contrib/wpa/hostapd/ctrl_iface.c

   1 /*
   2  * hostapd / UNIX domain socket -based control interface
   3  * Copyright (c) 2004-2018, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #ifndef CONFIG_NATIVE_WINDOWS
  12
  13 #ifdef CONFIG_TESTING_OPTIONS
  14 #include <net/ethernet.h>
  15 #include <netinet/ip.h>
  16 #endif /* CONFIG_TESTING_OPTIONS */
  17
  18 #include <sys/un.h>
  19 #include <sys/stat.h>
  20 #include <stddef.h>
  21
  22 #ifdef CONFIG_CTRL_IFACE_UDP
  23 #include <netdb.h>
  24 #endif /* CONFIG_CTRL_IFACE_UDP */
  25
  26 #include "utils/common.h"
  27 #include "utils/eloop.h"
  28 #include "utils/module_tests.h"
  29 #include "common/version.h"
  30 #include "common/ieee802_11_defs.h"
  31 #include "common/ctrl_iface_common.h"
  32 #ifdef CONFIG_DPP
  33 #include "common/dpp.h"
  34 #endif /* CONFIG_DPP */
  35 #include "common/wpa_ctrl.h"
  36 #include "crypto/tls.h"
  37 #include "drivers/driver.h"
  38 #include "eapol_auth/eapol_auth_sm.h"
  39 #include "radius/radius_client.h"
  40 #include "radius/radius_server.h"
  41 #include "l2_packet/l2_packet.h"
  42 #include "ap/hostapd.h"
  43 #include "ap/ap_config.h"
  44 #include "ap/ieee802_1x.h"
  45 #include "ap/wpa_auth.h"
  46 #include "ap/ieee802_11.h"
  47 #include "ap/sta_info.h"
  48 #include "ap/wps_hostapd.h"
  49 #include "ap/ctrl_iface_ap.h"
  50 #include "ap/ap_drv_ops.h"
  51 #include "ap/hs20.h"
  52 #include "ap/wnm_ap.h"
  53 #include "ap/wpa_auth.h"
  54 #include "ap/beacon.h"
  55 #include "ap/neighbor_db.h"
  56 #include "ap/rrm.h"
  57 #include "ap/dpp_hostapd.h"
  58 #include "wps/wps_defs.h"
  59 #include "wps/wps.h"
  60 #include "fst/fst_ctrl_iface.h"
  61 #include "config_file.h"
  62 #include "ctrl_iface.h"
  63
  64
  65 #define HOSTAPD_CLI_DUP_VALUE_MAX_LEN 256
  66
  67 #ifdef CONFIG_CTRL_IFACE_UDP
  68 #define COOKIE_LEN 8
  69 static unsigned char cookie[COOKIE_LEN];
  70 static unsigned char gcookie[COOKIE_LEN];
  71 #define HOSTAPD_CTRL_IFACE_PORT         8877
  72 #define HOSTAPD_CTRL_IFACE_PORT_LIMIT   50
  73 #define HOSTAPD_GLOBAL_CTRL_IFACE_PORT          8878
  74 #define HOSTAPD_GLOBAL_CTRL_IFACE_PORT_LIMIT    50
  75 #endif /* CONFIG_CTRL_IFACE_UDP */
  76
  77 static void hostapd_ctrl_iface_send(struct hostapd_data *hapd, int level,
  78                                     enum wpa_msg_type type,
  79                                     const char *buf, size_t len);
  80
  81
  82 static int hostapd_ctrl_iface_attach(struct hostapd_data *hapd,
  83                                      struct sockaddr_storage *from,
  84                                      socklen_t fromlen, const char *input)
  85 {
  86         return ctrl_iface_attach(&hapd->ctrl_dst, from, fromlen, input);
  87 }
  88
  89
  90 static int hostapd_ctrl_iface_detach(struct hostapd_data *hapd,
  91                                      struct sockaddr_storage *from,
  92                                      socklen_t fromlen)
  93 {
  94         return ctrl_iface_detach(&hapd->ctrl_dst, from, fromlen);
  95 }
  96
  97
  98 static int hostapd_ctrl_iface_level(struct hostapd_data *hapd,
  99                                     struct sockaddr_storage *from,
 100                                     socklen_t fromlen,
 101                                     char *level)
 102 {
 103         return ctrl_iface_level(&hapd->ctrl_dst, from, fromlen, level);
 104 }
 105
 106
 107 static int hostapd_ctrl_iface_new_sta(struct hostapd_data *hapd,
 108                                       const char *txtaddr)
 109 {
 110         u8 addr[ETH_ALEN];
 111         struct sta_info *sta;
 112
 113         wpa_printf(MSG_DEBUG, "CTRL_IFACE NEW_STA %s", txtaddr);
 114
 115         if (hwaddr_aton(txtaddr, addr))
 116                 return -1;
 117
 118         sta = ap_get_sta(hapd, addr);
 119         if (sta)
 120                 return 0;
 121
 122         wpa_printf(MSG_DEBUG, "Add new STA " MACSTR " based on ctrl_iface "
 123                    "notification", MAC2STR(addr));
 124         sta = ap_sta_add(hapd, addr);
 125         if (sta == NULL)
 126                 return -1;
 127
 128         hostapd_new_assoc_sta(hapd, sta, 0);
 129         return 0;
 130 }
 131
 132
 133 #ifdef CONFIG_IEEE80211W
 134 #ifdef NEED_AP_MLME
 135 static int hostapd_ctrl_iface_sa_query(struct hostapd_data *hapd,
 136                                        const char *txtaddr)
 137 {
 138         u8 addr[ETH_ALEN];
 139         u8 trans_id[WLAN_SA_QUERY_TR_ID_LEN];
 140
 141         wpa_printf(MSG_DEBUG, "CTRL_IFACE SA_QUERY %s", txtaddr);
 142
 143         if (hwaddr_aton(txtaddr, addr) ||
 144             os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0)
 145                 return -1;
 146
 147         ieee802_11_send_sa_query_req(hapd, addr, trans_id);
 148
 149         return 0;
 150 }
 151 #endif /* NEED_AP_MLME */
 152 #endif /* CONFIG_IEEE80211W */
 153
 154
 155 #ifdef CONFIG_WPS
 156 static int hostapd_ctrl_iface_wps_pin(struct hostapd_data *hapd, char *txt)
 157 {
 158         char *pin = os_strchr(txt, ' ');
 159         char *timeout_txt;
 160         int timeout;
 161         u8 addr_buf[ETH_ALEN], *addr = NULL;
 162         char *pos;
 163
 164         if (pin == NULL)
 165                 return -1;
 166         *pin++ = '\0';
 167
 168         timeout_txt = os_strchr(pin, ' ');
 169         if (timeout_txt) {
 170                 *timeout_txt++ = '\0';
 171                 timeout = atoi(timeout_txt);
 172                 pos = os_strchr(timeout_txt, ' ');
 173                 if (pos) {
 174                         *pos++ = '\0';
 175                         if (hwaddr_aton(pos, addr_buf) == 0)
 176                                 addr = addr_buf;
 177                 }
 178         } else
 179                 timeout = 0;
 180
 181         return hostapd_wps_add_pin(hapd, addr, txt, pin, timeout);
 182 }
 183
 184
 185 static int hostapd_ctrl_iface_wps_check_pin(
 186         struct hostapd_data *hapd, char *cmd, char *buf, size_t buflen)
 187 {
 188         char pin[9];
 189         size_t len;
 190         char *pos;
 191         int ret;
 192
 193         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS_CHECK_PIN",
 194                               (u8 *) cmd, os_strlen(cmd));
 195         for (pos = cmd, len = 0; *pos != '\0'; pos++) {
 196                 if (*pos < '0' || *pos > '9')
 197                         continue;
 198                 pin[len++] = *pos;
 199                 if (len == 9) {
 200                         wpa_printf(MSG_DEBUG, "WPS: Too long PIN");
 201                         return -1;
 202                 }
 203         }
 204         if (len != 4 && len != 8) {
 205                 wpa_printf(MSG_DEBUG, "WPS: Invalid PIN length %d", (int) len);
 206                 return -1;
 207         }
 208         pin[len] = '\0';
 209
 210         if (len == 8) {
 211                 unsigned int pin_val;
 212                 pin_val = atoi(pin);
 213                 if (!wps_pin_valid(pin_val)) {
 214                         wpa_printf(MSG_DEBUG, "WPS: Invalid checksum digit");
 215                         ret = os_snprintf(buf, buflen, "FAIL-CHECKSUM\n");
 216                         if (os_snprintf_error(buflen, ret))
 217                                 return -1;
 218                         return ret;
 219                 }
 220         }
 221
 222         ret = os_snprintf(buf, buflen, "%s", pin);
 223         if (os_snprintf_error(buflen, ret))
 224                 return -1;
 225
 226         return ret;
 227 }
 228
 229
 230 #ifdef CONFIG_WPS_NFC
 231 static int hostapd_ctrl_iface_wps_nfc_tag_read(struct hostapd_data *hapd,
 232                                                char *pos)
 233 {
 234         size_t len;
 235         struct wpabuf *buf;
 236         int ret;
 237
 238         len = os_strlen(pos);
 239         if (len & 0x01)
 240                 return -1;
 241         len /= 2;
 242
 243         buf = wpabuf_alloc(len);
 244         if (buf == NULL)
 245                 return -1;
 246         if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
 247                 wpabuf_free(buf);
 248                 return -1;
 249         }
 250
 251         ret = hostapd_wps_nfc_tag_read(hapd, buf);
 252         wpabuf_free(buf);
 253
 254         return ret;
 255 }
 256
 257
 258 static int hostapd_ctrl_iface_wps_nfc_config_token(struct hostapd_data *hapd,
 259                                                    char *cmd, char *reply,
 260                                                    size_t max_len)
 261 {
 262         int ndef;
 263         struct wpabuf *buf;
 264         int res;
 265
 266         if (os_strcmp(cmd, "WPS") == 0)
 267                 ndef = 0;
 268         else if (os_strcmp(cmd, "NDEF") == 0)
 269                 ndef = 1;
 270         else
 271                 return -1;
 272
 273         buf = hostapd_wps_nfc_config_token(hapd, ndef);
 274         if (buf == NULL)
 275                 return -1;
 276
 277         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
 278                                          wpabuf_len(buf));
 279         reply[res++] = '\n';
 280         reply[res] = '\0';
 281
 282         wpabuf_free(buf);
 283
 284         return res;
 285 }
 286
 287
 288 static int hostapd_ctrl_iface_wps_nfc_token_gen(struct hostapd_data *hapd,
 289                                                 char *reply, size_t max_len,
 290                                                 int ndef)
 291 {
 292         struct wpabuf *buf;
 293         int res;
 294
 295         buf = hostapd_wps_nfc_token_gen(hapd, ndef);
 296         if (buf == NULL)
 297                 return -1;
 298
 299         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
 300                                          wpabuf_len(buf));
 301         reply[res++] = '\n';
 302         reply[res] = '\0';
 303
 304         wpabuf_free(buf);
 305
 306         return res;
 307 }
 308
 309
 310 static int hostapd_ctrl_iface_wps_nfc_token(struct hostapd_data *hapd,
 311                                             char *cmd, char *reply,
 312                                             size_t max_len)
 313 {
 314         if (os_strcmp(cmd, "WPS") == 0)
 315                 return hostapd_ctrl_iface_wps_nfc_token_gen(hapd, reply,
 316                                                             max_len, 0);
 317
 318         if (os_strcmp(cmd, "NDEF") == 0)
 319                 return hostapd_ctrl_iface_wps_nfc_token_gen(hapd, reply,
 320                                                             max_len, 1);
 321
 322         if (os_strcmp(cmd, "enable") == 0)
 323                 return hostapd_wps_nfc_token_enable(hapd);
 324
 325         if (os_strcmp(cmd, "disable") == 0) {
 326                 hostapd_wps_nfc_token_disable(hapd);
 327                 return 0;
 328         }
 329
 330         return -1;
 331 }
 332
 333
 334 static int hostapd_ctrl_iface_nfc_get_handover_sel(struct hostapd_data *hapd,
 335                                                    char *cmd, char *reply,
 336                                                    size_t max_len)
 337 {
 338         struct wpabuf *buf;
 339         int res;
 340         char *pos;
 341         int ndef;
 342
 343         pos = os_strchr(cmd, ' ');
 344         if (pos == NULL)
 345                 return -1;
 346         *pos++ = '\0';
 347
 348         if (os_strcmp(cmd, "WPS") == 0)
 349                 ndef = 0;
 350         else if (os_strcmp(cmd, "NDEF") == 0)
 351                 ndef = 1;
 352         else
 353                 return -1;
 354
 355         if (os_strcmp(pos, "WPS-CR") == 0)
 356                 buf = hostapd_wps_nfc_hs_cr(hapd, ndef);
 357         else
 358                 buf = NULL;
 359         if (buf == NULL)
 360                 return -1;
 361
 362         res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
 363                                          wpabuf_len(buf));
 364         reply[res++] = '\n';
 365         reply[res] = '\0';
 366
 367         wpabuf_free(buf);
 368
 369         return res;
 370 }
 371
 372
 373 static int hostapd_ctrl_iface_nfc_report_handover(struct hostapd_data *hapd,
 374                                                   char *cmd)
 375 {
 376         size_t len;
 377         struct wpabuf *req, *sel;
 378         int ret;
 379         char *pos, *role, *type, *pos2;
 380
 381         role = cmd;
 382         pos = os_strchr(role, ' ');
 383         if (pos == NULL)
 384                 return -1;
 385         *pos++ = '\0';
 386
 387         type = pos;
 388         pos = os_strchr(type, ' ');
 389         if (pos == NULL)
 390                 return -1;
 391         *pos++ = '\0';
 392
 393         pos2 = os_strchr(pos, ' ');
 394         if (pos2 == NULL)
 395                 return -1;
 396         *pos2++ = '\0';
 397
 398         len = os_strlen(pos);
 399         if (len & 0x01)
 400                 return -1;
 401         len /= 2;
 402
 403         req = wpabuf_alloc(len);
 404         if (req == NULL)
 405                 return -1;
 406         if (hexstr2bin(pos, wpabuf_put(req, len), len) < 0) {
 407                 wpabuf_free(req);
 408                 return -1;
 409         }
 410
 411         len = os_strlen(pos2);
 412         if (len & 0x01) {
 413                 wpabuf_free(req);
 414                 return -1;
 415         }
 416         len /= 2;
 417
 418         sel = wpabuf_alloc(len);
 419         if (sel == NULL) {
 420                 wpabuf_free(req);
 421                 return -1;
 422         }
 423         if (hexstr2bin(pos2, wpabuf_put(sel, len), len) < 0) {
 424                 wpabuf_free(req);
 425                 wpabuf_free(sel);
 426                 return -1;
 427         }
 428
 429         if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "WPS") == 0) {
 430                 ret = hostapd_wps_nfc_report_handover(hapd, req, sel);
 431         } else {
 432                 wpa_printf(MSG_DEBUG, "NFC: Unsupported connection handover "
 433                            "reported: role=%s type=%s", role, type);
 434                 ret = -1;
 435         }
 436         wpabuf_free(req);
 437         wpabuf_free(sel);
 438
 439         return ret;
 440 }
 441
 442 #endif /* CONFIG_WPS_NFC */
 443
 444
 445 static int hostapd_ctrl_iface_wps_ap_pin(struct hostapd_data *hapd, char *txt,
 446                                          char *buf, size_t buflen)
 447 {
 448         int timeout = 300;
 449         char *pos;
 450         const char *pin_txt;
 451
 452         pos = os_strchr(txt, ' ');
 453         if (pos)
 454                 *pos++ = '\0';
 455
 456         if (os_strcmp(txt, "disable") == 0) {
 457                 hostapd_wps_ap_pin_disable(hapd);
 458                 return os_snprintf(buf, buflen, "OK\n");
 459         }
 460
 461         if (os_strcmp(txt, "random") == 0) {
 462                 if (pos)
 463                         timeout = atoi(pos);
 464                 pin_txt = hostapd_wps_ap_pin_random(hapd, timeout);
 465                 if (pin_txt == NULL)
 466                         return -1;
 467                 return os_snprintf(buf, buflen, "%s", pin_txt);
 468         }
 469
 470         if (os_strcmp(txt, "get") == 0) {
 471                 pin_txt = hostapd_wps_ap_pin_get(hapd);
 472                 if (pin_txt == NULL)
 473                         return -1;
 474                 return os_snprintf(buf, buflen, "%s", pin_txt);
 475         }
 476
 477         if (os_strcmp(txt, "set") == 0) {
 478                 char *pin;
 479                 if (pos == NULL)
 480                         return -1;
 481                 pin = pos;
 482                 pos = os_strchr(pos, ' ');
 483                 if (pos) {
 484                         *pos++ = '\0';
 485                         timeout = atoi(pos);
 486                 }
 487                 if (os_strlen(pin) > buflen)
 488                         return -1;
 489                 if (hostapd_wps_ap_pin_set(hapd, pin, timeout) < 0)
 490                         return -1;
 491                 return os_snprintf(buf, buflen, "%s", pin);
 492         }
 493
 494         return -1;
 495 }
 496
 497
 498 static int hostapd_ctrl_iface_wps_config(struct hostapd_data *hapd, char *txt)
 499 {
 500         char *pos;
 501         char *ssid, *auth, *encr = NULL, *key = NULL;
 502
 503         ssid = txt;
 504         pos = os_strchr(txt, ' ');
 505         if (!pos)
 506                 return -1;
 507         *pos++ = '\0';
 508
 509         auth = pos;
 510         pos = os_strchr(pos, ' ');
 511         if (pos) {
 512                 *pos++ = '\0';
 513                 encr = pos;
 514                 pos = os_strchr(pos, ' ');
 515                 if (pos) {
 516                         *pos++ = '\0';
 517                         key = pos;
 518                 }
 519         }
 520
 521         return hostapd_wps_config_ap(hapd, ssid, auth, encr, key);
 522 }
 523
 524
 525 static const char * pbc_status_str(enum pbc_status status)
 526 {
 527         switch (status) {
 528         case WPS_PBC_STATUS_DISABLE:
 529                 return "Disabled";
 530         case WPS_PBC_STATUS_ACTIVE:
 531                 return "Active";
 532         case WPS_PBC_STATUS_TIMEOUT:
 533                 return "Timed-out";
 534         case WPS_PBC_STATUS_OVERLAP:
 535                 return "Overlap";
 536         default:
 537                 return "Unknown";
 538         }
 539 }
 540
 541
 542 static int hostapd_ctrl_iface_wps_get_status(struct hostapd_data *hapd,
 543                                              char *buf, size_t buflen)
 544 {
 545         int ret;
 546         char *pos, *end;
 547
 548         pos = buf;
 549         end = buf + buflen;
 550
 551         ret = os_snprintf(pos, end - pos, "PBC Status: %s\n",
 552                           pbc_status_str(hapd->wps_stats.pbc_status));
 553
 554         if (os_snprintf_error(end - pos, ret))
 555                 return pos - buf;
 556         pos += ret;
 557
 558         ret = os_snprintf(pos, end - pos, "Last WPS result: %s\n",
 559                           (hapd->wps_stats.status == WPS_STATUS_SUCCESS ?
 560                            "Success":
 561                            (hapd->wps_stats.status == WPS_STATUS_FAILURE ?
