1 /*
2  * hostapd / UNIX domain socket -based control interface
3  * Copyright (c) 2004-2018, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #ifndef CONFIG_NATIVE_WINDOWS
12 
13 #ifdef CONFIG_TESTING_OPTIONS
14 #ifdef __NetBSD__
15 #include <net/if_ether.h>
16 #else
17 #include <net/ethernet.h>
18 #endif
19 #include <netinet/ip.h>
20 #endif /* CONFIG_TESTING_OPTIONS */
21 
22 #include <sys/un.h>
23 #include <sys/stat.h>
24 #include <stddef.h>
25 
26 #ifdef CONFIG_CTRL_IFACE_UDP
27 #include <netdb.h>
28 #endif /* CONFIG_CTRL_IFACE_UDP */
29 
30 #include "utils/common.h"
31 #include "utils/eloop.h"
32 #include "utils/module_tests.h"
33 #include "common/version.h"
34 #include "common/ieee802_11_defs.h"
35 #include "common/ctrl_iface_common.h"
36 #ifdef CONFIG_DPP
37 #include "common/dpp.h"
38 #endif /* CONFIG_DPP */
39 #include "common/wpa_ctrl.h"
40 #include "common/ptksa_cache.h"
41 #include "common/hw_features_common.h"
42 #include "common/nan_de.h"
43 #include "crypto/tls.h"
44 #include "drivers/driver.h"
45 #include "eapol_auth/eapol_auth_sm.h"
46 #include "radius/radius_client.h"
47 #include "radius/radius_server.h"
48 #include "l2_packet/l2_packet.h"
49 #include "ap/hostapd.h"
50 #include "ap/ap_config.h"
51 #include "ap/ieee802_1x.h"
52 #include "ap/wpa_auth.h"
53 #include "ap/pmksa_cache_auth.h"
54 #include "ap/ieee802_11.h"
55 #include "ap/sta_info.h"
56 #include "ap/wps_hostapd.h"
57 #include "ap/ctrl_iface_ap.h"
58 #include "ap/ap_drv_ops.h"
59 #include "ap/hs20.h"
60 #include "ap/wnm_ap.h"
61 #include "ap/wpa_auth.h"
62 #include "ap/beacon.h"
63 #include "ap/neighbor_db.h"
64 #include "ap/rrm.h"
65 #include "ap/dpp_hostapd.h"
66 #include "ap/dfs.h"
67 #include "ap/nan_usd_ap.h"
68 #include "wps/wps_defs.h"
69 #include "wps/wps.h"
70 #include "fst/fst_ctrl_iface.h"
71 #include "config_file.h"
72 #include "ctrl_iface.h"
73 
74 
75 #define HOSTAPD_CLI_DUP_VALUE_MAX_LEN 256
76 
77 #ifdef CONFIG_CTRL_IFACE_UDP
78 #define HOSTAPD_CTRL_IFACE_PORT		8877
79 #define HOSTAPD_CTRL_IFACE_PORT_LIMIT	50
80 #define HOSTAPD_GLOBAL_CTRL_IFACE_PORT		8878
81 #define HOSTAPD_GLOBAL_CTRL_IFACE_PORT_LIMIT	50
82 #endif /* CONFIG_CTRL_IFACE_UDP */
83 
84 static void hostapd_ctrl_iface_send(struct hostapd_data *hapd, int level,
85 				    enum wpa_msg_type type,
86 				    const char *buf, size_t len);
87 
88 
hostapd_ctrl_iface_attach(struct hostapd_data * hapd,struct sockaddr_storage * from,socklen_t fromlen,const char * input)89 static int hostapd_ctrl_iface_attach(struct hostapd_data *hapd,
90 				     struct sockaddr_storage *from,
91 				     socklen_t fromlen, const char *input)
92 {
93 	return ctrl_iface_attach(&hapd->ctrl_dst, from, fromlen, input);
94 }
95 
96 
hostapd_ctrl_iface_detach(struct hostapd_data * hapd,struct sockaddr_storage * from,socklen_t fromlen)97 static int hostapd_ctrl_iface_detach(struct hostapd_data *hapd,
98 				     struct sockaddr_storage *from,
99 				     socklen_t fromlen)
100 {
101 	return ctrl_iface_detach(&hapd->ctrl_dst, from, fromlen);
102 }
103 
104 
hostapd_ctrl_iface_level(struct hostapd_data * hapd,struct sockaddr_storage * from,socklen_t fromlen,char * level)105 static int hostapd_ctrl_iface_level(struct hostapd_data *hapd,
106 				    struct sockaddr_storage *from,
107 				    socklen_t fromlen,
108 				    char *level)
109 {
110 	return ctrl_iface_level(&hapd->ctrl_dst, from, fromlen, level);
111 }
112 
113 
hostapd_ctrl_iface_new_sta(struct hostapd_data * hapd,const char * txtaddr)114 static int hostapd_ctrl_iface_new_sta(struct hostapd_data *hapd,
115 				      const char *txtaddr)
116 {
117 	u8 addr[ETH_ALEN];
118 	struct sta_info *sta;
119 
120 	wpa_printf(MSG_DEBUG, "CTRL_IFACE NEW_STA %s", txtaddr);
121 
122 	if (hwaddr_aton(txtaddr, addr))
123 		return -1;
124 
125 	sta = ap_get_sta(hapd, addr);
126 	if (sta)
127 		return 0;
128 
129 	wpa_printf(MSG_DEBUG, "Add new STA " MACSTR " based on ctrl_iface "
130 		   "notification", MAC2STR(addr));
131 	sta = ap_sta_add(hapd, addr);
132 	if (sta == NULL)
133 		return -1;
134 
135 	hostapd_new_assoc_sta(hapd, sta, 0);
136 	return 0;
137 }
138 
139 
140 #ifdef NEED_AP_MLME
hostapd_ctrl_iface_sa_query(struct hostapd_data * hapd,const char * txtaddr)141 static int hostapd_ctrl_iface_sa_query(struct hostapd_data *hapd,
142 				       const char *txtaddr)
143 {
144 	u8 addr[ETH_ALEN];
145 	u8 trans_id[WLAN_SA_QUERY_TR_ID_LEN];
146 
147 	wpa_printf(MSG_DEBUG, "CTRL_IFACE SA_QUERY %s", txtaddr);
148 
149 	if (hwaddr_aton(txtaddr, addr) ||
150 	    os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0)
151 		return -1;
152 
153 	ieee802_11_send_sa_query_req(hapd, addr, trans_id);
154 
155 	return 0;
156 }
157 #endif /* NEED_AP_MLME */
158 
159 
160 #ifdef CONFIG_WPS
hostapd_ctrl_iface_wps_pin(struct hostapd_data * hapd,char * txt)161 static int hostapd_ctrl_iface_wps_pin(struct hostapd_data *hapd, char *txt)
162 {
163 	char *pin = os_strchr(txt, ' ');
164 	char *timeout_txt;
165 	int timeout;
166 	u8 addr_buf[ETH_ALEN], *addr = NULL;
167 	char *pos;
168 
169 	if (pin == NULL)
170 		return -1;
171 	*pin++ = '\0';
172 
173 	timeout_txt = os_strchr(pin, ' ');
174 	if (timeout_txt) {
175 		*timeout_txt++ = '\0';
176 		timeout = atoi(timeout_txt);
177 		pos = os_strchr(timeout_txt, ' ');
178 		if (pos) {
179 			*pos++ = '\0';
180 			if (hwaddr_aton(pos, addr_buf) == 0)
181 				addr = addr_buf;
182 		}
183 	} else
184 		timeout = 0;
185 
186 	return hostapd_wps_add_pin(hapd, addr, txt, pin, timeout);
187 }
188 
189 
hostapd_ctrl_iface_wps_check_pin(struct hostapd_data * hapd,char * cmd,char * buf,size_t buflen)190 static int hostapd_ctrl_iface_wps_check_pin(
191 	struct hostapd_data *hapd, char *cmd, char *buf, size_t buflen)
192 {
193 	char pin[9];
194 	size_t len;
195 	char *pos;
196 	int ret;
197 
198 	wpa_hexdump_ascii_key(MSG_DEBUG, "WPS_CHECK_PIN",
199 			      (u8 *) cmd, os_strlen(cmd));
200 	for (pos = cmd, len = 0; *pos != '\0'; pos++) {
201 		if (*pos < '0' || *pos > '9')
202 			continue;
203 		pin[len++] = *pos;
204 		if (len == 9) {
205 			wpa_printf(MSG_DEBUG, "WPS: Too long PIN");
206 			return -1;
207 		}
208 	}
209 	if (len != 4 && len != 8) {
210 		wpa_printf(MSG_DEBUG, "WPS: Invalid PIN length %d", (int) len);
211 		return -1;
212 	}
213 	pin[len] = '\0';
214 
215 	if (len == 8) {
216 		unsigned int pin_val;
217 		pin_val = atoi(pin);
218 		if (!wps_pin_valid(pin_val)) {
219 			wpa_printf(MSG_DEBUG, "WPS: Invalid checksum digit");
220 			ret = os_snprintf(buf, buflen, "FAIL-CHECKSUM\n");
221 			if (os_snprintf_error(buflen, ret))
222 				return -1;
223 			return ret;
224 		}
225 	}
226 
227 	ret = os_snprintf(buf, buflen, "%s", pin);
228 	if (os_snprintf_error(buflen, ret))
229 		return -1;
230 
231 	return ret;
232 }
233 
234 
235 #ifdef CONFIG_WPS_NFC
hostapd_ctrl_iface_wps_nfc_tag_read(struct hostapd_data * hapd,char * pos)236 static int hostapd_ctrl_iface_wps_nfc_tag_read(struct hostapd_data *hapd,
237 					       char *pos)
238 {
239 	size_t len;
240 	struct wpabuf *buf;
241 	int ret;
242 
243 	len = os_strlen(pos);
244 	if (len & 0x01)
245 		return -1;
246 	len /= 2;
247 
248 	buf = wpabuf_alloc(len);
249 	if (buf == NULL)
250 		return -1;
251 	if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
252 		wpabuf_free(buf);
253 		return -1;
254 	}
255 
256 	ret = hostapd_wps_nfc_tag_read(hapd, buf);
257 	wpabuf_free(buf);
258 
259 	return ret;
260 }
261 
262 
hostapd_ctrl_iface_wps_nfc_config_token(struct hostapd_data * hapd,char * cmd,char * reply,size_t max_len)263 static int hostapd_ctrl_iface_wps_nfc_config_token(struct hostapd_data *hapd,
264 						   char *cmd, char *reply,
265 						   size_t max_len)
266 {
267 	int ndef;
268 	struct wpabuf *buf;
269 	int res;
270 
271 	if (os_strcmp(cmd, "WPS") == 0)
272 		ndef = 0;
273 	else if (os_strcmp(cmd, "NDEF") == 0)
274 		ndef = 1;
275 	else
276 		return -1;
277 
278 	buf = hostapd_wps_nfc_config_token(hapd, ndef);
279 	if (buf == NULL)
280 		return -1;
281 
282 	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
283 					 wpabuf_len(buf));
284 	reply[res++] = '\n';
285 	reply[res] = '\0';
286 
287 	wpabuf_free(buf);
288 
289 	return res;
290 }
291 
292 
hostapd_ctrl_iface_wps_nfc_token_gen(struct hostapd_data * hapd,char * reply,size_t max_len,int ndef)293 static int hostapd_ctrl_iface_wps_nfc_token_gen(struct hostapd_data *hapd,
294 						char *reply, size_t max_len,
295 						int ndef)
296 {
297 	struct wpabuf *buf;
298 	int res;
299 
300 	buf = hostapd_wps_nfc_token_gen(hapd, ndef);
301 	if (buf == NULL)
302 		return -1;
303 
304 	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
305 					 wpabuf_len(buf));
306 	reply[res++] = '\n';
307 	reply[res] = '\0';
308 
309 	wpabuf_free(buf);
310 
311 	return res;
312 }
313 
314 
hostapd_ctrl_iface_wps_nfc_token(struct hostapd_data * hapd,char * cmd,char * reply,size_t max_len)315 static int hostapd_ctrl_iface_wps_nfc_token(struct hostapd_data *hapd,
316 					    char *cmd, char *reply,
317 					    size_t max_len)
318 {
319 	if (os_strcmp(cmd, "WPS") == 0)
320 		return hostapd_ctrl_iface_wps_nfc_token_gen(hapd, reply,
321 							    max_len, 0);
322 
323 	if (os_strcmp(cmd, "NDEF") == 0)
324 		return hostapd_ctrl_iface_wps_nfc_token_gen(hapd, reply,
325 							    max_len, 1);
326 
327 	if (os_strcmp(cmd, "enable") == 0)
328 		return hostapd_wps_nfc_token_enable(hapd);
329 
330 	if (os_strcmp(cmd, "disable") == 0) {
331 		hostapd_wps_nfc_token_disable(hapd);
332 		return 0;
333 	}
334 
335 	return -1;
336 }
337 
338 
hostapd_ctrl_iface_nfc_get_handover_sel(struct hostapd_data * hapd,char * cmd,char * reply,size_t max_len)339 static int hostapd_ctrl_iface_nfc_get_handover_sel(struct hostapd_data *hapd,
340 						   char *cmd, char *reply,
341 						   size_t max_len)
342 {
343 	struct wpabuf *buf;
344 	int res;
345 	char *pos;
346 	int ndef;
347 
348 	pos = os_strchr(cmd, ' ');
349 	if (pos == NULL)
350 		return -1;
351 	*pos++ = '\0';
352 
353 	if (os_strcmp(cmd, "WPS") == 0)
354 		ndef = 0;
355 	else if (os_strcmp(cmd, "NDEF") == 0)
356 		ndef = 1;
357 	else
358 		return -1;
359 
360 	if (os_strcmp(pos, "WPS-CR") == 0)
361 		buf = hostapd_wps_nfc_hs_cr(hapd, ndef);
362 	else
363 		buf = NULL;
364 	if (buf == NULL)
365 		return -1;
366 
367 	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
368 					 wpabuf_len(buf));
369 	reply[res++] = '\n';
370 	reply[res] = '\0';
371 
372 	wpabuf_free(buf);
373 
374 	return res;
375 }
376 
377 
hostapd_ctrl_iface_nfc_report_handover(struct hostapd_data * hapd,char * cmd)378 static int hostapd_ctrl_iface_nfc_report_handover(struct hostapd_data *hapd,
379 						  char *cmd)
380 {
381 	size_t len;
382 	struct wpabuf *req, *sel;
383 	int ret;
384 	char *pos, *role, *type, *pos2;
385 
386 	role = cmd;
387 	pos = os_strchr(role, ' ');
388 	if (pos == NULL)
389 		return -1;
390 	*pos++ = '\0';
391 
392 	type = pos;
393 	pos = os_strchr(type, ' ');
394 	if (pos == NULL)
395 		return -1;
396 	*pos++ = '\0';
397 
398 	pos2 = os_strchr(pos, ' ');
399 	if (pos2 == NULL)
400 		return -1;
401 	*pos2++ = '\0';
402 
403 	len = os_strlen(pos);
404 	if (len & 0x01)
405 		return -1;
406 	len /= 2;
407 
408 	req = wpabuf_alloc(len);
409 	if (req == NULL)
410 		return -1;
411 	if (hexstr2bin(pos, wpabuf_put(req, len), len) < 0) {
412 		wpabuf_free(req);
413 		return -1;
414 	}
415 
416 	len = os_strlen(pos2);
417 	if (len & 0x01) {
418 		wpabuf_free(req);
419 		return -1;
420 	}
421 	len /= 2;
422 
423 	sel = wpabuf_alloc(len);
424 	if (sel == NULL) {
425 		wpabuf_free(req);
426 		return -1;
427 	}
428 	if (hexstr2bin(pos2, wpabuf_put(sel, len), len) < 0) {
429 		wpabuf_free(req);
430 		wpabuf_free(sel);
431 		return -1;
432 	}
433 
434 	if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "WPS") == 0) {
435 		ret = hostapd_wps_nfc_report_handover(hapd, req, sel);
436 	} else {
437 		wpa_printf(MSG_DEBUG, "NFC: Unsupported connection handover "
438 			   "reported: role=%s type=%s", role, type);
439 		ret = -1;
440 	}
441 	wpabuf_free(req);
442 	wpabuf_free(sel);
443 
444 	return ret;
445 }
446 
447 #endif /* CONFIG_WPS_NFC */
448 
449 
hostapd_ctrl_iface_wps_ap_pin(struct hostapd_data * hapd,char * txt,char * buf,size_t buflen)450 static int hostapd_ctrl_iface_wps_ap_pin(struct hostapd_data *hapd, char *txt,
451 					 char *buf, size_t buflen)
452 {
453 	int timeout = 300;
454 	char *pos;
455 	const char *pin_txt;
456 
457 	pos = os_strchr(txt, ' ');
458 	if (pos)
459 		*pos++ = '\0';
460 
461 	if (os_strcmp(txt, "disable") == 0) {
462 		hostapd_wps_ap_pin_disable(hapd);
463 		return os_snprintf(buf, buflen, "OK\n");
464 	}
465 
466 	if (os_strcmp(txt, "random") == 0) {
467 		if (pos)
468 			timeout = atoi(pos);
469 		pin_txt = hostapd_wps_ap_pin_random(hapd, timeout);
470 		if (pin_txt == NULL)
471 			return -1;
472 		return os_snprintf(buf, buflen, "%s", pin_txt);
473 	}
474 
475 	if (os_strcmp(txt, "get") == 0) {
476 		pin_txt = hostapd_wps_ap_pin_get(hapd);
477 		if (pin_txt == NULL)
478 			return -1;
479 		return os_snprintf(buf, buflen, "%s", pin_txt);
480 	}
481 
482 	if (os_strcmp(txt, "set") == 0) {
483 		char *pin;
484 		if (pos == NULL)
485 			return -1;
486 		pin = pos;
487 		pos = os_strchr(pos, ' ');
488 		if (pos) {
489 			*pos++ = '\0';
490 			timeout = atoi(pos);
491 		}
492 		if (os_strlen(pin) > buflen)
493 			return -1;
494 		if (hostapd_wps_ap_pin_set(hapd, pin, timeout) < 0)
495 			return -1;
496 		return os_snprintf(buf, buflen, "%s", pin);
497 	}
498 
499 	return -1;
500 }
501 
502 
hostapd_ctrl_iface_wps_config(struct hostapd_data * hapd,char * txt)503 static int hostapd_ctrl_iface_wps_config(struct hostapd_data *hapd, char *txt)
504 {
505 	char *pos;
506 	char *ssid, *auth, *encr = NULL, *key = NULL;
507 
508 	ssid = txt;
509 	pos = os_strchr(txt, ' ');
510 	if (!pos)
511 		return -1;
512 	*pos++ = '\0';
513 
514 	auth = pos;
515 	pos = os_strchr(pos, ' ');
516 	if (pos) {
517 		*pos++ = '\0';
518 		encr = pos;
519 		pos = os_strchr(pos, ' ');
520 		if (pos) {
521 			*pos++ = '\0';
522 			key = pos;
523 		}
524 	}
525 
526 	return hostapd_wps_config_ap(hapd, ssid, auth, encr, key);
527 }
528 
529 
pbc_status_str(enum pbc_status status)530 static const char * pbc_status_str(enum pbc_status status)
531 {
532 	switch (status) {
533 	case WPS_PBC_STATUS_DISABLE:
534 		return "Disabled";
535 	case WPS_PBC_STATUS_ACTIVE:
536 		return "Active";
537 	case WPS_PBC_STATUS_TIMEOUT:
538 		return "Timed-out";
539 	case WPS_PBC_STATUS_OVERLAP:
540 		return "Overlap";
541 	default:
542 		return "Unknown";
543 	}
544 }
545 
546 
hostapd_ctrl_iface_wps_get_status(struct hostapd_data * hapd,char * buf,size_t buflen)547 static int hostapd_ctrl_iface_wps_get_status(struct hostapd_data *hapd,
548 					     char *buf, size_t buflen)
549 {
550 	int ret;
551 	char *pos, *end;
552 
553 	pos = buf;
554 	end = buf + buflen;
555 
556 	ret = os_snprintf(pos, end - pos, "PBC Status: %s\n",
557 			  pbc_status_str(hapd->wps_stats.pbc_status));
558 
559 	if (os_snprintf_error(end - pos, ret))
560 		return pos - buf;
561 	pos += ret;
562 
563 	ret = os_snprintf(pos, end - pos, "Last WPS result: %s\n",
564 			  (hapd->wps_stats.status == WPS_STATUS_SUCCESS ?
565 			   "Success":
566 			   (hapd->wps_stats.status == WPS_STATUS_FAILURE ?
567 			    "Failed" : "None")));
568 
569 	if (os_snprintf_error(end - pos, ret))
570 		return pos - buf;
571 	pos += ret;
572 
573 	/* If status == Failure - Add possible Reasons */
574 	if(hapd->wps_stats.status == WPS_STATUS_FAILURE &&
575 	   hapd->wps_stats.failure_reason > 0) {
576 		ret = os_snprintf(pos, end - pos,
577 				  "Failure Reason: %s\n",
578 				  wps_ei_str(hapd->wps_stats.failure_reason));
579 
580 		if (os_snprintf_error(end - pos, ret))
581 			return pos - buf;
582 		pos += ret;
583 	}
584 
585 	if (hapd->wps_stats.status) {
586 		ret = os_snprintf(pos, end - pos, "Peer Address: " MACSTR "\n",
587 				  MAC2STR(hapd->wps_stats.peer_addr));
588 
589 		if (os_snprintf_error(end - pos, ret))
590 			return pos - buf;
591 		pos += ret;
592 	}
593 
594 	return pos - buf;
595 }
596 
597 #endif /* CONFIG_WPS */
598 
599 
600 #ifdef CONFIG_HS20
hostapd_ctrl_iface_hs20_deauth_req(struct hostapd_data * hapd,const char * cmd)601 static int hostapd_ctrl_iface_hs20_deauth_req(struct hostapd_data *hapd,
602 					      const char *cmd)
603 {
604 	u8 addr[ETH_ALEN];
605 	int code, reauth_delay, ret;
606 	const char *pos;
607 	size_t url_len;
608 	struct wpabuf *req;
609 
610 	/* <STA MAC Addr> <Code(0/1)> <Re-auth-Delay(sec)> [URL] */
611 	if (hwaddr_aton(cmd, addr))
612 		return -1;
613 
614 	pos = os_strchr(cmd, ' ');
615 	if (pos == NULL)
616 		return -1;
617 	pos++;
618 	code = atoi(pos);
619 
620 	pos = os_strchr(pos, ' ');
621 	if (pos == NULL)
622 		return -1;
623 	pos++;
624 	reauth_delay = atoi(pos);
625 
626 	url_len = 0;
627 	pos = os_strchr(pos, ' ');
628 	if (pos) {
629 		pos++;
630 		url_len = os_strlen(pos);
631 	}
632 
633 	req = wpabuf_alloc(4 + url_len);
634 	if (req == NULL)
635 		return -1;
636 	wpabuf_put_u8(req, code);
637 	wpabuf_put_le16(req, reauth_delay);
638 	wpabuf_put_u8(req, url_len);
639 	if (pos)
640 		wpabuf_put_data(req, pos, url_len);
641 
642 	wpa_printf(MSG_DEBUG, "HS 2.0: Send WNM-Notification to " MACSTR
643 		   " to indicate imminent deauthentication (code=%d "
644 		   "reauth_delay=%d)", MAC2STR(addr), code, reauth_delay);
645 	ret = hs20_send_wnm_notification_deauth_req(hapd, addr, req);
646 	wpabuf_free(req);
647 	return ret;
648 }
649 #endif /* CONFIG_HS20 */
650 
651 
652 #ifdef CONFIG_INTERWORKING
653 
hostapd_ctrl_iface_set_qos_map_set(struct hostapd_data * hapd,const char * cmd)654 static int hostapd_ctrl_iface_set_qos_map_set(struct hostapd_data *hapd,
655 					      const char *cmd)
656 {
657 	u8 qos_map_set[16 + 2 * 21], count = 0;
658 	const char *pos = cmd;
659 	int val, ret;
660 
661 	for (;;) {
662 		if (count == sizeof(qos_map_set)) {
663 			wpa_printf(MSG_ERROR, "Too many qos_map_set parameters");
664 			return -1;
665 		}
666 
667 		val = atoi(pos);
668 		if (val < 0 || val > 255) {
669 			wpa_printf(MSG_INFO, "Invalid QoS Map Set");
670 			return -1;
671 		}
672 
673 		qos_map_set[count++] = val;
674 		pos = os_strchr(pos, ',');
675 		if (!pos)
676 			break;
677 		pos++;
678 	}
679 
680 	if (count < 16 || count & 1) {
681 		wpa_printf(MSG_INFO, "Invalid QoS Map Set");
682 		return -1;
683 	}
684 
685 	ret = hostapd_drv_set_qos_map(hapd, qos_map_set, count);
686 	if (ret) {
687 		wpa_printf(MSG_INFO, "Failed to set QoS Map Set");
688 		return -1;
689 	}
690 
691 	os_memcpy(hapd->conf->qos_map_set, qos_map_set, count);
692 	hapd->conf->qos_map_set_len = count;
693 
694 	return 0;
695 }
696 
697 
hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data * hapd,const char * cmd)698 static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
699 						const char *cmd)
700 {
701 	u8 addr[ETH_ALEN];
702 	struct sta_info *sta;
703 	struct wpabuf *buf;
704 	u8 *qos_map_set = hapd->conf->qos_map_set;
705 	u8 qos_map_set_len = hapd->conf->qos_map_set_len;
706 	int ret;
707 
708 	if (!qos_map_set_len) {
709 		wpa_printf(MSG_INFO, "QoS Map Set is not set");
710 		return -1;
711 	}
712 
713 	if (hwaddr_aton(cmd, addr))
714 		return -1;
715 
716 	sta = ap_get_sta(hapd, addr);
717 	if (sta == NULL) {
718 		wpa_printf(MSG_DEBUG, "Station " MACSTR " not found "
719 			   "for QoS Map Configuration message",
720 			   MAC2STR(addr));
721 		return -1;
722 	}
723 
724 	if (!sta->qos_map_enabled) {
725 		wpa_printf(MSG_DEBUG, "Station " MACSTR " did not indicate "
726 			   "support for QoS Map", MAC2STR(addr));
727 		return -1;
728 	}
729 
730 	buf = wpabuf_alloc(2 + 2 + qos_map_set_len);
731 	if (buf == NULL)
732 		return -1;
733 
734 	wpabuf_put_u8(buf, WLAN_ACTION_QOS);
735 	wpabuf_put_u8(buf, QOS_QOS_MAP_CONFIG);
736 
737 	/* QoS Map Set Element */
738 	wpabuf_put_u8(buf, WLAN_EID_QOS_MAP_SET);
739 	wpabuf_put_u8(buf, qos_map_set_len);
740 	wpabuf_put_data(buf, qos_map_set, qos_map_set_len);
741 
742 	ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr,
743 				      wpabuf_head(buf), wpabuf_len(buf));
744 	wpabuf_free(buf);
745 
746 	return ret;
747 }
748 
749 #endif /* CONFIG_INTERWORKING */
750 
751 
752 #ifdef CONFIG_WNM_AP
753 
hostapd_ctrl_iface_coloc_intf_req(struct hostapd_data * hapd,const char * cmd)754 static int hostapd_ctrl_iface_coloc_intf_req(struct hostapd_data *hapd,
755 					     const char *cmd)
756 {
757 	u8 addr[ETH_ALEN];
758 	struct sta_info *sta;
759 	const char *pos;
760 	unsigned int auto_report, timeout;
761 
762 	if (hwaddr_aton(cmd, addr)) {
763 		wpa_printf(MSG_DEBUG, "Invalid STA MAC address");
764 		return -1;
765 	}
766 
767 	sta = ap_get_sta(hapd, addr);
768 	if (!sta) {
769 		wpa_printf(MSG_DEBUG, "Station " MACSTR
770 			   " not found for Collocated Interference Request",
771 			   MAC2STR(addr));
772 		return -1;
773 	}
774 
775 	pos = cmd + 17;
776 	if (*pos != ' ')
777 		return -1;
778 	pos++;
779 	auto_report = atoi(pos);
780 	pos = os_strchr(pos, ' ');
781 	if (!pos)
782 		return -1;
783 	pos++;
784 	timeout = atoi(pos);
785 
786 	return wnm_send_coloc_intf_req(hapd, sta, auto_report, timeout);
787 }
788 
789 #endif /* CONFIG_WNM_AP */
790 
791 
hostapd_ctrl_iface_get_key_mgmt(struct hostapd_data * hapd,char * buf,size_t buflen)792 static int hostapd_ctrl_iface_get_key_mgmt(struct hostapd_data *hapd,
793 					   char *buf, size_t buflen)
794 {
795 	int ret = 0;
796 	char *pos, *end;
797 
798 	pos = buf;
799 	end = buf + buflen;
800 
801 	WPA_ASSERT(hapd->conf->wpa_key_mgmt);
802 
803 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
804 		ret = os_snprintf(pos, end - pos, "WPA-PSK ");
805 		if (os_snprintf_error(end - pos, ret))
806 			return pos - buf;
807 		pos += ret;
808 	}
809 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
810 		ret = os_snprintf(pos, end - pos, "WPA-EAP ");
811 		if (os_snprintf_error(end - pos, ret))
812 			return pos - buf;
813 		pos += ret;
814 	}
815 #ifdef CONFIG_IEEE80211R_AP
816 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) {
817 		ret = os_snprintf(pos, end - pos, "FT-PSK ");
818 		if (os_snprintf_error(end - pos, ret))
819 			return pos - buf;
820 		pos += ret;
821 	}
822 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
823 		ret = os_snprintf(pos, end - pos, "FT-EAP ");
824 		if (os_snprintf_error(end - pos, ret))
825 			return pos - buf;
826 		pos += ret;
827 	}
828 #ifdef CONFIG_SHA384
829 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X_SHA384) {
830 		ret = os_snprintf(pos, end - pos, "FT-EAP-SHA384 ");
831 		if (os_snprintf_error(end - pos, ret))
832 			return pos - buf;
833 		pos += ret;
834 	}
835 #endif /* CONFIG_SHA384 */
836 #ifdef CONFIG_SAE
837 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE) {
838 		ret = os_snprintf(pos, end - pos, "FT-SAE ");
839 		if (os_snprintf_error(end - pos, ret))
840 			return pos - buf;
841 		pos += ret;
842 	}
843 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE_EXT_KEY) {
844 		ret = os_snprintf(pos, end - pos, "FT-SAE-EXT-KEY ");
845 		if (os_snprintf_error(end - pos, ret))
846 			return pos - buf;
847 		pos += ret;
848 	}
849 #endif /* CONFIG_SAE */
850 #ifdef CONFIG_FILS
851 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) {
852 		ret = os_snprintf(pos, end - pos, "FT-FILS-SHA256 ");
853 		if (os_snprintf_error(end - pos, ret))
854 			return pos - buf;
855 		pos += ret;
856 	}
857 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) {
858 		ret = os_snprintf(pos, end - pos, "FT-FILS-SHA384 ");
859 		if (os_snprintf_error(end - pos, ret))
860 			return pos - buf;
861 		pos += ret;
862 	}
863 #endif /* CONFIG_FILS */
864 #endif /* CONFIG_IEEE80211R_AP */
865 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
866 		ret = os_snprintf(pos, end - pos, "WPA-PSK-SHA256 ");
867 		if (os_snprintf_error(end - pos, ret))
868 			return pos - buf;
869 		pos += ret;
870 	}
871 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
872 		ret = os_snprintf(pos, end - pos, "WPA-EAP-SHA256 ");
873 		if (os_snprintf_error(end - pos, ret))
874 			return pos - buf;
875 		pos += ret;
876 	}
877 #ifdef CONFIG_SAE
878 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_SAE) {
879 		ret = os_snprintf(pos, end - pos, "SAE ");
880 		if (os_snprintf_error(end - pos, ret))
881 			return pos - buf;
882 		pos += ret;
883 	}
884 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_SAE_EXT_KEY) {
885 		ret = os_snprintf(pos, end - pos, "SAE-EXT-KEY ");
886 		if (os_snprintf_error(end - pos, ret))
887 			return pos - buf;
888 		pos += ret;
889 	}
890 #endif /* CONFIG_SAE */
891 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
892 		ret = os_snprintf(pos, end - pos, "WPA-EAP-SUITE-B ");
893 		if (os_snprintf_error(end - pos, ret))
894 			return pos - buf;
