xref: /freebsd/contrib/wpa/wpa_supplicant/ctrl_iface.c (revision cddbc3b40812213ff00041f79174cac0be360a2a)
1 /*
2  * WPA Supplicant / Control interface (shared code for all backends)
3  * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 #ifdef CONFIG_TESTING_OPTIONS
11 #include <net/ethernet.h>
12 #include <netinet/ip.h>
13 #endif /* CONFIG_TESTING_OPTIONS */
14 
15 #include "utils/common.h"
16 #include "utils/eloop.h"
17 #include "utils/uuid.h"
18 #include "utils/module_tests.h"
19 #include "common/version.h"
20 #include "common/ieee802_11_defs.h"
21 #include "common/ieee802_11_common.h"
22 #include "common/wpa_ctrl.h"
23 #ifdef CONFIG_DPP
24 #include "common/dpp.h"
25 #endif /* CONFIG_DPP */
26 #include "crypto/tls.h"
27 #include "ap/hostapd.h"
28 #include "eap_peer/eap.h"
29 #include "eapol_supp/eapol_supp_sm.h"
30 #include "rsn_supp/wpa.h"
31 #include "rsn_supp/preauth.h"
32 #include "rsn_supp/pmksa_cache.h"
33 #include "l2_packet/l2_packet.h"
34 #include "wps/wps.h"
35 #include "fst/fst.h"
36 #include "fst/fst_ctrl_iface.h"
37 #include "config.h"
38 #include "wpa_supplicant_i.h"
39 #include "driver_i.h"
40 #include "wps_supplicant.h"
41 #include "ibss_rsn.h"
42 #include "ap.h"
43 #include "p2p_supplicant.h"
44 #include "p2p/p2p.h"
45 #include "hs20_supplicant.h"
46 #include "wifi_display.h"
47 #include "notify.h"
48 #include "bss.h"
49 #include "scan.h"
50 #include "ctrl_iface.h"
51 #include "interworking.h"
52 #include "blacklist.h"
53 #include "autoscan.h"
54 #include "wnm_sta.h"
55 #include "offchannel.h"
56 #include "drivers/driver.h"
57 #include "mesh.h"
58 #include "dpp_supplicant.h"
59 
60 static int wpa_supplicant_global_iface_list(struct wpa_global *global,
61 					    char *buf, int len);
62 static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
63 						  const char *input,
64 						  char *buf, int len);
65 static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s,
66 					char *val);
67 
68 
69 static int set_bssid_filter(struct wpa_supplicant *wpa_s, char *val)
70 {
71 	char *pos;
72 	u8 addr[ETH_ALEN], *filter = NULL, *n;
73 	size_t count = 0;
74 
75 	pos = val;
76 	while (pos) {
77 		if (*pos == '\0')
78 			break;
79 		if (hwaddr_aton(pos, addr)) {
80 			os_free(filter);
81 			return -1;
82 		}
83 		n = os_realloc_array(filter, count + 1, ETH_ALEN);
84 		if (n == NULL) {
85 			os_free(filter);
86 			return -1;
87 		}
88 		filter = n;
89 		os_memcpy(filter + count * ETH_ALEN, addr, ETH_ALEN);
90 		count++;
91 
92 		pos = os_strchr(pos, ' ');
93 		if (pos)
94 			pos++;
95 	}
96 
97 	wpa_hexdump(MSG_DEBUG, "bssid_filter", filter, count * ETH_ALEN);
98 	os_free(wpa_s->bssid_filter);
99 	wpa_s->bssid_filter = filter;
100 	wpa_s->bssid_filter_count = count;
101 
102 	return 0;
103 }
104 
105 
106 static int set_disallow_aps(struct wpa_supplicant *wpa_s, char *val)
107 {
108 	char *pos;
109 	u8 addr[ETH_ALEN], *bssid = NULL, *n;
110 	struct wpa_ssid_value *ssid = NULL, *ns;
111 	size_t count = 0, ssid_count = 0;
112 	struct wpa_ssid *c;
113 
114 	/*
115 	 * disallow_list ::= <ssid_spec> | <bssid_spec> | <disallow_list> | ""
116 	 * SSID_SPEC ::= ssid <SSID_HEX>
117 	 * BSSID_SPEC ::= bssid <BSSID_HEX>
118 	 */
119 
120 	pos = val;
121 	while (pos) {
122 		if (*pos == '\0')
123 			break;
124 		if (os_strncmp(pos, "bssid ", 6) == 0) {
125 			int res;
126 			pos += 6;
127 			res = hwaddr_aton2(pos, addr);
128 			if (res < 0) {
129 				os_free(ssid);
130 				os_free(bssid);
131 				wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
132 					   "BSSID value '%s'", pos);
133 				return -1;
134 			}
135 			pos += res;
136 			n = os_realloc_array(bssid, count + 1, ETH_ALEN);
137 			if (n == NULL) {
138 				os_free(ssid);
139 				os_free(bssid);
140 				return -1;
141 			}
142 			bssid = n;
143 			os_memcpy(bssid + count * ETH_ALEN, addr, ETH_ALEN);
144 			count++;
145 		} else if (os_strncmp(pos, "ssid ", 5) == 0) {
146 			char *end;
147 			pos += 5;
148 
149 			end = pos;
150 			while (*end) {
151 				if (*end == '\0' || *end == ' ')
152 					break;
153 				end++;
154 			}
155 
156 			ns = os_realloc_array(ssid, ssid_count + 1,
157 					      sizeof(struct wpa_ssid_value));
158 			if (ns == NULL) {
159 				os_free(ssid);
160 				os_free(bssid);
161 				return -1;
162 			}
163 			ssid = ns;
164 
165 			if ((end - pos) & 0x01 ||
166 			    end - pos > 2 * SSID_MAX_LEN ||
167 			    hexstr2bin(pos, ssid[ssid_count].ssid,
168 				       (end - pos) / 2) < 0) {
169 				os_free(ssid);
170 				os_free(bssid);
171 				wpa_printf(MSG_DEBUG, "Invalid disallow_aps "
172 					   "SSID value '%s'", pos);
173 				return -1;
174 			}
175 			ssid[ssid_count].ssid_len = (end - pos) / 2;
176 			wpa_hexdump_ascii(MSG_DEBUG, "disallow_aps SSID",
177 					  ssid[ssid_count].ssid,
178 					  ssid[ssid_count].ssid_len);
179 			ssid_count++;
180 			pos = end;
181 		} else {
182 			wpa_printf(MSG_DEBUG, "Unexpected disallow_aps value "
183 				   "'%s'", pos);
184 			os_free(ssid);
185 			os_free(bssid);
186 			return -1;
187 		}
188 
189 		pos = os_strchr(pos, ' ');
190 		if (pos)
191 			pos++;
192 	}
193 
194 	wpa_hexdump(MSG_DEBUG, "disallow_aps_bssid", bssid, count * ETH_ALEN);
195 	os_free(wpa_s->disallow_aps_bssid);
196 	wpa_s->disallow_aps_bssid = bssid;
197 	wpa_s->disallow_aps_bssid_count = count;
198 
199 	wpa_printf(MSG_DEBUG, "disallow_aps_ssid_count %d", (int) ssid_count);
200 	os_free(wpa_s->disallow_aps_ssid);
201 	wpa_s->disallow_aps_ssid = ssid;
202 	wpa_s->disallow_aps_ssid_count = ssid_count;
203 
204 	if (!wpa_s->current_ssid || wpa_s->wpa_state < WPA_AUTHENTICATING)
205 		return 0;
206 
207 	c = wpa_s->current_ssid;
208 	if (c->mode != WPAS_MODE_INFRA && c->mode != WPAS_MODE_IBSS)
209 		return 0;
210 
211 	if (!disallowed_bssid(wpa_s, wpa_s->bssid) &&
212 	    !disallowed_ssid(wpa_s, c->ssid, c->ssid_len))
213 		return 0;
214 
215 	wpa_printf(MSG_DEBUG, "Disconnect and try to find another network "
216 		   "because current AP was marked disallowed");
217 
218 #ifdef CONFIG_SME
219 	wpa_s->sme.prev_bssid_set = 0;
220 #endif /* CONFIG_SME */
221 	wpa_s->reassociate = 1;
222 	wpa_s->own_disconnect_req = 1;
223 	wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
224 	wpa_supplicant_req_scan(wpa_s, 0, 0);
225 
226 	return 0;
227 }
228 
229 
230 #ifndef CONFIG_NO_CONFIG_BLOBS
231 static int wpas_ctrl_set_blob(struct wpa_supplicant *wpa_s, char *pos)
232 {
233 	char *name = pos;
234 	struct wpa_config_blob *blob;
235 	size_t len;
236 
237 	pos = os_strchr(pos, ' ');
238 	if (pos == NULL)
239 		return -1;
240 	*pos++ = '\0';
241 	len = os_strlen(pos);
242 	if (len & 1)
243 		return -1;
244 
245 	wpa_printf(MSG_DEBUG, "CTRL: Set blob '%s'", name);
246 	blob = os_zalloc(sizeof(*blob));
247 	if (blob == NULL)
248 		return -1;
249 	blob->name = os_strdup(name);
250 	blob->data = os_malloc(len / 2);
251 	if (blob->name == NULL || blob->data == NULL) {
252 		wpa_config_free_blob(blob);
253 		return -1;
254 	}
255 
256 	if (hexstr2bin(pos, blob->data, len / 2) < 0) {
257 		wpa_printf(MSG_DEBUG, "CTRL: Invalid blob hex data");
258 		wpa_config_free_blob(blob);
259 		return -1;
260 	}
261 	blob->len = len / 2;
262 
263 	wpa_config_set_blob(wpa_s->conf, blob);
264 
265 	return 0;
266 }
267 #endif /* CONFIG_NO_CONFIG_BLOBS */
268 
269 
270 static int wpas_ctrl_pno(struct wpa_supplicant *wpa_s, char *cmd)
271 {
272 	char *params;
273 	char *pos;
274 	int *freqs = NULL;
275 	int ret;
276 
277 	if (atoi(cmd)) {
278 		params = os_strchr(cmd, ' ');
279 		os_free(wpa_s->manual_sched_scan_freqs);
280 		if (params) {
281 			params++;
282 			pos = os_strstr(params, "freq=");
283 			if (pos)
284 				freqs = freq_range_to_channel_list(wpa_s,
285 								   pos + 5);
286 		}
287 		wpa_s->manual_sched_scan_freqs = freqs;
288 		ret = wpas_start_pno(wpa_s);
289 	} else {
290 		ret = wpas_stop_pno(wpa_s);
291 	}
292 	return ret;
293 }
294 
295 
296 static int wpas_ctrl_set_band(struct wpa_supplicant *wpa_s, char *band)
297 {
298 	union wpa_event_data event;
299 
300 	if (os_strcmp(band, "AUTO") == 0)
301 		wpa_s->setband = WPA_SETBAND_AUTO;
302 	else if (os_strcmp(band, "5G") == 0)
303 		wpa_s->setband = WPA_SETBAND_5G;
304 	else if (os_strcmp(band, "2G") == 0)
305 		wpa_s->setband = WPA_SETBAND_2G;
306 	else
307 		return -1;
308 
309 	if (wpa_drv_setband(wpa_s, wpa_s->setband) == 0) {
310 		os_memset(&event, 0, sizeof(event));
311 		event.channel_list_changed.initiator = REGDOM_SET_BY_USER;
312 		event.channel_list_changed.type = REGDOM_TYPE_UNKNOWN;
313 		wpa_supplicant_event(wpa_s, EVENT_CHANNEL_LIST_CHANGED, &event);
314 	}
315 
316 	return 0;
317 }
318 
319 
320 static int wpas_ctrl_iface_set_lci(struct wpa_supplicant *wpa_s,
321 				   const char *cmd)
322 {
323 	struct wpabuf *lci;
324 
325 	if (*cmd == '\0' || os_strcmp(cmd, "\"\"") == 0) {
326 		wpabuf_free(wpa_s->lci);
327 		wpa_s->lci = NULL;
328 		return 0;
329 	}
330 
331 	lci = wpabuf_parse_bin(cmd);
332 	if (!lci)
333 		return -1;
334 
335 	if (os_get_reltime(&wpa_s->lci_time)) {
336 		wpabuf_free(lci);
337 		return -1;
338 	}
339 
340 	wpabuf_free(wpa_s->lci);
341 	wpa_s->lci = lci;
342 
343 	return 0;
344 }
345 
346 
347 static int
348 wpas_ctrl_set_relative_rssi(struct wpa_supplicant *wpa_s, const char *cmd)
349 {
350 	int relative_rssi;
351 
352 	if (os_strcmp(cmd, "disable") == 0) {
353 		wpa_s->srp.relative_rssi_set = 0;
354 		return 0;
355 	}
356 
357 	relative_rssi = atoi(cmd);
358 	if (relative_rssi < 0 || relative_rssi > 100)
359 		return -1;
360 	wpa_s->srp.relative_rssi = relative_rssi;
361 	wpa_s->srp.relative_rssi_set = 1;
362 	return 0;
363 }
364 
365 
366 static int wpas_ctrl_set_relative_band_adjust(struct wpa_supplicant *wpa_s,
367 					      const char *cmd)
368 {
369 	char *pos;
370 	int adjust_rssi;
371 
372 	/* <band>:adjust_value */
373 	pos = os_strchr(cmd, ':');
374 	if (!pos)
375 		return -1;
376 	pos++;
377 	adjust_rssi = atoi(pos);
378 	if (adjust_rssi < -100 || adjust_rssi > 100)
379 		return -1;
380 
381 	if (os_strncmp(cmd, "2G", 2) == 0)
382 		wpa_s->srp.relative_adjust_band = WPA_SETBAND_2G;
383 	else if (os_strncmp(cmd, "5G", 2) == 0)
384 		wpa_s->srp.relative_adjust_band = WPA_SETBAND_5G;
385 	else
386 		return -1;
387 
388 	wpa_s->srp.relative_adjust_rssi = adjust_rssi;
389 
390 	return 0;
391 }
392 
393 
394 static int wpas_ctrl_iface_set_ric_ies(struct wpa_supplicant *wpa_s,
395 				   const char *cmd)
396 {
397 	struct wpabuf *ric_ies;
398 
399 	if (*cmd == '\0' || os_strcmp(cmd, "\"\"") == 0) {
400 		wpabuf_free(wpa_s->ric_ies);
401 		wpa_s->ric_ies = NULL;
402 		return 0;
403 	}
404 
405 	ric_ies = wpabuf_parse_bin(cmd);
406 	if (!ric_ies)
407 		return -1;
408 
409 	wpabuf_free(wpa_s->ric_ies);
410 	wpa_s->ric_ies = ric_ies;
411 
412 	return 0;
413 }
414 
415 
416 static int wpa_supplicant_ctrl_iface_set(struct wpa_supplicant *wpa_s,
417 					 char *cmd)
418 {
419 	char *value;
420 	int ret = 0;
421 
422 	value = os_strchr(cmd, ' ');
423 	if (value == NULL)
424 		return -1;
425 	*value++ = '\0';
426 
427 	wpa_printf(MSG_DEBUG, "CTRL_IFACE SET '%s'='%s'", cmd, value);
428 	if (os_strcasecmp(cmd, "EAPOL::heldPeriod") == 0) {
429 		eapol_sm_configure(wpa_s->eapol,
430 				   atoi(value), -1, -1, -1);
431 	} else if (os_strcasecmp(cmd, "EAPOL::authPeriod") == 0) {
432 		eapol_sm_configure(wpa_s->eapol,
433 				   -1, atoi(value), -1, -1);
434 	} else if (os_strcasecmp(cmd, "EAPOL::startPeriod") == 0) {
435 		eapol_sm_configure(wpa_s->eapol,
436 				   -1, -1, atoi(value), -1);
437 	} else if (os_strcasecmp(cmd, "EAPOL::maxStart") == 0) {
438 		eapol_sm_configure(wpa_s->eapol,
439 				   -1, -1, -1, atoi(value));
440 	} else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKLifetime") == 0) {
441 		if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
442 				     atoi(value))) {
443 			ret = -1;
444 		} else {
445 			value[-1] = '=';
446 			wpa_config_process_global(wpa_s->conf, cmd, -1);
447 		}
448 	} else if (os_strcasecmp(cmd, "dot11RSNAConfigPMKReauthThreshold") ==
449 		   0) {
450 		if (wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
451 				     atoi(value))) {
452 			ret = -1;
453 		} else {
454 			value[-1] = '=';
455 			wpa_config_process_global(wpa_s->conf, cmd, -1);
456 		}
457 	} else if (os_strcasecmp(cmd, "dot11RSNAConfigSATimeout") == 0) {
458 		if (wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
459 				     atoi(value))) {
460 			ret = -1;
461 		} else {
462 			value[-1] = '=';
463 			wpa_config_process_global(wpa_s->conf, cmd, -1);
464 		}
465 	} else if (os_strcasecmp(cmd, "wps_fragment_size") == 0) {
466 		wpa_s->wps_fragment_size = atoi(value);
467 #ifdef CONFIG_WPS_TESTING
468 	} else if (os_strcasecmp(cmd, "wps_version_number") == 0) {
469 		long int val;
470 		val = strtol(value, NULL, 0);
471 		if (val < 0 || val > 0xff) {
472 			ret = -1;
473 			wpa_printf(MSG_DEBUG, "WPS: Invalid "
474 				   "wps_version_number %ld", val);
475 		} else {
476 			wps_version_number = val;
477 			wpa_printf(MSG_DEBUG, "WPS: Testing - force WPS "
478 				   "version %u.%u",
479 				   (wps_version_number & 0xf0) >> 4,
480 				   wps_version_number & 0x0f);
481 		}
482 	} else if (os_strcasecmp(cmd, "wps_testing_dummy_cred") == 0) {
483 		wps_testing_dummy_cred = atoi(value);
484 		wpa_printf(MSG_DEBUG, "WPS: Testing - dummy_cred=%d",
485 			   wps_testing_dummy_cred);
486 	} else if (os_strcasecmp(cmd, "wps_corrupt_pkhash") == 0) {
487 		wps_corrupt_pkhash = atoi(value);
488 		wpa_printf(MSG_DEBUG, "WPS: Testing - wps_corrupt_pkhash=%d",
489 			   wps_corrupt_pkhash);
490 	} else if (os_strcasecmp(cmd, "wps_force_auth_types") == 0) {
491 		if (value[0] == '\0') {
492 			wps_force_auth_types_in_use = 0;
493 		} else {
494 			wps_force_auth_types = strtol(value, NULL, 0);
495 			wps_force_auth_types_in_use = 1;
496 		}
497 	} else if (os_strcasecmp(cmd, "wps_force_encr_types") == 0) {
498 		if (value[0] == '\0') {
499 			wps_force_encr_types_in_use = 0;
500 		} else {
501 			wps_force_encr_types = strtol(value, NULL, 0);
502 			wps_force_encr_types_in_use = 1;
503 		}
504 #endif /* CONFIG_WPS_TESTING */
505 	} else if (os_strcasecmp(cmd, "ampdu") == 0) {
506 		if (wpa_drv_ampdu(wpa_s, atoi(value)) < 0)
507 			ret = -1;
508 #ifdef CONFIG_TDLS
509 #ifdef CONFIG_TDLS_TESTING
510 	} else if (os_strcasecmp(cmd, "tdls_testing") == 0) {
511 		tdls_testing = strtol(value, NULL, 0);
512 		wpa_printf(MSG_DEBUG, "TDLS: tdls_testing=0x%x", tdls_testing);
513 #endif /* CONFIG_TDLS_TESTING */
514 	} else if (os_strcasecmp(cmd, "tdls_disabled") == 0) {
515 		int disabled = atoi(value);
516 		wpa_printf(MSG_DEBUG, "TDLS: tdls_disabled=%d", disabled);
517 		if (disabled) {
518 			if (wpa_drv_tdls_oper(wpa_s, TDLS_DISABLE, NULL) < 0)
519 				ret = -1;
520 		} else if (wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL) < 0)
521 			ret = -1;
522 		wpa_tdls_enable(wpa_s->wpa, !disabled);
523 #endif /* CONFIG_TDLS */
524 	} else if (os_strcasecmp(cmd, "pno") == 0) {
525 		ret = wpas_ctrl_pno(wpa_s, value);
526 	} else if (os_strcasecmp(cmd, "radio_disabled") == 0) {
527 		int disabled = atoi(value);
528 		if (wpa_drv_radio_disable(wpa_s, disabled) < 0)
529 			ret = -1;
530 		else if (disabled)
531 			wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
532 	} else if (os_strcasecmp(cmd, "uapsd") == 0) {
533 		if (os_strcmp(value, "disable") == 0)
534 			wpa_s->set_sta_uapsd = 0;
535 		else {
536 			int be, bk, vi, vo;
537 			char *pos;
538 			/* format: BE,BK,VI,VO;max SP Length */
539 			be = atoi(value);
540 			pos = os_strchr(value, ',');
541 			if (pos == NULL)
542 				return -1;
543 			pos++;
544 			bk = atoi(pos);
545 			pos = os_strchr(pos, ',');
546 			if (pos == NULL)
547 				return -1;
548 			pos++;
549 			vi = atoi(pos);
550 			pos = os_strchr(pos, ',');
551 			if (pos == NULL)
552 				return -1;
553 			pos++;
554 			vo = atoi(pos);
555 			/* ignore max SP Length for now */
556 
557 			wpa_s->set_sta_uapsd = 1;
558 			wpa_s->sta_uapsd = 0;
559 			if (be)
560 				wpa_s->sta_uapsd |= BIT(0);
561 			if (bk)
562 				wpa_s->sta_uapsd |= BIT(1);
563 			if (vi)
564 				wpa_s->sta_uapsd |= BIT(2);
565 			if (vo)
566 				wpa_s->sta_uapsd |= BIT(3);
567 		}
568 	} else if (os_strcasecmp(cmd, "ps") == 0) {
569 		ret = wpa_drv_set_p2p_powersave(wpa_s, atoi(value), -1, -1);
570 #ifdef CONFIG_WIFI_DISPLAY
571 	} else if (os_strcasecmp(cmd, "wifi_display") == 0) {
572 		int enabled = !!atoi(value);
573 		if (enabled && !wpa_s->global->p2p)
574 			ret = -1;
575 		else
576 			wifi_display_enable(wpa_s->global, enabled);
577 #endif /* CONFIG_WIFI_DISPLAY */
578 	} else if (os_strcasecmp(cmd, "bssid_filter") == 0) {
579 		ret = set_bssid_filter(wpa_s, value);
580 	} else if (os_strcasecmp(cmd, "disallow_aps") == 0) {
581 		ret = set_disallow_aps(wpa_s, value);
582 	} else if (os_strcasecmp(cmd, "no_keep_alive") == 0) {
583 		wpa_s->no_keep_alive = !!atoi(value);
584 #ifdef CONFIG_DPP
585 	} else if (os_strcasecmp(cmd, "dpp_configurator_params") == 0) {
586 		os_free(wpa_s->dpp_configurator_params);
587 		wpa_s->dpp_configurator_params = os_strdup(value);
588 	} else if (os_strcasecmp(cmd, "dpp_init_max_tries") == 0) {
589 		wpa_s->dpp_init_max_tries = atoi(value);
590 	} else if (os_strcasecmp(cmd, "dpp_init_retry_time") == 0) {
591 		wpa_s->dpp_init_retry_time = atoi(value);
592 	} else if (os_strcasecmp(cmd, "dpp_resp_wait_time") == 0) {
593 		wpa_s->dpp_resp_wait_time = atoi(value);
594 	} else if (os_strcasecmp(cmd, "dpp_resp_max_tries") == 0) {
595 		wpa_s->dpp_resp_max_tries = atoi(value);
596 	} else if (os_strcasecmp(cmd, "dpp_resp_retry_time") == 0) {
597 		wpa_s->dpp_resp_retry_time = atoi(value);
598 #ifdef CONFIG_TESTING_OPTIONS
599 	} else if (os_strcasecmp(cmd, "dpp_pkex_own_mac_override") == 0) {
600 		if (hwaddr_aton(value, dpp_pkex_own_mac_override))
601 			ret = -1;
602 	} else if (os_strcasecmp(cmd, "dpp_pkex_peer_mac_override") == 0) {
603 		if (hwaddr_aton(value, dpp_pkex_peer_mac_override))
604 			ret = -1;
605 	} else if (os_strcasecmp(cmd, "dpp_pkex_ephemeral_key_override") == 0) {
606 		size_t hex_len = os_strlen(value);
607 
608 		if (hex_len >
609 		    2 * sizeof(dpp_pkex_ephemeral_key_override))
610 			ret = -1;
611 		else if (hexstr2bin(value, dpp_pkex_ephemeral_key_override,
612 				    hex_len / 2))
613 			ret = -1;
614 		else
615 			dpp_pkex_ephemeral_key_override_len = hex_len / 2;
616 	} else if (os_strcasecmp(cmd, "dpp_protocol_key_override") == 0) {