 562                             "Failed" : "None")));
 563
 564         if (os_snprintf_error(end - pos, ret))
 565                 return pos - buf;
 566         pos += ret;
 567
 568         /* If status == Failure - Add possible Reasons */
 569         if(hapd->wps_stats.status == WPS_STATUS_FAILURE &&
 570            hapd->wps_stats.failure_reason > 0) {
 571                 ret = os_snprintf(pos, end - pos,
 572                                   "Failure Reason: %s\n",
 573                                   wps_ei_str(hapd->wps_stats.failure_reason));
 574
 575                 if (os_snprintf_error(end - pos, ret))
 576                         return pos - buf;
 577                 pos += ret;
 578         }
 579
 580         if (hapd->wps_stats.status) {
 581                 ret = os_snprintf(pos, end - pos, "Peer Address: " MACSTR "\n",
 582                                   MAC2STR(hapd->wps_stats.peer_addr));
 583
 584                 if (os_snprintf_error(end - pos, ret))
 585                         return pos - buf;
 586                 pos += ret;
 587         }
 588
 589         return pos - buf;
 590 }
 591
 592 #endif /* CONFIG_WPS */
 593
 594 #ifdef CONFIG_HS20
 595
 596 static int hostapd_ctrl_iface_hs20_wnm_notif(struct hostapd_data *hapd,
 597                                              const char *cmd)
 598 {
 599         u8 addr[ETH_ALEN];
 600         const char *url;
 601
 602         if (hwaddr_aton(cmd, addr))
 603                 return -1;
 604         url = cmd + 17;
 605         if (*url == '\0') {
 606                 url = NULL;
 607         } else {
 608                 if (*url != ' ')
 609                         return -1;
 610                 url++;
 611                 if (*url == '\0')
 612                         url = NULL;
 613         }
 614
 615         return hs20_send_wnm_notification(hapd, addr, 1, url);
 616 }
 617
 618
 619 static int hostapd_ctrl_iface_hs20_deauth_req(struct hostapd_data *hapd,
 620                                               const char *cmd)
 621 {
 622         u8 addr[ETH_ALEN];
 623         int code, reauth_delay, ret;
 624         const char *pos;
 625         size_t url_len;
 626         struct wpabuf *req;
 627
 628         /* <STA MAC Addr> <Code(0/1)> <Re-auth-Delay(sec)> [URL] */
 629         if (hwaddr_aton(cmd, addr))
 630                 return -1;
 631
 632         pos = os_strchr(cmd, ' ');
 633         if (pos == NULL)
 634                 return -1;
 635         pos++;
 636         code = atoi(pos);
 637
 638         pos = os_strchr(pos, ' ');
 639         if (pos == NULL)
 640                 return -1;
 641         pos++;
 642         reauth_delay = atoi(pos);
 643
 644         url_len = 0;
 645         pos = os_strchr(pos, ' ');
 646         if (pos) {
 647                 pos++;
 648                 url_len = os_strlen(pos);
 649         }
 650
 651         req = wpabuf_alloc(4 + url_len);
 652         if (req == NULL)
 653                 return -1;
 654         wpabuf_put_u8(req, code);
 655         wpabuf_put_le16(req, reauth_delay);
 656         wpabuf_put_u8(req, url_len);
 657         if (pos)
 658                 wpabuf_put_data(req, pos, url_len);
 659
 660         wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to " MACSTR
 661                    " to indicate imminent deauthentication (code=%d "
 662                    "reauth_delay=%d)", MAC2STR(addr), code, reauth_delay);
 663         ret = hs20_send_wnm_notification_deauth_req(hapd, addr, req);
 664         wpabuf_free(req);
 665         return ret;
 666 }
 667
 668 #endif /* CONFIG_HS20 */
 669
 670
 671 #ifdef CONFIG_INTERWORKING
 672
 673 static int hostapd_ctrl_iface_set_qos_map_set(struct hostapd_data *hapd,
 674                                               const char *cmd)
 675 {
 676         u8 qos_map_set[16 + 2 * 21], count = 0;
 677         const char *pos = cmd;
 678         int val, ret;
 679
 680         for (;;) {
 681                 if (count == sizeof(qos_map_set)) {
 682                         wpa_printf(MSG_ERROR, "Too many qos_map_set parameters");
 683                         return -1;
 684                 }
 685
 686                 val = atoi(pos);
 687                 if (val < 0 || val > 255) {
 688                         wpa_printf(MSG_INFO, "Invalid QoS Map Set");
 689                         return -1;
 690                 }
 691
 692                 qos_map_set[count++] = val;
 693                 pos = os_strchr(pos, ',');
 694                 if (!pos)
 695                         break;
 696                 pos++;
 697         }
 698
 699         if (count < 16 || count & 1) {
 700                 wpa_printf(MSG_INFO, "Invalid QoS Map Set");
 701                 return -1;
 702         }
 703
 704         ret = hostapd_drv_set_qos_map(hapd, qos_map_set, count);
 705         if (ret) {
 706                 wpa_printf(MSG_INFO, "Failed to set QoS Map Set");
 707                 return -1;
 708         }
 709
 710         os_memcpy(hapd->conf->qos_map_set, qos_map_set, count);
 711         hapd->conf->qos_map_set_len = count;
 712
 713         return 0;
 714 }
 715
 716
 717 static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
 718                                                 const char *cmd)
 719 {
 720         u8 addr[ETH_ALEN];
 721         struct sta_info *sta;
 722         struct wpabuf *buf;
 723         u8 *qos_map_set = hapd->conf->qos_map_set;
 724         u8 qos_map_set_len = hapd->conf->qos_map_set_len;
 725         int ret;
 726
 727         if (!qos_map_set_len) {
 728                 wpa_printf(MSG_INFO, "QoS Map Set is not set");
 729                 return -1;
 730         }
 731
 732         if (hwaddr_aton(cmd, addr))
 733                 return -1;
 734
 735         sta = ap_get_sta(hapd, addr);
 736         if (sta == NULL) {
 737                 wpa_printf(MSG_DEBUG, "Station " MACSTR " not found "
 738                            "for QoS Map Configuration message",
 739                            MAC2STR(addr));
 740                 return -1;
 741         }
 742
 743         if (!sta->qos_map_enabled) {
 744                 wpa_printf(MSG_DEBUG, "Station " MACSTR " did not indicate "
 745                            "support for QoS Map", MAC2STR(addr));
 746                 return -1;
 747         }
 748
 749         buf = wpabuf_alloc(2 + 2 + qos_map_set_len);
 750         if (buf == NULL)
 751                 return -1;
 752
 753         wpabuf_put_u8(buf, WLAN_ACTION_QOS);
 754         wpabuf_put_u8(buf, QOS_QOS_MAP_CONFIG);
 755
 756         /* QoS Map Set Element */
 757         wpabuf_put_u8(buf, WLAN_EID_QOS_MAP_SET);
 758         wpabuf_put_u8(buf, qos_map_set_len);
 759         wpabuf_put_data(buf, qos_map_set, qos_map_set_len);
 760
 761         ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr,
 762                                       wpabuf_head(buf), wpabuf_len(buf));
 763         wpabuf_free(buf);
 764
 765         return ret;
 766 }
 767
 768 #endif /* CONFIG_INTERWORKING */
 769
 770
 771 #ifdef CONFIG_WNM_AP
 772
 773 static int hostapd_ctrl_iface_disassoc_imminent(struct hostapd_data *hapd,
 774                                                 const char *cmd)
 775 {
 776         u8 addr[ETH_ALEN];
 777         int disassoc_timer;
 778         struct sta_info *sta;
 779
 780         if (hwaddr_aton(cmd, addr))
 781                 return -1;
 782         if (cmd[17] != ' ')
 783                 return -1;
 784         disassoc_timer = atoi(cmd + 17);
 785
 786         sta = ap_get_sta(hapd, addr);
 787         if (sta == NULL) {
 788                 wpa_printf(MSG_DEBUG, "Station " MACSTR
 789                            " not found for disassociation imminent message",
 790                            MAC2STR(addr));
 791                 return -1;
 792         }
 793
 794         return wnm_send_disassoc_imminent(hapd, sta, disassoc_timer);
 795 }
 796
 797
 798 static int hostapd_ctrl_iface_ess_disassoc(struct hostapd_data *hapd,
 799                                            const char *cmd)
 800 {
 801         u8 addr[ETH_ALEN];
 802         const char *url, *timerstr;
 803         int disassoc_timer;
 804         struct sta_info *sta;
 805
 806         if (hwaddr_aton(cmd, addr))
 807                 return -1;
 808
 809         sta = ap_get_sta(hapd, addr);
 810         if (sta == NULL) {
 811                 wpa_printf(MSG_DEBUG, "Station " MACSTR
 812                            " not found for ESS disassociation imminent message",
 813                            MAC2STR(addr));
 814                 return -1;
 815         }
 816
 817         timerstr = cmd + 17;
 818         if (*timerstr != ' ')
 819                 return -1;
 820         timerstr++;
 821         disassoc_timer = atoi(timerstr);
 822         if (disassoc_timer < 0 || disassoc_timer > 65535)
 823                 return -1;
 824
 825         url = os_strchr(timerstr, ' ');
 826         if (url == NULL)
 827                 return -1;
 828         url++;
 829
 830         return wnm_send_ess_disassoc_imminent(hapd, sta, url, disassoc_timer);
 831 }
 832
 833
 834 static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
 835                                          const char *cmd)
 836 {
 837         u8 addr[ETH_ALEN];
 838         const char *pos, *end;
 839         int disassoc_timer = 0;
 840         struct sta_info *sta;
 841         u8 req_mode = 0, valid_int = 0x01;
 842         u8 bss_term_dur[12];
 843         char *url = NULL;
 844         int ret;
 845         u8 nei_rep[1000];
 846         int nei_len;
 847         u8 mbo[10];
 848         size_t mbo_len = 0;
 849
 850         if (hwaddr_aton(cmd, addr)) {
 851                 wpa_printf(MSG_DEBUG, "Invalid STA MAC address");
 852                 return -1;
 853         }
 854
 855         sta = ap_get_sta(hapd, addr);
 856         if (sta == NULL) {
 857                 wpa_printf(MSG_DEBUG, "Station " MACSTR
 858                            " not found for BSS TM Request message",
 859                            MAC2STR(addr));
 860                 return -1;
 861         }
 862
 863         pos = os_strstr(cmd, " disassoc_timer=");
 864         if (pos) {
 865                 pos += 16;
 866                 disassoc_timer = atoi(pos);
 867                 if (disassoc_timer < 0 || disassoc_timer > 65535) {
 868                         wpa_printf(MSG_DEBUG, "Invalid disassoc_timer");
 869                         return -1;
 870                 }
 871         }
 872
 873         pos = os_strstr(cmd, " valid_int=");
 874         if (pos) {
 875                 pos += 11;
 876                 valid_int = atoi(pos);
 877         }
 878
 879         pos = os_strstr(cmd, " bss_term=");
 880         if (pos) {
 881                 pos += 10;
 882                 req_mode |= WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED;
 883                 /* TODO: TSF configurable/learnable */
 884                 bss_term_dur[0] = 4; /* Subelement ID */
 885                 bss_term_dur[1] = 10; /* Length */
 886                 os_memset(bss_term_dur, 2, 8);
 887                 end = os_strchr(pos, ',');
 888                 if (end == NULL) {
 889                         wpa_printf(MSG_DEBUG, "Invalid bss_term data");
 890                         return -1;
 891                 }
 892                 end++;
 893                 WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
 894         }
 895
 896         nei_len = ieee802_11_parse_candidate_list(cmd, nei_rep,
 897                                                   sizeof(nei_rep));
 898         if (nei_len < 0)
 899                 return -1;
 900
 901         pos = os_strstr(cmd, " url=");
 902         if (pos) {
 903                 size_t len;
 904                 pos += 5;
 905                 end = os_strchr(pos, ' ');
 906                 if (end)
 907                         len = end - pos;
 908                 else
 909                         len = os_strlen(pos);
 910                 url = os_malloc(len + 1);
 911                 if (url == NULL)
 912                         return -1;
 913                 os_memcpy(url, pos, len);
 914                 url[len] = '\0';
 915                 req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
 916         }
 917
 918         if (os_strstr(cmd, " pref=1"))
 919                 req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
 920         if (os_strstr(cmd, " abridged=1"))
 921                 req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
 922         if (os_strstr(cmd, " disassoc_imminent=1"))
 923                 req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
 924
 925 #ifdef CONFIG_MBO
 926         pos = os_strstr(cmd, "mbo=");
 927         if (pos) {
 928                 unsigned int mbo_reason, cell_pref, reassoc_delay;
 929                 u8 *mbo_pos = mbo;
 930
 931                 ret = sscanf(pos, "mbo=%u:%u:%u", &mbo_reason,
 932                              &reassoc_delay, &cell_pref);
 933                 if (ret != 3) {
 934                         wpa_printf(MSG_DEBUG,
 935                                    "MBO requires three arguments: mbo=<reason>:<reassoc_delay>:<cell_pref>");
 936                         ret = -1;
 937                         goto fail;
 938                 }
 939
 940                 if (mbo_reason > MBO_TRANSITION_REASON_PREMIUM_AP) {
 941                         wpa_printf(MSG_DEBUG,
 942                                    "Invalid MBO transition reason code %u",
 943                                    mbo_reason);
 944                         ret = -1;
 945                         goto fail;
 946                 }
 947
 948                 /* Valid values for Cellular preference are: 0, 1, 255 */
 949                 if (cell_pref != 0 && cell_pref != 1 && cell_pref != 255) {
 950                         wpa_printf(MSG_DEBUG,
 951                                    "Invalid MBO cellular capability %u",
 952                                    cell_pref);
 953                         ret = -1;
 954                         goto fail;
 955                 }
 956
 957                 if (reassoc_delay > 65535 ||
 958                     (reassoc_delay &&
 959                      !(req_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT))) {
 960                         wpa_printf(MSG_DEBUG,
 961                                    "MBO: Assoc retry delay is only valid in disassoc imminent mode");
 962                         ret = -1;
 963                         goto fail;
 964                 }
 965
 966                 *mbo_pos++ = MBO_ATTR_ID_TRANSITION_REASON;
 967                 *mbo_pos++ = 1;
 968                 *mbo_pos++ = mbo_reason;
 969                 *mbo_pos++ = MBO_ATTR_ID_CELL_DATA_PREF;
 970                 *mbo_pos++ = 1;
 971                 *mbo_pos++ = cell_pref;
 972
 973                 if (reassoc_delay) {
 974                         *mbo_pos++ = MBO_ATTR_ID_ASSOC_RETRY_DELAY;
 975                         *mbo_pos++ = 2;
 976                         WPA_PUT_LE16(mbo_pos, reassoc_delay);
 977                         mbo_pos += 2;
 978                 }
 979
 980                 mbo_len = mbo_pos - mbo;
 981         }
 982 #endif /* CONFIG_MBO */
 983
 984         ret = wnm_send_bss_tm_req(hapd, sta, req_mode, disassoc_timer,
 985                                   valid_int, bss_term_dur, url,
 986                                   nei_len ? nei_rep : NULL, nei_len,
 987                                   mbo_len ? mbo : NULL, mbo_len);
 988 #ifdef CONFIG_MBO
 989 fail:
 990 #endif /* CONFIG_MBO */
 991         os_free(url);
 992         return ret;
 993 }
 994
 995
 996 static int hostapd_ctrl_iface_coloc_intf_req(struct hostapd_data *hapd,
 997                                              const char *cmd)
 998 {
 999         u8 addr[ETH_ALEN];
1000         struct sta_info *sta;
1001         const char *pos;
1002         unsigned int auto_report, timeout;
1003
1004         if (hwaddr_aton(cmd, addr)) {
1005                 wpa_printf(MSG_DEBUG, "Invalid STA MAC address");
1006                 return -1;
1007         }
1008
1009         sta = ap_get_sta(hapd, addr);
1010         if (!sta) {
1011                 wpa_printf(MSG_DEBUG, "Station " MACSTR
1012                            " not found for Collocated Interference Request",
1013                            MAC2STR(addr));
1014                 return -1;
1015         }
1016
1017         pos = cmd + 17;
1018         if (*pos != ' ')
1019                 return -1;
1020         pos++;
1021         auto_report = atoi(pos);
1022         pos = os_strchr(pos, ' ');
1023         if (!pos)
1024                 return -1;
1025         pos++;
1026         timeout = atoi(pos);
1027
1028         return wnm_send_coloc_intf_req(hapd, sta, auto_report, timeout);
1029 }
1030
1031 #endif /* CONFIG_WNM_AP */
1032
1033
1034 static int hostapd_ctrl_iface_get_key_mgmt(struct hostapd_data *hapd,
1035                                            char *buf, size_t buflen)
1036 {
1037         int ret = 0;
1038         char *pos, *end;
1039
1040         pos = buf;
1041         end = buf + buflen;
1042
1043         WPA_ASSERT(hapd->conf->wpa_key_mgmt);
1044
1045         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
1046                 ret = os_snprintf(pos, end - pos, "WPA-PSK ");
1047                 if (os_snprintf_error(end - pos, ret))
1048                         return pos - buf;
1049                 pos += ret;
1050         }
1051         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
1052                 ret = os_snprintf(pos, end - pos, "WPA-EAP ");
1053                 if (os_snprintf_error(end - pos, ret))
1054                         return pos - buf;
1055                 pos += ret;
1056         }
1057 #ifdef CONFIG_IEEE80211R_AP
1058         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) {
1059                 ret = os_snprintf(pos, end - pos, "FT-PSK ");
1060                 if (os_snprintf_error(end - pos, ret))
1061                         return pos - buf;
1062                 pos += ret;
1063         }
1064         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
1065                 ret = os_snprintf(pos, end - pos, "FT-EAP ");
1066                 if (os_snprintf_error(end - pos, ret))
1067                         return pos - buf;
1068                 pos += ret;
1069         }
1070 #ifdef CONFIG_SHA384
1071         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384) {
1072                 ret = os_snprintf(pos, end - pos, "FT-EAP-SHA384 ");
1073                 if (os_snprintf_error(end - pos, ret))
1074                         return pos - buf;
1075                 pos += ret;
1076         }
1077 #endif /* CONFIG_SHA384 */
1078 #ifdef CONFIG_SAE
1079         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE) {
1080                 ret = os_snprintf(pos, end - pos, "FT-SAE ");
1081                 if (os_snprintf_error(end - pos, ret))
1082                         return pos - buf;
1083                 pos += ret;
1084         }
1085 #endif /* CONFIG_SAE */
1086 #ifdef CONFIG_FILS
1087         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) {
1088                 ret = os_snprintf(pos, end - pos, "FT-FILS-SHA256 ");
1089                 if (os_snprintf_error(end - pos, ret))
1090                         return pos - buf;
1091                 pos += ret;
1092         }
1093         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) {
1094                 ret = os_snprintf(pos, end - pos, "FT-FILS-SHA384 ");
1095                 if (os_snprintf_error(end - pos, ret))
1096                         return pos - buf;
1097                 pos += ret;
1098         }
1099 #endif /* CONFIG_FILS */
1100 #endif /* CONFIG_IEEE80211R_AP */
1101 #ifdef CONFIG_IEEE80211W
1102         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
1103                 ret = os_snprintf(pos, end - pos, "WPA-PSK-SHA256 ");
1104                 if (os_snprintf_error(end - pos, ret))
1105                         return pos - buf;
1106                 pos += ret;
1107         }
1108         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1109                 ret = os_snprintf(pos, end - pos, "WPA-EAP-SHA256 ");
1110                 if (os_snprintf_error(end - pos, ret))
1111                         return pos - buf;
1112                 pos += ret;
1113         }
1114 #endif /* CONFIG_IEEE80211W */
1115 #ifdef CONFIG_SAE
1116         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_SAE) {
1117                 ret = os_snprintf(pos, end - pos, "SAE ");
1118                 if (os_snprintf_error(end - pos, ret))
1119                         return pos - buf;
1120                 pos += ret;
1121         }
1122 #endif /* CONFIG_SAE */
1123         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1124                 ret = os_snprintf(pos, end - pos, "WPA-EAP-SUITE-B ");
1125                 if (os_snprintf_error(end - pos, ret))
1126                         return pos - buf;
1127                 pos += ret;
1128         }
1129         if (hapd->conf->wpa_key_mgmt &
1130             WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1131                 ret = os_snprintf(pos, end - pos,
1132                                   "WPA-EAP-SUITE-B-192 ");
1133                 if (os_snprintf_error(end - pos, ret))
1134                         return pos - buf;
1135                 pos += ret;
1136         }
1137 #ifdef CONFIG_FILS
1138         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FILS_SHA256) {
1139                 ret = os_snprintf(pos, end - pos, "FILS-SHA256 ");
1140                 if (os_snprintf_error(end - pos, ret))
1141                         return pos - buf;
1142                 pos += ret;
1143         }
1144         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FILS_SHA384) {
1145                 ret = os_snprintf(pos, end - pos, "FILS-SHA384 ");
1146                 if (os_snprintf_error(end - pos, ret))
1147                         return pos - buf;
1148                 pos += ret;
1149         }
1150 #endif /* CONFIG_FILS */
1151
1152 #ifdef CONFIG_OWE
1153         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) {
1154                 ret = os_snprintf(pos, end - pos, "OWE ");
1155                 if (os_snprintf_error(end - pos, ret))
1156                         return pos - buf;
1157                 pos += ret;
1158         }
1159 #endif /* CONFIG_OWE */
1160
1161 #ifdef CONFIG_DPP
1162         if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_DPP) {
1163                 ret = os_snprintf(pos, end - pos, "DPP ");
1164                 if (os_snprintf_error(end - pos, ret))
1165                         return pos - buf;
1166                 pos += ret;
1167         }
1168 #endif /* CONFIG_DPP */
1169
1170         if (pos > buf && *(pos - 1) == ' ') {
1171                 *(pos - 1) = '\0';
1172                 pos--;
1173         }
1174
1175         return pos - buf;
1176 }
1177
1178
1179 static int hostapd_ctrl_iface_get_config(struct hostapd_data *hapd,
1180                                          char *buf, size_t buflen)
1181 {
1182         int ret;
1183         char *pos, *end;
1184
1185         pos = buf;
1186         end = buf + buflen;
1187
1188         ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n"
1189                           "ssid=%s\n",
1190                           MAC2STR(hapd->own_addr),