895 		pos += ret;
896 	}
897 	if (hapd->conf->wpa_key_mgmt &
898 	    WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
899 		ret = os_snprintf(pos, end - pos,
900 				  "WPA-EAP-SUITE-B-192 ");
901 		if (os_snprintf_error(end - pos, ret))
902 			return pos - buf;
903 		pos += ret;
904 	}
905 #ifdef CONFIG_FILS
906 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FILS_SHA256) {
907 		ret = os_snprintf(pos, end - pos, "FILS-SHA256 ");
908 		if (os_snprintf_error(end - pos, ret))
909 			return pos - buf;
910 		pos += ret;
911 	}
912 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_FILS_SHA384) {
913 		ret = os_snprintf(pos, end - pos, "FILS-SHA384 ");
914 		if (os_snprintf_error(end - pos, ret))
915 			return pos - buf;
916 		pos += ret;
917 	}
918 #endif /* CONFIG_FILS */
919 
920 #ifdef CONFIG_OWE
921 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) {
922 		ret = os_snprintf(pos, end - pos, "OWE ");
923 		if (os_snprintf_error(end - pos, ret))
924 			return pos - buf;
925 		pos += ret;
926 	}
927 #endif /* CONFIG_OWE */
928 
929 #ifdef CONFIG_DPP
930 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_DPP) {
931 		ret = os_snprintf(pos, end - pos, "DPP ");
932 		if (os_snprintf_error(end - pos, ret))
933 			return pos - buf;
934 		pos += ret;
935 	}
936 #endif /* CONFIG_DPP */
937 #ifdef CONFIG_SHA384
938 	if (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA384) {
939 		ret = os_snprintf(pos, end - pos, "WPA-EAP-SHA384 ");
940 		if (os_snprintf_error(end - pos, ret))
941 			return pos - buf;
942 		pos += ret;
943 	}
944 #endif /* CONFIG_SHA384 */
945 
946 	if (pos > buf && *(pos - 1) == ' ') {
947 		*(pos - 1) = '\0';
948 		pos--;
949 	}
950 
951 	return pos - buf;
952 }
953 
954 
hostapd_ctrl_iface_get_config(struct hostapd_data * hapd,char * buf,size_t buflen)955 static int hostapd_ctrl_iface_get_config(struct hostapd_data *hapd,
956 					 char *buf, size_t buflen)
957 {
958 	int ret;
959 	char *pos, *end;
960 
961 	pos = buf;
962 	end = buf + buflen;
963 
964 	ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n"
965 			  "ssid=%s\n",
966 			  MAC2STR(hapd->own_addr),
967 			  wpa_ssid_txt(hapd->conf->ssid.ssid,
968 				       hapd->conf->ssid.ssid_len));
969 	if (os_snprintf_error(end - pos, ret))
970 		return pos - buf;
971 	pos += ret;
972 
973 	if ((hapd->conf->config_id)) {
974 		ret = os_snprintf(pos, end - pos, "config_id=%s\n",
975 				  hapd->conf->config_id);
976 		if (os_snprintf_error(end - pos, ret))
977 			return pos - buf;
978 		pos += ret;
979 	}
980 
981 #ifdef CONFIG_WPS
982 	ret = os_snprintf(pos, end - pos, "wps_state=%s\n",
983 			  hapd->conf->wps_state == 0 ? "disabled" :
984 			  (hapd->conf->wps_state == 1 ? "not configured" :
985 			   "configured"));
986 	if (os_snprintf_error(end - pos, ret))
987 		return pos - buf;
988 	pos += ret;
989 
990 	if (hapd->conf->wps_state && hapd->conf->wpa &&
991 	    hapd->conf->ssid.wpa_passphrase) {
992 		ret = os_snprintf(pos, end - pos, "passphrase=%s\n",
993 				  hapd->conf->ssid.wpa_passphrase);
994 		if (os_snprintf_error(end - pos, ret))
995 			return pos - buf;
996 		pos += ret;
997 	}
998 
999 	if (hapd->conf->wps_state && hapd->conf->wpa &&
1000 	    hapd->conf->ssid.wpa_psk &&
1001 	    hapd->conf->ssid.wpa_psk->group) {
1002 		char hex[PMK_LEN * 2 + 1];
1003 		wpa_snprintf_hex(hex, sizeof(hex),
1004 				 hapd->conf->ssid.wpa_psk->psk, PMK_LEN);
1005 		ret = os_snprintf(pos, end - pos, "psk=%s\n", hex);
1006 		if (os_snprintf_error(end - pos, ret))
1007 			return pos - buf;
1008 		pos += ret;
1009 	}
1010 
1011 	if (hapd->conf->multi_ap) {
1012 		struct hostapd_ssid *ssid = &hapd->conf->multi_ap_backhaul_ssid;
1013 
1014 		ret = os_snprintf(pos, end - pos, "multi_ap=%d\n",
1015 				  hapd->conf->multi_ap);
1016 		if (os_snprintf_error(end - pos, ret))
1017 			return pos - buf;
1018 		pos += ret;
1019 
1020 		if (ssid->ssid_len) {
1021 			ret = os_snprintf(pos, end - pos,
1022 					  "multi_ap_backhaul_ssid=%s\n",
1023 					  wpa_ssid_txt(ssid->ssid,
1024 						       ssid->ssid_len));
1025 			if (os_snprintf_error(end - pos, ret))
1026 				return pos - buf;
1027 			pos += ret;
1028 		}
1029 
1030 		if (hapd->conf->wps_state && hapd->conf->wpa &&
1031 			ssid->wpa_passphrase) {
1032 			ret = os_snprintf(pos, end - pos,
1033 					  "multi_ap_backhaul_wpa_passphrase=%s\n",
1034 					  ssid->wpa_passphrase);
1035 			if (os_snprintf_error(end - pos, ret))
1036 				return pos - buf;
1037 			pos += ret;
1038 		}
1039 
1040 		if (hapd->conf->wps_state && hapd->conf->wpa &&
1041 		    ssid->wpa_psk &&
1042 		    ssid->wpa_psk->group) {
1043 			char hex[PMK_LEN * 2 + 1];
1044 
1045 			wpa_snprintf_hex(hex, sizeof(hex), ssid->wpa_psk->psk,
1046 					 PMK_LEN);
1047 			ret = os_snprintf(pos, end - pos,
1048 					  "multi_ap_backhaul_wpa_psk=%s\n",
1049 					  hex);
1050 			forced_memzero(hex, sizeof(hex));
1051 			if (os_snprintf_error(end - pos, ret))
1052 				return pos - buf;
1053 			pos += ret;
1054 		}
1055 	}
1056 #endif /* CONFIG_WPS */
1057 
1058 	if (hapd->conf->wpa) {
1059 		ret = os_snprintf(pos, end - pos, "wpa=%d\n", hapd->conf->wpa);
1060 		if (os_snprintf_error(end - pos, ret))
1061 			return pos - buf;
1062 		pos += ret;
1063 	}
1064 
1065 	if (hapd->conf->wpa && hapd->conf->wpa_key_mgmt) {
1066 		ret = os_snprintf(pos, end - pos, "key_mgmt=");
1067 		if (os_snprintf_error(end - pos, ret))
1068 			return pos - buf;
1069 		pos += ret;
1070 
1071 		pos += hostapd_ctrl_iface_get_key_mgmt(hapd, pos, end - pos);
1072 
1073 		ret = os_snprintf(pos, end - pos, "\n");
1074 		if (os_snprintf_error(end - pos, ret))
1075 			return pos - buf;
1076 		pos += ret;
1077 	}
1078 
1079 	if (hapd->conf->wpa) {
1080 		ret = os_snprintf(pos, end - pos, "group_cipher=%s\n",
1081 				  wpa_cipher_txt(hapd->conf->wpa_group));
1082 		if (os_snprintf_error(end - pos, ret))
1083 			return pos - buf;
1084 		pos += ret;
1085 	}
1086 
1087 	if ((hapd->conf->wpa & WPA_PROTO_RSN) && hapd->conf->rsn_pairwise) {
1088 		ret = os_snprintf(pos, end - pos, "rsn_pairwise_cipher=");
1089 		if (os_snprintf_error(end - pos, ret))
1090 			return pos - buf;
1091 		pos += ret;
1092 
1093 		ret = wpa_write_ciphers(pos, end, hapd->conf->rsn_pairwise,
1094 					" ");
1095 		if (ret < 0)
1096 			return pos - buf;
1097 		pos += ret;
1098 
1099 		ret = os_snprintf(pos, end - pos, "\n");
1100 		if (os_snprintf_error(end - pos, ret))
1101 			return pos - buf;
1102 		pos += ret;
1103 	}
1104 
1105 	if ((hapd->conf->wpa & WPA_PROTO_WPA) && hapd->conf->wpa_pairwise) {
1106 		ret = os_snprintf(pos, end - pos, "wpa_pairwise_cipher=");
1107 		if (os_snprintf_error(end - pos, ret))
1108 			return pos - buf;
1109 		pos += ret;
1110 
1111 		ret = wpa_write_ciphers(pos, end, hapd->conf->wpa_pairwise,
1112 					" ");
1113 		if (ret < 0)
1114 			return pos - buf;
1115 		pos += ret;
1116 
1117 		ret = os_snprintf(pos, end - pos, "\n");
1118 		if (os_snprintf_error(end - pos, ret))
1119 			return pos - buf;
1120 		pos += ret;
1121 	}
1122 
1123 	if (hapd->conf->wpa && hapd->conf->wpa_deny_ptk0_rekey) {
1124 		ret = os_snprintf(pos, end - pos, "wpa_deny_ptk0_rekey=%d\n",
1125 				  hapd->conf->wpa_deny_ptk0_rekey);
1126 		if (os_snprintf_error(end - pos, ret))
1127 			return pos - buf;
1128 		pos += ret;
1129 	}
1130 
1131 	if ((hapd->conf->wpa & WPA_PROTO_RSN) && hapd->conf->extended_key_id) {
1132 		ret = os_snprintf(pos, end - pos, "extended_key_id=%d\n",
1133 				  hapd->conf->extended_key_id);
1134 		if (os_snprintf_error(end - pos, ret))
1135 			return pos - buf;
1136 		pos += ret;
1137 	}
1138 
1139 	return pos - buf;
1140 }
1141 
1142 
hostapd_ctrl_iface_set_band(struct hostapd_data * hapd,const char * bands)1143 static int hostapd_ctrl_iface_set_band(struct hostapd_data *hapd,
1144 				       const char *bands)
1145 {
1146 	union wpa_event_data event;
1147 	u32 setband_mask = WPA_SETBAND_AUTO;
1148 
1149 	/*
1150 	 * For example:
1151 	 *  SET setband 2G,6G
1152 	 *  SET setband 5G
1153 	 *  SET setband AUTO
1154 	 */
1155 	if (!os_strstr(bands, "AUTO")) {
1156 		if (os_strstr(bands, "5G"))
1157 			setband_mask |= WPA_SETBAND_5G;
1158 		if (os_strstr(bands, "6G"))
1159 			setband_mask |= WPA_SETBAND_6G;
1160 		if (os_strstr(bands, "2G"))
1161 			setband_mask |= WPA_SETBAND_2G;
1162 		if (setband_mask == WPA_SETBAND_AUTO)
1163 			return -1;
1164 	}
1165 
1166 	if (hostapd_drv_set_band(hapd, setband_mask) == 0) {
1167 		os_memset(&event, 0, sizeof(event));
1168 		event.channel_list_changed.initiator = REGDOM_SET_BY_USER;
1169 		event.channel_list_changed.type = REGDOM_TYPE_UNKNOWN;
1170 		wpa_supplicant_event(hapd, EVENT_CHANNEL_LIST_CHANGED, &event);
1171 	}
1172 
1173 	return 0;
1174 }
1175 
1176 
hostapd_ctrl_iface_set(struct hostapd_data * hapd,char * cmd)1177 static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
1178 {
1179 	char *value;
1180 	int ret = 0;
1181 
1182 	value = os_strchr(cmd, ' ');
1183 	if (value == NULL)
1184 		return -1;
1185 	*value++ = '\0';
1186 
1187 	wpa_printf(MSG_DEBUG, "CTRL_IFACE SET '%s'='%s'", cmd, value);
1188 	if (0) {
1189 #ifdef CONFIG_WPS_TESTING
1190 	} else if (os_strcasecmp(cmd, "wps_version_number") == 0) {
1191 		long int val;
1192 		val = strtol(value, NULL, 0);
1193 		if (val < 0 || val > 0xff) {
1194 			ret = -1;
1195 			wpa_printf(MSG_DEBUG, "WPS: Invalid "
1196 				   "wps_version_number %ld", val);
1197 		} else {
1198 			wps_version_number = val;
1199 			wpa_printf(MSG_DEBUG, "WPS: Testing - force WPS "
1200 				   "version %u.%u",
1201 				   (wps_version_number & 0xf0) >> 4,
1202 				   wps_version_number & 0x0f);
1203 			hostapd_wps_update_ie(hapd);
1204 		}
1205 	} else if (os_strcasecmp(cmd, "wps_testing_stub_cred") == 0) {
1206 		wps_testing_stub_cred = atoi(value);
1207 		wpa_printf(MSG_DEBUG, "WPS: Testing - stub_cred=%d",
1208 			   wps_testing_stub_cred);
1209 	} else if (os_strcasecmp(cmd, "wps_corrupt_pkhash") == 0) {
1210 		wps_corrupt_pkhash = atoi(value);
1211 		wpa_printf(MSG_DEBUG, "WPS: Testing - wps_corrupt_pkhash=%d",
1212 			   wps_corrupt_pkhash);
1213 #endif /* CONFIG_WPS_TESTING */
1214 #ifdef CONFIG_TESTING_OPTIONS
1215 	} else if (os_strcasecmp(cmd, "ext_mgmt_frame_handling") == 0) {
1216 		hapd->ext_mgmt_frame_handling = atoi(value);
1217 	} else if (os_strcasecmp(cmd, "ext_eapol_frame_io") == 0) {
1218 		hapd->ext_eapol_frame_io = atoi(value);
1219 	} else if (os_strcasecmp(cmd, "force_backlog_bytes") == 0) {
1220 		hapd->force_backlog_bytes = atoi(value);
1221 #ifdef CONFIG_DPP
1222 	} else if (os_strcasecmp(cmd, "dpp_config_obj_override") == 0) {
1223 		os_free(hapd->dpp_config_obj_override);
1224 		hapd->dpp_config_obj_override = os_strdup(value);
1225 	} else if (os_strcasecmp(cmd, "dpp_discovery_override") == 0) {
1226 		os_free(hapd->dpp_discovery_override);
1227 		hapd->dpp_discovery_override = os_strdup(value);
1228 	} else if (os_strcasecmp(cmd, "dpp_groups_override") == 0) {
1229 		os_free(hapd->dpp_groups_override);
1230 		hapd->dpp_groups_override = os_strdup(value);
1231 	} else if (os_strcasecmp(cmd,
1232 				 "dpp_ignore_netaccesskey_mismatch") == 0) {
1233 		hapd->dpp_ignore_netaccesskey_mismatch = atoi(value);
1234 	} else if (os_strcasecmp(cmd, "dpp_test") == 0) {
1235 		dpp_test = atoi(value);
1236 	} else if (os_strcasecmp(cmd, "dpp_version_override") == 0) {
1237 		dpp_version_override = atoi(value);
1238 #endif /* CONFIG_DPP */
1239 #endif /* CONFIG_TESTING_OPTIONS */
1240 #ifdef CONFIG_MBO
1241 	} else if (os_strcasecmp(cmd, "mbo_assoc_disallow") == 0) {
1242 		int val;
1243 
1244 		if (!hapd->conf->mbo_enabled)
1245 			return -1;
1246 
1247 		val = atoi(value);
1248 		if (val < 0 || val > MBO_ASSOC_DISALLOW_REASON_LOW_RSSI)
1249 			return -1;
1250 
1251 		hapd->mbo_assoc_disallow = val;
1252 		ieee802_11_update_beacons(hapd->iface);
1253 
1254 		/*
1255 		 * TODO: Need to configure drivers that do AP MLME offload with
1256 		 * disallowing station logic.
1257 		 */
1258 #endif /* CONFIG_MBO */
1259 #ifdef CONFIG_DPP
1260 	} else if (os_strcasecmp(cmd, "dpp_configurator_params") == 0) {
1261 		os_free(hapd->dpp_configurator_params);
1262 		hapd->dpp_configurator_params = os_strdup(value);
1263 #ifdef CONFIG_DPP2
1264 		dpp_controller_set_params(hapd->iface->interfaces->dpp, value);
1265 #endif /* CONFIG_DPP2 */
1266 	} else if (os_strcasecmp(cmd, "dpp_init_max_tries") == 0) {
1267 		hapd->dpp_init_max_tries = atoi(value);
1268 	} else if (os_strcasecmp(cmd, "dpp_init_retry_time") == 0) {
1269 		hapd->dpp_init_retry_time = atoi(value);
1270 	} else if (os_strcasecmp(cmd, "dpp_resp_wait_time") == 0) {
1271 		hapd->dpp_resp_wait_time = atoi(value);
1272 	} else if (os_strcasecmp(cmd, "dpp_resp_max_tries") == 0) {
1273 		hapd->dpp_resp_max_tries = atoi(value);
1274 	} else if (os_strcasecmp(cmd, "dpp_resp_retry_time") == 0) {
1275 		hapd->dpp_resp_retry_time = atoi(value);
1276 #endif /* CONFIG_DPP */
1277 	} else if (os_strcasecmp(cmd, "setband") == 0) {
1278 		ret = hostapd_ctrl_iface_set_band(hapd, value);
1279 	} else {
1280 		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
1281 		if (ret)
1282 			return ret;
1283 
1284 		if (os_strcasecmp(cmd, "deny_mac_file") == 0) {
1285 			hostapd_disassoc_deny_mac(hapd);
1286 		} else if (os_strcasecmp(cmd, "accept_mac_file") == 0) {
1287 			hostapd_disassoc_accept_mac(hapd);
1288 		} else if (os_strcasecmp(cmd, "ssid") == 0) {
1289 			hostapd_neighbor_sync_own_report(hapd);
1290 		} else if (os_strncmp(cmd, "wme_ac_", 7) == 0 ||
1291 			   os_strncmp(cmd, "wmm_ac_", 7) == 0) {
1292 			hapd->parameter_set_count++;
1293 			if (ieee802_11_update_beacons(hapd->iface))
1294 				wpa_printf(MSG_DEBUG,
1295 					   "Failed to update beacons with WMM parameters");
1296 		} else if (os_strcmp(cmd, "wpa_passphrase") == 0 ||
1297 			   os_strcmp(cmd, "sae_password") == 0 ||
1298 			   os_strcmp(cmd, "sae_pwe") == 0) {
1299 			if (hapd->started)
1300 				hostapd_setup_sae_pt(hapd->conf);
1301 		} else if (os_strcasecmp(cmd, "transition_disable") == 0) {
1302 			wpa_auth_set_transition_disable(hapd->wpa_auth,
1303 							hapd->conf->transition_disable);
1304 		}
1305 
1306 #ifdef CONFIG_TESTING_OPTIONS
1307 		if (os_strcmp(cmd, "ft_rsnxe_used") == 0)
1308 			wpa_auth_set_ft_rsnxe_used(hapd->wpa_auth,
1309 						   hapd->conf->ft_rsnxe_used);
1310 		else if (os_strcmp(cmd, "oci_freq_override_eapol_m3") == 0)
1311 			wpa_auth_set_ocv_override_freq(
1312 				hapd->wpa_auth, WPA_AUTH_OCV_OVERRIDE_EAPOL_M3,
1313 				atoi(value));
1314 		else if (os_strcmp(cmd, "oci_freq_override_eapol_g1") == 0)
1315 			wpa_auth_set_ocv_override_freq(
1316 				hapd->wpa_auth, WPA_AUTH_OCV_OVERRIDE_EAPOL_G1,
1317 				atoi(value));
1318 		else if (os_strcmp(cmd, "oci_freq_override_ft_assoc") == 0)
1319 			wpa_auth_set_ocv_override_freq(
1320 				hapd->wpa_auth, WPA_AUTH_OCV_OVERRIDE_FT_ASSOC,
1321 				atoi(value));
1322 		else if (os_strcmp(cmd, "oci_freq_override_fils_assoc") == 0)
1323 			wpa_auth_set_ocv_override_freq(
1324 				hapd->wpa_auth,
1325 				WPA_AUTH_OCV_OVERRIDE_FILS_ASSOC, atoi(value));
1326 #endif /* CONFIG_TESTING_OPTIONS */
1327 	}
1328 
1329 	return ret;
1330 }
1331 
1332 
hostapd_ctrl_iface_get(struct hostapd_data * hapd,char * cmd,char * buf,size_t buflen)1333 static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
1334 				  char *buf, size_t buflen)
1335 {
1336 	int res;
1337 
1338 	wpa_printf(MSG_DEBUG, "CTRL_IFACE GET '%s'", cmd);
1339 
1340 	if (os_strcmp(cmd, "version") == 0) {
1341 		res = os_snprintf(buf, buflen, "%s", VERSION_STR);
1342 		if (os_snprintf_error(buflen, res))
1343 			return -1;
1344 		return res;
1345 	} else if (os_strcmp(cmd, "tls_library") == 0) {
1346 		res = tls_get_library_version(buf, buflen);
1347 		if (os_snprintf_error(buflen, res))
1348 			return -1;
1349 		return res;
1350 	}
1351 
1352 	return -1;
1353 }
1354 
1355 
hostapd_ctrl_iface_enable(struct hostapd_iface * iface)1356 static int hostapd_ctrl_iface_enable(struct hostapd_iface *iface)
1357 {
1358 	if (hostapd_enable_iface(iface) < 0) {
1359 		wpa_printf(MSG_ERROR, "Enabling of interface failed");
1360 		return -1;
1361 	}
1362 	return 0;
1363 }
1364 
1365 
hostapd_ctrl_iface_reload(struct hostapd_iface * iface)1366 static int hostapd_ctrl_iface_reload(struct hostapd_iface *iface)
1367 {
1368 	if (hostapd_reload_iface(iface) < 0) {
1369 		wpa_printf(MSG_ERROR, "Reloading of interface failed");
1370 		return -1;
1371 	}
1372 	return 0;
1373 }
1374 
1375 
hostapd_ctrl_iface_reload_bss(struct hostapd_data * bss)1376 static int hostapd_ctrl_iface_reload_bss(struct hostapd_data *bss)
1377 {
1378 	if (hostapd_reload_bss_only(bss) < 0) {
1379 		wpa_printf(MSG_ERROR, "Reloading of BSS failed");
1380 		return -1;
1381 	}
1382 	return 0;
1383 }
1384 
1385 
hostapd_ctrl_iface_disable(struct hostapd_iface * iface)1386 static int hostapd_ctrl_iface_disable(struct hostapd_iface *iface)
1387 {
1388 	if (hostapd_disable_iface(iface) < 0) {
1389 		wpa_printf(MSG_ERROR, "Disabling of interface failed");
1390 		return -1;
1391 	}
1392 	return 0;
1393 }
1394 
1395 
1396 static int
hostapd_ctrl_iface_kick_mismatch_psk_sta_iter(struct hostapd_data * hapd,struct sta_info * sta,void * ctx)1397 hostapd_ctrl_iface_kick_mismatch_psk_sta_iter(struct hostapd_data *hapd,
1398 					      struct sta_info *sta, void *ctx)
1399 {
1400 	struct hostapd_wpa_psk *psk;
1401 	const u8 *pmk;
1402 	int pmk_len;
1403 	int pmk_match;
1404 	int sta_match;
1405 	int bss_match;
1406 	int reason;
1407 
1408 	pmk = wpa_auth_get_pmk(sta->wpa_sm, &pmk_len);
1409 
1410 	for (psk = hapd->conf->ssid.wpa_psk; pmk && psk; psk = psk->next) {
1411 		pmk_match = PMK_LEN == pmk_len &&
1412 			os_memcmp(psk->psk, pmk, pmk_len) == 0;
1413 		sta_match = psk->group == 0 &&
1414 			ether_addr_equal(sta->addr, psk->addr);
1415 		bss_match = psk->group == 1;
1416 
1417 		if (pmk_match && (sta_match || bss_match))
1418 			return 0;
1419 	}
1420 
1421 	wpa_printf(MSG_INFO, "STA " MACSTR
1422 		   " PSK/passphrase no longer valid - disconnect",
1423 		   MAC2STR(sta->addr));
1424 	reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
1425 	hostapd_drv_sta_deauth(hapd, sta->addr, reason);
1426 	ap_sta_deauthenticate(hapd, sta, reason);
1427 
1428 	return 0;
1429 }
1430 
1431 
hostapd_ctrl_iface_reload_wpa_psk(struct hostapd_data * hapd)1432 static int hostapd_ctrl_iface_reload_wpa_psk(struct hostapd_data *hapd)
1433 {
1434 	struct hostapd_bss_config *conf = hapd->conf;
1435 	int err;
1436 
1437 	hostapd_config_clear_wpa_psk(&conf->ssid.wpa_psk);
1438 
1439 	err = hostapd_setup_wpa_psk(conf);
1440 	if (err < 0) {
1441 		wpa_printf(MSG_ERROR, "Reloading WPA-PSK passwords failed: %d",
1442 			   err);
1443 		return -1;
1444 	}
1445 
1446 	ap_for_each_sta(hapd, hostapd_ctrl_iface_kick_mismatch_psk_sta_iter,
1447 			NULL);
1448 
1449 	return 0;
1450 }
1451 
1452 
1453 #ifdef CONFIG_IEEE80211R_AP
1454 
hostapd_ctrl_iface_get_rxkhs(struct hostapd_data * hapd,char * buf,size_t buflen)1455 static int hostapd_ctrl_iface_get_rxkhs(struct hostapd_data *hapd,
1456 					char *buf, size_t buflen)
1457 {
1458 	int ret, start_pos;
1459 	char *pos, *end;
1460 	struct ft_remote_r0kh *r0kh;
1461 	struct ft_remote_r1kh *r1kh;
1462 	struct hostapd_bss_config *conf = hapd->conf;
1463 
1464 	pos = buf;
1465 	end = buf + buflen;
1466 
1467 	for (r0kh = conf->r0kh_list; r0kh; r0kh=r0kh->next) {
1468 		start_pos = pos - buf;
1469 		ret = os_snprintf(pos, end - pos, "r0kh=" MACSTR " ",
1470 				  MAC2STR(r0kh->addr));
1471 		if (os_snprintf_error(end - pos, ret))
1472 			return start_pos;
1473 		pos += ret;
1474 		if (r0kh->id_len + 1 >= (size_t) (end - pos))
1475 			return start_pos;
1476 		os_memcpy(pos, r0kh->id, r0kh->id_len);
1477 		pos += r0kh->id_len;
1478 		*pos++ = ' ';
1479 		pos += wpa_snprintf_hex(pos, end - pos, r0kh->key,
1480 					sizeof(r0kh->key));
1481 		ret = os_snprintf(pos, end - pos, "\n");
1482 		if (os_snprintf_error(end - pos, ret))
1483 			return start_pos;
1484 		pos += ret;
1485 	}
1486 
1487 	for (r1kh = conf->r1kh_list; r1kh; r1kh=r1kh->next) {
1488 		start_pos = pos - buf;
1489 		ret = os_snprintf(pos, end - pos, "r1kh=" MACSTR " " MACSTR " ",
1490 			MAC2STR(r1kh->addr), MAC2STR(r1kh->id));
1491 		if (os_snprintf_error(end - pos, ret))
1492 			return start_pos;
1493 		pos += ret;
1494 		pos += wpa_snprintf_hex(pos, end - pos, r1kh->key,
1495 					sizeof(r1kh->key));
1496 		ret = os_snprintf(pos, end - pos, "\n");
1497 		if (os_snprintf_error(end - pos, ret))
1498 			return start_pos;
1499 		pos += ret;
1500 	}
1501 
1502 	return pos - buf;
1503 }
1504 
1505 
hostapd_ctrl_iface_reload_rxkhs(struct hostapd_data * hapd)1506 static int hostapd_ctrl_iface_reload_rxkhs(struct hostapd_data *hapd)
1507 {
1508 	struct hostapd_bss_config *conf = hapd->conf;
1509 	int err;
1510 
1511 	hostapd_config_clear_rxkhs(conf);
1512 
1513 	err = hostapd_config_read_rxkh_file(conf, conf->rxkh_file);
1514 	if (err < 0) {
1515 		wpa_printf(MSG_ERROR, "Reloading RxKHs failed: %d",
1516 			   err);
1517 		return -1;
1518 	}
1519 
1520 	return 0;
1521 }
1522 
1523 #endif /* CONFIG_IEEE80211R_AP */
1524 
1525 
1526 #ifdef CONFIG_TESTING_OPTIONS
1527 
hostapd_ctrl_iface_radar(struct hostapd_data * hapd,char * cmd)1528 static int hostapd_ctrl_iface_radar(struct hostapd_data *hapd, char *cmd)
1529 {
1530 	union wpa_event_data data;
1531 	char *pos, *param;
1532 	enum wpa_event_type event;
1533 
1534 	wpa_printf(MSG_DEBUG, "RADAR TEST: %s", cmd);
1535 
1536 	os_memset(&data, 0, sizeof(data));
1537 
1538 	param = os_strchr(cmd, ' ');
1539 	if (param == NULL)
1540 		return -1;
1541 	*param++ = '\0';
1542 
1543 	if (os_strcmp(cmd, "DETECTED") == 0)
1544 		event = EVENT_DFS_RADAR_DETECTED;
1545 	else if (os_strcmp(cmd, "CAC-FINISHED") == 0)
1546 		event = EVENT_DFS_CAC_FINISHED;
1547 	else if (os_strcmp(cmd, "CAC-ABORTED") == 0)
1548 		event = EVENT_DFS_CAC_ABORTED;
1549 	else if (os_strcmp(cmd, "NOP-FINISHED") == 0)
1550 		event = EVENT_DFS_NOP_FINISHED;
1551 	else {
1552 		wpa_printf(MSG_DEBUG, "Unsupported RADAR test command: %s",
1553 			   cmd);
1554 		return -1;
1555 	}
1556 
1557 	pos = os_strstr(param, "freq=");
1558 	if (pos)
1559 		data.dfs_event.freq = atoi(pos + 5);
1560 
1561 	pos = os_strstr(param, "ht_enabled=1");
1562 	if (pos)
1563 		data.dfs_event.ht_enabled = 1;
1564 
1565 	pos = os_strstr(param, "chan_offset=");
1566 	if (pos)
1567 		data.dfs_event.chan_offset = atoi(pos + 12);
1568 
1569 	pos = os_strstr(param, "chan_width=");
1570 	if (pos)
1571 		data.dfs_event.chan_width = atoi(pos + 11);
1572 
1573 	pos = os_strstr(param, "cf1=");
1574 	if (pos)
1575 		data.dfs_event.cf1 = atoi(pos + 4);
1576 
1577 	pos = os_strstr(param, "cf2=");
1578 	if (pos)
1579 		data.dfs_event.cf2 = atoi(pos + 4);
1580 
1581 	wpa_supplicant_event(hapd, event, &data);
1582 
1583 	return 0;
1584 }
1585 
1586 
hostapd_ctrl_iface_mgmt_tx(struct hostapd_data * hapd,char * cmd)1587 static int hostapd_ctrl_iface_mgmt_tx(struct hostapd_data *hapd, char *cmd)
1588 {
1589 	size_t len;
1590 	u8 *buf;
1591 	int res;
1592 
1593 	wpa_printf(MSG_DEBUG, "External MGMT TX: %s", cmd);
1594 
1595 	len = os_strlen(cmd);
1596 	if (len & 1)
1597 		return -1;
1598 	len /= 2;
1599 
1600 	buf = os_malloc(len);
1601 	if (buf == NULL)
1602 		return -1;
1603 
1604 	if (hexstr2bin(cmd, buf, len) < 0) {
1605 		os_free(buf);
1606 		return -1;
1607 	}
1608 
1609 	res = hostapd_drv_send_mlme(hapd, buf, len, 0, NULL, 0, 0);
1610 	os_free(buf);
1611 	return res;
1612 }
1613 
1614 
hostapd_ctrl_iface_mgmt_tx_status_process(struct hostapd_data * hapd,char * cmd)1615 static int hostapd_ctrl_iface_mgmt_tx_status_process(struct hostapd_data *hapd,
1616 						     char *cmd)
1617 {
1618 	char *pos, *param;
1619 	size_t len;
1620 	u8 *buf;
1621 	int stype = 0, ok = 0;
1622 	union wpa_event_data event;
1623 
1624 	if (!hapd->ext_mgmt_frame_handling)
1625 		return -1;
1626 
1627 	/* stype=<val> ok=<0/1> buf=<frame hexdump> */
1628 
1629 	wpa_printf(MSG_DEBUG, "External MGMT TX status process: %s", cmd);
1630 
1631 	pos = cmd;
1632 	param = os_strstr(pos, "stype=");
1633 	if (param) {
1634 		param += 6;
1635 		stype = atoi(param);
1636 	}
1637 
1638 	param = os_strstr(pos, " ok=");
1639 	if (param) {
1640 		param += 4;
1641 		ok = atoi(param);
1642 	}
1643 
1644 	param = os_strstr(pos, " buf=");
1645 	if (!param)
1646 		return -1;
1647 	param += 5;
1648 
1649 	len = os_strlen(param);
1650 	if (len & 1)
1651 		return -1;
1652 	len /= 2;
1653 
1654 	buf = os_malloc(len);
1655 	if (!buf || hexstr2bin(param, buf, len) < 0) {
1656 		os_free(buf);
1657 		return -1;
1658 	}
1659 
1660 	os_memset(&event, 0, sizeof(event));
1661 	event.tx_status.type = WLAN_FC_TYPE_MGMT;
1662 	event.tx_status.data = buf;
1663 	event.tx_status.data_len = len;