617 		size_t hex_len = os_strlen(value);
618 
619 		if (hex_len > 2 * sizeof(dpp_protocol_key_override))
620 			ret = -1;
621 		else if (hexstr2bin(value, dpp_protocol_key_override,
622 				    hex_len / 2))
623 			ret = -1;
624 		else
625 			dpp_protocol_key_override_len = hex_len / 2;
626 	} else if (os_strcasecmp(cmd, "dpp_nonce_override") == 0) {
627 		size_t hex_len = os_strlen(value);
628 
629 		if (hex_len > 2 * sizeof(dpp_nonce_override))
630 			ret = -1;
631 		else if (hexstr2bin(value, dpp_nonce_override, hex_len / 2))
632 			ret = -1;
633 		else
634 			dpp_nonce_override_len = hex_len / 2;
635 #endif /* CONFIG_TESTING_OPTIONS */
636 #endif /* CONFIG_DPP */
637 #ifdef CONFIG_TESTING_OPTIONS
638 	} else if (os_strcasecmp(cmd, "ext_mgmt_frame_handling") == 0) {
639 		wpa_s->ext_mgmt_frame_handling = !!atoi(value);
640 	} else if (os_strcasecmp(cmd, "ext_eapol_frame_io") == 0) {
641 		wpa_s->ext_eapol_frame_io = !!atoi(value);
642 #ifdef CONFIG_AP
643 		if (wpa_s->ap_iface) {
644 			wpa_s->ap_iface->bss[0]->ext_eapol_frame_io =
645 				wpa_s->ext_eapol_frame_io;
646 		}
647 #endif /* CONFIG_AP */
648 	} else if (os_strcasecmp(cmd, "extra_roc_dur") == 0) {
649 		wpa_s->extra_roc_dur = atoi(value);
650 	} else if (os_strcasecmp(cmd, "test_failure") == 0) {
651 		wpa_s->test_failure = atoi(value);
652 	} else if (os_strcasecmp(cmd, "p2p_go_csa_on_inv") == 0) {
653 		wpa_s->p2p_go_csa_on_inv = !!atoi(value);
654 	} else if (os_strcasecmp(cmd, "ignore_auth_resp") == 0) {
655 		wpa_s->ignore_auth_resp = !!atoi(value);
656 	} else if (os_strcasecmp(cmd, "ignore_assoc_disallow") == 0) {
657 		wpa_s->ignore_assoc_disallow = !!atoi(value);
658 		wpa_drv_ignore_assoc_disallow(wpa_s,
659 					      wpa_s->ignore_assoc_disallow);
660 	} else if (os_strcasecmp(cmd, "reject_btm_req_reason") == 0) {
661 		wpa_s->reject_btm_req_reason = atoi(value);
662 	} else if (os_strcasecmp(cmd, "get_pref_freq_list_override") == 0) {
663 		os_free(wpa_s->get_pref_freq_list_override);
664 		if (!value[0])
665 			wpa_s->get_pref_freq_list_override = NULL;
666 		else
667 			wpa_s->get_pref_freq_list_override = os_strdup(value);
668 	} else if (os_strcasecmp(cmd, "sae_commit_override") == 0) {
669 		wpabuf_free(wpa_s->sae_commit_override);
670 		if (value[0] == '\0')
671 			wpa_s->sae_commit_override = NULL;
672 		else
673 			wpa_s->sae_commit_override = wpabuf_parse_bin(value);
674 #ifdef CONFIG_DPP
675 	} else if (os_strcasecmp(cmd, "dpp_config_obj_override") == 0) {
676 		os_free(wpa_s->dpp_config_obj_override);
677 		if (value[0] == '\0')
678 			wpa_s->dpp_config_obj_override = NULL;
679 		else
680 			wpa_s->dpp_config_obj_override = os_strdup(value);
681 	} else if (os_strcasecmp(cmd, "dpp_discovery_override") == 0) {
682 		os_free(wpa_s->dpp_discovery_override);
683 		if (value[0] == '\0')
684 			wpa_s->dpp_discovery_override = NULL;
685 		else
686 			wpa_s->dpp_discovery_override = os_strdup(value);
687 	} else if (os_strcasecmp(cmd, "dpp_groups_override") == 0) {
688 		os_free(wpa_s->dpp_groups_override);
689 		if (value[0] == '\0')
690 			wpa_s->dpp_groups_override = NULL;
691 		else
692 			wpa_s->dpp_groups_override = os_strdup(value);
693 	} else if (os_strcasecmp(cmd,
694 				 "dpp_ignore_netaccesskey_mismatch") == 0) {
695 		wpa_s->dpp_ignore_netaccesskey_mismatch = atoi(value);
696 	} else if (os_strcasecmp(cmd, "dpp_test") == 0) {
697 		dpp_test = atoi(value);
698 #endif /* CONFIG_DPP */
699 #endif /* CONFIG_TESTING_OPTIONS */
700 #ifdef CONFIG_FILS
701 	} else if (os_strcasecmp(cmd, "disable_fils") == 0) {
702 		wpa_s->disable_fils = !!atoi(value);
703 		wpa_drv_disable_fils(wpa_s, wpa_s->disable_fils);
704 		wpa_supplicant_set_default_scan_ies(wpa_s);
705 #endif /* CONFIG_FILS */
706 #ifndef CONFIG_NO_CONFIG_BLOBS
707 	} else if (os_strcmp(cmd, "blob") == 0) {
708 		ret = wpas_ctrl_set_blob(wpa_s, value);
709 #endif /* CONFIG_NO_CONFIG_BLOBS */
710 	} else if (os_strcasecmp(cmd, "setband") == 0) {
711 		ret = wpas_ctrl_set_band(wpa_s, value);
712 #ifdef CONFIG_MBO
713 	} else if (os_strcasecmp(cmd, "non_pref_chan") == 0) {
714 		ret = wpas_mbo_update_non_pref_chan(wpa_s, value);
715 		if (ret == 0) {
716 			value[-1] = '=';
717 			wpa_config_process_global(wpa_s->conf, cmd, -1);
718 		}
719 	} else if (os_strcasecmp(cmd, "mbo_cell_capa") == 0) {
720 		wpas_mbo_update_cell_capa(wpa_s, atoi(value));
721 	} else if (os_strcasecmp(cmd, "oce") == 0) {
722 		wpa_s->conf->oce = atoi(value);
723 		if (wpa_s->conf->oce) {
724 			if ((wpa_s->conf->oce & OCE_STA) &&
725 			    (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OCE_STA))
726 				wpa_s->enable_oce = OCE_STA;
727 
728 			if ((wpa_s->conf->oce & OCE_STA_CFON) &&
729 			    (wpa_s->drv_flags &
730 			     WPA_DRIVER_FLAGS_OCE_STA_CFON)) {
731 				/* TODO: Need to add STA-CFON support */
732 				wpa_printf(MSG_ERROR,
733 					   "OCE STA-CFON feature is not yet supported");
734 				return -1;
735 			}
736 		} else {
737 			wpa_s->enable_oce = 0;
738 		}
739 		wpa_supplicant_set_default_scan_ies(wpa_s);
740 #endif /* CONFIG_MBO */
741 	} else if (os_strcasecmp(cmd, "lci") == 0) {
742 		ret = wpas_ctrl_iface_set_lci(wpa_s, value);
743 	} else if (os_strcasecmp(cmd, "tdls_trigger_control") == 0) {
744 		ret = wpa_drv_set_tdls_mode(wpa_s, atoi(value));
745 	} else if (os_strcasecmp(cmd, "relative_rssi") == 0) {
746 		ret = wpas_ctrl_set_relative_rssi(wpa_s, value);
747 	} else if (os_strcasecmp(cmd, "relative_band_adjust") == 0) {
748 		ret = wpas_ctrl_set_relative_band_adjust(wpa_s, value);
749 	} else if (os_strcasecmp(cmd, "ric_ies") == 0) {
750 		ret = wpas_ctrl_iface_set_ric_ies(wpa_s, value);
751 	} else if (os_strcasecmp(cmd, "roaming") == 0) {
752 		ret = wpa_drv_roaming(wpa_s, atoi(value), NULL);
753 #ifdef CONFIG_WNM
754 	} else if (os_strcasecmp(cmd, "coloc_intf_elems") == 0) {
755 		struct wpabuf *elems;
756 
757 		elems = wpabuf_parse_bin(value);
758 		if (!elems)
759 			return -1;
760 		wnm_set_coloc_intf_elems(wpa_s, elems);
761 #endif /* CONFIG_WNM */
762 	} else {
763 		value[-1] = '=';
764 		ret = wpa_config_process_global(wpa_s->conf, cmd, -1);
765 		if (ret == 0)
766 			wpa_supplicant_update_config(wpa_s);
767 	}
768 
769 	return ret;
770 }
771 
772 
773 static int wpa_supplicant_ctrl_iface_get(struct wpa_supplicant *wpa_s,
774 					 char *cmd, char *buf, size_t buflen)
775 {
776 	int res = -1;
777 
778 	wpa_printf(MSG_DEBUG, "CTRL_IFACE GET '%s'", cmd);
779 
780 	if (os_strcmp(cmd, "version") == 0) {
781 		res = os_snprintf(buf, buflen, "%s", VERSION_STR);
782 	} else if (os_strcasecmp(cmd, "country") == 0) {
783 		if (wpa_s->conf->country[0] && wpa_s->conf->country[1])
784 			res = os_snprintf(buf, buflen, "%c%c",
785 					  wpa_s->conf->country[0],
786 					  wpa_s->conf->country[1]);
787 #ifdef CONFIG_WIFI_DISPLAY
788 	} else if (os_strcasecmp(cmd, "wifi_display") == 0) {
789 		int enabled;
790 		if (wpa_s->global->p2p == NULL ||
791 		    wpa_s->global->p2p_disabled)
792 			enabled = 0;
793 		else
794 			enabled = wpa_s->global->wifi_display;
795 		res = os_snprintf(buf, buflen, "%d", enabled);
796 #endif /* CONFIG_WIFI_DISPLAY */
797 #ifdef CONFIG_TESTING_GET_GTK
798 	} else if (os_strcmp(cmd, "gtk") == 0) {
799 		if (wpa_s->last_gtk_len == 0)
800 			return -1;
801 		res = wpa_snprintf_hex(buf, buflen, wpa_s->last_gtk,
802 				       wpa_s->last_gtk_len);
803 		return res;
804 #endif /* CONFIG_TESTING_GET_GTK */
805 	} else if (os_strcmp(cmd, "tls_library") == 0) {
806 		res = tls_get_library_version(buf, buflen);
807 #ifdef CONFIG_TESTING_OPTIONS
808 	} else if (os_strcmp(cmd, "anonce") == 0) {
809 		return wpa_snprintf_hex(buf, buflen,
810 					wpa_sm_get_anonce(wpa_s->wpa),
811 					WPA_NONCE_LEN);
812 #endif /* CONFIG_TESTING_OPTIONS */
813 	} else {
814 		res = wpa_config_get_value(cmd, wpa_s->conf, buf, buflen);
815 	}
816 
817 	if (os_snprintf_error(buflen, res))
818 		return -1;
819 	return res;
820 }
821 
822 
823 #ifdef IEEE8021X_EAPOL
824 static int wpa_supplicant_ctrl_iface_preauth(struct wpa_supplicant *wpa_s,
825 					     char *addr)
826 {
827 	u8 bssid[ETH_ALEN];
828 	struct wpa_ssid *ssid = wpa_s->current_ssid;
829 
830 	if (hwaddr_aton(addr, bssid)) {
831 		wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH: invalid address "
832 			   "'%s'", addr);
833 		return -1;
834 	}
835 
836 	wpa_printf(MSG_DEBUG, "CTRL_IFACE PREAUTH " MACSTR, MAC2STR(bssid));
837 	rsn_preauth_deinit(wpa_s->wpa);
838 	if (rsn_preauth_init(wpa_s->wpa, bssid, ssid ? &ssid->eap : NULL))
839 		return -1;
840 
841 	return 0;
842 }
843 #endif /* IEEE8021X_EAPOL */
844 
845 
846 #ifdef CONFIG_TDLS
847 
848 static int wpa_supplicant_ctrl_iface_tdls_discover(
849 	struct wpa_supplicant *wpa_s, char *addr)
850 {
851 	u8 peer[ETH_ALEN];
852 	int ret;
853 
854 	if (hwaddr_aton(addr, peer)) {
855 		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER: invalid "
856 			   "address '%s'", addr);
857 		return -1;
858 	}
859 
860 	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_DISCOVER " MACSTR,
861 		   MAC2STR(peer));
862 
863 	if (wpa_tdls_is_external_setup(wpa_s->wpa))
864 		ret = wpa_tdls_send_discovery_request(wpa_s->wpa, peer);
865 	else
866 		ret = wpa_drv_tdls_oper(wpa_s, TDLS_DISCOVERY_REQ, peer);
867 
868 	return ret;
869 }
870 
871 
872 static int wpa_supplicant_ctrl_iface_tdls_setup(
873 	struct wpa_supplicant *wpa_s, char *addr)
874 {
875 	u8 peer[ETH_ALEN];
876 	int ret;
877 
878 	if (hwaddr_aton(addr, peer)) {
879 		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP: invalid "
880 			   "address '%s'", addr);
881 		return -1;
882 	}
883 
884 	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_SETUP " MACSTR,
885 		   MAC2STR(peer));
886 
887 	if ((wpa_s->conf->tdls_external_control) &&
888 	    wpa_tdls_is_external_setup(wpa_s->wpa))
889 		return wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
890 
891 	wpa_tdls_remove(wpa_s->wpa, peer);
892 
893 	if (wpa_tdls_is_external_setup(wpa_s->wpa))
894 		ret = wpa_tdls_start(wpa_s->wpa, peer);
895 	else
896 		ret = wpa_drv_tdls_oper(wpa_s, TDLS_SETUP, peer);
897 
898 	return ret;
899 }
900 
901 
902 static int wpa_supplicant_ctrl_iface_tdls_teardown(
903 	struct wpa_supplicant *wpa_s, char *addr)
904 {
905 	u8 peer[ETH_ALEN];
906 	int ret;
907 
908 	if (os_strcmp(addr, "*") == 0) {
909 		/* remove everyone */
910 		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN *");
911 		wpa_tdls_teardown_peers(wpa_s->wpa);
912 		return 0;
913 	}
914 
915 	if (hwaddr_aton(addr, peer)) {
916 		wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN: invalid "
917 			   "address '%s'", addr);
918 		return -1;
919 	}
920 
921 	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_TEARDOWN " MACSTR,
922 		   MAC2STR(peer));
923 
924 	if ((wpa_s->conf->tdls_external_control) &&
925 	    wpa_tdls_is_external_setup(wpa_s->wpa))
926 		return wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
927 
928 	if (wpa_tdls_is_external_setup(wpa_s->wpa))
929 		ret = wpa_tdls_teardown_link(
930 			wpa_s->wpa, peer,
931 			WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
932 	else
933 		ret = wpa_drv_tdls_oper(wpa_s, TDLS_TEARDOWN, peer);
934 
935 	return ret;
936 }
937 
938 
939 static int ctrl_iface_get_capability_tdls(
940 	struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
941 {
942 	int ret;
943 
944 	ret = os_snprintf(buf, buflen, "%s\n",
945 			  wpa_s->drv_flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT ?
946 			  (wpa_s->drv_flags &
947 			   WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP ?
948 			   "EXTERNAL" : "INTERNAL") : "UNSUPPORTED");
949 	if (os_snprintf_error(buflen, ret))
950 		return -1;
951 	return ret;
952 }
953 
954 
955 static int wpa_supplicant_ctrl_iface_tdls_chan_switch(
956 	struct wpa_supplicant *wpa_s, char *cmd)
957 {
958 	u8 peer[ETH_ALEN];
959 	struct hostapd_freq_params freq_params;
960 	u8 oper_class;
961 	char *pos, *end;
962 
963 	if (!wpa_tdls_is_external_setup(wpa_s->wpa)) {
964 		wpa_printf(MSG_INFO,
965 			   "tdls_chanswitch: Only supported with external setup");
966 		return -1;
967 	}
968 
969 	os_memset(&freq_params, 0, sizeof(freq_params));
970 
971 	pos = os_strchr(cmd, ' ');
972 	if (pos == NULL)
973 		return -1;
974 	*pos++ = '\0';
975 
976 	oper_class = strtol(pos, &end, 10);
977 	if (pos == end) {
978 		wpa_printf(MSG_INFO,
979 			   "tdls_chanswitch: Invalid op class provided");
980 		return -1;
981 	}
982 
983 	pos = end;
984 	freq_params.freq = atoi(pos);
985 	if (freq_params.freq == 0) {
986 		wpa_printf(MSG_INFO, "tdls_chanswitch: Invalid freq provided");
987 		return -1;
988 	}
989 
990 #define SET_FREQ_SETTING(str) \
991 	do { \
992 		const char *pos2 = os_strstr(pos, " " #str "="); \
993 		if (pos2) { \
994 			pos2 += sizeof(" " #str "=") - 1; \
995 			freq_params.str = atoi(pos2); \
996 		} \
997 	} while (0)
998 
999 	SET_FREQ_SETTING(center_freq1);
1000 	SET_FREQ_SETTING(center_freq2);
1001 	SET_FREQ_SETTING(bandwidth);
1002 	SET_FREQ_SETTING(sec_channel_offset);
1003 #undef SET_FREQ_SETTING
1004 
1005 	freq_params.ht_enabled = !!os_strstr(pos, " ht");
1006 	freq_params.vht_enabled = !!os_strstr(pos, " vht");
1007 
1008 	if (hwaddr_aton(cmd, peer)) {
1009 		wpa_printf(MSG_DEBUG,
1010 			   "CTRL_IFACE TDLS_CHAN_SWITCH: Invalid address '%s'",
1011 			   cmd);
1012 		return -1;
1013 	}
1014 
1015 	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_CHAN_SWITCH " MACSTR
1016 		   " OP CLASS %d FREQ %d CENTER1 %d CENTER2 %d BW %d SEC_OFFSET %d%s%s",
1017 		   MAC2STR(peer), oper_class, freq_params.freq,
1018 		   freq_params.center_freq1, freq_params.center_freq2,
1019 		   freq_params.bandwidth, freq_params.sec_channel_offset,
1020 		   freq_params.ht_enabled ? " HT" : "",
1021 		   freq_params.vht_enabled ? " VHT" : "");
1022 
1023 	return wpa_tdls_enable_chan_switch(wpa_s->wpa, peer, oper_class,
1024 					   &freq_params);
1025 }
1026 
1027 
1028 static int wpa_supplicant_ctrl_iface_tdls_cancel_chan_switch(
1029 	struct wpa_supplicant *wpa_s, char *cmd)
1030 {
1031 	u8 peer[ETH_ALEN];
1032 
1033 	if (!wpa_tdls_is_external_setup(wpa_s->wpa)) {
1034 		wpa_printf(MSG_INFO,
1035 			   "tdls_chanswitch: Only supported with external setup");
1036 		return -1;
1037 	}
1038 
1039 	if (hwaddr_aton(cmd, peer)) {
1040 		wpa_printf(MSG_DEBUG,
1041 			   "CTRL_IFACE TDLS_CANCEL_CHAN_SWITCH: Invalid address '%s'",
1042 			   cmd);
1043 		return -1;
1044 	}
1045 
1046 	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_CANCEL_CHAN_SWITCH " MACSTR,
1047 		   MAC2STR(peer));
1048 
1049 	return wpa_tdls_disable_chan_switch(wpa_s->wpa, peer);
1050 }
1051 
1052 
1053 static int wpa_supplicant_ctrl_iface_tdls_link_status(
1054 	struct wpa_supplicant *wpa_s, const char *addr,
1055 	char *buf, size_t buflen)
1056 {
1057 	u8 peer[ETH_ALEN];
1058 	const char *tdls_status;
1059 	int ret;
1060 
1061 	if (hwaddr_aton(addr, peer)) {
1062 		wpa_printf(MSG_DEBUG,
1063 			   "CTRL_IFACE TDLS_LINK_STATUS: Invalid address '%s'",
1064 			   addr);
1065 		return -1;
1066 	}
1067 	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_LINK_STATUS " MACSTR,
1068 		   MAC2STR(peer));
1069 
1070 	tdls_status = wpa_tdls_get_link_status(wpa_s->wpa, peer);
1071 	wpa_printf(MSG_DEBUG, "CTRL_IFACE TDLS_LINK_STATUS: %s", tdls_status);
1072 	ret = os_snprintf(buf, buflen, "TDLS link status: %s\n", tdls_status);
1073 	if (os_snprintf_error(buflen, ret))
1074 		return -1;
1075 
1076 	return ret;
1077 }
1078 
1079 #endif /* CONFIG_TDLS */
1080 
1081 
1082 static int wmm_ac_ctrl_addts(struct wpa_supplicant *wpa_s, char *cmd)
1083 {
1084 	char *token, *context = NULL;
1085 	struct wmm_ac_ts_setup_params params = {
1086 		.tsid = 0xff,
1087 		.direction = 0xff,
1088 	};
1089 
1090 	while ((token = str_token(cmd, " ", &context))) {
1091 		if (sscanf(token, "tsid=%i", &params.tsid) == 1 ||
1092 		    sscanf(token, "up=%i", &params.user_priority) == 1 ||
1093 		    sscanf(token, "nominal_msdu_size=%i",
1094 			   &params.nominal_msdu_size) == 1 ||
1095 		    sscanf(token, "mean_data_rate=%i",
1096 			   &params.mean_data_rate) == 1 ||
1097 		    sscanf(token, "min_phy_rate=%i",
1098 			   &params.minimum_phy_rate) == 1 ||
1099 		    sscanf(token, "sba=%i",
1100 			   &params.surplus_bandwidth_allowance) == 1)
1101 			continue;
1102 
1103 		if (os_strcasecmp(token, "downlink") == 0) {
1104 			params.direction = WMM_TSPEC_DIRECTION_DOWNLINK;
1105 		} else if (os_strcasecmp(token, "uplink") == 0) {
1106 			params.direction = WMM_TSPEC_DIRECTION_UPLINK;
1107 		} else if (os_strcasecmp(token, "bidi") == 0) {
1108 			params.direction = WMM_TSPEC_DIRECTION_BI_DIRECTIONAL;
1109 		} else if (os_strcasecmp(token, "fixed_nominal_msdu") == 0) {
1110 			params.fixed_nominal_msdu = 1;
1111 		} else {
1112 			wpa_printf(MSG_DEBUG,
1113 				   "CTRL: Invalid WMM_AC_ADDTS parameter: '%s'",
1114 				   token);
1115 			return -1;
1116 		}
1117 
1118 	}
1119 
1120 	return wpas_wmm_ac_addts(wpa_s, &params);
1121 }
1122 
1123 
1124 static int wmm_ac_ctrl_delts(struct wpa_supplicant *wpa_s, char *cmd)
1125 {
1126 	u8 tsid = atoi(cmd);
1127 
1128 	return wpas_wmm_ac_delts(wpa_s, tsid);
1129 }
1130 
1131 
1132 #ifdef CONFIG_IEEE80211R
1133 static int wpa_supplicant_ctrl_iface_ft_ds(
1134 	struct wpa_supplicant *wpa_s, char *addr)
1135 {
1136 	u8 target_ap[ETH_ALEN];
1137 	struct wpa_bss *bss;
1138 	const u8 *mdie;
1139 
1140 	if (hwaddr_aton(addr, target_ap)) {
1141 		wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS: invalid "
1142 			   "address '%s'", addr);
1143 		return -1;
1144 	}
1145 
1146 	wpa_printf(MSG_DEBUG, "CTRL_IFACE FT_DS " MACSTR, MAC2STR(target_ap));
1147 
1148 	bss = wpa_bss_get_bssid(wpa_s, target_ap);
1149 	if (bss)
1150 		mdie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1151 	else
1152 		mdie = NULL;
1153 
1154 	return wpa_ft_start_over_ds(wpa_s->wpa, target_ap, mdie);
1155 }
1156 #endif /* CONFIG_IEEE80211R */
1157 
1158 
1159 #ifdef CONFIG_WPS
1160 static int wpa_supplicant_ctrl_iface_wps_pbc(struct wpa_supplicant *wpa_s,
1161 					     char *cmd)
1162 {
1163 	u8 bssid[ETH_ALEN], *_bssid = bssid;
1164 #ifdef CONFIG_P2P
1165 	u8 p2p_dev_addr[ETH_ALEN];
1166 #endif /* CONFIG_P2P */
1167 #ifdef CONFIG_AP
1168 	u8 *_p2p_dev_addr = NULL;
1169 #endif /* CONFIG_AP */
1170 
1171 	if (cmd == NULL || os_strcmp(cmd, "any") == 0) {
1172 		_bssid = NULL;
1173 #ifdef CONFIG_P2P
1174 	} else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