1191                           wpa_ssid_txt(hapd->conf->ssid.ssid,
1192                                        hapd->conf->ssid.ssid_len));
1193         if (os_snprintf_error(end - pos, ret))
1194                 return pos - buf;
1195         pos += ret;
1196
1197 #ifdef CONFIG_WPS
1198         ret = os_snprintf(pos, end - pos, "wps_state=%s\n",
1199                           hapd->conf->wps_state == 0 ? "disabled" :
1200                           (hapd->conf->wps_state == 1 ? "not configured" :
1201                            "configured"));
1202         if (os_snprintf_error(end - pos, ret))
1203                 return pos - buf;
1204         pos += ret;
1205
1206         if (hapd->conf->wps_state && hapd->conf->wpa &&
1207             hapd->conf->ssid.wpa_passphrase) {
1208                 ret = os_snprintf(pos, end - pos, "passphrase=%s\n",
1209                                   hapd->conf->ssid.wpa_passphrase);
1210                 if (os_snprintf_error(end - pos, ret))
1211                         return pos - buf;
1212                 pos += ret;
1213         }
1214
1215         if (hapd->conf->wps_state && hapd->conf->wpa &&
1216             hapd->conf->ssid.wpa_psk &&
1217             hapd->conf->ssid.wpa_psk->group) {
1218                 char hex[PMK_LEN * 2 + 1];
1219                 wpa_snprintf_hex(hex, sizeof(hex),
1220                                  hapd->conf->ssid.wpa_psk->psk, PMK_LEN);
1221                 ret = os_snprintf(pos, end - pos, "psk=%s\n", hex);
1222                 if (os_snprintf_error(end - pos, ret))
1223                         return pos - buf;
1224                 pos += ret;
1225         }
1226 #endif /* CONFIG_WPS */
1227
1228         if (hapd->conf->wpa) {
1229                 ret = os_snprintf(pos, end - pos, "wpa=%d\n", hapd->conf->wpa);
1230                 if (os_snprintf_error(end - pos, ret))
1231                         return pos - buf;
1232                 pos += ret;
1233         }
1234
1235         if (hapd->conf->wpa && hapd->conf->wpa_key_mgmt) {
1236                 ret = os_snprintf(pos, end - pos, "key_mgmt=");
1237                 if (os_snprintf_error(end - pos, ret))
1238                         return pos - buf;
1239                 pos += ret;
1240
1241                 pos += hostapd_ctrl_iface_get_key_mgmt(hapd, pos, end - pos);
1242
1243                 ret = os_snprintf(pos, end - pos, "\n");
1244                 if (os_snprintf_error(end - pos, ret))
1245                         return pos - buf;
1246                 pos += ret;
1247         }
1248
1249         if (hapd->conf->wpa) {
1250                 ret = os_snprintf(pos, end - pos, "group_cipher=%s\n",
1251                                   wpa_cipher_txt(hapd->conf->wpa_group));
1252                 if (os_snprintf_error(end - pos, ret))
1253                         return pos - buf;
1254                 pos += ret;
1255         }
1256
1257         if ((hapd->conf->wpa & WPA_PROTO_RSN) && hapd->conf->rsn_pairwise) {
1258                 ret = os_snprintf(pos, end - pos, "rsn_pairwise_cipher=");
1259                 if (os_snprintf_error(end - pos, ret))
1260                         return pos - buf;
1261                 pos += ret;
1262
1263                 ret = wpa_write_ciphers(pos, end, hapd->conf->rsn_pairwise,
1264                                         " ");
1265                 if (ret < 0)
1266                         return pos - buf;
1267                 pos += ret;
1268
1269                 ret = os_snprintf(pos, end - pos, "\n");
1270                 if (os_snprintf_error(end - pos, ret))
1271                         return pos - buf;
1272                 pos += ret;
1273         }
1274
1275         if ((hapd->conf->wpa & WPA_PROTO_WPA) && hapd->conf->wpa_pairwise) {
1276                 ret = os_snprintf(pos, end - pos, "wpa_pairwise_cipher=");
1277                 if (os_snprintf_error(end - pos, ret))
1278                         return pos - buf;
1279                 pos += ret;
1280
1281                 ret = wpa_write_ciphers(pos, end, hapd->conf->wpa_pairwise,
1282                                         " ");
1283                 if (ret < 0)
1284                         return pos - buf;
1285                 pos += ret;
1286
1287                 ret = os_snprintf(pos, end - pos, "\n");
1288                 if (os_snprintf_error(end - pos, ret))
1289                         return pos - buf;
1290                 pos += ret;
1291         }
1292
1293         return pos - buf;
1294 }
1295
1296
1297 static void hostapd_disassoc_accept_mac(struct hostapd_data *hapd)
1298 {
1299         struct sta_info *sta;
1300         struct vlan_description vlan_id;
1301
1302         if (hapd->conf->macaddr_acl != DENY_UNLESS_ACCEPTED)
1303                 return;
1304
1305         for (sta = hapd->sta_list; sta; sta = sta->next) {
1306                 if (!hostapd_maclist_found(hapd->conf->accept_mac,
1307                                            hapd->conf->num_accept_mac,
1308                                            sta->addr, &vlan_id) ||
1309                     (vlan_id.notempty &&
1310                      vlan_compare(&vlan_id, sta->vlan_desc)))
1311                         ap_sta_disconnect(hapd, sta, sta->addr,
1312                                           WLAN_REASON_UNSPECIFIED);
1313         }
1314 }
1315
1316
1317 static void hostapd_disassoc_deny_mac(struct hostapd_data *hapd)
1318 {
1319         struct sta_info *sta;
1320         struct vlan_description vlan_id;
1321
1322         for (sta = hapd->sta_list; sta; sta = sta->next) {
1323                 if (hostapd_maclist_found(hapd->conf->deny_mac,
1324                                           hapd->conf->num_deny_mac, sta->addr,
1325                                           &vlan_id) &&
1326                     (!vlan_id.notempty ||
1327                      !vlan_compare(&vlan_id, sta->vlan_desc)))
1328                         ap_sta_disconnect(hapd, sta, sta->addr,
1329                                           WLAN_REASON_UNSPECIFIED);
1330         }
1331 }
1332
1333 static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
1334 {
1335         char *value;
1336         int ret = 0;
1337
1338         value = os_strchr(cmd, ' ');
1339         if (value == NULL)
1340                 return -1;
1341         *value++ = '\0';
1342
1343         wpa_printf(MSG_DEBUG, "CTRL_IFACE SET '%s'='%s'", cmd, value);
1344         if (0) {
1345 #ifdef CONFIG_WPS_TESTING
1346         } else if (os_strcasecmp(cmd, "wps_version_number") == 0) {
1347                 long int val;
1348                 val = strtol(value, NULL, 0);
1349                 if (val < 0 || val > 0xff) {
1350                         ret = -1;
1351                         wpa_printf(MSG_DEBUG, "WPS: Invalid "
1352                                    "wps_version_number %ld", val);
1353                 } else {
1354                         wps_version_number = val;
1355                         wpa_printf(MSG_DEBUG, "WPS: Testing - force WPS "
1356                                    "version %u.%u",
1357                                    (wps_version_number & 0xf0) >> 4,
1358                                    wps_version_number & 0x0f);
1359                         hostapd_wps_update_ie(hapd);
1360                 }
1361         } else if (os_strcasecmp(cmd, "wps_testing_dummy_cred") == 0) {
1362                 wps_testing_dummy_cred = atoi(value);
1363                 wpa_printf(MSG_DEBUG, "WPS: Testing - dummy_cred=%d",
1364                            wps_testing_dummy_cred);
1365         } else if (os_strcasecmp(cmd, "wps_corrupt_pkhash") == 0) {
1366                 wps_corrupt_pkhash = atoi(value);
1367                 wpa_printf(MSG_DEBUG, "WPS: Testing - wps_corrupt_pkhash=%d",
1368                            wps_corrupt_pkhash);
1369 #endif /* CONFIG_WPS_TESTING */
1370 #ifdef CONFIG_TESTING_OPTIONS
1371         } else if (os_strcasecmp(cmd, "ext_mgmt_frame_handling") == 0) {
1372                 hapd->ext_mgmt_frame_handling = atoi(value);
1373         } else if (os_strcasecmp(cmd, "ext_eapol_frame_io") == 0) {
1374                 hapd->ext_eapol_frame_io = atoi(value);
1375 #ifdef CONFIG_DPP
1376         } else if (os_strcasecmp(cmd, "dpp_config_obj_override") == 0) {
1377                 os_free(hapd->dpp_config_obj_override);
1378                 hapd->dpp_config_obj_override = os_strdup(value);
1379         } else if (os_strcasecmp(cmd, "dpp_discovery_override") == 0) {
1380                 os_free(hapd->dpp_discovery_override);
1381                 hapd->dpp_discovery_override = os_strdup(value);
1382         } else if (os_strcasecmp(cmd, "dpp_groups_override") == 0) {
1383                 os_free(hapd->dpp_groups_override);
1384                 hapd->dpp_groups_override = os_strdup(value);
1385         } else if (os_strcasecmp(cmd,
1386                                  "dpp_ignore_netaccesskey_mismatch") == 0) {
1387                 hapd->dpp_ignore_netaccesskey_mismatch = atoi(value);
1388         } else if (os_strcasecmp(cmd, "dpp_test") == 0) {
1389                 dpp_test = atoi(value);
1390 #endif /* CONFIG_DPP */
1391 #endif /* CONFIG_TESTING_OPTIONS */
1392 #ifdef CONFIG_MBO
1393         } else if (os_strcasecmp(cmd, "mbo_assoc_disallow") == 0) {
1394                 int val;
1395
1396                 if (!hapd->conf->mbo_enabled)
1397                         return -1;
1398
1399                 val = atoi(value);
1400                 if (val < 0 || val > 1)
1401                         return -1;
1402
1403                 hapd->mbo_assoc_disallow = val;
1404                 ieee802_11_update_beacons(hapd->iface);
1405
1406                 /*
1407                  * TODO: Need to configure drivers that do AP MLME offload with
1408                  * disallowing station logic.
1409                  */
1410 #endif /* CONFIG_MBO */
1411 #ifdef CONFIG_DPP
1412         } else if (os_strcasecmp(cmd, "dpp_configurator_params") == 0) {
1413                 os_free(hapd->dpp_configurator_params);
1414                 hapd->dpp_configurator_params = os_strdup(value);
1415 #endif /* CONFIG_DPP */
1416         } else {
1417                 ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
1418                 if (ret)
1419                         return ret;
1420
1421                 if (os_strcasecmp(cmd, "deny_mac_file") == 0) {
1422                         hostapd_disassoc_deny_mac(hapd);
1423                 } else if (os_strcasecmp(cmd, "accept_mac_file") == 0) {
1424                         hostapd_disassoc_accept_mac(hapd);
1425                 } else if (os_strncmp(cmd, "wme_ac_", 7) == 0 ||
1426                            os_strncmp(cmd, "wmm_ac_", 7) == 0) {
1427                         hapd->parameter_set_count++;
1428                         if (ieee802_11_update_beacons(hapd->iface))
1429                                 wpa_printf(MSG_DEBUG,
1430                                            "Failed to update beacons with WMM parameters");
1431                 }
1432         }
1433
1434         return ret;
1435 }
1436
1437
1438 static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
1439                                   char *buf, size_t buflen)
1440 {
1441         int res;
1442
1443         wpa_printf(MSG_DEBUG, "CTRL_IFACE GET '%s'", cmd);
1444
1445         if (os_strcmp(cmd, "version") == 0) {
1446                 res = os_snprintf(buf, buflen, "%s", VERSION_STR);
1447                 if (os_snprintf_error(buflen, res))
1448                         return -1;
1449                 return res;
1450         } else if (os_strcmp(cmd, "tls_library") == 0) {
1451                 res = tls_get_library_version(buf, buflen);
1452                 if (os_snprintf_error(buflen, res))
1453                         return -1;
1454                 return res;
1455         }
1456
1457         return -1;
1458 }
1459
1460
1461 static int hostapd_ctrl_iface_enable(struct hostapd_iface *iface)
1462 {
1463         if (hostapd_enable_iface(iface) < 0) {
1464                 wpa_printf(MSG_ERROR, "Enabling of interface failed");
1465                 return -1;
1466         }
1467         return 0;
1468 }
1469
1470
1471 static int hostapd_ctrl_iface_reload(struct hostapd_iface *iface)
1472 {
1473         if (hostapd_reload_iface(iface) < 0) {
1474                 wpa_printf(MSG_ERROR, "Reloading of interface failed");
1475                 return -1;
1476         }
1477         return 0;
1478 }
1479
1480
1481 static int hostapd_ctrl_iface_disable(struct hostapd_iface *iface)
1482 {
1483         if (hostapd_disable_iface(iface) < 0) {
1484                 wpa_printf(MSG_ERROR, "Disabling of interface failed");
1485                 return -1;
1486         }
1487         return 0;
1488 }
1489
1490
1491 #ifdef CONFIG_TESTING_OPTIONS
1492
1493 static int hostapd_ctrl_iface_radar(struct hostapd_data *hapd, char *cmd)
1494 {
1495         union wpa_event_data data;
1496         char *pos, *param;
1497         enum wpa_event_type event;
1498
1499         wpa_printf(MSG_DEBUG, "RADAR TEST: %s", cmd);
1500
1501         os_memset(&data, 0, sizeof(data));
1502
1503         param = os_strchr(cmd, ' ');
1504         if (param == NULL)
1505                 return -1;
1506         *param++ = '\0';
1507
1508         if (os_strcmp(cmd, "DETECTED") == 0)
1509                 event = EVENT_DFS_RADAR_DETECTED;
1510         else if (os_strcmp(cmd, "CAC-FINISHED") == 0)
1511                 event = EVENT_DFS_CAC_FINISHED;
1512         else if (os_strcmp(cmd, "CAC-ABORTED") == 0)
1513                 event = EVENT_DFS_CAC_ABORTED;
1514         else if (os_strcmp(cmd, "NOP-FINISHED") == 0)
1515                 event = EVENT_DFS_NOP_FINISHED;
1516         else {
1517                 wpa_printf(MSG_DEBUG, "Unsupported RADAR test command: %s",
1518                            cmd);
1519                 return -1;
1520         }
1521
1522         pos = os_strstr(param, "freq=");
1523         if (pos)
1524                 data.dfs_event.freq = atoi(pos + 5);
1525
1526         pos = os_strstr(param, "ht_enabled=1");
1527         if (pos)
1528                 data.dfs_event.ht_enabled = 1;
1529
1530         pos = os_strstr(param, "chan_offset=");
1531         if (pos)
1532                 data.dfs_event.chan_offset = atoi(pos + 12);
1533
1534         pos = os_strstr(param, "chan_width=");
1535         if (pos)
1536                 data.dfs_event.chan_width = atoi(pos + 11);
1537
1538         pos = os_strstr(param, "cf1=");
1539         if (pos)
1540                 data.dfs_event.cf1 = atoi(pos + 4);
1541
1542         pos = os_strstr(param, "cf2=");
1543         if (pos)
1544                 data.dfs_event.cf2 = atoi(pos + 4);
1545
1546         wpa_supplicant_event(hapd, event, &data);
1547
1548         return 0;
1549 }
1550
1551
1552 static int hostapd_ctrl_iface_mgmt_tx(struct hostapd_data *hapd, char *cmd)
1553 {
1554         size_t len;
1555         u8 *buf;
1556         int res;
1557
1558         wpa_printf(MSG_DEBUG, "External MGMT TX: %s", cmd);
1559
1560         len = os_strlen(cmd);
1561         if (len & 1)
1562                 return -1;
1563         len /= 2;
1564
1565         buf = os_malloc(len);
1566         if (buf == NULL)
1567                 return -1;
1568
1569         if (hexstr2bin(cmd, buf, len) < 0) {
1570                 os_free(buf);
1571                 return -1;
1572         }
1573
1574         res = hostapd_drv_send_mlme(hapd, buf, len, 0);
1575         os_free(buf);
1576         return res;
1577 }
1578
1579
1580 static int hostapd_ctrl_iface_mgmt_tx_status_process(struct hostapd_data *hapd,
1581                                                      char *cmd)
1582 {
1583         char *pos, *param;
1584         size_t len;
1585         u8 *buf;
1586         int stype = 0, ok = 0;
1587         union wpa_event_data event;
1588
1589         if (!hapd->ext_mgmt_frame_handling)
1590                 return -1;
1591
1592         /* stype=<val> ok=<0/1> buf=<frame hexdump> */
1593
1594         wpa_printf(MSG_DEBUG, "External MGMT TX status process: %s", cmd);
1595
1596         pos = cmd;
1597         param = os_strstr(pos, "stype=");
1598         if (param) {
1599                 param += 6;
1600                 stype = atoi(param);
1601         }
1602
1603         param = os_strstr(pos, " ok=");
1604         if (param) {
1605                 param += 4;
1606                 ok = atoi(param);
1607         }
1608
1609         param = os_strstr(pos, " buf=");
1610         if (!param)
1611                 return -1;
1612         param += 5;
1613
1614         len = os_strlen(param);
1615         if (len & 1)
1616                 return -1;
1617         len /= 2;
1618
1619         buf = os_malloc(len);
1620         if (!buf || hexstr2bin(param, buf, len) < 0) {
1621                 os_free(buf);
1622                 return -1;
1623         }
1624
1625         os_memset(&event, 0, sizeof(event));
1626         event.tx_status.type = WLAN_FC_TYPE_MGMT;
1627         event.tx_status.data = buf;
1628         event.tx_status.data_len = len;
1629         event.tx_status.stype = stype;
1630         event.tx_status.ack = ok;
1631         hapd->ext_mgmt_frame_handling = 0;
1632         wpa_supplicant_event(hapd, EVENT_TX_STATUS, &event);
1633         hapd->ext_mgmt_frame_handling = 1;
1634
1635         os_free(buf);
1636
1637         return 0;
1638 }
1639
1640
1641 static int hostapd_ctrl_iface_mgmt_rx_process(struct hostapd_data *hapd,
1642                                               char *cmd)
1643 {
1644         char *pos, *param;
1645         size_t len;
1646         u8 *buf;
1647         int freq = 0, datarate = 0, ssi_signal = 0;
1648         union wpa_event_data event;
1649
1650         if (!hapd->ext_mgmt_frame_handling)
1651                 return -1;
1652
1653         /* freq=<MHz> datarate=<val> ssi_signal=<val> frame=<frame hexdump> */
1654
1655         wpa_printf(MSG_DEBUG, "External MGMT RX process: %s", cmd);
1656
1657         pos = cmd;
1658         param = os_strstr(pos, "freq=");
1659         if (param) {
1660                 param += 5;
1661                 freq = atoi(param);
1662         }
1663
1664         param = os_strstr(pos, " datarate=");
1665         if (param) {
1666                 param += 10;
1667                 datarate = atoi(param);
1668         }
1669
1670         param = os_strstr(pos, " ssi_signal=");
1671         if (param) {
1672                 param += 12;
1673                 ssi_signal = atoi(param);
1674         }
1675
1676         param = os_strstr(pos, " frame=");
1677         if (param == NULL)
1678                 return -1;
1679         param += 7;
1680
1681         len = os_strlen(param);
1682         if (len & 1)
1683                 return -1;
1684         len /= 2;
1685
1686         buf = os_malloc(len);
1687         if (buf == NULL)
1688                 return -1;
1689
1690         if (hexstr2bin(param, buf, len) < 0) {
1691                 os_free(buf);
1692                 return -1;
1693         }
1694
1695         os_memset(&event, 0, sizeof(event));
1696         event.rx_mgmt.freq = freq;
1697         event.rx_mgmt.frame = buf;
1698         event.rx_mgmt.frame_len = len;
1699         event.rx_mgmt.ssi_signal = ssi_signal;
1700         event.rx_mgmt.datarate = datarate;
1701         hapd->ext_mgmt_frame_handling = 0;
1702         wpa_supplicant_event(hapd, EVENT_RX_MGMT, &event);
1703         hapd->ext_mgmt_frame_handling = 1;
1704
1705         os_free(buf);
1706
1707         return 0;
1708 }
1709
1710
1711 static int hostapd_ctrl_iface_eapol_rx(struct hostapd_data *hapd, char *cmd)
1712 {
1713         char *pos;
1714         u8 src[ETH_ALEN], *buf;
1715         int used;
1716         size_t len;
1717
1718         wpa_printf(MSG_DEBUG, "External EAPOL RX: %s", cmd);
1719
1720         pos = cmd;
1721         used = hwaddr_aton2(pos, src);
1722         if (used < 0)
1723                 return -1;
1724         pos += used;
1725         while (*pos == ' ')
1726                 pos++;
1727
1728         len = os_strlen(pos);
1729         if (len & 1)
1730                 return -1;
1731         len /= 2;
1732
1733         buf = os_malloc(len);
1734         if (buf == NULL)
1735                 return -1;
1736
1737         if (hexstr2bin(pos, buf, len) < 0) {
1738                 os_free(buf);
1739                 return -1;
1740         }
1741
1742         ieee802_1x_receive(hapd, src, buf, len);
1743         os_free(buf);
1744
1745         return 0;
1746 }
1747
1748
1749 static u16 ipv4_hdr_checksum(const void *buf, size_t len)
1750 {
1751         size_t i;
1752         u32 sum = 0;
1753         const u16 *pos = buf;
1754
1755         for (i = 0; i < len / 2; i++)
1756                 sum += *pos++;
1757
1758         while (sum >> 16)
1759                 sum = (sum & 0xffff) + (sum >> 16);
1760
1761         return sum ^ 0xffff;
1762 }
1763
1764
1765 #define HWSIM_PACKETLEN 1500
1766 #define HWSIM_IP_LEN (HWSIM_PACKETLEN - sizeof(struct ether_header))
1767
1768 static void hostapd_data_test_rx(void *ctx, const u8 *src_addr, const u8 *buf,
1769                                  size_t len)
1770 {
1771         struct hostapd_data *hapd = ctx;
1772         const struct ether_header *eth;
1773         struct iphdr ip;
1774         const u8 *pos;
1775         unsigned int i;
1776
1777         if (len != HWSIM_PACKETLEN)
1778                 return;
1779
1780         eth = (const struct ether_header *) buf;
1781         os_memcpy(&ip, eth + 1, sizeof(ip));
1782         pos = &buf[sizeof(*eth) + sizeof(ip)];
1783
1784         if (ip.ihl != 5 || ip.version != 4 ||
1785             ntohs(ip.tot_len) != HWSIM_IP_LEN)
1786                 return;
1787
1788         for (i = 0; i < HWSIM_IP_LEN - sizeof(ip); i++) {
1789                 if (*pos != (u8) i)
1790                         return;
1791                 pos++;
1792         }
1793
1794         wpa_msg(hapd->msg_ctx, MSG_INFO, "DATA-TEST-RX " MACSTR " " MACSTR,
1795                 MAC2STR(eth->ether_dhost), MAC2STR(eth->ether_shost));
1796 }
1797
1798
1799 static int hostapd_ctrl_iface_data_test_config(struct hostapd_data *hapd,
1800                                                char *cmd)
1801 {
1802         int enabled = atoi(cmd);
1803         char *pos;
1804         const char *ifname;
1805
1806         if (!enabled) {
1807                 if (hapd->l2_test) {
1808                         l2_packet_deinit(hapd->l2_test);
1809                         hapd->l2_test = NULL;
1810                         wpa_dbg(hapd->msg_ctx, MSG_DEBUG,
1811                                 "test data: Disabled");
1812                 }
1813                 return 0;
1814         }
1815
1816         if (hapd->l2_test)
1817                 return 0;
1818
1819         pos = os_strstr(cmd, " ifname=");
1820         if (pos)
1821                 ifname = pos + 8;
1822         else
1823                 ifname = hapd->conf->iface;
1824
1825         hapd->l2_test = l2_packet_init(ifname, hapd->own_addr,
1826                                         ETHERTYPE_IP, hostapd_data_test_rx,
1827                                         hapd, 1);
1828         if (hapd->l2_test == NULL)
1829                 return -1;
1830
1831         wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "test data: Enabled");
1832
1833         return 0;
1834 }
1835
1836
1837 static int hostapd_ctrl_iface_data_test_tx(struct hostapd_data *hapd, char *cmd)
1838 {
1839         u8 dst[ETH_ALEN], src[ETH_ALEN];