1664 	event.tx_status.stype = stype;
1665 	event.tx_status.ack = ok;
1666 	hapd->ext_mgmt_frame_handling = 0;
1667 	wpa_supplicant_event(hapd, EVENT_TX_STATUS, &event);
1668 	hapd->ext_mgmt_frame_handling = 1;
1669 
1670 	os_free(buf);
1671 
1672 	return 0;
1673 }
1674 
1675 
hostapd_ctrl_iface_mgmt_rx_process(struct hostapd_data * hapd,char * cmd)1676 static int hostapd_ctrl_iface_mgmt_rx_process(struct hostapd_data *hapd,
1677 					      char *cmd)
1678 {
1679 	char *pos, *param;
1680 	size_t len;
1681 	u8 *buf;
1682 	int freq = 0, datarate = 0, ssi_signal = 0;
1683 	union wpa_event_data event;
1684 
1685 	if (!hapd->ext_mgmt_frame_handling)
1686 		return -1;
1687 
1688 	/* freq=<MHz> datarate=<val> ssi_signal=<val> frame=<frame hexdump> */
1689 
1690 	wpa_printf(MSG_DEBUG, "External MGMT RX process: %s", cmd);
1691 
1692 	pos = cmd;
1693 	param = os_strstr(pos, "freq=");
1694 	if (param) {
1695 		param += 5;
1696 		freq = atoi(param);
1697 	}
1698 
1699 	param = os_strstr(pos, " datarate=");
1700 	if (param) {
1701 		param += 10;
1702 		datarate = atoi(param);
1703 	}
1704 
1705 	param = os_strstr(pos, " ssi_signal=");
1706 	if (param) {
1707 		param += 12;
1708 		ssi_signal = atoi(param);
1709 	}
1710 
1711 	param = os_strstr(pos, " frame=");
1712 	if (param == NULL)
1713 		return -1;
1714 	param += 7;
1715 
1716 	len = os_strlen(param);
1717 	if (len & 1)
1718 		return -1;
1719 	len /= 2;
1720 
1721 	buf = os_malloc(len);
1722 	if (buf == NULL)
1723 		return -1;
1724 
1725 	if (hexstr2bin(param, buf, len) < 0) {
1726 		os_free(buf);
1727 		return -1;
1728 	}
1729 
1730 	os_memset(&event, 0, sizeof(event));
1731 	event.rx_mgmt.freq = freq;
1732 	event.rx_mgmt.frame = buf;
1733 	event.rx_mgmt.frame_len = len;
1734 	event.rx_mgmt.ssi_signal = ssi_signal;
1735 	event.rx_mgmt.datarate = datarate;
1736 	hapd->ext_mgmt_frame_handling = 0;
1737 	wpa_supplicant_event(hapd, EVENT_RX_MGMT, &event);
1738 	hapd->ext_mgmt_frame_handling = 1;
1739 
1740 	os_free(buf);
1741 
1742 	return 0;
1743 }
1744 
1745 
hostapd_ctrl_iface_eapol_rx(struct hostapd_data * hapd,char * cmd)1746 static int hostapd_ctrl_iface_eapol_rx(struct hostapd_data *hapd, char *cmd)
1747 {
1748 	char *pos;
1749 	u8 src[ETH_ALEN], *buf;
1750 	int used;
1751 	size_t len;
1752 
1753 	wpa_printf(MSG_DEBUG, "External EAPOL RX: %s", cmd);
1754 
1755 	pos = cmd;
1756 	used = hwaddr_aton2(pos, src);
1757 	if (used < 0)
1758 		return -1;
1759 	pos += used;
1760 	while (*pos == ' ')
1761 		pos++;
1762 
1763 	len = os_strlen(pos);
1764 	if (len & 1)
1765 		return -1;
1766 	len /= 2;
1767 
1768 	buf = os_malloc(len);
1769 	if (buf == NULL)
1770 		return -1;
1771 
1772 	if (hexstr2bin(pos, buf, len) < 0) {
1773 		os_free(buf);
1774 		return -1;
1775 	}
1776 
1777 	ieee802_1x_receive(hapd, src, buf, len, FRAME_ENCRYPTION_UNKNOWN);
1778 	os_free(buf);
1779 
1780 	return 0;
1781 }
1782 
1783 
hostapd_ctrl_iface_eapol_tx(struct hostapd_data * hapd,char * cmd)1784 static int hostapd_ctrl_iface_eapol_tx(struct hostapd_data *hapd, char *cmd)
1785 {
1786 	char *pos, *pos2;
1787 	u8 dst[ETH_ALEN], *buf;
1788 	int used, ret;
1789 	size_t len;
1790 	unsigned int prev;
1791 	int encrypt = 0;
1792 
1793 	wpa_printf(MSG_DEBUG, "External EAPOL TX: %s", cmd);
1794 
1795 	pos = cmd;
1796 	used = hwaddr_aton2(pos, dst);
1797 	if (used < 0)
1798 		return -1;
1799 	pos += used;
1800 	while (*pos == ' ')
1801 		pos++;
1802 
1803 	pos2 = os_strchr(pos, ' ');
1804 	if (pos2) {
1805 		len = pos2 - pos;
1806 		encrypt = os_strstr(pos2, "encrypt=1") != NULL;
1807 	} else {
1808 		len = os_strlen(pos);
1809 	}
1810 	if (len & 1)
1811 		return -1;
1812 	len /= 2;
1813 
1814 	buf = os_malloc(len);
1815 	if (!buf || hexstr2bin(pos, buf, len) < 0) {
1816 		os_free(buf);
1817 		return -1;
1818 	}
1819 
1820 	prev = hapd->ext_eapol_frame_io;
1821 	hapd->ext_eapol_frame_io = 0;
1822 	ret = hostapd_wpa_auth_send_eapol(hapd, dst, buf, len, encrypt);
1823 	hapd->ext_eapol_frame_io = prev;
1824 	os_free(buf);
1825 
1826 	return ret;
1827 }
1828 
1829 
ipv4_hdr_checksum(const void * buf,size_t len)1830 static u16 ipv4_hdr_checksum(const void *buf, size_t len)
1831 {
1832 	size_t i;
1833 	u32 sum = 0;
1834 	const u16 *pos = buf;
1835 
1836 	for (i = 0; i < len / 2; i++)
1837 		sum += *pos++;
1838 
1839 	while (sum >> 16)
1840 		sum = (sum & 0xffff) + (sum >> 16);
1841 
1842 	return sum ^ 0xffff;
1843 }
1844 
1845 
1846 #define HWSIM_PACKETLEN 1500
1847 #define HWSIM_IP_LEN (HWSIM_PACKETLEN - sizeof(struct ether_header))
1848 
hostapd_data_test_rx(void * ctx,const u8 * src_addr,const u8 * buf,size_t len)1849 static void hostapd_data_test_rx(void *ctx, const u8 *src_addr, const u8 *buf,
1850 				 size_t len)
1851 {
1852 	struct hostapd_data *hapd = ctx;
1853 	const struct ether_header *eth;
1854 	struct ip ip;
1855 	const u8 *pos;
1856 	unsigned int i;
1857 	char extra[30];
1858 
1859 	if (len < sizeof(*eth) + sizeof(ip) || len > HWSIM_PACKETLEN) {
1860 		wpa_printf(MSG_DEBUG,
1861 			   "test data: RX - ignore unexpected length %d",
1862 			   (int) len);
1863 		return;
1864 	}
1865 
1866 	eth = (const struct ether_header *) buf;
1867 	os_memcpy(&ip, eth + 1, sizeof(ip));
1868 	pos = &buf[sizeof(*eth) + sizeof(ip)];
1869 
1870 	if (ip.ip_hl != 5 || ip.ip_v != 4 ||
1871 	    ntohs(ip.ip_len) > HWSIM_IP_LEN) {
1872 		wpa_printf(MSG_DEBUG,
1873 			   "test data: RX - ignore unexpected IP header");
1874 		return;
1875 	}
1876 
1877 	for (i = 0; i < ntohs(ip.ip_len) - sizeof(ip); i++) {
1878 		if (*pos != (u8) i) {
1879 			wpa_printf(MSG_DEBUG,
1880 				   "test data: RX - ignore mismatching payload");
1881 			return;
1882 		}
1883 		pos++;
1884 	}
1885 
1886 	extra[0] = '\0';
1887 	if (ntohs(ip.ip_len) != HWSIM_IP_LEN)
1888 		os_snprintf(extra, sizeof(extra), " len=%d", ntohs(ip.ip_len));
1889 	wpa_msg(hapd->msg_ctx, MSG_INFO, "DATA-TEST-RX " MACSTR " " MACSTR "%s",
1890 		MAC2STR(eth->ether_dhost), MAC2STR(eth->ether_shost), extra);
1891 }
1892 
1893 
hostapd_ctrl_iface_data_test_config(struct hostapd_data * hapd,char * cmd)1894 static int hostapd_ctrl_iface_data_test_config(struct hostapd_data *hapd,
1895 					       char *cmd)
1896 {
1897 	int enabled = atoi(cmd);
1898 	char *pos;
1899 	const char *ifname;
1900 	const u8 *addr = hapd->own_addr;
1901 
1902 	if (!enabled) {
1903 		if (hapd->l2_test) {
1904 			l2_packet_deinit(hapd->l2_test);
1905 			hapd->l2_test = NULL;
1906 			wpa_dbg(hapd->msg_ctx, MSG_DEBUG,
1907 				"test data: Disabled");
1908 		}
1909 		return 0;
1910 	}
1911 
1912 	if (hapd->l2_test)
1913 		return 0;
1914 
1915 	pos = os_strstr(cmd, " ifname=");
1916 	if (pos)
1917 		ifname = pos + 8;
1918 	else
1919 		ifname = hapd->conf->iface;
1920 
1921 #ifdef CONFIG_IEEE80211BE
1922 	if (hapd->conf->mld_ap)
1923 		addr = hapd->mld->mld_addr;
1924 #endif /* CONFIG_IEEE80211BE */
1925 	hapd->l2_test = l2_packet_init(ifname, addr,
1926 					ETHERTYPE_IP, hostapd_data_test_rx,
1927 					hapd, 1);
1928 	if (hapd->l2_test == NULL)
1929 		return -1;
1930 
1931 	wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "test data: Enabled");
1932 
1933 	return 0;
1934 }
1935 
1936 
hostapd_ctrl_iface_data_test_tx(struct hostapd_data * hapd,char * cmd)1937 static int hostapd_ctrl_iface_data_test_tx(struct hostapd_data *hapd, char *cmd)
1938 {
1939 	u8 dst[ETH_ALEN], src[ETH_ALEN];
1940 	char *pos, *pos2;
1941 	int used;
1942 	long int val;
1943 	u8 tos;
1944 	u8 buf[2 + HWSIM_PACKETLEN];
1945 	struct ether_header *eth;
1946 	struct ip *ip;
1947 	u8 *dpos;
1948 	unsigned int i;
1949 	size_t send_len = HWSIM_IP_LEN;
1950 
1951 	if (hapd->l2_test == NULL)
1952 		return -1;
1953 
1954 	/* format: <dst> <src> <tos> [len=<length>] */
1955 
1956 	pos = cmd;
1957 	used = hwaddr_aton2(pos, dst);
1958 	if (used < 0)
1959 		return -1;
1960 	pos += used;
1961 	while (*pos == ' ')
1962 		pos++;
1963 	used = hwaddr_aton2(pos, src);
1964 	if (used < 0)
1965 		return -1;
1966 	pos += used;
1967 
1968 	val = strtol(pos, &pos2, 0);
1969 	if (val < 0 || val > 0xff)
1970 		return -1;
1971 	tos = val;
1972 
1973 	pos = os_strstr(pos2, " len=");
1974 	if (pos) {
1975 		i = atoi(pos + 5);
1976 		if (i < sizeof(*ip) || i > HWSIM_IP_LEN)
1977 			return -1;
1978 		send_len = i;
1979 	}
1980 
1981 	eth = (struct ether_header *) &buf[2];
1982 	os_memcpy(eth->ether_dhost, dst, ETH_ALEN);
1983 	os_memcpy(eth->ether_shost, src, ETH_ALEN);
1984 	eth->ether_type = htons(ETHERTYPE_IP);
1985 	ip = (struct ip *) (eth + 1);
1986 	os_memset(ip, 0, sizeof(*ip));
1987 	ip->ip_hl = 5;
1988 	ip->ip_v = 4;
1989 	ip->ip_ttl = 64;
1990 	ip->ip_tos = tos;
1991 	ip->ip_len = htons(send_len);
1992 	ip->ip_p = 1;
1993 	ip->ip_src.s_addr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 1);
1994 	ip->ip_dst.s_addr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 2);
1995 	ip->ip_sum = ipv4_hdr_checksum(ip, sizeof(*ip));
1996 	dpos = (u8 *) (ip + 1);
1997 	for (i = 0; i < send_len - sizeof(*ip); i++)
1998 		*dpos++ = i;
1999 
2000 	if (l2_packet_send(hapd->l2_test, dst, ETHERTYPE_IP, &buf[2],
2001 			   sizeof(struct ether_header) + send_len) < 0)
2002 		return -1;
2003 
2004 	wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "test data: TX dst=" MACSTR
2005 		" src=" MACSTR " tos=0x%x", MAC2STR(dst), MAC2STR(src), tos);
2006 
2007 	return 0;
2008 }
2009 
2010 
hostapd_ctrl_iface_data_test_frame(struct hostapd_data * hapd,char * cmd)2011 static int hostapd_ctrl_iface_data_test_frame(struct hostapd_data *hapd,
2012 					      char *cmd)
2013 {
2014 	u8 *buf;
2015 	struct ether_header *eth;
2016 	struct l2_packet_data *l2 = NULL;
2017 	size_t len;
2018 	u16 ethertype;
2019 	int res = -1;
2020 	const char *ifname = hapd->conf->iface;
2021 
2022 	if (os_strncmp(cmd, "ifname=", 7) == 0) {
2023 		cmd += 7;
2024 		ifname = cmd;
2025 		cmd = os_strchr(cmd, ' ');
2026 		if (cmd == NULL)
2027 			return -1;
2028 		*cmd++ = '\0';
2029 	}
2030 
2031 	len = os_strlen(cmd);
2032 	if (len & 1 || len < ETH_HLEN * 2)
2033 		return -1;
2034 	len /= 2;
2035 
2036 	buf = os_malloc(len);
2037 	if (buf == NULL)
2038 		return -1;
2039 
2040 	if (hexstr2bin(cmd, buf, len) < 0)
2041 		goto done;
2042 
2043 	eth = (struct ether_header *) buf;
2044 	ethertype = ntohs(eth->ether_type);
2045 
2046 	l2 = l2_packet_init(ifname, hapd->own_addr, ethertype,
2047 			    hostapd_data_test_rx, hapd, 1);
2048 	if (l2 == NULL)
2049 		goto done;
2050 
2051 	res = l2_packet_send(l2, eth->ether_dhost, ethertype, buf, len);
2052 	wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "test data: TX frame res=%d", res);
2053 done:
2054 	if (l2)
2055 		l2_packet_deinit(l2);
2056 	os_free(buf);
2057 
2058 	return res < 0 ? -1 : 0;
2059 }
2060 
2061 
hostapd_ctrl_reset_pn(struct hostapd_data * hapd,const char * cmd)2062 static int hostapd_ctrl_reset_pn(struct hostapd_data *hapd, const char *cmd)
2063 {
2064 	struct sta_info *sta;
2065 	u8 addr[ETH_ALEN];
2066 	u8 zero[WPA_TK_MAX_LEN];
2067 
2068 	os_memset(zero, 0, sizeof(zero));
2069 
2070 	if (hwaddr_aton(cmd, addr))
2071 		return -1;
2072 
2073 	if (is_broadcast_ether_addr(addr) && os_strstr(cmd, " BIGTK")) {
2074 		if (hapd->last_bigtk_alg == WPA_ALG_NONE)
2075 			return -1;
2076 
2077 		wpa_printf(MSG_INFO, "TESTING: Reset BIPN for BIGTK");
2078 
2079 		/* First, use a zero key to avoid any possible duplicate key
2080 		 * avoidance in the driver. */
2081 		if (hostapd_drv_set_key(hapd->conf->iface, hapd,
2082 					hapd->last_bigtk_alg,
2083 					broadcast_ether_addr,
2084 					hapd->last_bigtk_key_idx, 0, 1, NULL, 0,
2085 					zero, hapd->last_bigtk_len,
2086 					KEY_FLAG_GROUP_TX_DEFAULT) < 0)
2087 			return -1;
2088 
2089 		/* Set the previously configured key to reset its TSC */
2090 		return hostapd_drv_set_key(hapd->conf->iface, hapd,
2091 					   hapd->last_bigtk_alg,
2092 					   broadcast_ether_addr,
2093 					   hapd->last_bigtk_key_idx, 0, 1, NULL,
2094 					   0, hapd->last_bigtk,
2095 					   hapd->last_bigtk_len,
2096 					   KEY_FLAG_GROUP_TX_DEFAULT);
2097 	}
2098 
2099 	if (is_broadcast_ether_addr(addr) && os_strstr(cmd, "IGTK")) {
2100 		if (hapd->last_igtk_alg == WPA_ALG_NONE)
2101 			return -1;
2102 
2103 		wpa_printf(MSG_INFO, "TESTING: Reset IPN for IGTK");
2104 
2105 		/* First, use a zero key to avoid any possible duplicate key
2106 		 * avoidance in the driver. */
2107 		if (hostapd_drv_set_key(hapd->conf->iface, hapd,
2108 					hapd->last_igtk_alg,
2109 					broadcast_ether_addr,
2110 					hapd->last_igtk_key_idx, 0, 1, NULL, 0,
2111 					zero, hapd->last_igtk_len,
2112 					KEY_FLAG_GROUP_TX_DEFAULT) < 0)
2113 			return -1;
2114 
2115 		/* Set the previously configured key to reset its TSC */
2116 		return hostapd_drv_set_key(hapd->conf->iface, hapd,
2117 					   hapd->last_igtk_alg,
2118 					   broadcast_ether_addr,
2119 					   hapd->last_igtk_key_idx, 0, 1, NULL,
2120 					   0, hapd->last_igtk,
2121 					   hapd->last_igtk_len,
2122 					   KEY_FLAG_GROUP_TX_DEFAULT);
2123 	}
2124 
2125 	if (is_broadcast_ether_addr(addr)) {
2126 		if (hapd->last_gtk_alg == WPA_ALG_NONE)
2127 			return -1;
2128 
2129 		wpa_printf(MSG_INFO, "TESTING: Reset PN for GTK");
2130 
2131 		/* First, use a zero key to avoid any possible duplicate key
2132 		 * avoidance in the driver. */
2133 		if (hostapd_drv_set_key(hapd->conf->iface, hapd,
2134 					hapd->last_gtk_alg,
2135 					broadcast_ether_addr,
2136 					hapd->last_gtk_key_idx, 0, 1, NULL, 0,
2137 					zero, hapd->last_gtk_len,
2138 					KEY_FLAG_GROUP_TX_DEFAULT) < 0)
2139 			return -1;
2140 
2141 		/* Set the previously configured key to reset its TSC */
2142 		return hostapd_drv_set_key(hapd->conf->iface, hapd,
2143 					   hapd->last_gtk_alg,
2144 					   broadcast_ether_addr,
2145 					   hapd->last_gtk_key_idx, 0, 1, NULL,
2146 					   0, hapd->last_gtk,
2147 					   hapd->last_gtk_len,
2148 					   KEY_FLAG_GROUP_TX_DEFAULT);
2149 	}
2150 
2151 	sta = ap_get_sta(hapd, addr);
2152 	if (!sta)
2153 		return -1;
2154 
2155 	if (sta->last_tk_alg == WPA_ALG_NONE)
2156 		return -1;
2157 
2158 	wpa_printf(MSG_INFO, "TESTING: Reset PN for " MACSTR,
2159 		   MAC2STR(sta->addr));
2160 
2161 	/* First, use a zero key to avoid any possible duplicate key avoidance
2162 	 * in the driver. */
2163 	if (hostapd_drv_set_key(hapd->conf->iface, hapd, sta->last_tk_alg,
2164 				sta->addr, sta->last_tk_key_idx, 0, 1, NULL, 0,
2165 				zero, sta->last_tk_len,
2166 				KEY_FLAG_PAIRWISE_RX_TX) < 0)
2167 		return -1;
2168 
2169 	/* Set the previously configured key to reset its TSC/RSC */
2170 	return hostapd_drv_set_key(hapd->conf->iface, hapd, sta->last_tk_alg,
2171 				   sta->addr, sta->last_tk_key_idx, 0, 1, NULL,
2172 				   0, sta->last_tk, sta->last_tk_len,
2173 				   KEY_FLAG_PAIRWISE_RX_TX);
2174 }
2175 
2176 
hostapd_ctrl_set_key(struct hostapd_data * hapd,const char * cmd)2177 static int hostapd_ctrl_set_key(struct hostapd_data *hapd, const char *cmd)
2178 {
2179 	u8 addr[ETH_ALEN];
2180 	const char *pos = cmd;
2181 	enum wpa_alg alg;
2182 	enum key_flag key_flag;
2183 	int idx, set_tx;
2184 	u8 seq[6], key[WPA_TK_MAX_LEN];
2185 	size_t key_len;
2186 
2187 	/* parameters: alg addr idx set_tx seq key key_flag */
2188 
2189 	alg = atoi(pos);
2190 	pos = os_strchr(pos, ' ');
2191 	if (!pos)
2192 		return -1;
2193 	pos++;
2194 	if (hwaddr_aton(pos, addr))
2195 		return -1;
2196 	pos += 17;
2197 	if (*pos != ' ')
2198 		return -1;
2199 	pos++;
2200 	idx = atoi(pos);
2201 	pos = os_strchr(pos, ' ');
2202 	if (!pos)
2203 		return -1;
2204 	pos++;
2205 	set_tx = atoi(pos);
2206 	pos = os_strchr(pos, ' ');
2207 	if (!pos)
2208 		return -1;
2209 	pos++;
2210 	if (hexstr2bin(pos, seq, sizeof(seq)) < 0)
2211 		return -1;
2212 	pos += 2 * 6;
2213 	if (*pos != ' ')
2214 		return -1;
2215 	pos++;
2216 	if (!os_strchr(pos, ' '))
2217 		return -1;
2218 	key_len = (os_strchr(pos, ' ') - pos) / 2;
2219 	if (hexstr2bin(pos, key, key_len) < 0)
2220 		return -1;
2221 	pos += 2 * key_len;
2222 	if (*pos != ' ')
2223 		return -1;
2224 
2225 	pos++;
2226 	key_flag = atoi(pos);
2227 	pos = os_strchr(pos, ' ');
2228 	if (pos)
2229 		return -1;
2230 
2231 	wpa_printf(MSG_INFO, "TESTING: Set key");
2232 	return hostapd_drv_set_key(hapd->conf->iface, hapd, alg, addr, idx, 0,
2233 				   set_tx, seq, 6, key, key_len, key_flag);
2234 }
2235 
2236 
restore_tk(void * ctx1,void * ctx2)2237 static void restore_tk(void *ctx1, void *ctx2)
2238 {
2239 	struct hostapd_data *hapd = ctx1;
2240 	struct sta_info *sta = ctx2;
2241 
2242 	wpa_printf(MSG_INFO, "TESTING: Restore TK for " MACSTR,
2243 		   MAC2STR(sta->addr));
2244 	/* This does not really restore the TSC properly, so this will result
2245 	 * in replay protection issues for now since there is no clean way of
2246 	 * preventing encryption of a single EAPOL frame. */
2247 	hostapd_drv_set_key(hapd->conf->iface, hapd, sta->last_tk_alg,
2248 			    sta->addr, sta->last_tk_key_idx, 0, 1, NULL, 0,
2249 			    sta->last_tk, sta->last_tk_len,
2250 			    KEY_FLAG_PAIRWISE_RX_TX);
2251 }
2252 
2253 
hostapd_ctrl_resend_m1(struct hostapd_data * hapd,const char * cmd)2254 static int hostapd_ctrl_resend_m1(struct hostapd_data *hapd, const char *cmd)
2255 {
2256 	struct sta_info *sta;
2257 	u8 addr[ETH_ALEN];
2258 	int plain = os_strstr(cmd, "plaintext") != NULL;
2259 
2260 	if (hwaddr_aton(cmd, addr))
2261 		return -1;
2262 
2263 	sta = ap_get_sta(hapd, addr);
2264 	if (!sta || !sta->wpa_sm)
2265 		return -1;
2266 
2267 	if (plain && sta->last_tk_alg == WPA_ALG_NONE)
2268 		plain = 0; /* no need for special processing */
2269 	if (plain) {
2270 		wpa_printf(MSG_INFO, "TESTING: Clear TK for " MACSTR,
2271 			   MAC2STR(sta->addr));
2272 		hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_NONE,
2273 				    sta->addr, sta->last_tk_key_idx, 0, 0, NULL,
2274 				    0, NULL, 0, KEY_FLAG_PAIRWISE);
2275 	}
2276 
2277 	wpa_printf(MSG_INFO, "TESTING: Send M1 to " MACSTR, MAC2STR(sta->addr));
2278 	return wpa_auth_resend_m1(sta->wpa_sm,
2279 				  os_strstr(cmd, "change-anonce") != NULL,
2280 				  plain ? restore_tk : NULL, hapd, sta);
2281 }
2282 
2283 
hostapd_ctrl_resend_m3(struct hostapd_data * hapd,const char * cmd)2284 static int hostapd_ctrl_resend_m3(struct hostapd_data *hapd, const char *cmd)
2285 {
2286 	struct sta_info *sta;
2287 	u8 addr[ETH_ALEN];
2288 	int plain = os_strstr(cmd, "plaintext") != NULL;
2289 
2290 	if (hwaddr_aton(cmd, addr))
2291 		return -1;
2292 
2293 	sta = ap_get_sta(hapd, addr);
2294 	if (!sta || !sta->wpa_sm)
2295 		return -1;
2296 
2297 	if (plain && sta->last_tk_alg == WPA_ALG_NONE)
2298 		plain = 0; /* no need for special processing */
2299 	if (plain) {
2300 		wpa_printf(MSG_INFO, "TESTING: Clear TK for " MACSTR,
2301 			   MAC2STR(sta->addr));
2302 		hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_NONE,
2303 				    sta->addr, sta->last_tk_key_idx, 0, 0, NULL,
2304 				    0, NULL, 0, KEY_FLAG_PAIRWISE);
2305 	}
2306 
2307 	wpa_printf(MSG_INFO, "TESTING: Send M3 to " MACSTR, MAC2STR(sta->addr));
2308 	return wpa_auth_resend_m3(sta->wpa_sm,
2309 				  plain ? restore_tk : NULL, hapd, sta);
2310 }
2311 
2312 
hostapd_ctrl_resend_group_m1(struct hostapd_data * hapd,const char * cmd)2313 static int hostapd_ctrl_resend_group_m1(struct hostapd_data *hapd,
2314 					const char *cmd)
2315 {
2316 	struct sta_info *sta;
2317 	u8 addr[ETH_ALEN];
2318 	int plain = os_strstr(cmd, "plaintext") != NULL;
2319 
2320 	if (hwaddr_aton(cmd, addr))
2321 		return -1;
2322 
2323 	sta = ap_get_sta(hapd, addr);
2324 	if (!sta || !sta->wpa_sm)
2325 		return -1;
2326 
2327 	if (plain && sta->last_tk_alg == WPA_ALG_NONE)
2328 		plain = 0; /* no need for special processing */
2329 	if (plain) {
2330 		wpa_printf(MSG_INFO, "TESTING: Clear TK for " MACSTR,
2331 			   MAC2STR(sta->addr));
2332 		hostapd_drv_set_key(hapd->conf->iface, hapd, WPA_ALG_NONE,
2333 				    sta->addr, sta->last_tk_key_idx, 0, 0, NULL,
2334 				    0, NULL, 0, KEY_FLAG_PAIRWISE);
2335 	}
2336 
2337 	wpa_printf(MSG_INFO,
2338 		   "TESTING: Send group M1 for the same GTK and zero RSC to "
2339 		   MACSTR, MAC2STR(sta->addr));
2340 	return wpa_auth_resend_group_m1(sta->wpa_sm,
2341 					plain ? restore_tk : NULL, hapd, sta);
2342 }
2343 
2344 
hostapd_ctrl_rekey_ptk(struct hostapd_data * hapd,const char * cmd)2345 static int hostapd_ctrl_rekey_ptk(struct hostapd_data *hapd, const char *cmd)
2346 {
2347 	struct sta_info *sta;
2348 	u8 addr[ETH_ALEN];
2349 
2350 	if (hwaddr_aton(cmd, addr))
2351 		return -1;
2352 
2353 	sta = ap_get_sta(hapd, addr);
2354 	if (!sta || !sta->wpa_sm)
2355 		return -1;
2356 
2357 	return wpa_auth_rekey_ptk(hapd->wpa_auth, sta->wpa_sm);
2358 }
2359 
2360 
hostapd_ctrl_get_pmksa_pmk(struct hostapd_data * hapd,const u8 * addr,char * buf,size_t buflen)2361 static int hostapd_ctrl_get_pmksa_pmk(struct hostapd_data *hapd, const u8 *addr,
2362 				      char *buf, size_t buflen)
2363 {
2364 	struct rsn_pmksa_cache_entry *pmksa;
2365 
2366 	pmksa = wpa_auth_pmksa_get(hapd->wpa_auth, addr, NULL);
2367 	if (!pmksa)
2368 		return -1;
2369 
2370 	return wpa_snprintf_hex(buf, buflen, pmksa->pmk, pmksa->pmk_len);
2371 }
2372 
2373 
hostapd_ctrl_get_pmk(struct hostapd_data * hapd,const char * cmd,char * buf,size_t buflen)2374 static int hostapd_ctrl_get_pmk(struct hostapd_data *hapd, const char *cmd,
2375 				char *buf, size_t buflen)
2376 {
2377 	struct sta_info *sta;
2378 	u8 addr[ETH_ALEN];
2379 	const u8 *pmk;
2380 	int pmk_len;
2381 
2382 	if (hwaddr_aton(cmd, addr))
2383 		return -1;
2384 
2385 	sta = ap_get_sta(hapd, addr);
2386 	if (!sta || !sta->wpa_sm) {
2387 		wpa_printf(MSG_DEBUG, "No STA WPA state machine for " MACSTR,
2388 			   MAC2STR(addr));
2389 		return hostapd_ctrl_get_pmksa_pmk(hapd, addr, buf, buflen);
2390 	}
2391 	pmk = wpa_auth_get_pmk(sta->wpa_sm, &pmk_len);
2392 	if (!pmk || !pmk_len) {
2393 		wpa_printf(MSG_DEBUG, "No PMK stored for " MACSTR,
2394 			   MAC2STR(addr));
2395 		return hostapd_ctrl_get_pmksa_pmk(hapd, addr, buf, buflen);
2396 	}
2397 
2398 	return wpa_snprintf_hex(buf, buflen, pmk, pmk_len);
2399 }
2400 
2401 
hostapd_ctrl_register_frame(struct hostapd_data * hapd,const char * cmd)2402 static int hostapd_ctrl_register_frame(struct hostapd_data *hapd,
2403 				       const char *cmd)
2404 {
2405 	u16 type;
2406 	char *pos, *end;
2407 	u8 match[10];
2408 	size_t match_len;
2409 	bool multicast = false;
2410 
2411 	type = strtol(cmd, &pos, 16);
2412 	if (*pos != ' ')
2413 		return -1;
2414 	pos++;
2415 	end = os_strchr(pos, ' ');
2416 	if (end) {
2417 		match_len = end - pos;
2418 		multicast = os_strstr(end, "multicast") != NULL;
2419 	} else {
2420 		match_len = os_strlen(pos) / 2;
2421 	}
2422 	if (hexstr2bin(pos, match, match_len))
2423 		return -1;
2424 
2425 	return hostapd_drv_register_frame(hapd, type, match, match_len,
2426 					  multicast);
2427 }
2428 
2429 #endif /* CONFIG_TESTING_OPTIONS */
2430 
2431 
2432 #ifdef NEED_AP_MLME
2433 
2434 static bool
hostapd_ctrl_is_freq_in_cmode(struct hostapd_hw_modes * mode,struct hostapd_multi_hw_info * current_hw_info,int freq)2435 hostapd_ctrl_is_freq_in_cmode(struct hostapd_hw_modes *mode,
2436 			      struct hostapd_multi_hw_info *current_hw_info,
2437 			      int freq)
2438 {
2439 	struct hostapd_channel_data *chan;
2440 	int i;
2441 
2442 	for (i = 0; i < mode->num_channels; i++) {
2443 		chan = &mode->channels[i];
2444 
2445 		if (chan->flag & HOSTAPD_CHAN_DISABLED)
2446 			continue;
2447 
2448 		if (!chan_in_current_hw_info(current_hw_info, chan))
2449 			continue;
2450 
2451 		if (chan->freq == freq)
2452 			return true;
2453 	}
2454 	return false;
2455 }
2456 
2457 
hostapd_ctrl_check_freq_params(struct hostapd_freq_params * params,u16 punct_bitmap)2458 static int hostapd_ctrl_check_freq_params(struct hostapd_freq_params *params,
2459 					  u16 punct_bitmap)
2460 {
2461 	u32 start_freq;
2462 
2463 	if (is_6ghz_freq(params->freq)) {
2464 		const int bw_idx[] = { 20, 40, 80, 160, 320 };
2465 		int idx, bw;
2466 
2467 		/* The 6 GHz band requires HE to be enabled. */
2468 		params->he_enabled = 1;
2469 
2470 		if (params->center_freq1) {
2471 			if (params->freq == 5935)
2472 				idx = (params->center_freq1 - 5925) / 5;
2473 			else
2474 				idx = (params->center_freq1 - 5950) / 5;
2475 
2476 			bw = center_idx_to_bw_6ghz(idx);
2477 			if (bw < 0 || bw > (int) ARRAY_SIZE(bw_idx) ||
2478 			    bw_idx[bw] != params->bandwidth)
2479 				return -1;
2480 		}
2481 	} else { /* Non-6 GHz channel */
2482 		/* An EHT STA is also an HE STA as defined in
2483 		 * IEEE P802.11be/D5.0, 4.3.16a. */
2484 		if (params->he_enabled || params->eht_enabled) {
2485 			params->he_enabled = 1;
2486 			/* An HE STA is also a VHT STA if operating in the 5 GHz
2487 			 * band and an HE STA is also an HT STA in the 2.4 GHz
2488 			 * band as defined in IEEE Std 802.11ax-2021, 4.3.15a.