1175 		if (hwaddr_aton(cmd + 13, p2p_dev_addr)) {
1176 			wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid "
1177 				   "P2P Device Address '%s'",
1178 				   cmd + 13);
1179 			return -1;
1180 		}
1181 		_p2p_dev_addr = p2p_dev_addr;
1182 #endif /* CONFIG_P2P */
1183 	} else if (hwaddr_aton(cmd, bssid)) {
1184 		wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid BSSID '%s'",
1185 			   cmd);
1186 		return -1;
1187 	}
1188 
1189 #ifdef CONFIG_AP
1190 	if (wpa_s->ap_iface)
1191 		return wpa_supplicant_ap_wps_pbc(wpa_s, _bssid, _p2p_dev_addr);
1192 #endif /* CONFIG_AP */
1193 
1194 	return wpas_wps_start_pbc(wpa_s, _bssid, 0);
1195 }
1196 
1197 
1198 static int wpa_supplicant_ctrl_iface_wps_pin(struct wpa_supplicant *wpa_s,
1199 					     char *cmd, char *buf,
1200 					     size_t buflen)
1201 {
1202 	u8 bssid[ETH_ALEN], *_bssid = bssid;
1203 	char *pin;
1204 	int ret;
1205 
1206 	pin = os_strchr(cmd, ' ');
1207 	if (pin)
1208 		*pin++ = '\0';
1209 
1210 	if (os_strcmp(cmd, "any") == 0)
1211 		_bssid = NULL;
1212 	else if (os_strcmp(cmd, "get") == 0) {
1213 		if (wps_generate_pin((unsigned int *) &ret) < 0)
1214 			return -1;
1215 		goto done;
1216 	} else if (hwaddr_aton(cmd, bssid)) {
1217 		wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PIN: invalid BSSID '%s'",
1218 			   cmd);
1219 		return -1;
1220 	}
1221 
1222 #ifdef CONFIG_AP
1223 	if (wpa_s->ap_iface) {
1224 		int timeout = 0;
1225 		char *pos;
1226 
1227 		if (pin) {
1228 			pos = os_strchr(pin, ' ');
1229 			if (pos) {
1230 				*pos++ = '\0';
1231 				timeout = atoi(pos);
1232 			}
1233 		}
1234 
1235 		return wpa_supplicant_ap_wps_pin(wpa_s, _bssid, pin,
1236 						 buf, buflen, timeout);
1237 	}
1238 #endif /* CONFIG_AP */
1239 
1240 	if (pin) {
1241 		ret = wpas_wps_start_pin(wpa_s, _bssid, pin, 0,
1242 					 DEV_PW_DEFAULT);
1243 		if (ret < 0)
1244 			return -1;
1245 		ret = os_snprintf(buf, buflen, "%s", pin);
1246 		if (os_snprintf_error(buflen, ret))
1247 			return -1;
1248 		return ret;
1249 	}
1250 
1251 	ret = wpas_wps_start_pin(wpa_s, _bssid, NULL, 0, DEV_PW_DEFAULT);
1252 	if (ret < 0)
1253 		return -1;
1254 
1255 done:
1256 	/* Return the generated PIN */
1257 	ret = os_snprintf(buf, buflen, "%08d", ret);
1258 	if (os_snprintf_error(buflen, ret))
1259 		return -1;
1260 	return ret;
1261 }
1262 
1263 
1264 static int wpa_supplicant_ctrl_iface_wps_check_pin(
1265 	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
1266 {
1267 	char pin[9];
1268 	size_t len;
1269 	char *pos;
1270 	int ret;
1271 
1272 	wpa_hexdump_ascii_key(MSG_DEBUG, "WPS_CHECK_PIN",
1273 			      (u8 *) cmd, os_strlen(cmd));
1274 	for (pos = cmd, len = 0; *pos != '\0'; pos++) {
1275 		if (*pos < '0' || *pos > '9')
1276 			continue;
1277 		pin[len++] = *pos;
1278 		if (len == 9) {
1279 			wpa_printf(MSG_DEBUG, "WPS: Too long PIN");
1280 			return -1;
1281 		}
1282 	}
1283 	if (len != 4 && len != 8) {
1284 		wpa_printf(MSG_DEBUG, "WPS: Invalid PIN length %d", (int) len);
1285 		return -1;
1286 	}
1287 	pin[len] = '\0';
1288 
1289 	if (len == 8) {
1290 		unsigned int pin_val;
1291 		pin_val = atoi(pin);
1292 		if (!wps_pin_valid(pin_val)) {
1293 			wpa_printf(MSG_DEBUG, "WPS: Invalid checksum digit");
1294 			ret = os_snprintf(buf, buflen, "FAIL-CHECKSUM\n");
1295 			if (os_snprintf_error(buflen, ret))
1296 				return -1;
1297 			return ret;
1298 		}
1299 	}
1300 
1301 	ret = os_snprintf(buf, buflen, "%s", pin);
1302 	if (os_snprintf_error(buflen, ret))
1303 		return -1;
1304 
1305 	return ret;
1306 }
1307 
1308 
1309 #ifdef CONFIG_WPS_NFC
1310 
1311 static int wpa_supplicant_ctrl_iface_wps_nfc(struct wpa_supplicant *wpa_s,
1312 					     char *cmd)
1313 {
1314 	u8 bssid[ETH_ALEN], *_bssid = bssid;
1315 
1316 	if (cmd == NULL || cmd[0] == '\0')
1317 		_bssid = NULL;
1318 	else if (hwaddr_aton(cmd, bssid))
1319 		return -1;
1320 
1321 	return wpas_wps_start_nfc(wpa_s, NULL, _bssid, NULL, 0, 0, NULL, NULL,
1322 				  0, 0);
1323 }
1324 
1325 
1326 static int wpa_supplicant_ctrl_iface_wps_nfc_config_token(
1327 	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1328 {
1329 	int ndef;
1330 	struct wpabuf *buf;
1331 	int res;
1332 	char *pos;
1333 
1334 	pos = os_strchr(cmd, ' ');
1335 	if (pos)
1336 		*pos++ = '\0';
1337 	if (os_strcmp(cmd, "WPS") == 0)
1338 		ndef = 0;
1339 	else if (os_strcmp(cmd, "NDEF") == 0)
1340 		ndef = 1;
1341 	else
1342 		return -1;
1343 
1344 	buf = wpas_wps_nfc_config_token(wpa_s, ndef, pos);
1345 	if (buf == NULL)
1346 		return -1;
1347 
1348 	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1349 					 wpabuf_len(buf));
1350 	reply[res++] = '\n';
1351 	reply[res] = '\0';
1352 
1353 	wpabuf_free(buf);
1354 
1355 	return res;
1356 }
1357 
1358 
1359 static int wpa_supplicant_ctrl_iface_wps_nfc_token(
1360 	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1361 {
1362 	int ndef;
1363 	struct wpabuf *buf;
1364 	int res;
1365 
1366 	if (os_strcmp(cmd, "WPS") == 0)
1367 		ndef = 0;
1368 	else if (os_strcmp(cmd, "NDEF") == 0)
1369 		ndef = 1;
1370 	else
1371 		return -1;
1372 
1373 	buf = wpas_wps_nfc_token(wpa_s, ndef);
1374 	if (buf == NULL)
1375 		return -1;
1376 
1377 	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1378 					 wpabuf_len(buf));
1379 	reply[res++] = '\n';
1380 	reply[res] = '\0';
1381 
1382 	wpabuf_free(buf);
1383 
1384 	return res;
1385 }
1386 
1387 
1388 static int wpa_supplicant_ctrl_iface_wps_nfc_tag_read(
1389 	struct wpa_supplicant *wpa_s, char *pos)
1390 {
1391 	size_t len;
1392 	struct wpabuf *buf;
1393 	int ret;
1394 	char *freq;
1395 	int forced_freq = 0;
1396 
1397 	freq = strstr(pos, " freq=");
1398 	if (freq) {
1399 		*freq = '\0';
1400 		freq += 6;
1401 		forced_freq = atoi(freq);
1402 	}
1403 
1404 	len = os_strlen(pos);
1405 	if (len & 0x01)
1406 		return -1;
1407 	len /= 2;
1408 
1409 	buf = wpabuf_alloc(len);
1410 	if (buf == NULL)
1411 		return -1;
1412 	if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
1413 		wpabuf_free(buf);
1414 		return -1;
1415 	}
1416 
1417 	ret = wpas_wps_nfc_tag_read(wpa_s, buf, forced_freq);
1418 	wpabuf_free(buf);
1419 
1420 	return ret;
1421 }
1422 
1423 
1424 static int wpas_ctrl_nfc_get_handover_req_wps(struct wpa_supplicant *wpa_s,
1425 					      char *reply, size_t max_len,
1426 					      int ndef)
1427 {
1428 	struct wpabuf *buf;
1429 	int res;
1430 
1431 	buf = wpas_wps_nfc_handover_req(wpa_s, ndef);
1432 	if (buf == NULL)
1433 		return -1;
1434 
1435 	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1436 					 wpabuf_len(buf));
1437 	reply[res++] = '\n';
1438 	reply[res] = '\0';
1439 
1440 	wpabuf_free(buf);
1441 
1442 	return res;
1443 }
1444 
1445 
1446 #ifdef CONFIG_P2P
1447 static int wpas_ctrl_nfc_get_handover_req_p2p(struct wpa_supplicant *wpa_s,
1448 					      char *reply, size_t max_len,
1449 					      int ndef)
1450 {
1451 	struct wpabuf *buf;
1452 	int res;
1453 
1454 	buf = wpas_p2p_nfc_handover_req(wpa_s, ndef);
1455 	if (buf == NULL) {
1456 		wpa_printf(MSG_DEBUG, "P2P: Could not generate NFC handover request");
1457 		return -1;
1458 	}
1459 
1460 	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1461 					 wpabuf_len(buf));
1462 	reply[res++] = '\n';
1463 	reply[res] = '\0';
1464 
1465 	wpabuf_free(buf);
1466 
1467 	return res;
1468 }
1469 #endif /* CONFIG_P2P */
1470 
1471 
1472 static int wpas_ctrl_nfc_get_handover_req(struct wpa_supplicant *wpa_s,
1473 					  char *cmd, char *reply,
1474 					  size_t max_len)
1475 {
1476 	char *pos;
1477 	int ndef;
1478 
1479 	pos = os_strchr(cmd, ' ');
1480 	if (pos == NULL)
1481 		return -1;
1482 	*pos++ = '\0';
1483 
1484 	if (os_strcmp(cmd, "WPS") == 0)
1485 		ndef = 0;
1486 	else if (os_strcmp(cmd, "NDEF") == 0)
1487 		ndef = 1;
1488 	else
1489 		return -1;
1490 
1491 	if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1492 		if (!ndef)
1493 			return -1;
1494 		return wpas_ctrl_nfc_get_handover_req_wps(
1495 			wpa_s, reply, max_len, ndef);
1496 	}
1497 
1498 #ifdef CONFIG_P2P
1499 	if (os_strcmp(pos, "P2P-CR") == 0) {
1500 		return wpas_ctrl_nfc_get_handover_req_p2p(
1501 			wpa_s, reply, max_len, ndef);
1502 	}
1503 #endif /* CONFIG_P2P */
1504 
1505 	return -1;
1506 }
1507 
1508 
1509 static int wpas_ctrl_nfc_get_handover_sel_wps(struct wpa_supplicant *wpa_s,
1510 					      char *reply, size_t max_len,
1511 					      int ndef, int cr, char *uuid)
1512 {
1513 	struct wpabuf *buf;
1514 	int res;
1515 
1516 	buf = wpas_wps_nfc_handover_sel(wpa_s, ndef, cr, uuid);
1517 	if (buf == NULL)
1518 		return -1;
1519 
1520 	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1521 					 wpabuf_len(buf));
1522 	reply[res++] = '\n';
1523 	reply[res] = '\0';
1524 
1525 	wpabuf_free(buf);
1526 
1527 	return res;
1528 }
1529 
1530 
1531 #ifdef CONFIG_P2P
1532 static int wpas_ctrl_nfc_get_handover_sel_p2p(struct wpa_supplicant *wpa_s,
1533 					      char *reply, size_t max_len,
1534 					      int ndef, int tag)
1535 {
1536 	struct wpabuf *buf;
1537 	int res;
1538 
1539 	buf = wpas_p2p_nfc_handover_sel(wpa_s, ndef, tag);
1540 	if (buf == NULL)
1541 		return -1;
1542 
1543 	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1544 					 wpabuf_len(buf));
1545 	reply[res++] = '\n';
1546 	reply[res] = '\0';
1547 
1548 	wpabuf_free(buf);
1549 
1550 	return res;
1551 }
1552 #endif /* CONFIG_P2P */
1553 
1554 
1555 static int wpas_ctrl_nfc_get_handover_sel(struct wpa_supplicant *wpa_s,
1556 					  char *cmd, char *reply,
1557 					  size_t max_len)
1558 {
1559 	char *pos, *pos2;
1560 	int ndef;
1561 
1562 	pos = os_strchr(cmd, ' ');
1563 	if (pos == NULL)
1564 		return -1;
1565 	*pos++ = '\0';
1566 
1567 	if (os_strcmp(cmd, "WPS") == 0)
1568 		ndef = 0;
1569 	else if (os_strcmp(cmd, "NDEF") == 0)
1570 		ndef = 1;
1571 	else
1572 		return -1;
1573 
1574 	pos2 = os_strchr(pos, ' ');
1575 	if (pos2)
1576 		*pos2++ = '\0';
1577 	if (os_strcmp(pos, "WPS") == 0 || os_strcmp(pos, "WPS-CR") == 0) {
1578 		if (!ndef)
1579 			return -1;
1580 		return wpas_ctrl_nfc_get_handover_sel_wps(
1581 			wpa_s, reply, max_len, ndef,
1582 			os_strcmp(pos, "WPS-CR") == 0, pos2);
1583 	}
1584 
1585 #ifdef CONFIG_P2P
1586 	if (os_strcmp(pos, "P2P-CR") == 0) {
1587 		return wpas_ctrl_nfc_get_handover_sel_p2p(
1588 			wpa_s, reply, max_len, ndef, 0);
1589 	}
1590 
1591 	if (os_strcmp(pos, "P2P-CR-TAG") == 0) {
1592 		return wpas_ctrl_nfc_get_handover_sel_p2p(
1593 			wpa_s, reply, max_len, ndef, 1);
1594 	}
1595 #endif /* CONFIG_P2P */
1596 
1597 	return -1;
1598 }
1599 
1600 
1601 static int wpas_ctrl_nfc_report_handover(struct wpa_supplicant *wpa_s,
1602 					 char *cmd)
1603 {
1604 	size_t len;
1605 	struct wpabuf *req, *sel;
1606 	int ret;
1607 	char *pos, *role, *type, *pos2;
1608 #ifdef CONFIG_P2P
1609 	char *freq;
1610 	int forced_freq = 0;
1611 
1612 	freq = strstr(cmd, " freq=");
1613 	if (freq) {
1614 		*freq = '\0';
1615 		freq += 6;
1616 		forced_freq = atoi(freq);
1617 	}
1618 #endif /* CONFIG_P2P */
1619 
1620 	role = cmd;
1621 	pos = os_strchr(role, ' ');
1622 	if (pos == NULL) {
1623 		wpa_printf(MSG_DEBUG, "NFC: Missing type in handover report");
1624 		return -1;
1625 	}
1626 	*pos++ = '\0';
1627 
1628 	type = pos;
1629 	pos = os_strchr(type, ' ');
1630 	if (pos == NULL) {
1631 		wpa_printf(MSG_DEBUG, "NFC: Missing request message in handover report");
1632 		return -1;
1633 	}
1634 	*pos++ = '\0';
1635 
1636 	pos2 = os_strchr(pos, ' ');
1637 	if (pos2 == NULL) {
1638 		wpa_printf(MSG_DEBUG, "NFC: Missing select message in handover report");
1639 		return -1;
1640 	}
1641 	*pos2++ = '\0';
1642 
1643 	len = os_strlen(pos);
1644 	if (len & 0x01) {
1645 		wpa_printf(MSG_DEBUG, "NFC: Invalid request message length in handover report");
1646 		return -1;
1647 	}
1648 	len /= 2;
1649 
1650 	req = wpabuf_alloc(len);
1651 	if (req == NULL) {
1652 		wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for request message");
1653 		return -1;
1654 	}
1655 	if (hexstr2bin(pos, wpabuf_put(req, len), len) < 0) {
1656 		wpa_printf(MSG_DEBUG, "NFC: Invalid request message hexdump in handover report");
1657 		wpabuf_free(req);
1658 		return -1;
1659 	}
1660 
1661 	len = os_strlen(pos2);
1662 	if (len & 0x01) {
1663 		wpa_printf(MSG_DEBUG, "NFC: Invalid select message length in handover report");
1664 		wpabuf_free(req);
1665 		return -1;
1666 	}
1667 	len /= 2;
1668 
1669 	sel = wpabuf_alloc(len);
1670 	if (sel == NULL) {
1671 		wpa_printf(MSG_DEBUG, "NFC: Failed to allocate memory for select message");
1672 		wpabuf_free(req);
1673 		return -1;
1674 	}
1675 	if (hexstr2bin(pos2, wpabuf_put(sel, len), len) < 0) {
1676 		wpa_printf(MSG_DEBUG, "NFC: Invalid select message hexdump in handover report");
1677 		wpabuf_free(req);
1678 		wpabuf_free(sel);
1679 		return -1;
1680 	}
1681 
1682 	wpa_printf(MSG_DEBUG, "NFC: Connection handover reported - role=%s type=%s req_len=%d sel_len=%d",
1683 		   role, type, (int) wpabuf_len(req), (int) wpabuf_len(sel));
1684 
1685 	if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "WPS") == 0) {
1686 		ret = wpas_wps_nfc_report_handover(wpa_s, req, sel);
1687 #ifdef CONFIG_AP
1688 	} else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "WPS") == 0)
1689 	{
1690 		ret = wpas_ap_wps_nfc_report_handover(wpa_s, req, sel);
1691 		if (ret < 0)
1692 			ret = wpas_er_wps_nfc_report_handover(wpa_s, req, sel);
1693 #endif /* CONFIG_AP */
1694 #ifdef CONFIG_P2P
1695 	} else if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "P2P") == 0)
1696 	{
1697 		ret = wpas_p2p_nfc_report_handover(wpa_s, 1, req, sel, 0);
1698 	} else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "P2P") == 0)
1699 	{
1700 		ret = wpas_p2p_nfc_report_handover(wpa_s, 0, req, sel,
1701 						   forced_freq);
1702 #endif /* CONFIG_P2P */
1703 	} else {
1704 		wpa_printf(MSG_DEBUG, "NFC: Unsupported connection handover "
1705 			   "reported: role=%s type=%s", role, type);
1706 		ret = -1;
1707 	}
1708 	wpabuf_free(req);
1709 	wpabuf_free(sel);
1710 
1711 	if (ret)
1712 		wpa_printf(MSG_DEBUG, "NFC: Failed to process reported handover messages");
1713 
1714 	return ret;
1715 }
1716 
1717 #endif /* CONFIG_WPS_NFC */
1718 
1719 
1720 static int wpa_supplicant_ctrl_iface_wps_reg(struct wpa_supplicant *wpa_s,
1721 					     char *cmd)
1722 {
1723 	u8 bssid[ETH_ALEN];
1724 	char *pin;
1725 	char *new_ssid;
1726 	char *new_auth;
1727 	char *new_encr;
1728 	char *new_key;
1729 	struct wps_new_ap_settings ap;
1730 
1731 	pin = os_strchr(cmd, ' ');
1732 	if (pin == NULL)
1733 		return -1;
1734 	*pin++ = '\0';
1735 
1736 	if (hwaddr_aton(cmd, bssid)) {
1737 		wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_REG: invalid BSSID '%s'",
1738 			   cmd);
1739 		return -1;
1740 	}
1741 
1742 	new_ssid = os_strchr(pin, ' ');
1743 	if (new_ssid == NULL)
1744 		return wpas_wps_start_reg(wpa_s, bssid, pin, NULL);
1745 	*new_ssid++ = '\0';
1746 
1747 	new_auth = os_strchr(new_ssid, ' ');
1748 	if (new_auth == NULL)
1749 		return -1;
1750 	*new_auth++ = '\0';
1751 
1752 	new_encr = os_strchr(new_auth, ' ');
1753 	if (new_encr == NULL)
1754 		return -1;
1755 	*new_encr++ = '\0';
1756 
1757 	new_key = os_strchr(new_encr, ' ');
1758 	if (new_key == NULL)
1759 		return -1;
1760 	*new_key++ = '\0';
1761 
1762 	os_memset(&ap, 0, sizeof(ap));
1763 	ap.ssid_hex = new_ssid;
1764 	ap.auth = new_auth;
1765 	ap.encr = new_encr;
1766 	ap.key_hex = new_key;
1767 	return wpas_wps_start_reg(wpa_s, bssid, pin, &ap);
1768 }
1769 
1770 
1771 #ifdef CONFIG_AP
1772 static int wpa_supplicant_ctrl_iface_wps_ap_pin(struct wpa_supplicant *wpa_s,
1773 						char *cmd, char *buf,
1774 						size_t buflen)
1775 {
1776 	int timeout = 300;
1777 	char *pos;
1778 	const char *pin_txt;
1779 
1780 	if (!wpa_s->ap_iface)
1781 		return -1;
1782 
1783 	pos = os_strchr(cmd, ' ');
1784 	if (pos)
1785 		*pos++ = '\0';
1786 
1787 	if (os_strcmp(cmd, "disable") == 0) {
1788 		wpas_wps_ap_pin_disable(wpa_s);
1789 		return os_snprintf(buf, buflen, "OK\n");
1790 	}
1791 
1792 	if (os_strcmp(cmd, "random") == 0) {
1793 		if (pos)
1794 			timeout = atoi(pos);
1795 		pin_txt = wpas_wps_ap_pin_random(wpa_s, timeout);
1796 		if (pin_txt == NULL)
1797 			return -1;
1798 		return os_snprintf(buf, buflen, "%s", pin_txt);
1799 	}
1800 
1801 	if (os_strcmp(cmd, "get") == 0) {
1802 		pin_txt = wpas_wps_ap_pin_get(wpa_s);
1803 		if (pin_txt == NULL)
1804 			return -1;
1805 		return os_snprintf(buf, buflen, "%s", pin_txt);
1806 	}
1807 
1808 	if (os_strcmp(cmd, "set") == 0) {
1809 		char *pin;
1810 		if (pos == NULL)
1811 			return -1;
1812 		pin = pos;
1813 		pos = os_strchr(pos, ' ');
1814 		if (pos) {
1815 			*pos++ = '\0';
1816 			timeout = atoi(pos);
1817 		}
1818 		if (os_strlen(pin) > buflen)
1819 			return -1;
1820 		if (wpas_wps_ap_pin_set(wpa_s, pin, timeout) < 0)
1821 			return -1;
1822 		return os_snprintf(buf, buflen, "%s", pin);
1823 	}
1824 
1825 	return -1;
1826 }
1827 #endif /* CONFIG_AP */
1828 
1829 
1830 #ifdef CONFIG_WPS_ER
1831 static int wpa_supplicant_ctrl_iface_wps_er_pin(struct wpa_supplicant *wpa_s,
1832 						char *cmd)
1833 {
1834 	char *uuid = cmd, *pin, *pos;
1835 	u8 addr_buf[ETH_ALEN], *addr = NULL;
1836 	pin = os_strchr(uuid, ' ');
1837 	if (pin == NULL)
1838 		return -1;
1839 	*pin++ = '\0';
1840 	pos = os_strchr(pin, ' ');
1841 	if (pos) {
1842 		*pos++ = '\0';
1843 		if (hwaddr_aton(pos, addr_buf) == 0)
1844 			addr = addr_buf;
1845 	}
1846 	return wpas_wps_er_add_pin(wpa_s, addr, uuid, pin);
1847 }
1848 
1849 
1850 static int wpa_supplicant_ctrl_iface_wps_er_learn(struct wpa_supplicant *wpa_s,
1851 						  char *cmd)
1852 {
1853 	char *uuid = cmd, *pin;
1854 	pin = os_strchr(uuid, ' ');
1855 	if (pin == NULL)
1856 		return -1;
1857 	*pin++ = '\0';
1858 	return wpas_wps_er_learn(wpa_s, uuid, pin);
1859 }
1860 
1861 
1862 static int wpa_supplicant_ctrl_iface_wps_er_set_config(
1863 	struct wpa_supplicant *wpa_s, char *cmd)
1864 {
1865 	char *uuid = cmd, *id;
1866 	id = os_strchr(uuid, ' ');
1867 	if (id == NULL)
1868 		return -1;
1869 	*id++ = '\0';
1870 	return wpas_wps_er_set_config(wpa_s, uuid, atoi(id));
1871 }
1872 
1873 
1874 static int wpa_supplicant_ctrl_iface_wps_er_config(
1875 	struct wpa_supplicant *wpa_s, char *cmd)
1876 {
1877 	char *pin;
1878 	char *new_ssid;
1879 	char *new_auth;
1880 	char *new_encr;
1881 	char *new_key;
1882 	struct wps_new_ap_settings ap;
1883 
1884 	pin = os_strchr(cmd, ' ');
1885 	if (pin == NULL)
1886 		return -1;
1887 	*pin++ = '\0';
1888 
1889 	new_ssid = os_strchr(pin, ' ');