1840         char *pos;
1841         int used;
1842         long int val;
1843         u8 tos;
1844         u8 buf[2 + HWSIM_PACKETLEN];
1845         struct ether_header *eth;
1846         struct iphdr *ip;
1847         u8 *dpos;
1848         unsigned int i;
1849
1850         if (hapd->l2_test == NULL)
1851                 return -1;
1852
1853         /* format: <dst> <src> <tos> */
1854
1855         pos = cmd;
1856         used = hwaddr_aton2(pos, dst);
1857         if (used < 0)
1858                 return -1;
1859         pos += used;
1860         while (*pos == ' ')
1861                 pos++;
1862         used = hwaddr_aton2(pos, src);
1863         if (used < 0)
1864                 return -1;
1865         pos += used;
1866
1867         val = strtol(pos, NULL, 0);
1868         if (val < 0 || val > 0xff)
1869                 return -1;
1870         tos = val;
1871
1872         eth = (struct ether_header *) &buf[2];
1873         os_memcpy(eth->ether_dhost, dst, ETH_ALEN);
1874         os_memcpy(eth->ether_shost, src, ETH_ALEN);
1875         eth->ether_type = htons(ETHERTYPE_IP);
1876         ip = (struct iphdr *) (eth + 1);
1877         os_memset(ip, 0, sizeof(*ip));
1878         ip->ihl = 5;
1879         ip->version = 4;
1880         ip->ttl = 64;
1881         ip->tos = tos;
1882         ip->tot_len = htons(HWSIM_IP_LEN);
1883         ip->protocol = 1;
1884         ip->saddr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 1);
1885         ip->daddr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 2);
1886         ip->check = ipv4_hdr_checksum(ip, sizeof(*ip));
1887         dpos = (u8 *) (ip + 1);
1888         for (i = 0; i < HWSIM_IP_LEN - sizeof(*ip); i++)
1889                 *dpos++ = i;
1890
1891         if (l2_packet_send(hapd->l2_test, dst, ETHERTYPE_IP, &buf[2],
1892                            HWSIM_PACKETLEN) < 0)
1893                 return -1;
1894
1895         wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "test data: TX dst=" MACSTR
1896                 " src=" MACSTR " tos=0x%x", MAC2STR(dst), MAC2STR(src), tos);
1897
1898         return 0;
1899 }
1900
1901
1902 static int hostapd_ctrl_iface_data_test_frame(struct hostapd_data *hapd,
1903                                               char *cmd)
1904 {
1905         u8 *buf;
1906         struct ether_header *eth;
1907         struct l2_packet_data *l2 = NULL;
1908         size_t len;
1909         u16 ethertype;
1910         int res = -1;
1911         const char *ifname = hapd->conf->iface;
1912
1913         if (os_strncmp(cmd, "ifname=", 7) == 0) {
1914                 cmd += 7;
1915                 ifname = cmd;
1916                 cmd = os_strchr(cmd, ' ');
1917                 if (cmd == NULL)
1918                         return -1;
1919                 *cmd++ = '\0';
1920         }
1921
1922         len = os_strlen(cmd);
1923         if (len & 1 || len < ETH_HLEN * 2)
1924                 return -1;
1925         len /= 2;
1926
1927         buf = os_malloc(len);
1928         if (buf == NULL)
1929                 return -1;
1930
1931         if (hexstr2bin(cmd, buf, len) < 0)
1932                 goto done;
1933
1934         eth = (struct ether_header *) buf;
1935         ethertype = ntohs(eth->ether_type);
1936
1937         l2 = l2_packet_init(ifname, hapd->own_addr, ethertype,
1938                             hostapd_data_test_rx, hapd, 1);
1939         if (l2 == NULL)
1940                 goto done;
1941
1942         res = l2_packet_send(l2, eth->ether_dhost, ethertype, buf, len);
1943         wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "test data: TX frame res=%d", res);
1944 done:
1945         if (l2)
1946                 l2_packet_deinit(l2);
1947         os_free(buf);
1948
1949         return res < 0 ? -1 : 0;
1950 }
1951
1952
1953 static int hostapd_ctrl_test_alloc_fail(struct hostapd_data *hapd, char *cmd)
1954 {
1955 #ifdef WPA_TRACE_BFD
1956         char *pos;
1957
1958         wpa_trace_fail_after = atoi(cmd);
1959         pos = os_strchr(cmd, ':');
1960         if (pos) {
1961                 pos++;
1962                 os_strlcpy(wpa_trace_fail_func, pos,
1963                            sizeof(wpa_trace_fail_func));
1964         } else {
1965                 wpa_trace_fail_after = 0;
1966         }
1967
1968         return 0;
1969 #else /* WPA_TRACE_BFD */
1970         return -1;
1971 #endif /* WPA_TRACE_BFD */
1972 }
1973
1974
1975 static int hostapd_ctrl_get_alloc_fail(struct hostapd_data *hapd,
1976                                        char *buf, size_t buflen)
1977 {
1978 #ifdef WPA_TRACE_BFD
1979         return os_snprintf(buf, buflen, "%u:%s", wpa_trace_fail_after,
1980                            wpa_trace_fail_func);
1981 #else /* WPA_TRACE_BFD */
1982         return -1;
1983 #endif /* WPA_TRACE_BFD */
1984 }
1985
1986
1987 static int hostapd_ctrl_test_fail(struct hostapd_data *hapd, char *cmd)
1988 {
1989 #ifdef WPA_TRACE_BFD
1990         char *pos;
1991
1992         wpa_trace_test_fail_after = atoi(cmd);
1993         pos = os_strchr(cmd, ':');
1994         if (pos) {
1995                 pos++;
1996                 os_strlcpy(wpa_trace_test_fail_func, pos,
1997                            sizeof(wpa_trace_test_fail_func));
1998         } else {
1999                 wpa_trace_test_fail_after = 0;
2000         }
2001
2002         return 0;
2003 #else /* WPA_TRACE_BFD */
2004         return -1;
2005 #endif /* WPA_TRACE_BFD */
2006 }
2007
2008
2009 static int hostapd_ctrl_get_fail(struct hostapd_data *hapd,
2010                                  char *buf, size_t buflen)
2011 {
2012 #ifdef WPA_TRACE_BFD
2013         return os_snprintf(buf, buflen, "%u:%s", wpa_trace_test_fail_after,
2014                            wpa_trace_test_fail_func);
2015 #else /* WPA_TRACE_BFD */
2016         return -1;
2017 #endif /* WPA_TRACE_BFD */
2018 }
2019
2020
2021 static int hostapd_ctrl_reset_pn(struct hostapd_data *hapd, const char *cmd)
2022 {
2023         struct sta_info *sta;
2024         u8 addr[ETH_ALEN];
2025         u8 zero[WPA_TK_MAX_LEN];
2026
2027         os_memset(zero, 0, sizeof(zero));
2028
2029         if (hwaddr_aton(cmd, addr))
2030                 return -1;
2031
2032 #ifdef CONFIG_IEEE80211W
2033         if (is_broadcast_ether_addr(addr) && os_strstr(cmd, "IGTK")) {
2034                 if (hapd->last_igtk_alg == WPA_ALG_NONE)
2035                         return -1;
2036
2037                 wpa_printf(MSG_INFO, "TESTING: Reset IPN for IGTK");
2038
2039                 /* First, use a zero key to avoid any possible duplicate key
2040                  * avoidance in the driver. */
2041                 if (hostapd_drv_set_key(hapd->conf->iface, hapd,
2042                                         hapd->last_igtk_alg,
2043                                         broadcast_ether_addr,
2044                                         hapd->last_igtk_key_idx, 1, NULL, 0,
2045                                         zero, hapd->last_igtk_len) < 0)
2046                         return -1;
2047
2048                 /* Set the previously configured key to reset its TSC */
2049                 return hostapd_drv_set_key(hapd->conf->iface, hapd,
2050                                            hapd->last_igtk_alg,
2051                                            broadcast_ether_addr,
2052                                            hapd->last_igtk_key_idx, 1, NULL, 0,
2053                                            hapd->last_igtk,
2054                                            hapd->last_igtk_len);
2055         }
2056 #endif /* CONFIG_IEEE80211W */
2057
2058         if (is_broadcast_ether_addr(addr)) {
2059                 if (hapd->last_gtk_alg == WPA_ALG_NONE)
2060                         return -1;
2061
2062                 wpa_printf(MSG_INFO, "TESTING: Reset PN for GTK");
2063
2064                 /* First, use a zero key to avoid any possible duplicate key
2065                  * avoidance in the driver. */
2066                 if (hostapd_drv_set_key(hapd->conf->iface, hapd,
2067                                         hapd->last_gtk_alg,
2068                                         broadcast_ether_addr,
2069                                         hapd->last_gtk_key_idx, 1, NULL, 0,
2070                                         zero, hapd->last_gtk_len) < 0)
2071                         return -1;
2072
2073                 /* Set the previously configured key to reset its TSC */
2074                 return hostapd_drv_set_key(hapd->conf->iface, hapd,
2075                                            hapd->last_gtk_alg,
2076                                            broadcast_ether_addr,
2077                                            hapd->last_gtk_key_idx, 1, NULL, 0,
2078                                            hapd->last_gtk, hapd->last_gtk_len);
2079         }
2080
2081         sta = ap_get_sta(hapd, addr);
2082         if (!sta)
2083                 return -1;
2084
2085         if (sta->last_tk_alg == WPA_ALG_NONE)
2086                 return -1;
2087
2088         wpa_printf(MSG_INFO, "TESTING: Reset PN for " MACSTR,
2089                    MAC2STR(sta->addr));
2090
2091         /* First, use a zero key to avoid any possible duplicate key avoidance
2092          * in the driver. */
2093         if (hostapd_drv_set_key(hapd->conf->iface, hapd, sta->last_tk_alg,
2094                                 sta->addr, sta->last_tk_key_idx, 1, NULL, 0,
2095                                 zero, sta->last_tk_len) < 0)
2096                 return -1;
2097
2098         /* Set the previously configured key to reset its TSC/RSC */
2099         return hostapd_drv_set_key(hapd->conf->iface, hapd, sta->last_tk_alg,
2100                                    sta->addr, sta->last_tk_key_idx, 1, NULL, 0,
2101                                    sta->last_tk, sta->last_tk_len);
2102 }
2103
2104
2105 static int hostapd_ctrl_set_key(struct hostapd_data *hapd, const char *cmd)
2106 {
2107         u8 addr[ETH_ALEN];
2108         const char *pos = cmd;
2109         enum wpa_alg alg;
2110         int idx, set_tx;
2111         u8 seq[6], key[WPA_TK_MAX_LEN];
2112         size_t key_len;
2113
2114         /* parameters: alg addr idx set_tx seq key */
2115
2116         alg = atoi(pos);
2117         pos = os_strchr(pos, ' ');
2118         if (!pos)
2119                 return -1;
2120         pos++;
2121         if (hwaddr_aton(pos, addr))
2122                 return -1;
2123         pos += 17;
2124         if (*pos != ' ')
2125                 return -1;
2126         pos++;
2127         idx = atoi(pos);
2128         pos = os_strchr(pos, ' ');
2129         if (!pos)
2130                 return -1;
2131         pos++;
2132         set_tx = atoi(pos);
2133         pos = os_strchr(pos, ' ');
2134         if (!pos)
2135                 return -1;
2136         pos++;
2137         if (hexstr2bin(pos, seq, sizeof(seq)) < 0)
2138                 return -1;
2139         pos += 2 * 6;
2140         if (*pos != ' ')
2141                 return -1;
2142         pos++;
2143         key_len = os_strlen(pos) / 2;
2144         if (hexstr2bin(pos, key, key_len) < 0)
2145                 return -1;
2146
2147         wpa_printf(MSG_INFO, "TESTING: Set key");
2148         return hostapd_drv_set_key(hapd->conf->iface, hapd, alg, addr, idx,
2149                                    set_tx, seq, 6, key, key_len);
2150 }
2151
2152
2153 static void restore_tk(void *ctx1, void *ctx2)
2154 {
2155         struct hostapd_data *hapd = ctx1;
2156         struct sta_info *sta = ctx2;
2157
2158         wpa_printf(MSG_INFO, "TESTING: Restore TK for " MACSTR,
2159                    MAC2STR(sta->addr));
2160         /* This does not really restore the TSC properly, so this will result
2161          * in replay protection issues for now since there is no clean way of
2162          * preventing encryption of a single EAPOL frame. */
2163         hostapd_drv_set_key(hapd->conf->iface, hapd, sta->last_tk_alg,
2164                             sta->addr, sta->last_tk_key_idx, 1, NULL, 0,
2165                             sta->last_tk, sta->last_tk_len);
2166 }
2167
2168
2169 static int hostapd_ctrl_resend_m1(struct hostapd_data *hapd, const char *cmd)
2170 {
2171         struct sta_info *sta;
2172         u8 addr[ETH_ALEN];
2173         int plain = os_strstr(cmd, "plaintext") != NULL;
2174
2175         if (hwaddr_aton(cmd, addr))
2176                 return -1;
2177
2178         sta = ap_get_sta(hapd, addr);
2179         if (!sta || !sta->wpa_sm)
2180                 return -1;
2181
2182         if (plain && sta->last_tk_alg == WPA_ALG_NONE)
2183                 plain = 0; /* no need for special processing */
2184         if (plain) {
2185                 wpa_printf(MSG_INFO, "TESTING: Clear TK for " MACSTR,
2186                            MAC2STR(sta->addr));
2187                 hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_NONE,
2188                                     sta->addr, sta->last_tk_key_idx, 0, NULL, 0,
2189                                     NULL, 0);
2190         }
2191
2192         wpa_printf(MSG_INFO, "TESTING: Send M1 to " MACSTR, MAC2STR(sta->addr));
2193         return wpa_auth_resend_m1(sta->wpa_sm,
2194                                   os_strstr(cmd, "change-anonce") != NULL,
2195                                   plain ? restore_tk : NULL, hapd, sta);
2196 }
2197
2198
2199 static int hostapd_ctrl_resend_m3(struct hostapd_data *hapd, const char *cmd)
2200 {
2201         struct sta_info *sta;
2202         u8 addr[ETH_ALEN];
2203         int plain = os_strstr(cmd, "plaintext") != NULL;
2204
2205         if (hwaddr_aton(cmd, addr))
2206                 return -1;
2207
2208         sta = ap_get_sta(hapd, addr);
2209         if (!sta || !sta->wpa_sm)
2210                 return -1;
2211
2212         if (plain && sta->last_tk_alg == WPA_ALG_NONE)
2213                 plain = 0; /* no need for special processing */
2214         if (plain) {
2215                 wpa_printf(MSG_INFO, "TESTING: Clear TK for " MACSTR,
2216                            MAC2STR(sta->addr));
2217                 hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_NONE,
2218                                     sta->addr, sta->last_tk_key_idx, 0, NULL, 0,
2219                                     NULL, 0);
2220         }
2221
2222         wpa_printf(MSG_INFO, "TESTING: Send M3 to " MACSTR, MAC2STR(sta->addr));
2223         return wpa_auth_resend_m3(sta->wpa_sm,
2224                                   plain ? restore_tk : NULL, hapd, sta);
2225 }
2226
2227
2228 static int hostapd_ctrl_resend_group_m1(struct hostapd_data *hapd,
2229                                         const char *cmd)
2230 {
2231         struct sta_info *sta;
2232         u8 addr[ETH_ALEN];
2233         int plain = os_strstr(cmd, "plaintext") != NULL;
2234
2235         if (hwaddr_aton(cmd, addr))
2236                 return -1;
2237
2238         sta = ap_get_sta(hapd, addr);
2239         if (!sta || !sta->wpa_sm)
2240                 return -1;
2241
2242         if (plain && sta->last_tk_alg == WPA_ALG_NONE)
2243                 plain = 0; /* no need for special processing */
2244         if (plain) {
2245                 wpa_printf(MSG_INFO, "TESTING: Clear TK for " MACSTR,
2246                            MAC2STR(sta->addr));
2247                 hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_NONE,
2248                                     sta->addr, sta->last_tk_key_idx, 0, NULL, 0,
2249                                     NULL, 0);
2250         }
2251
2252         wpa_printf(MSG_INFO,
2253                    "TESTING: Send group M1 for the same GTK and zero RSC to "
2254                    MACSTR, MAC2STR(sta->addr));
2255         return wpa_auth_resend_group_m1(sta->wpa_sm,
2256                                         plain ? restore_tk : NULL, hapd, sta);
2257 }
2258
2259 #endif /* CONFIG_TESTING_OPTIONS */
2260
2261
2262 static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
2263                                           char *pos)
2264 {
2265 #ifdef NEED_AP_MLME
2266         struct csa_settings settings;
2267         int ret;
2268         unsigned int i;
2269
2270         ret = hostapd_parse_csa_settings(pos, &settings);
2271         if (ret)
2272                 return ret;
2273
2274         for (i = 0; i < iface->num_bss; i++) {
2275
2276                 /* Save CHAN_SWITCH VHT config */
2277                 hostapd_chan_switch_vht_config(
2278                         iface->bss[i], settings.freq_params.vht_enabled);
2279
2280                 ret = hostapd_switch_channel(iface->bss[i], &settings);
2281                 if (ret) {
2282                         /* FIX: What do we do if CSA fails in the middle of
2283                          * submitting multi-BSS CSA requests? */
2284                         return ret;
2285                 }
2286         }
2287
2288         return 0;
2289 #else /* NEED_AP_MLME */
2290         return -1;
2291 #endif /* NEED_AP_MLME */
2292 }
2293
2294
2295 static int hostapd_ctrl_iface_mib(struct hostapd_data *hapd, char *reply,
2296                                   int reply_size, const char *param)
2297 {
2298 #ifdef RADIUS_SERVER
2299         if (os_strcmp(param, "radius_server") == 0) {
2300                 return radius_server_get_mib(hapd->radius_srv, reply,
2301                                              reply_size);
2302         }
2303 #endif /* RADIUS_SERVER */
2304         return -1;
2305 }
2306
2307
2308 static int hostapd_ctrl_iface_vendor(struct hostapd_data *hapd, char *cmd,
2309                                      char *buf, size_t buflen)
2310 {
2311         int ret;
2312         char *pos;
2313         u8 *data = NULL;
2314         unsigned int vendor_id, subcmd;
2315         struct wpabuf *reply;
2316         size_t data_len = 0;
2317
2318         /* cmd: <vendor id> <subcommand id> [<hex formatted data>] */
2319         vendor_id = strtoul(cmd, &pos, 16);
2320         if (!isblank((unsigned char) *pos))
2321                 return -EINVAL;
2322
2323         subcmd = strtoul(pos, &pos, 10);
2324
2325         if (*pos != '\0') {
2326                 if (!isblank((unsigned char) *pos++))
2327                         return -EINVAL;
2328                 data_len = os_strlen(pos);
2329         }
2330
2331         if (data_len) {
2332                 data_len /= 2;
2333                 data = os_malloc(data_len);
2334                 if (!data)
2335                         return -ENOBUFS;
2336
2337                 if (hexstr2bin(pos, data, data_len)) {
2338                         wpa_printf(MSG_DEBUG,
2339                                    "Vendor command: wrong parameter format");
2340                         os_free(data);
2341                         return -EINVAL;
2342                 }
2343         }
2344
2345         reply = wpabuf_alloc((buflen - 1) / 2);
2346         if (!reply) {
2347                 os_free(data);
2348                 return -ENOBUFS;
2349         }
2350
2351         ret = hostapd_drv_vendor_cmd(hapd, vendor_id, subcmd, data, data_len,
2352                                      reply);
2353
2354         if (ret == 0)
2355                 ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(reply),
2356                                        wpabuf_len(reply));
2357
2358         wpabuf_free(reply);
2359         os_free(data);
2360
2361         return ret;
2362 }
2363
2364
2365 static int hostapd_ctrl_iface_eapol_reauth(struct hostapd_data *hapd,
2366                                            const char *cmd)
2367 {
2368         u8 addr[ETH_ALEN];
2369         struct sta_info *sta;
2370
2371         if (hwaddr_aton(cmd, addr))
2372                 return -1;
2373
2374         sta = ap_get_sta(hapd, addr);
2375         if (!sta || !sta->eapol_sm)
2376                 return -1;
2377
2378         eapol_auth_reauthenticate(sta->eapol_sm);
2379         return 0;
2380 }
2381
2382
2383 static int hostapd_ctrl_iface_eapol_set(struct hostapd_data *hapd, char *cmd)
2384 {
2385         u8 addr[ETH_ALEN];
2386         struct sta_info *sta;
2387         char *pos = cmd, *param;
2388
2389         if (hwaddr_aton(pos, addr) || pos[17] != ' ')
2390                 return -1;
2391         pos += 18;
2392         param = pos;
2393         pos = os_strchr(pos, ' ');
2394         if (!pos)
2395                 return -1;
2396         *pos++ = '\0';
2397
2398         sta = ap_get_sta(hapd, addr);
2399         if (!sta || !sta->eapol_sm)
2400                 return -1;
2401
2402         return eapol_auth_set_conf(sta->eapol_sm, param, pos);
2403 }
2404
2405
2406 static int hostapd_ctrl_iface_log_level(struct hostapd_data *hapd, char *cmd,
2407                                         char *buf, size_t buflen)
2408 {
2409         char *pos, *end, *stamp;
2410         int ret;
2411
2412         /* cmd: "LOG_LEVEL [<level>]" */
2413         if (*cmd == '\0') {
2414                 pos = buf;
2415                 end = buf + buflen;
2416                 ret = os_snprintf(pos, end - pos, "Current level: %s\n"
2417                                   "Timestamp: %d\n",
2418                                   debug_level_str(wpa_debug_level),
2419                                   wpa_debug_timestamp);
2420                 if (os_snprintf_error(end - pos, ret))
2421                         ret = 0;
2422
2423                 return ret;
2424         }
2425
2426         while (*cmd == ' ')
2427                 cmd++;
2428
2429         stamp = os_strchr(cmd, ' ');
2430         if (stamp) {
2431                 *stamp++ = '\0';
2432                 while (*stamp == ' ') {
2433                         stamp++;
2434                 }
2435         }
2436
2437         if (os_strlen(cmd)) {
2438                 int level = str_to_debug_level(cmd);
2439                 if (level < 0)
2440                         return -1;
2441                 wpa_debug_level = level;
2442         }
2443
2444         if (stamp && os_strlen(stamp))
2445                 wpa_debug_timestamp = atoi(stamp);
2446
2447         os_memcpy(buf, "OK\n", 3);
2448         return 3;
2449 }
2450
2451
2452 #ifdef NEED_AP_MLME
2453 static int hostapd_ctrl_iface_track_sta_list(struct hostapd_data *hapd,
2454                                              char *buf, size_t buflen)
2455 {
2456         struct hostapd_iface *iface = hapd->iface;
2457         char *pos, *end;
2458         struct hostapd_sta_info *info;
2459         struct os_reltime now;
2460
2461         if (!iface->num_sta_seen)
2462                 return 0;
2463
2464         sta_track_expire(iface, 0);
2465
2466         pos = buf;
2467         end = buf + buflen;
2468
2469         os_get_reltime(&now);
2470         dl_list_for_each_reverse(info, &iface->sta_seen,
2471                                  struct hostapd_sta_info, list) {
2472                 struct os_reltime age;
2473                 int ret;
2474
2475                 os_reltime_sub(&now, &info->last_seen, &age);
2476                 ret = os_snprintf(pos, end - pos, MACSTR " %u %d\n",
2477                                   MAC2STR(info->addr), (unsigned int) age.sec,
2478                                   info->ssi_signal);
2479                 if (os_snprintf_error(end - pos, ret))
2480                         break;
2481                 pos += ret;
2482         }
2483
2484         return pos - buf;
2485 }
2486 #endif /* NEED_AP_MLME */
2487
2488
2489 static int hostapd_ctrl_iface_req_lci(struct hostapd_data *hapd,
2490                                       const char *cmd)
