end(msg, freqs);
156 }
157
158 os_free(drv->filter_ssids);
159 drv->filter_ssids = params->filter_ssids;
160 params->filter_ssids = NULL;
161 drv->num_filter_ssids = params->num_filter_ssids;
162
163 if (params->only_new_results) {
164 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
165 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
166 }
167
168 if (params->low_priority && drv->have_low_prio_scan) {
169 wpa_printf(MSG_DEBUG,
170 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
171 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
172 }
173
174 if (params->mac_addr_rand) {
175 wpa_printf(MSG_DEBUG,
176 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
177 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
178
179 if (params->mac_addr) {
180 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
181 MAC2STR(params->mac_addr));
182 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
183 params->mac_addr))
184 goto fail;
185 }
186
187 if (params->mac_addr_mask) {
188 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
189 MACSTR, MAC2STR(params->mac_addr_mask));
190 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
191 params->mac_addr_mask))
192 goto fail;
193 }
194 }
195
196 if (scan_flags &&
197 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
198 goto fail;
199
200 return msg;
201
202 fail:
203 nlmsg_free(msg);
204 return NULL;
205 }
206
207
208 /**
209 * wpa_driver_nl80211_scan - Request the driver to initiate scan
210 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
211 * @params: Scan parameters
212 * Returns: 0 on success, -1 on failure
213 */
wpa_driver_nl80211_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)214 int wpa_driver_nl80211_scan(struct i802_bss *bss,
215 struct wpa_driver_scan_params *params)
216 {
217 struct wpa_driver_nl80211_data *drv = bss->drv;
218 int ret = -1, timeout;
219 struct nl_msg *msg = NULL;
220
221 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
222 drv->scan_for_auth = 0;
223
224 if (TEST_FAIL())
225 return -1;
226
227 msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
228 if (!msg)
229 return -1;
230
231 if (params->p2p_probe) {
232 struct nlattr *rates;
233
234 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
235
236 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
237 if (rates == NULL)
238 goto fail;
239
240 /*
241 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
242 * by masking out everything else apart from the OFDM rates 6,
243 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
244 * rates are left enabled.
245 */
246 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
247 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
248 goto fail;
249 nla_nest_end(msg, rates);
250
251 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
252 goto fail;
253 }
254
255 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
256 msg = NULL;
257 if (ret) {
258 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
259 "(%s)", ret, strerror(-ret));
260 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
261 enum nl80211_iftype old_mode = drv->nlmode;
262
263 /*
264 * mac80211 does not allow scan requests in AP mode, so
265 * try to do this in station mode.
266 */
267 if (wpa_driver_nl80211_set_mode(
268 bss, NL80211_IFTYPE_STATION))
269 goto fail;
270
271 if (wpa_driver_nl80211_scan(bss, params)) {
272 wpa_driver_nl80211_set_mode(bss, old_mode);
273 goto fail;
274 }
275
276 /* Restore AP mode when processing scan results */
277 drv->ap_scan_as_station = old_mode;
278 ret = 0;
279 } else
280 goto fail;
281 }
282
283 drv->scan_state = SCAN_REQUESTED;
284 /* Not all drivers generate "scan completed" wireless event, so try to
285 * read results after a timeout. */
286 timeout = 10;
287 if (drv->scan_complete_events) {
288 /*
289 * The driver seems to deliver events to notify when scan is
290 * complete, so use longer timeout to avoid race conditions
291 * with scanning and following association request.