1890 	if (new_ssid == NULL)
1891 		return -1;
1892 	*new_ssid++ = '\0';
1893 
1894 	new_auth = os_strchr(new_ssid, ' ');
1895 	if (new_auth == NULL)
1896 		return -1;
1897 	*new_auth++ = '\0';
1898 
1899 	new_encr = os_strchr(new_auth, ' ');
1900 	if (new_encr == NULL)
1901 		return -1;
1902 	*new_encr++ = '\0';
1903 
1904 	new_key = os_strchr(new_encr, ' ');
1905 	if (new_key == NULL)
1906 		return -1;
1907 	*new_key++ = '\0';
1908 
1909 	os_memset(&ap, 0, sizeof(ap));
1910 	ap.ssid_hex = new_ssid;
1911 	ap.auth = new_auth;
1912 	ap.encr = new_encr;
1913 	ap.key_hex = new_key;
1914 	return wpas_wps_er_config(wpa_s, cmd, pin, &ap);
1915 }
1916 
1917 
1918 #ifdef CONFIG_WPS_NFC
1919 static int wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
1920 	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
1921 {
1922 	int ndef;
1923 	struct wpabuf *buf;
1924 	int res;
1925 	char *uuid;
1926 
1927 	uuid = os_strchr(cmd, ' ');
1928 	if (uuid == NULL)
1929 		return -1;
1930 	*uuid++ = '\0';
1931 
1932 	if (os_strcmp(cmd, "WPS") == 0)
1933 		ndef = 0;
1934 	else if (os_strcmp(cmd, "NDEF") == 0)
1935 		ndef = 1;
1936 	else
1937 		return -1;
1938 
1939 	buf = wpas_wps_er_nfc_config_token(wpa_s, ndef, uuid);
1940 	if (buf == NULL)
1941 		return -1;
1942 
1943 	res = wpa_snprintf_hex_uppercase(reply, max_len, wpabuf_head(buf),
1944 					 wpabuf_len(buf));
1945 	reply[res++] = '\n';
1946 	reply[res] = '\0';
1947 
1948 	wpabuf_free(buf);
1949 
1950 	return res;
1951 }
1952 #endif /* CONFIG_WPS_NFC */
1953 #endif /* CONFIG_WPS_ER */
1954 
1955 #endif /* CONFIG_WPS */
1956 
1957 
1958 #ifdef CONFIG_IBSS_RSN
1959 static int wpa_supplicant_ctrl_iface_ibss_rsn(
1960 	struct wpa_supplicant *wpa_s, char *addr)
1961 {
1962 	u8 peer[ETH_ALEN];
1963 
1964 	if (hwaddr_aton(addr, peer)) {
1965 		wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN: invalid "
1966 			   "address '%s'", addr);
1967 		return -1;
1968 	}
1969 
1970 	wpa_printf(MSG_DEBUG, "CTRL_IFACE IBSS_RSN " MACSTR,
1971 		   MAC2STR(peer));
1972 
1973 	return ibss_rsn_start(wpa_s->ibss_rsn, peer);
1974 }
1975 #endif /* CONFIG_IBSS_RSN */
1976 
1977 
1978 static int wpa_supplicant_ctrl_iface_ctrl_rsp(struct wpa_supplicant *wpa_s,
1979 					      char *rsp)
1980 {
1981 #ifdef IEEE8021X_EAPOL
1982 	char *pos, *id_pos;
1983 	int id;
1984 	struct wpa_ssid *ssid;
1985 
1986 	pos = os_strchr(rsp, '-');
1987 	if (pos == NULL)
1988 		return -1;
1989 	*pos++ = '\0';
1990 	id_pos = pos;
1991 	pos = os_strchr(pos, ':');
1992 	if (pos == NULL)
1993 		return -1;
1994 	*pos++ = '\0';
1995 	id = atoi(id_pos);
1996 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: field=%s id=%d", rsp, id);
1997 	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
1998 			      (u8 *) pos, os_strlen(pos));
1999 
2000 	ssid = wpa_config_get_network(wpa_s->conf, id);
2001 	if (ssid == NULL) {
2002 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
2003 			   "to update", id);
2004 		return -1;
2005 	}
2006 
2007 	return wpa_supplicant_ctrl_iface_ctrl_rsp_handle(wpa_s, ssid, rsp,
2008 							 pos);
2009 #else /* IEEE8021X_EAPOL */
2010 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: 802.1X not included");
2011 	return -1;
2012 #endif /* IEEE8021X_EAPOL */
2013 }
2014 
2015 
2016 static int wpa_supplicant_ctrl_iface_status(struct wpa_supplicant *wpa_s,
2017 					    const char *params,
2018 					    char *buf, size_t buflen)
2019 {
2020 	char *pos, *end, tmp[30];
2021 	int res, verbose, wps, ret;
2022 #ifdef CONFIG_HS20
2023 	const u8 *hs20;
2024 #endif /* CONFIG_HS20 */
2025 	const u8 *sess_id;
2026 	size_t sess_id_len;
2027 
2028 	if (os_strcmp(params, "-DRIVER") == 0)
2029 		return wpa_drv_status(wpa_s, buf, buflen);
2030 	verbose = os_strcmp(params, "-VERBOSE") == 0;
2031 	wps = os_strcmp(params, "-WPS") == 0;
2032 	pos = buf;
2033 	end = buf + buflen;
2034 	if (wpa_s->wpa_state >= WPA_ASSOCIATED) {
2035 		struct wpa_ssid *ssid = wpa_s->current_ssid;
2036 		ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
2037 				  MAC2STR(wpa_s->bssid));
2038 		if (os_snprintf_error(end - pos, ret))
2039 			return pos - buf;
2040 		pos += ret;
2041 		ret = os_snprintf(pos, end - pos, "freq=%u\n",
2042 				  wpa_s->assoc_freq);
2043 		if (os_snprintf_error(end - pos, ret))
2044 			return pos - buf;
2045 		pos += ret;
2046 		if (ssid) {
2047 			u8 *_ssid = ssid->ssid;
2048 			size_t ssid_len = ssid->ssid_len;
2049 			u8 ssid_buf[SSID_MAX_LEN];
2050 			if (ssid_len == 0) {
2051 				int _res = wpa_drv_get_ssid(wpa_s, ssid_buf);
2052 				if (_res < 0)
2053 					ssid_len = 0;
2054 				else
2055 					ssid_len = _res;
2056 				_ssid = ssid_buf;
2057 			}
2058 			ret = os_snprintf(pos, end - pos, "ssid=%s\nid=%d\n",
2059 					  wpa_ssid_txt(_ssid, ssid_len),
2060 					  ssid->id);
2061 			if (os_snprintf_error(end - pos, ret))
2062 				return pos - buf;
2063 			pos += ret;
2064 
2065 			if (wps && ssid->passphrase &&
2066 			    wpa_key_mgmt_wpa_psk(ssid->key_mgmt) &&
2067 			    (ssid->mode == WPAS_MODE_AP ||
2068 			     ssid->mode == WPAS_MODE_P2P_GO)) {
2069 				ret = os_snprintf(pos, end - pos,
2070 						  "passphrase=%s\n",
2071 						  ssid->passphrase);
2072 				if (os_snprintf_error(end - pos, ret))
2073 					return pos - buf;
2074 				pos += ret;
2075 			}
2076 			if (ssid->id_str) {
2077 				ret = os_snprintf(pos, end - pos,
2078 						  "id_str=%s\n",
2079 						  ssid->id_str);
2080 				if (os_snprintf_error(end - pos, ret))
2081 					return pos - buf;
2082 				pos += ret;
2083 			}
2084 
2085 			switch (ssid->mode) {
2086 			case WPAS_MODE_INFRA:
2087 				ret = os_snprintf(pos, end - pos,
2088 						  "mode=station\n");
2089 				break;
2090 			case WPAS_MODE_IBSS:
2091 				ret = os_snprintf(pos, end - pos,
2092 						  "mode=IBSS\n");
2093 				break;
2094 			case WPAS_MODE_AP:
2095 				ret = os_snprintf(pos, end - pos,
2096 						  "mode=AP\n");
2097 				break;
2098 			case WPAS_MODE_P2P_GO:
2099 				ret = os_snprintf(pos, end - pos,
2100 						  "mode=P2P GO\n");
2101 				break;
2102 			case WPAS_MODE_P2P_GROUP_FORMATION:
2103 				ret = os_snprintf(pos, end - pos,
2104 						  "mode=P2P GO - group "
2105 						  "formation\n");
2106 				break;
2107 			case WPAS_MODE_MESH:
2108 				ret = os_snprintf(pos, end - pos,
2109 						  "mode=mesh\n");
2110 				break;
2111 			default:
2112 				ret = 0;
2113 				break;
2114 			}
2115 			if (os_snprintf_error(end - pos, ret))
2116 				return pos - buf;
2117 			pos += ret;
2118 		}
2119 
2120 #ifdef CONFIG_AP
2121 		if (wpa_s->ap_iface) {
2122 			pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
2123 							    end - pos,
2124 							    verbose);
2125 		} else
2126 #endif /* CONFIG_AP */
2127 		pos += wpa_sm_get_status(wpa_s->wpa, pos, end - pos, verbose);
2128 	}
2129 #ifdef CONFIG_SME
2130 #ifdef CONFIG_SAE
2131 	if (wpa_s->wpa_state >= WPA_ASSOCIATED &&
2132 #ifdef CONFIG_AP
2133 	    !wpa_s->ap_iface &&
2134 #endif /* CONFIG_AP */
2135 	    wpa_s->sme.sae.state == SAE_ACCEPTED) {
2136 		ret = os_snprintf(pos, end - pos, "sae_group=%d\n",
2137 				  wpa_s->sme.sae.group);
2138 		if (os_snprintf_error(end - pos, ret))
2139 			return pos - buf;
2140 		pos += ret;
2141 	}
2142 #endif /* CONFIG_SAE */
2143 #endif /* CONFIG_SME */
2144 	ret = os_snprintf(pos, end - pos, "wpa_state=%s\n",
2145 			  wpa_supplicant_state_txt(wpa_s->wpa_state));
2146 	if (os_snprintf_error(end - pos, ret))
2147 		return pos - buf;
2148 	pos += ret;
2149 
2150 	if (wpa_s->l2 &&
2151 	    l2_packet_get_ip_addr(wpa_s->l2, tmp, sizeof(tmp)) >= 0) {
2152 		ret = os_snprintf(pos, end - pos, "ip_address=%s\n", tmp);
2153 		if (os_snprintf_error(end - pos, ret))
2154 			return pos - buf;
2155 		pos += ret;
2156 	}
2157 
2158 #ifdef CONFIG_P2P
2159 	if (wpa_s->global->p2p) {
2160 		ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
2161 				  "\n", MAC2STR(wpa_s->global->p2p_dev_addr));
2162 		if (os_snprintf_error(end - pos, ret))
2163 			return pos - buf;
2164 		pos += ret;
2165 	}
2166 #endif /* CONFIG_P2P */
2167 
2168 	ret = os_snprintf(pos, end - pos, "address=" MACSTR "\n",
2169 			  MAC2STR(wpa_s->own_addr));
2170 	if (os_snprintf_error(end - pos, ret))
2171 		return pos - buf;
2172 	pos += ret;
2173 
2174 #ifdef CONFIG_HS20
2175 	if (wpa_s->current_bss &&
2176 	    (hs20 = wpa_bss_get_vendor_ie(wpa_s->current_bss,
2177 					  HS20_IE_VENDOR_TYPE)) &&
2178 	    wpa_s->wpa_proto == WPA_PROTO_RSN &&
2179 	    wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
2180 		int release = 1;
2181 		if (hs20[1] >= 5) {
2182 			u8 rel_num = (hs20[6] & 0xf0) >> 4;
2183 			release = rel_num + 1;
2184 		}
2185 		ret = os_snprintf(pos, end - pos, "hs20=%d\n", release);
2186 		if (os_snprintf_error(end - pos, ret))
2187 			return pos - buf;
2188 		pos += ret;
2189 	}
2190 
2191 	if (wpa_s->current_ssid) {
2192 		struct wpa_cred *cred;
2193 		char *type;
2194 
2195 		for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
2196 			size_t i;
2197 
2198 			if (wpa_s->current_ssid->parent_cred != cred)
2199 				continue;
2200 
2201 			if (cred->provisioning_sp) {
2202 				ret = os_snprintf(pos, end - pos,
2203 						  "provisioning_sp=%s\n",
2204 						  cred->provisioning_sp);
2205 				if (os_snprintf_error(end - pos, ret))
2206 					return pos - buf;
2207 				pos += ret;
2208 			}
2209 
2210 			if (!cred->domain)
2211 				goto no_domain;
2212 
2213 			i = 0;
2214 			if (wpa_s->current_bss && wpa_s->current_bss->anqp) {
2215 				struct wpabuf *names =
2216 					wpa_s->current_bss->anqp->domain_name;
2217 				for (i = 0; names && i < cred->num_domain; i++)
2218 				{
2219 					if (domain_name_list_contains(
2220 						    names, cred->domain[i], 1))
2221 						break;
2222 				}
2223 				if (i == cred->num_domain)
2224 					i = 0; /* show first entry by default */
2225 			}
2226 			ret = os_snprintf(pos, end - pos, "home_sp=%s\n",
2227 					  cred->domain[i]);
2228 			if (os_snprintf_error(end - pos, ret))
2229 				return pos - buf;
2230 			pos += ret;
2231 
2232 		no_domain:
2233 			if (wpa_s->current_bss == NULL ||
2234 			    wpa_s->current_bss->anqp == NULL)
2235 				res = -1;
2236 			else
2237 				res = interworking_home_sp_cred(
2238 					wpa_s, cred,
2239 					wpa_s->current_bss->anqp->domain_name);
2240 			if (res > 0)
2241 				type = "home";
2242 			else if (res == 0)
2243 				type = "roaming";
2244 			else
2245 				type = "unknown";
2246 
2247 			ret = os_snprintf(pos, end - pos, "sp_type=%s\n", type);
2248 			if (os_snprintf_error(end - pos, ret))
2249 				return pos - buf;
2250 			pos += ret;
2251 
2252 			break;
2253 		}
2254 	}
2255 #endif /* CONFIG_HS20 */
2256 
2257 	if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
2258 	    wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2259 		res = eapol_sm_get_status(wpa_s->eapol, pos, end - pos,
2260 					  verbose);
2261 		if (res >= 0)
2262 			pos += res;
2263 	}
2264 
2265 #ifdef CONFIG_MACSEC
2266 	res = ieee802_1x_kay_get_status(wpa_s->kay, pos, end - pos);
2267 	if (res > 0)
2268 		pos += res;
2269 #endif /* CONFIG_MACSEC */
2270 
2271 	sess_id = eapol_sm_get_session_id(wpa_s->eapol, &sess_id_len);
2272 	if (sess_id) {
2273 		char *start = pos;
2274 
2275 		ret = os_snprintf(pos, end - pos, "eap_session_id=");
2276 		if (os_snprintf_error(end - pos, ret))
2277 			return start - buf;
2278 		pos += ret;
2279 		ret = wpa_snprintf_hex(pos, end - pos, sess_id, sess_id_len);
2280 		if (ret <= 0)
2281 			return start - buf;
2282 		pos += ret;
2283 		ret = os_snprintf(pos, end - pos, "\n");
2284 		if (os_snprintf_error(end - pos, ret))
2285 			return start - buf;
2286 		pos += ret;
2287 	}
2288 
2289 	res = rsn_preauth_get_status(wpa_s->wpa, pos, end - pos, verbose);
2290 	if (res >= 0)
2291 		pos += res;
2292 
2293 #ifdef CONFIG_WPS
2294 	{
2295 		char uuid_str[100];
2296 		uuid_bin2str(wpa_s->wps->uuid, uuid_str, sizeof(uuid_str));
2297 		ret = os_snprintf(pos, end - pos, "uuid=%s\n", uuid_str);
2298 		if (os_snprintf_error(end - pos, ret))
2299 			return pos - buf;
2300 		pos += ret;
2301 	}
2302 #endif /* CONFIG_WPS */
2303 
2304 	if (wpa_s->ieee80211ac) {
2305 		ret = os_snprintf(pos, end - pos, "ieee80211ac=1\n");
2306 		if (os_snprintf_error(end - pos, ret))
2307 			return pos - buf;
2308 		pos += ret;
2309 	}
2310 
2311 #ifdef ANDROID
2312 	/*
2313 	 * Allow using the STATUS command with default behavior, say for debug,
2314 	 * i.e., don't generate a "fake" CONNECTION and SUPPLICANT_STATE_CHANGE
2315 	 * events with STATUS-NO_EVENTS.
2316 	 */
2317 	if (os_strcmp(params, "-NO_EVENTS")) {
2318 		wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_STATE_CHANGE
2319 			     "id=%d state=%d BSSID=" MACSTR " SSID=%s",
2320 			     wpa_s->current_ssid ? wpa_s->current_ssid->id : -1,
2321 			     wpa_s->wpa_state,
2322 			     MAC2STR(wpa_s->bssid),
2323 			     wpa_s->current_ssid && wpa_s->current_ssid->ssid ?
2324 			     wpa_ssid_txt(wpa_s->current_ssid->ssid,
2325 					  wpa_s->current_ssid->ssid_len) : "");
2326 		if (wpa_s->wpa_state == WPA_COMPLETED) {
2327 			struct wpa_ssid *ssid = wpa_s->current_ssid;
2328 			wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED
2329 				     "- connection to " MACSTR
2330 				     " completed %s [id=%d id_str=%s]",
2331 				     MAC2STR(wpa_s->bssid), "(auth)",
2332 				     ssid ? ssid->id : -1,
2333 				     ssid && ssid->id_str ? ssid->id_str : "");
2334 		}
2335 	}
2336 #endif /* ANDROID */
2337 
2338 	return pos - buf;
2339 }
2340 
2341 
2342 static int wpa_supplicant_ctrl_iface_bssid(struct wpa_supplicant *wpa_s,
2343 					   char *cmd)
2344 {
2345 	char *pos;
2346 	int id;
2347 	struct wpa_ssid *ssid;
2348 	u8 bssid[ETH_ALEN];
2349 
2350 	/* cmd: "<network id> <BSSID>" */
2351 	pos = os_strchr(cmd, ' ');
2352 	if (pos == NULL)
2353 		return -1;
2354 	*pos++ = '\0';
2355 	id = atoi(cmd);
2356 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: id=%d bssid='%s'", id, pos);
2357 	if (hwaddr_aton(pos, bssid)) {
2358 		wpa_printf(MSG_DEBUG ,"CTRL_IFACE: invalid BSSID '%s'", pos);
2359 		return -1;
2360 	}
2361 
2362 	ssid = wpa_config_get_network(wpa_s->conf, id);
2363 	if (ssid == NULL) {
2364 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
2365 			   "to update", id);
2366 		return -1;
2367 	}
2368 
2369 	os_memcpy(ssid->bssid, bssid, ETH_ALEN);
2370 	ssid->bssid_set = !is_zero_ether_addr(bssid);
2371 
2372 	return 0;
2373 }
2374 
2375 
2376 static int wpa_supplicant_ctrl_iface_blacklist(struct wpa_supplicant *wpa_s,
2377 					       char *cmd, char *buf,
2378 					       size_t buflen)
2379 {
2380 	u8 bssid[ETH_ALEN];
2381 	struct wpa_blacklist *e;
2382 	char *pos, *end;
2383 	int ret;
2384 
2385 	/* cmd: "BLACKLIST [<BSSID>]" */
2386 	if (*cmd == '\0') {
2387 		pos = buf;
2388 		end = buf + buflen;
2389 		e = wpa_s->blacklist;
2390 		while (e) {
2391 			ret = os_snprintf(pos, end - pos, MACSTR "\n",
2392 					  MAC2STR(e->bssid));
2393 			if (os_snprintf_error(end - pos, ret))
2394 				return pos - buf;
2395 			pos += ret;
2396 			e = e->next;
2397 		}
2398 		return pos - buf;
2399 	}
2400 
2401 	cmd++;
2402 	if (os_strncmp(cmd, "clear", 5) == 0) {
2403 		wpa_blacklist_clear(wpa_s);
2404 		os_memcpy(buf, "OK\n", 3);
2405 		return 3;
2406 	}
2407 
2408 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: BLACKLIST bssid='%s'", cmd);
2409 	if (hwaddr_aton(cmd, bssid)) {
2410 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: invalid BSSID '%s'", cmd);
2411 		return -1;
2412 	}
2413 
2414 	/*
2415 	 * Add the BSSID twice, so its count will be 2, causing it to be
2416 	 * skipped when processing scan results.
2417 	 */
2418 	ret = wpa_blacklist_add(wpa_s, bssid);
2419 	if (ret < 0)
2420 		return -1;
2421 	ret = wpa_blacklist_add(wpa_s, bssid);
2422 	if (ret < 0)
2423 		return -1;
2424 	os_memcpy(buf, "OK\n", 3);
2425 	return 3;
2426 }
2427 
2428 
2429 static int wpa_supplicant_ctrl_iface_log_level(struct wpa_supplicant *wpa_s,
2430 					       char *cmd, char *buf,
2431 					       size_t buflen)
2432 {
2433 	char *pos, *end, *stamp;
2434 	int ret;
2435 
2436 	/* cmd: "LOG_LEVEL [<level>]" */
2437 	if (*cmd == '\0') {
2438 		pos = buf;
2439 		end = buf + buflen;
2440 		ret = os_snprintf(pos, end - pos, "Current level: %s\n"
2441 				  "Timestamp: %d\n",
2442 				  debug_level_str(wpa_debug_level),
2443 				  wpa_debug_timestamp);
2444 		if (os_snprintf_error(end - pos, ret))
2445 			ret = 0;
2446 
2447 		return ret;
2448 	}
2449 
2450 	while (*cmd == ' ')
2451 		cmd++;
2452 
2453 	stamp = os_strchr(cmd, ' ');
2454 	if (stamp) {
2455 		*stamp++ = '\0';
2456 		while (*stamp == ' ') {
2457 			stamp++;
2458 		}
2459 	}
2460 
2461 	if (os_strlen(cmd)) {
2462 		int level = str_to_debug_level(cmd);
2463 		if (level < 0)
2464 			return -1;
2465 		wpa_debug_level = level;
2466 	}
2467 
2468 	if (stamp && os_strlen(stamp))
2469 		wpa_debug_timestamp = atoi(stamp);
2470 
2471 	os_memcpy(buf, "OK\n", 3);
2472 	return 3;
2473 }
2474 
2475 
2476 static int wpa_supplicant_ctrl_iface_list_networks(
2477 	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
2478 {
2479 	char *pos, *end, *prev;
2480 	struct wpa_ssid *ssid;
2481 	int ret;
2482 
2483 	pos = buf;
2484 	end = buf + buflen;
2485 	ret = os_snprintf(pos, end - pos,
2486 			  "network id / ssid / bssid / flags\n");
2487 	if (os_snprintf_error(end - pos, ret))
2488 		return pos - buf;
2489 	pos += ret;
2490 
2491 	ssid = wpa_s->conf->ssid;
2492 
2493 	/* skip over ssids until we find next one */
2494 	if (cmd != NULL && os_strncmp(cmd, "LAST_ID=", 8) == 0) {
2495 		int last_id = atoi(cmd + 8);
2496 		if (last_id != -1) {
2497 			while (ssid != NULL && ssid->id <= last_id) {
2498 				ssid = ssid->next;
2499 			}
2500 		}
2501 	}
2502 
2503 	while (ssid) {
2504 		prev = pos;
2505 		ret = os_snprintf(pos, end - pos, "%d\t%s",
2506 				  ssid->id,
2507 				  wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2508 		if (os_snprintf_error(end - pos, ret))
2509 			return prev - buf;
2510 		pos += ret;
2511 		if (ssid->bssid_set) {
2512 			ret = os_snprintf(pos, end - pos, "\t" MACSTR,
2513 					  MAC2STR(ssid->bssid));
2514 		} else {
2515 			ret = os_snprintf(pos, end - pos, "\tany");
2516 		}
2517 		if (os_snprintf_error(end - pos, ret))
2518 			return prev - buf;
2519 		pos += ret;
2520 		ret = os_snprintf(pos, end - pos, "\t%s%s%s%s",
2521 				  ssid == wpa_s->current_ssid ?
2522 				  "[CURRENT]" : "",
2523 				  ssid->disabled ? "[DISABLED]" : "",
2524 				  ssid->disabled_until.sec ?