2489 			 * A VHT STA is an HT STA as defined in IEEE
2490 			 * Std 802.11, 4.3.15. */
2491 			if (IS_5GHZ(params->freq))
2492 				params->vht_enabled = 1;
2493 
2494 			params->ht_enabled = 1;
2495 		}
2496 	}
2497 
2498 	switch (params->bandwidth) {
2499 	case 0:
2500 		/* bandwidth not specified: use 20 MHz by default */
2501 		/* fall-through */
2502 	case 20:
2503 		if (params->center_freq1 &&
2504 		    params->center_freq1 != params->freq)
2505 			return -1;
2506 
2507 		if (params->center_freq2 || params->sec_channel_offset)
2508 			return -1;
2509 
2510 		if (punct_bitmap)
2511 			return -1;
2512 		break;
2513 	case 40:
2514 		if (params->center_freq2 || !params->sec_channel_offset)
2515 			return -1;
2516 
2517 		if (punct_bitmap)
2518 			return -1;
2519 
2520 		if (!params->center_freq1)
2521 			break;
2522 		switch (params->sec_channel_offset) {
2523 		case 1:
2524 			if (params->freq + 10 != params->center_freq1)
2525 				return -1;
2526 			break;
2527 		case -1:
2528 			if (params->freq - 10 != params->center_freq1)
2529 				return -1;
2530 			break;
2531 		default:
2532 			return -1;
2533 		}
2534 		break;
2535 	case 80:
2536 		if (!params->center_freq1 || !params->sec_channel_offset)
2537 			return 1;
2538 
2539 		switch (params->sec_channel_offset) {
2540 		case 1:
2541 			if (params->freq - 10 != params->center_freq1 &&
2542 			    params->freq + 30 != params->center_freq1)
2543 				return 1;
2544 			break;
2545 		case -1:
2546 			if (params->freq + 10 != params->center_freq1 &&
2547 			    params->freq - 30 != params->center_freq1)
2548 				return -1;
2549 			break;
2550 		default:
2551 			return -1;
2552 		}
2553 
2554 		if (params->center_freq2 && punct_bitmap)
2555 			return -1;
2556 
2557 		/* Adjacent and overlapped are not allowed for 80+80 */
2558 		if (params->center_freq2 &&
2559 		    params->center_freq1 - params->center_freq2 <= 80 &&
2560 		    params->center_freq2 - params->center_freq1 <= 80)
2561 			return 1;
2562 		break;
2563 	case 160:
2564 		if (!params->center_freq1 || params->center_freq2 ||
2565 		    !params->sec_channel_offset)
2566 			return -1;
2567 
2568 		switch (params->sec_channel_offset) {
2569 		case 1:
2570 			if (params->freq + 70 != params->center_freq1 &&
2571 			    params->freq + 30 != params->center_freq1 &&
2572 			    params->freq - 10 != params->center_freq1 &&
2573 			    params->freq - 50 != params->center_freq1)
2574 				return -1;
2575 			break;
2576 		case -1:
2577 			if (params->freq + 50 != params->center_freq1 &&
2578 			    params->freq + 10 != params->center_freq1 &&
2579 			    params->freq - 30 != params->center_freq1 &&
2580 			    params->freq - 70 != params->center_freq1)
2581 				return -1;
2582 			break;
2583 		default:
2584 			return -1;
2585 		}
2586 		break;
2587 	case 320:
2588 		if (!params->center_freq1 || params->center_freq2 ||
2589 		    !params->sec_channel_offset)
2590 			return -1;
2591 
2592 		switch (params->sec_channel_offset) {
2593 		case 1:
2594 			if (params->freq + 150 != params->center_freq1 &&
2595 			    params->freq + 110 != params->center_freq1 &&
2596 			    params->freq + 70 != params->center_freq1 &&
2597 			    params->freq + 30 != params->center_freq1 &&
2598 			    params->freq - 10 != params->center_freq1 &&
2599 			    params->freq - 50 != params->center_freq1 &&
2600 			    params->freq - 90 != params->center_freq1 &&
2601 			    params->freq - 130 != params->center_freq1)
2602 				return -1;
2603 			break;
2604 		case -1:
2605 			if (params->freq + 130 != params->center_freq1 &&
2606 			    params->freq + 90 != params->center_freq1 &&
2607 			    params->freq + 50 != params->center_freq1 &&
2608 			    params->freq + 10 != params->center_freq1 &&
2609 			    params->freq - 30 != params->center_freq1 &&
2610 			    params->freq - 70 != params->center_freq1 &&
2611 			    params->freq - 110 != params->center_freq1 &&
2612 			    params->freq - 150 != params->center_freq1)
2613 				return -1;
2614 			break;
2615 		}
2616 		break;
2617 	default:
2618 		return -1;
2619 	}
2620 
2621 	if (!punct_bitmap)
2622 		return 0;
2623 
2624 	if (!params->eht_enabled) {
2625 		wpa_printf(MSG_ERROR,
2626 			   "Preamble puncturing supported only in EHT");
2627 		return -1;
2628 	}
2629 
2630 	if (params->freq >= 2412 && params->freq <= 2484) {
2631 		wpa_printf(MSG_ERROR,
2632 			   "Preamble puncturing is not supported in 2.4 GHz");
2633 		return -1;
2634 	}
2635 
2636 	start_freq = params->center_freq1 - (params->bandwidth / 2);
2637 	if (!is_punct_bitmap_valid(params->bandwidth,
2638 				   (params->freq - start_freq) / 20,
2639 				   punct_bitmap)) {
2640 		wpa_printf(MSG_ERROR, "Invalid preamble puncturing bitmap");
2641 		return -1;
2642 	}
2643 
2644 	return 0;
2645 }
2646 #endif /* NEED_AP_MLME */
2647 
2648 
hostapd_ctrl_iface_chan_switch(struct hostapd_iface * iface,char * pos)2649 static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
2650 					  char *pos)
2651 {
2652 #ifdef NEED_AP_MLME
2653 	struct csa_settings settings;
2654 	int ret;
2655 	int dfs_range = 0;
2656 	unsigned int i;
2657 	int bandwidth;
2658 	u8 chan;
2659 	unsigned int num_err = 0;
2660 	int err = 0;
2661 
2662 	ret = hostapd_parse_csa_settings(pos, &settings);
2663 	if (ret)
2664 		return ret;
2665 
2666 	settings.link_id = -1;
2667 #ifdef CONFIG_IEEE80211BE
2668 	if (iface->num_bss && iface->bss[0]->conf->mld_ap)
2669 		settings.link_id = iface->bss[0]->mld_link_id;
2670 #endif /* CONFIG_IEEE80211BE */
2671 
2672 	if (iface->num_hw_features > 1 &&
2673 	    !hostapd_ctrl_is_freq_in_cmode(iface->current_mode,
2674 					   iface->current_hw_info,
2675 					   settings.freq_params.freq)) {
2676 		wpa_printf(MSG_INFO,
2677 			   "chanswitch: Invalid frequency settings provided for multi band phy");
2678 		return -1;
2679 	}
2680 
2681 	ret = hostapd_ctrl_check_freq_params(&settings.freq_params,
2682 					     settings.freq_params.punct_bitmap);
2683 	if (ret) {
2684 		wpa_printf(MSG_INFO,
2685 			   "chanswitch: invalid frequency settings provided");
2686 		return ret;
2687 	}
2688 
2689 	switch (settings.freq_params.bandwidth) {
2690 	case 40:
2691 		bandwidth = CHAN_WIDTH_40;
2692 		break;
2693 	case 80:
2694 		if (settings.freq_params.center_freq2)
2695 			bandwidth = CHAN_WIDTH_80P80;
2696 		else
2697 			bandwidth = CHAN_WIDTH_80;
2698 		break;
2699 	case 160:
2700 		bandwidth = CHAN_WIDTH_160;
2701 		break;
2702 	case 320:
2703 		bandwidth = CHAN_WIDTH_320;
2704 		break;
2705 	default:
2706 		bandwidth = CHAN_WIDTH_20;
2707 		break;
2708 	}
2709 
2710 	if (settings.freq_params.center_freq1)
2711 		dfs_range += hostapd_is_dfs_overlap(
2712 			iface, bandwidth, settings.freq_params.center_freq1);
2713 	else
2714 		dfs_range += hostapd_is_dfs_overlap(
2715 			iface, bandwidth, settings.freq_params.freq);
2716 
2717 	if (settings.freq_params.center_freq2)
2718 		dfs_range += hostapd_is_dfs_overlap(
2719 			iface, bandwidth, settings.freq_params.center_freq2);
2720 
2721 	if (dfs_range) {
2722 		ret = ieee80211_freq_to_chan(settings.freq_params.freq, &chan);
2723 		if (ret == NUM_HOSTAPD_MODES) {
2724 			wpa_printf(MSG_ERROR,
2725 				   "Failed to get channel for (freq=%d, sec_channel_offset=%d, bw=%d)",
2726 				   settings.freq_params.freq,
2727 				   settings.freq_params.sec_channel_offset,
2728 				   settings.freq_params.bandwidth);
2729 			return -1;
2730 		}
2731 
2732 		settings.freq_params.channel = chan;
2733 
2734 		wpa_printf(MSG_DEBUG,
2735 			   "DFS/CAC to (channel=%u, freq=%d, sec_channel_offset=%d, bw=%d, center_freq1=%d)",
2736 			   settings.freq_params.channel,
2737 			   settings.freq_params.freq,
2738 			   settings.freq_params.sec_channel_offset,
2739 			   settings.freq_params.bandwidth,
2740 			   settings.freq_params.center_freq1);
2741 
2742 		/* Perform CAC and switch channel */
2743 		iface->is_ch_switch_dfs = true;
2744 		hostapd_switch_channel_fallback(iface, &settings.freq_params);
2745 		return 0;
2746 	}
2747 
2748 	if (iface->cac_started) {
2749 		wpa_printf(MSG_DEBUG,
2750 			   "CAC is in progress - switching channel without CSA");
2751 		return hostapd_force_channel_switch(iface, &settings);
2752 	}
2753 
2754 	for (i = 0; i < iface->num_bss; i++) {
2755 
2756 		/* Save CHAN_SWITCH VHT, HE, and EHT config */
2757 		hostapd_chan_switch_config(iface->bss[i],
2758 					   &settings.freq_params);
2759 
2760 		err = hostapd_switch_channel(iface->bss[i], &settings);
2761 		if (err) {
2762 			ret = err;
2763 			num_err++;
2764 		}
2765 	}
2766 
2767 	return (iface->num_bss == num_err) ? ret : 0;
2768 #else /* NEED_AP_MLME */
2769 	return -1;
2770 #endif /* NEED_AP_MLME */
2771 }
2772 
2773 
2774 #ifdef CONFIG_IEEE80211AX
hostapd_ctrl_iface_color_change(struct hostapd_iface * iface,const char * pos)2775 static int hostapd_ctrl_iface_color_change(struct hostapd_iface *iface,
2776 					   const char *pos)
2777 {
2778 #ifdef NEED_AP_MLME
2779 	struct cca_settings settings;
2780 	struct hostapd_data *hapd = iface->bss[0];
2781 	int ret, color;
2782 	unsigned int i;
2783 	char *end;
2784 
2785 	os_memset(&settings, 0, sizeof(settings));
2786 
2787 	color = strtol(pos, &end, 10);
2788 	if (pos == end || color < 0 || color > 63) {
2789 		wpa_printf(MSG_ERROR, "color_change: Invalid color provided");
2790 		return -1;
2791 	}
2792 
2793 	/* Color value is expected to be [1-63]. If 0 comes, assumption is this
2794 	 * is to disable the color. In this case no need to do CCA, just
2795 	 * changing Beacon frames is sufficient. */
2796 	if (color == 0) {
2797 		if (iface->conf->he_op.he_bss_color_disabled) {
2798 			wpa_printf(MSG_ERROR,
2799 				   "color_change: Color is already disabled");
2800 			return -1;
2801 		}
2802 
2803 		iface->conf->he_op.he_bss_color_disabled = 1;
2804 
2805 		for (i = 0; i < iface->num_bss; i++)
2806 			ieee802_11_set_beacon(iface->bss[i]);
2807 
2808 		return 0;
2809 	}
2810 
2811 	if (color == iface->conf->he_op.he_bss_color) {
2812 		if (!iface->conf->he_op.he_bss_color_disabled) {
2813 			wpa_printf(MSG_ERROR,
2814 				   "color_change: Provided color is already set");
2815 			return -1;
2816 		}
2817 
2818 		iface->conf->he_op.he_bss_color_disabled = 0;
2819 
2820 		for (i = 0; i < iface->num_bss; i++)
2821 			ieee802_11_set_beacon(iface->bss[i]);
2822 
2823 		return 0;
2824 	}
2825 
2826 	if (hapd->cca_in_progress) {
2827 		wpa_printf(MSG_ERROR,
2828 			   "color_change: CCA is already in progress");
2829 		return -1;
2830 	}
2831 
2832 	iface->conf->he_op.he_bss_color_disabled = 0;
2833 
2834 	for (i = 0; i < iface->num_bss; i++) {
2835 		struct hostapd_data *bss = iface->bss[i];
2836 
2837 		hostapd_cleanup_cca_params(bss);
2838 
2839 		bss->cca_color = color;
2840 		bss->cca_count = 10;
2841 
2842 		if (hostapd_fill_cca_settings(bss, &settings)) {
2843 			wpa_printf(MSG_DEBUG,
2844 				   "color_change: Filling CCA settings failed for color: %d\n",
2845 				   color);
2846 			hostapd_cleanup_cca_params(bss);
2847 			continue;
2848 		}
2849 
2850 		wpa_printf(MSG_DEBUG, "Setting user selected color: %d", color);
2851 		ret = hostapd_drv_switch_color(bss, &settings);
2852 		if (ret)
2853 			hostapd_cleanup_cca_params(bss);
2854 
2855 		free_beacon_data(&settings.beacon_cca);
2856 		free_beacon_data(&settings.beacon_after);
2857 	}
2858 
2859 	return 0;
2860 #else /* NEED_AP_MLME */
2861 	return -1;
2862 #endif /* NEED_AP_MLME */
2863 }
2864 #endif /* CONFIG_IEEE80211AX */
2865 
2866 
hostapd_maxnss(struct hostapd_data * hapd,struct sta_info * sta)2867 static u8 hostapd_maxnss(struct hostapd_data *hapd, struct sta_info *sta)
2868 {
2869 	u8 *mcs_set = NULL;
2870 	u16 mcs_map;
2871 	u8 ht_rx_nss = 0;
2872 	u8 vht_rx_nss = 1;
2873 	u8 mcs;
2874 	bool ht_supported = false;
2875 	bool vht_supported = false;
2876 	int i;
2877 
2878 	if (sta->ht_capabilities && (sta->flags & WLAN_STA_HT)) {
2879 		mcs_set = sta->ht_capabilities->supported_mcs_set;
2880 		ht_supported = true;
2881 	}
2882 
2883 	if (sta->vht_capabilities && (sta->flags & WLAN_STA_VHT)) {
2884 		mcs_map = le_to_host16(
2885 			sta->vht_capabilities->vht_supported_mcs_set.rx_map);
2886 		vht_supported = true;
2887 	}
2888 
2889 	if (ht_supported && mcs_set) {
2890 		if (mcs_set[0])
2891 			ht_rx_nss++;
2892 		if (mcs_set[1])
2893 			ht_rx_nss++;
2894 		if (mcs_set[2])
2895 			ht_rx_nss++;
2896 		if (mcs_set[3])
2897 			ht_rx_nss++;
2898 	}
2899 	if (vht_supported) {
2900 		for (i = 7; i >= 0; i--) {
2901 			mcs = (mcs_map >> (2 * i)) & 0x03;
2902 			if (mcs != 0x03) {
2903 				vht_rx_nss = i + 1;
2904 				break;
2905 			}
2906 		}
2907 	}
2908 
2909 	return ht_rx_nss > vht_rx_nss ? ht_rx_nss : vht_rx_nss;
2910 }
2911 
2912 
hostapd_ctrl_iface_notify_cw_htaction(struct hostapd_data * hapd,const u8 * addr,u8 width)2913 static char hostapd_ctrl_iface_notify_cw_htaction(struct hostapd_data *hapd,
2914 						  const u8 *addr, u8 width)
2915 {
2916 	u8 buf[3];
2917 	char ret;
2918 
2919 	width = width >= 1 ? 1 : 0;
2920 
2921 	buf[0] = WLAN_ACTION_HT;
2922 	buf[1] = WLAN_HT_ACTION_NOTIFY_CHANWIDTH;
2923 	buf[2] = width;
2924 
2925 	ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr,
2926 				      buf, sizeof(buf));
2927 	if (ret)
2928 		wpa_printf(MSG_DEBUG,
2929 			   "Failed to send Notify Channel Width frame to "
2930 			   MACSTR, MAC2STR(addr));
2931 
2932 	return ret;
2933 }
2934 
2935 
hostapd_ctrl_iface_notify_cw_vhtaction(struct hostapd_data * hapd,const u8 * addr,u8 width)2936 static char hostapd_ctrl_iface_notify_cw_vhtaction(struct hostapd_data *hapd,
2937 						   const u8 *addr, u8 width)
2938 {
2939 	u8 buf[3];
2940 	char ret;
2941 
2942 	buf[0] = WLAN_ACTION_VHT;
2943 	buf[1] = WLAN_VHT_ACTION_OPMODE_NOTIF;
2944 	buf[2] = width;
2945 
2946 	ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr,
2947 				      buf, sizeof(buf));
2948 	if (ret)
2949 		wpa_printf(MSG_DEBUG,
2950 			   "Failed to send Opeating Mode Notification frame to "
2951 			   MACSTR, MAC2STR(addr));
2952 
2953 	return ret;
2954 }
2955 
2956 
hostapd_ctrl_iface_notify_cw_change(struct hostapd_data * hapd,const char * cmd)2957 static char hostapd_ctrl_iface_notify_cw_change(struct hostapd_data *hapd,
2958 						const char *cmd)
2959 {
2960 	u8 cw, operating_mode = 0, nss;
2961 	struct sta_info *sta;
2962 	enum hostapd_hw_mode hw_mode;
2963 
2964 	if (is_6ghz_freq(hapd->iface->freq)) {
2965 		wpa_printf(MSG_ERROR, "20/40 BSS coex not supported in 6 GHz");
2966 		return -1;
2967 	}
2968 
2969 	cw = atoi(cmd);
2970 	hw_mode = hapd->iface->current_mode->mode;
2971 	if ((hw_mode == HOSTAPD_MODE_IEEE80211G ||
2972 	     hw_mode == HOSTAPD_MODE_IEEE80211B) &&
2973 	    !(cw == 0 || cw == 1)) {
2974 		wpa_printf(MSG_ERROR,
2975 			   "Channel width should be either 20 MHz or 40 MHz for 2.4 GHz band");
2976 		return -1;
2977 	}
2978 
2979 	switch (cw) {
2980 	case 0:
2981 		operating_mode = 0;
2982 		break;
2983 	case 1:
2984 		operating_mode = VHT_OPMODE_CHANNEL_40MHZ;
2985 		break;
2986 	case 2:
2987 		operating_mode = VHT_OPMODE_CHANNEL_80MHZ;
2988 		break;
2989 	case 3:
2990 		operating_mode = VHT_OPMODE_CHANNEL_160MHZ;
2991 		break;
2992 	default:
2993 		wpa_printf(MSG_ERROR, "Channel width should be between 0 to 3");
2994 		return -1;
2995 	}
2996 
2997 	for (sta = hapd->sta_list; sta; sta = sta->next) {
2998 		if ((sta->flags & WLAN_STA_VHT) && sta->vht_capabilities) {
2999 			nss = hostapd_maxnss(hapd, sta) - 1;
3000 			hostapd_ctrl_iface_notify_cw_vhtaction(hapd, sta->addr,
3001 							       operating_mode |
3002 							       (u8) (nss << 4));
3003 			continue;
3004 		}
3005 
3006 		if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) ==
3007 		    WLAN_STA_HT && sta->ht_capabilities)
3008 			hostapd_ctrl_iface_notify_cw_htaction(hapd, sta->addr,
3009 							      cw);
3010 	}
3011 
3012 	return 0;
3013 }
3014 
3015 
hostapd_ctrl_iface_mib(struct hostapd_data * hapd,char * reply,int reply_size,const char * param)3016 static int hostapd_ctrl_iface_mib(struct hostapd_data *hapd, char *reply,
3017 				  int reply_size, const char *param)
3018 {
3019 #ifdef RADIUS_SERVER
3020 	if (os_strcmp(param, "radius_server") == 0) {
3021 		return radius_server_get_mib(hapd->radius_srv, reply,
3022 					     reply_size);
3023 	}
3024 #endif /* RADIUS_SERVER */
3025 	return -1;
3026 }
3027 
3028 
hostapd_ctrl_iface_vendor(struct hostapd_data * hapd,char * cmd,char * buf,size_t buflen)3029 static int hostapd_ctrl_iface_vendor(struct hostapd_data *hapd, char *cmd,
3030 				     char *buf, size_t buflen)
3031 {
3032 	int ret;
3033 	char *pos, *temp = NULL;
3034 	u8 *data = NULL;
3035 	unsigned int vendor_id, subcmd;
3036 	enum nested_attr nested_attr_flag = NESTED_ATTR_UNSPECIFIED;
3037 	struct wpabuf *reply;
3038 	size_t data_len = 0;
3039 
3040 	/**
3041 	 * cmd: <vendor id> <subcommand id> [<hex formatted data>]
3042 	 * [nested=<0|1>]
3043 	 */
3044 	vendor_id = strtoul(cmd, &pos, 16);
3045 	if (!isblank((unsigned char) *pos))
3046 		return -EINVAL;
3047 
3048 	subcmd = strtoul(pos, &pos, 10);
3049 
3050 	if (*pos != '\0') {
3051 		if (!isblank((unsigned char) *pos++))
3052 			return -EINVAL;
3053 
3054 		temp = os_strchr(pos, ' ');
3055 		data_len = temp ? (size_t) (temp - pos) : os_strlen(pos);
3056 	}
3057 
3058 	if (data_len) {
3059 		data_len /= 2;
3060 		data = os_malloc(data_len);
3061 		if (!data)
3062 			return -ENOBUFS;
3063 
3064 		if (hexstr2bin(pos, data, data_len)) {
3065 			wpa_printf(MSG_DEBUG,
3066 				   "Vendor command: wrong parameter format");
3067 			os_free(data);
3068 			return -EINVAL;
3069 		}
3070 	}
3071 
3072 	pos = os_strstr(cmd, "nested=");
3073 	if (pos)
3074 		nested_attr_flag = atoi(pos + 7) ? NESTED_ATTR_USED :
3075 			NESTED_ATTR_NOT_USED;
3076 
3077 	reply = wpabuf_alloc((buflen - 1) / 2);
3078 	if (!reply) {
3079 		os_free(data);
3080 		return -ENOBUFS;
3081 	}
3082 
3083 	ret = hostapd_drv_vendor_cmd(hapd, vendor_id, subcmd, data, data_len,
3084 				     nested_attr_flag, reply);
3085 
3086 	if (ret == 0)
3087 		ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(reply),
3088 				       wpabuf_len(reply));
3089 
3090 	wpabuf_free(reply);
3091 	os_free(data);
3092 
3093 	return ret;
3094 }
3095 
3096 
hostapd_ctrl_iface_eapol_reauth(struct hostapd_data * hapd,const char * cmd)3097 static int hostapd_ctrl_iface_eapol_reauth(struct hostapd_data *hapd,
3098 					   const char *cmd)
3099 {
3100 	u8 addr[ETH_ALEN];
3101 	struct sta_info *sta;
3102 
3103 	if (hwaddr_aton(cmd, addr))
3104 		return -1;
3105 
3106 	sta = ap_get_sta(hapd, addr);
3107 	if (!sta || !sta->eapol_sm)
3108 		return -1;
3109 
3110 	eapol_auth_reauthenticate(sta->eapol_sm);
3111 	return 0;
3112 }
3113 
3114 
hostapd_ctrl_iface_eapol_set(struct hostapd_data * hapd,char * cmd)3115 static int hostapd_ctrl_iface_eapol_set(struct hostapd_data *hapd, char *cmd)
3116 {
3117 	u8 addr[ETH_ALEN];
3118 	struct sta_info *sta;
3119 	char *pos = cmd, *param;
3120 
3121 	if (hwaddr_aton(pos, addr) || pos[17] != ' ')
3122 		return -1;
3123 	pos += 18;
3124 	param = pos;
3125 	pos = os_strchr(pos, ' ');
3126 	if (!pos)
3127 		return -1;
3128 	*pos++ = '\0';
3129 
3130 	sta = ap_get_sta(hapd, addr);
3131 	if (!sta || !sta->eapol_sm)
3132 		return -1;
3133 
3134 	return eapol_auth_set_conf(sta->eapol_sm, param, pos);
3135 }
3136 
3137 
hostapd_ctrl_iface_log_level(struct hostapd_data * hapd,char * cmd,char * buf,size_t buflen)3138 static int hostapd_ctrl_iface_log_level(struct hostapd_data *hapd, char *cmd,
3139 					char *buf, size_t buflen)
3140 {
3141 	char *pos, *end, *stamp;
3142 	int ret;
3143 
3144 	/* cmd: "LOG_LEVEL [<level>]" */
3145 	if (*cmd == '\0') {
3146 		pos = buf;
3147 		end = buf + buflen;
3148 		ret = os_snprintf(pos, end - pos, "Current level: %s\n"
3149 				  "Timestamp: %d\n",
3150 				  debug_level_str(wpa_debug_level),
3151 				  wpa_debug_timestamp);
3152 		if (os_snprintf_error(end - pos, ret))
3153 			ret = 0;
3154 
3155 		return ret;
3156 	}
3157 
3158 	while (*cmd == ' ')
3159 		cmd++;
3160 
3161 	stamp = os_strchr(cmd, ' ');
3162 	if (stamp) {
3163 		*stamp++ = '\0';
3164 		while (*stamp == ' ') {
3165 			stamp++;
3166 		}
3167 	}
3168 
3169 	if (os_strlen(cmd)) {
3170 		int level = str_to_debug_level(cmd);
3171 		if (level < 0)
3172 			return -1;
3173 		wpa_debug_level = level;
3174 	}
3175 
3176 	if (stamp && os_strlen(stamp))
3177 		wpa_debug_timestamp = atoi(stamp);
3178 
3179 	os_memcpy(buf, "OK\n", 3);
3180 	return 3;
3181 }
3182 
3183 
3184 #ifdef NEED_AP_MLME
3185 
hostapd_ctrl_iface_track_sta_list(struct hostapd_data * hapd,char * buf,size_t buflen)3186 static int hostapd_ctrl_iface_track_sta_list(struct hostapd_data *hapd,
3187 					     char *buf, size_t buflen)
3188 {
3189 	struct hostapd_iface *iface = hapd->iface;
3190 	char *pos, *end;
3191 	struct hostapd_sta_info *info;
3192 	struct os_reltime now;
3193 
3194 	if (!iface->num_sta_seen)
3195 		return 0;
3196 
3197 	sta_track_expire(iface, 0);
3198 
3199 	pos = buf;
3200 	end = buf + buflen;
3201 
3202 	os_get_reltime(&now);
3203 	dl_list_for_each_reverse(info, &iface->sta_seen,
3204 				 struct hostapd_sta_info, list) {
3205 		struct os_reltime age;
3206 		int ret;
3207 
3208 		os_reltime_sub(&now, &info->last_seen, &age);
3209 		ret = os_snprintf(pos, end - pos, MACSTR " %u %d\n",
3210 				  MAC2STR(info->addr), (unsigned int) age.sec,
3211 				  info->ssi_signal);
3212 		if (os_snprintf_error(end - pos, ret))
3213 			break;
3214 		pos += ret;
3215 	}
3216 
3217 	return pos - buf;
3218 }
3219 
3220 
hostapd_ctrl_iface_dump_beacon(struct hostapd_data * hapd,char * buf,size_t buflen)3221 static int hostapd_ctrl_iface_dump_beacon(struct hostapd_data *hapd,
3222 					  char *buf, size_t buflen)
3223 {
3224 	struct beacon_data beacon;
3225 	char *pos, *end;
3226 	int ret;
3227 
3228 	if (hostapd_build_beacon_data(hapd, &beacon) < 0)
3229 		return -1;
3230 
3231 	if (2 * (beacon.head_len + beacon.tail_len) > buflen)
3232 		return -1;
3233 
3234 	pos = buf;
3235 	end = buf + buflen;
3236 
3237 	ret = wpa_snprintf_hex(pos, end - pos, beacon.head, beacon.head_len);
3238 	pos += ret;
3239 
3240 	ret = wpa_snprintf_hex(pos, end - pos, beacon.tail, beacon.tail_len);
3241 	pos += ret;
3242 
3243 	free_beacon_data(&beacon);
3244 
3245 	return pos - buf;
3246 }
3247 
3248 #endif /* NEED_AP_MLME */
3249 
3250 
hostapd_ctrl_iface_req_lci(struct hostapd_data * hapd,const char * cmd)3251 static int hostapd_ctrl_iface_req_lci(struct hostapd_data *hapd,
3252 				      const char *cmd)
3253 {
3254 	u8 addr[ETH_ALEN];
3255 
3256 	if (hwaddr_aton(cmd, addr)) {
3257 		wpa_printf(MSG_INFO, "CTRL: REQ_LCI: Invalid MAC address");
3258 		return -1;
3259 	}
3260 
3261 	return hostapd_send_lci_req(hapd, addr);
3262 }
3263 
3264 
hostapd_ctrl_iface_req_range(struct hostapd_data * hapd,char * cmd)3265 static int hostapd_ctrl_iface_req_range(struct hostapd_data *hapd, char *cmd)
3266 {
3267 	u8 addr[ETH_ALEN];
3268 	char *token, *context = NULL;
3269 	int random_interval, min_ap;
3270 	u8 responders[ETH_ALEN * RRM_RANGE_REQ_MAX_RESPONDERS];
3271 	unsigned int n_responders;
3272 
3273 	token = str_token(cmd, " ", &context);
3274 	if (!token || hwaddr_aton(token, addr)) {
3275 		wpa_printf(MSG_INFO,
3276 			   "CTRL: REQ_RANGE - Bad destination address");
3277 		return -1;
3278 	}
3279 
3280 	token = str_token(cmd, " ", &context);
3281 	if (!token)
3282 		return -1;
3283 
3284 	random_interval = atoi(token);
3285 	if (random_interval < 0 || random_interval > 0xffff)
3286 		return -1;
3287 
3288 	token = str_token(cmd, " ", &context);
3289 	if (!token)
3290 		return -1;
3291 
3292 	min_ap = atoi(token);
3293 	if (min_ap <= 0 || min_ap > WLAN_RRM_RANGE_REQ_MAX_MIN_AP)
3294 		return -1;
3295 
3296 	n_responders = 0;
3297 	while ((token = str_token(cmd, " ", &context))) {
3298 		if (n_responders == RRM_RANGE_REQ_MAX_RESPONDERS) {
3299 			wpa_printf(MSG_INFO,
3300 				   "CTRL: REQ_RANGE: Too many responders");
3301 			return -1;
3302 		}
3303 
3304 		if (hwaddr_aton(token, responders + n_responders * ETH_ALEN)) {
3305 			wpa_printf(MSG_INFO,
3306 				   "CTRL: REQ_RANGE: Bad responder address");
3307 			return -1;
3308 		}
3309 
3310 		n_responders++;
3311 	}
3312 
3313 	if (!n_responders) {
3314 		wpa_printf(MSG_INFO,
3315 			   "CTRL: REQ_RANGE - No FTM responder address");
3316 		return -1;
3317 	}
3318 
3319 	return hostapd_send_range_req(hapd, addr, random_interval, min_ap,
3320 				      responders, n_responders);
3321 }
3322 
3323 
hostapd_ctrl_iface_req_beacon(struct hostapd_data * hapd,const char * cmd,char * reply,size_t reply_size)3324 static int hostapd_ctrl_iface_req_beacon(struct hostapd_data *hapd,
3325 					 const char *cmd, char *reply,
3326 					 size_t reply_size)
3327 {
3328 	u8 addr[ETH_ALEN];
3329 	const char *pos;
3330 	struct wpabuf *req;
3331 	int ret;
3332 	u8 req_mode = 0;
3333 
3334 	if (hwaddr_aton(cmd, addr))
3335 		return -1;
3336 	pos = os_strchr(cmd, ' ');
3337 	if (!pos)
3338 		return -1;
3339 	pos++;
3340 	if (os_strncmp(pos, "req_mode=", 9) == 0) {
3341 		int val = hex2byte(pos + 9);
3342 
3343 		if (val < 0)
3344 			return -1;
3345 		req_mode = val;
3346 		pos += 11;
3347 		pos = os_strchr(pos, ' ');
3348 		if (!pos)
3349 			return -1;
3350 		pos++;
3351 	}
3352 	req = wpabuf_parse_bin(pos);
3353 	if (!req)
3354 		return -1;
3355 
3356 	ret = hostapd_send_beacon_req(hapd, addr, req_mode, req);
3357 	wpabuf_free(req);
3358 	if (ret >= 0)
3359 		ret = os_snprintf(reply, reply_size, "%d", ret);
3360 	return ret;
3361 }
3362 
3363 
hostapd_ctrl_iface_req_link_measurement(struct hostapd_data * hapd,const char * cmd,char * reply,size_t reply_size)3364 static int hostapd_ctrl_iface_req_link_measurement(struct hostapd_data *hapd,