292 */
293 timeout = 30;
294 }
295 wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
296 "seconds", ret, timeout);
297 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
298 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
299 drv, drv->ctx);
300
301 fail:
302 nlmsg_free(msg);
303 return ret;
304 }
305
306
307 /**
308 * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
309 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
310 * @params: Scan parameters
311 * @interval: Interval between scan cycles in milliseconds
312 * Returns: 0 on success, -1 on failure or if not supported
313 */
wpa_driver_nl80211_sched_scan(void * priv,struct wpa_driver_scan_params * params,u32 interval)314 int wpa_driver_nl80211_sched_scan(void *priv,
315 struct wpa_driver_scan_params *params,
316 u32 interval)
317 {
318 struct i802_bss *bss = priv;
319 struct wpa_driver_nl80211_data *drv = bss->drv;
320 int ret = -1;
321 struct nl_msg *msg;
322 size_t i;
323
324 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
325
326 #ifdef ANDROID
327 if (!drv->capa.sched_scan_supported)
328 return android_pno_start(bss, params);
329 #endif /* ANDROID */
330
331 msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
332 if (!msg ||
333 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval))
334 goto fail;
335
336 if ((drv->num_filter_ssids &&
337 (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
338 params->filter_rssi) {
339 struct nlattr *match_sets;
340 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
341 if (match_sets == NULL)
342 goto fail;
343
344 for (i = 0; i < drv->num_filter_ssids; i++) {
345 struct nlattr *match_set_ssid;
346 wpa_hexdump_ascii(MSG_MSGDUMP,
347 "nl80211: Sched scan filter SSID",
348 drv->filter_ssids[i].ssid,
349 drv->filter_ssids[i].ssid_len);
350
351 match_set_ssid = nla_nest_start(msg, i + 1);
352 if (match_set_ssid == NULL ||
353 nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
354 drv->filter_ssids[i].ssid_len,
355 drv->filter_ssids[i].ssid) ||
356 (params->filter_rssi &&
357 nla_put_u32(msg,
358 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
359 params->filter_rssi)))
360 goto fail;
361
362 nla_nest_end(msg, match_set_ssid);
363 }
364
365 /*
366 * Due to backward compatibility code, newer kernels treat this
367 * matchset (with only an RSSI filter) as the default for all
368 * other matchsets, unless it's the only one, in which case the
369 * matchset will actually allow all SSIDs above the RSSI.
370 */
371 if (params->filter_rssi) {
372 struct nlattr *match_set_rssi;
373 match_set_rssi = nla_nest_start(msg, 0);
374 if (match_set_rssi == NULL ||
375 nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
376 params->filter_rssi))
377 goto fail;
378 wpa_printf(MSG_MSGDUMP,
379 "nl80211: Sched scan RSSI filter %d dBm",
380 params->filter_rssi);
381 nla_nest_end(msg, match_set_rssi);
382 }
383
384 nla_nest_end(msg, match_sets);
385 }
386
387 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
388
389 /* TODO: if we get an error here, we should fall back to normal scan */
390
391 msg = NULL;
392 if (ret) {
393 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
394 "ret=%d (%s)", ret, strerror(-ret));
395 goto fail;
396 }
397
398 wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
399 "scan interval %d msec", ret, interval);
400
401 fail:
402 nlmsg_free(msg);
403 return ret;
404 }
405
406
407 /**
408 * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
409 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
410 * Returns: 0 on success, -1 on failure or if not supported
411 */
wpa_driver_nl80211_stop_sched_scan(void * priv)412 int wpa_driver_nl80211_stop_sched_scan(void *priv)
413 {
414 struct i802_bss *bss = priv;
415 struct wpa_driver_nl80211_data *drv = bss->drv;
416 int ret;
417 struct nl_msg *msg;
418
419 #ifdef ANDROID
420 if (!drv->capa.sched_scan_supported)
421 return android_pno_stop(bss);
422 #endif /* ANDROID */
423
424 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
425 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
426 if (ret) {
427 wpa_printf(MSG_DEBUG,
428 "nl80211: Sched scan stop failed: ret=%d (%s)",
429 ret, strerror(-ret));
430 } else {
431 wpa_printf(MSG_DEBUG,
432 "nl80211: Sched scan stop sent");
433 }
434
435 return ret;
436 }
437
438
nl80211_get_ie(const u8 * ies,size_t ies_len,u8 ie)439 const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
440 {
441 const u8 *end, *pos;
442
443 if (ies == NULL)
444 return NULL;
445
446 pos = ies;
447 end = ies + ies_len;
448
449 while (pos + 1 < end) {
450 if (pos + 2 + pos[1] > end)
451 break;
452 if (pos[0] == ie)
453 return pos;
454 pos += 2 + pos[1];
455 }
456
457 return NULL;
458 }
459
460
nl80211_scan_filtered(struct wpa_driver_nl80211_data * drv,const u8 * ie,size_t ie_len)461 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
462 const u8 *ie, size_t ie_len)
463 {
464 const u8 *ssid;
465 size_t i;
466
467 if (drv->filter_ssids == NULL)
468 return 0;
469
470 ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
471 if (ssid == NULL)
472 return 1;
473
474 for (i = 0; i < drv->num_filter_ssids; i++) {
475 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
476 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