2491 {
2492         u8 addr[ETH_ALEN];
2493
2494         if (hwaddr_aton(cmd, addr)) {
2495                 wpa_printf(MSG_INFO, "CTRL: REQ_LCI: Invalid MAC address");
2496                 return -1;
2497         }
2498
2499         return hostapd_send_lci_req(hapd, addr);
2500 }
2501
2502
2503 static int hostapd_ctrl_iface_req_range(struct hostapd_data *hapd, char *cmd)
2504 {
2505         u8 addr[ETH_ALEN];
2506         char *token, *context = NULL;
2507         int random_interval, min_ap;
2508         u8 responders[ETH_ALEN * RRM_RANGE_REQ_MAX_RESPONDERS];
2509         unsigned int n_responders;
2510
2511         token = str_token(cmd, " ", &context);
2512         if (!token || hwaddr_aton(token, addr)) {
2513                 wpa_printf(MSG_INFO,
2514                            "CTRL: REQ_RANGE - Bad destination address");
2515                 return -1;
2516         }
2517
2518         token = str_token(cmd, " ", &context);
2519         if (!token)
2520                 return -1;
2521
2522         random_interval = atoi(token);
2523         if (random_interval < 0 || random_interval > 0xffff)
2524                 return -1;
2525
2526         token = str_token(cmd, " ", &context);
2527         if (!token)
2528                 return -1;
2529
2530         min_ap = atoi(token);
2531         if (min_ap <= 0 || min_ap > WLAN_RRM_RANGE_REQ_MAX_MIN_AP)
2532                 return -1;
2533
2534         n_responders = 0;
2535         while ((token = str_token(cmd, " ", &context))) {
2536                 if (n_responders == RRM_RANGE_REQ_MAX_RESPONDERS) {
2537                         wpa_printf(MSG_INFO,
2538                                    "CTRL: REQ_RANGE: Too many responders");
2539                         return -1;
2540                 }
2541
2542                 if (hwaddr_aton(token, responders + n_responders * ETH_ALEN)) {
2543                         wpa_printf(MSG_INFO,
2544                                    "CTRL: REQ_RANGE: Bad responder address");
2545                         return -1;
2546                 }
2547
2548                 n_responders++;
2549         }
2550
2551         if (!n_responders) {
2552                 wpa_printf(MSG_INFO,
2553                            "CTRL: REQ_RANGE - No FTM responder address");
2554                 return -1;
2555         }
2556
2557         return hostapd_send_range_req(hapd, addr, random_interval, min_ap,
2558                                       responders, n_responders);
2559 }
2560
2561
2562 static int hostapd_ctrl_iface_req_beacon(struct hostapd_data *hapd,
2563                                          const char *cmd, char *reply,
2564                                          size_t reply_size)
2565 {
2566         u8 addr[ETH_ALEN];
2567         const char *pos;
2568         struct wpabuf *req;
2569         int ret;
2570         u8 req_mode = 0;
2571
2572         if (hwaddr_aton(cmd, addr))
2573                 return -1;
2574         pos = os_strchr(cmd, ' ');
2575         if (!pos)
2576                 return -1;
2577         pos++;
2578         if (os_strncmp(pos, "req_mode=", 9) == 0) {
2579                 int val = hex2byte(pos + 9);
2580
2581                 if (val < 0)
2582                         return -1;
2583                 req_mode = val;
2584                 pos += 11;
2585                 pos = os_strchr(pos, ' ');
2586                 if (!pos)
2587                         return -1;
2588                 pos++;
2589         }
2590         req = wpabuf_parse_bin(pos);
2591         if (!req)
2592                 return -1;
2593
2594         ret = hostapd_send_beacon_req(hapd, addr, req_mode, req);
2595         wpabuf_free(req);
2596         if (ret >= 0)
2597                 ret = os_snprintf(reply, reply_size, "%d", ret);
2598         return ret;
2599 }
2600
2601
2602 static int hostapd_ctrl_iface_set_neighbor(struct hostapd_data *hapd, char *buf)
2603 {
2604         struct wpa_ssid_value ssid;
2605         u8 bssid[ETH_ALEN];
2606         struct wpabuf *nr, *lci = NULL, *civic = NULL;
2607         int stationary = 0;
2608         char *tmp;
2609         int ret;
2610
2611         if (!(hapd->conf->radio_measurements[0] &
2612               WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
2613                 wpa_printf(MSG_ERROR,
2614                            "CTRL: SET_NEIGHBOR: Neighbor report is not enabled");
2615                 return -1;
2616         }
2617
2618         if (hwaddr_aton(buf, bssid)) {
2619                 wpa_printf(MSG_ERROR, "CTRL: SET_NEIGHBOR: Bad BSSID");
2620                 return -1;
2621         }
2622
2623         tmp = os_strstr(buf, "ssid=");
2624         if (!tmp || ssid_parse(tmp + 5, &ssid)) {
2625                 wpa_printf(MSG_ERROR,
2626                            "CTRL: SET_NEIGHBOR: Bad or missing SSID");
2627                 return -1;
2628         }
2629         buf = os_strchr(tmp + 6, tmp[5] == '"' ? '"' : ' ');
2630         if (!buf)
2631                 return -1;
2632
2633         tmp = os_strstr(buf, "nr=");
2634         if (!tmp) {
2635                 wpa_printf(MSG_ERROR,
2636                            "CTRL: SET_NEIGHBOR: Missing Neighbor Report element");
2637                 return -1;
2638         }
2639
2640         buf = os_strchr(tmp, ' ');
2641         if (buf)
2642                 *buf++ = '\0';
2643
2644         nr = wpabuf_parse_bin(tmp + 3);
2645         if (!nr) {
2646                 wpa_printf(MSG_ERROR,
2647                            "CTRL: SET_NEIGHBOR: Bad Neighbor Report element");
2648                 return -1;
2649         }
2650
2651         if (!buf)
2652                 goto set;
2653
2654         tmp = os_strstr(buf, "lci=");
2655         if (tmp) {
2656                 buf = os_strchr(tmp, ' ');
2657                 if (buf)
2658                         *buf++ = '\0';
2659                 lci = wpabuf_parse_bin(tmp + 4);
2660                 if (!lci) {
2661                         wpa_printf(MSG_ERROR,
2662                                    "CTRL: SET_NEIGHBOR: Bad LCI subelement");
2663                         wpabuf_free(nr);
2664                         return -1;
2665                 }
2666         }
2667
2668         if (!buf)
2669                 goto set;
2670
2671         tmp = os_strstr(buf, "civic=");
2672         if (tmp) {
2673                 buf = os_strchr(tmp, ' ');
2674                 if (buf)
2675                         *buf++ = '\0';
2676                 civic = wpabuf_parse_bin(tmp + 6);
2677                 if (!civic) {
2678                         wpa_printf(MSG_ERROR,
2679                                    "CTRL: SET_NEIGHBOR: Bad civic subelement");
2680                         wpabuf_free(nr);
2681                         wpabuf_free(lci);
2682                         return -1;
2683                 }
2684         }
2685
2686         if (!buf)
2687                 goto set;
2688
2689         if (os_strstr(buf, "stat"))
2690                 stationary = 1;
2691
2692 set:
2693         ret = hostapd_neighbor_set(hapd, bssid, &ssid, nr, lci, civic,
2694                                    stationary);
2695
2696         wpabuf_free(nr);
2697         wpabuf_free(lci);
2698         wpabuf_free(civic);
2699
2700         return ret;
2701 }
2702
2703
2704 static int hostapd_ctrl_iface_remove_neighbor(struct hostapd_data *hapd,
2705                                               char *buf)
2706 {
2707         struct wpa_ssid_value ssid;
2708         u8 bssid[ETH_ALEN];
2709         char *tmp;
2710
2711         if (hwaddr_aton(buf, bssid)) {
2712                 wpa_printf(MSG_ERROR, "CTRL: REMOVE_NEIGHBOR: Bad BSSID");
2713                 return -1;
2714         }
2715
2716         tmp = os_strstr(buf, "ssid=");
2717         if (!tmp || ssid_parse(tmp + 5, &ssid)) {
2718                 wpa_printf(MSG_ERROR,
2719                            "CTRL: REMOVE_NEIGHBORr: Bad or missing SSID");
2720                 return -1;
2721         }
2722
2723         return hostapd_neighbor_remove(hapd, bssid, &ssid);
2724 }
2725
2726
2727 static int hostapd_ctrl_driver_flags(struct hostapd_iface *iface, char *buf,
2728                                      size_t buflen)
2729 {
2730         int ret, i;
2731         char *pos, *end;
2732
2733         ret = os_snprintf(buf, buflen, "%016llX:\n",
2734                           (long long unsigned) iface->drv_flags);
2735         if (os_snprintf_error(buflen, ret))
2736                 return -1;
2737
2738         pos = buf + ret;
2739         end = buf + buflen;
2740
2741         for (i = 0; i < 64; i++) {
2742                 if (iface->drv_flags & (1LLU << i)) {
2743                         ret = os_snprintf(pos, end - pos, "%s\n",
2744                                           driver_flag_to_string(1LLU << i));
2745                         if (os_snprintf_error(end - pos, ret))
2746                                 return -1;
2747                         pos += ret;
2748                 }
2749         }
2750
2751         return pos - buf;
2752 }
2753
2754
2755 static int hostapd_ctrl_iface_acl_del_mac(struct mac_acl_entry **acl, int *num,
2756                                           const char *txtaddr)
2757 {
2758         u8 addr[ETH_ALEN];
2759         struct vlan_description vlan_id;
2760
2761         if (!(*num))
2762                 return 0;
2763
2764         if (hwaddr_aton(txtaddr, addr))
2765                 return -1;
2766
2767         if (hostapd_maclist_found(*acl, *num, addr, &vlan_id))
2768                 hostapd_remove_acl_mac(acl, num, addr);
2769
2770         return 0;
2771 }
2772
2773
2774 static void hostapd_ctrl_iface_acl_clear_list(struct mac_acl_entry **acl,
2775                                               int *num)
2776 {
2777         while (*num)
2778                 hostapd_remove_acl_mac(acl, num, (*acl)[0].addr);
2779 }
2780
2781
2782 static int hostapd_ctrl_iface_acl_show_mac(struct mac_acl_entry *acl, int num,
2783                                            char *buf, size_t buflen)
2784 {
2785         int i = 0, len = 0, ret = 0;
2786
2787         if (!acl)
2788                 return 0;
2789
2790         while (i < num) {
2791                 ret = os_snprintf(buf + len, buflen - len,
2792                                   MACSTR " VLAN_ID=%d\n",
2793                                   MAC2STR(acl[i].addr),
2794                                   acl[i].vlan_id.untagged);
2795                 if (ret < 0 || (size_t) ret >= buflen - len)
2796                         return len;
2797                 i++;
2798                 len += ret;
2799         }
2800         return len;
2801 }
2802
2803
2804 static int hostapd_ctrl_iface_acl_add_mac(struct mac_acl_entry **acl, int *num,
2805                                           const char *cmd)
2806 {
2807         u8 addr[ETH_ALEN];
2808         struct vlan_description vlan_id;
2809         int ret = 0, vlanid = 0;
2810         const char *pos;
2811
2812         if (hwaddr_aton(cmd, addr))
2813                 return -1;
2814
2815         pos = os_strstr(cmd, "VLAN_ID=");
2816         if (pos)
2817                 vlanid = atoi(pos + 8);
2818
2819         if (!hostapd_maclist_found(*acl, *num, addr, &vlan_id)) {
2820                 ret = hostapd_add_acl_maclist(acl, num, vlanid, addr);
2821                 if (ret != -1 && *acl)
2822                         qsort(*acl, *num, sizeof(**acl), hostapd_acl_comp);
2823         }
2824
2825         return ret < 0 ? -1 : 0;
2826 }
2827
2828
2829 static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
2830                                               char *buf, char *reply,
2831                                               int reply_size,
2832                                               struct sockaddr_storage *from,
2833                                               socklen_t fromlen)
2834 {
2835         int reply_len, res;
2836
2837         os_memcpy(reply, "OK\n", 3);
2838         reply_len = 3;
2839
2840         if (os_strcmp(buf, "PING") == 0) {
2841                 os_memcpy(reply, "PONG\n", 5);
2842                 reply_len = 5;
2843         } else if (os_strncmp(buf, "RELOG", 5) == 0) {
2844                 if (wpa_debug_reopen_file() < 0)
2845                         reply_len = -1;
2846         } else if (os_strncmp(buf, "NOTE ", 5) == 0) {
2847                 wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
2848         } else if (os_strcmp(buf, "STATUS") == 0) {
2849                 reply_len = hostapd_ctrl_iface_status(hapd, reply,
2850                                                       reply_size);
2851         } else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
2852                 reply_len = hostapd_drv_status(hapd, reply, reply_size);
2853         } else if (os_strcmp(buf, "MIB") == 0) {
2854                 reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
2855                 if (reply_len >= 0) {
2856                         res = wpa_get_mib(hapd->wpa_auth, reply + reply_len,
2857                                           reply_size - reply_len);
2858                         if (res < 0)
2859                                 reply_len = -1;
2860                         else
2861                                 reply_len += res;
2862                 }
2863                 if (reply_len >= 0) {
2864                         res = ieee802_1x_get_mib(hapd, reply + reply_len,
2865                                                  reply_size - reply_len);
2866                         if (res < 0)
2867                                 reply_len = -1;
2868                         else
2869                                 reply_len += res;
2870                 }
2871 #ifndef CONFIG_NO_RADIUS
2872                 if (reply_len >= 0) {
2873                         res = radius_client_get_mib(hapd->radius,
2874                                                     reply + reply_len,
2875                                                     reply_size - reply_len);
2876                         if (res < 0)
2877                                 reply_len = -1;
2878                         else
2879                                 reply_len += res;
2880                 }
2881 #endif /* CONFIG_NO_RADIUS */
2882         } else if (os_strncmp(buf, "MIB ", 4) == 0) {
2883                 reply_len = hostapd_ctrl_iface_mib(hapd, reply, reply_size,
2884                                                    buf + 4);
2885         } else if (os_strcmp(buf, "STA-FIRST") == 0) {
2886                 reply_len = hostapd_ctrl_iface_sta_first(hapd, reply,
2887                                                          reply_size);
2888         } else if (os_strncmp(buf, "STA ", 4) == 0) {
2889                 reply_len = hostapd_ctrl_iface_sta(hapd, buf + 4, reply,
2890                                                    reply_size);
2891         } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
2892                 reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
2893                                                         reply_size);
2894         } else if (os_strcmp(buf, "ATTACH") == 0) {
2895                 if (hostapd_ctrl_iface_attach(hapd, from, fromlen, NULL))
2896                         reply_len = -1;
2897         } else if (os_strncmp(buf, "ATTACH ", 7) == 0) {
2898                 if (hostapd_ctrl_iface_attach(hapd, from, fromlen, buf + 7))
2899                         reply_len = -1;
2900         } else if (os_strcmp(buf, "DETACH") == 0) {
2901                 if (hostapd_ctrl_iface_detach(hapd, from, fromlen))
2902                         reply_len = -1;
2903         } else if (os_strncmp(buf, "LEVEL ", 6) == 0) {
2904                 if (hostapd_ctrl_iface_level(hapd, from, fromlen,
2905                                                     buf + 6))
2906                         reply_len = -1;
2907         } else if (os_strncmp(buf, "NEW_STA ", 8) == 0) {
2908                 if (hostapd_ctrl_iface_new_sta(hapd, buf + 8))
2909                         reply_len = -1;
2910         } else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
2911                 if (hostapd_ctrl_iface_deauthenticate(hapd, buf + 15))
2912                         reply_len = -1;
2913         } else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
2914                 if (hostapd_ctrl_iface_disassociate(hapd, buf + 13))
2915                         reply_len = -1;
2916 #ifdef CONFIG_TAXONOMY
2917         } else if (os_strncmp(buf, "SIGNATURE ", 10) == 0) {
2918                 reply_len = hostapd_ctrl_iface_signature(hapd, buf + 10,
2919                                                          reply, reply_size);
2920 #endif /* CONFIG_TAXONOMY */
2921         } else if (os_strncmp(buf, "POLL_STA ", 9) == 0) {
2922                 if (hostapd_ctrl_iface_poll_sta(hapd, buf + 9))
2923                         reply_len = -1;
2924         } else if (os_strcmp(buf, "STOP_AP") == 0) {
2925                 if (hostapd_ctrl_iface_stop_ap(hapd))
2926                         reply_len = -1;
2927 #ifdef CONFIG_IEEE80211W
2928 #ifdef NEED_AP_MLME
2929         } else if (os_strncmp(buf, "SA_QUERY ", 9) == 0) {
2930                 if (hostapd_ctrl_iface_sa_query(hapd, buf + 9))
2931                         reply_len = -1;
2932 #endif /* NEED_AP_MLME */
2933 #endif /* CONFIG_IEEE80211W */
2934 #ifdef CONFIG_WPS
2935         } else if (os_strncmp(buf, "WPS_PIN ", 8) == 0) {
2936                 if (hostapd_ctrl_iface_wps_pin(hapd, buf + 8))
2937                         reply_len = -1;
2938         } else if (os_strncmp(buf, "WPS_CHECK_PIN ", 14) == 0) {
2939                 reply_len = hostapd_ctrl_iface_wps_check_pin(
2940                         hapd, buf + 14, reply, reply_size);
2941         } else if (os_strcmp(buf, "WPS_PBC") == 0) {
2942                 if (hostapd_wps_button_pushed(hapd, NULL))
2943                         reply_len = -1;
2944         } else if (os_strcmp(buf, "WPS_CANCEL") == 0) {
2945                 if (hostapd_wps_cancel(hapd))
2946                         reply_len = -1;
2947         } else if (os_strncmp(buf, "WPS_AP_PIN ", 11) == 0) {
2948                 reply_len = hostapd_ctrl_iface_wps_ap_pin(hapd, buf + 11,
2949                                                           reply, reply_size);
2950         } else if (os_strncmp(buf, "WPS_CONFIG ", 11) == 0) {
2951                 if (hostapd_ctrl_iface_wps_config(hapd, buf + 11) < 0)
2952                         reply_len = -1;
2953         } else if (os_strncmp(buf, "WPS_GET_STATUS", 13) == 0) {
2954                 reply_len = hostapd_ctrl_iface_wps_get_status(hapd, reply,
2955                                                               reply_size);
2956 #ifdef CONFIG_WPS_NFC
2957         } else if (os_strncmp(buf, "WPS_NFC_TAG_READ ", 17) == 0) {
2958                 if (hostapd_ctrl_iface_wps_nfc_tag_read(hapd, buf + 17))
2959                         reply_len = -1;
2960         } else if (os_strncmp(buf, "WPS_NFC_CONFIG_TOKEN ", 21) == 0) {
2961                 reply_len = hostapd_ctrl_iface_wps_nfc_config_token(
2962                         hapd, buf + 21, reply, reply_size);
2963         } else if (os_strncmp(buf, "WPS_NFC_TOKEN ", 14) == 0) {
2964                 reply_len = hostapd_ctrl_iface_wps_nfc_token(
2965                         hapd, buf + 14, reply, reply_size);
2966         } else if (os_strncmp(buf, "NFC_GET_HANDOVER_SEL ", 21) == 0) {
2967                 reply_len = hostapd_ctrl_iface_nfc_get_handover_sel(
2968                         hapd, buf + 21, reply, reply_size);
2969         } else if (os_strncmp(buf, "NFC_REPORT_HANDOVER ", 20) == 0) {
2970                 if (hostapd_ctrl_iface_nfc_report_handover(hapd, buf + 20))
2971                         reply_len = -1;
2972 #endif /* CONFIG_WPS_NFC */
2973 #endif /* CONFIG_WPS */
2974 #ifdef CONFIG_INTERWORKING
2975         } else if (os_strncmp(buf, "SET_QOS_MAP_SET ", 16) == 0) {
2976                 if (hostapd_ctrl_iface_set_qos_map_set(hapd, buf + 16))
2977                         reply_len = -1;
2978         } else if (os_strncmp(buf, "SEND_QOS_MAP_CONF ", 18) == 0) {
2979                 if (hostapd_ctrl_iface_send_qos_map_conf(hapd, buf + 18))
2980                         reply_len = -1;
2981 #endif /* CONFIG_INTERWORKING */
2982 #ifdef CONFIG_HS20
2983         } else if (os_strncmp(buf, "HS20_WNM_NOTIF ", 15) == 0) {
2984                 if (hostapd_ctrl_iface_hs20_wnm_notif(hapd, buf + 15))
2985                         reply_len = -1;
2986         } else if (os_strncmp(buf, "HS20_DEAUTH_REQ ", 16) == 0) {
2987                 if (hostapd_ctrl_iface_hs20_deauth_req(hapd, buf + 16))
2988                         reply_len = -1;
2989 #endif /* CONFIG_HS20 */
2990 #ifdef CONFIG_WNM_AP
2991         } else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
2992                 if (hostapd_ctrl_iface_disassoc_imminent(hapd, buf + 18))
2993                         reply_len = -1;
2994         } else if (os_strncmp(buf, "ESS_DISASSOC ", 13) == 0) {
2995                 if (hostapd_ctrl_iface_ess_disassoc(hapd, buf + 13))
2996                         reply_len = -1;
2997         } else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
2998                 if (hostapd_ctrl_iface_bss_tm_req(hapd, buf + 11))
2999                         reply_len = -1;
3000         } else if (os_strncmp(buf, "COLOC_INTF_REQ ", 15) == 0) {
3001                 if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
3002                         reply_len = -1;
3003 #endif /* CONFIG_WNM_AP */
3004         } else if (os_strcmp(buf, "GET_CONFIG") == 0) {
3005                 reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
3006                                                           reply_size);
3007         } else if (os_strncmp(buf, "SET ", 4) == 0) {
3008                 if (hostapd_ctrl_iface_set(hapd, buf + 4))
3009                         reply_len = -1;
3010         } else if (os_strncmp(buf, "GET ", 4) == 0) {
3011                 reply_len = hostapd_ctrl_iface_get(hapd, buf + 4, reply,
3012                                                    reply_size);
3013         } else if (os_strncmp(buf, "ENABLE", 6) == 0) {
3014                 if (hostapd_ctrl_iface_enable(hapd->iface))
3015                         reply_len = -1;
3016         } else if (os_strncmp(buf, "RELOAD", 6) == 0) {
3017                 if (hostapd_ctrl_iface_reload(hapd->iface))
3018                         reply_len = -1;
3019         } else if (os_strncmp(buf, "DISABLE", 7) == 0) {
3020                 if (hostapd_ctrl_iface_disable(hapd->iface))
3021                         reply_len = -1;
3022         } else if (os_strcmp(buf, "UPDATE_BEACON") == 0) {
3023                 if (ieee802_11_set_beacon(hapd))
3024                         reply_len = -1;
3025 #ifdef CONFIG_TESTING_OPTIONS
3026         } else if (os_strncmp(buf, "RADAR ", 6) == 0) {
3027                 if (hostapd_ctrl_iface_radar(hapd, buf + 6))
3028                         reply_len = -1;
3029         } else if (os_strncmp(buf, "MGMT_TX ", 8) == 0) {
3030                 if (hostapd_ctrl_iface_mgmt_tx(hapd, buf + 8))
3031                         reply_len = -1;
3032         } else if (os_strncmp(buf, "MGMT_TX_STATUS_PROCESS ", 23) == 0) {
3033                 if (hostapd_ctrl_iface_mgmt_tx_status_process(hapd,
3034                                                               buf + 23) < 0)
3035                         reply_len = -1;