2525 				  "[TEMP-DISABLED]" : "",
2526 				  ssid->disabled == 2 ? "[P2P-PERSISTENT]" :
2527 				  "");
2528 		if (os_snprintf_error(end - pos, ret))
2529 			return prev - buf;
2530 		pos += ret;
2531 		ret = os_snprintf(pos, end - pos, "\n");
2532 		if (os_snprintf_error(end - pos, ret))
2533 			return prev - buf;
2534 		pos += ret;
2535 
2536 		ssid = ssid->next;
2537 	}
2538 
2539 	return pos - buf;
2540 }
2541 
2542 
2543 static char * wpa_supplicant_cipher_txt(char *pos, char *end, int cipher)
2544 {
2545 	int ret;
2546 	ret = os_snprintf(pos, end - pos, "-");
2547 	if (os_snprintf_error(end - pos, ret))
2548 		return pos;
2549 	pos += ret;
2550 	ret = wpa_write_ciphers(pos, end, cipher, "+");
2551 	if (ret < 0)
2552 		return pos;
2553 	pos += ret;
2554 	return pos;
2555 }
2556 
2557 
2558 static char * wpa_supplicant_ie_txt(char *pos, char *end, const char *proto,
2559 				    const u8 *ie, size_t ie_len)
2560 {
2561 	struct wpa_ie_data data;
2562 	char *start;
2563 	int ret;
2564 
2565 	ret = os_snprintf(pos, end - pos, "[%s-", proto);
2566 	if (os_snprintf_error(end - pos, ret))
2567 		return pos;
2568 	pos += ret;
2569 
2570 	if (wpa_parse_wpa_ie(ie, ie_len, &data) < 0) {
2571 		ret = os_snprintf(pos, end - pos, "?]");
2572 		if (os_snprintf_error(end - pos, ret))
2573 			return pos;
2574 		pos += ret;
2575 		return pos;
2576 	}
2577 
2578 	start = pos;
2579 	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
2580 		ret = os_snprintf(pos, end - pos, "%sEAP",
2581 				  pos == start ? "" : "+");
2582 		if (os_snprintf_error(end - pos, ret))
2583 			return pos;
2584 		pos += ret;
2585 	}
2586 	if (data.key_mgmt & WPA_KEY_MGMT_PSK) {
2587 		ret = os_snprintf(pos, end - pos, "%sPSK",
2588 				  pos == start ? "" : "+");
2589 		if (os_snprintf_error(end - pos, ret))
2590 			return pos;
2591 		pos += ret;
2592 	}
2593 	if (data.key_mgmt & WPA_KEY_MGMT_WPA_NONE) {
2594 		ret = os_snprintf(pos, end - pos, "%sNone",
2595 				  pos == start ? "" : "+");
2596 		if (os_snprintf_error(end - pos, ret))
2597 			return pos;
2598 		pos += ret;
2599 	}
2600 	if (data.key_mgmt & WPA_KEY_MGMT_SAE) {
2601 		ret = os_snprintf(pos, end - pos, "%sSAE",
2602 				  pos == start ? "" : "+");
2603 		if (os_snprintf_error(end - pos, ret))
2604 			return pos;
2605 		pos += ret;
2606 	}
2607 #ifdef CONFIG_IEEE80211R
2608 	if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
2609 		ret = os_snprintf(pos, end - pos, "%sFT/EAP",
2610 				  pos == start ? "" : "+");
2611 		if (os_snprintf_error(end - pos, ret))
2612 			return pos;
2613 		pos += ret;
2614 	}
2615 	if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK) {
2616 		ret = os_snprintf(pos, end - pos, "%sFT/PSK",
2617 				  pos == start ? "" : "+");
2618 		if (os_snprintf_error(end - pos, ret))
2619 			return pos;
2620 		pos += ret;
2621 	}
2622 	if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE) {
2623 		ret = os_snprintf(pos, end - pos, "%sFT/SAE",
2624 				  pos == start ? "" : "+");
2625 		if (os_snprintf_error(end - pos, ret))
2626 			return pos;
2627 		pos += ret;
2628 	}
2629 #endif /* CONFIG_IEEE80211R */
2630 #ifdef CONFIG_IEEE80211W
2631 	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
2632 		ret = os_snprintf(pos, end - pos, "%sEAP-SHA256",
2633 				  pos == start ? "" : "+");
2634 		if (os_snprintf_error(end - pos, ret))
2635 			return pos;
2636 		pos += ret;
2637 	}
2638 	if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
2639 		ret = os_snprintf(pos, end - pos, "%sPSK-SHA256",
2640 				  pos == start ? "" : "+");
2641 		if (os_snprintf_error(end - pos, ret))
2642 			return pos;
2643 		pos += ret;
2644 	}
2645 #endif /* CONFIG_IEEE80211W */
2646 
2647 #ifdef CONFIG_SUITEB
2648 	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
2649 		ret = os_snprintf(pos, end - pos, "%sEAP-SUITE-B",
2650 				  pos == start ? "" : "+");
2651 		if (os_snprintf_error(end - pos, ret))
2652 			return pos;
2653 		pos += ret;
2654 	}
2655 #endif /* CONFIG_SUITEB */
2656 
2657 #ifdef CONFIG_SUITEB192
2658 	if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
2659 		ret = os_snprintf(pos, end - pos, "%sEAP-SUITE-B-192",
2660 				  pos == start ? "" : "+");
2661 		if (os_snprintf_error(end - pos, ret))
2662 			return pos;
2663 		pos += ret;
2664 	}
2665 #endif /* CONFIG_SUITEB192 */
2666 
2667 #ifdef CONFIG_FILS
2668 	if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA256) {
2669 		ret = os_snprintf(pos, end - pos, "%sFILS-SHA256",
2670 				  pos == start ? "" : "+");
2671 		if (os_snprintf_error(end - pos, ret))
2672 			return pos;
2673 		pos += ret;
2674 	}
2675 	if (data.key_mgmt & WPA_KEY_MGMT_FILS_SHA384) {
2676 		ret = os_snprintf(pos, end - pos, "%sFILS-SHA384",
2677 				  pos == start ? "" : "+");
2678 		if (os_snprintf_error(end - pos, ret))
2679 			return pos;
2680 		pos += ret;
2681 	}
2682 #ifdef CONFIG_IEEE80211R
2683 	if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA256) {
2684 		ret = os_snprintf(pos, end - pos, "%sFT-FILS-SHA256",
2685 				  pos == start ? "" : "+");
2686 		if (os_snprintf_error(end - pos, ret))
2687 			return pos;
2688 		pos += ret;
2689 	}
2690 	if (data.key_mgmt & WPA_KEY_MGMT_FT_FILS_SHA384) {
2691 		ret = os_snprintf(pos, end - pos, "%sFT-FILS-SHA384",
2692 				  pos == start ? "" : "+");
2693 		if (os_snprintf_error(end - pos, ret))
2694 			return pos;
2695 		pos += ret;
2696 	}
2697 #endif /* CONFIG_IEEE80211R */
2698 #endif /* CONFIG_FILS */
2699 
2700 #ifdef CONFIG_OWE
2701 	if (data.key_mgmt & WPA_KEY_MGMT_OWE) {
2702 		ret = os_snprintf(pos, end - pos, "%sOWE",
2703 				  pos == start ? "" : "+");
2704 		if (os_snprintf_error(end - pos, ret))
2705 			return pos;
2706 		pos += ret;
2707 	}
2708 #endif /* CONFIG_OWE */
2709 
2710 #ifdef CONFIG_DPP
2711 	if (data.key_mgmt & WPA_KEY_MGMT_DPP) {
2712 		ret = os_snprintf(pos, end - pos, "%sDPP",
2713 				  pos == start ? "" : "+");
2714 		if (os_snprintf_error(end - pos, ret))
2715 			return pos;
2716 		pos += ret;
2717 	}
2718 #endif /* CONFIG_DPP */
2719 
2720 	if (data.key_mgmt & WPA_KEY_MGMT_OSEN) {
2721 		ret = os_snprintf(pos, end - pos, "%sOSEN",
2722 				  pos == start ? "" : "+");
2723 		if (os_snprintf_error(end - pos, ret))
2724 			return pos;
2725 		pos += ret;
2726 	}
2727 
2728 	pos = wpa_supplicant_cipher_txt(pos, end, data.pairwise_cipher);
2729 
2730 	if (data.capabilities & WPA_CAPABILITY_PREAUTH) {
2731 		ret = os_snprintf(pos, end - pos, "-preauth");
2732 		if (os_snprintf_error(end - pos, ret))
2733 			return pos;
2734 		pos += ret;
2735 	}
2736 
2737 	ret = os_snprintf(pos, end - pos, "]");
2738 	if (os_snprintf_error(end - pos, ret))
2739 		return pos;
2740 	pos += ret;
2741 
2742 	return pos;
2743 }
2744 
2745 
2746 #ifdef CONFIG_WPS
2747 static char * wpa_supplicant_wps_ie_txt_buf(struct wpa_supplicant *wpa_s,
2748 					    char *pos, char *end,
2749 					    struct wpabuf *wps_ie)
2750 {
2751 	int ret;
2752 	const char *txt;
2753 
2754 	if (wps_ie == NULL)
2755 		return pos;
2756 	if (wps_is_selected_pbc_registrar(wps_ie))
2757 		txt = "[WPS-PBC]";
2758 	else if (wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 0))
2759 		txt = "[WPS-AUTH]";
2760 	else if (wps_is_selected_pin_registrar(wps_ie))
2761 		txt = "[WPS-PIN]";
2762 	else
2763 		txt = "[WPS]";
2764 
2765 	ret = os_snprintf(pos, end - pos, "%s", txt);
2766 	if (!os_snprintf_error(end - pos, ret))
2767 		pos += ret;
2768 	wpabuf_free(wps_ie);
2769 	return pos;
2770 }
2771 #endif /* CONFIG_WPS */
2772 
2773 
2774 static char * wpa_supplicant_wps_ie_txt(struct wpa_supplicant *wpa_s,
2775 					char *pos, char *end,
2776 					const struct wpa_bss *bss)
2777 {
2778 #ifdef CONFIG_WPS
2779 	struct wpabuf *wps_ie;
2780 	wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
2781 	return wpa_supplicant_wps_ie_txt_buf(wpa_s, pos, end, wps_ie);
2782 #else /* CONFIG_WPS */
2783 	return pos;
2784 #endif /* CONFIG_WPS */
2785 }
2786 
2787 
2788 /* Format one result on one text line into a buffer. */
2789 static int wpa_supplicant_ctrl_iface_scan_result(
2790 	struct wpa_supplicant *wpa_s,
2791 	const struct wpa_bss *bss, char *buf, size_t buflen)
2792 {
2793 	char *pos, *end;
2794 	int ret;
2795 	const u8 *ie, *ie2, *osen_ie, *p2p, *mesh, *owe;
2796 
2797 	mesh = wpa_bss_get_ie(bss, WLAN_EID_MESH_ID);
2798 	p2p = wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE);
2799 	if (!p2p)
2800 		p2p = wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE);
2801 	if (p2p && bss->ssid_len == P2P_WILDCARD_SSID_LEN &&
2802 	    os_memcmp(bss->ssid, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) ==
2803 	    0)
2804 		return 0; /* Do not show P2P listen discovery results here */
2805 
2806 	pos = buf;
2807 	end = buf + buflen;
2808 
2809 	ret = os_snprintf(pos, end - pos, MACSTR "\t%d\t%d\t",
2810 			  MAC2STR(bss->bssid), bss->freq, bss->level);
2811 	if (os_snprintf_error(end - pos, ret))
2812 		return -1;
2813 	pos += ret;
2814 	ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
2815 	if (ie)
2816 		pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie, 2 + ie[1]);
2817 	ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2818 	if (ie2) {
2819 		pos = wpa_supplicant_ie_txt(pos, end, mesh ? "RSN" : "WPA2",
2820 					    ie2, 2 + ie2[1]);
2821 	}
2822 	osen_ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
2823 	if (osen_ie)
2824 		pos = wpa_supplicant_ie_txt(pos, end, "OSEN",
2825 					    osen_ie, 2 + osen_ie[1]);
2826 	owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
2827 	if (owe) {
2828 		ret = os_snprintf(pos, end - pos,
2829 				  ie2 ? "[OWE-TRANS]" : "[OWE-TRANS-OPEN]");
2830 		if (os_snprintf_error(end - pos, ret))
2831 			return -1;
2832 		pos += ret;
2833 	}
2834 	pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
2835 	if (!ie && !ie2 && !osen_ie && (bss->caps & IEEE80211_CAP_PRIVACY)) {
2836 		ret = os_snprintf(pos, end - pos, "[WEP]");
2837 		if (os_snprintf_error(end - pos, ret))
2838 			return -1;
2839 		pos += ret;
2840 	}
2841 	if (mesh) {
2842 		ret = os_snprintf(pos, end - pos, "[MESH]");
2843 		if (os_snprintf_error(end - pos, ret))
2844 			return -1;
2845 		pos += ret;
2846 	}
2847 	if (bss_is_dmg(bss)) {
2848 		const char *s;
2849 		ret = os_snprintf(pos, end - pos, "[DMG]");
2850 		if (os_snprintf_error(end - pos, ret))
2851 			return -1;
2852 		pos += ret;
2853 		switch (bss->caps & IEEE80211_CAP_DMG_MASK) {
2854 		case IEEE80211_CAP_DMG_IBSS:
2855 			s = "[IBSS]";
2856 			break;
2857 		case IEEE80211_CAP_DMG_AP:
2858 			s = "[ESS]";
2859 			break;
2860 		case IEEE80211_CAP_DMG_PBSS:
2861 			s = "[PBSS]";
2862 			break;
2863 		default:
2864 			s = "";
2865 			break;
2866 		}
2867 		ret = os_snprintf(pos, end - pos, "%s", s);
2868 		if (os_snprintf_error(end - pos, ret))
2869 			return -1;
2870 		pos += ret;
2871 	} else {
2872 		if (bss->caps & IEEE80211_CAP_IBSS) {
2873 			ret = os_snprintf(pos, end - pos, "[IBSS]");
2874 			if (os_snprintf_error(end - pos, ret))
2875 				return -1;
2876 			pos += ret;
2877 		}
2878 		if (bss->caps & IEEE80211_CAP_ESS) {
2879 			ret = os_snprintf(pos, end - pos, "[ESS]");
2880 			if (os_snprintf_error(end - pos, ret))
2881 				return -1;
2882 			pos += ret;
2883 		}
2884 	}
2885 	if (p2p) {
2886 		ret = os_snprintf(pos, end - pos, "[P2P]");
2887 		if (os_snprintf_error(end - pos, ret))
2888 			return -1;
2889 		pos += ret;
2890 	}
2891 #ifdef CONFIG_HS20
2892 	if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE) && ie2) {
2893 		ret = os_snprintf(pos, end - pos, "[HS20]");
2894 		if (os_snprintf_error(end - pos, ret))
2895 			return -1;
2896 		pos += ret;
2897 	}
2898 #endif /* CONFIG_HS20 */
2899 #ifdef CONFIG_FILS
2900 	if (wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION)) {
2901 		ret = os_snprintf(pos, end - pos, "[FILS]");
2902 		if (os_snprintf_error(end - pos, ret))
2903 			return -1;
2904 		pos += ret;
2905 	}
2906 #endif /* CONFIG_FILS */
2907 #ifdef CONFIG_FST
2908 	if (wpa_bss_get_ie(bss, WLAN_EID_MULTI_BAND)) {
2909 		ret = os_snprintf(pos, end - pos, "[FST]");
2910 		if (os_snprintf_error(end - pos, ret))
2911 			return -1;
2912 		pos += ret;
2913 	}
2914 #endif /* CONFIG_FST */
2915 
2916 	ret = os_snprintf(pos, end - pos, "\t%s",
2917 			  wpa_ssid_txt(bss->ssid, bss->ssid_len));
2918 	if (os_snprintf_error(end - pos, ret))
2919 		return -1;
2920 	pos += ret;
2921 
2922 	ret = os_snprintf(pos, end - pos, "\n");
2923 	if (os_snprintf_error(end - pos, ret))
2924 		return -1;
2925 	pos += ret;
2926 
2927 	return pos - buf;
2928 }
2929 
2930 
2931 static int wpa_supplicant_ctrl_iface_scan_results(
2932 	struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
2933 {
2934 	char *pos, *end;
2935 	struct wpa_bss *bss;
2936 	int ret;
2937 
2938 	pos = buf;
2939 	end = buf + buflen;
2940 	ret = os_snprintf(pos, end - pos, "bssid / frequency / signal level / "
2941 			  "flags / ssid\n");
2942 	if (os_snprintf_error(end - pos, ret))
2943 		return pos - buf;
2944 	pos += ret;
2945 
2946 	dl_list_for_each(bss, &wpa_s->bss_id, struct wpa_bss, list_id) {
2947 		ret = wpa_supplicant_ctrl_iface_scan_result(wpa_s, bss, pos,
2948 							    end - pos);
2949 		if (ret < 0 || ret >= end - pos)
2950 			return pos - buf;
2951 		pos += ret;
2952 	}
2953 
2954 	return pos - buf;
2955 }
2956 
2957 
2958 #ifdef CONFIG_MESH
2959 
2960 static int wpa_supplicant_ctrl_iface_mesh_interface_add(
2961 	struct wpa_supplicant *wpa_s, char *cmd, char *reply, size_t max_len)
2962 {
2963 	char *pos, ifname[IFNAMSIZ + 1];
2964 
2965 	ifname[0] = '\0';
2966 
2967 	pos = os_strstr(cmd, "ifname=");
2968 	if (pos) {
2969 		pos += 7;
2970 		os_strlcpy(ifname, pos, sizeof(ifname));
2971 	}
2972 
2973 	if (wpas_mesh_add_interface(wpa_s, ifname, sizeof(ifname)) < 0)
2974 		return -1;
2975 
2976 	os_strlcpy(reply, ifname, max_len);
2977 	return os_strlen(ifname);
2978 }
2979 
2980 
2981 static int wpa_supplicant_ctrl_iface_mesh_group_add(
2982 	struct wpa_supplicant *wpa_s, char *cmd)
2983 {
2984 	int id;
2985 	struct wpa_ssid *ssid;
2986 
2987 	id = atoi(cmd);
2988 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: MESH_GROUP_ADD id=%d", id);
2989 
2990 	ssid = wpa_config_get_network(wpa_s->conf, id);
2991 	if (ssid == NULL) {
2992 		wpa_printf(MSG_DEBUG,
2993 			   "CTRL_IFACE: Could not find network id=%d", id);
2994 		return -1;
2995 	}
2996 	if (ssid->mode != WPAS_MODE_MESH) {
2997 		wpa_printf(MSG_DEBUG,
2998 			   "CTRL_IFACE: Cannot use MESH_GROUP_ADD on a non mesh network");
2999 		return -1;
3000 	}
3001 	if (ssid->key_mgmt != WPA_KEY_MGMT_NONE &&
3002 	    ssid->key_mgmt != WPA_KEY_MGMT_SAE) {
3003 		wpa_printf(MSG_ERROR,
3004 			   "CTRL_IFACE: key_mgmt for mesh network should be open or SAE");
3005 		return -1;
3006 	}
3007 
3008 	/*
3009 	 * TODO: If necessary write our own group_add function,
3010 	 * for now we can reuse select_network
3011 	 */
3012 	wpa_supplicant_select_network(wpa_s, ssid);
3013 
3014 	return 0;
3015 }
3016 
3017 
3018 static int wpa_supplicant_ctrl_iface_mesh_group_remove(
3019 	struct wpa_supplicant *wpa_s, char *cmd)
3020 {
3021 	struct wpa_supplicant *orig;
3022 	struct wpa_global *global;
3023 	int found = 0;
3024 
3025 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: MESH_GROUP_REMOVE ifname=%s", cmd);
3026 
3027 	global = wpa_s->global;
3028 	orig = wpa_s;
3029 
3030 	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
3031 		if (os_strcmp(wpa_s->ifname, cmd) == 0) {
3032 			found = 1;
3033 			break;
3034 		}
3035 	}
3036 	if (!found) {
3037 		wpa_printf(MSG_ERROR,
3038 			   "CTRL_IFACE: MESH_GROUP_REMOVE ifname=%s not found",
3039 			   cmd);
3040 		return -1;
3041 	}
3042 	if (wpa_s->mesh_if_created && wpa_s == orig) {
3043 		wpa_printf(MSG_ERROR,
3044 			   "CTRL_IFACE: MESH_GROUP_REMOVE can't remove itself");
3045 		return -1;
3046 	}
3047 
3048 	wpa_s->reassociate = 0;
3049 	wpa_s->disconnected = 1;
3050 	wpa_supplicant_cancel_sched_scan(wpa_s);
3051 	wpa_supplicant_cancel_scan(wpa_s);
3052 
3053 	/*
3054 	 * TODO: If necessary write our own group_remove function,
3055 	 * for now we can reuse deauthenticate
3056 	 */
3057 	wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
3058 
3059 	if (wpa_s->mesh_if_created)
3060 		wpa_supplicant_remove_iface(global, wpa_s, 0);
3061 
3062 	return 0;
3063 }
3064 
3065 
3066 static int wpa_supplicant_ctrl_iface_mesh_peer_remove(
3067 	struct wpa_supplicant *wpa_s, char *cmd)
3068 {
3069 	u8 addr[ETH_ALEN];
3070 
3071 	if (hwaddr_aton(cmd, addr) < 0)
3072 		return -1;
3073 
3074 	return wpas_mesh_peer_remove(wpa_s, addr);
3075 }
3076 
3077 
3078 static int wpa_supplicant_ctrl_iface_mesh_peer_add(
3079 	struct wpa_supplicant *wpa_s, char *cmd)
3080 {
3081 	u8 addr[ETH_ALEN];
3082 	int duration;
3083 	char *pos;
3084 
3085 	pos = os_strstr(cmd, " duration=");
3086 	if (pos) {
3087 		*pos = '\0';
3088 		duration = atoi(pos + 10);
3089 	} else {
3090 		duration = -1;
3091 	}
3092 
3093 	if (hwaddr_aton(cmd, addr))
3094 		return -1;
3095 
3096 	return wpas_mesh_peer_add(wpa_s, addr, duration);
3097 }
3098 
3099 #endif /* CONFIG_MESH */
3100 
3101 
3102 static int wpa_supplicant_ctrl_iface_select_network(
3103 	struct wpa_supplicant *wpa_s, char *cmd)
3104 {
3105 	int id;
3106 	struct wpa_ssid *ssid;
3107 	char *pos;
3108 
3109 	/* cmd: "<network id>" or "any" */
3110 	if (os_strncmp(cmd, "any", 3) == 0) {
3111 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK any");
3112 		ssid = NULL;
3113 	} else {
3114 		id = atoi(cmd);
3115 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SELECT_NETWORK id=%d", id);
3116 
3117 		ssid = wpa_config_get_network(wpa_s->conf, id);
3118 		if (ssid == NULL) {
3119 			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3120 				   "network id=%d", id);
3121 			return -1;
3122 		}
3123 		if (ssid->disabled == 2) {
3124 			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
3125 				   "SELECT_NETWORK with persistent P2P group");
3126 			return -1;
3127 		}
3128 	}
3129 
3130 	pos = os_strstr(cmd, " freq=");
3131 	if (pos) {
3132 		int *freqs = freq_range_to_channel_list(wpa_s, pos + 6);
3133 		if (freqs) {
3134 			os_free(wpa_s->select_network_scan_freqs);
3135 			wpa_s->select_network_scan_freqs = freqs;
3136 		}
3137 	}
3138 
3139 	wpa_s->scan_min_time.sec = 0;
3140 	wpa_s->scan_min_time.usec = 0;
3141 	wpa_supplicant_select_network(wpa_s, ssid);
3142 
3143 	return 0;
3144 }
3145 
3146 
3147 static int wpa_supplicant_ctrl_iface_enable_network(
3148 	struct wpa_supplicant *wpa_s, char *cmd)
3149 {
3150 	int id;
3151 	struct wpa_ssid *ssid;
3152 
3153 	/* cmd: "<network id>" or "all" */
3154 	if (os_strcmp(cmd, "all") == 0) {
3155 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK all");
3156 		ssid = NULL;
3157 	} else {
3158 		id = atoi(cmd);
3159 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: ENABLE_NETWORK id=%d", id);
3160 
3161 		ssid = wpa_config_get_network(wpa_s->conf, id);
3162 		if (ssid == NULL) {
3163 			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3164 				   "network id=%d", id);
3165 			return -1;
3166 		}
3167 		if (ssid->disabled == 2) {
3168 			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
3169 				   "ENABLE_NETWORK with persistent P2P group");
3170 			return -1;
3171 		}
3172 
3173 		if (os_strstr(cmd, " no-connect")) {
3174 			ssid->disabled = 0;
3175 			return 0;
3176 		}
3177 	}
3178 	wpa_s->scan_min_time.sec = 0;
3179 	wpa_s->scan_min_time.usec = 0;
3180 	wpa_supplicant_enable_network(wpa_s, ssid);
3181 
3182 	return 0;
3183 }
3184 
3185 
3186 static int wpa_supplicant_ctrl_iface_disable_network(
3187 	struct wpa_supplicant *wpa_s, char *cmd)
3188 {
3189 	int id;
3190 	struct wpa_ssid *ssid;
3191 
3192 	/* cmd: "<network id>" or "all" */
3193 	if (os_strcmp(cmd, "all") == 0) {
3194 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK all");
3195 		ssid = NULL;
3196 	} else {
3197 		id = atoi(cmd);
3198 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: DISABLE_NETWORK id=%d", id);
3199 
3200 		ssid = wpa_config_get_network(wpa_s->conf, id);
3201 		if (ssid == NULL) {
3202 			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3203 				   "network id=%d", id);
3204 			return -1;
3205 		}
3206 		if (ssid->disabled == 2) {
3207 			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Cannot use "
3208 				   "DISABLE_NETWORK with persistent P2P "
3209 				   "group");
3210 			return -1;
3211 		}
3212 	}
3213 	wpa_supplicant_disable_network(wpa_s, ssid);
3214 
3215 	return 0;
3216 }
3217 
3218 
3219 static int wpa_supplicant_ctrl_iface_add_network(
3220 	struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
3221 {
3222 	struct wpa_ssid *ssid;
3223 	int ret;
3224 
3225 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_NETWORK");
3226 
3227 	ssid = wpa_supplicant_add_network(wpa_s);
3228 	if (ssid == NULL)
3229 		return -1;
3230 
3231 	ret = os_snprintf(buf, buflen, "%d\n", ssid->id);
3232 	if (os_snprintf_error(buflen, ret))
3233 		return -1;
3234 	return ret;
3235 }
3236 
3237 
3238 static int wpa_supplicant_ctrl_iface_remove_network(
3239 	struct wpa_supplicant *wpa_s, char *cmd)
3240 {
3241 	int id;
3242 	struct wpa_ssid *ssid;
3243 	int result;
3244 
3245 	/* cmd: "<network id>" or "all" */
3246 	if (os_strcmp(cmd, "all") == 0) {
3247 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK all");
3248 		if (wpa_s->sched_scanning)
3249 			wpa_supplicant_cancel_sched_scan(wpa_s);
3250 
3251 		eapol_sm_invalidate_cached_session(wpa_s->eapol);
3252 		if (wpa_s->current_ssid) {
3253 #ifdef CONFIG_SME
3254 			wpa_s->sme.prev_bssid_set = 0;
3255 #endif /* CONFIG_SME */
3256 			wpa_sm_set_config(wpa_s->wpa, NULL);
3257 			eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
3258 			if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
3259 				wpa_s->own_disconnect_req = 1;
3260 			wpa_supplicant_deauthenticate(
3261 				wpa_s, WLAN_REASON_DEAUTH_LEAVING);
3262 		}
3263 		ssid = wpa_s->conf->ssid;
3264 		while (ssid) {
3265 			struct wpa_ssid *remove_ssid = ssid;
3266 			id = ssid->id;
3267 			ssid = ssid->next;
3268 			if (wpa_s->last_ssid == remove_ssid)
3269 				wpa_s->last_ssid = NULL;
3270 			wpas_notify_network_removed(wpa_s, remove_ssid);
3271 			wpa_config_remove_network(wpa_s->conf, id);
3272 		}
3273 		return 0;
3274 	}
3275 
3276 	id = atoi(cmd);
3277 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK id=%d", id);
3278 
3279 	result = wpa_supplicant_remove_network(wpa_s, id);
3280 	if (result == -1) {
3281 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
3282 			   "id=%d", id);
3283 		return -1;
3284 	}
3285 	if (result == -2) {
3286 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Not able to remove the "
3287 			   "network id=%d", id);
3288 		return -1;
3289 	}
3290 	return 0;
3291 }
3292 
3293 
3294 static int wpa_supplicant_ctrl_iface_update_network(
3295 	struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3296 	char *name, char *value)
3297 {
3298 	int ret;
3299 
3300 	ret = wpa_config_set(ssid, name, value, 0);
3301 	if (ret < 0) {
3302 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set network "
3303 			   "variable '%s'", name);
3304 		return -1;
3305 	}
3306 	if (ret == 1)
3307 		return 0; /* No change to the previously configured value */
3308 
3309 	if (os_strcmp(name, "bssid") != 0 &&
3310 	    os_strcmp(name, "bssid_hint") != 0 &&
3311 	    os_strcmp(name, "priority") != 0) {
3312 		wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
3313 
3314 		if (wpa_s->current_ssid == ssid ||
3315 		    wpa_s->current_ssid == NULL) {
3316 			/*
3317 			 * Invalidate the EAP session cache if anything in the
3318 			 * current or previously used configuration changes.