477 0)
478 return 0;
479 }
480
481 return 1;
482 }
483
484
bss_info_handler(struct nl_msg * msg,void * arg)485 int bss_info_handler(struct nl_msg *msg, void *arg)
486 {
487 struct nlattr *tb[NL80211_ATTR_MAX + 1];
488 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
489 struct nlattr *bss[NL80211_BSS_MAX + 1];
490 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
491 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
492 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
493 [NL80211_BSS_TSF] = { .type = NLA_U64 },
494 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
495 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
496 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
497 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
498 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
499 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
500 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
501 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
502 };
503 struct nl80211_bss_info_arg *_arg = arg;
504 struct wpa_scan_results *res = _arg->res;
505 struct wpa_scan_res **tmp;
506 struct wpa_scan_res *r;
507 const u8 *ie, *beacon_ie;
508 size_t ie_len, beacon_ie_len;
509 u8 *pos;
510 size_t i;
511
512 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
513 genlmsg_attrlen(gnlh, 0), NULL);
514 if (!tb[NL80211_ATTR_BSS])
515 return NL_SKIP;
516 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
517 bss_policy))
518 return NL_SKIP;
519 if (bss[NL80211_BSS_STATUS]) {
520 enum nl80211_bss_status status;
521 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
522 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
523 bss[NL80211_BSS_FREQUENCY]) {
524 _arg->assoc_freq =
525 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
526 wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
527 _arg->assoc_freq);
528 }
529 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
530 bss[NL80211_BSS_FREQUENCY]) {
531 _arg->ibss_freq =
532 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
533 wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
534 _arg->ibss_freq);
535 }
536 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
537 bss[NL80211_BSS_BSSID]) {
538 os_memcpy(_arg->assoc_bssid,
539 nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
540 wpa_printf(MSG_DEBUG, "nl80211: Associated with "
541 MACSTR, MAC2STR(_arg->assoc_bssid));
542 }
543 }
544 if (!res)
545 return NL_SKIP;
546 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
547 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
548 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
549 } else {
550 ie = NULL;
551 ie_len = 0;
552 }
553 if (bss[NL80211_BSS_BEACON_IES]) {
554 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
555 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
556 } else {
557 beacon_ie = NULL;
558 beacon_ie_len = 0;
559 }
560
561 if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
562 ie ? ie_len : beacon_ie_len))
563 return NL_SKIP;
564
565 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
566 if (r == NULL)
567 return NL_SKIP;
568 if (bss[NL80211_BSS_BSSID])
569 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
570 ETH_ALEN);
571 if (bss[NL80211_BSS_FREQUENCY])
572 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
573 if (bss[NL80211_BSS_BEACON_INTERVAL])
574 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
575 if (bss[NL80211_BSS_CAPABILITY])
576 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
577 r->flags |= WPA_SCAN_NOISE_INVALID;
578 if (bss[NL80211_BSS_SIGNAL_MBM]) {
579 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
580 r->level /= 100; /* mBm to dBm */
581 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
582 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
583 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
584 r->flags |= WPA_SCAN_QUAL_INVALID;
585 } else
586 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
587 if (bss[NL80211_BSS_TSF])
588 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
589 if (bss[NL80211_BSS_BEACON_TSF]) {
590 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
591 if (tsf > r->tsf)
592 r->tsf = tsf;
593 }
594 if (bss[NL80211_BSS_SEEN_MS_AGO])
595 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
596 r->ie_len = ie_len;
597 pos = (u8 *) (r + 1);
598 if (ie) {
599 os_memcpy(pos, ie, ie_len);
600 pos += ie_len;
601 }
602 r->beacon_ie_len = beacon_ie_len;
603 if (beacon_ie)
604 os_memcpy(pos, beacon_ie, beacon_ie_len);
605
606 if (bss[NL80211_BSS_STATUS]) {
607 enum nl80211_bss_status status;
608 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
609 switch (status) {
610 case NL80211_BSS_STATUS_ASSOCIATED:
611 r->flags |= WPA_SCAN_ASSOCIATED;
612 break;
613 default:
614 break;
615 }
616 }
617
618 /*
619 * cfg80211 maintains separate BSS table entries for APs if the same
620 * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
621 * not use frequency as a separate key in the BSS table, so filter out
622 * duplicated entries. Prefer associated BSS entry in such a case in
623 * order to get the correct frequency into the BSS table. Similarly,
624 * prefer newer entries over older.