3036         } else if (os_strncmp(buf, "MGMT_RX_PROCESS ", 16) == 0) {
3037                 if (hostapd_ctrl_iface_mgmt_rx_process(hapd, buf + 16) < 0)
3038                         reply_len = -1;
3039         } else if (os_strncmp(buf, "EAPOL_RX ", 9) == 0) {
3040                 if (hostapd_ctrl_iface_eapol_rx(hapd, buf + 9) < 0)
3041                         reply_len = -1;
3042         } else if (os_strncmp(buf, "DATA_TEST_CONFIG ", 17) == 0) {
3043                 if (hostapd_ctrl_iface_data_test_config(hapd, buf + 17) < 0)
3044                         reply_len = -1;
3045         } else if (os_strncmp(buf, "DATA_TEST_TX ", 13) == 0) {
3046                 if (hostapd_ctrl_iface_data_test_tx(hapd, buf + 13) < 0)
3047                         reply_len = -1;
3048         } else if (os_strncmp(buf, "DATA_TEST_FRAME ", 16) == 0) {
3049                 if (hostapd_ctrl_iface_data_test_frame(hapd, buf + 16) < 0)
3050                         reply_len = -1;
3051         } else if (os_strncmp(buf, "TEST_ALLOC_FAIL ", 16) == 0) {
3052                 if (hostapd_ctrl_test_alloc_fail(hapd, buf + 16) < 0)
3053                         reply_len = -1;
3054         } else if (os_strcmp(buf, "GET_ALLOC_FAIL") == 0) {
3055                 reply_len = hostapd_ctrl_get_alloc_fail(hapd, reply,
3056                                                         reply_size);
3057         } else if (os_strncmp(buf, "TEST_FAIL ", 10) == 0) {
3058                 if (hostapd_ctrl_test_fail(hapd, buf + 10) < 0)
3059                         reply_len = -1;
3060         } else if (os_strcmp(buf, "GET_FAIL") == 0) {
3061                 reply_len = hostapd_ctrl_get_fail(hapd, reply, reply_size);
3062         } else if (os_strncmp(buf, "RESET_PN ", 9) == 0) {
3063                 if (hostapd_ctrl_reset_pn(hapd, buf + 9) < 0)
3064                         reply_len = -1;
3065         } else if (os_strncmp(buf, "SET_KEY ", 8) == 0) {
3066                 if (hostapd_ctrl_set_key(hapd, buf + 8) < 0)
3067                         reply_len = -1;
3068         } else if (os_strncmp(buf, "RESEND_M1 ", 10) == 0) {
3069                 if (hostapd_ctrl_resend_m1(hapd, buf + 10) < 0)
3070                         reply_len = -1;
3071         } else if (os_strncmp(buf, "RESEND_M3 ", 10) == 0) {
3072                 if (hostapd_ctrl_resend_m3(hapd, buf + 10) < 0)
3073                         reply_len = -1;
3074         } else if (os_strncmp(buf, "RESEND_GROUP_M1 ", 16) == 0) {
3075                 if (hostapd_ctrl_resend_group_m1(hapd, buf + 16) < 0)
3076                         reply_len = -1;
3077         } else if (os_strcmp(buf, "REKEY_GTK") == 0) {
3078                 if (wpa_auth_rekey_gtk(hapd->wpa_auth) < 0)
3079                         reply_len = -1;
3080 #endif /* CONFIG_TESTING_OPTIONS */
3081         } else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
3082                 if (hostapd_ctrl_iface_chan_switch(hapd->iface, buf + 12))
3083                         reply_len = -1;
3084         } else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
3085                 reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply,
3086                                                       reply_size);
3087         } else if (os_strcmp(buf, "ERP_FLUSH") == 0) {
3088                 ieee802_1x_erp_flush(hapd);
3089 #ifdef RADIUS_SERVER
3090                 radius_server_erp_flush(hapd->radius_srv);
3091 #endif /* RADIUS_SERVER */
3092         } else if (os_strncmp(buf, "EAPOL_REAUTH ", 13) == 0) {
3093                 if (hostapd_ctrl_iface_eapol_reauth(hapd, buf + 13))
3094                         reply_len = -1;
3095         } else if (os_strncmp(buf, "EAPOL_SET ", 10) == 0) {
3096                 if (hostapd_ctrl_iface_eapol_set(hapd, buf + 10))
3097                         reply_len = -1;
3098         } else if (os_strncmp(buf, "LOG_LEVEL", 9) == 0) {
3099                 reply_len = hostapd_ctrl_iface_log_level(
3100                         hapd, buf + 9, reply, reply_size);
3101 #ifdef NEED_AP_MLME
3102         } else if (os_strcmp(buf, "TRACK_STA_LIST") == 0) {
3103                 reply_len = hostapd_ctrl_iface_track_sta_list(
3104                         hapd, reply, reply_size);
3105 #endif /* NEED_AP_MLME */
3106         } else if (os_strcmp(buf, "PMKSA") == 0) {
3107                 reply_len = hostapd_ctrl_iface_pmksa_list(hapd, reply,
3108                                                           reply_size);
3109         } else if (os_strcmp(buf, "PMKSA_FLUSH") == 0) {
3110                 hostapd_ctrl_iface_pmksa_flush(hapd);
3111         } else if (os_strncmp(buf, "PMKSA_ADD ", 10) == 0) {
3112                 if (hostapd_ctrl_iface_pmksa_add(hapd, buf + 10) < 0)
3113                         reply_len = -1;
3114         } else if (os_strncmp(buf, "SET_NEIGHBOR ", 13) == 0) {
3115                 if (hostapd_ctrl_iface_set_neighbor(hapd, buf + 13))
3116                         reply_len = -1;
3117         } else if (os_strncmp(buf, "REMOVE_NEIGHBOR ", 16) == 0) {
3118                 if (hostapd_ctrl_iface_remove_neighbor(hapd, buf + 16))
3119                         reply_len = -1;
3120         } else if (os_strncmp(buf, "REQ_LCI ", 8) == 0) {
3121                 if (hostapd_ctrl_iface_req_lci(hapd, buf + 8))
3122                         reply_len = -1;
3123         } else if (os_strncmp(buf, "REQ_RANGE ", 10) == 0) {
3124                 if (hostapd_ctrl_iface_req_range(hapd, buf + 10))
3125                         reply_len = -1;
3126         } else if (os_strncmp(buf, "REQ_BEACON ", 11) == 0) {
3127                 reply_len = hostapd_ctrl_iface_req_beacon(hapd, buf + 11,
3128                                                           reply, reply_size);
3129         } else if (os_strcmp(buf, "DRIVER_FLAGS") == 0) {
3130                 reply_len = hostapd_ctrl_driver_flags(hapd->iface, reply,
3131                                                       reply_size);
3132         } else if (os_strcmp(buf, "TERMINATE") == 0) {
3133                 eloop_terminate();
3134         } else if (os_strncmp(buf, "ACCEPT_ACL ", 11) == 0) {
3135                 if (os_strncmp(buf + 11, "ADD_MAC ", 8) == 0) {
3136                         if (!hostapd_ctrl_iface_acl_add_mac(
3137                                     &hapd->conf->accept_mac,
3138                                     &hapd->conf->num_accept_mac, buf + 19))
3139                                 hostapd_disassoc_accept_mac(hapd);
3140                         else
3141                                 reply_len = -1;
3142                 } else if (os_strncmp((buf + 11), "DEL_MAC ", 8) == 0) {
3143                         hostapd_ctrl_iface_acl_del_mac(
3144                                 &hapd->conf->accept_mac,
3145                                 &hapd->conf->num_accept_mac, buf + 19);
3146                 } else if (os_strcmp(buf + 11, "SHOW") == 0) {
3147                         reply_len = hostapd_ctrl_iface_acl_show_mac(
3148                                 hapd->conf->accept_mac,
3149                                 hapd->conf->num_accept_mac, reply, reply_size);
3150                 } else if (os_strcmp(buf + 11, "CLEAR") == 0) {
3151                         hostapd_ctrl_iface_acl_clear_list(
3152                                 &hapd->conf->accept_mac,
3153                                 &hapd->conf->num_accept_mac);
3154                 }
3155         } else if (os_strncmp(buf, "DENY_ACL ", 9) == 0) {
3156                 if (os_strncmp(buf + 9, "ADD_MAC ", 8) == 0) {
3157                         if (!hostapd_ctrl_iface_acl_add_mac(
3158                                     &hapd->conf->deny_mac,
3159                                     &hapd->conf->num_deny_mac, buf + 17))
3160                                 hostapd_disassoc_deny_mac(hapd);
3161                 } else if (os_strncmp(buf + 9, "DEL_MAC ", 8) == 0) {
3162                         hostapd_ctrl_iface_acl_del_mac(
3163                                 &hapd->conf->deny_mac,
3164                                 &hapd->conf->num_deny_mac, buf + 17);
3165                 } else if (os_strcmp(buf + 9, "SHOW") == 0) {
3166                         reply_len = hostapd_ctrl_iface_acl_show_mac(
3167                                 hapd->conf->deny_mac,
3168                                 hapd->conf->num_deny_mac, reply, reply_size);
3169                 } else if (os_strcmp(buf + 9, "CLEAR") == 0) {
3170                         hostapd_ctrl_iface_acl_clear_list(
3171                                 &hapd->conf->deny_mac,
3172                                 &hapd->conf->num_deny_mac);
3173                 }
3174 #ifdef CONFIG_DPP
3175         } else if (os_strncmp(buf, "DPP_QR_CODE ", 12) == 0) {
3176                 res = hostapd_dpp_qr_code(hapd, buf + 12);
3177                 if (res < 0) {
3178                         reply_len = -1;
3179                 } else {
3180                         reply_len = os_snprintf(reply, reply_size, "%d", res);
3181                         if (os_snprintf_error(reply_size, reply_len))
3182                                 reply_len = -1;
3183                 }
3184         } else if (os_strncmp(buf, "DPP_BOOTSTRAP_GEN ", 18) == 0) {
3185                 res = hostapd_dpp_bootstrap_gen(hapd, buf + 18);
3186                 if (res < 0) {
3187                         reply_len = -1;
3188                 } else {
3189                         reply_len = os_snprintf(reply, reply_size, "%d", res);
3190                         if (os_snprintf_error(reply_size, reply_len))
3191                                 reply_len = -1;
3192                 }
3193         } else if (os_strncmp(buf, "DPP_BOOTSTRAP_REMOVE ", 21) == 0) {
3194                 if (hostapd_dpp_bootstrap_remove(hapd, buf + 21) < 0)
3195                         reply_len = -1;
3196         } else if (os_strncmp(buf, "DPP_BOOTSTRAP_GET_URI ", 22) == 0) {
3197                 const char *uri;
3198
3199                 uri = hostapd_dpp_bootstrap_get_uri(hapd, atoi(buf + 22));
3200                 if (!uri) {
3201                         reply_len = -1;
3202                 } else {
3203                         reply_len = os_snprintf(reply, reply_size, "%s", uri);
3204                         if (os_snprintf_error(reply_size, reply_len))
3205                                 reply_len = -1;
3206                 }
3207         } else if (os_strncmp(buf, "DPP_BOOTSTRAP_INFO ", 19) == 0) {
3208                 reply_len = hostapd_dpp_bootstrap_info(hapd, atoi(buf + 19),
3209                                                        reply, reply_size);
3210         } else if (os_strncmp(buf, "DPP_AUTH_INIT ", 14) == 0) {
3211                 if (hostapd_dpp_auth_init(hapd, buf + 13) < 0)
3212                         reply_len = -1;
3213         } else if (os_strncmp(buf, "DPP_LISTEN ", 11) == 0) {
3214                 if (hostapd_dpp_listen(hapd, buf + 11) < 0)
3215                         reply_len = -1;
3216         } else if (os_strcmp(buf, "DPP_STOP_LISTEN") == 0) {
3217                 hostapd_dpp_stop(hapd);
3218                 hostapd_dpp_listen_stop(hapd);
3219         } else if (os_strncmp(buf, "DPP_CONFIGURATOR_ADD", 20) == 0) {
3220                 res = hostapd_dpp_configurator_add(hapd, buf + 20);
3221                 if (res < 0) {
3222                         reply_len = -1;
3223                 } else {
3224                         reply_len = os_snprintf(reply, reply_size, "%d", res);
3225                         if (os_snprintf_error(reply_size, reply_len))
3226                                 reply_len = -1;
3227                 }
3228         } else if (os_strncmp(buf, "DPP_CONFIGURATOR_REMOVE ", 24) == 0) {
3229                 if (hostapd_dpp_configurator_remove(hapd, buf + 24) < 0)
3230                         reply_len = -1;
3231         } else if (os_strncmp(buf, "DPP_CONFIGURATOR_SIGN ", 22) == 0) {
3232                 if (hostapd_dpp_configurator_sign(hapd, buf + 22) < 0)
3233                         reply_len = -1;
3234         } else if (os_strncmp(buf, "DPP_CONFIGURATOR_GET_KEY ", 25) == 0) {
3235                 reply_len = hostapd_dpp_configurator_get_key(hapd,
3236                                                              atoi(buf + 25),
3237                                                              reply, reply_size);
3238         } else if (os_strncmp(buf, "DPP_PKEX_ADD ", 13) == 0) {
3239                 res = hostapd_dpp_pkex_add(hapd, buf + 12);
3240                 if (res < 0) {
3241                         reply_len = -1;
3242                 } else {
3243                         reply_len = os_snprintf(reply, reply_size, "%d", res);
3244                         if (os_snprintf_error(reply_size, reply_len))
3245                                 reply_len = -1;
3246                 }
3247         } else if (os_strncmp(buf, "DPP_PKEX_REMOVE ", 16) == 0) {
3248                 if (hostapd_dpp_pkex_remove(hapd, buf + 16) < 0)
3249                         reply_len = -1;
3250 #endif /* CONFIG_DPP */
3251 #ifdef RADIUS_SERVER
3252         } else if (os_strncmp(buf, "DAC_REQUEST ", 12) == 0) {
3253                 if (radius_server_dac_request(hapd->radius_srv, buf + 12) < 0)
3254                         reply_len = -1;
3255 #endif /* RADIUS_SERVER */
3256         } else {
3257                 os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
3258                 reply_len = 16;
3259         }
3260
3261         if (reply_len < 0) {
3262                 os_memcpy(reply, "FAIL\n", 5);
3263                 reply_len = 5;
3264         }
3265
3266         return reply_len;
3267 }
3268
3269
3270 static void hostapd_ctrl_iface_receive(int sock, void *eloop_ctx,
3271                                        void *sock_ctx)
3272 {
3273         struct hostapd_data *hapd = eloop_ctx;
3274         char buf[4096];
3275         int res;
3276         struct sockaddr_storage from;
3277         socklen_t fromlen = sizeof(from);
3278         char *reply, *pos = buf;
3279         const int reply_size = 4096;
3280         int reply_len;
3281         int level = MSG_DEBUG;
3282 #ifdef CONFIG_CTRL_IFACE_UDP
3283         unsigned char lcookie[COOKIE_LEN];
3284 #endif /* CONFIG_CTRL_IFACE_UDP */
3285
3286         res = recvfrom(sock, buf, sizeof(buf) - 1, 0,
3287                        (struct sockaddr *) &from, &fromlen);
3288         if (res < 0) {
3289                 wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s",
3290                            strerror(errno));
3291                 return;
3292         }
3293         buf[res] = '\0';
3294
3295         reply = os_malloc(reply_size);
3296         if (reply == NULL) {
3297                 if (sendto(sock, "FAIL\n", 5, 0, (struct sockaddr *) &from,
3298                            fromlen) < 0) {
3299                         wpa_printf(MSG_DEBUG, "CTRL: sendto failed: %s",
3300                                    strerror(errno));
3301                 }
3302                 return;
3303         }
3304
3305 #ifdef CONFIG_CTRL_IFACE_UDP
3306         if (os_strcmp(buf, "GET_COOKIE") == 0) {
3307                 os_memcpy(reply, "COOKIE=", 7);
3308                 wpa_snprintf_hex(reply + 7, 2 * COOKIE_LEN + 1,
3309                                  cookie, COOKIE_LEN);
3310                 reply_len = 7 + 2 * COOKIE_LEN;
3311                 goto done;
3312         }
3313
3314         if (os_strncmp(buf, "COOKIE=", 7) != 0 ||
3315             hexstr2bin(buf + 7, lcookie, COOKIE_LEN) < 0) {
3316                 wpa_printf(MSG_DEBUG,
3317                            "CTRL: No cookie in the request - drop request");
3318                 os_free(reply);
3319                 return;
3320         }
3321
3322         if (os_memcmp(cookie, lcookie, COOKIE_LEN) != 0) {
3323                 wpa_printf(MSG_DEBUG,
3324                            "CTRL: Invalid cookie in the request - drop request");
3325                 os_free(reply);
3326                 return;
3327         }
3328
3329         pos = buf + 7 + 2 * COOKIE_LEN;
3330         while (*pos == ' ')
3331                 pos++;
3332 #endif /* CONFIG_CTRL_IFACE_UDP */
3333
3334         if (os_strcmp(pos, "PING") == 0)
3335                 level = MSG_EXCESSIVE;
3336         wpa_hexdump_ascii(level, "RX ctrl_iface", pos, res);
3337
3338         reply_len = hostapd_ctrl_iface_receive_process(hapd, pos,
3339                                                        reply, reply_size,
3340                                                        &from, fromlen);
3341
3342 #ifdef CONFIG_CTRL_IFACE_UDP
3343 done:
3344 #endif /* CONFIG_CTRL_IFACE_UDP */
3345         if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
3346                    fromlen) < 0) {
3347                 wpa_printf(MSG_DEBUG, "CTRL: sendto failed: %s",
3348                            strerror(errno));
3349         }
3350         os_free(reply);
3351 }
3352
3353
3354 #ifndef CONFIG_CTRL_IFACE_UDP
3355 static char * hostapd_ctrl_iface_path(struct hostapd_data *hapd)
3356 {
3357         char *buf;
3358         size_t len;
3359
3360         if (hapd->conf->ctrl_interface == NULL)
3361                 return NULL;
3362
3363         len = os_strlen(hapd->conf->ctrl_interface) +
3364                 os_strlen(hapd->conf->iface) + 2;
3365         buf = os_malloc(len);
3366         if (buf == NULL)
3367                 return NULL;
3368
3369         os_snprintf(buf, len, "%s/%s",
3370                     hapd->conf->ctrl_interface, hapd->conf->iface);
3371         buf[len - 1] = '\0';
3372         return buf;
3373 }
3374 #endif /* CONFIG_CTRL_IFACE_UDP */
3375
3376
3377 static void hostapd_ctrl_iface_msg_cb(void *ctx, int level,
3378                                       enum wpa_msg_type type,
3379                                       const char *txt, size_t len)
3380 {
3381         struct hostapd_data *hapd = ctx;
3382         if (hapd == NULL)
3383                 return;
3384         hostapd_ctrl_iface_send(hapd, level, type, txt, len);
3385 }
3386
3387
3388 int hostapd_ctrl_iface_init(struct hostapd_data *hapd)
3389 {
3390 #ifdef CONFIG_CTRL_IFACE_UDP
3391         int port = HOSTAPD_CTRL_IFACE_PORT;
3392         char p[32] = { 0 };
3393         char port_str[40], *tmp;
3394         char *pos;
3395         struct addrinfo hints = { 0 }, *res, *saveres;
3396         int n;
3397
3398         if (hapd->ctrl_sock > -1) {
3399                 wpa_printf(MSG_DEBUG, "ctrl_iface already exists!");
3400                 return 0;
3401         }
3402
3403         if (hapd->conf->ctrl_interface == NULL)
3404                 return 0;
3405
3406         pos = os_strstr(hapd->conf->ctrl_interface, "udp:");
3407         if (pos) {
3408                 pos += 4;
3409                 port = atoi(pos);
3410                 if (port <= 0) {
3411                         wpa_printf(MSG_ERROR, "Invalid ctrl_iface UDP port");
3412                         goto fail;
3413                 }
3414         }
3415
3416         dl_list_init(&hapd->ctrl_dst);
3417         hapd->ctrl_sock = -1;
3418         os_get_random(cookie, COOKIE_LEN);
3419
3420 #ifdef CONFIG_CTRL_IFACE_UDP_REMOTE
3421         hints.ai_flags = AI_PASSIVE;
3422 #endif /* CONFIG_CTRL_IFACE_UDP_REMOTE */
3423
3424 #ifdef CONFIG_CTRL_IFACE_UDP_IPV6
3425         hints.ai_family = AF_INET6;
3426 #else /* CONFIG_CTRL_IFACE_UDP_IPV6 */
3427         hints.ai_family = AF_INET;
3428 #endif /* CONFIG_CTRL_IFACE_UDP_IPV6 */
3429         hints.ai_socktype = SOCK_DGRAM;
3430
3431 try_again:
3432         os_snprintf(p, sizeof(p), "%d", port);
3433         n = getaddrinfo(NULL, p, &hints, &res);
3434         if (n) {
3435                 wpa_printf(MSG_ERROR, "getaddrinfo(): %s", gai_strerror(n));
3436                 goto fail;
3437         }
3438
3439         saveres = res;
3440         hapd->ctrl_sock = socket(res->ai_family, res->ai_socktype,
3441                                  res->ai_protocol);
3442         if (hapd->ctrl_sock < 0) {
3443                 wpa_printf(MSG_ERROR, "socket(PF_INET): %s", strerror(errno));
3444                 goto fail;
3445         }
3446
3447         if (bind(hapd->ctrl_sock, res->ai_addr, res->ai_addrlen) < 0) {
3448                 port--;
3449                 if ((HOSTAPD_CTRL_IFACE_PORT - port) <
3450                     HOSTAPD_CTRL_IFACE_PORT_LIMIT && !pos)
3451                         goto try_again;
3452                 wpa_printf(MSG_ERROR, "bind(AF_INET): %s", strerror(errno));
3453                 goto fail;
3454         }
3455
3456         freeaddrinfo(saveres);
3457
3458         os_snprintf(port_str, sizeof(port_str), "udp:%d", port);
3459         tmp = os_strdup(port_str);
3460         if (tmp) {
3461                 os_free(hapd->conf->ctrl_interface);
3462                 hapd->conf->ctrl_interface = tmp;
3463         }
3464         wpa_printf(MSG_DEBUG, "ctrl_iface_init UDP port: %d", port);
3465
3466         if (eloop_register_read_sock(hapd->ctrl_sock,
3467                                      hostapd_ctrl_iface_receive, hapd, NULL) <
3468             0) {
3469                 hostapd_ctrl_iface_deinit(hapd);
3470                 return -1;
3471         }
3472
3473         hapd->msg_ctx = hapd;
3474         wpa_msg_register_cb(hostapd_ctrl_iface_msg_cb);
3475
3476         return 0;
3477
3478 fail:
3479         if (hapd->ctrl_sock >= 0)
3480                 close(hapd->ctrl_sock);
3481         return -1;
3482 #else /* CONFIG_CTRL_IFACE_UDP */
3483         struct sockaddr_un addr;
3484         int s = -1;
3485         char *fname = NULL;
3486
3487         if (hapd->ctrl_sock > -1) {
3488                 wpa_printf(MSG_DEBUG, "ctrl_iface already exists!");
3489                 return 0;
3490         }
3491
3492         dl_list_init(&hapd->ctrl_dst);
3493
3494         if (hapd->conf->ctrl_interface == NULL)
3495                 return 0;
3496
3497         if (mkdir(hapd->conf->ctrl_interface, S_IRWXU | S_IRWXG) < 0) {
3498                 if (errno == EEXIST) {
3499                         wpa_printf(MSG_DEBUG, "Using existing control "
3500                                    "interface directory.");
3501                 } else {
3502                         wpa_printf(MSG_ERROR, "mkdir[ctrl_interface]: %s",
3503                                    strerror(errno));
3504                         goto fail;
3505                 }
3506         }
3507
3508         if (hapd->conf->ctrl_interface_gid_set &&
3509             chown(hapd->conf->ctrl_interface, -1,
3510                   hapd->conf->ctrl_interface_gid) < 0) {
3511                 wpa_printf(MSG_ERROR, "chown[ctrl_interface]: %s",
3512                            strerror(errno));
3513                 return -1;
3514         }
3515
3516         if (!hapd->conf->ctrl_interface_gid_set &&
3517             hapd->iface->interfaces->ctrl_iface_group &&
3518             chown(hapd->conf->ctrl_interface, -1,
3519                   hapd->iface->interfaces->ctrl_iface_group) < 0) {
3520                 wpa_printf(MSG_ERROR, "chown[ctrl_interface]: %s",
3521                            strerror(errno));
3522                 return -1;
3523         }
3524
3525 #ifdef ANDROID
3526         /*
3527          * Android is using umask 0077 which would leave the control interface
3528          * directory without group access. This breaks things since Wi-Fi
3529          * framework assumes that this directory can be accessed by other
3530          * applications in the wifi group. Fix this by adding group access even
3531          * if umask value would prevent this.