3365 						   const char *cmd, char *reply,
3366 						   size_t reply_size)
3367 {
3368 	u8 addr[ETH_ALEN];
3369 	int ret;
3370 
3371 	if (hwaddr_aton(cmd, addr)) {
3372 		wpa_printf(MSG_ERROR,
3373 			   "CTRL: REQ_LINK_MEASUREMENT: Invalid MAC address");
3374 		return -1;
3375 	}
3376 
3377 	ret = hostapd_send_link_measurement_req(hapd, addr);
3378 	if (ret >= 0)
3379 		ret = os_snprintf(reply, reply_size, "%d", ret);
3380 	return ret;
3381 }
3382 
3383 
hostapd_ctrl_iface_show_neighbor(struct hostapd_data * hapd,char * buf,size_t buflen)3384 static int hostapd_ctrl_iface_show_neighbor(struct hostapd_data *hapd,
3385 					    char *buf, size_t buflen)
3386 {
3387 	if (!(hapd->conf->radio_measurements[0] &
3388 	      WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
3389 		wpa_printf(MSG_ERROR,
3390 			   "CTRL: SHOW_NEIGHBOR: Neighbor report is not enabled");
3391 		return -1;
3392 	}
3393 
3394 	return hostapd_neighbor_show(hapd, buf, buflen);
3395 }
3396 
3397 
hostapd_ctrl_iface_set_neighbor(struct hostapd_data * hapd,char * buf)3398 static int hostapd_ctrl_iface_set_neighbor(struct hostapd_data *hapd, char *buf)
3399 {
3400 	struct wpa_ssid_value ssid;
3401 	u8 bssid[ETH_ALEN];
3402 	struct wpabuf *nr, *lci = NULL, *civic = NULL;
3403 	int stationary = 0;
3404 	int bss_parameters = 0;
3405 	char *tmp;
3406 	int ret = -1;
3407 
3408 	if (!(hapd->conf->radio_measurements[0] &
3409 	      WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
3410 		wpa_printf(MSG_ERROR,
3411 			   "CTRL: SET_NEIGHBOR: Neighbor report is not enabled");
3412 		return -1;
3413 	}
3414 
3415 	if (hwaddr_aton(buf, bssid)) {
3416 		wpa_printf(MSG_ERROR, "CTRL: SET_NEIGHBOR: Bad BSSID");
3417 		return -1;
3418 	}
3419 
3420 	tmp = os_strstr(buf, "ssid=");
3421 	if (!tmp || ssid_parse(tmp + 5, &ssid)) {
3422 		wpa_printf(MSG_ERROR,
3423 			   "CTRL: SET_NEIGHBOR: Bad or missing SSID");
3424 		return -1;
3425 	}
3426 	buf = os_strchr(tmp + 6, tmp[5] == '"' ? '"' : ' ');
3427 	if (!buf)
3428 		return -1;
3429 
3430 	tmp = os_strstr(buf, "nr=");
3431 	if (!tmp) {
3432 		wpa_printf(MSG_ERROR,
3433 			   "CTRL: SET_NEIGHBOR: Missing Neighbor Report element");
3434 		return -1;
3435 	}
3436 
3437 	buf = os_strchr(tmp, ' ');
3438 	if (buf)
3439 		*buf++ = '\0';
3440 
3441 	nr = wpabuf_parse_bin(tmp + 3);
3442 	if (!nr) {
3443 		wpa_printf(MSG_ERROR,
3444 			   "CTRL: SET_NEIGHBOR: Bad Neighbor Report element");
3445 		return -1;
3446 	}
3447 
3448 	if (!buf)
3449 		goto set;
3450 
3451 	tmp = os_strstr(buf, "lci=");
3452 	if (tmp) {
3453 		buf = os_strchr(tmp, ' ');
3454 		if (buf)
3455 			*buf++ = '\0';
3456 		lci = wpabuf_parse_bin(tmp + 4);
3457 		if (!lci) {
3458 			wpa_printf(MSG_ERROR,
3459 				   "CTRL: SET_NEIGHBOR: Bad LCI subelement");
3460 			goto fail;
3461 		}
3462 	}
3463 
3464 	if (!buf)
3465 		goto set;
3466 
3467 	tmp = os_strstr(buf, "civic=");
3468 	if (tmp) {
3469 		buf = os_strchr(tmp, ' ');
3470 		if (buf)
3471 			*buf++ = '\0';
3472 		civic = wpabuf_parse_bin(tmp + 6);
3473 		if (!civic) {
3474 			wpa_printf(MSG_ERROR,
3475 				   "CTRL: SET_NEIGHBOR: Bad civic subelement");
3476 			goto fail;
3477 		}
3478 	}
3479 
3480 	if (!buf)
3481 		goto set;
3482 
3483 	if (os_strstr(buf, "stat"))
3484 		stationary = 1;
3485 
3486 	tmp = os_strstr(buf, "bss_parameter=");
3487 	if (tmp) {
3488 		bss_parameters = atoi(tmp + 14);
3489 		if (bss_parameters < 0 || bss_parameters > 0xff) {
3490 			wpa_printf(MSG_ERROR,
3491 				   "CTRL: SET_NEIGHBOR: Bad bss_parameters subelement");
3492 			goto fail;
3493 		}
3494 	}
3495 
3496 set:
3497 	ret = hostapd_neighbor_set(hapd, bssid, &ssid, nr, lci, civic,
3498 				   stationary, bss_parameters);
3499 
3500 fail:
3501 	wpabuf_free(nr);
3502 	wpabuf_free(lci);
3503 	wpabuf_free(civic);
3504 
3505 	return ret;
3506 }
3507 
3508 
hostapd_ctrl_iface_remove_neighbor(struct hostapd_data * hapd,char * buf)3509 static int hostapd_ctrl_iface_remove_neighbor(struct hostapd_data *hapd,
3510 					      char *buf)
3511 {
3512 	struct wpa_ssid_value ssid;
3513 	struct wpa_ssid_value *ssidp = NULL;
3514 	u8 bssid[ETH_ALEN];
3515 	char *tmp;
3516 
3517 	if (hwaddr_aton(buf, bssid)) {
3518 		wpa_printf(MSG_ERROR, "CTRL: REMOVE_NEIGHBOR: Bad BSSID");
3519 		return -1;
3520 	}
3521 
3522 	tmp = os_strstr(buf, "ssid=");
3523 	if (tmp) {
3524 		ssidp = &ssid;
3525 		if (ssid_parse(tmp + 5, &ssid)) {
3526 			wpa_printf(MSG_ERROR,
3527 				   "CTRL: REMOVE_NEIGHBOR: Bad SSID");
3528 			return -1;
3529 		}
3530 	}
3531 
3532 	return hostapd_neighbor_remove(hapd, bssid, ssidp);
3533 }
3534 
3535 
hostapd_ctrl_driver_flags(struct hostapd_iface * iface,char * buf,size_t buflen)3536 static int hostapd_ctrl_driver_flags(struct hostapd_iface *iface, char *buf,
3537 				     size_t buflen)
3538 {
3539 	int ret, i;
3540 	char *pos, *end;
3541 
3542 	ret = os_snprintf(buf, buflen, "%016llX:\n",
3543 			  (long long unsigned) iface->drv_flags);
3544 	if (os_snprintf_error(buflen, ret))
3545 		return -1;
3546 
3547 	pos = buf + ret;
3548 	end = buf + buflen;
3549 
3550 	for (i = 0; i < 64; i++) {
3551 		if (iface->drv_flags & (1LLU << i)) {
3552 			ret = os_snprintf(pos, end - pos, "%s\n",
3553 					  driver_flag_to_string(1LLU << i));
3554 			if (os_snprintf_error(end - pos, ret))
3555 				return -1;
3556 			pos += ret;
3557 		}
3558 	}
3559 
3560 	return pos - buf;
3561 }
3562 
3563 
hostapd_ctrl_driver_flags2(struct hostapd_iface * iface,char * buf,size_t buflen)3564 static int hostapd_ctrl_driver_flags2(struct hostapd_iface *iface, char *buf,
3565 				      size_t buflen)
3566 {
3567 	int ret, i;
3568 	char *pos, *end;
3569 
3570 	ret = os_snprintf(buf, buflen, "%016llX:\n",
3571 			  (long long unsigned) iface->drv_flags2);
3572 	if (os_snprintf_error(buflen, ret))
3573 		return -1;
3574 
3575 	pos = buf + ret;
3576 	end = buf + buflen;
3577 
3578 	for (i = 0; i < 64; i++) {
3579 		if (iface->drv_flags2 & (1LLU << i)) {
3580 			ret = os_snprintf(pos, end - pos, "%s\n",
3581 					  driver_flag2_to_string(1LLU << i));
3582 			if (os_snprintf_error(end - pos, ret))
3583 				return -1;
3584 			pos += ret;
3585 		}
3586 	}
3587 
3588 	return pos - buf;
3589 }
3590 
3591 
hostapd_ctrl_iface_get_capability(struct hostapd_data * hapd,const char * field,char * buf,size_t buflen)3592 static int hostapd_ctrl_iface_get_capability(struct hostapd_data *hapd,
3593 					     const char *field, char *buf,
3594 					     size_t buflen)
3595 {
3596 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CAPABILITY '%s'", field);
3597 
3598 #ifdef CONFIG_DPP
3599 	if (os_strcmp(field, "dpp") == 0) {
3600 		int res;
3601 
3602 #ifdef CONFIG_DPP3
3603 		res = os_snprintf(buf, buflen, "DPP=3");
3604 #elif defined(CONFIG_DPP2)
3605 		res = os_snprintf(buf, buflen, "DPP=2");
3606 #else /* CONFIG_DPP2 */
3607 		res = os_snprintf(buf, buflen, "DPP=1");
3608 #endif /* CONFIG_DPP2 */
3609 		if (os_snprintf_error(buflen, res))
3610 			return -1;
3611 		return res;
3612 	}
3613 #endif /* CONFIG_DPP */
3614 
3615 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown GET_CAPABILITY field '%s'",
3616 		   field);
3617 
3618 	return -1;
3619 }
3620 
3621 
3622 #ifdef ANDROID
hostapd_ctrl_iface_driver_cmd(struct hostapd_data * hapd,char * cmd,char * buf,size_t buflen)3623 static int hostapd_ctrl_iface_driver_cmd(struct hostapd_data *hapd, char *cmd,
3624 					 char *buf, size_t buflen)
3625 {
3626 	int ret;
3627 
3628 	ret = hostapd_drv_driver_cmd(hapd, cmd, buf, buflen);
3629 	if (ret == 0) {
3630 		ret = os_snprintf(buf, buflen, "%s\n", "OK");
3631 		if (os_snprintf_error(buflen, ret))
3632 			ret = -1;
3633 	}
3634 	return ret;
3635 }
3636 #endif /* ANDROID */
3637 
3638 
3639 #ifdef CONFIG_IEEE80211BE
3640 
hostapd_ctrl_iface_enable_mld(struct hostapd_iface * iface)3641 static int hostapd_ctrl_iface_enable_mld(struct hostapd_iface *iface)
3642 {
3643 	unsigned int i;
3644 
3645 	if (!iface || !iface->bss[0]->conf->mld_ap) {
3646 		wpa_printf(MSG_ERROR,
3647 			   "Trying to enable AP MLD on an interface that is not affiliated with an AP MLD");
3648 		return -1;
3649 	}
3650 
3651 	for (i = 0; i < iface->interfaces->count; ++i) {
3652 		struct hostapd_iface *h_iface = iface->interfaces->iface[i];
3653 		struct hostapd_data *h_hapd = h_iface->bss[0];
3654 
3655 		if (!hostapd_is_ml_partner(h_hapd, iface->bss[0]))
3656 			continue;
3657 
3658 		if (hostapd_enable_iface(h_iface)) {
3659 			wpa_printf(MSG_ERROR, "Enabling of AP MLD failed");
3660 			return -1;
3661 		}
3662 	}
3663 	return 0;
3664 }
3665 
3666 
hostapd_disable_iface_bss(struct hostapd_iface * iface)3667 static void hostapd_disable_iface_bss(struct hostapd_iface *iface)
3668 {
3669 	unsigned int i;
3670 
3671 	for (i = 0; i < iface->num_bss; i++)
3672 		hostapd_bss_deinit_no_free(iface->bss[i]);
3673 }
3674 
3675 
hostapd_ctrl_iface_disable_mld(struct hostapd_iface * iface)3676 static int hostapd_ctrl_iface_disable_mld(struct hostapd_iface *iface)
3677 {
3678 	unsigned int i;
3679 
3680 	if (!iface || !iface->bss[0]->conf->mld_ap) {
3681 		wpa_printf(MSG_ERROR,
3682 			   "Trying to disable AP MLD on an interface that is not affiliated with an AP MLD.");
3683 		return -1;
3684 	}
3685 
3686 	/* First, disable BSSs before stopping beaconing and doing driver
3687 	 * deinit so that the broadcast Deauthentication frames go out. */
3688 
3689 	for (i = 0; i < iface->interfaces->count; ++i) {
3690 		struct hostapd_iface *h_iface = iface->interfaces->iface[i];
3691 		struct hostapd_data *h_hapd = h_iface->bss[0];
3692 
3693 		if (!hostapd_is_ml_partner(h_hapd, iface->bss[0]))
3694 			continue;
3695 
3696 		hostapd_disable_iface_bss(iface);
3697 	}
3698 
3699 	/* Then, fully disable interfaces */
3700 	for (i = 0; i < iface->interfaces->count; ++i) {
3701 		struct hostapd_iface *h_iface = iface->interfaces->iface[i];
3702 		struct hostapd_data *h_hapd = h_iface->bss[0];
3703 
3704 		if (!hostapd_is_ml_partner(h_hapd, iface->bss[0]))
3705 			continue;
3706 
3707 		if (hostapd_disable_iface(h_iface)) {
3708 			wpa_printf(MSG_ERROR, "Disabling AP MLD failed");
3709 			return -1;
3710 		}
3711 	}
3712 
3713 	return 0;
3714 }
3715 
3716 
3717 #ifdef CONFIG_TESTING_OPTIONS
hostapd_ctrl_iface_link_remove(struct hostapd_data * hapd,char * cmd,char * buf,size_t buflen)3718 static int hostapd_ctrl_iface_link_remove(struct hostapd_data *hapd, char *cmd,
3719 					  char *buf, size_t buflen)
3720 {
3721 	int ret;
3722 	u32 count = atoi(cmd);
3723 
3724 	if (!count)
3725 		count = 1;
3726 
3727 	ret = hostapd_link_remove(hapd, count);
3728 	if (ret == 0) {
3729 		ret = os_snprintf(buf, buflen, "%s\n", "OK");
3730 		if (os_snprintf_error(buflen, ret))
3731 			ret = -1;
3732 		else
3733 			ret = 0;
3734 	}
3735 
3736 	return ret;
3737 }
3738 #endif /* CONFIG_TESTING_OPTIONS */
3739 #endif /* CONFIG_IEEE80211BE */
3740 
3741 
3742 #ifdef CONFIG_NAN_USD
3743 
hostapd_ctrl_nan_publish(struct hostapd_data * hapd,char * cmd,char * buf,size_t buflen)3744 static int hostapd_ctrl_nan_publish(struct hostapd_data *hapd, char *cmd,
3745 				    char *buf, size_t buflen)
3746 {
3747 	char *token, *context = NULL;
3748 	int publish_id;
3749 	struct nan_publish_params params;
3750 	const char *service_name = NULL;
3751 	struct wpabuf *ssi = NULL;
3752 	int ret = -1;
3753 	enum nan_service_protocol_type srv_proto_type = 0;
3754 	bool p2p = false;
3755 
3756 	os_memset(&params, 0, sizeof(params));
3757 	/* USD shall use both solicited and unsolicited transmissions */
3758 	params.unsolicited = true;
3759 	params.solicited = true;
3760 	/* USD shall require FSD without GAS */
3761 	params.fsd = true;
3762 
3763 	while ((token = str_token(cmd, " ", &context))) {
3764 		if (os_strncmp(token, "service_name=", 13) == 0) {
3765 			service_name = token + 13;
3766 			continue;
3767 		}
3768 
3769 		if (os_strncmp(token, "ttl=", 4) == 0) {
3770 			params.ttl = atoi(token + 4);
3771 			continue;
3772 		}
3773 
3774 		if (os_strncmp(token, "srv_proto_type=", 15) == 0) {
3775 			srv_proto_type = atoi(token + 15);
3776 			continue;
3777 		}
3778 
3779 		if (os_strncmp(token, "ssi=", 4) == 0) {
3780 			if (ssi)
3781 				goto fail;
3782 			ssi = wpabuf_parse_bin(token + 4);
3783 			if (!ssi)
3784 				goto fail;
3785 			continue;
3786 		}
3787 
3788 		if (os_strcmp(token, "p2p=1") == 0) {
3789 			p2p = true;
3790 			continue;
3791 		}
3792 
3793 		if (os_strcmp(token, "solicited=0") == 0) {
3794 			params.solicited = false;
3795 			continue;
3796 		}
3797 
3798 		if (os_strcmp(token, "unsolicited=0") == 0) {
3799 			params.unsolicited = false;
3800 			continue;
3801 		}
3802 
3803 		if (os_strcmp(token, "fsd=0") == 0) {
3804 			params.fsd = false;
3805 			continue;
3806 		}
3807 
3808 		wpa_printf(MSG_INFO, "CTRL: Invalid NAN_PUBLISH parameter: %s",
3809 			   token);
3810 		goto fail;
3811 	}
3812 
3813 	publish_id = hostapd_nan_usd_publish(hapd, service_name, srv_proto_type,
3814 					     ssi, &params, p2p);
3815 	if (publish_id > 0)
3816 		ret = os_snprintf(buf, buflen, "%d", publish_id);
3817 fail:
3818 	wpabuf_free(ssi);
3819 	return ret;
3820 }
3821 
3822 
hostapd_ctrl_nan_cancel_publish(struct hostapd_data * hapd,char * cmd)3823 static int hostapd_ctrl_nan_cancel_publish(struct hostapd_data *hapd,
3824 					   char *cmd)
3825 {
3826 	char *token, *context = NULL;
3827 	int publish_id = 0;
3828 
3829 	while ((token = str_token(cmd, " ", &context))) {
3830 		if (sscanf(token, "publish_id=%i", &publish_id) == 1)
3831 			continue;
3832 		wpa_printf(MSG_INFO,
3833 			   "CTRL: Invalid NAN_CANCEL_PUBLISH parameter: %s",
3834 			   token);
3835 		return -1;
3836 	}
3837 
3838 	if (publish_id <= 0) {
3839 		wpa_printf(MSG_INFO,
3840 			   "CTRL: Invalid or missing NAN_CANCEL_PUBLISH publish_id");
3841 		return -1;
3842 	}
3843 
3844 	hostapd_nan_usd_cancel_publish(hapd, publish_id);
3845 	return 0;
3846 }
3847 
3848 
hostapd_ctrl_nan_update_publish(struct hostapd_data * hapd,char * cmd)3849 static int hostapd_ctrl_nan_update_publish(struct hostapd_data *hapd,
3850 					   char *cmd)
3851 {
3852 	char *token, *context = NULL;
3853 	int publish_id = 0;
3854 	struct wpabuf *ssi = NULL;
3855 	int ret = -1;
3856 
3857 	while ((token = str_token(cmd, " ", &context))) {
3858 		if (sscanf(token, "publish_id=%i", &publish_id) == 1)
3859 			continue;
3860 		if (os_strncmp(token, "ssi=", 4) == 0) {
3861 			if (ssi)
3862 				goto fail;
3863 			ssi = wpabuf_parse_bin(token + 4);
3864 			if (!ssi)
3865 				goto fail;
3866 			continue;
3867 		}
3868 		wpa_printf(MSG_INFO,
3869 			   "CTRL: Invalid NAN_UPDATE_PUBLISH parameter: %s",
3870 			   token);
3871 		goto fail;
3872 	}
3873 
3874 	if (publish_id <= 0) {
3875 		wpa_printf(MSG_INFO,
3876 			   "CTRL: Invalid or missing NAN_UPDATE_PUBLISH publish_id");
3877 		goto fail;
3878 	}
3879 
3880 	ret = hostapd_nan_usd_update_publish(hapd, publish_id, ssi);
3881 fail:
3882 	wpabuf_free(ssi);
3883 	return ret;
3884 }
3885 
3886 
hostapd_ctrl_nan_subscribe(struct hostapd_data * hapd,char * cmd,char * buf,size_t buflen)3887 static int hostapd_ctrl_nan_subscribe(struct hostapd_data *hapd, char *cmd,
3888 				      char *buf, size_t buflen)
3889 {
3890 	char *token, *context = NULL;
3891 	int subscribe_id;
3892 	struct nan_subscribe_params params;
3893 	const char *service_name = NULL;
3894 	struct wpabuf *ssi = NULL;
3895 	int ret = -1;
3896 	enum nan_service_protocol_type srv_proto_type = 0;
3897 	bool p2p = false;
3898 
3899 	os_memset(&params, 0, sizeof(params));
3900 
3901 	while ((token = str_token(cmd, " ", &context))) {
3902 		if (os_strncmp(token, "service_name=", 13) == 0) {
3903 			service_name = token + 13;
3904 			continue;
3905 		}
3906 
3907 		if (os_strcmp(token, "active=1") == 0) {
3908 			params.active = true;
3909 			continue;
3910 		}
3911 
3912 		if (os_strncmp(token, "ttl=", 4) == 0) {
3913 			params.ttl = atoi(token + 4);
3914 			continue;
3915 		}
3916 
3917 		if (os_strncmp(token, "srv_proto_type=", 15) == 0) {
3918 			srv_proto_type = atoi(token + 15);
3919 			continue;
3920 		}
3921 
3922 		if (os_strncmp(token, "ssi=", 4) == 0) {
3923 			if (ssi)
3924 				goto fail;
3925 			ssi = wpabuf_parse_bin(token + 4);
3926 			if (!ssi)
3927 				goto fail;
3928 			continue;
3929 		}
3930 
3931 		if (os_strcmp(token, "p2p=1") == 0) {
3932 			p2p = true;
3933 			continue;
3934 		}
3935 
3936 		wpa_printf(MSG_INFO,
3937 			   "CTRL: Invalid NAN_SUBSCRIBE parameter: %s",
3938 			   token);
3939 		goto fail;
3940 	}
3941 
3942 	subscribe_id = hostapd_nan_usd_subscribe(hapd, service_name,
3943 						 srv_proto_type, ssi,
3944 						 &params, p2p);
3945 	if (subscribe_id > 0)
3946 		ret = os_snprintf(buf, buflen, "%d", subscribe_id);
3947 fail:
3948 	wpabuf_free(ssi);
3949 	return ret;
3950 }
3951 
3952 
hostapd_ctrl_nan_cancel_subscribe(struct hostapd_data * hapd,char * cmd)3953 static int hostapd_ctrl_nan_cancel_subscribe(struct hostapd_data *hapd,
3954 					     char *cmd)
3955 {
3956 	char *token, *context = NULL;
3957 	int subscribe_id = 0;
3958 
3959 	while ((token = str_token(cmd, " ", &context))) {
3960 		if (sscanf(token, "subscribe_id=%i", &subscribe_id) == 1)
3961 			continue;
3962 		wpa_printf(MSG_INFO,
3963 			   "CTRL: Invalid NAN_CANCEL_SUBSCRIBE parameter: %s",
3964 			   token);
3965 		return -1;
3966 	}
3967 
3968 	if (subscribe_id <= 0) {
3969 		wpa_printf(MSG_INFO,
3970 			   "CTRL: Invalid or missing NAN_CANCEL_SUBSCRIBE subscribe_id");
3971 		return -1;
3972 	}
3973 
3974 	hostapd_nan_usd_cancel_subscribe(hapd, subscribe_id);
3975 	return 0;
3976 }
3977 
3978 
hostapd_ctrl_nan_transmit(struct hostapd_data * hapd,char * cmd)3979 static int hostapd_ctrl_nan_transmit(struct hostapd_data *hapd, char *cmd)
3980 {
3981 	char *token, *context = NULL;
3982 	int handle = 0;
3983 	int req_instance_id = 0;
3984 	struct wpabuf *ssi = NULL;
3985 	u8 peer_addr[ETH_ALEN];
3986 	int ret = -1;
3987 
3988 	os_memset(peer_addr, 0, ETH_ALEN);
3989 
3990 	while ((token = str_token(cmd, " ", &context))) {
3991 		if (sscanf(token, "handle=%i", &handle) == 1)
3992 			continue;
3993 
3994 		if (sscanf(token, "req_instance_id=%i", &req_instance_id) == 1)
3995 			continue;
3996 
3997 		if (os_strncmp(token, "address=", 8) == 0) {
3998 			if (hwaddr_aton(token + 8, peer_addr) < 0)
3999 				return -1;
4000 			continue;
4001 		}
4002 
4003 		if (os_strncmp(token, "ssi=", 4) == 0) {
4004 			if (ssi)
4005 				goto fail;
4006 			ssi = wpabuf_parse_bin(token + 4);
4007 			if (!ssi)
4008 				goto fail;
4009 			continue;
4010 		}
4011 
4012 		wpa_printf(MSG_INFO,
4013 			   "CTRL: Invalid NAN_TRANSMIT parameter: %s",
4014 			   token);
4015 		goto fail;
4016 	}
4017 
4018 	if (handle <= 0) {
4019 		wpa_printf(MSG_INFO,
4020 			   "CTRL: Invalid or missing NAN_TRANSMIT handle");
4021 		goto fail;
4022 	}
4023 
4024 	if (is_zero_ether_addr(peer_addr)) {
4025 		wpa_printf(MSG_INFO,
4026 			   "CTRL: Invalid or missing NAN_TRANSMIT address");
4027 		goto fail;
4028 	}
4029 
4030 	ret = hostapd_nan_usd_transmit(hapd, handle, ssi, NULL, peer_addr,
4031 				       req_instance_id);
4032 fail:
4033 	wpabuf_free(ssi);
4034 	return ret;
4035 }
4036 
4037 #endif /* CONFIG_NAN_USD */
4038 
4039 
hostapd_ctrl_iface_receive_process(struct hostapd_data * hapd,char * buf,char * reply,int reply_size,struct sockaddr_storage * from,socklen_t fromlen)4040 static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
4041 					      char *buf, char *reply,
4042 					      int reply_size,
4043 					      struct sockaddr_storage *from,
4044 					      socklen_t fromlen)
4045 {
4046 	int reply_len, res;
4047 
4048 	os_memcpy(reply, "OK\n", 3);
4049 	reply_len = 3;
4050 
4051 	if (os_strcmp(buf, "PING") == 0) {
4052 		os_memcpy(reply, "PONG\n", 5);
4053 		reply_len = 5;
4054 	} else if (os_strncmp(buf, "RELOG", 5) == 0) {
4055 		if (wpa_debug_reopen_file() < 0)
4056 			reply_len = -1;
4057 	} else if (os_strcmp(buf, "CLOSE_LOG") == 0) {
4058 		wpa_debug_stop_log();
4059 	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
4060 		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
4061 	} else if (os_strcmp(buf, "STATUS") == 0) {
4062 		reply_len = hostapd_ctrl_iface_status(hapd, reply,
4063 						      reply_size);
4064 	} else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
4065 		reply_len = hostapd_drv_status(hapd, reply, reply_size);
4066 	} else if (os_strcmp(buf, "MIB") == 0) {
4067 		reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
4068 		if (reply_len >= 0) {
4069 			res = wpa_get_mib(hapd->wpa_auth, reply + reply_len,
4070 					  reply_size - reply_len);
4071 			if (res < 0)
4072 				reply_len = -1;
4073 			else
4074 				reply_len += res;
4075 		}
4076 		if (reply_len >= 0) {
4077 			res = ieee802_1x_get_mib(hapd, reply + reply_len,
4078 						 reply_size - reply_len);
4079 			if (res < 0)
4080 				reply_len = -1;
4081 			else
4082 				reply_len += res;
4083 		}
4084 #ifndef CONFIG_NO_RADIUS
4085 		if (reply_len >= 0) {
4086 			res = radius_client_get_mib(hapd->radius,
4087 						    reply + reply_len,
4088 						    reply_size - reply_len);
4089 			if (res < 0)
4090 				reply_len = -1;
4091 			else
4092 				reply_len += res;
4093 		}
4094 #endif /* CONFIG_NO_RADIUS */
4095 	} else if (os_strncmp(buf, "MIB ", 4) == 0) {
4096 		reply_len = hostapd_ctrl_iface_mib(hapd, reply, reply_size,
4097 						   buf + 4);
4098 	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
4099 		reply_len = hostapd_ctrl_iface_sta_first(hapd, reply,
4100 							 reply_size);
4101 	} else if (os_strncmp(buf, "STA ", 4) == 0) {
4102 		reply_len = hostapd_ctrl_iface_sta(hapd, buf + 4, reply,
4103 						   reply_size);
4104 	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
4105 		reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
4106 							reply_size);
4107 	} else if (os_strcmp(buf, "ATTACH") == 0) {
4108 		if (hostapd_ctrl_iface_attach(hapd, from, fromlen, NULL))
4109 			reply_len = -1;
4110 	} else if (os_strncmp(buf, "ATTACH ", 7) == 0) {
4111 		if (hostapd_ctrl_iface_attach(hapd, from, fromlen, buf + 7))
4112 			reply_len = -1;
4113 	} else if (os_strcmp(buf, "DETACH") == 0) {
4114 		if (hostapd_ctrl_iface_detach(hapd, from, fromlen))
4115 			reply_len = -1;
4116 	} else if (os_strncmp(buf, "LEVEL ", 6) == 0) {
4117 		if (hostapd_ctrl_iface_level(hapd, from, fromlen,
4118 						    buf + 6))
4119 			reply_len = -1;
4120 	} else if (os_strncmp(buf, "NEW_STA ", 8) == 0) {
4121 		if (hostapd_ctrl_iface_new_sta(hapd, buf + 8))
4122 			reply_len = -1;
4123 	} else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
4124 		if (hostapd_ctrl_iface_deauthenticate(hapd, buf + 15))
4125 			reply_len = -1;
4126 	} else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
4127 		if (hostapd_ctrl_iface_disassociate(hapd, buf + 13))
4128 			reply_len = -1;
4129 #ifdef CONFIG_TAXONOMY
4130 	} else if (os_strncmp(buf, "SIGNATURE ", 10) == 0) {
4131 		reply_len = hostapd_ctrl_iface_signature(hapd, buf + 10,
4132 							 reply, reply_size);
4133 #endif /* CONFIG_TAXONOMY */
4134 	} else if (os_strncmp(buf, "POLL_STA ", 9) == 0) {
4135 		if (hostapd_ctrl_iface_poll_sta(hapd, buf + 9))
4136 			reply_len = -1;
4137 	} else if (os_strcmp(buf, "STOP_AP") == 0) {
4138 		if (hostapd_ctrl_iface_stop_ap(hapd))
4139 			reply_len = -1;
4140 #ifdef NEED_AP_MLME
4141 	} else if (os_strncmp(buf, "SA_QUERY ", 9) == 0) {
4142 		if (hostapd_ctrl_iface_sa_query(hapd, buf + 9))
4143 			reply_len = -1;
4144 #endif /* NEED_AP_MLME */
4145 #ifdef CONFIG_WPS
4146 	} else if (os_strncmp(buf, "WPS_PIN ", 8) == 0) {
4147 		if (hostapd_ctrl_iface_wps_pin(hapd, buf + 8))
4148 			reply_len = -1;
4149 	} else if (os_strncmp(buf, "WPS_CHECK_PIN ", 14) == 0) {
4150 		reply_len = hostapd_ctrl_iface_wps_check_pin(
4151 			hapd, buf + 14, reply, reply_size);
4152 	} else if (os_strcmp(buf, "WPS_PBC") == 0) {
4153 		if (hostapd_wps_button_pushed(hapd, NULL))
4154 			reply_len = -1;
4155 	} else if (os_strcmp(buf, "WPS_CANCEL") == 0) {
4156 		if (hostapd_wps_cancel(hapd))
4157 			reply_len = -1;
4158 	} else if (os_strncmp(buf, "WPS_AP_PIN ", 11) == 0) {
4159 		reply_len = hostapd_ctrl_iface_wps_ap_pin(hapd, buf + 11,
4160 							  reply, reply_size);
4161 	} else if (os_strncmp(buf, "WPS_CONFIG ", 11) == 0) {
4162 		if (hostapd_ctrl_iface_wps_config(hapd, buf + 11) < 0)
4163 			reply_len = -1;
4164 	} else if (os_strncmp(buf, "WPS_GET_STATUS", 13) == 0) {
4165 		reply_len = hostapd_ctrl_iface_wps_get_status(hapd, reply,
4166 							      reply_size);
4167 #ifdef CONFIG_WPS_NFC
4168 	} else if (os_strncmp(buf, "WPS_NFC_TAG_READ ", 17) == 0) {
4169 		if (hostapd_ctrl_iface_wps_nfc_tag_read(hapd, buf + 17))
4170 			reply_len = -1;
4171 	} else if (os_strncmp(buf, "WPS_NFC_CONFIG_TOKEN ", 21) == 0) {
4172 		reply_len = hostapd_ctrl_iface_wps_nfc_config_token(
4173 			hapd, buf + 21, reply, reply_size);
4174 	} else if (os_strncmp(buf, "WPS_NFC_TOKEN ", 14) == 0) {
4175 		reply_len = hostapd_ctrl_iface_wps_nfc_token(
4176 			hapd, buf + 14, reply, reply_size);
4177 	} else if (os_strncmp(buf, "NFC_GET_HANDOVER_SEL ", 21) == 0) {
4178 		reply_len = hostapd_ctrl_iface_nfc_get_handover_sel(
4179 			hapd, buf + 21, reply, reply_size);
4180 	} else if (os_strncmp(buf, "NFC_REPORT_HANDOVER ", 20) == 0) {
4181 		if (hostapd_ctrl_iface_nfc_report_handover(hapd, buf + 20))
4182 			reply_len = -1;
4183 #endif /* CONFIG_WPS_NFC */
4184 #endif /* CONFIG_WPS */
4185 #ifdef CONFIG_INTERWORKING
4186 	} else if (os_strncmp(buf, "SET_QOS_MAP_SET ", 16) == 0) {
4187 		if (hostapd_ctrl_iface_set_qos_map_set(hapd, buf + 16))
4188 			reply_len = -1;