625 */
626 for (i = 0; i < res->num; i++) {
627 const u8 *s1, *s2;
628 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
629 continue;
630
631 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
632 res->res[i]->ie_len, WLAN_EID_SSID);
633 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
634 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
635 os_memcmp(s1, s2, 2 + s1[1]) != 0)
636 continue;
637
638 /* Same BSSID,SSID was already included in scan results */
639 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
640 "for " MACSTR, MAC2STR(r->bssid));
641
642 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
643 !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
644 r->age < res->res[i]->age) {
645 os_free(res->res[i]);
646 res->res[i] = r;
647 } else
648 os_free(r);
649 return NL_SKIP;
650 }
651
652 tmp = os_realloc_array(res->res, res->num + 1,
653 sizeof(struct wpa_scan_res *));
654 if (tmp == NULL) {
655 os_free(r);
656 return NL_SKIP;
657 }
658 tmp[res->num++] = r;
659 res->res = tmp;
660
661 return NL_SKIP;
662 }
663
664
clear_state_mismatch(struct wpa_driver_nl80211_data * drv,const u8 * addr)665 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
666 const u8 *addr)
667 {
668 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
669 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
670 "mismatch (" MACSTR ")", MAC2STR(addr));
671 wpa_driver_nl80211_mlme(drv, addr,
672 NL80211_CMD_DEAUTHENTICATE,
673 WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
674 }
675 }
676
677
wpa_driver_nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * res)678 static void wpa_driver_nl80211_check_bss_status(
679 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
680 {
681 size_t i;
682
683 for (i = 0; i < res->num; i++) {
684 struct wpa_scan_res *r = res->res[i];
685
686 if (r->flags & WPA_SCAN_ASSOCIATED) {
687 wpa_printf(MSG_DEBUG, "nl80211: Scan results "
688 "indicate BSS status with " MACSTR
689 " as associated",
690 MAC2STR(r->bssid));
691 if (is_sta_interface(drv->nlmode) &&
692 !drv->associated) {
693 wpa_printf(MSG_DEBUG, "nl80211: Local state "
694 "(not associated) does not match "
695 "with BSS state");
696 clear_state_mismatch(drv, r->bssid);
697 } else if (is_sta_interface(drv->nlmode) &&
698 os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
699 0) {
700 wpa_printf(MSG_DEBUG, "nl80211: Local state "
701 "(associated with " MACSTR ") does "
702 "not match with BSS state",
703 MAC2STR(drv->bssid));
704 clear_state_mismatch(drv, r->bssid);
705 clear_state_mismatch(drv, drv->bssid);
706 }
707 }
708 }
709 }
710
711
712 static struct wpa_scan_results *
nl80211_get_scan_results(struct wpa_driver_nl80211_data * drv)713 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
714 {
715 struct nl_msg *msg;
716 struct wpa_scan_results *res;
717 int ret;
718 struct nl80211_bss_info_arg arg;
719
720 res = os_zalloc(sizeof(*res));
721 if (res == NULL)
722 return NULL;
723 if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
724 NL80211_CMD_GET_SCAN))) {
725 wpa_scan_results_free(res);
726 return NULL;
727 }
728
729 arg.drv = drv;
730 arg.res = res;
731 ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
732 if (ret == 0) {
733 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
734 "BSSes)", (unsigned long) res->num);
735 nl80211_get_noise_for_scan_results(drv, res);
736 return res;
737 }
738 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
739 "(%s)", ret, strerror(-ret));
740 wpa_scan_results_free(res);
741 return NULL;
742 }
743
744
745 /**
746 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
747 * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
748 * Returns: Scan results on success, -1 on failure
749 */
wpa_driver_nl80211_get_scan_results(void * priv)750 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
751 {
752 struct i802_bss *bss = priv;
753 struct wpa_driver_nl80211_data *drv = bss->drv;
754 struct wpa_scan_results *res;
755
756 res = nl80211_get_scan_results(drv);
757 if (res)
758 wpa_driver_nl80211_check_bss_status(drv, res);
759 return res;
760 }
761
762
nl80211_dump_scan(struct wpa_driver_nl80211_data * drv)763 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
764 {
765 struct wpa_scan_results *res;
766 size_t i;
767
768 res = nl80211_get_scan_results(drv);
769 if (res == NULL) {
770 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
771 return;
772 }
773
774 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
775 for (i = 0; i < res->num; i++) {
776 struct wpa_scan_res *r = res->res[i];
777 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s",
778 (int) i, (int) res->num, MAC2STR(r->bssid),
779 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
780 }
781
782 wpa_scan_results_free(res);
783 }
784