3532          */
3533         if (chmod(hapd->conf->ctrl_interface, S_IRWXU | S_IRWXG) < 0) {
3534                 wpa_printf(MSG_ERROR, "CTRL: Could not chmod directory: %s",
3535                            strerror(errno));
3536                 /* Try to continue anyway */
3537         }
3538 #endif /* ANDROID */
3539
3540         if (os_strlen(hapd->conf->ctrl_interface) + 1 +
3541             os_strlen(hapd->conf->iface) >= sizeof(addr.sun_path))
3542                 goto fail;
3543
3544         s = socket(PF_UNIX, SOCK_DGRAM, 0);
3545         if (s < 0) {
3546                 wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno));
3547                 goto fail;
3548         }
3549
3550         os_memset(&addr, 0, sizeof(addr));
3551 #ifdef __FreeBSD__
3552         addr.sun_len = sizeof(addr);
3553 #endif /* __FreeBSD__ */
3554         addr.sun_family = AF_UNIX;
3555         fname = hostapd_ctrl_iface_path(hapd);
3556         if (fname == NULL)
3557                 goto fail;
3558         os_strlcpy(addr.sun_path, fname, sizeof(addr.sun_path));
3559         if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
3560                 wpa_printf(MSG_DEBUG, "ctrl_iface bind(PF_UNIX) failed: %s",
3561                            strerror(errno));
3562                 if (connect(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
3563                         wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not"
3564                                    " allow connections - assuming it was left"
3565                                    "over from forced program termination");
3566                         if (unlink(fname) < 0) {
3567                                 wpa_printf(MSG_ERROR,
3568                                            "Could not unlink existing ctrl_iface socket '%s': %s",
3569                                            fname, strerror(errno));
3570                                 goto fail;
3571                         }
3572                         if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) <
3573                             0) {
3574                                 wpa_printf(MSG_ERROR,
3575                                            "hostapd-ctrl-iface: bind(PF_UNIX): %s",
3576                                            strerror(errno));
3577                                 goto fail;
3578                         }
3579                         wpa_printf(MSG_DEBUG, "Successfully replaced leftover "
3580                                    "ctrl_iface socket '%s'", fname);
3581                 } else {
3582                         wpa_printf(MSG_INFO, "ctrl_iface exists and seems to "
3583                                    "be in use - cannot override it");
3584                         wpa_printf(MSG_INFO, "Delete '%s' manually if it is "
3585                                    "not used anymore", fname);
3586                         os_free(fname);
3587                         fname = NULL;
3588                         goto fail;
3589                 }
3590         }
3591
3592         if (hapd->conf->ctrl_interface_gid_set &&
3593             chown(fname, -1, hapd->conf->ctrl_interface_gid) < 0) {
3594                 wpa_printf(MSG_ERROR, "chown[ctrl_interface/ifname]: %s",
3595                            strerror(errno));
3596                 goto fail;
3597         }
3598
3599         if (!hapd->conf->ctrl_interface_gid_set &&
3600             hapd->iface->interfaces->ctrl_iface_group &&
3601             chown(fname, -1, hapd->iface->interfaces->ctrl_iface_group) < 0) {
3602                 wpa_printf(MSG_ERROR, "chown[ctrl_interface/ifname]: %s",
3603                            strerror(errno));
3604                 goto fail;
3605         }
3606
3607         if (chmod(fname, S_IRWXU | S_IRWXG) < 0) {
3608                 wpa_printf(MSG_ERROR, "chmod[ctrl_interface/ifname]: %s",
3609                            strerror(errno));
3610                 goto fail;
3611         }
3612         os_free(fname);
3613
3614         hapd->ctrl_sock = s;
3615         if (eloop_register_read_sock(s, hostapd_ctrl_iface_receive, hapd,
3616                                      NULL) < 0) {
3617                 hostapd_ctrl_iface_deinit(hapd);
3618                 return -1;
3619         }
3620         hapd->msg_ctx = hapd;
3621         wpa_msg_register_cb(hostapd_ctrl_iface_msg_cb);
3622
3623         return 0;
3624
3625 fail:
3626         if (s >= 0)
3627                 close(s);
3628         if (fname) {
3629                 unlink(fname);
3630                 os_free(fname);
3631         }
3632         return -1;
3633 #endif /* CONFIG_CTRL_IFACE_UDP */
3634 }
3635
3636
3637 void hostapd_ctrl_iface_deinit(struct hostapd_data *hapd)
3638 {
3639         struct wpa_ctrl_dst *dst, *prev;
3640
3641         if (hapd->ctrl_sock > -1) {
3642 #ifndef CONFIG_CTRL_IFACE_UDP
3643                 char *fname;
3644 #endif /* !CONFIG_CTRL_IFACE_UDP */
3645
3646                 eloop_unregister_read_sock(hapd->ctrl_sock);
3647                 close(hapd->ctrl_sock);
3648                 hapd->ctrl_sock = -1;
3649 #ifndef CONFIG_CTRL_IFACE_UDP
3650                 fname = hostapd_ctrl_iface_path(hapd);
3651                 if (fname)
3652                         unlink(fname);
3653                 os_free(fname);
3654
3655                 if (hapd->conf->ctrl_interface &&
3656                     rmdir(hapd->conf->ctrl_interface) < 0) {
3657                         if (errno == ENOTEMPTY) {
3658                                 wpa_printf(MSG_DEBUG, "Control interface "
3659                                            "directory not empty - leaving it "
3660                                            "behind");
3661                         } else {
3662                                 wpa_printf(MSG_ERROR,
3663                                            "rmdir[ctrl_interface=%s]: %s",
3664                                            hapd->conf->ctrl_interface,
3665                                            strerror(errno));
3666                         }
3667                 }
3668 #endif /* !CONFIG_CTRL_IFACE_UDP */
3669         }
3670
3671         dl_list_for_each_safe(dst, prev, &hapd->ctrl_dst, struct wpa_ctrl_dst,
3672                               list)
3673                 os_free(dst);
3674
3675 #ifdef CONFIG_TESTING_OPTIONS
3676         l2_packet_deinit(hapd->l2_test);
3677         hapd->l2_test = NULL;
3678 #endif /* CONFIG_TESTING_OPTIONS */
3679 }
3680
3681
3682 static int hostapd_ctrl_iface_add(struct hapd_interfaces *interfaces,
3683                                   char *buf)
3684 {
3685         if (hostapd_add_iface(interfaces, buf) < 0) {
3686                 wpa_printf(MSG_ERROR, "Adding interface %s failed", buf);
3687                 return -1;
3688         }
3689         return 0;
3690 }
3691
3692
3693 static int hostapd_ctrl_iface_remove(struct hapd_interfaces *interfaces,
3694                                      char *buf)
3695 {
3696         if (hostapd_remove_iface(interfaces, buf) < 0) {
3697                 wpa_printf(MSG_ERROR, "Removing interface %s failed", buf);
3698                 return -1;
3699         }
3700         return 0;
3701 }
3702
3703
3704 static int hostapd_global_ctrl_iface_attach(struct hapd_interfaces *interfaces,
3705                                             struct sockaddr_storage *from,
3706                                             socklen_t fromlen, char *input)
3707 {
3708         return ctrl_iface_attach(&interfaces->global_ctrl_dst, from, fromlen,
3709                                  input);
3710 }
3711
3712
3713 static int hostapd_global_ctrl_iface_detach(struct hapd_interfaces *interfaces,
3714                                             struct sockaddr_storage *from,
3715                                             socklen_t fromlen)
3716 {
3717         return ctrl_iface_detach(&interfaces->global_ctrl_dst, from, fromlen);
3718 }
3719
3720
3721 static void hostapd_ctrl_iface_flush(struct hapd_interfaces *interfaces)
3722 {
3723 #ifdef CONFIG_WPS_TESTING
3724         wps_version_number = 0x20;
3725         wps_testing_dummy_cred = 0;
3726         wps_corrupt_pkhash = 0;
3727 #endif /* CONFIG_WPS_TESTING */
3728
3729 #ifdef CONFIG_TESTING_OPTIONS
3730 #ifdef CONFIG_DPP
3731         dpp_test = DPP_TEST_DISABLED;
3732 #endif /* CONFIG_DPP */
3733 #endif /* CONFIG_TESTING_OPTIONS */
3734
3735 #ifdef CONFIG_DPP
3736         hostapd_dpp_deinit_global(interfaces);
3737 #endif /* CONFIG_DPP */
3738 }
3739
3740
3741 #ifdef CONFIG_FST
3742
3743 static int
3744 hostapd_global_ctrl_iface_fst_attach(struct hapd_interfaces *interfaces,
3745                                      const char *cmd)
3746 {
3747         char ifname[IFNAMSIZ + 1];
3748         struct fst_iface_cfg cfg;
3749         struct hostapd_data *hapd;
3750         struct fst_wpa_obj iface_obj;
3751
3752         if (!fst_parse_attach_command(cmd, ifname, sizeof(ifname), &cfg)) {
3753                 hapd = hostapd_get_iface(interfaces, ifname);
3754                 if (hapd) {
3755                         if (hapd->iface->fst) {
3756                                 wpa_printf(MSG_INFO, "FST: Already attached");
3757                                 return -1;
3758                         }
3759                         fst_hostapd_fill_iface_obj(hapd, &iface_obj);
3760                         hapd->iface->fst = fst_attach(ifname, hapd->own_addr,
3761                                                       &iface_obj, &cfg);
3762                         if (hapd->iface->fst)
3763                                 return 0;
3764                 }
3765         }
3766
3767         return -EINVAL;
3768 }
3769
3770
3771 static int
3772 hostapd_global_ctrl_iface_fst_detach(struct hapd_interfaces *interfaces,
3773                                      const char *cmd)
3774 {
3775         char ifname[IFNAMSIZ + 1];
3776         struct hostapd_data * hapd;
3777
3778         if (!fst_parse_detach_command(cmd, ifname, sizeof(ifname))) {
3779                 hapd = hostapd_get_iface(interfaces, ifname);
3780                 if (hapd) {
3781                         if (!fst_iface_detach(ifname)) {
3782                                 hapd->iface->fst = NULL;
3783                                 hapd->iface->fst_ies = NULL;
3784                                 return 0;
3785                         }
3786                 }
3787         }
3788
3789         return -EINVAL;
3790 }
3791
3792 #endif /* CONFIG_FST */
3793
3794
3795 static struct hostapd_data *
3796 hostapd_interfaces_get_hapd(struct hapd_interfaces *interfaces,
3797                             const char *ifname)
3798 {
3799         size_t i, j;
3800
3801         for (i = 0; i < interfaces->count; i++) {
3802                 struct hostapd_iface *iface = interfaces->iface[i];
3803
3804                 for (j = 0; j < iface->num_bss; j++) {
3805                         struct hostapd_data *hapd;
3806
3807                         hapd = iface->bss[j];
3808                         if (os_strcmp(ifname, hapd->conf->iface) == 0)
3809                                 return hapd;
3810                 }
3811         }
3812
3813         return NULL;
3814 }
3815
3816
3817 static int hostapd_ctrl_iface_dup_param(struct hostapd_data *src_hapd,
3818                                         struct hostapd_data *dst_hapd,
3819                                         const char *param)
3820 {
3821         int res;
3822         char *value;
3823
3824         value = os_zalloc(HOSTAPD_CLI_DUP_VALUE_MAX_LEN);
3825         if (!value) {
3826                 wpa_printf(MSG_ERROR,
3827                            "DUP: cannot allocate buffer to stringify %s",
3828                            param);
3829                 goto error_return;
3830         }
3831
3832         if (os_strcmp(param, "wpa") == 0) {
3833                 os_snprintf(value, HOSTAPD_CLI_DUP_VALUE_MAX_LEN, "%d",
3834                             src_hapd->conf->wpa);
3835         } else if (os_strcmp(param, "wpa_key_mgmt") == 0 &&
3836                    src_hapd->conf->wpa_key_mgmt) {
3837                 res = hostapd_ctrl_iface_get_key_mgmt(
3838                         src_hapd, value, HOSTAPD_CLI_DUP_VALUE_MAX_LEN);
3839                 if (os_snprintf_error(HOSTAPD_CLI_DUP_VALUE_MAX_LEN, res))
3840                         goto error_stringify;
3841         } else if (os_strcmp(param, "wpa_pairwise") == 0 &&
3842                    src_hapd->conf->wpa_pairwise) {
3843                 res = wpa_write_ciphers(value,
3844                                         value + HOSTAPD_CLI_DUP_VALUE_MAX_LEN,
3845                                         src_hapd->conf->wpa_pairwise, " ");
3846                 if (res < 0)
3847                         goto error_stringify;
3848         } else if (os_strcmp(param, "rsn_pairwise") == 0 &&
3849                    src_hapd->conf->rsn_pairwise) {
3850                 res = wpa_write_ciphers(value,
3851                                         value + HOSTAPD_CLI_DUP_VALUE_MAX_LEN,
3852                                         src_hapd->conf->rsn_pairwise, " ");
3853                 if (res < 0)
3854                         goto error_stringify;
3855         } else if (os_strcmp(param, "wpa_passphrase") == 0 &&
3856                    src_hapd->conf->ssid.wpa_passphrase) {
3857                 os_snprintf(value, HOSTAPD_CLI_DUP_VALUE_MAX_LEN, "%s",
3858                             src_hapd->conf->ssid.wpa_passphrase);
3859         } else if (os_strcmp(param, "wpa_psk") == 0 &&
3860                    src_hapd->conf->ssid.wpa_psk_set) {
3861                 wpa_snprintf_hex(value, HOSTAPD_CLI_DUP_VALUE_MAX_LEN,
3862                         src_hapd->conf->ssid.wpa_psk->psk, PMK_LEN);
3863         } else {
3864                 wpa_printf(MSG_WARNING, "DUP: %s cannot be duplicated", param);
3865                 goto error_return;
3866         }
3867
3868         res = hostapd_set_iface(dst_hapd->iconf, dst_hapd->conf, param, value);
3869         os_free(value);
3870         return res;
3871
3872 error_stringify:
3873         wpa_printf(MSG_ERROR, "DUP: cannot stringify %s", param);
3874 error_return:
3875         os_free(value);
3876         return -1;
3877 }
3878
3879
3880 static int
3881 hostapd_global_ctrl_iface_interfaces(struct hapd_interfaces *interfaces,
3882                                      const char *input,
3883                                      char *reply, int reply_size)
3884 {
3885         size_t i, j;
3886         int res;
3887         char *pos, *end;
3888         struct hostapd_iface *iface;
3889         int show_ctrl = 0;
3890
3891         if (input)
3892                 show_ctrl = !!os_strstr(input, "ctrl");
3893
3894         pos = reply;
3895         end = reply + reply_size;
3896
3897         for (i = 0; i < interfaces->count; i++) {
3898                 iface = interfaces->iface[i];
3899
3900                 for (j = 0; j < iface->num_bss; j++) {
3901                         struct hostapd_bss_config *conf;
3902
3903                         conf = iface->conf->bss[j];
3904                         if (show_ctrl)
3905                                 res = os_snprintf(pos, end - pos,
3906                                                   "%s ctrl_iface=%s\n",
3907                                                   conf->iface,
3908                                                   conf->ctrl_interface ?