4189 	} else if (os_strncmp(buf, "SEND_QOS_MAP_CONF ", 18) == 0) {
4190 		if (hostapd_ctrl_iface_send_qos_map_conf(hapd, buf + 18))
4191 			reply_len = -1;
4192 #endif /* CONFIG_INTERWORKING */
4193 #ifdef CONFIG_HS20
4194 	} else if (os_strncmp(buf, "HS20_DEAUTH_REQ ", 16) == 0) {
4195 		if (hostapd_ctrl_iface_hs20_deauth_req(hapd, buf + 16))
4196 			reply_len = -1;
4197 #endif /* CONFIG_HS20 */
4198 #ifdef CONFIG_WNM_AP
4199 	} else if (os_strncmp(buf, "DISASSOC_IMMINENT ", 18) == 0) {
4200 		if (hostapd_ctrl_iface_disassoc_imminent(hapd, buf + 18))
4201 			reply_len = -1;
4202 	} else if (os_strncmp(buf, "ESS_DISASSOC ", 13) == 0) {
4203 		if (hostapd_ctrl_iface_ess_disassoc(hapd, buf + 13))
4204 			reply_len = -1;
4205 	} else if (os_strncmp(buf, "BSS_TM_REQ ", 11) == 0) {
4206 		if (hostapd_ctrl_iface_bss_tm_req(hapd, buf + 11))
4207 			reply_len = -1;
4208 	} else if (os_strncmp(buf, "COLOC_INTF_REQ ", 15) == 0) {
4209 		if (hostapd_ctrl_iface_coloc_intf_req(hapd, buf + 15))
4210 			reply_len = -1;
4211 #endif /* CONFIG_WNM_AP */
4212 	} else if (os_strcmp(buf, "GET_CONFIG") == 0) {
4213 		reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
4214 							  reply_size);
4215 	} else if (os_strncmp(buf, "SET ", 4) == 0) {
4216 		if (hostapd_ctrl_iface_set(hapd, buf + 4))
4217 			reply_len = -1;
4218 	} else if (os_strncmp(buf, "GET ", 4) == 0) {
4219 		reply_len = hostapd_ctrl_iface_get(hapd, buf + 4, reply,
4220 						   reply_size);
4221 	} else if (os_strcmp(buf, "ENABLE") == 0) {
4222 		if (hostapd_ctrl_iface_enable(hapd->iface))
4223 			reply_len = -1;
4224 	} else if (os_strcmp(buf, "RELOAD_WPA_PSK") == 0) {
4225 		if (hostapd_ctrl_iface_reload_wpa_psk(hapd))
4226 			reply_len = -1;
4227 #ifdef CONFIG_IEEE80211R_AP
4228 	} else if (os_strcmp(buf, "GET_RXKHS") == 0) {
4229 		reply_len = hostapd_ctrl_iface_get_rxkhs(hapd, reply,
4230 							 reply_size);
4231 	} else if (os_strcmp(buf, "RELOAD_RXKHS") == 0) {
4232 		if (hostapd_ctrl_iface_reload_rxkhs(hapd))
4233 			reply_len = -1;
4234 #endif /* CONFIG_IEEE80211R_AP */
4235 	} else if (os_strcmp(buf, "RELOAD_BSS") == 0) {
4236 		if (hostapd_ctrl_iface_reload_bss(hapd))
4237 			reply_len = -1;
4238 	} else if (os_strcmp(buf, "RELOAD_CONFIG") == 0) {
4239 		if (hostapd_reload_config(hapd->iface))
4240 			reply_len = -1;
4241 	} else if (os_strcmp(buf, "RELOAD") == 0) {
4242 		if (hostapd_ctrl_iface_reload(hapd->iface))
4243 			reply_len = -1;
4244 	} else if (os_strcmp(buf, "DISABLE") == 0) {
4245 		if (hostapd_ctrl_iface_disable(hapd->iface))
4246 			reply_len = -1;
4247 	} else if (os_strcmp(buf, "UPDATE_BEACON") == 0) {
4248 		if (ieee802_11_set_beacon(hapd))
4249 			reply_len = -1;
4250 #ifdef CONFIG_TESTING_OPTIONS
4251 	} else if (os_strncmp(buf, "RADAR ", 6) == 0) {
4252 		if (hostapd_ctrl_iface_radar(hapd, buf + 6))
4253 			reply_len = -1;
4254 	} else if (os_strncmp(buf, "MGMT_TX ", 8) == 0) {
4255 		if (hostapd_ctrl_iface_mgmt_tx(hapd, buf + 8))
4256 			reply_len = -1;
4257 	} else if (os_strncmp(buf, "MGMT_TX_STATUS_PROCESS ", 23) == 0) {
4258 		if (hostapd_ctrl_iface_mgmt_tx_status_process(hapd,
4259 							      buf + 23) < 0)
4260 			reply_len = -1;
4261 	} else if (os_strncmp(buf, "MGMT_RX_PROCESS ", 16) == 0) {
4262 		if (hostapd_ctrl_iface_mgmt_rx_process(hapd, buf + 16) < 0)
4263 			reply_len = -1;
4264 	} else if (os_strncmp(buf, "EAPOL_RX ", 9) == 0) {
4265 		if (hostapd_ctrl_iface_eapol_rx(hapd, buf + 9) < 0)
4266 			reply_len = -1;
4267 	} else if (os_strncmp(buf, "EAPOL_TX ", 9) == 0) {
4268 		if (hostapd_ctrl_iface_eapol_tx(hapd, buf + 9) < 0)
4269 			reply_len = -1;
4270 	} else if (os_strncmp(buf, "DATA_TEST_CONFIG ", 17) == 0) {
4271 		if (hostapd_ctrl_iface_data_test_config(hapd, buf + 17) < 0)
4272 			reply_len = -1;
4273 	} else if (os_strncmp(buf, "DATA_TEST_TX ", 13) == 0) {
4274 		if (hostapd_ctrl_iface_data_test_tx(hapd, buf + 13) < 0)
4275 			reply_len = -1;
4276 	} else if (os_strncmp(buf, "DATA_TEST_FRAME ", 16) == 0) {
4277 		if (hostapd_ctrl_iface_data_test_frame(hapd, buf + 16) < 0)
4278 			reply_len = -1;
4279 	} else if (os_strncmp(buf, "TEST_ALLOC_FAIL ", 16) == 0) {
4280 		if (testing_set_fail_pattern(true, buf + 16) < 0)
4281 			reply_len = -1;
4282 	} else if (os_strcmp(buf, "GET_ALLOC_FAIL") == 0) {
4283 		reply_len = testing_get_fail_pattern(true, reply, reply_size);
4284 	} else if (os_strncmp(buf, "TEST_FAIL ", 10) == 0) {
4285 		if (testing_set_fail_pattern(false, buf + 10) < 0)
4286 			reply_len = -1;
4287 	} else if (os_strcmp(buf, "GET_FAIL") == 0) {
4288 		reply_len = testing_get_fail_pattern(false, reply, reply_size);
4289 	} else if (os_strncmp(buf, "RESET_PN ", 9) == 0) {
4290 		if (hostapd_ctrl_reset_pn(hapd, buf + 9) < 0)
4291 			reply_len = -1;
4292 	} else if (os_strncmp(buf, "SET_KEY ", 8) == 0) {
4293 		if (hostapd_ctrl_set_key(hapd, buf + 8) < 0)
4294 			reply_len = -1;
4295 	} else if (os_strncmp(buf, "RESEND_M1 ", 10) == 0) {
4296 		if (hostapd_ctrl_resend_m1(hapd, buf + 10) < 0)
4297 			reply_len = -1;
4298 	} else if (os_strncmp(buf, "RESEND_M3 ", 10) == 0) {
4299 		if (hostapd_ctrl_resend_m3(hapd, buf + 10) < 0)
4300 			reply_len = -1;
4301 	} else if (os_strncmp(buf, "RESEND_GROUP_M1 ", 16) == 0) {
4302 		if (hostapd_ctrl_resend_group_m1(hapd, buf + 16) < 0)
4303 			reply_len = -1;
4304 	} else if (os_strncmp(buf, "REKEY_PTK ", 10) == 0) {
4305 		if (hostapd_ctrl_rekey_ptk(hapd, buf + 10) < 0)
4306 			reply_len = -1;
4307 	} else if (os_strcmp(buf, "REKEY_GTK") == 0) {
4308 		if (wpa_auth_rekey_gtk(hapd->wpa_auth) < 0)
4309 			reply_len = -1;
4310 	} else if (os_strncmp(buf, "GET_PMK ", 8) == 0) {
4311 		reply_len = hostapd_ctrl_get_pmk(hapd, buf + 8, reply,
4312 						 reply_size);
4313 	} else if (os_strncmp(buf, "REGISTER_FRAME ", 15) == 0) {
4314 		if (hostapd_ctrl_register_frame(hapd, buf + 16) < 0)
4315 			reply_len = -1;
4316 #endif /* CONFIG_TESTING_OPTIONS */
4317 	} else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
4318 		if (hostapd_ctrl_iface_chan_switch(hapd->iface, buf + 12))
4319 			reply_len = -1;
4320 #ifdef CONFIG_IEEE80211AX
4321 	} else if (os_strncmp(buf, "COLOR_CHANGE ", 13) == 0) {
4322 		if (hostapd_ctrl_iface_color_change(hapd->iface, buf + 13))
4323 			reply_len = -1;
4324 #endif /* CONFIG_IEEE80211AX */
4325 	} else if (os_strncmp(buf, "NOTIFY_CW_CHANGE ", 17) == 0) {
4326 		if (hostapd_ctrl_iface_notify_cw_change(hapd, buf + 17))
4327 			reply_len = -1;
4328 	} else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
4329 		reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply,
4330 						      reply_size);
4331 	} else if (os_strcmp(buf, "ERP_FLUSH") == 0) {
4332 		ieee802_1x_erp_flush(hapd);
4333 #ifdef RADIUS_SERVER
4334 		radius_server_erp_flush(hapd->radius_srv);
4335 #endif /* RADIUS_SERVER */
4336 	} else if (os_strncmp(buf, "EAPOL_REAUTH ", 13) == 0) {
4337 		if (hostapd_ctrl_iface_eapol_reauth(hapd, buf + 13))
4338 			reply_len = -1;
4339 	} else if (os_strncmp(buf, "EAPOL_SET ", 10) == 0) {
4340 		if (hostapd_ctrl_iface_eapol_set(hapd, buf + 10))
4341 			reply_len = -1;
4342 	} else if (os_strncmp(buf, "LOG_LEVEL", 9) == 0) {
4343 		reply_len = hostapd_ctrl_iface_log_level(
4344 			hapd, buf + 9, reply, reply_size);
4345 #ifdef NEED_AP_MLME
4346 	} else if (os_strcmp(buf, "TRACK_STA_LIST") == 0) {
4347 		reply_len = hostapd_ctrl_iface_track_sta_list(
4348 			hapd, reply, reply_size);
4349 	} else if (os_strcmp(buf, "DUMP_BEACON") == 0) {
4350 		reply_len = hostapd_ctrl_iface_dump_beacon(hapd, reply,
4351 							   reply_size);
4352 #endif /* NEED_AP_MLME */
4353 	} else if (os_strcmp(buf, "PMKSA") == 0) {
4354 		reply_len = hostapd_ctrl_iface_pmksa_list(hapd, reply,
4355 							  reply_size);
4356 	} else if (os_strcmp(buf, "PMKSA_FLUSH") == 0) {
4357 		hostapd_ctrl_iface_pmksa_flush(hapd);
4358 	} else if (os_strncmp(buf, "PMKSA_ADD ", 10) == 0) {
4359 		if (hostapd_ctrl_iface_pmksa_add(hapd, buf + 10) < 0)
4360 			reply_len = -1;
4361 	} else if (os_strncmp(buf, "SET_NEIGHBOR ", 13) == 0) {
4362 		if (hostapd_ctrl_iface_set_neighbor(hapd, buf + 13))
4363 			reply_len = -1;
4364 	} else if (os_strcmp(buf, "SHOW_NEIGHBOR") == 0) {
4365 		reply_len = hostapd_ctrl_iface_show_neighbor(hapd, reply,
4366 							     reply_size);
4367 	} else if (os_strncmp(buf, "REMOVE_NEIGHBOR ", 16) == 0) {
4368 		if (hostapd_ctrl_iface_remove_neighbor(hapd, buf + 16))
4369 			reply_len = -1;
4370 	} else if (os_strncmp(buf, "REQ_LCI ", 8) == 0) {
4371 		if (hostapd_ctrl_iface_req_lci(hapd, buf + 8))
4372 			reply_len = -1;
4373 	} else if (os_strncmp(buf, "REQ_RANGE ", 10) == 0) {
4374 		if (hostapd_ctrl_iface_req_range(hapd, buf + 10))
4375 			reply_len = -1;
4376 	} else if (os_strncmp(buf, "REQ_BEACON ", 11) == 0) {
4377 		reply_len = hostapd_ctrl_iface_req_beacon(hapd, buf + 11,
4378 							  reply, reply_size);
4379 	} else if (os_strncmp(buf, "REQ_LINK_MEASUREMENT ", 21) == 0) {
4380 		reply_len = hostapd_ctrl_iface_req_link_measurement(
4381 			hapd, buf + 21, reply, reply_size);
4382 	} else if (os_strcmp(buf, "DRIVER_FLAGS") == 0) {
4383 		reply_len = hostapd_ctrl_driver_flags(hapd->iface, reply,
4384 						      reply_size);
4385 	} else if (os_strcmp(buf, "DRIVER_FLAGS2") == 0) {
4386 		reply_len = hostapd_ctrl_driver_flags2(hapd->iface, reply,
4387 						       reply_size);
4388 	} else if (os_strcmp(buf, "TERMINATE") == 0) {
4389 		eloop_terminate();
4390 	} else if (os_strncmp(buf, "ACCEPT_ACL ", 11) == 0) {
4391 		if (os_strncmp(buf + 11, "ADD_MAC ", 8) == 0) {
4392 			if (hostapd_ctrl_iface_acl_add_mac(
4393 				    &hapd->conf->accept_mac,
4394 				    &hapd->conf->num_accept_mac, buf + 19) ||
4395 			    hostapd_set_acl(hapd))
4396 				reply_len = -1;
4397 		} else if (os_strncmp((buf + 11), "DEL_MAC ", 8) == 0) {
4398 			if (hostapd_ctrl_iface_acl_del_mac(
4399 				    &hapd->conf->accept_mac,
4400 				    &hapd->conf->num_accept_mac, buf + 19) ||
4401 			    hostapd_set_acl(hapd) ||
4402 			    hostapd_disassoc_accept_mac(hapd))
4403 				reply_len = -1;
4404 		} else if (os_strcmp(buf + 11, "SHOW") == 0) {
4405 			reply_len = hostapd_ctrl_iface_acl_show_mac(
4406 				hapd->conf->accept_mac,
4407 				hapd->conf->num_accept_mac, reply, reply_size);
4408 		} else if (os_strcmp(buf + 11, "CLEAR") == 0) {
4409 			hostapd_ctrl_iface_acl_clear_list(
4410 				&hapd->conf->accept_mac,
4411 				&hapd->conf->num_accept_mac);
4412 			if (hostapd_set_acl(hapd) ||
4413 			    hostapd_disassoc_accept_mac(hapd))
4414 				reply_len = -1;
4415 		} else {
4416 			reply_len = -1;
4417 		}
4418 	} else if (os_strncmp(buf, "DENY_ACL ", 9) == 0) {
4419 		if (os_strncmp(buf + 9, "ADD_MAC ", 8) == 0) {
4420 			if (hostapd_ctrl_iface_acl_add_mac(
4421 				    &hapd->conf->deny_mac,
4422 				    &hapd->conf->num_deny_mac, buf + 17) ||
4423 			    hostapd_set_acl(hapd) ||
4424 			    hostapd_disassoc_deny_mac(hapd))
4425 				reply_len = -1;
4426 		} else if (os_strncmp(buf + 9, "DEL_MAC ", 8) == 0) {
4427 			if (hostapd_ctrl_iface_acl_del_mac(
4428 				    &hapd->conf->deny_mac,
4429 				    &hapd->conf->num_deny_mac, buf + 17) ||
4430 			    hostapd_set_acl(hapd))
4431 				reply_len = -1;
4432 		} else if (os_strcmp(buf + 9, "SHOW") == 0) {
4433 			reply_len = hostapd_ctrl_iface_acl_show_mac(
4434 				hapd->conf->deny_mac,
4435 				hapd->conf->num_deny_mac, reply, reply_size);
4436 		} else if (os_strcmp(buf + 9, "CLEAR") == 0) {
4437 			hostapd_ctrl_iface_acl_clear_list(
4438 				&hapd->conf->deny_mac,
4439 				&hapd->conf->num_deny_mac);
4440 			if (hostapd_set_acl(hapd))
4441 				reply_len = -1;
4442 		} else {
4443 			reply_len = -1;
4444 		}
4445 #ifdef CONFIG_DPP
4446 	} else if (os_strncmp(buf, "DPP_QR_CODE ", 12) == 0) {
4447 		res = hostapd_dpp_qr_code(hapd, buf + 12);
4448 		if (res < 0) {
4449 			reply_len = -1;
4450 		} else {
4451 			reply_len = os_snprintf(reply, reply_size, "%d", res);
4452 			if (os_snprintf_error(reply_size, reply_len))
4453 				reply_len = -1;
4454 		}
4455 	} else if (os_strncmp(buf, "DPP_NFC_URI ", 12) == 0) {
4456 		res = hostapd_dpp_nfc_uri(hapd, buf + 12);
4457 		if (res < 0) {
4458 			reply_len = -1;
4459 		} else {
4460 			reply_len = os_snprintf(reply, reply_size, "%d", res);
4461 			if (os_snprintf_error(reply_size, reply_len))
4462 				reply_len = -1;
4463 		}
4464 	} else if (os_strncmp(buf, "DPP_NFC_HANDOVER_REQ ", 21) == 0) {
4465 		res = hostapd_dpp_nfc_handover_req(hapd, buf + 20);
4466 		if (res < 0) {
4467 			reply_len = -1;
4468 		} else {
4469 			reply_len = os_snprintf(reply, reply_size, "%d", res);
4470 			if (os_snprintf_error(reply_size, reply_len))
4471 				reply_len = -1;
4472 		}
4473 	} else if (os_strncmp(buf, "DPP_NFC_HANDOVER_SEL ", 21) == 0) {
4474 		res = hostapd_dpp_nfc_handover_sel(hapd, buf + 20);
4475 		if (res < 0) {
4476 			reply_len = -1;
4477 		} else {
4478 			reply_len = os_snprintf(reply, reply_size, "%d", res);
4479 			if (os_snprintf_error(reply_size, reply_len))
4480 				reply_len = -1;
4481 		}
4482 	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_GEN ", 18) == 0) {
4483 		res = dpp_bootstrap_gen(hapd->iface->interfaces->dpp, buf + 18);
4484 		if (res < 0) {
4485 			reply_len = -1;
4486 		} else {
4487 			reply_len = os_snprintf(reply, reply_size, "%d", res);
4488 			if (os_snprintf_error(reply_size, reply_len))
4489 				reply_len = -1;
4490 		}
4491 	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_REMOVE ", 21) == 0) {
4492 		if (dpp_bootstrap_remove(hapd->iface->interfaces->dpp,
4493 					 buf + 21) < 0)
4494 			reply_len = -1;
4495 	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_GET_URI ", 22) == 0) {
4496 		const char *uri;
4497 
4498 		uri = dpp_bootstrap_get_uri(hapd->iface->interfaces->dpp,
4499 					    atoi(buf + 22));
4500 		if (!uri) {
4501 			reply_len = -1;
4502 		} else {
4503 			reply_len = os_snprintf(reply, reply_size, "%s", uri);
4504 			if (os_snprintf_error(reply_size, reply_len))
4505 				reply_len = -1;
4506 		}
4507 	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_INFO ", 19) == 0) {
4508 		reply_len = dpp_bootstrap_info(hapd->iface->interfaces->dpp,
4509 					       atoi(buf + 19),
4510 			reply, reply_size);
4511 	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_SET ", 18) == 0) {
4512 		if (dpp_bootstrap_set(hapd->iface->interfaces->dpp,
4513 				      atoi(buf + 18),
4514 				      os_strchr(buf + 18, ' ')) < 0)
4515 			reply_len = -1;
4516 	} else if (os_strncmp(buf, "DPP_AUTH_INIT ", 14) == 0) {
4517 		if (hostapd_dpp_auth_init(hapd, buf + 13) < 0)
4518 			reply_len = -1;
4519 	} else if (os_strncmp(buf, "DPP_LISTEN ", 11) == 0) {
4520 		if (hostapd_dpp_listen(hapd, buf + 11) < 0)
4521 			reply_len = -1;
4522 	} else if (os_strcmp(buf, "DPP_STOP_LISTEN") == 0) {
4523 		hostapd_dpp_stop(hapd);
4524 		hostapd_dpp_listen_stop(hapd);
4525 	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_ADD", 20) == 0) {
4526 		res = dpp_configurator_add(hapd->iface->interfaces->dpp,
4527 					   buf + 20);
4528 		if (res < 0) {
4529 			reply_len = -1;
4530 		} else {
4531 			reply_len = os_snprintf(reply, reply_size, "%d", res);
4532 			if (os_snprintf_error(reply_size, reply_len))
4533 				reply_len = -1;
4534 		}
4535 	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_SET ", 21) == 0) {
4536 		if (dpp_configurator_set(hapd->iface->interfaces->dpp,
4537 					 buf + 20) < 0)
4538 			reply_len = -1;
4539 	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_REMOVE ", 24) == 0) {
4540 		if (dpp_configurator_remove(hapd->iface->interfaces->dpp,
4541 					    buf + 24) < 0)
4542 			reply_len = -1;
4543 	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_SIGN ", 22) == 0) {
4544 		if (hostapd_dpp_configurator_sign(hapd, buf + 21) < 0)
4545 			reply_len = -1;
4546 	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_GET_KEY ", 25) == 0) {
4547 		reply_len = dpp_configurator_get_key_id(
4548 			hapd->iface->interfaces->dpp,
4549 			atoi(buf + 25),
4550 			reply, reply_size);
4551 	} else if (os_strncmp(buf, "DPP_PKEX_ADD ", 13) == 0) {
4552 		res = hostapd_dpp_pkex_add(hapd, buf + 12);
4553 		if (res < 0) {
4554 			reply_len = -1;
4555 		} else {
4556 			reply_len = os_snprintf(reply, reply_size, "%d", res);
4557 			if (os_snprintf_error(reply_size, reply_len))
4558 				reply_len = -1;
4559 		}
4560 	} else if (os_strncmp(buf, "DPP_PKEX_REMOVE ", 16) == 0) {
4561 		if (hostapd_dpp_pkex_remove(hapd, buf + 16) < 0)
4562 			reply_len = -1;
4563 #ifdef CONFIG_DPP2
4564 	} else if (os_strncmp(buf, "DPP_CONTROLLER_START ", 21) == 0) {
4565 		if (hostapd_dpp_controller_start(hapd, buf + 20) < 0)
4566 			reply_len = -1;
4567 	} else if (os_strcmp(buf, "DPP_CONTROLLER_START") == 0) {
4568 		if (hostapd_dpp_controller_start(hapd, NULL) < 0)
4569 			reply_len = -1;
4570 	} else if (os_strcmp(buf, "DPP_CONTROLLER_STOP") == 0) {
4571 		dpp_controller_stop(hapd->iface->interfaces->dpp);
4572 	} else if (os_strncmp(buf, "DPP_CHIRP ", 10) == 0) {
4573 		if (hostapd_dpp_chirp(hapd, buf + 9) < 0)
4574 			reply_len = -1;
4575 	} else if (os_strcmp(buf, "DPP_STOP_CHIRP") == 0) {
4576 		hostapd_dpp_chirp_stop(hapd);
4577 	} else if (os_strncmp(buf, "DPP_RELAY_ADD_CONTROLLER ", 25) == 0) {
4578 		if (hostapd_dpp_add_controller(hapd, buf + 25) < 0)
4579 			reply_len = -1;
4580 	} else if (os_strncmp(buf, "DPP_RELAY_REMOVE_CONTROLLER ", 28) == 0) {
4581 		hostapd_dpp_remove_controller(hapd, buf + 28);
4582 #endif /* CONFIG_DPP2 */
4583 #ifdef CONFIG_DPP3
4584 	} else if (os_strcmp(buf, "DPP_PUSH_BUTTON") == 0) {
4585 		if (hostapd_dpp_push_button(hapd, NULL) < 0)
4586 			reply_len = -1;
4587 	} else if (os_strncmp(buf, "DPP_PUSH_BUTTON ", 16) == 0) {
4588 		if (hostapd_dpp_push_button(hapd, buf + 15) < 0)
4589 			reply_len = -1;
4590 #endif /* CONFIG_DPP3 */
4591 #endif /* CONFIG_DPP */
4592 #ifdef CONFIG_NAN_USD
4593 	} else if (os_strncmp(buf, "NAN_PUBLISH ", 12) == 0) {
4594 		reply_len = hostapd_ctrl_nan_publish(hapd, buf + 12, reply,
4595 						     reply_size);
4596 	} else if (os_strncmp(buf, "NAN_CANCEL_PUBLISH ", 19) == 0) {
4597 		if (hostapd_ctrl_nan_cancel_publish(hapd, buf + 19) < 0)
4598 			reply_len = -1;
4599 	} else if (os_strncmp(buf, "NAN_UPDATE_PUBLISH ", 19) == 0) {
4600 		if (hostapd_ctrl_nan_update_publish(hapd, buf + 19) < 0)
4601 			reply_len = -1;
4602 	} else if (os_strncmp(buf, "NAN_SUBSCRIBE ", 14) == 0) {
4603 		reply_len = hostapd_ctrl_nan_subscribe(hapd, buf + 14, reply,
4604 						       reply_size);
4605 	} else if (os_strncmp(buf, "NAN_CANCEL_SUBSCRIBE ", 21) == 0) {
4606 		if (hostapd_ctrl_nan_cancel_subscribe(hapd, buf + 21) < 0)
4607 			reply_len = -1;
4608 	} else if (os_strncmp(buf, "NAN_TRANSMIT ", 13) == 0) {
4609 		if (hostapd_ctrl_nan_transmit(hapd, buf + 13) < 0)
4610 			reply_len = -1;
4611 #endif /* CONFIG_NAN_USD */
4612 #ifdef RADIUS_SERVER
4613 	} else if (os_strncmp(buf, "DAC_REQUEST ", 12) == 0) {
4614 		if (radius_server_dac_request(hapd->radius_srv, buf + 12) < 0)
4615 			reply_len = -1;
4616 #endif /* RADIUS_SERVER */
4617 	} else if (os_strncmp(buf, "GET_CAPABILITY ", 15) == 0) {
4618 		reply_len = hostapd_ctrl_iface_get_capability(
4619 			hapd, buf + 15, reply, reply_size);
4620 #ifdef CONFIG_PASN
4621 	} else if (os_strcmp(buf, "PTKSA_CACHE_LIST") == 0) {
4622 		reply_len = ptksa_cache_list(hapd->ptksa, reply, reply_size);
4623 #endif /* CONFIG_PASN */
4624 #ifdef ANDROID
4625 	} else if (os_strncmp(buf, "DRIVER ", 7) == 0) {
4626 		reply_len = hostapd_ctrl_iface_driver_cmd(hapd, buf + 7, reply,
4627 							  reply_size);
4628 #endif /* ANDROID */
4629 #ifdef CONFIG_IEEE80211BE
4630 	} else if (os_strcmp(buf, "ENABLE_MLD") == 0) {
4631 		if (hostapd_ctrl_iface_enable_mld(hapd->iface))
4632 			reply_len = -1;
4633 	} else if (os_strcmp(buf, "DISABLE_MLD") == 0) {
4634 		if (hostapd_ctrl_iface_disable_mld(hapd->iface))
4635 			reply_len = -1;
4636 #ifdef CONFIG_TESTING_OPTIONS
4637 	} else if (os_strncmp(buf, "LINK_REMOVE ", 12) == 0) {
4638 		if (hostapd_ctrl_iface_link_remove(hapd, buf + 12,
4639 						   reply, reply_size))
4640 			reply_len = -1;
4641 #endif /* CONFIG_TESTING_OPTIONS */
4642 #endif /* CONFIG_IEEE80211BE */
4643 	} else {
4644 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
4645 		reply_len = 16;
4646 	}
4647 
4648 	if (reply_len < 0) {
4649 		os_memcpy(reply, "FAIL\n", 5);
4650 		reply_len = 5;
4651 	}
4652 
4653 	return reply_len;
4654 }
4655 
4656 
hostapd_ctrl_iface_receive(int sock,void * eloop_ctx,void * sock_ctx)4657 static void hostapd_ctrl_iface_receive(int sock, void *eloop_ctx,
4658 				       void *sock_ctx)
4659 {
4660 	struct hostapd_data *hapd = eloop_ctx;
4661 	char buf[4096];
4662 	int res;
4663 	struct sockaddr_storage from;
4664 	socklen_t fromlen = sizeof(from);
4665 	char *reply, *pos = buf;
4666 	const int reply_size = 4096;
4667 	int reply_len;
4668 	int level = MSG_DEBUG;
4669 #ifdef CONFIG_CTRL_IFACE_UDP
4670 	unsigned char lcookie[CTRL_IFACE_COOKIE_LEN];
4671 #endif /* CONFIG_CTRL_IFACE_UDP */
4672 
4673 	res = recvfrom(sock, buf, sizeof(buf) - 1, 0,
4674 		       (struct sockaddr *) &from, &fromlen);
4675 	if (res < 0) {
4676 		wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s",
4677 			   strerror(errno));
4678 		return;
4679 	}
4680 	buf[res] = '\0';
4681 
4682 	reply = os_malloc(reply_size);
4683 	if (reply == NULL) {
4684 		if (sendto(sock, "FAIL\n", 5, 0, (struct sockaddr *) &from,
4685 			   fromlen) < 0) {
4686 			wpa_printf(MSG_DEBUG, "CTRL: sendto failed: %s",
4687 				   strerror(errno));
4688 		}
4689 		return;
4690 	}
4691 
4692 #ifdef CONFIG_CTRL_IFACE_UDP
4693 	if (os_strcmp(buf, "GET_COOKIE") == 0) {
4694 		os_memcpy(reply, "COOKIE=", 7);
4695 		wpa_snprintf_hex(reply + 7, 2 * CTRL_IFACE_COOKIE_LEN + 1,
4696 				 hapd->ctrl_iface_cookie,
4697 				 CTRL_IFACE_COOKIE_LEN);
4698 		reply_len = 7 + 2 * CTRL_IFACE_COOKIE_LEN;
4699 		goto done;
4700 	}
4701 
4702 	if (os_strncmp(buf, "COOKIE=", 7) != 0 ||
4703 	    hexstr2bin(buf + 7, lcookie, CTRL_IFACE_COOKIE_LEN) < 0) {
4704 		wpa_printf(MSG_DEBUG,
4705 			   "CTRL: No cookie in the request - drop request");
4706 		os_free(reply);
4707 		return;
4708 	}
4709 
4710 	if (os_memcmp(hapd->ctrl_iface_cookie, lcookie,
4711 		      CTRL_IFACE_COOKIE_LEN) != 0) {
4712 		wpa_printf(MSG_DEBUG,
4713 			   "CTRL: Invalid cookie in the request - drop request");
4714 		os_free(reply);
4715 		return;
4716 	}
4717 
4718 	pos = buf + 7 + 2 * CTRL_IFACE_COOKIE_LEN;
4719 	while (*pos == ' ')
4720 		pos++;
4721 #endif /* CONFIG_CTRL_IFACE_UDP */
4722 
4723 	if (os_strcmp(pos, "PING") == 0)
4724 		level = MSG_EXCESSIVE;
4725 	wpa_hexdump_ascii(level, "RX ctrl_iface", pos, res);
4726 
4727 	reply_len = hostapd_ctrl_iface_receive_process(hapd, pos,
4728 						       reply, reply_size,
4729 						       &from, fromlen);
4730 
4731 #ifdef CONFIG_CTRL_IFACE_UDP
4732 done:
4733 #endif /* CONFIG_CTRL_IFACE_UDP */
4734 	if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
4735 		   fromlen) < 0) {
4736 		wpa_printf(MSG_DEBUG, "CTRL: sendto failed: %s",
4737 			   strerror(errno));
4738 	}
4739 	os_free(reply);
4740 }
4741 
4742 
4743 #ifdef CONFIG_IEEE80211BE
4744 #ifndef CONFIG_CTRL_IFACE_UDP
4745 
hostapd_mld_ctrl_iface_receive_process(struct hostapd_mld * mld,char * buf,char * reply,size_t reply_size,struct sockaddr_storage * from,socklen_t fromlen)4746 static int hostapd_mld_ctrl_iface_receive_process(struct hostapd_mld *mld,
4747 						  char *buf, char *reply,
4748 						  size_t reply_size,
4749 						  struct sockaddr_storage *from,
4750 						  socklen_t fromlen)
4751 {
4752 	struct hostapd_data *link_hapd, *link_itr;
4753 	int reply_len = -1, link_id = -1;
4754 	char *cmd;
4755 	bool found = false;
4756 
4757 	os_memcpy(reply, "OK\n", 3);
4758 	reply_len = 3;
4759 
4760 	cmd = buf;
4761 
4762 	/* Check whether the link ID is provided in the command */
4763 	if (os_strncmp(cmd, "LINKID ", 7) == 0) {
4764 		cmd += 7;
4765 		link_id = atoi(cmd);
4766 		if (link_id < 0 || link_id >= 15) {
4767 			os_memcpy(reply, "INVALID LINK ID\n", 16);
4768 			reply_len = 16;
4769 			goto out;
4770 		}
4771 
4772 		cmd = os_strchr(cmd, ' ');
4773 		if (!cmd)
4774 			goto out;
4775 		cmd++;
4776 	}
4777 	if (link_id >= 0) {
4778 		link_hapd = mld->fbss;
4779 		if (!link_hapd) {
4780 			os_memcpy(reply, "NO LINKS ACTIVE\n", 16);
4781 			reply_len = 16;
4782 			goto out;
4783 		}
4784 
4785 		for_each_mld_link(link_itr, link_hapd) {
4786 			if (link_itr->mld_link_id == link_id) {
4787 				found = true;
4788 				break;
4789 			}
4790 		}
4791 
4792 		if (!found)
4793 			goto out;
4794 
4795 		link_hapd = link_itr;
4796 	} else {
4797 		link_hapd = mld->fbss;
4798 	}
4799 
4800 	if (os_strcmp(cmd, "PING") == 0) {
4801 		os_memcpy(reply, "PONG\n", 5);
4802 		reply_len = 5;
4803 	} else if (os_strcmp(cmd, "ATTACH") == 0) {
4804 		if (ctrl_iface_attach(&mld->ctrl_dst, from, fromlen, NULL))
4805 			reply_len = -1;
4806 	} else if (os_strncmp(cmd, "ATTACH ", 7) == 0) {
4807 		if (ctrl_iface_attach(&mld->ctrl_dst, from, fromlen, cmd + 7))
4808 			reply_len = -1;
4809 	} else if (os_strcmp(cmd, "DETACH") == 0) {
4810 		if (ctrl_iface_detach(&mld->ctrl_dst, from, fromlen))
4811 			reply_len = -1;
4812 	} else {
4813 		if (link_id == -1)
4814 			wpa_printf(MSG_DEBUG,
4815 				   "Link ID not provided, using the first link BSS (if available)");
4816 
4817 		if (!link_hapd)
4818 			reply_len = -1;
4819 		else
4820 			reply_len =
4821 				hostapd_ctrl_iface_receive_process(
4822 					link_hapd, cmd, reply, reply_size,
4823 					from, fromlen);
4824 	}
4825 
4826 out:
4827 	if (reply_len < 0) {
4828 		os_memcpy(reply, "FAIL\n", 5);
4829 		reply_len = 5;
4830 	}