3319 			 */
3320 			eapol_sm_invalidate_cached_session(wpa_s->eapol);
3321 		}
3322 	}
3323 
3324 	if ((os_strcmp(name, "psk") == 0 &&
3325 	     value[0] == '"' && ssid->ssid_len) ||
3326 	    (os_strcmp(name, "ssid") == 0 && ssid->passphrase))
3327 		wpa_config_update_psk(ssid);
3328 	else if (os_strcmp(name, "priority") == 0)
3329 		wpa_config_update_prio_list(wpa_s->conf);
3330 
3331 	return 0;
3332 }
3333 
3334 
3335 static int wpa_supplicant_ctrl_iface_set_network(
3336 	struct wpa_supplicant *wpa_s, char *cmd)
3337 {
3338 	int id, ret, prev_bssid_set, prev_disabled;
3339 	struct wpa_ssid *ssid;
3340 	char *name, *value;
3341 	u8 prev_bssid[ETH_ALEN];
3342 
3343 	/* cmd: "<network id> <variable name> <value>" */
3344 	name = os_strchr(cmd, ' ');
3345 	if (name == NULL)
3346 		return -1;
3347 	*name++ = '\0';
3348 
3349 	value = os_strchr(name, ' ');
3350 	if (value == NULL)
3351 		return -1;
3352 	*value++ = '\0';
3353 
3354 	id = atoi(cmd);
3355 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_NETWORK id=%d name='%s'",
3356 		   id, name);
3357 	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
3358 			      (u8 *) value, os_strlen(value));
3359 
3360 	ssid = wpa_config_get_network(wpa_s->conf, id);
3361 	if (ssid == NULL) {
3362 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find network "
3363 			   "id=%d", id);
3364 		return -1;
3365 	}
3366 
3367 	prev_bssid_set = ssid->bssid_set;
3368 	prev_disabled = ssid->disabled;
3369 	os_memcpy(prev_bssid, ssid->bssid, ETH_ALEN);
3370 	ret = wpa_supplicant_ctrl_iface_update_network(wpa_s, ssid, name,
3371 						       value);
3372 	if (ret == 0 &&
3373 	    (ssid->bssid_set != prev_bssid_set ||
3374 	     os_memcmp(ssid->bssid, prev_bssid, ETH_ALEN) != 0))
3375 		wpas_notify_network_bssid_set_changed(wpa_s, ssid);
3376 
3377 	if (prev_disabled != ssid->disabled &&
3378 	    (prev_disabled == 2 || ssid->disabled == 2))
3379 		wpas_notify_network_type_changed(wpa_s, ssid);
3380 
3381 	return ret;
3382 }
3383 
3384 
3385 static int wpa_supplicant_ctrl_iface_get_network(
3386 	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
3387 {
3388 	int id;
3389 	size_t res;
3390 	struct wpa_ssid *ssid;
3391 	char *name, *value;
3392 
3393 	/* cmd: "<network id> <variable name>" */
3394 	name = os_strchr(cmd, ' ');
3395 	if (name == NULL || buflen == 0)
3396 		return -1;
3397 	*name++ = '\0';
3398 
3399 	id = atoi(cmd);
3400 	wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: GET_NETWORK id=%d name='%s'",
3401 		   id, name);
3402 
3403 	ssid = wpa_config_get_network(wpa_s->conf, id);
3404 	if (ssid == NULL) {
3405 		wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: Could not find network "
3406 			   "id=%d", id);
3407 		return -1;
3408 	}
3409 
3410 	value = wpa_config_get_no_key(ssid, name);
3411 	if (value == NULL) {
3412 		wpa_printf(MSG_EXCESSIVE, "CTRL_IFACE: Failed to get network "
3413 			   "variable '%s'", name);
3414 		return -1;
3415 	}
3416 
3417 	res = os_strlcpy(buf, value, buflen);
3418 	if (res >= buflen) {
3419 		os_free(value);
3420 		return -1;
3421 	}
3422 
3423 	os_free(value);
3424 
3425 	return res;
3426 }
3427 
3428 
3429 static int wpa_supplicant_ctrl_iface_dup_network(
3430 	struct wpa_supplicant *wpa_s, char *cmd,
3431 	struct wpa_supplicant *dst_wpa_s)
3432 {
3433 	struct wpa_ssid *ssid_s, *ssid_d;
3434 	char *name, *id, *value;
3435 	int id_s, id_d, ret;
3436 
3437 	/* cmd: "<src network id> <dst network id> <variable name>" */
3438 	id = os_strchr(cmd, ' ');
3439 	if (id == NULL)
3440 		return -1;
3441 	*id++ = '\0';
3442 
3443 	name = os_strchr(id, ' ');
3444 	if (name == NULL)
3445 		return -1;
3446 	*name++ = '\0';
3447 
3448 	id_s = atoi(cmd);
3449 	id_d = atoi(id);
3450 
3451 	wpa_printf(MSG_DEBUG,
3452 		   "CTRL_IFACE: DUP_NETWORK ifname=%s->%s id=%d->%d name='%s'",
3453 		   wpa_s->ifname, dst_wpa_s->ifname, id_s, id_d, name);
3454 
3455 	ssid_s = wpa_config_get_network(wpa_s->conf, id_s);
3456 	if (ssid_s == NULL) {
3457 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3458 			   "network id=%d", id_s);
3459 		return -1;
3460 	}
3461 
3462 	ssid_d = wpa_config_get_network(dst_wpa_s->conf, id_d);
3463 	if (ssid_d == NULL) {
3464 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
3465 			   "network id=%d", id_d);
3466 		return -1;
3467 	}
3468 
3469 	value = wpa_config_get(ssid_s, name);
3470 	if (value == NULL) {
3471 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get network "
3472 			   "variable '%s'", name);
3473 		return -1;
3474 	}
3475 
3476 	ret = wpa_supplicant_ctrl_iface_update_network(dst_wpa_s, ssid_d, name,
3477 						       value);
3478 
3479 	os_free(value);
3480 
3481 	return ret;
3482 }
3483 
3484 
3485 static int wpa_supplicant_ctrl_iface_list_creds(struct wpa_supplicant *wpa_s,
3486 						char *buf, size_t buflen)
3487 {
3488 	char *pos, *end;
3489 	struct wpa_cred *cred;
3490 	int ret;
3491 
3492 	pos = buf;
3493 	end = buf + buflen;
3494 	ret = os_snprintf(pos, end - pos,
3495 			  "cred id / realm / username / domain / imsi\n");
3496 	if (os_snprintf_error(end - pos, ret))
3497 		return pos - buf;
3498 	pos += ret;
3499 
3500 	cred = wpa_s->conf->cred;
3501 	while (cred) {
3502 		ret = os_snprintf(pos, end - pos, "%d\t%s\t%s\t%s\t%s\n",
3503 				  cred->id, cred->realm ? cred->realm : "",
3504 				  cred->username ? cred->username : "",
3505 				  cred->domain ? cred->domain[0] : "",
3506 				  cred->imsi ? cred->imsi : "");
3507 		if (os_snprintf_error(end - pos, ret))
3508 			return pos - buf;
3509 		pos += ret;
3510 
3511 		cred = cred->next;
3512 	}
3513 
3514 	return pos - buf;
3515 }
3516 
3517 
3518 static int wpa_supplicant_ctrl_iface_add_cred(struct wpa_supplicant *wpa_s,
3519 					      char *buf, size_t buflen)
3520 {
3521 	struct wpa_cred *cred;
3522 	int ret;
3523 
3524 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: ADD_CRED");
3525 
3526 	cred = wpa_config_add_cred(wpa_s->conf);
3527 	if (cred == NULL)
3528 		return -1;
3529 
3530 	wpa_msg(wpa_s, MSG_INFO, CRED_ADDED "%d", cred->id);
3531 
3532 	ret = os_snprintf(buf, buflen, "%d\n", cred->id);
3533 	if (os_snprintf_error(buflen, ret))
3534 		return -1;
3535 	return ret;
3536 }
3537 
3538 
3539 static int wpas_ctrl_remove_cred(struct wpa_supplicant *wpa_s,
3540 				 struct wpa_cred *cred)
3541 {
3542 	struct wpa_ssid *ssid;
3543 	char str[20];
3544 	int id;
3545 
3546 	if (cred == NULL) {
3547 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred");
3548 		return -1;
3549 	}
3550 
3551 	id = cred->id;
3552 	if (wpa_config_remove_cred(wpa_s->conf, id) < 0) {
3553 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred");
3554 		return -1;
3555 	}
3556 
3557 	wpa_msg(wpa_s, MSG_INFO, CRED_REMOVED "%d", id);
3558 
3559 	/* Remove any network entry created based on the removed credential */
3560 	ssid = wpa_s->conf->ssid;
3561 	while (ssid) {
3562 		if (ssid->parent_cred == cred) {
3563 			int res;
3564 
3565 			wpa_printf(MSG_DEBUG, "Remove network id %d since it "
3566 				   "used the removed credential", ssid->id);
3567 			res = os_snprintf(str, sizeof(str), "%d", ssid->id);
3568 			if (os_snprintf_error(sizeof(str), res))
3569 				str[sizeof(str) - 1] = '\0';
3570 			ssid = ssid->next;
3571 			wpa_supplicant_ctrl_iface_remove_network(wpa_s, str);
3572 		} else
3573 			ssid = ssid->next;
3574 	}
3575 
3576 	return 0;
3577 }
3578 
3579 
3580 static int wpa_supplicant_ctrl_iface_remove_cred(struct wpa_supplicant *wpa_s,
3581 						 char *cmd)
3582 {
3583 	int id;
3584 	struct wpa_cred *cred, *prev;
3585 
3586 	/* cmd: "<cred id>", "all", "sp_fqdn=<FQDN>", or
3587 	 * "provisioning_sp=<FQDN> */
3588 	if (os_strcmp(cmd, "all") == 0) {
3589 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED all");
3590 		cred = wpa_s->conf->cred;
3591 		while (cred) {
3592 			prev = cred;
3593 			cred = cred->next;
3594 			wpas_ctrl_remove_cred(wpa_s, prev);
3595 		}
3596 		return 0;
3597 	}
3598 
3599 	if (os_strncmp(cmd, "sp_fqdn=", 8) == 0) {
3600 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED SP FQDN '%s'",
3601 			   cmd + 8);
3602 		cred = wpa_s->conf->cred;
3603 		while (cred) {
3604 			prev = cred;
3605 			cred = cred->next;
3606 			if (prev->domain) {
3607 				size_t i;
3608 				for (i = 0; i < prev->num_domain; i++) {
3609 					if (os_strcmp(prev->domain[i], cmd + 8)
3610 					    != 0)
3611 						continue;
3612 					wpas_ctrl_remove_cred(wpa_s, prev);
3613 					break;
3614 				}
3615 			}
3616 		}
3617 		return 0;
3618 	}
3619 
3620 	if (os_strncmp(cmd, "provisioning_sp=", 16) == 0) {
3621 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED provisioning SP FQDN '%s'",
3622 			   cmd + 16);
3623 		cred = wpa_s->conf->cred;
3624 		while (cred) {
3625 			prev = cred;
3626 			cred = cred->next;
3627 			if (prev->provisioning_sp &&
3628 			    os_strcmp(prev->provisioning_sp, cmd + 16) == 0)
3629 				wpas_ctrl_remove_cred(wpa_s, prev);
3630 		}
3631 		return 0;
3632 	}
3633 
3634 	id = atoi(cmd);
3635 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_CRED id=%d", id);
3636 
3637 	cred = wpa_config_get_cred(wpa_s->conf, id);
3638 	return wpas_ctrl_remove_cred(wpa_s, cred);
3639 }
3640 
3641 
3642 static int wpa_supplicant_ctrl_iface_set_cred(struct wpa_supplicant *wpa_s,
3643 					      char *cmd)
3644 {
3645 	int id;
3646 	struct wpa_cred *cred;
3647 	char *name, *value;
3648 
3649 	/* cmd: "<cred id> <variable name> <value>" */
3650 	name = os_strchr(cmd, ' ');
3651 	if (name == NULL)
3652 		return -1;
3653 	*name++ = '\0';
3654 
3655 	value = os_strchr(name, ' ');
3656 	if (value == NULL)
3657 		return -1;
3658 	*value++ = '\0';
3659 
3660 	id = atoi(cmd);
3661 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: SET_CRED id=%d name='%s'",
3662 		   id, name);
3663 	wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: value",
3664 			      (u8 *) value, os_strlen(value));
3665 
3666 	cred = wpa_config_get_cred(wpa_s->conf, id);
3667 	if (cred == NULL) {
3668 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
3669 			   id);
3670 		return -1;
3671 	}
3672 
3673 	if (wpa_config_set_cred(cred, name, value, 0) < 0) {
3674 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to set cred "
3675 			   "variable '%s'", name);
3676 		return -1;
3677 	}
3678 
3679 	wpa_msg(wpa_s, MSG_INFO, CRED_MODIFIED "%d %s", cred->id, name);
3680 
3681 	return 0;
3682 }
3683 
3684 
3685 static int wpa_supplicant_ctrl_iface_get_cred(struct wpa_supplicant *wpa_s,
3686 					      char *cmd, char *buf,
3687 					      size_t buflen)
3688 {
3689 	int id;
3690 	size_t res;
3691 	struct wpa_cred *cred;
3692 	char *name, *value;
3693 
3694 	/* cmd: "<cred id> <variable name>" */
3695 	name = os_strchr(cmd, ' ');
3696 	if (name == NULL)
3697 		return -1;
3698 	*name++ = '\0';
3699 
3700 	id = atoi(cmd);
3701 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CRED id=%d name='%s'",
3702 		   id, name);
3703 
3704 	cred = wpa_config_get_cred(wpa_s->conf, id);
3705 	if (cred == NULL) {
3706 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find cred id=%d",
3707 			   id);
3708 		return -1;
3709 	}
3710 
3711 	value = wpa_config_get_cred_no_key(cred, name);
3712 	if (value == NULL) {
3713 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Failed to get cred variable '%s'",
3714 			   name);
3715 		return -1;
3716 	}
3717 
3718 	res = os_strlcpy(buf, value, buflen);
3719 	if (res >= buflen) {
3720 		os_free(value);
3721 		return -1;
3722 	}
3723 
3724 	os_free(value);
3725 
3726 	return res;
3727 }
3728 
3729 
3730 #ifndef CONFIG_NO_CONFIG_WRITE
3731 static int wpa_supplicant_ctrl_iface_save_config(struct wpa_supplicant *wpa_s)
3732 {
3733 	int ret;
3734 
3735 	if (!wpa_s->conf->update_config) {
3736 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed "
3737 			   "to update configuration (update_config=0)");
3738 		return -1;
3739 	}
3740 
3741 	ret = wpa_config_write(wpa_s->confname, wpa_s->conf);
3742 	if (ret) {
3743 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to "
3744 			   "update configuration");
3745 	} else {
3746 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration"
3747 			   " updated");
3748 	}
3749 
3750 	return ret;
3751 }
3752 #endif /* CONFIG_NO_CONFIG_WRITE */
3753 
3754 
3755 struct cipher_info {
3756 	unsigned int capa;
3757 	const char *name;
3758 	int group_only;
3759 };
3760 
3761 static const struct cipher_info ciphers[] = {
3762 	{ WPA_DRIVER_CAPA_ENC_CCMP_256, "CCMP-256", 0 },
3763 	{ WPA_DRIVER_CAPA_ENC_GCMP_256, "GCMP-256", 0 },
3764 	{ WPA_DRIVER_CAPA_ENC_CCMP, "CCMP", 0 },
3765 	{ WPA_DRIVER_CAPA_ENC_GCMP, "GCMP", 0 },
3766 	{ WPA_DRIVER_CAPA_ENC_TKIP, "TKIP", 0 },
3767 	{ WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE, "NONE", 0 },
3768 	{ WPA_DRIVER_CAPA_ENC_WEP104, "WEP104", 1 },
3769 	{ WPA_DRIVER_CAPA_ENC_WEP40, "WEP40", 1 }
3770 };
3771 
3772 static const struct cipher_info ciphers_group_mgmt[] = {
3773 	{ WPA_DRIVER_CAPA_ENC_BIP, "AES-128-CMAC", 1 },
3774 	{ WPA_DRIVER_CAPA_ENC_BIP_GMAC_128, "BIP-GMAC-128", 1 },
3775 	{ WPA_DRIVER_CAPA_ENC_BIP_GMAC_256, "BIP-GMAC-256", 1 },
3776 	{ WPA_DRIVER_CAPA_ENC_BIP_CMAC_256, "BIP-CMAC-256", 1 },
3777 };
3778 
3779 
3780 static int ctrl_iface_get_capability_pairwise(int res, char *strict,
3781 					      struct wpa_driver_capa *capa,
3782 					      char *buf, size_t buflen)
3783 {
3784 	int ret;
3785 	char *pos, *end;
3786 	size_t len;
3787 	unsigned int i;
3788 
3789 	pos = buf;
3790 	end = pos + buflen;
3791 
3792 	if (res < 0) {
3793 		if (strict)
3794 			return 0;
3795 		len = os_strlcpy(buf, "CCMP TKIP NONE", buflen);
3796 		if (len >= buflen)
3797 			return -1;
3798 		return len;
3799 	}
3800 
3801 	for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
3802 		if (!ciphers[i].group_only && capa->enc & ciphers[i].capa) {
3803 			ret = os_snprintf(pos, end - pos, "%s%s",
3804 					  pos == buf ? "" : " ",
3805 					  ciphers[i].name);
3806 			if (os_snprintf_error(end - pos, ret))
3807 				return pos - buf;
3808 			pos += ret;
3809 		}
3810 	}
3811 
3812 	return pos - buf;
3813 }
3814 
3815 
3816 static int ctrl_iface_get_capability_group(int res, char *strict,
3817 					   struct wpa_driver_capa *capa,
3818 					   char *buf, size_t buflen)
3819 {
3820 	int ret;
3821 	char *pos, *end;
3822 	size_t len;
3823 	unsigned int i;
3824 
3825 	pos = buf;
3826 	end = pos + buflen;
3827 
3828 	if (res < 0) {
3829 		if (strict)
3830 			return 0;
3831 		len = os_strlcpy(buf, "CCMP TKIP WEP104 WEP40", buflen);
3832 		if (len >= buflen)
3833 			return -1;
3834 		return len;
3835 	}
3836 
3837 	for (i = 0; i < ARRAY_SIZE(ciphers); i++) {
3838 		if (capa->enc & ciphers[i].capa) {
3839 			ret = os_snprintf(pos, end - pos, "%s%s",
3840 					  pos == buf ? "" : " ",
3841 					  ciphers[i].name);
3842 			if (os_snprintf_error(end - pos, ret))
3843 				return pos - buf;
3844 			pos += ret;
3845 		}
3846 	}
3847 
3848 	return pos - buf;
3849 }
3850 
3851 
3852 static int ctrl_iface_get_capability_group_mgmt(int res, char *strict,
3853 						struct wpa_driver_capa *capa,
3854 						char *buf, size_t buflen)
3855 {
3856 	int ret;
3857 	char *pos, *end;
3858 	unsigned int i;
3859 
3860 	pos = buf;
3861 	end = pos + buflen;
3862 
3863 	if (res < 0)
3864 		return 0;
3865 
3866 	for (i = 0; i < ARRAY_SIZE(ciphers_group_mgmt); i++) {
3867 		if (capa->enc & ciphers_group_mgmt[i].capa) {
3868 			ret = os_snprintf(pos, end - pos, "%s%s",
3869 					  pos == buf ? "" : " ",
3870 					  ciphers_group_mgmt[i].name);
3871 			if (os_snprintf_error(end - pos, ret))
3872 				return pos - buf;
3873 			pos += ret;
3874 		}
3875 	}
3876 
3877 	return pos - buf;
3878 }
3879 
3880 
3881 static int ctrl_iface_get_capability_key_mgmt(int res, char *strict,
3882 					      struct wpa_driver_capa *capa,
3883 					      char *buf, size_t buflen)
3884 {
3885 	int ret;
3886 	char *pos, *end;
3887 	size_t len;
3888 
3889 	pos = buf;
3890 	end = pos + buflen;
3891 
3892 	if (res < 0) {
3893 		if (strict)
3894 			return 0;
3895 		len = os_strlcpy(buf, "WPA-PSK WPA-EAP IEEE8021X WPA-NONE "
3896 				 "NONE", buflen);
3897 		if (len >= buflen)
3898 			return -1;
3899 		return len;
3900 	}
3901 
3902 	ret = os_snprintf(pos, end - pos, "NONE IEEE8021X");
3903 	if (os_snprintf_error(end - pos, ret))
3904 		return pos - buf;
3905 	pos += ret;
3906 
3907 	if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
3908 			      WPA_DRIVER_CAPA_KEY_MGMT_WPA2)) {
3909 		ret = os_snprintf(pos, end - pos, " WPA-EAP");
3910 		if (os_snprintf_error(end - pos, ret))
3911 			return pos - buf;
3912 		pos += ret;
3913 	}
3914 
3915 	if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
3916 			      WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
3917 		ret = os_snprintf(pos, end - pos, " WPA-PSK");
3918 		if (os_snprintf_error(end - pos, ret))
3919 			return pos - buf;
3920 		pos += ret;
3921 	}
3922 
3923 	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE) {
3924 		ret = os_snprintf(pos, end - pos, " WPA-NONE");
3925 		if (os_snprintf_error(end - pos, ret))
3926 			return pos - buf;
3927 		pos += ret;
3928 	}
3929 
3930 #ifdef CONFIG_SUITEB
3931 	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B) {
3932 		ret = os_snprintf(pos, end - pos, " WPA-EAP-SUITE-B");
3933 		if (os_snprintf_error(end - pos, ret))
3934 			return pos - buf;
3935 		pos += ret;
3936 	}
3937 #endif /* CONFIG_SUITEB */
3938 #ifdef CONFIG_SUITEB192
3939 	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B_192) {
3940 		ret = os_snprintf(pos, end - pos, " WPA-EAP-SUITE-B-192");
3941 		if (os_snprintf_error(end - pos, ret))
3942 			return pos - buf;
3943 		pos += ret;
3944 	}
3945 #endif /* CONFIG_SUITEB192 */
3946 #ifdef CONFIG_OWE
3947 	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_OWE) {
3948 		ret = os_snprintf(pos, end - pos, " OWE");
3949 		if (os_snprintf_error(end - pos, ret))
3950 			return pos - buf;
3951 		pos += ret;
3952 	}
3953 #endif /* CONFIG_OWE */
3954 #ifdef CONFIG_DPP
3955 	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_DPP) {
3956 		ret = os_snprintf(pos, end - pos, " DPP");
3957 		if (os_snprintf_error(end - pos, ret))
3958 			return pos - buf;
3959 		pos += ret;
3960 	}
3961 #endif /* CONFIG_DPP */
3962 #ifdef CONFIG_FILS
3963 	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA256) {
3964 		ret = os_snprintf(pos, end - pos, " FILS-SHA256");
3965 		if (os_snprintf_error(end - pos, ret))
3966 			return pos - buf;
3967 		pos += ret;
3968 	}
3969 	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA384) {
3970 		ret = os_snprintf(pos, end - pos, " FILS-SHA384");
3971 		if (os_snprintf_error(end - pos, ret))
3972 			return pos - buf;
3973 		pos += ret;
3974 	}
3975 #ifdef CONFIG_IEEE80211R
3976 	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT_FILS_SHA256) {
3977 		ret = os_snprintf(pos, end - pos, " FT-FILS-SHA256");
3978 		if (os_snprintf_error(end - pos, ret))
3979 			return pos - buf;
3980 		pos += ret;
3981 	}
3982 	if (capa->key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_FT_FILS_SHA384) {
3983 		ret = os_snprintf(pos, end - pos, " FT-FILS-SHA384");
3984 		if (os_snprintf_error(end - pos, ret))
3985 			return pos - buf;
3986 		pos += ret;
3987 	}
3988 #endif /* CONFIG_IEEE80211R */
3989 #endif /* CONFIG_FILS */
3990 
3991 	return pos - buf;