3909                                                   conf->ctrl_interface : "N/A");
3910                         else
3911                                 res = os_snprintf(pos, end - pos, "%s\n",
3912                                                   conf->iface);
3913                         if (os_snprintf_error(end - pos, res)) {
3914                                 *pos = '\0';
3915                                 return pos - reply;
3916                         }
3917                         pos += res;
3918                 }
3919         }
3920
3921         return pos - reply;
3922 }
3923
3924
3925 static int
3926 hostapd_global_ctrl_iface_dup_network(struct hapd_interfaces *interfaces,
3927                                       char *cmd)
3928 {
3929         char *p_start = cmd, *p_end;
3930         struct hostapd_data *src_hapd, *dst_hapd;
3931
3932         /* cmd: "<src ifname> <dst ifname> <variable name> */
3933
3934         p_end = os_strchr(p_start, ' ');
3935         if (!p_end) {
3936                 wpa_printf(MSG_ERROR, "DUP: no src ifname found in cmd: '%s'",
3937                            cmd);
3938                 return -1;
3939         }
3940
3941         *p_end = '\0';
3942         src_hapd = hostapd_interfaces_get_hapd(interfaces, p_start);
3943         if (!src_hapd) {
3944                 wpa_printf(MSG_ERROR, "DUP: no src ifname found: '%s'",
3945                            p_start);
3946                 return -1;
3947         }
3948
3949         p_start = p_end + 1;
3950         p_end = os_strchr(p_start, ' ');
3951         if (!p_end) {
3952                 wpa_printf(MSG_ERROR, "DUP: no dst ifname found in cmd: '%s'",
3953                            cmd);
3954                 return -1;
3955         }
3956
3957         *p_end = '\0';
3958         dst_hapd = hostapd_interfaces_get_hapd(interfaces, p_start);
3959         if (!dst_hapd) {
3960                 wpa_printf(MSG_ERROR, "DUP: no dst ifname found: '%s'",
3961                            p_start);
3962                 return -1;
3963         }
3964
3965         p_start = p_end + 1;
3966         return hostapd_ctrl_iface_dup_param(src_hapd, dst_hapd, p_start);
3967 }
3968
3969
3970 static int hostapd_global_ctrl_iface_ifname(struct hapd_interfaces *interfaces,
3971                                             const char *ifname,
3972                                             char *buf, char *reply,
3973                                             int reply_size,
3974                                             struct sockaddr_storage *from,
3975                                             socklen_t fromlen)
3976 {
3977         struct hostapd_data *hapd;
3978
3979         hapd = hostapd_interfaces_get_hapd(interfaces, ifname);
3980         if (hapd == NULL) {
3981                 int res;
3982
3983                 res = os_snprintf(reply, reply_size, "FAIL-NO-IFNAME-MATCH\n");
3984                 if (os_snprintf_error(reply_size, res))
3985                         return -1;
3986                 return res;
3987         }
3988
3989         return hostapd_ctrl_iface_receive_process(hapd, buf, reply,reply_size,
3990                                                   from, fromlen);
3991 }
3992
3993
3994 static void hostapd_global_ctrl_iface_receive(int sock, void *eloop_ctx,
3995                                               void *sock_ctx)
3996 {
3997         void *interfaces = eloop_ctx;
3998         char buffer[256], *buf = buffer;
3999         int res;
4000         struct sockaddr_storage from;
4001         socklen_t fromlen = sizeof(from);
4002         char *reply;
4003         int reply_len;
4004         const int reply_size = 4096;
4005 #ifdef CONFIG_CTRL_IFACE_UDP
4006         unsigned char lcookie[COOKIE_LEN];
4007 #endif /* CONFIG_CTRL_IFACE_UDP */
4008
4009         res = recvfrom(sock, buffer, sizeof(buffer) - 1, 0,
4010                        (struct sockaddr *) &from, &fromlen);
4011         if (res < 0) {
4012                 wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s",
4013                            strerror(errno));
4014                 return;
4015         }
4016         buf[res] = '\0';
4017         wpa_printf(MSG_DEBUG, "Global ctrl_iface command: %s", buf);
4018
4019         reply = os_malloc(reply_size);
4020         if (reply == NULL) {
4021                 if (sendto(sock, "FAIL\n", 5, 0, (struct sockaddr *) &from,
4022                            fromlen) < 0) {
4023                         wpa_printf(MSG_DEBUG, "CTRL: sendto failed: %s",
4024                                    strerror(errno));
4025                 }
4026                 return;
4027         }
4028
4029         os_memcpy(reply, "OK\n", 3);
4030         reply_len = 3;
4031
4032 #ifdef CONFIG_CTRL_IFACE_UDP
4033         if (os_strcmp(buf, "GET_COOKIE") == 0) {
4034                 os_memcpy(reply, "COOKIE=", 7);
4035                 wpa_snprintf_hex(reply + 7, 2 * COOKIE_LEN + 1,
4036                                  gcookie, COOKIE_LEN);
4037                 reply_len = 7 + 2 * COOKIE_LEN;
4038                 goto send_reply;
4039         }
4040
4041         if (os_strncmp(buf, "COOKIE=", 7) != 0 ||
4042             hexstr2bin(buf + 7, lcookie, COOKIE_LEN) < 0) {
4043                 wpa_printf(MSG_DEBUG,
4044                            "CTRL: No cookie in the request - drop request");
4045                 os_free(reply);
4046                 return;
4047         }
4048
4049         if (os_memcmp(gcookie, lcookie, COOKIE_LEN) != 0) {
4050                 wpa_printf(MSG_DEBUG,
4051                            "CTRL: Invalid cookie in the request - drop request");
4052                 os_free(reply);
4053                 return;
4054         }
4055
4056         buf += 7 + 2 * COOKIE_LEN;
4057         while (*buf == ' ')
4058                 buf++;
4059 #endif /* CONFIG_CTRL_IFACE_UDP */
4060
4061         if (os_strncmp(buf, "IFNAME=", 7) == 0) {
4062                 char *pos = os_strchr(buf + 7, ' ');
4063
4064                 if (pos) {
4065                         *pos++ = '\0';
4066                         reply_len = hostapd_global_ctrl_iface_ifname(
4067                                 interfaces, buf + 7, pos, reply, reply_size,
4068                                 &from, fromlen);
4069                         goto send_reply;
4070                 }
4071         }
4072
4073         if (os_strcmp(buf, "PING") == 0) {
4074                 os_memcpy(reply, "PONG\n", 5);
4075                 reply_len = 5;
4076         } else if (os_strncmp(buf, "RELOG", 5) == 0) {
4077                 if (wpa_debug_reopen_file() < 0)
4078                         reply_len = -1;
4079         } else if (os_strcmp(buf, "FLUSH") == 0) {
4080                 hostapd_ctrl_iface_flush(interfaces);
4081         } else if (os_strncmp(buf, "ADD ", 4) == 0) {
4082                 if (hostapd_ctrl_iface_add(interfaces, buf + 4) < 0)
4083                         reply_len = -1;
4084         } else if (os_strncmp(buf, "REMOVE ", 7) == 0) {
4085                 if (hostapd_ctrl_iface_remove(interfaces, buf + 7) < 0)
4086                         reply_len = -1;
4087         } else if (os_strcmp(buf, "ATTACH") == 0) {
4088                 if (hostapd_global_ctrl_iface_attach(interfaces, &from,
4089                                                      fromlen, NULL))
4090                         reply_len = -1;
4091         } else if (os_strncmp(buf, "ATTACH ", 7) == 0) {
4092                 if (hostapd_global_ctrl_iface_attach(interfaces, &from,
4093                                                      fromlen, buf + 7))
4094                         reply_len = -1;
4095         } else if (os_strcmp(buf, "DETACH") == 0) {
4096                 if (hostapd_global_ctrl_iface_detach(interfaces, &from,
4097                         fromlen))
4098                         reply_len = -1;
4099 #ifdef CONFIG_MODULE_TESTS
4100         } else if (os_strcmp(buf, "MODULE_TESTS") == 0) {
4101                 if (hapd_module_tests() < 0)
4102                         reply_len = -1;
4103 #endif /* CONFIG_MODULE_TESTS */
4104 #ifdef CONFIG_FST
4105         } else if (os_strncmp(buf, "FST-ATTACH ", 11) == 0) {
4106                 if (!hostapd_global_ctrl_iface_fst_attach(interfaces, buf + 11))
4107                         reply_len = os_snprintf(reply, reply_size, "OK\n");
4108                 else
4109                         reply_len = -1;
4110         } else if (os_strncmp(buf, "FST-DETACH ", 11) == 0) {
4111                 if (!hostapd_global_ctrl_iface_fst_detach(interfaces, buf + 11))
4112                         reply_len = os_snprintf(reply, reply_size, "OK\n");
4113                 else
4114                         reply_len = -1;
4115         } else if (os_strncmp(buf, "FST-MANAGER ", 12) == 0) {
4116                 reply_len = fst_ctrl_iface_receive(buf + 12, reply, reply_size);
4117 #endif /* CONFIG_FST */
4118         } else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
4119                 if (!hostapd_global_ctrl_iface_dup_network(interfaces,
4120                                                            buf + 12))
4121                         reply_len = os_snprintf(reply, reply_size, "OK\n");
4122                 else
4123                         reply_len = -1;
4124         } else if (os_strncmp(buf, "INTERFACES", 10) == 0) {
4125                 reply_len = hostapd_global_ctrl_iface_interfaces(
4126                         interfaces, buf + 10, reply, sizeof(buffer));
4127         } else if (os_strcmp(buf, "TERMINATE") == 0) {
4128                 eloop_terminate();
4129         } else {
4130                 wpa_printf(MSG_DEBUG, "Unrecognized global ctrl_iface command "
4131                            "ignored");
4132                 reply_len = -1;
4133         }
4134
4135 send_reply:
4136         if (reply_len < 0) {
4137                 os_memcpy(reply, "FAIL\n", 5);
4138                 reply_len = 5;
4139         }
4140
4141         if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
4142                    fromlen) < 0) {
4143                 wpa_printf(MSG_DEBUG, "CTRL: sendto failed: %s",
4144                            strerror(errno));
4145         }
4146         os_free(reply);
4147 }
4148
4149
4150 #ifndef CONFIG_CTRL_IFACE_UDP
4151 static char * hostapd_global_ctrl_iface_path(struct hapd_interfaces *interface)
4152 {
4153         char *buf;
4154         size_t len;
4155
4156         if (interface->global_iface_path == NULL)
4157                 return NULL;
4158
4159         len = os_strlen(interface->global_iface_path) +
4160                 os_strlen(interface->global_iface_name) + 2;
4161         buf = os_malloc(len);
4162         if (buf == NULL)
4163                 return NULL;
4164
4165         os_snprintf(buf, len, "%s/%s", interface->global_iface_path,
4166                     interface->global_iface_name);
4167         buf[len - 1] = '\0';
4168         return buf;
4169 }
4170 #endif /* CONFIG_CTRL_IFACE_UDP */
4171
4172
4173 int hostapd_global_ctrl_iface_init(struct hapd_interfaces *interface)
4174 {
4175 #ifdef CONFIG_CTRL_IFACE_UDP
4176         int port = HOSTAPD_GLOBAL_CTRL_IFACE_PORT;
4177         char p[32] = { 0 };
4178         char *pos;
4179         struct addrinfo hints = { 0 }, *res, *saveres;
4180         int n;
4181
4182         if (interface->global_ctrl_sock > -1) {
4183                 wpa_printf(MSG_DEBUG, "ctrl_iface already exists!");
4184                 return 0;
4185         }
4186
4187         if (interface->global_iface_path == NULL)
4188                 return 0;
4189
4190         pos = os_strstr(interface->global_iface_path, "udp:");
4191         if (pos) {
4192                 pos += 4;
4193                 port = atoi(pos);
4194                 if (port <= 0) {
4195                         wpa_printf(MSG_ERROR, "Invalid global ctrl UDP port");
4196                         goto fail;
4197                 }
4198         }
4199
4200         os_get_random(gcookie, COOKIE_LEN);
4201
4202 #ifdef CONFIG_CTRL_IFACE_UDP_REMOTE
4203         hints.ai_flags = AI_PASSIVE;
4204 #endif /* CONFIG_CTRL_IFACE_UDP_REMOTE */
4205
4206 #ifdef CONFIG_CTRL_IFACE_UDP_IPV6
4207         hints.ai_family = AF_INET6;
4208 #else /* CONFIG_CTRL_IFACE_UDP_IPV6 */
4209         hints.ai_family = AF_INET;
4210 #endif /* CONFIG_CTRL_IFACE_UDP_IPV6 */
4211         hints.ai_socktype = SOCK_DGRAM;
4212
4213 try_again:
4214         os_snprintf(p, sizeof(p), "%d", port);
4215         n = getaddrinfo(NULL, p, &hints, &res);
4216         if (n) {
4217                 wpa_printf(MSG_ERROR, "getaddrinfo(): %s", gai_strerror(n));
4218                 goto fail;
4219         }
4220
4221         saveres = res;
4222         interface->global_ctrl_sock = socket(res->ai_family, res->ai_socktype,
4223                                              res->ai_protocol);
4224         if (interface->global_ctrl_sock < 0) {
4225                 wpa_printf(MSG_ERROR, "socket(PF_INET): %s", strerror(errno));
4226                 goto fail;
4227         }
4228
4229         if (bind(interface->global_ctrl_sock, res->ai_addr, res->ai_addrlen) <
4230             0) {
4231                 port++;
4232                 if ((port - HOSTAPD_GLOBAL_CTRL_IFACE_PORT) <
4233                     HOSTAPD_GLOBAL_CTRL_IFACE_PORT_LIMIT && !pos)
4234                         goto try_again;
4235                 wpa_printf(MSG_ERROR, "bind(AF_INET): %s", strerror(errno));
4236                 goto fail;
4237         }
4238
4239         freeaddrinfo(saveres);
4240
4241         wpa_printf(MSG_DEBUG, "global ctrl_iface_init UDP port: %d", port);
4242
4243         if (eloop_register_read_sock(interface->global_ctrl_sock,
4244                                      hostapd_global_ctrl_iface_receive,
4245                                      interface, NULL) < 0) {
4246                 hostapd_global_ctrl_iface_deinit(interface);
4247                 return -1;
4248         }
4249
4250         return 0;
4251
4252 fail:
4253         if (interface->global_ctrl_sock >= 0)
4254                 close(interface->global_ctrl_sock);
4255         return -1;
4256 #else /* CONFIG_CTRL_IFACE_UDP */
4257         struct sockaddr_un addr;
4258         int s = -1;
4259         char *fname = NULL;
4260
4261         if (interface->global_iface_path == NULL) {
4262                 wpa_printf(MSG_DEBUG, "ctrl_iface not configured!");
4263                 return 0;
4264         }
4265
4266         if (mkdir(interface->global_iface_path, S_IRWXU | S_IRWXG) < 0) {
4267                 if (errno == EEXIST) {
4268                         wpa_printf(MSG_DEBUG, "Using existing control "
4269                                    "interface directory.");
4270                 } else {
4271                         wpa_printf(MSG_ERROR, "mkdir[ctrl_interface]: %s",
4272                                    strerror(errno));
4273                         goto fail;
4274                 }
4275         } else if (interface->ctrl_iface_group &&
4276                    chown(interface->global_iface_path, -1,
4277                          interface->ctrl_iface_group) < 0) {
4278                 wpa_printf(MSG_ERROR, "chown[ctrl_interface]: %s",
4279                            strerror(errno));
4280                 goto fail;
4281         }
4282
4283         if (os_strlen(interface->global_iface_path) + 1 +
4284             os_strlen(interface->global_iface_name) >= sizeof(addr.sun_path))
4285                 goto fail;
4286
4287         s = socket(PF_UNIX, SOCK_DGRAM, 0);
4288         if (s < 0) {
4289                 wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno));
4290                 goto fail;
4291         }
4292
4293         os_memset(&addr, 0, sizeof(addr));
4294 #ifdef __FreeBSD__
4295         addr.sun_len = sizeof(addr);
4296 #endif /* __FreeBSD__ */
4297         addr.sun_family = AF_UNIX;
4298         fname = hostapd_global_ctrl_iface_path(interface);
4299         if (fname == NULL)
4300                 goto fail;
4301         os_strlcpy(addr.sun_path, fname, sizeof(addr.sun_path));
4302         if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
4303                 wpa_printf(MSG_DEBUG, "ctrl_iface bind(PF_UNIX) failed: %s",
4304                            strerror(errno));
4305                 if (connect(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
4306                         wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not"
4307                                    " allow connections - assuming it was left"
4308                                    "over from forced program termination");
4309                         if (unlink(fname) < 0) {
4310                                 wpa_printf(MSG_ERROR,
4311                                            "Could not unlink existing ctrl_iface socket '%s': %s",
4312                                            fname, strerror(errno));
4313                                 goto fail;
4314                         }
4315                         if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) <
4316                             0) {
4317                                 wpa_printf(MSG_ERROR, "bind(PF_UNIX): %s",
4318                                            strerror(errno));
4319                                 goto fail;
4320                         }
4321                         wpa_printf(MSG_DEBUG, "Successfully replaced leftover "
4322                                    "ctrl_iface socket '%s'", fname);
4323                 } else {
4324                         wpa_printf(MSG_INFO, "ctrl_iface exists and seems to "
4325                                    "be in use - cannot override it");
4326                         wpa_printf(MSG_INFO, "Delete '%s' manually if it is "
4327                                    "not used anymore", fname);
4328                         os_free(fname);
4329                         fname = NULL;
4330                         goto fail;
4331                 }
4332         }
4333
4334         if (interface->ctrl_iface_group &&
4335             chown(fname, -1, interface->ctrl_iface_group) < 0) {
4336                 wpa_printf(MSG_ERROR, "chown[ctrl_interface]: %s",
4337                            strerror(errno));
4338                 goto fail;
4339         }
4340
4341         if (chmod(fname, S_IRWXU | S_IRWXG) < 0) {
4342                 wpa_printf(MSG_ERROR, "chmod[ctrl_interface/ifname]: %s",
4343                            strerror(errno));
4344                 goto fail;
4345         }
4346         os_free(fname);
4347
4348         interface->global_ctrl_sock = s;
4349         eloop_register_read_sock(s, hostapd_global_ctrl_iface_receive,
4350                                  interface, NULL);
4351
4352         return 0;
4353
4354 fail:
4355         if (s >= 0)
4356                 close(s);
4357         if (fname) {
4358                 unlink(fname);
4359                 os_free(fname);
4360         }
4361         return -1;
4362 #endif /* CONFIG_CTRL_IFACE_UDP */
4363 }
4364
4365
4366 void hostapd_global_ctrl_iface_deinit(struct hapd_interfaces *interfaces)
4367 {
4368 #ifndef CONFIG_CTRL_IFACE_UDP
4369         char *fname = NULL;
4370 #endif /* CONFIG_CTRL_IFACE_UDP */
4371         struct wpa_ctrl_dst *dst, *prev;
4372
4373         if (interfaces->global_ctrl_sock > -1) {
4374                 eloop_unregister_read_sock(interfaces->global_ctrl_sock);
4375                 close(interfaces->global_ctrl_sock);
4376                 interfaces->global_ctrl_sock = -1;
4377 #ifndef CONFIG_CTRL_IFACE_UDP
4378                 fname = hostapd_global_ctrl_iface_path(interfaces);
4379                 if (fname) {
4380                         unlink(fname);
4381                         os_free(fname);
4382                 }
4383
4384                 if (interfaces->global_iface_path &&
4385                     rmdir(interfaces->global_iface_path) < 0) {
4386                         if (errno == ENOTEMPTY) {
4387                                 wpa_printf(MSG_DEBUG, "Control interface "
4388                                            "directory not empty - leaving it "
4389                                            "behind");
4390                         } else {
4391                                 wpa_printf(MSG_ERROR,
4392                                            "rmdir[ctrl_interface=%s]: %s",
4393                                            interfaces->global_iface_path,
4394                                            strerror(errno));
4395                         }
4396                 }
4397 #endif /* CONFIG_CTRL_IFACE_UDP */
4398         }
4399
4400         os_free(interfaces->global_iface_path);
4401         interfaces->global_iface_path = NULL;
4402
4403         dl_list_for_each_safe(dst, prev, &interfaces->global_ctrl_dst,
4404                               struct wpa_ctrl_dst, list)
4405                 os_free(dst);
4406 }
4407
4408
4409 static int hostapd_ctrl_check_event_enabled(struct wpa_ctrl_dst *dst,
4410                                             const char *buf)
4411 {
4412         /* Enable Probe Request events based on explicit request.
4413          * Other events are enabled by default.
4414          */
4415         if (str_starts(buf, RX_PROBE_REQUEST))
4416                 return !!(dst->events & WPA_EVENT_RX_PROBE_REQUEST);
4417         return 1;
4418 }
4419
4420
4421 static void hostapd_ctrl_iface_send(struct hostapd_data *hapd, int level,
4422                                     enum wpa_msg_type type,
4423                                     const char *buf, size_t len)
4424 {
4425         struct wpa_ctrl_dst *dst, *next;
4426         struct dl_list *ctrl_dst;
4427         struct msghdr msg;
4428         int idx;
4429         struct iovec io[2];
4430         char levelstr[10];
4431         int s;
4432
4433         if (type != WPA_MSG_ONLY_GLOBAL) {
4434                 s = hapd->ctrl_sock;
4435                 ctrl_dst = &hapd->ctrl_dst;
4436         } else {
4437                 s = hapd->iface->interfaces->global_ctrl_sock;
4438                 ctrl_dst = &hapd->iface->interfaces->global_ctrl_dst;
4439         }
4440
4441         if (s < 0 || dl_list_empty(ctrl_dst))
4442                 return;
4443
4444         os_snprintf(levelstr, sizeof(levelstr), "<%d>", level);
4445         io[0].iov_base = levelstr;
4446         io[0].iov_len = os_strlen(levelstr);
4447         io[1].iov_base = (char *) buf;
4448         io[1].iov_len = len;
4449         os_memset(&msg, 0, sizeof(msg));
4450         msg.msg_iov = io;
4451         msg.msg_iovlen = 2;
4452
4453         idx = 0;
4454         dl_list_for_each_safe(dst, next, ctrl_dst, struct wpa_ctrl_dst, list) {
4455                 if ((level >= dst->debug_level) &&
4456                      hostapd_ctrl_check_event_enabled(dst, buf)) {
4457                         sockaddr_print(MSG_DEBUG, "CTRL_IFACE monitor send",
4458                                        &dst->addr, dst->addrlen);
4459                         msg.msg_name = &dst->addr;
4460                         msg.msg_namelen = dst->addrlen;
4461                         if (sendmsg(s, &msg, 0) < 0) {
4462                                 int _errno = errno;
4463                                 wpa_printf(MSG_INFO, "CTRL_IFACE monitor[%d]: "
4464                                            "%d - %s",
4465                                            idx, errno, strerror(errno));
4466                                 dst->errors++;
4467                                 if (dst->errors > 10 || _errno == ENOENT) {
4468                                         if (type != WPA_MSG_ONLY_GLOBAL)
4469                                                 hostapd_ctrl_iface_detach(
4470                                                         hapd, &dst->addr,
4471                                                         dst->addrlen);
4472                                         else
4473                                                 hostapd_global_ctrl_iface_detach(
4474                                                         hapd->iface->interfaces,
4475                                                         &dst->addr,
4476                                                         dst->addrlen);
4477                                 }
4478                         } else
4479                                 dst->errors = 0;
4480                 }
4481                 idx++;
4482         }
4483 }
4484
4485 #endif /* CONFIG_NATIVE_WINDOWS */