4831 
4832 	return reply_len;
4833 }
4834 
4835 
hostapd_mld_ctrl_iface_receive(int sock,void * eloop_ctx,void * sock_ctx)4836 static void hostapd_mld_ctrl_iface_receive(int sock, void *eloop_ctx,
4837 					   void *sock_ctx)
4838 {
4839 	struct hostapd_mld *mld = eloop_ctx;
4840 	char buf[4096];
4841 	int res;
4842 	struct sockaddr_storage from;
4843 	socklen_t fromlen = sizeof(from);
4844 	char *reply, *pos = buf;
4845 	const size_t reply_size = 4096;
4846 	int reply_len;
4847 	int level = MSG_DEBUG;
4848 
4849 	res = recvfrom(sock, buf, sizeof(buf) - 1, 0,
4850 		       (struct sockaddr *) &from, &fromlen);
4851 	if (res < 0) {
4852 		wpa_printf(MSG_ERROR, "recvfrom(mld ctrl_iface): %s",
4853 			   strerror(errno));
4854 		return;
4855 	}
4856 	buf[res] = '\0';
4857 
4858 	reply = os_malloc(reply_size);
4859 	if (!reply) {
4860 		if (sendto(sock, "FAIL\n", 5, 0, (struct sockaddr *) &from,
4861 			   fromlen) < 0) {
4862 			wpa_printf(MSG_DEBUG, "MLD CTRL: sendto failed: %s",
4863 				   strerror(errno));
4864 		}
4865 		return;
4866 	}
4867 
4868 	if (os_strcmp(pos, "PING") == 0)
4869 		level = MSG_EXCESSIVE;
4870 
4871 	wpa_hexdump_ascii(level, "RX MLD ctrl_iface", pos, res);
4872 
4873 	reply_len = hostapd_mld_ctrl_iface_receive_process(mld, pos,
4874 							   reply, reply_size,
4875 							   &from, fromlen);
4876 
4877 	if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
4878 		   fromlen) < 0) {
4879 		wpa_printf(MSG_DEBUG, "MLD CTRL: sendto failed: %s",
4880 			   strerror(errno));
4881 	}
4882 	os_free(reply);
4883 }
4884 
4885 
hostapd_mld_ctrl_iface_path(struct hostapd_mld * mld)4886 static char * hostapd_mld_ctrl_iface_path(struct hostapd_mld *mld)
4887 {
4888 	size_t len;
4889 	char *buf;
4890 	int ret;
4891 
4892 	if (!mld->ctrl_interface)
4893 		return NULL;
4894 
4895 	len = os_strlen(mld->ctrl_interface) + os_strlen(mld->name) + 2;
4896 
4897 	buf = os_malloc(len);
4898 	if (!buf)
4899 		return NULL;
4900 
4901 	ret = os_snprintf(buf, len, "%s/%s", mld->ctrl_interface, mld->name);
4902 	if (os_snprintf_error(len, ret)) {
4903 		os_free(buf);
4904 		return NULL;
4905 	}
4906 
4907 	return buf;
4908 }
4909 
4910 #endif /* !CONFIG_CTRL_IFACE_UDP */
4911 
4912 
hostapd_mld_ctrl_iface_init(struct hostapd_mld * mld)4913 int hostapd_mld_ctrl_iface_init(struct hostapd_mld *mld)
4914 {
4915 #ifndef CONFIG_CTRL_IFACE_UDP
4916 	struct sockaddr_un addr;
4917 	int s = -1;
4918 	char *fname = NULL;
4919 
4920 	if (!mld)
4921 		return -1;
4922 
4923 	if (mld->ctrl_sock > -1) {
4924 		wpa_printf(MSG_DEBUG, "MLD %s ctrl_iface already exists!",
4925 			   mld->name);
4926 		return 0;
4927 	}
4928 
4929 	dl_list_init(&mld->ctrl_dst);
4930 
4931 	if (!mld->ctrl_interface)
4932 		return 0;
4933 
4934 	if (mkdir(mld->ctrl_interface, S_IRWXU | S_IRWXG) < 0) {
4935 		if (errno == EEXIST) {
4936 			wpa_printf(MSG_DEBUG,
4937 				   "Using existing control interface directory.");
4938 		} else {
4939 			wpa_printf(MSG_ERROR, "mkdir[ctrl_interface]: %s",
4940 				   strerror(errno));
4941 			goto fail;
4942 		}
4943 	}
4944 
4945 	if (os_strlen(mld->ctrl_interface) + 1 + os_strlen(mld->name) >=
4946 	    sizeof(addr.sun_path))
4947 		goto fail;
4948 
4949 	s = socket(PF_UNIX, SOCK_DGRAM, 0);
4950 	if (s < 0) {
4951 		wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno));
4952 		goto fail;
4953 	}
4954 
4955 	os_memset(&addr, 0, sizeof(addr));
4956 #ifdef __FreeBSD__
4957 	addr.sun_len = sizeof(addr);
4958 #endif /* __FreeBSD__ */
4959 	addr.sun_family = AF_UNIX;
4960 
4961 	fname = hostapd_mld_ctrl_iface_path(mld);
4962 	if (!fname)
4963 		goto fail;
4964 
4965 	os_strlcpy(addr.sun_path, fname, sizeof(addr.sun_path));
4966 
4967 	wpa_printf(MSG_DEBUG, "Setting up MLD %s ctrl_iface", mld->name);
4968 
4969 	if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
4970 		wpa_printf(MSG_DEBUG, "ctrl_iface bind(PF_UNIX) failed: %s",
4971 			   strerror(errno));
4972 		if (connect(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
4973 			wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not allow connections - assuming it was left over from forced program termination");
4974 			if (unlink(fname) < 0) {
4975 				wpa_printf(MSG_ERROR,
4976 					   "Could not unlink existing ctrl_iface socket '%s': %s",
4977 					   fname, strerror(errno));
4978 				goto fail;
4979 			}
4980 			if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) <
4981 			    0) {
4982 				wpa_printf(MSG_ERROR,
4983 					   "hostapd-ctrl-iface: bind(PF_UNIX): %s",
4984 					   strerror(errno));
4985 				goto fail;
4986 			}
4987 			wpa_printf(MSG_DEBUG,
4988 				   "Successfully replaced leftover ctrl_iface socket '%s'",
4989 				   fname);
4990 		} else {
4991 			wpa_printf(MSG_INFO,
4992 				   "ctrl_iface exists and seems to be in use - cannot override it");
4993 			wpa_printf(MSG_INFO,
4994 				   "Delete '%s' manually if it is not used anymore", fname);
4995 			os_free(fname);
4996 			fname = NULL;
4997 			goto fail;
4998 		}
4999 	}
5000 
5001 	if (chmod(fname, S_IRWXU | S_IRWXG) < 0) {
5002 		wpa_printf(MSG_ERROR, "chmod[ctrl_interface/ifname]: %s",
5003 			   strerror(errno));
5004 		goto fail;
5005 	}
5006 	os_free(fname);
5007 
5008 	mld->ctrl_sock = s;
5009 
5010 	if (eloop_register_read_sock(s, hostapd_mld_ctrl_iface_receive, mld,
5011 				     NULL) < 0)
5012 		return -1;
5013 
5014 	return 0;
5015 
5016 fail:
5017 	if (s >= 0)
5018 		close(s);
5019 	if (fname) {
5020 		unlink(fname);
5021 		os_free(fname);
5022 	}
5023 	return -1;
5024 #endif /* !CONFIG_CTRL_IFACE_UDP */
5025 	return 0;
5026 }
5027 
5028 
hostapd_mld_ctrl_iface_deinit(struct hostapd_mld * mld)5029 void hostapd_mld_ctrl_iface_deinit(struct hostapd_mld *mld)
5030 {
5031 #ifndef CONFIG_CTRL_IFACE_UDP
5032 	struct wpa_ctrl_dst *dst, *prev;
5033 
5034 	if (mld->ctrl_sock > -1) {
5035 		char *fname;
5036 
5037 		eloop_unregister_read_sock(mld->ctrl_sock);
5038 		close(mld->ctrl_sock);
5039 		mld->ctrl_sock = -1;
5040 
5041 		fname = hostapd_mld_ctrl_iface_path(mld);
5042 		if (fname) {
5043 			unlink(fname);
5044 			os_free(fname);
5045 		}
5046 
5047 		if (mld->ctrl_interface &&
5048 		    rmdir(mld->ctrl_interface) < 0) {
5049 			if (errno == ENOTEMPTY) {
5050 				wpa_printf(MSG_DEBUG,
5051 					   "MLD control interface directory not empty - leaving it behind");
5052 			} else {
5053 				wpa_printf(MSG_ERROR,
5054 					   "rmdir[ctrl_interface=%s]: %s",
5055 					   mld->ctrl_interface,
5056 					   strerror(errno));
5057 			}
5058 		}
5059 	}
5060 
5061 	dl_list_for_each_safe(dst, prev, &mld->ctrl_dst, struct wpa_ctrl_dst,
5062 			      list)
5063 		os_free(dst);
5064 #endif /* !CONFIG_CTRL_IFACE_UDP */
5065 
5066 	os_free(mld->ctrl_interface);
5067 }
5068 
5069 #endif /* CONFIG_IEEE80211BE */
5070 
5071 
5072 #ifndef CONFIG_CTRL_IFACE_UDP
hostapd_ctrl_iface_path(struct hostapd_data * hapd)5073 static char * hostapd_ctrl_iface_path(struct hostapd_data *hapd)
5074 {
5075 	char *buf;
5076 	size_t len;
5077 	const char *ctrl_sock_iface;
5078 
5079 #ifdef CONFIG_IEEE80211BE
5080 	ctrl_sock_iface = hapd->ctrl_sock_iface;
5081 #else /* CONFIG_IEEE80211BE */
5082 	ctrl_sock_iface = hapd->conf->iface;
5083 #endif /* CONFIG_IEEE80211BE */
5084 
5085 	if (hapd->conf->ctrl_interface == NULL)
5086 		return NULL;
5087 
5088 	len = os_strlen(hapd->conf->ctrl_interface) +
5089 		os_strlen(ctrl_sock_iface) + 2;
5090 
5091 	buf = os_malloc(len);
5092 	if (buf == NULL)
5093 		return NULL;
5094 
5095 	os_snprintf(buf, len, "%s/%s",
5096 		    hapd->conf->ctrl_interface, ctrl_sock_iface);
5097 	buf[len - 1] = '\0';
5098 	return buf;
5099 }
5100 #endif /* CONFIG_CTRL_IFACE_UDP */
5101 
5102 
hostapd_ctrl_iface_msg_cb(void * ctx,int level,enum wpa_msg_type type,const char * txt,size_t len)5103 static void hostapd_ctrl_iface_msg_cb(void *ctx, int level,
5104 				      enum wpa_msg_type type,
5105 				      const char *txt, size_t len)
5106 {
5107 	struct hostapd_data *hapd = ctx;
5108 	if (hapd == NULL)
5109 		return;
5110 	hostapd_ctrl_iface_send(hapd, level, type, txt, len);
5111 }
5112 
5113 
hostapd_ctrl_iface_init(struct hostapd_data * hapd)5114 int hostapd_ctrl_iface_init(struct hostapd_data *hapd)
5115 {
5116 #ifdef CONFIG_CTRL_IFACE_UDP
5117 	int port = HOSTAPD_CTRL_IFACE_PORT;
5118 	char p[32] = { 0 };
5119 	char port_str[40], *tmp;
5120 	char *pos;
5121 	struct addrinfo hints = { 0 }, *res, *saveres;
5122 	int n;
5123 
5124 	if (hapd->ctrl_sock > -1) {
5125 		wpa_printf(MSG_DEBUG, "ctrl_iface already exists!");
5126 		return 0;
5127 	}
5128 
5129 	if (hapd->conf->ctrl_interface == NULL)
5130 		return 0;
5131 
5132 	pos = os_strstr(hapd->conf->ctrl_interface, "udp:");
5133 	if (pos) {
5134 		pos += 4;
5135 		port = atoi(pos);
5136 		if (port <= 0) {
5137 			wpa_printf(MSG_ERROR, "Invalid ctrl_iface UDP port");
5138 			goto fail;
5139 		}
5140 	}
5141 
5142 	dl_list_init(&hapd->ctrl_dst);
5143 	hapd->ctrl_sock = -1;
5144 	os_get_random(hapd->ctrl_iface_cookie, CTRL_IFACE_COOKIE_LEN);
5145 
5146 #ifdef CONFIG_CTRL_IFACE_UDP_REMOTE
5147 	hints.ai_flags = AI_PASSIVE;
5148 #endif /* CONFIG_CTRL_IFACE_UDP_REMOTE */
5149 
5150 #ifdef CONFIG_CTRL_IFACE_UDP_IPV6
5151 	hints.ai_family = AF_INET6;
5152 #else /* CONFIG_CTRL_IFACE_UDP_IPV6 */
5153 	hints.ai_family = AF_INET;
5154 #endif /* CONFIG_CTRL_IFACE_UDP_IPV6 */
5155 	hints.ai_socktype = SOCK_DGRAM;
5156 
5157 try_again:
5158 	os_snprintf(p, sizeof(p), "%d", port);
5159 	n = getaddrinfo(NULL, p, &hints, &res);
5160 	if (n) {
5161 		wpa_printf(MSG_ERROR, "getaddrinfo(): %s", gai_strerror(n));
5162 		goto fail;
5163 	}
5164 
5165 	saveres = res;
5166 	hapd->ctrl_sock = socket(res->ai_family, res->ai_socktype,
5167 				 res->ai_protocol);
5168 	if (hapd->ctrl_sock < 0) {
5169 		wpa_printf(MSG_ERROR, "socket(PF_INET): %s", strerror(errno));
5170 		goto fail;
5171 	}
5172 
5173 	if (bind(hapd->ctrl_sock, res->ai_addr, res->ai_addrlen) < 0) {
5174 		port--;
5175 		if ((HOSTAPD_CTRL_IFACE_PORT - port) <
5176 		    HOSTAPD_CTRL_IFACE_PORT_LIMIT && !pos)
5177 			goto try_again;
5178 		wpa_printf(MSG_ERROR, "bind(AF_INET): %s", strerror(errno));
5179 		goto fail;
5180 	}
5181 
5182 	freeaddrinfo(saveres);
5183 
5184 	os_snprintf(port_str, sizeof(port_str), "udp:%d", port);
5185 	tmp = os_strdup(port_str);
5186 	if (tmp) {
5187 		os_free(hapd->conf->ctrl_interface);
5188 		hapd->conf->ctrl_interface = tmp;
5189 	}
5190 	wpa_printf(MSG_DEBUG, "ctrl_iface_init UDP port: %d", port);
5191 
5192 	if (eloop_register_read_sock(hapd->ctrl_sock,
5193 				     hostapd_ctrl_iface_receive, hapd, NULL) <
5194 	    0) {
5195 		hostapd_ctrl_iface_deinit(hapd);
5196 		return -1;
5197 	}
5198 
5199 	hapd->msg_ctx = hapd;
5200 	wpa_msg_register_cb(hostapd_ctrl_iface_msg_cb);
5201 
5202 	return 0;
5203 
5204 fail:
5205 	if (hapd->ctrl_sock >= 0)
5206 		close(hapd->ctrl_sock);
5207 	return -1;
5208 #else /* CONFIG_CTRL_IFACE_UDP */
5209 	struct sockaddr_un addr;
5210 	int s = -1;
5211 	char *fname = NULL;
5212 	size_t iflen;
5213 
5214 	if (hapd->ctrl_sock > -1) {
5215 		wpa_printf(MSG_DEBUG, "ctrl_iface already exists!");
5216 		return 0;
5217 	}
5218 
5219 	dl_list_init(&hapd->ctrl_dst);
5220 
5221 	if (hapd->conf->ctrl_interface == NULL)
5222 		return 0;
5223 
5224 	if (mkdir(hapd->conf->ctrl_interface, S_IRWXU | S_IRWXG) < 0) {
5225 		if (errno == EEXIST) {
5226 			wpa_printf(MSG_DEBUG, "Using existing control "
5227 				   "interface directory.");
5228 		} else {
5229 			wpa_printf(MSG_ERROR, "mkdir[ctrl_interface]: %s",
5230 				   strerror(errno));
5231 			goto fail;
5232 		}
5233 	}
5234 
5235 	if (hapd->conf->ctrl_interface_gid_set &&
5236 	    lchown(hapd->conf->ctrl_interface, -1,
5237 		   hapd->conf->ctrl_interface_gid) < 0) {
5238 		wpa_printf(MSG_ERROR, "lchown[ctrl_interface]: %s",
5239 			   strerror(errno));
5240 		return -1;
5241 	}
5242 
5243 	if (!hapd->conf->ctrl_interface_gid_set &&
5244 	    hapd->iface->interfaces->ctrl_iface_group &&
5245 	    lchown(hapd->conf->ctrl_interface, -1,
5246 		   hapd->iface->interfaces->ctrl_iface_group) < 0) {
5247 		wpa_printf(MSG_ERROR, "lchown[ctrl_interface]: %s",
5248 			   strerror(errno));
5249 		return -1;
5250 	}
5251 
5252 #ifdef ANDROID
5253 	/*
5254 	 * Android is using umask 0077 which would leave the control interface
5255 	 * directory without group access. This breaks things since Wi-Fi
5256 	 * framework assumes that this directory can be accessed by other
5257 	 * applications in the wifi group. Fix this by adding group access even
5258 	 * if umask value would prevent this.
5259 	 */
5260 	if (chmod(hapd->conf->ctrl_interface, S_IRWXU | S_IRWXG) < 0) {
5261 		wpa_printf(MSG_ERROR, "CTRL: Could not chmod directory: %s",
5262 			   strerror(errno));
5263 		/* Try to continue anyway */
5264 	}
5265 #endif /* ANDROID */
5266 
5267 #ifdef CONFIG_IEEE80211BE
5268 	iflen = os_strlen(hapd->ctrl_sock_iface);
5269 #else /* CONFIG_IEEE80211BE */
5270 	iflen = os_strlen(hapd->conf->iface);
5271 #endif /* CONFIG_IEEE80211BE */
5272 	if (os_strlen(hapd->conf->ctrl_interface) + 1 +
5273 	    iflen >= sizeof(addr.sun_path))
5274 		goto fail;
5275 
5276 	s = socket(PF_UNIX, SOCK_DGRAM, 0);
5277 	if (s < 0) {
5278 		wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno));
5279 		goto fail;
5280 	}
5281 
5282 	os_memset(&addr, 0, sizeof(addr));
5283 #ifdef __FreeBSD__
5284 	addr.sun_len = sizeof(addr);
5285 #endif /* __FreeBSD__ */
5286 	addr.sun_family = AF_UNIX;
5287 	fname = hostapd_ctrl_iface_path(hapd);
5288 	if (fname == NULL)
5289 		goto fail;
5290 	os_strlcpy(addr.sun_path, fname, sizeof(addr.sun_path));
5291 	if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
5292 		wpa_printf(MSG_DEBUG, "ctrl_iface bind(PF_UNIX) failed: %s",
5293 			   strerror(errno));
5294 		if (connect(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
5295 			wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not"
5296 				   " allow connections - assuming it was left"
5297 				   "over from forced program termination");
5298 			if (unlink(fname) < 0) {
5299 				wpa_printf(MSG_ERROR,
5300 					   "Could not unlink existing ctrl_iface socket '%s': %s",
5301 					   fname, strerror(errno));
5302 				goto fail;
5303 			}
5304 			if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) <
5305 			    0) {
5306 				wpa_printf(MSG_ERROR,
5307 					   "hostapd-ctrl-iface: bind(PF_UNIX): %s",
5308 					   strerror(errno));
5309 				goto fail;
5310 			}
5311 			wpa_printf(MSG_DEBUG, "Successfully replaced leftover "
5312 				   "ctrl_iface socket '%s'", fname);
5313 		} else {
5314 			wpa_printf(MSG_INFO, "ctrl_iface exists and seems to "
5315 				   "be in use - cannot override it");
5316 			wpa_printf(MSG_INFO, "Delete '%s' manually if it is "
5317 				   "not used anymore", fname);
5318 			os_free(fname);
5319 			fname = NULL;
5320 			goto fail;
5321 		}
5322 	}
5323 
5324 	if (hapd->conf->ctrl_interface_gid_set &&
5325 	    lchown(fname, -1, hapd->conf->ctrl_interface_gid) < 0) {
5326 		wpa_printf(MSG_ERROR, "lchown[ctrl_interface/ifname]: %s",
5327 			   strerror(errno));
5328 		goto fail;
5329 	}
5330 
5331 	if (!hapd->conf->ctrl_interface_gid_set &&
5332 	    hapd->iface->interfaces->ctrl_iface_group &&
5333 	    lchown(fname, -1, hapd->iface->interfaces->ctrl_iface_group) < 0) {
5334 		wpa_printf(MSG_ERROR, "lchown[ctrl_interface/ifname]: %s",
5335 			   strerror(errno));
5336 		goto fail;
5337 	}
5338 
5339 	if (chmod(fname, S_IRWXU | S_IRWXG) < 0) {
5340 		wpa_printf(MSG_ERROR, "chmod[ctrl_interface/ifname]: %s",
5341 			   strerror(errno));
5342 		goto fail;
5343 	}
5344 	os_free(fname);
5345 
5346 	hapd->ctrl_sock = s;
5347 	if (eloop_register_read_sock(s, hostapd_ctrl_iface_receive, hapd,
5348 				     NULL) < 0) {
5349 		hostapd_ctrl_iface_deinit(hapd);
5350 		return -1;
5351 	}
5352 	hapd->msg_ctx = hapd;
5353 	wpa_msg_register_cb(hostapd_ctrl_iface_msg_cb);
5354 
5355 	return 0;
5356 
5357 fail:
5358 	if (s >= 0)
5359 		close(s);
5360 	if (fname) {
5361 		unlink(fname);
5362 		os_free(fname);
5363 	}
5364 	return -1;
5365 #endif /* CONFIG_CTRL_IFACE_UDP */
5366 }
5367 
5368 
hostapd_ctrl_iface_deinit(struct hostapd_data * hapd)5369 void hostapd_ctrl_iface_deinit(struct hostapd_data *hapd)
5370 {
5371 	struct wpa_ctrl_dst *dst, *prev;
5372 
5373 	if (hapd->ctrl_sock > -1) {
5374 #ifndef CONFIG_CTRL_IFACE_UDP
5375 		char *fname;
5376 #endif /* !CONFIG_CTRL_IFACE_UDP */
5377 
5378 		eloop_unregister_read_sock(hapd->ctrl_sock);
5379 		close(hapd->ctrl_sock);
5380 		hapd->ctrl_sock = -1;
5381 #ifndef CONFIG_CTRL_IFACE_UDP
5382 		fname = hostapd_ctrl_iface_path(hapd);
5383 		if (fname)
5384 			unlink(fname);
5385 		os_free(fname);
5386 
5387 		if (hapd->conf->ctrl_interface &&
5388 		    rmdir(hapd->conf->ctrl_interface) < 0) {
5389 			if (errno == ENOTEMPTY) {
5390 				wpa_printf(MSG_DEBUG, "Control interface "
5391 					   "directory not empty - leaving it "
5392 					   "behind");
5393 			} else {
5394 				wpa_printf(MSG_ERROR,
5395 					   "rmdir[ctrl_interface=%s]: %s",
5396 					   hapd->conf->ctrl_interface,
5397 					   strerror(errno));
5398 			}
5399 		}
5400 #endif /* !CONFIG_CTRL_IFACE_UDP */
5401 	}
5402 
5403 	dl_list_for_each_safe(dst, prev, &hapd->ctrl_dst, struct wpa_ctrl_dst,
5404 			      list)
5405 		os_free(dst);
5406 
5407 #ifdef CONFIG_TESTING_OPTIONS
5408 	l2_packet_deinit(hapd->l2_test);
5409 	hapd->l2_test = NULL;
5410 #endif /* CONFIG_TESTING_OPTIONS */
5411 }
5412 
5413 
hostapd_ctrl_iface_add(struct hapd_interfaces * interfaces,char * buf)5414 static int hostapd_ctrl_iface_add(struct hapd_interfaces *interfaces,
5415 				  char *buf)
5416 {
5417 	if (hostapd_add_iface(interfaces, buf) < 0) {
5418 		wpa_printf(MSG_ERROR, "Adding interface %s failed", buf);
5419 		return -1;
5420 	}
5421 	return 0;
5422 }
5423 
5424 
hostapd_ctrl_iface_remove(struct hapd_interfaces * interfaces,char * buf)5425 static int hostapd_ctrl_iface_remove(struct hapd_interfaces *interfaces,
5426 				     char *buf)
5427 {
5428 	if (hostapd_remove_iface(interfaces, buf) < 0) {
5429 		wpa_printf(MSG_ERROR, "Removing interface %s failed", buf);
5430 		return -1;
5431 	}
5432 	return 0;
5433 }
5434 
5435 
hostapd_global_ctrl_iface_attach(struct hapd_interfaces * interfaces,struct sockaddr_storage * from,socklen_t fromlen,char * input)5436 static int hostapd_global_ctrl_iface_attach(struct hapd_interfaces *interfaces,
5437 					    struct sockaddr_storage *from,
5438 					    socklen_t fromlen, char *input)
5439 {
5440 	return ctrl_iface_attach(&interfaces->global_ctrl_dst, from, fromlen,
5441 				 input);
5442 }
5443 
5444 
hostapd_global_ctrl_iface_detach(struct hapd_interfaces * interfaces,struct sockaddr_storage * from,socklen_t fromlen)5445 static int hostapd_global_ctrl_iface_detach(struct hapd_interfaces *interfaces,
5446 					    struct sockaddr_storage *from,
5447 					    socklen_t fromlen)
5448 {
5449 	return ctrl_iface_detach(&interfaces->global_ctrl_dst, from, fromlen);
5450 }
5451 
5452 
hostapd_ctrl_iface_flush(struct hapd_interfaces * interfaces)5453 static void hostapd_ctrl_iface_flush(struct hapd_interfaces *interfaces)
5454 {
5455 #ifdef CONFIG_WPS_TESTING
5456 	wps_version_number = 0x20;
5457 	wps_testing_stub_cred = 0;
5458 	wps_corrupt_pkhash = 0;
5459 #endif /* CONFIG_WPS_TESTING */
5460 
5461 #ifdef CONFIG_TESTING_OPTIONS
5462 #ifdef CONFIG_DPP
5463 	dpp_test = DPP_TEST_DISABLED;
5464 #ifdef CONFIG_DPP3
5465 	dpp_version_override = 3;
5466 #elif defined(CONFIG_DPP2)
5467 	dpp_version_override = 2;
5468 #else /* CONFIG_DPP2 */
5469 	dpp_version_override = 1;
5470 #endif /* CONFIG_DPP2 */
5471 #endif /* CONFIG_DPP */
5472 #endif /* CONFIG_TESTING_OPTIONS */
5473 
5474 #ifdef CONFIG_DPP
5475 	dpp_global_clear(interfaces->dpp);
5476 #ifdef CONFIG_DPP3
5477 	interfaces->dpp_pb_bi = NULL;
5478 	{
5479 		int i;
5480 
5481 		for (i = 0; i < DPP_PB_INFO_COUNT; i++) {
5482 			struct dpp_pb_info *info;
5483 
5484 			info = &interfaces->dpp_pb[i];
5485 			info->rx_time.sec = 0;
5486 			info->rx_time.usec = 0;
5487 		}
5488 	}
5489 #endif /* CONFIG_DPP3 */
5490 #endif /* CONFIG_DPP */
5491 }
5492 
5493 
5494 #ifdef CONFIG_FST
5495 
5496 static int
hostapd_global_ctrl_iface_fst_attach(struct hapd_interfaces * interfaces,const char * cmd)5497 hostapd_global_ctrl_iface_fst_attach(struct hapd_interfaces *interfaces,
5498 				     const char *cmd)
5499 {
5500 	char ifname[IFNAMSIZ + 1];
5501 	struct fst_iface_cfg cfg;
5502 	struct hostapd_data *hapd;
5503 	struct fst_wpa_obj iface_obj;
5504 
5505 	if (!fst_parse_attach_command(cmd, ifname, sizeof(ifname), &cfg)) {
5506 		hapd = hostapd_get_iface(interfaces, ifname);
5507 		if (hapd) {
5508 			if (hapd->iface->fst) {
5509 				wpa_printf(MSG_INFO, "FST: Already attached");
5510 				return -1;
5511 			}
5512 			fst_hostapd_fill_iface_obj(hapd, &iface_obj);
5513 			hapd->iface->fst = fst_attach(ifname, hapd->own_addr,
5514 						      &iface_obj, &cfg);
5515 			if (hapd->iface->fst)
5516 				return 0;
5517 		}
5518 	}
5519 
5520 	return -EINVAL;
5521 }
5522 
5523 
5524 static int
hostapd_global_ctrl_iface_fst_detach(struct hapd_interfaces * interfaces,const char * cmd)5525 hostapd_global_ctrl_iface_fst_detach(struct hapd_interfaces *interfaces,
5526 				     const char *cmd)
5527 {
5528 	char ifname[IFNAMSIZ + 1];
5529 	struct hostapd_data * hapd;
5530 
5531 	if (!fst_parse_detach_command(cmd, ifname, sizeof(ifname))) {
5532 		hapd = hostapd_get_iface(interfaces, ifname);
5533 		if (hapd) {
5534 			if (!fst_iface_detach(ifname)) {
5535 				hapd->iface->fst = NULL;
5536 				hapd->iface->fst_ies = NULL;
5537 				return 0;
5538 			}
5539 		}
5540 	}
5541 
5542 	return -EINVAL;
5543 }
5544 
5545 #endif /* CONFIG_FST */
5546 
5547 
5548 static struct hostapd_data *
hostapd_interfaces_get_hapd(struct hapd_interfaces * interfaces,const char * ifname)5549 hostapd_interfaces_get_hapd(struct hapd_interfaces *interfaces,
5550 			    const char *ifname)
5551 {
5552 	size_t i, j;
5553 
5554 	for (i = 0; i < interfaces->count; i++) {
5555 		struct hostapd_iface *iface = interfaces->iface[i];
5556 
5557 		for (j = 0; j < iface->num_bss; j++) {
5558 			struct hostapd_data *hapd;
5559 
5560 			hapd = iface->bss[j];
5561 			if (os_strcmp(ifname, hapd->conf->iface) == 0)
5562 				return hapd;
5563 		}
5564 	}
5565 
5566 	return NULL;
5567 }
5568 
5569 
hostapd_ctrl_iface_dup_param(struct hostapd_data * src_hapd,struct hostapd_data * dst_hapd,const char * param)5570 static int hostapd_ctrl_iface_dup_param(struct hostapd_data *src_hapd,
5571 					struct hostapd_data *dst_hapd,
5572 					const char *param)
5573 {
5574 	int res;
5575 	char *value;
5576 
5577 	value = os_zalloc(HOSTAPD_CLI_DUP_VALUE_MAX_LEN);
5578 	if (!value) {
5579 		wpa_printf(MSG_ERROR,
5580 			   "DUP: cannot allocate buffer to stringify %s",
5581 			   param);
5582 		goto error_return;
5583 	}
5584 
5585 	if (os_strcmp(param, "wpa") == 0) {
5586 		os_snprintf(value, HOSTAPD_CLI_DUP_VALUE_MAX_LEN, "%d",
5587 			    src_hapd->conf->wpa);
5588 	} else if (os_strcmp(param, "wpa_key_mgmt") == 0 &&
5589 		   src_hapd->conf->wpa_key_mgmt) {
5590 		res = hostapd_ctrl_iface_get_key_mgmt(
5591 			src_hapd, value, HOSTAPD_CLI_DUP_VALUE_MAX_LEN);
5592 		if (os_snprintf_error(HOSTAPD_CLI_DUP_VALUE_MAX_LEN, res))
5593 			goto error_stringify;
5594 	} else if (os_strcmp(param, "wpa_pairwise") == 0 &&
5595 		   src_hapd->conf->wpa_pairwise) {
5596 		res = wpa_write_ciphers(value,
5597 					value + HOSTAPD_CLI_DUP_VALUE_MAX_LEN,
5598 					src_hapd->conf->wpa_pairwise, " ");
5599 		if (res < 0)
5600 			goto error_stringify;
5601 	} else if (os_strcmp(param, "rsn_pairwise") == 0 &&
5602 		   src_hapd->conf->rsn_pairwise) {
5603 		res = wpa_write_ciphers(value,
5604 					value + HOSTAPD_CLI_DUP_VALUE_MAX_LEN,
5605 					src_hapd->conf->rsn_pairwise, " ");
5606 		if (res < 0)
5607 			goto error_stringify;
5608 	} else if (os_strcmp(param, "wpa_passphrase") == 0 &&
5609 		   src_hapd->conf->ssid.wpa_passphrase) {
5610 		os_snprintf(value, HOSTAPD_CLI_DUP_VALUE_MAX_LEN, "%s",
5611 			    src_hapd->conf->ssid.wpa_passphrase);
5612 	} else if (os_strcmp(param, "wpa_psk") == 0 &&
5613 		   src_hapd->conf->ssid.wpa_psk_set) {
5614 		wpa_snprintf_hex(value, HOSTAPD_CLI_DUP_VALUE_MAX_LEN,
5615 			src_hapd->conf->ssid.wpa_psk->psk, PMK_LEN);
5616 	} else {
5617 		wpa_printf(MSG_WARNING, "DUP: %s cannot be duplicated", param);
5618 		goto error_return;
5619 	}
5620 
5621 	res = hostapd_set_iface(dst_hapd->iconf, dst_hapd->conf, param, value);
5622 	os_free(value);
5623 	return res;
5624 
5625 error_stringify:
5626 	wpa_printf(MSG_ERROR, "DUP: cannot stringify %s", param);
5627 error_return:
5628 	os_free(value);
5629 	return -1;
5630 }
5631 
5632 
5633 static int
hostapd_global_ctrl_iface_interfaces(struct hapd_interfaces * interfaces,const char * input,char * reply,int reply_size)5634 hostapd_global_ctrl_iface_interfaces(struct hapd_interfaces *interfaces,
5635 				     const char *input,
5636 				     char *reply, int reply_size)
5637 {
5638 	size_t i, j;
5639 	int res;
5640 	char *pos, *end;
5641 	struct hostapd_iface *iface;
5642 	int show_ctrl = 0;
5643 
5644 	if (input)
5645 		show_ctrl = !!os_strstr(input, "ctrl");
5646 
5647 	pos = reply;
5648 	end = reply + reply_size;
5649 
5650 	for (i = 0; i < interfaces->count; i++) {
5651 		iface = interfaces->iface[i];
5652 
5653 		for (j = 0; j < iface->num_bss; j++) {
5654 			struct hostapd_bss_config *conf;
5655 
5656 			conf = iface->conf->bss[j];
5657 			if (show_ctrl)
5658 				res = os_snprintf(pos, end - pos,
5659 						  "%s ctrl_iface=%s\n",
5660 						  conf->iface,
5661 						  conf->ctrl_interface ?
5662 						  conf->ctrl_interface : "N/A");
5663 			else
5664 				res = os_snprintf(pos, end - pos, "%s\n",
5665 						  conf->iface);
5666 			if (os_snprintf_error(end - pos, res)) {
5667 				*pos = '\0';
5668 				return pos - reply;
5669 			}
5670 			pos += res;
5671 		}
5672 	}
5673 
5674 	return pos - reply;
5675 }
5676 
5677 
5678 static int
hostapd_global_ctrl_iface_dup_network(struct hapd_interfaces * interfaces,char * cmd)5679 hostapd_global_ctrl_iface_dup_network(struct hapd_interfaces *interfaces,
5680 				      char *cmd)
5681 {
5682 	char *p_start = cmd, *p_end;
5683 	struct hostapd_data *src_hapd, *dst_hapd;
5684 
5685 	/* cmd: "<src ifname> <dst ifname> <variable name> */
5686 
5687 	p_end = os_strchr(p_start, ' ');
5688 	if (!p_end) {
5689 		wpa_printf(MSG_ERROR, "DUP: no src ifname found in cmd: '%s'",
5690 			   cmd);
5691 		return -1;
5692 	}
5693 
5694 	*p_end = '\0';
5695 	src_hapd = hostapd_interfaces_get_hapd(interfaces, p_start);
5696 	if (!src_hapd) {
5697 		wpa_printf(MSG_ERROR, "DUP: no src ifname found: '%s'",
5698 			   p_start);
5699 		return -1;
5700 	}
5701 
5702 	p_start = p_end + 1;
5703 	p_end = os_strchr(p_start, ' ');
5704 	if (!p_end) {
5705 		wpa_printf(MSG_ERROR, "DUP: no dst ifname found in cmd: '%s'",
5706 			   cmd);
5707 		return -1;
5708 	}
5709 
5710 	*p_end = '\0';
5711 	dst_hapd = hostapd_interfaces_get_hapd(interfaces, p_start);
5712 	if (!dst_hapd) {
5713 		wpa_printf(MSG_ERROR, "DUP: no dst ifname found: '%s'",
5714 			   p_start);
5715 		return -1;
5716 	}
5717 
5718 	p_start = p_end + 1;
5719 	return hostapd_ctrl_iface_dup_param(src_hapd, dst_hapd, p_start);
5720 }
5721 
5722 
hostapd_global_ctrl_iface_ifname(struct hapd_interfaces * interfaces,const char * ifname,char * buf,char * reply,int reply_size,struct sockaddr_storage * from,socklen_t fromlen)5723 static int hostapd_global_ctrl_iface_ifname(struct hapd_interfaces *interfaces,
5724 					    const char *ifname,
5725 					    char *buf, char *reply,
5726 					    int reply_size,
5727 					    struct sockaddr_storage *from,
5728 					    socklen_t fromlen)
5729 {
5730 	struct hostapd_data *hapd;
5731 
5732 	hapd = hostapd_interfaces_get_hapd(interfaces, ifname);
5733 	if (hapd == NULL) {
5734 		int res;
5735 
5736 		res = os_snprintf(reply, reply_size, "FAIL-NO-IFNAME-MATCH\n");
5737 		if (os_snprintf_error(reply_size, res))
5738 			return -1;
5739 		return res;
5740 	}
5741 
5742 	return hostapd_ctrl_iface_receive_process(hapd, buf, reply,reply_size,
5743 						  from, fromlen);
5744 }
5745 
5746 
hostapd_global_ctrl_iface_receive(int sock,void * eloop_ctx,void * sock_ctx)5747 static void hostapd_global_ctrl_iface_receive(int sock, void *eloop_ctx,
5748 					      void *sock_ctx)
5749 {
5750 	struct hapd_interfaces *interfaces = eloop_ctx;
5751 	char buffer[256], *buf = buffer;
5752 	int res;
5753 	struct sockaddr_storage from;
5754 	socklen_t fromlen = sizeof(from);
5755 	char *reply;
5756 	int reply_len;
5757 	const int reply_size = 4096;
5758 #ifdef CONFIG_CTRL_IFACE_UDP
5759 	unsigned char lcookie[CTRL_IFACE_COOKIE_LEN];
5760 #endif /* CONFIG_CTRL_IFACE_UDP */
5761 
5762 	res = recvfrom(sock, buffer, sizeof(buffer) - 1, 0,
5763 		       (struct sockaddr *) &from, &fromlen);
5764 	if (res < 0) {
5765 		wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s",
5766 			   strerror(errno));
5767 		return;
5768 	}
5769 	buf[res] = '\0';
5770 	wpa_printf(MSG_DEBUG, "Global ctrl_iface command: %s", buf);
5771 
5772 	reply = os_malloc(reply_size);
5773 	if (reply == NULL) {
5774 		if (sendto(sock, "FAIL\n", 5, 0, (struct sockaddr *) &from,
5775 			   fromlen) < 0) {
5776 			wpa_printf(MSG_DEBUG, "CTRL: sendto failed: %s",
5777 				   strerror(errno));
5778 		}
5779 		return;
5780 	}
5781 
5782 	os_memcpy(reply, "OK\n", 3);
5783 	reply_len = 3;
5784 
5785 #ifdef CONFIG_CTRL_IFACE_UDP
5786 	if (os_strcmp(buf, "GET_COOKIE") == 0) {
5787 		os_memcpy(reply, "COOKIE=", 7);
5788 		wpa_snprintf_hex(reply + 7, 2 * CTRL_IFACE_COOKIE_LEN + 1,
5789 				 interfaces->ctrl_iface_cookie,
5790 				 CTRL_IFACE_COOKIE_LEN);
5791 		reply_len = 7 + 2 * CTRL_IFACE_COOKIE_LEN;
5792 		goto send_reply;
5793 	}
5794 
5795 	if (os_strncmp(buf, "COOKIE=", 7) != 0 ||
5796 	    hexstr2bin(buf + 7, lcookie, CTRL_IFACE_COOKIE_LEN) < 0) {
5797 		wpa_printf(MSG_DEBUG,
5798 			   "CTRL: No cookie in the request - drop request");
5799 		os_free(reply);
5800 		return;
5801 	}
5802 
5803 	if (os_memcmp(interfaces->ctrl_iface_cookie, lcookie,
5804 		      CTRL_IFACE_COOKIE_LEN) != 0) {
5805 		wpa_printf(MSG_DEBUG,
5806 			   "CTRL: Invalid cookie in the request - drop request");
5807 		os_free(reply);
5808 		return;
5809 	}
5810 
5811 	buf += 7 + 2 * CTRL_IFACE_COOKIE_LEN;
5812 	while (*buf == ' ')
5813 		buf++;
5814 #endif /* CONFIG_CTRL_IFACE_UDP */
5815 
5816 	if (os_strncmp(buf, "IFNAME=", 7) == 0) {
5817 		char *pos = os_strchr(buf + 7, ' ');
5818 
5819 		if (pos) {
5820 			*pos++ = '\0';
5821 			reply_len = hostapd_global_ctrl_iface_ifname(
5822 				interfaces, buf + 7, pos, reply, reply_size,
5823 				&from, fromlen);
5824 			goto send_reply;
5825 		}
5826 	}
5827 
5828 	if (os_strcmp(buf, "PING") == 0) {
5829 		os_memcpy(reply, "PONG\n", 5);
5830 		reply_len = 5;
5831 	} else if (os_strncmp(buf, "RELOG", 5) == 0) {
5832 		if (wpa_debug_reopen_file() < 0)
5833 			reply_len = -1;
5834 	} else if (os_strcmp(buf, "FLUSH") == 0) {
5835 		hostapd_ctrl_iface_flush(interfaces);
5836 	} else if (os_strncmp(buf, "ADD ", 4) == 0) {
5837 		if (hostapd_ctrl_iface_add(interfaces, buf + 4) < 0)
5838 			reply_len = -1;
5839 	} else if (os_strncmp(buf, "REMOVE ", 7) == 0) {
5840 		if (hostapd_ctrl_iface_remove(interfaces, buf + 7) < 0)
5841 			reply_len = -1;
5842 	} else if (os_strcmp(buf, "ATTACH") == 0) {
5843 		if (hostapd_global_ctrl_iface_attach(interfaces, &from,
5844 						     fromlen, NULL))
5845 			reply_len = -1;
5846 	} else if (os_strncmp(buf, "ATTACH ", 7) == 0) {
5847 		if (hostapd_global_ctrl_iface_attach(interfaces, &from,
5848 						     fromlen, buf + 7))
5849 			reply_len = -1;
5850 	} else if (os_strcmp(buf, "DETACH") == 0) {
5851 		if (hostapd_global_ctrl_iface_detach(interfaces, &from,
5852 			fromlen))
5853 			reply_len = -1;
5854 #ifdef CONFIG_MODULE_TESTS
5855 	} else if (os_strcmp(buf, "MODULE_TESTS") == 0) {
5856 		if (hapd_module_tests() < 0)
5857 			reply_len = -1;
5858 #endif /* CONFIG_MODULE_TESTS */
5859 #ifdef CONFIG_FST
5860 	} else if (os_strncmp(buf, "FST-ATTACH ", 11) == 0) {
5861 		if (!hostapd_global_ctrl_iface_fst_attach(interfaces, buf + 11))
5862 			reply_len = os_snprintf(reply, reply_size, "OK\n");
5863 		else
5864 			reply_len = -1;
5865 	} else if (os_strncmp(buf, "FST-DETACH ", 11) == 0) {
5866 		if (!hostapd_global_ctrl_iface_fst_detach(interfaces, buf + 11))
5867 			reply_len = os_snprintf(reply, reply_size, "OK\n");
5868 		else
5869 			reply_len = -1;
5870 	} else if (os_strncmp(buf, "FST-MANAGER ", 12) == 0) {
5871 		reply_len = fst_ctrl_iface_receive(buf + 12, reply, reply_size);
5872 #endif /* CONFIG_FST */
5873 	} else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
5874 		if (!hostapd_global_ctrl_iface_dup_network(interfaces,
5875 							   buf + 12))
5876 			reply_len = os_snprintf(reply, reply_size, "OK\n");
5877 		else
5878 			reply_len = -1;
5879 	} else if (os_strncmp(buf, "INTERFACES", 10) == 0) {
5880 		reply_len = hostapd_global_ctrl_iface_interfaces(
5881 			interfaces, buf + 10, reply, reply_size);
5882 	} else if (os_strcmp(buf, "TERMINATE") == 0) {
5883 		eloop_terminate();
5884 	} else {
5885 		wpa_printf(MSG_DEBUG, "Unrecognized global ctrl_iface command "
5886 			   "ignored");
5887 		reply_len = -1;
5888 	}
5889 
5890 send_reply:
5891 	if (reply_len < 0) {
5892 		os_memcpy(reply, "FAIL\n", 5);
5893 		reply_len = 5;
5894 	}
5895 
5896 	if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
5897 		   fromlen) < 0) {
5898 		wpa_printf(MSG_DEBUG, "CTRL: sendto failed: %s",
5899 			   strerror(errno));
5900 	}
5901 	os_free(reply);
5902 }
5903 
5904 
5905 #ifndef CONFIG_CTRL_IFACE_UDP
hostapd_global_ctrl_iface_path(struct hapd_interfaces * interface)5906 static char * hostapd_global_ctrl_iface_path(struct hapd_interfaces *interface)
5907 {
5908 	char *buf;
5909 	size_t len;
5910 
5911 	if (interface->global_iface_path == NULL)
5912 		return NULL;
5913 
5914 	len = os_strlen(interface->global_iface_path) +
5915 		os_strlen(interface->global_iface_name) + 2;
5916 	buf = os_malloc(len);
5917 	if (buf == NULL)
5918 		return NULL;
5919 
5920 	os_snprintf(buf, len, "%s/%s", interface->global_iface_path,
5921 		    interface->global_iface_name);
5922 	buf[len - 1] = '\0';
5923 	return buf;
5924 }
5925 #endif /* CONFIG_CTRL_IFACE_UDP */
5926 
5927 
hostapd_global_ctrl_iface_init(struct hapd_interfaces * interface)5928 int hostapd_global_ctrl_iface_init(struct hapd_interfaces *interface)
5929 {
5930 #ifdef CONFIG_CTRL_IFACE_UDP
5931 	int port = HOSTAPD_GLOBAL_CTRL_IFACE_PORT;
5932 	char p[32] = { 0 };
5933 	char *pos;
5934 	struct addrinfo hints = { 0 }, *res, *saveres;
5935 	int n;
5936 
5937 	if (interface->global_ctrl_sock > -1) {
5938 		wpa_printf(MSG_DEBUG, "ctrl_iface already exists!");
5939 		return 0;
5940 	}
5941 
5942 	if (interface->global_iface_path == NULL)
5943 		return 0;
5944 
5945 	pos = os_strstr(interface->global_iface_path, "udp:");
5946 	if (pos) {
5947 		pos += 4;
5948 		port = atoi(pos);
5949 		if (port <= 0) {
5950 			wpa_printf(MSG_ERROR, "Invalid global ctrl UDP port");
5951 			goto fail;
5952 		}
5953 	}
5954 
5955 	os_get_random(interface->ctrl_iface_cookie, CTRL_IFACE_COOKIE_LEN);
5956 
5957 #ifdef CONFIG_CTRL_IFACE_UDP_REMOTE
5958 	hints.ai_flags = AI_PASSIVE;
5959 #endif /* CONFIG_CTRL_IFACE_UDP_REMOTE */
5960 
5961 #ifdef CONFIG_CTRL_IFACE_UDP_IPV6
5962 	hints.ai_family = AF_INET6;
5963 #else /* CONFIG_CTRL_IFACE_UDP_IPV6 */
5964 	hints.ai_family = AF_INET;
5965 #endif /* CONFIG_CTRL_IFACE_UDP_IPV6 */
5966 	hints.ai_socktype = SOCK_DGRAM;
5967 
5968 try_again:
5969 	os_snprintf(p, sizeof(p), "%d", port);
5970 	n = getaddrinfo(NULL, p, &hints, &res);
5971 	if (n) {
5972 		wpa_printf(MSG_ERROR, "getaddrinfo(): %s", gai_strerror(n));
5973 		goto fail;
5974 	}
5975 
5976 	saveres = res;
5977 	interface->global_ctrl_sock = socket(res->ai_family, res->ai_socktype,
5978 					     res->ai_protocol);
5979 	if (interface->global_ctrl_sock < 0) {
5980 		wpa_printf(MSG_ERROR, "socket(PF_INET): %s", strerror(errno));
5981 		goto fail;
5982 	}
5983 
5984 	if (bind(interface->global_ctrl_sock, res->ai_addr, res->ai_addrlen) <
5985 	    0) {
5986 		port++;
5987 		if ((port - HOSTAPD_GLOBAL_CTRL_IFACE_PORT) <
5988 		    HOSTAPD_GLOBAL_CTRL_IFACE_PORT_LIMIT && !pos)
5989 			goto try_again;
5990 		wpa_printf(MSG_ERROR, "bind(AF_INET): %s", strerror(errno));
5991 		goto fail;
5992 	}
5993 
5994 	freeaddrinfo(saveres);
5995 
5996 	wpa_printf(MSG_DEBUG, "global ctrl_iface_init UDP port: %d", port);
5997 
5998 	if (eloop_register_read_sock(interface->global_ctrl_sock,
5999 				     hostapd_global_ctrl_iface_receive,
6000 				     interface, NULL) < 0) {
6001 		hostapd_global_ctrl_iface_deinit(interface);
6002 		return -1;
6003 	}
6004 
6005 	wpa_msg_register_cb(hostapd_ctrl_iface_msg_cb);
6006 
6007 	return 0;
6008 
6009 fail:
6010 	if (interface->global_ctrl_sock >= 0)
6011 		close(interface->global_ctrl_sock);
6012 	return -1;
6013 #else /* CONFIG_CTRL_IFACE_UDP */
6014 	struct sockaddr_un addr;
6015 	int s = -1;
6016 	char *fname = NULL;
6017 
6018 	if (interface->global_iface_path == NULL) {
6019 		wpa_printf(MSG_DEBUG, "ctrl_iface not configured!");
6020 		return 0;
6021 	}
6022 
6023 	if (mkdir(interface->global_iface_path, S_IRWXU | S_IRWXG) < 0) {
6024 		if (errno == EEXIST) {
6025 			wpa_printf(MSG_DEBUG, "Using existing control "
6026 				   "interface directory.");
6027 		} else {
6028 			wpa_printf(MSG_ERROR, "mkdir[ctrl_interface]: %s",
6029 				   strerror(errno));
6030 			goto fail;
6031 		}
6032 	} else if (interface->ctrl_iface_group &&
6033 		   lchown(interface->global_iface_path, -1,
6034 			  interface->ctrl_iface_group) < 0) {
6035 		wpa_printf(MSG_ERROR, "lchown[ctrl_interface]: %s",
6036 			   strerror(errno));
6037 		goto fail;
6038 	}
6039 
6040 	if (os_strlen(interface->global_iface_path) + 1 +
6041 	    os_strlen(interface->global_iface_name) >= sizeof(addr.sun_path))
6042 		goto fail;
6043 
6044 	s = socket(PF_UNIX, SOCK_DGRAM, 0);
6045 	if (s < 0) {
6046 		wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno));
6047 		goto fail;
6048 	}
6049 
6050 	os_memset(&addr, 0, sizeof(addr));
6051 #ifdef __FreeBSD__
6052 	addr.sun_len = sizeof(addr);
6053 #endif /* __FreeBSD__ */
6054 	addr.sun_family = AF_UNIX;
6055 	fname = hostapd_global_ctrl_iface_path(interface);
6056 	if (fname == NULL)
6057 		goto fail;
6058 	os_strlcpy(addr.sun_path, fname, sizeof(addr.sun_path));
6059 	if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
6060 		wpa_printf(MSG_DEBUG, "ctrl_iface bind(PF_UNIX) failed: %s",
6061 			   strerror(errno));
6062 		if (connect(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
6063 			wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not"
6064 				   " allow connections - assuming it was left"
6065 				   "over from forced program termination");
6066 			if (unlink(fname) < 0) {
6067 				wpa_printf(MSG_ERROR,
6068 					   "Could not unlink existing ctrl_iface socket '%s': %s",
6069 					   fname, strerror(errno));
6070 				goto fail;
6071 			}
6072 			if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) <
6073 			    0) {
6074 				wpa_printf(MSG_ERROR, "bind(PF_UNIX): %s",
6075 					   strerror(errno));
6076 				goto fail;
6077 			}
6078 			wpa_printf(MSG_DEBUG, "Successfully replaced leftover "
6079 				   "ctrl_iface socket '%s'", fname);
6080 		} else {
6081 			wpa_printf(MSG_INFO, "ctrl_iface exists and seems to "
6082 				   "be in use - cannot override it");
6083 			wpa_printf(MSG_INFO, "Delete '%s' manually if it is "
6084 				   "not used anymore", fname);
6085 			os_free(fname);
6086 			fname = NULL;
6087 			goto fail;
6088 		}
6089 	}
6090 
6091 	if (interface->ctrl_iface_group &&
6092 	    lchown(fname, -1, interface->ctrl_iface_group) < 0) {
6093 		wpa_printf(MSG_ERROR, "lchown[ctrl_interface]: %s",
6094 			   strerror(errno));
6095 		goto fail;
6096 	}
6097 
6098 	if (chmod(fname, S_IRWXU | S_IRWXG) < 0) {
6099 		wpa_printf(MSG_ERROR, "chmod[ctrl_interface/ifname]: %s",
6100 			   strerror(errno));
6101 		goto fail;
6102 	}
6103 	os_free(fname);
6104 
6105 	interface->global_ctrl_sock = s;
6106 	eloop_register_read_sock(s, hostapd_global_ctrl_iface_receive,
6107 				 interface, NULL);
6108 
6109 	wpa_msg_register_cb(hostapd_ctrl_iface_msg_cb);
6110 
6111 	return 0;
6112 
6113 fail:
6114 	if (s >= 0)
6115 		close(s);
6116 	if (fname) {
6117 		unlink(fname);
6118 		os_free(fname);
6119 	}
6120 	return -1;
6121 #endif /* CONFIG_CTRL_IFACE_UDP */
6122 }
6123 
6124 
hostapd_global_ctrl_iface_deinit(struct hapd_interfaces * interfaces)6125 void hostapd_global_ctrl_iface_deinit(struct hapd_interfaces *interfaces)
6126 {
6127 #ifndef CONFIG_CTRL_IFACE_UDP
6128 	char *fname = NULL;
6129 #endif /* CONFIG_CTRL_IFACE_UDP */
6130 	struct wpa_ctrl_dst *dst, *prev;
6131 
6132 	if (interfaces->global_ctrl_sock > -1) {
6133 		eloop_unregister_read_sock(interfaces->global_ctrl_sock);
6134 		close(interfaces->global_ctrl_sock);
6135 		interfaces->global_ctrl_sock = -1;
6136 #ifndef CONFIG_CTRL_IFACE_UDP
6137 		fname = hostapd_global_ctrl_iface_path(interfaces);
6138 		if (fname) {
6139 			unlink(fname);
6140 			os_free(fname);
6141 		}
6142 
6143 		if (interfaces->global_iface_path &&
6144 		    rmdir(interfaces->global_iface_path) < 0) {
6145 			if (errno == ENOTEMPTY) {
6146 				wpa_printf(MSG_DEBUG, "Control interface "
6147 					   "directory not empty - leaving it "
6148 					   "behind");
6149 			} else {
6150 				wpa_printf(MSG_ERROR,
6151 					   "rmdir[ctrl_interface=%s]: %s",
6152 					   interfaces->global_iface_path,
6153 					   strerror(errno));
6154 			}
6155 		}
6156 #endif /* CONFIG_CTRL_IFACE_UDP */
6157 	}
6158 
6159 	os_free(interfaces->global_iface_path);
6160 	interfaces->global_iface_path = NULL;
6161 
6162 	dl_list_for_each_safe(dst, prev, &interfaces->global_ctrl_dst,
6163 			      struct wpa_ctrl_dst, list)
6164 		os_free(dst);
6165 }
6166 
6167 
hostapd_ctrl_check_event_enabled(struct wpa_ctrl_dst * dst,const char * buf)6168 static int hostapd_ctrl_check_event_enabled(struct wpa_ctrl_dst *dst,
6169 					    const char *buf)
6170 {
6171 	/* Enable Probe Request events based on explicit request.
6172 	 * Other events are enabled by default.
6173 	 */
6174 	if (str_starts(buf, RX_PROBE_REQUEST))
6175 		return !!(dst->events & WPA_EVENT_RX_PROBE_REQUEST);
6176 	return 1;
6177 }
6178 
6179 
hostapd_ctrl_iface_send_internal(int sock,struct dl_list * ctrl_dst,const char * ifname,int level,const char * buf,size_t len)6180 static void hostapd_ctrl_iface_send_internal(int sock, struct dl_list *ctrl_dst,
6181 					     const char *ifname, int level,
6182 					     const char *buf, size_t len)
6183 {
6184 	struct wpa_ctrl_dst *dst, *next;
6185 	struct msghdr msg;
6186 	int idx, res;
6187 	struct iovec io[5];
6188 	char levelstr[10];
6189 
6190 	if (sock < 0 || dl_list_empty(ctrl_dst))
6191 		return;
6192 
6193 	res = os_snprintf(levelstr, sizeof(levelstr), "<%d>", level);
6194 	if (os_snprintf_error(sizeof(levelstr), res))
6195 		return;
6196 	idx = 0;
6197 	if (ifname) {
6198 		io[idx].iov_base = "IFNAME=";
6199 		io[idx].iov_len = 7;
6200 		idx++;
6201 		io[idx].iov_base = (char *) ifname;
6202 		io[idx].iov_len = os_strlen(ifname);
6203 		idx++;
6204 		io[idx].iov_base = " ";
6205 		io[idx].iov_len = 1;
6206 		idx++;
6207 	}
6208 	io[idx].iov_base = levelstr;
6209 	io[idx].iov_len = os_strlen(levelstr);
6210 	idx++;
6211 	io[idx].iov_base = (char *) buf;
6212 	io[idx].iov_len = len;
6213 	idx++;
6214 	os_memset(&msg, 0, sizeof(msg));
6215 	msg.msg_iov = io;
6216 	msg.msg_iovlen = idx;
6217 
6218 	idx = 0;
6219 	dl_list_for_each_safe(dst, next, ctrl_dst, struct wpa_ctrl_dst, list) {
6220 		if ((level >= dst->debug_level) &&
6221 		     hostapd_ctrl_check_event_enabled(dst, buf)) {
6222 			sockaddr_print(MSG_DEBUG, "CTRL_IFACE monitor send",
6223 				       &dst->addr, dst->addrlen);
6224 			msg.msg_name = &dst->addr;
6225 			msg.msg_namelen = dst->addrlen;
6226 			if (sendmsg(sock, &msg, 0) < 0) {
6227 				int _errno = errno;
6228 				wpa_printf(MSG_INFO, "CTRL_IFACE monitor[%d]: "
6229 					   "%d - %s",
6230 					   idx, errno, strerror(errno));
6231 				dst->errors++;
6232 				if (dst->errors > 10 || _errno == ENOENT) {
6233 					ctrl_iface_detach(ctrl_dst,
6234 							  &dst->addr,
6235 							  dst->addrlen);
6236 				}
6237 			} else
6238 				dst->errors = 0;
6239 		}
6240 		idx++;
6241 	}
6242 }
6243 
6244 
hostapd_ctrl_iface_send(struct hostapd_data * hapd,int level,enum wpa_msg_type type,const char * buf,size_t len)6245 static void hostapd_ctrl_iface_send(struct hostapd_data *hapd, int level,
6246 				    enum wpa_msg_type type,
6247 				    const char *buf, size_t len)
6248 {
6249 	if (type != WPA_MSG_NO_GLOBAL) {
6250 		hostapd_ctrl_iface_send_internal(
6251 			hapd->iface->interfaces->global_ctrl_sock,
6252 			&hapd->iface->interfaces->global_ctrl_dst,
6253 			type != WPA_MSG_PER_INTERFACE ?
6254 			NULL : hapd->conf->iface,
6255 			level, buf, len);
6256 	}
6257 
6258 	if (type != WPA_MSG_ONLY_GLOBAL) {
6259 		hostapd_ctrl_iface_send_internal(
6260 			hapd->ctrl_sock, &hapd->ctrl_dst,
6261 			NULL, level, buf, len);
6262 	}
6263 }
6264 
6265 #endif /* CONFIG_NATIVE_WINDOWS */
6266