3992 }
3993 
3994 
3995 static int ctrl_iface_get_capability_proto(int res, char *strict,
3996 					   struct wpa_driver_capa *capa,
3997 					   char *buf, size_t buflen)
3998 {
3999 	int ret;
4000 	char *pos, *end;
4001 	size_t len;
4002 
4003 	pos = buf;
4004 	end = pos + buflen;
4005 
4006 	if (res < 0) {
4007 		if (strict)
4008 			return 0;
4009 		len = os_strlcpy(buf, "RSN WPA", buflen);
4010 		if (len >= buflen)
4011 			return -1;
4012 		return len;
4013 	}
4014 
4015 	if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
4016 			      WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
4017 		ret = os_snprintf(pos, end - pos, "%sRSN",
4018 				  pos == buf ? "" : " ");
4019 		if (os_snprintf_error(end - pos, ret))
4020 			return pos - buf;
4021 		pos += ret;
4022 	}
4023 
4024 	if (capa->key_mgmt & (WPA_DRIVER_CAPA_KEY_MGMT_WPA |
4025 			      WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK)) {
4026 		ret = os_snprintf(pos, end - pos, "%sWPA",
4027 				  pos == buf ? "" : " ");
4028 		if (os_snprintf_error(end - pos, ret))
4029 			return pos - buf;
4030 		pos += ret;
4031 	}
4032 
4033 	return pos - buf;
4034 }
4035 
4036 
4037 static int ctrl_iface_get_capability_auth_alg(struct wpa_supplicant *wpa_s,
4038 					      int res, char *strict,
4039 					      struct wpa_driver_capa *capa,
4040 					      char *buf, size_t buflen)
4041 {
4042 	int ret;
4043 	char *pos, *end;
4044 	size_t len;
4045 
4046 	pos = buf;
4047 	end = pos + buflen;
4048 
4049 	if (res < 0) {
4050 		if (strict)
4051 			return 0;
4052 		len = os_strlcpy(buf, "OPEN SHARED LEAP", buflen);
4053 		if (len >= buflen)
4054 			return -1;
4055 		return len;
4056 	}
4057 
4058 	if (capa->auth & (WPA_DRIVER_AUTH_OPEN)) {
4059 		ret = os_snprintf(pos, end - pos, "%sOPEN",
4060 				  pos == buf ? "" : " ");
4061 		if (os_snprintf_error(end - pos, ret))
4062 			return pos - buf;
4063 		pos += ret;
4064 	}
4065 
4066 	if (capa->auth & (WPA_DRIVER_AUTH_SHARED)) {
4067 		ret = os_snprintf(pos, end - pos, "%sSHARED",
4068 				  pos == buf ? "" : " ");
4069 		if (os_snprintf_error(end - pos, ret))
4070 			return pos - buf;
4071 		pos += ret;
4072 	}
4073 
4074 	if (capa->auth & (WPA_DRIVER_AUTH_LEAP)) {
4075 		ret = os_snprintf(pos, end - pos, "%sLEAP",
4076 				  pos == buf ? "" : " ");
4077 		if (os_snprintf_error(end - pos, ret))
4078 			return pos - buf;
4079 		pos += ret;
4080 	}
4081 
4082 #ifdef CONFIG_SAE
4083 	if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE) {
4084 		ret = os_snprintf(pos, end - pos, "%sSAE",
4085 				  pos == buf ? "" : " ");
4086 		if (os_snprintf_error(end - pos, ret))
4087 			return pos - buf;
4088 		pos += ret;
4089 	}
4090 #endif /* CONFIG_SAE */
4091 
4092 #ifdef CONFIG_FILS
4093 	if (wpa_is_fils_supported(wpa_s)) {
4094 		ret = os_snprintf(pos, end - pos, "%sFILS_SK_WITHOUT_PFS",
4095 				  pos == buf ? "" : " ");
4096 		if (os_snprintf_error(end - pos, ret))
4097 			return pos - buf;
4098 		pos += ret;
4099 	}
4100 
4101 #ifdef CONFIG_FILS_SK_PFS
4102 	if (wpa_is_fils_sk_pfs_supported(wpa_s)) {
4103 		ret = os_snprintf(pos, end - pos, "%sFILS_SK_WITH_PFS",
4104 				  pos == buf ? "" : " ");
4105 		if (os_snprintf_error(end - pos, ret))
4106 			return pos - buf;
4107 		pos += ret;
4108 	}
4109 #endif /* CONFIG_FILS_SK_PFS */
4110 #endif /* CONFIG_FILS */
4111 
4112 	return pos - buf;
4113 }
4114 
4115 
4116 static int ctrl_iface_get_capability_modes(int res, char *strict,
4117 					   struct wpa_driver_capa *capa,
4118 					   char *buf, size_t buflen)
4119 {
4120 	int ret;
4121 	char *pos, *end;
4122 	size_t len;
4123 
4124 	pos = buf;
4125 	end = pos + buflen;
4126 
4127 	if (res < 0) {
4128 		if (strict)
4129 			return 0;
4130 		len = os_strlcpy(buf, "IBSS AP", buflen);
4131 		if (len >= buflen)
4132 			return -1;
4133 		return len;
4134 	}
4135 
4136 	if (capa->flags & WPA_DRIVER_FLAGS_IBSS) {
4137 		ret = os_snprintf(pos, end - pos, "%sIBSS",
4138 				  pos == buf ? "" : " ");
4139 		if (os_snprintf_error(end - pos, ret))
4140 			return pos - buf;
4141 		pos += ret;
4142 	}
4143 
4144 	if (capa->flags & WPA_DRIVER_FLAGS_AP) {
4145 		ret = os_snprintf(pos, end - pos, "%sAP",
4146 				  pos == buf ? "" : " ");
4147 		if (os_snprintf_error(end - pos, ret))
4148 			return pos - buf;
4149 		pos += ret;
4150 	}
4151 
4152 #ifdef CONFIG_MESH
4153 	if (capa->flags & WPA_DRIVER_FLAGS_MESH) {
4154 		ret = os_snprintf(pos, end - pos, "%sMESH",
4155 				  pos == buf ? "" : " ");
4156 		if (os_snprintf_error(end - pos, ret))
4157 			return pos - buf;
4158 		pos += ret;
4159 	}
4160 #endif /* CONFIG_MESH */
4161 
4162 	return pos - buf;
4163 }
4164 
4165 
4166 static int ctrl_iface_get_capability_channels(struct wpa_supplicant *wpa_s,
4167 					      char *buf, size_t buflen)
4168 {
4169 	struct hostapd_channel_data *chnl;
4170 	int ret, i, j;
4171 	char *pos, *end, *hmode;
4172 
4173 	pos = buf;
4174 	end = pos + buflen;
4175 
4176 	for (j = 0; j < wpa_s->hw.num_modes; j++) {
4177 		switch (wpa_s->hw.modes[j].mode) {
4178 		case HOSTAPD_MODE_IEEE80211B:
4179 			hmode = "B";
4180 			break;
4181 		case HOSTAPD_MODE_IEEE80211G:
4182 			hmode = "G";
4183 			break;
4184 		case HOSTAPD_MODE_IEEE80211A:
4185 			hmode = "A";
4186 			break;
4187 		case HOSTAPD_MODE_IEEE80211AD:
4188 			hmode = "AD";
4189 			break;
4190 		default:
4191 			continue;
4192 		}
4193 		ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:", hmode);
4194 		if (os_snprintf_error(end - pos, ret))
4195 			return pos - buf;
4196 		pos += ret;
4197 		chnl = wpa_s->hw.modes[j].channels;
4198 		for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
4199 			if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
4200 				continue;
4201 			ret = os_snprintf(pos, end - pos, " %d", chnl[i].chan);
4202 			if (os_snprintf_error(end - pos, ret))
4203 				return pos - buf;
4204 			pos += ret;
4205 		}
4206 		ret = os_snprintf(pos, end - pos, "\n");
4207 		if (os_snprintf_error(end - pos, ret))
4208 			return pos - buf;
4209 		pos += ret;
4210 	}
4211 
4212 	return pos - buf;
4213 }
4214 
4215 
4216 static int ctrl_iface_get_capability_freq(struct wpa_supplicant *wpa_s,
4217 					  char *buf, size_t buflen)
4218 {
4219 	struct hostapd_channel_data *chnl;
4220 	int ret, i, j;
4221 	char *pos, *end, *hmode;
4222 
4223 	pos = buf;
4224 	end = pos + buflen;
4225 
4226 	for (j = 0; j < wpa_s->hw.num_modes; j++) {
4227 		switch (wpa_s->hw.modes[j].mode) {
4228 		case HOSTAPD_MODE_IEEE80211B:
4229 			hmode = "B";
4230 			break;
4231 		case HOSTAPD_MODE_IEEE80211G:
4232 			hmode = "G";
4233 			break;
4234 		case HOSTAPD_MODE_IEEE80211A:
4235 			hmode = "A";
4236 			break;
4237 		case HOSTAPD_MODE_IEEE80211AD:
4238 			hmode = "AD";
4239 			break;
4240 		default:
4241 			continue;
4242 		}
4243 		ret = os_snprintf(pos, end - pos, "Mode[%s] Channels:\n",
4244 				  hmode);
4245 		if (os_snprintf_error(end - pos, ret))
4246 			return pos - buf;
4247 		pos += ret;
4248 		chnl = wpa_s->hw.modes[j].channels;
4249 		for (i = 0; i < wpa_s->hw.modes[j].num_channels; i++) {
4250 			if (chnl[i].flag & HOSTAPD_CHAN_DISABLED)
4251 				continue;
4252 			ret = os_snprintf(pos, end - pos, " %d = %d MHz%s%s\n",
4253 					  chnl[i].chan, chnl[i].freq,
4254 					  chnl[i].flag & HOSTAPD_CHAN_NO_IR ?
4255 					  " (NO_IR)" : "",
4256 					  chnl[i].flag & HOSTAPD_CHAN_RADAR ?
4257 					  " (DFS)" : "");
4258 
4259 			if (os_snprintf_error(end - pos, ret))
4260 				return pos - buf;
4261 			pos += ret;
4262 		}
4263 		ret = os_snprintf(pos, end - pos, "\n");
4264 		if (os_snprintf_error(end - pos, ret))
4265 			return pos - buf;
4266 		pos += ret;
4267 	}
4268 
4269 	return pos - buf;
4270 }
4271 
4272 
4273 static int wpa_supplicant_ctrl_iface_get_capability(
4274 	struct wpa_supplicant *wpa_s, const char *_field, char *buf,
4275 	size_t buflen)
4276 {
4277 	struct wpa_driver_capa capa;
4278 	int res;
4279 	char *strict;
4280 	char field[30];
4281 	size_t len;
4282 
4283 	/* Determine whether or not strict checking was requested */
4284 	len = os_strlcpy(field, _field, sizeof(field));
4285 	if (len >= sizeof(field))
4286 		return -1;
4287 	strict = os_strchr(field, ' ');
4288 	if (strict != NULL) {
4289 		*strict++ = '\0';
4290 		if (os_strcmp(strict, "strict") != 0)
4291 			return -1;
4292 	}
4293 
4294 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: GET_CAPABILITY '%s' %s",
4295 		field, strict ? strict : "");
4296 
4297 	if (os_strcmp(field, "eap") == 0) {
4298 		return eap_get_names(buf, buflen);
4299 	}
4300 
4301 	res = wpa_drv_get_capa(wpa_s, &capa);
4302 
4303 	if (os_strcmp(field, "pairwise") == 0)
4304 		return ctrl_iface_get_capability_pairwise(res, strict, &capa,
4305 							  buf, buflen);
4306 
4307 	if (os_strcmp(field, "group") == 0)
4308 		return ctrl_iface_get_capability_group(res, strict, &capa,
4309 						       buf, buflen);
4310 
4311 	if (os_strcmp(field, "group_mgmt") == 0)
4312 		return ctrl_iface_get_capability_group_mgmt(res, strict, &capa,
4313 							    buf, buflen);
4314 
4315 	if (os_strcmp(field, "key_mgmt") == 0)
4316 		return ctrl_iface_get_capability_key_mgmt(res, strict, &capa,
4317 							  buf, buflen);
4318 
4319 	if (os_strcmp(field, "proto") == 0)
4320 		return ctrl_iface_get_capability_proto(res, strict, &capa,
4321 						       buf, buflen);
4322 
4323 	if (os_strcmp(field, "auth_alg") == 0)
4324 		return ctrl_iface_get_capability_auth_alg(wpa_s, res, strict,
4325 							  &capa, buf, buflen);
4326 
4327 	if (os_strcmp(field, "modes") == 0)
4328 		return ctrl_iface_get_capability_modes(res, strict, &capa,
4329 						       buf, buflen);
4330 
4331 	if (os_strcmp(field, "channels") == 0)
4332 		return ctrl_iface_get_capability_channels(wpa_s, buf, buflen);
4333 
4334 	if (os_strcmp(field, "freq") == 0)
4335 		return ctrl_iface_get_capability_freq(wpa_s, buf, buflen);
4336 
4337 #ifdef CONFIG_TDLS
4338 	if (os_strcmp(field, "tdls") == 0)
4339 		return ctrl_iface_get_capability_tdls(wpa_s, buf, buflen);
4340 #endif /* CONFIG_TDLS */
4341 
4342 #ifdef CONFIG_ERP
4343 	if (os_strcmp(field, "erp") == 0) {
4344 		res = os_snprintf(buf, buflen, "ERP");
4345 		if (os_snprintf_error(buflen, res))
4346 			return -1;
4347 		return res;
4348 	}
4349 #endif /* CONFIG_EPR */
4350 
4351 #ifdef CONFIG_FIPS
4352 	if (os_strcmp(field, "fips") == 0) {
4353 		res = os_snprintf(buf, buflen, "FIPS");
4354 		if (os_snprintf_error(buflen, res))
4355 			return -1;
4356 		return res;
4357 	}
4358 #endif /* CONFIG_FIPS */
4359 
4360 #ifdef CONFIG_ACS
4361 	if (os_strcmp(field, "acs") == 0) {
4362 		res = os_snprintf(buf, buflen, "ACS");
4363 		if (os_snprintf_error(buflen, res))
4364 			return -1;
4365 		return res;
4366 	}
4367 #endif /* CONFIG_ACS */
4368 
4369 #ifdef CONFIG_FILS
4370 	if (os_strcmp(field, "fils") == 0) {
4371 #ifdef CONFIG_FILS_SK_PFS
4372 		if (wpa_is_fils_supported(wpa_s) &&
4373 		    wpa_is_fils_sk_pfs_supported(wpa_s)) {
4374 			res = os_snprintf(buf, buflen, "FILS FILS-SK-PFS");
4375 			if (os_snprintf_error(buflen, res))
4376 				return -1;
4377 			return res;
4378 		}
4379 #endif /* CONFIG_FILS_SK_PFS */
4380 
4381 		if (wpa_is_fils_supported(wpa_s)) {
4382 			res = os_snprintf(buf, buflen, "FILS");
4383 			if (os_snprintf_error(buflen, res))
4384 				return -1;
4385 			return res;
4386 		}
4387 	}
4388 #endif /* CONFIG_FILS */
4389 
4390 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown GET_CAPABILITY field '%s'",
4391 		   field);
4392 
4393 	return -1;
4394 }
4395 
4396 
4397 #ifdef CONFIG_INTERWORKING
4398 static char * anqp_add_hex(char *pos, char *end, const char *title,
4399 			   struct wpabuf *data)
4400 {
4401 	char *start = pos;
4402 	size_t i;
4403 	int ret;
4404 	const u8 *d;
4405 
4406 	if (data == NULL)
4407 		return start;
4408 
4409 	ret = os_snprintf(pos, end - pos, "%s=", title);
4410 	if (os_snprintf_error(end - pos, ret))
4411 		return start;
4412 	pos += ret;
4413 
4414 	d = wpabuf_head_u8(data);
4415 	for (i = 0; i < wpabuf_len(data); i++) {
4416 		ret = os_snprintf(pos, end - pos, "%02x", *d++);
4417 		if (os_snprintf_error(end - pos, ret))
4418 			return start;
4419 		pos += ret;
4420 	}
4421 
4422 	ret = os_snprintf(pos, end - pos, "\n");
4423 	if (os_snprintf_error(end - pos, ret))
4424 		return start;
4425 	pos += ret;
4426 
4427 	return pos;
4428 }
4429 #endif /* CONFIG_INTERWORKING */
4430 
4431 
4432 #ifdef CONFIG_FILS
4433 static int print_fils_indication(struct wpa_bss *bss, char *pos, char *end)
4434 {
4435 	char *start = pos;
4436 	const u8 *ie, *ie_end;
4437 	u16 info, realms;
4438 	int ret;
4439 
4440 	ie = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
4441 	if (!ie)
4442 		return 0;
4443 	ie_end = ie + 2 + ie[1];
4444 	ie += 2;
4445 	if (ie_end - ie < 2)
4446 		return -1;
4447 
4448 	info = WPA_GET_LE16(ie);
4449 	ie += 2;
4450 	ret = os_snprintf(pos, end - pos, "fils_info=%04x\n", info);
4451 	if (os_snprintf_error(end - pos, ret))
4452 		return 0;
4453 	pos += ret;
4454 
4455 	if (info & BIT(7)) {
4456 		/* Cache Identifier Included */
4457 		if (ie_end - ie < 2)
4458 			return -1;
4459 		ret = os_snprintf(pos, end - pos, "fils_cache_id=%02x%02x\n",
4460 				  ie[0], ie[1]);
4461 		if (os_snprintf_error(end - pos, ret))
4462 			return 0;
4463 		pos += ret;
4464 		ie += 2;
4465 	}
4466 
4467 	if (info & BIT(8)) {
4468 		/* HESSID Included */
4469 		if (ie_end - ie < ETH_ALEN)
4470 			return -1;
4471 		ret = os_snprintf(pos, end - pos, "fils_hessid=" MACSTR "\n",
4472 				  MAC2STR(ie));
4473 		if (os_snprintf_error(end - pos, ret))
4474 			return 0;
4475 		pos += ret;
4476 		ie += ETH_ALEN;
4477 	}
4478 
4479 	realms = (info & (BIT(3) | BIT(4) | BIT(5))) >> 3;
4480 	if (realms) {
4481 		if (ie_end - ie < realms * 2)
4482 			return -1;
4483 		ret = os_snprintf(pos, end - pos, "fils_realms=");
4484 		if (os_snprintf_error(end - pos, ret))
4485 			return 0;
4486 		pos += ret;
4487 
4488 		ret = wpa_snprintf_hex(pos, end - pos, ie, realms * 2);
4489 		if (ret <= 0)
4490 			return 0;
4491 		pos += ret;
4492 		ie += realms * 2;
4493 		ret = os_snprintf(pos, end - pos, "\n");
4494 		if (os_snprintf_error(end - pos, ret))
4495 			return 0;
4496 		pos += ret;
4497 	}
4498 
4499 	return pos - start;
4500 }
4501 #endif /* CONFIG_FILS */
4502 
4503 
4504 static int print_bss_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
4505 			  unsigned long mask, char *buf, size_t buflen)
4506 {
4507 	size_t i;
4508 	int ret;
4509 	char *pos, *end;
4510 	const u8 *ie, *ie2, *osen_ie, *mesh, *owe;
4511 
4512 	pos = buf;
4513 	end = buf + buflen;
4514 
4515 	if (mask & WPA_BSS_MASK_ID) {
4516 		ret = os_snprintf(pos, end - pos, "id=%u\n", bss->id);
4517 		if (os_snprintf_error(end - pos, ret))
4518 			return 0;
4519 		pos += ret;
4520 	}
4521 
4522 	if (mask & WPA_BSS_MASK_BSSID) {
4523 		ret = os_snprintf(pos, end - pos, "bssid=" MACSTR "\n",
4524 				  MAC2STR(bss->bssid));
4525 		if (os_snprintf_error(end - pos, ret))
4526 			return 0;
4527 		pos += ret;
4528 	}
4529 
4530 	if (mask & WPA_BSS_MASK_FREQ) {
4531 		ret = os_snprintf(pos, end - pos, "freq=%d\n", bss->freq);
4532 		if (os_snprintf_error(end - pos, ret))
4533 			return 0;
4534 		pos += ret;
4535 	}
4536 
4537 	if (mask & WPA_BSS_MASK_BEACON_INT) {
4538 		ret = os_snprintf(pos, end - pos, "beacon_int=%d\n",
4539 				  bss->beacon_int);
4540 		if (os_snprintf_error(end - pos, ret))
4541 			return 0;
4542 		pos += ret;
4543 	}
4544 
4545 	if (mask & WPA_BSS_MASK_CAPABILITIES) {
4546 		ret = os_snprintf(pos, end - pos, "capabilities=0x%04x\n",
4547 				  bss->caps);
4548 		if (os_snprintf_error(end - pos, ret))
4549 			return 0;
4550 		pos += ret;
4551 	}
4552 
4553 	if (mask & WPA_BSS_MASK_QUAL) {
4554 		ret = os_snprintf(pos, end - pos, "qual=%d\n", bss->qual);
4555 		if (os_snprintf_error(end - pos, ret))
4556 			return 0;
4557 		pos += ret;
4558 	}
4559 
4560 	if (mask & WPA_BSS_MASK_NOISE) {
4561 		ret = os_snprintf(pos, end - pos, "noise=%d\n", bss->noise);
4562 		if (os_snprintf_error(end - pos, ret))
4563 			return 0;
4564 		pos += ret;
4565 	}
4566 
4567 	if (mask & WPA_BSS_MASK_LEVEL) {
4568 		ret = os_snprintf(pos, end - pos, "level=%d\n", bss->level);
4569 		if (os_snprintf_error(end - pos, ret))
4570 			return 0;
4571 		pos += ret;
4572 	}
4573 
4574 	if (mask & WPA_BSS_MASK_TSF) {
4575 		ret = os_snprintf(pos, end - pos, "tsf=%016llu\n",
4576 				  (unsigned long long) bss->tsf);
4577 		if (os_snprintf_error(end - pos, ret))
4578 			return 0;
4579 		pos += ret;
4580 	}
4581 
4582 	if (mask & WPA_BSS_MASK_AGE) {
4583 		struct os_reltime now;
4584 
4585 		os_get_reltime(&now);
4586 		ret = os_snprintf(pos, end - pos, "age=%d\n",
4587 				  (int) (now.sec - bss->last_update.sec));
4588 		if (os_snprintf_error(end - pos, ret))
4589 			return 0;
4590 		pos += ret;
4591 	}
4592 
4593 	if (mask & WPA_BSS_MASK_IE) {
4594 		ret = os_snprintf(pos, end - pos, "ie=");
4595 		if (os_snprintf_error(end - pos, ret))
4596 			return 0;
4597 		pos += ret;
4598 
4599 		ie = (const u8 *) (bss + 1);
4600 		for (i = 0; i < bss->ie_len; i++) {
4601 			ret = os_snprintf(pos, end - pos, "%02x", *ie++);
4602 			if (os_snprintf_error(end - pos, ret))
4603 				return 0;
4604 			pos += ret;
4605 		}
4606 
4607 		ret = os_snprintf(pos, end - pos, "\n");
4608 		if (os_snprintf_error(end - pos, ret))
4609 			return 0;
4610 		pos += ret;
4611 	}
4612 
4613 	if (mask & WPA_BSS_MASK_FLAGS) {
4614 		ret = os_snprintf(pos, end - pos, "flags=");
4615 		if (os_snprintf_error(end - pos, ret))
4616 			return 0;
4617 		pos += ret;
4618 
4619 		mesh = wpa_bss_get_ie(bss, WLAN_EID_MESH_ID);
4620 
4621 		ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
4622 		if (ie)
4623 			pos = wpa_supplicant_ie_txt(pos, end, "WPA", ie,
4624 						    2 + ie[1]);
4625 		ie2 = wpa_bss_get_ie(bss, WLAN_EID_RSN);
4626 		if (ie2)
4627 			pos = wpa_supplicant_ie_txt(pos, end,
4628 						    mesh ? "RSN" : "WPA2", ie2,
4629 						    2 + ie2[1]);
4630 		osen_ie = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
4631 		if (osen_ie)
4632 			pos = wpa_supplicant_ie_txt(pos, end, "OSEN",
4633 						    osen_ie, 2 + osen_ie[1]);
4634 		owe = wpa_bss_get_vendor_ie(bss, OWE_IE_VENDOR_TYPE);
4635 		if (owe) {
4636 			ret = os_snprintf(
4637 				pos, end - pos,
4638 				ie2 ? "[OWE-TRANS]" : "[OWE-TRANS-OPEN]");
4639 			if (os_snprintf_error(end - pos, ret))
4640 				return 0;
4641 			pos += ret;
4642 		}
4643 		pos = wpa_supplicant_wps_ie_txt(wpa_s, pos, end, bss);
4644 		if (!ie && !ie2 && !osen_ie &&
4645 		    (bss->caps & IEEE80211_CAP_PRIVACY)) {
4646 			ret = os_snprintf(pos, end - pos, "[WEP]");
4647 			if (os_snprintf_error(end - pos, ret))
4648 				return 0;
4649 			pos += ret;
4650 		}
4651 
4652 		if (mesh) {
4653 			ret = os_snprintf(pos, end - pos, "[MESH]");
4654 			if (os_snprintf_error(end - pos, ret))
4655 				return 0;
4656 			pos += ret;
4657 		}
4658 
4659 		if (bss_is_dmg(bss)) {
4660 			const char *s;
4661 			ret = os_snprintf(pos, end - pos, "[DMG]");
4662 			if (os_snprintf_error(end - pos, ret))
4663 				return 0;
4664 			pos += ret;
4665 			switch (bss->caps & IEEE80211_CAP_DMG_MASK) {
4666 			case IEEE80211_CAP_DMG_IBSS:
4667 				s = "[IBSS]";
4668 				break;
4669 			case IEEE80211_CAP_DMG_AP:
4670 				s = "[ESS]";
4671 				break;
4672 			case IEEE80211_CAP_DMG_PBSS:
4673 				s = "[PBSS]";
4674 				break;
4675 			default:
4676 				s = "";
4677 				break;
4678 			}
4679 			ret = os_snprintf(pos, end - pos, "%s", s);
4680 			if (os_snprintf_error(end - pos, ret))
4681 				return 0;
4682 			pos += ret;
4683 		} else {
4684 			if (bss->caps & IEEE80211_CAP_IBSS) {
4685 				ret = os_snprintf(pos, end - pos, "[IBSS]");
4686 				if (os_snprintf_error(end - pos, ret))
4687 					return 0;
4688 				pos += ret;
4689 			}
4690 			if (bss->caps & IEEE80211_CAP_ESS) {
4691 				ret = os_snprintf(pos, end - pos, "[ESS]");
4692 				if (os_snprintf_error(end - pos, ret))
4693 					return 0;
4694 				pos += ret;
4695 			}
4696 		}
4697 		if (wpa_bss_get_vendor_ie(bss, P2P_IE_VENDOR_TYPE) ||
4698 		    wpa_bss_get_vendor_ie_beacon(bss, P2P_IE_VENDOR_TYPE)) {
4699 			ret = os_snprintf(pos, end - pos, "[P2P]");
4700 			if (os_snprintf_error(end - pos, ret))
4701 				return 0;
4702 			pos += ret;
4703 		}
4704 #ifdef CONFIG_HS20
4705 		if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
4706 			ret = os_snprintf(pos, end - pos, "[HS20]");
4707 			if (os_snprintf_error(end - pos, ret))
4708 				return 0;
4709 			pos += ret;
4710 		}
4711 #endif /* CONFIG_HS20 */
4712 #ifdef CONFIG_FILS
4713 		if (wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION)) {
4714 			ret = os_snprintf(pos, end - pos, "[FILS]");
4715 			if (os_snprintf_error(end - pos, ret))
4716 				return 0;
4717 			pos += ret;
4718 		}
4719 #endif /* CONFIG_FILS */
4720 
4721 		ret = os_snprintf(pos, end - pos, "\n");
4722 		if (os_snprintf_error(end - pos, ret))
4723 			return 0;
4724 		pos += ret;
4725 	}
4726 
4727 	if (mask & WPA_BSS_MASK_SSID) {
4728 		ret = os_snprintf(pos, end - pos, "ssid=%s\n",
4729 				  wpa_ssid_txt(bss->ssid, bss->ssid_len));
4730 		if (os_snprintf_error(end - pos, ret))
4731 			return 0;
4732 		pos += ret;
4733 	}
4734 
4735 #ifdef CONFIG_WPS
4736 	if (mask & WPA_BSS_MASK_WPS_SCAN) {
4737 		ie = (const u8 *) (bss + 1);
4738 		ret = wpas_wps_scan_result_text(ie, bss->ie_len, pos, end);
4739 		if (ret >= end - pos)
4740 			return 0;
4741 		if (ret > 0)
4742 			pos += ret;
4743 	}
4744 #endif /* CONFIG_WPS */
4745 
4746 #ifdef CONFIG_P2P
4747 	if (mask & WPA_BSS_MASK_P2P_SCAN) {
4748 		ie = (const u8 *) (bss + 1);
4749 		ret = wpas_p2p_scan_result_text(ie, bss->ie_len, pos, end);
4750 		if (ret >= end - pos)
4751 			return 0;
4752 		if (ret > 0)
4753 			pos += ret;
4754 	}
4755 #endif /* CONFIG_P2P */
4756 
4757 #ifdef CONFIG_WIFI_DISPLAY
4758 	if (mask & WPA_BSS_MASK_WIFI_DISPLAY) {
4759 		struct wpabuf *wfd;
4760 		ie = (const u8 *) (bss + 1);
4761 		wfd = ieee802_11_vendor_ie_concat(ie, bss->ie_len,
4762 						  WFD_IE_VENDOR_TYPE);
4763 		if (wfd) {
4764 			ret = os_snprintf(pos, end - pos, "wfd_subelems=");
4765 			if (os_snprintf_error(end - pos, ret)) {
4766 				wpabuf_free(wfd);
4767 				return 0;
4768 			}
4769 			pos += ret;
4770 
4771 			pos += wpa_snprintf_hex(pos, end - pos,
4772 						wpabuf_head(wfd),
4773 						wpabuf_len(wfd));
4774 			wpabuf_free(wfd);
4775 
4776 			ret = os_snprintf(pos, end - pos, "\n");
4777 			if (os_snprintf_error(end - pos, ret))
4778 				return 0;
4779 			pos += ret;
4780 		}
4781 	}
4782 #endif /* CONFIG_WIFI_DISPLAY */
4783 
4784 #ifdef CONFIG_INTERWORKING
4785 	if ((mask & WPA_BSS_MASK_INTERNETW) && bss->anqp) {
4786 		struct wpa_bss_anqp *anqp = bss->anqp;
4787 		struct wpa_bss_anqp_elem *elem;
4788 
4789 		pos = anqp_add_hex(pos, end, "anqp_capability_list",
4790 				   anqp->capability_list);
4791 		pos = anqp_add_hex(pos, end, "anqp_venue_name",
4792 				   anqp->venue_name);
4793 		pos = anqp_add_hex(pos, end, "anqp_network_auth_type",
4794 				   anqp->network_auth_type);
4795 		pos = anqp_add_hex(pos, end, "anqp_roaming_consortium",
4796 				   anqp->roaming_consortium);
4797 		pos = anqp_add_hex(pos, end, "anqp_ip_addr_type_availability",
4798 				   anqp->ip_addr_type_availability);
4799 		pos = anqp_add_hex(pos, end, "anqp_nai_realm",
4800 				   anqp->nai_realm);
4801 		pos = anqp_add_hex(pos, end, "anqp_3gpp", anqp->anqp_3gpp);
4802 		pos = anqp_add_hex(pos, end, "anqp_domain_name",
4803 				   anqp->domain_name);
4804 		pos = anqp_add_hex(pos, end, "anqp_fils_realm_info",
4805 				   anqp->fils_realm_info);
4806 #ifdef CONFIG_HS20
4807 		pos = anqp_add_hex(pos, end, "hs20_capability_list",
4808 				   anqp->hs20_capability_list);
4809 		pos = anqp_add_hex(pos, end, "hs20_operator_friendly_name",
4810 				   anqp->hs20_operator_friendly_name);
4811 		pos = anqp_add_hex(pos, end, "hs20_wan_metrics",
4812 				   anqp->hs20_wan_metrics);
4813 		pos = anqp_add_hex(pos, end, "hs20_connection_capability",
4814 				   anqp->hs20_connection_capability);
4815 		pos = anqp_add_hex(pos, end, "hs20_operating_class",
4816 				   anqp->hs20_operating_class);
4817 		pos = anqp_add_hex(pos, end, "hs20_osu_providers_list",
4818 				   anqp->hs20_osu_providers_list);
4819 		pos = anqp_add_hex(pos, end, "hs20_operator_icon_metadata",
4820 				   anqp->hs20_operator_icon_metadata);
4821 		pos = anqp_add_hex(pos, end, "hs20_osu_providers_nai_list",
4822 				   anqp->hs20_osu_providers_nai_list);
4823 #endif /* CONFIG_HS20 */
4824 
4825 		dl_list_for_each(elem, &anqp->anqp_elems,
4826 				 struct wpa_bss_anqp_elem, list) {
4827 			char title[20];
4828 
4829 			os_snprintf(title, sizeof(title), "anqp[%u]",
4830 				    elem->infoid);
4831 			pos = anqp_add_hex(pos, end, title, elem->payload);
4832 		}
4833 	}
4834 #endif /* CONFIG_INTERWORKING */
4835 
4836 #ifdef CONFIG_MESH
4837 	if (mask & WPA_BSS_MASK_MESH_SCAN) {
4838 		ie = (const u8 *) (bss + 1);
4839 		ret = wpas_mesh_scan_result_text(ie, bss->ie_len, pos, end);
4840 		if (ret >= end - pos)
4841 			return 0;
4842 		if (ret > 0)
4843 			pos += ret;
4844 	}
4845 #endif /* CONFIG_MESH */
4846 
4847 	if (mask & WPA_BSS_MASK_SNR) {
4848 		ret = os_snprintf(pos, end - pos, "snr=%d\n", bss->snr);
4849 		if (os_snprintf_error(end - pos, ret))
4850 			return 0;
4851 		pos += ret;
4852 	}
4853 
4854 	if (mask & WPA_BSS_MASK_EST_THROUGHPUT) {
4855 		ret = os_snprintf(pos, end - pos, "est_throughput=%d\n",
4856 				  bss->est_throughput);
4857 		if (os_snprintf_error(end - pos, ret))
4858 			return 0;
4859 		pos += ret;
4860 	}
4861 
4862 #ifdef CONFIG_FST
4863 	if (mask & WPA_BSS_MASK_FST) {
4864 		ret = fst_ctrl_iface_mb_info(bss->bssid, pos, end - pos);
4865 		if (ret < 0 || ret >= end - pos)
4866 			return 0;
4867 		pos += ret;
4868 	}
4869 #endif /* CONFIG_FST */
4870 
4871 	if (mask & WPA_BSS_MASK_UPDATE_IDX) {
4872 		ret = os_snprintf(pos, end - pos, "update_idx=%u\n",
4873 				  bss->last_update_idx);
4874 		if (os_snprintf_error(end - pos, ret))
4875 			return 0;
4876 		pos += ret;
4877 	}
4878 
4879 	if ((mask & WPA_BSS_MASK_BEACON_IE) && bss->beacon_ie_len) {
4880 		ret = os_snprintf(pos, end - pos, "beacon_ie=");
4881 		if (os_snprintf_error(end - pos, ret))
4882 			return 0;
4883 		pos += ret;
4884 
4885 		ie = (const u8 *) (bss + 1);
4886 		ie += bss->ie_len;
4887 		for (i = 0; i < bss->beacon_ie_len; i++) {
4888 			ret = os_snprintf(pos, end - pos, "%02x", *ie++);
4889 			if (os_snprintf_error(end - pos, ret))
4890 				return 0;
4891 			pos += ret;
4892 		}
4893 
4894 		ret = os_snprintf(pos, end - pos, "\n");
4895 		if (os_snprintf_error(end - pos, ret))
4896 			return 0;
4897 		pos += ret;
4898 	}
4899 
4900 #ifdef CONFIG_FILS
4901 	if (mask & WPA_BSS_MASK_FILS_INDICATION) {
4902 		ret = print_fils_indication(bss, pos, end);
4903 		if (ret < 0)
4904 			return 0;
4905 		pos += ret;
4906 	}
4907 #endif /* CONFIG_FILS */
4908 
4909 	if (mask & WPA_BSS_MASK_DELIM) {
4910 		ret = os_snprintf(pos, end - pos, "====\n");
4911 		if (os_snprintf_error(end - pos, ret))
4912 			return 0;
4913 		pos += ret;
4914 	}
4915 
4916 	return pos - buf;
4917 }
4918 
4919 
4920 static int wpa_supplicant_ctrl_iface_bss(struct wpa_supplicant *wpa_s,
4921 					 const char *cmd, char *buf,
4922 					 size_t buflen)
4923 {
4924 	u8 bssid[ETH_ALEN];
4925 	size_t i;
4926 	struct wpa_bss *bss;
4927 	struct wpa_bss *bsslast = NULL;
4928 	struct dl_list *next;
4929 	int ret = 0;
4930 	int len;
4931 	char *ctmp, *end = buf + buflen;
4932 	unsigned long mask = WPA_BSS_MASK_ALL;
4933 
4934 	if (os_strncmp(cmd, "RANGE=", 6) == 0) {
4935 		if (os_strncmp(cmd + 6, "ALL", 3) == 0) {
4936 			bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss,
4937 					    list_id);
4938 			bsslast = dl_list_last(&wpa_s->bss_id, struct wpa_bss,
4939 					       list_id);
4940 		} else { /* N1-N2 */
4941 			unsigned int id1, id2;
4942 
4943 			if ((ctmp = os_strchr(cmd + 6, '-')) == NULL) {
4944 				wpa_printf(MSG_INFO, "Wrong BSS range "
4945 					   "format");
4946 				return 0;
4947 			}
4948 
4949 			if (*(cmd + 6) == '-')
4950 				id1 = 0;
4951 			else
4952 				id1 = atoi(cmd + 6);
4953 			ctmp++;
4954 			if (*ctmp >= '0' && *ctmp <= '9')
4955 				id2 = atoi(ctmp);
4956 			else
4957 				id2 = (unsigned int) -1;
4958 			bss = wpa_bss_get_id_range(wpa_s, id1, id2);
4959 			if (id2 == (unsigned int) -1)
4960 				bsslast = dl_list_last(&wpa_s->bss_id,
4961 						       struct wpa_bss,
4962 						       list_id);
4963 			else {
4964 				bsslast = wpa_bss_get_id(wpa_s, id2);
4965 				if (bsslast == NULL && bss && id2 > id1) {
4966 					struct wpa_bss *tmp = bss;
4967 					for (;;) {
4968 						next = tmp->list_id.next;
4969 						if (next == &wpa_s->bss_id)
4970 							break;
4971 						tmp = dl_list_entry(
4972 							next, struct wpa_bss,
4973 							list_id);
4974 						if (tmp->id > id2)
4975 							break;
4976 						bsslast = tmp;
4977 					}
4978 				}
4979 			}
4980 		}
4981 	} else if (os_strncmp(cmd, "FIRST", 5) == 0)
4982 		bss = dl_list_first(&wpa_s->bss_id, struct wpa_bss, list_id);
4983 	else if (os_strncmp(cmd, "LAST", 4) == 0)
4984 		bss = dl_list_last(&wpa_s->bss_id, struct wpa_bss, list_id);
4985 	else if (os_strncmp(cmd, "ID-", 3) == 0) {
4986 		i = atoi(cmd + 3);
4987 		bss = wpa_bss_get_id(wpa_s, i);
4988 	} else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
4989 		i = atoi(cmd + 5);
4990 		bss = wpa_bss_get_id(wpa_s, i);
4991 		if (bss) {
4992 			next = bss->list_id.next;
4993 			if (next == &wpa_s->bss_id)
4994 				bss = NULL;
4995 			else
4996 				bss = dl_list_entry(next, struct wpa_bss,
4997 						    list_id);
4998 		}
4999 	} else if (os_strncmp(cmd, "CURRENT", 7) == 0) {
5000 		bss = wpa_s->current_bss;
5001 #ifdef CONFIG_P2P
5002 	} else if (os_strncmp(cmd, "p2p_dev_addr=", 13) == 0) {
5003 		if (hwaddr_aton(cmd + 13, bssid) == 0)
5004 			bss = wpa_bss_get_p2p_dev_addr(wpa_s, bssid);
5005 		else
5006 			bss = NULL;
5007 #endif /* CONFIG_P2P */
5008 	} else if (hwaddr_aton(cmd, bssid) == 0)
5009 		bss = wpa_bss_get_bssid(wpa_s, bssid);
5010 	else {
5011 		struct wpa_bss *tmp;
5012 		i = atoi(cmd);
5013 		bss = NULL;
5014 		dl_list_for_each(tmp, &wpa_s->bss_id, struct wpa_bss, list_id)
5015 		{
5016 			if (i-- == 0) {
5017 				bss = tmp;
5018 				break;
5019 			}
5020 		}
5021 	}
5022 
5023 	if ((ctmp = os_strstr(cmd, "MASK=")) != NULL) {
5024 		mask = strtoul(ctmp + 5, NULL, 0x10);
5025 		if (mask == 0)
5026 			mask = WPA_BSS_MASK_ALL;
5027 	}
5028 
5029 	if (bss == NULL)
5030 		return 0;
5031 
5032 	if (bsslast == NULL)
5033 		bsslast = bss;
5034 	do {
5035 		len = print_bss_info(wpa_s, bss, mask, buf, buflen);
5036 		ret += len;
5037 		buf += len;
5038 		buflen -= len;
5039 		if (bss == bsslast) {
5040 			if ((mask & WPA_BSS_MASK_DELIM) && len &&
5041 			    (bss == dl_list_last(&wpa_s->bss_id,
5042 						 struct wpa_bss, list_id))) {
5043 				int res;
5044 
5045 				res = os_snprintf(buf - 5, end - buf + 5,
5046 						  "####\n");
5047 				if (os_snprintf_error(end - buf + 5, res)) {
5048 					wpa_printf(MSG_DEBUG,
5049 						   "Could not add end delim");
5050 				}
5051 			}
5052 			break;
5053 		}
5054 		next = bss->list_id.next;
5055 		if (next == &wpa_s->bss_id)
5056 			break;
5057 		bss = dl_list_entry(next, struct wpa_bss, list_id);
5058 	} while (bss && len);
5059 
5060 	return ret;
5061 }
5062 
5063 
5064 static int wpa_supplicant_ctrl_iface_ap_scan(
5065 	struct wpa_supplicant *wpa_s, char *cmd)
5066 {
5067 	int ap_scan = atoi(cmd);
5068 	return wpa_supplicant_set_ap_scan(wpa_s, ap_scan);
5069 }
5070 
5071 
5072 static int wpa_supplicant_ctrl_iface_scan_interval(
5073 	struct wpa_supplicant *wpa_s, char *cmd)
5074 {
5075 	int scan_int = atoi(cmd);
5076 	return wpa_supplicant_set_scan_interval(wpa_s, scan_int);
5077 }
5078 
5079 
5080 static int wpa_supplicant_ctrl_iface_bss_expire_age(
5081 	struct wpa_supplicant *wpa_s, char *cmd)
5082 {
5083 	int expire_age = atoi(cmd);
5084 	return wpa_supplicant_set_bss_expiration_age(wpa_s, expire_age);
5085 }
5086 
5087 
5088 static int wpa_supplicant_ctrl_iface_bss_expire_count(
5089 	struct wpa_supplicant *wpa_s, char *cmd)
5090 {
5091 	int expire_count = atoi(cmd);
5092 	return wpa_supplicant_set_bss_expiration_count(wpa_s, expire_count);
5093 }
5094 
5095 
5096 static void wpa_supplicant_ctrl_iface_bss_flush(
5097 	struct wpa_supplicant *wpa_s, char *cmd)
5098 {
5099 	int flush_age = atoi(cmd);
5100 
5101 	if (flush_age == 0)
5102 		wpa_bss_flush(wpa_s);
5103 	else
5104 		wpa_bss_flush_by_age(wpa_s, flush_age);
5105 }
5106 
5107 
5108 #ifdef CONFIG_TESTING_OPTIONS
5109 static void wpa_supplicant_ctrl_iface_drop_sa(struct wpa_supplicant *wpa_s)
5110 {
5111 	wpa_printf(MSG_DEBUG, "Dropping SA without deauthentication");
5112 	/* MLME-DELETEKEYS.request */
5113 	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 0, 0, NULL, 0, NULL, 0);
5114 	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 1, 0, NULL, 0, NULL, 0);
5115 	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 2, 0, NULL, 0, NULL, 0);
5116 	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 3, 0, NULL, 0, NULL, 0);
5117 #ifdef CONFIG_IEEE80211W
5118 	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 4, 0, NULL, 0, NULL, 0);
5119 	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, 5, 0, NULL, 0, NULL, 0);
5120 #endif /* CONFIG_IEEE80211W */
5121 
5122 	wpa_drv_set_key(wpa_s, WPA_ALG_NONE, wpa_s->bssid, 0, 0, NULL, 0, NULL,
5123 			0);
5124 	/* MLME-SETPROTECTION.request(None) */
5125 	wpa_drv_mlme_setprotection(wpa_s, wpa_s->bssid,
5126 				   MLME_SETPROTECTION_PROTECT_TYPE_NONE,
5127 				   MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
5128 	wpa_sm_drop_sa(wpa_s->wpa);
5129 }
5130 #endif /* CONFIG_TESTING_OPTIONS */
5131 
5132 
5133 static int wpa_supplicant_ctrl_iface_roam(struct wpa_supplicant *wpa_s,
5134 					  char *addr)
5135 {
5136 #ifdef CONFIG_NO_SCAN_PROCESSING
5137 	return -1;
5138 #else /* CONFIG_NO_SCAN_PROCESSING */
5139 	u8 bssid[ETH_ALEN];
5140 	struct wpa_bss *bss;
5141 	struct wpa_ssid *ssid = wpa_s->current_ssid;
5142 
5143 	if (hwaddr_aton(addr, bssid)) {
5144 		wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: invalid "
5145 			   "address '%s'", addr);
5146 		return -1;
5147 	}
5148 
5149 	wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM " MACSTR, MAC2STR(bssid));
5150 
5151 	if (!ssid) {
5152 		wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: No network "
5153 			   "configuration known for the target AP");
5154 		return -1;
5155 	}
5156 
5157 	bss = wpa_bss_get(wpa_s, bssid, ssid->ssid, ssid->ssid_len);
5158 	if (!bss) {
5159 		wpa_printf(MSG_DEBUG, "CTRL_IFACE ROAM: Target AP not found "
5160 			   "from BSS table");
5161 		return -1;
5162 	}
5163 
5164 	/*
5165 	 * TODO: Find best network configuration block from configuration to
5166 	 * allow roaming to other networks
5167 	 */
5168 
5169 	wpa_s->reassociate = 1;
5170 	wpa_supplicant_connect(wpa_s, bss, ssid);
5171 
5172 	return 0;
5173 #endif /* CONFIG_NO_SCAN_PROCESSING */
5174 }
5175 
5176 
5177 #ifdef CONFIG_P2P
5178 static int p2p_ctrl_find(struct wpa_supplicant *wpa_s, char *cmd)
5179 {
5180 	unsigned int timeout = atoi(cmd);
5181 	enum p2p_discovery_type type = P2P_FIND_START_WITH_FULL;
5182 	u8 dev_id[ETH_ALEN], *_dev_id = NULL;
5183 	u8 dev_type[WPS_DEV_TYPE_LEN], *_dev_type = NULL;
5184 	char *pos;
5185 	unsigned int search_delay;
5186 	const char *_seek[P2P_MAX_QUERY_HASH + 1], **seek = NULL;
5187 	u8 seek_count = 0;
5188 	int freq = 0;
5189 
5190 	if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
5191 		wpa_dbg(wpa_s, MSG_INFO,
5192 			"Reject P2P_FIND since interface is disabled");
5193 		return -1;
5194 	}
5195 	if (os_strstr(cmd, "type=social"))
5196 		type = P2P_FIND_ONLY_SOCIAL;
5197 	else if (os_strstr(cmd, "type=progressive"))
5198 		type = P2P_FIND_PROGRESSIVE;
5199 
5200 	pos = os_strstr(cmd, "dev_id=");
5201 	if (pos) {
5202 		pos += 7;
5203 		if (hwaddr_aton(pos, dev_id))
5204 			return -1;
5205 		_dev_id = dev_id;
5206 	}
5207 
5208 	pos = os_strstr(cmd, "dev_type=");
5209 	if (pos) {
5210 		pos += 9;
5211 		if (wps_dev_type_str2bin(pos, dev_type) < 0)
5212 			return -1;
5213 		_dev_type = dev_type;
5214 	}
5215 
5216 	pos = os_strstr(cmd, "delay=");
5217 	if (pos) {
5218 		pos += 6;
5219 		search_delay = atoi(pos);
5220 	} else
5221 		search_delay = wpas_p2p_search_delay(wpa_s);
5222 
5223 	pos = os_strstr(cmd, "freq=");
5224 	if (pos) {
5225 		pos += 5;
5226 		freq = atoi(pos);
5227 		if (freq <= 0)
5228 			return -1;
5229 	}
5230 
5231 	/* Must be searched for last, because it adds nul termination */
5232 	pos = os_strstr(cmd, " seek=");
5233 	if (pos)
5234 		pos += 6;
5235 	while (pos && seek_count < P2P_MAX_QUERY_HASH + 1) {
5236 		char *term;
5237 
5238 		_seek[seek_count++] = pos;
5239 		seek = _seek;
5240 		term = os_strchr(pos, ' ');
5241 		if (!term)
5242 			break;
5243 		*term = '\0';
5244 		pos = os_strstr(term + 1, "seek=");
5245 		if (pos)
5246 			pos += 5;
5247 	}
5248 	if (seek_count > P2P_MAX_QUERY_HASH) {
5249 		seek[0] = NULL;
5250 		seek_count = 1;
5251 	}
5252 
5253 	return wpas_p2p_find(wpa_s, timeout, type, _dev_type != NULL, _dev_type,
5254 			     _dev_id, search_delay, seek_count, seek, freq);
5255 }
5256 
5257 
5258 static int p2ps_ctrl_parse_cpt_priority(const char *pos, u8 *cpt)
5259 {
5260 	const char *last = NULL;
5261 	const char *token;
5262 	long int token_len;
5263 	unsigned int i;
5264 
5265 	/* Expected predefined CPT names delimited by ':' */
5266 	for (i = 0; (token = cstr_token(pos, ": \t", &last)); i++) {
5267 		if (i >= P2PS_FEATURE_CAPAB_CPT_MAX) {
5268 			wpa_printf(MSG_ERROR,
5269 				   "P2PS: CPT name list is too long, expected up to %d names",
5270 				   P2PS_FEATURE_CAPAB_CPT_MAX);
5271 			cpt[0] = 0;
5272 			return -1;
5273 		}
5274 
5275 		token_len = last - token;
5276 
5277 		if (token_len  == 3 &&
5278 		    os_memcmp(token, "UDP", token_len) == 0) {
5279 			cpt[i] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
5280 		} else if (token_len == 3 &&
5281 			   os_memcmp(token, "MAC", token_len) == 0) {
5282 			cpt[i] = P2PS_FEATURE_CAPAB_MAC_TRANSPORT;
5283 		} else {
5284 			wpa_printf(MSG_ERROR,
5285 				   "P2PS: Unsupported CPT name '%s'", token);
5286 			cpt[0] = 0;
5287 			return -1;
5288 		}
5289 
5290 		if (isblank((unsigned char) *last)) {
5291 			i++;
5292 			break;
5293 		}
5294 	}
5295 	cpt[i] = 0;
5296 	return 0;
5297 }
5298 
5299 
5300 static struct p2ps_provision * p2p_parse_asp_provision_cmd(const char *cmd)
5301 {
5302 	struct p2ps_provision *p2ps_prov;
5303 	char *pos;
5304 	size_t info_len = 0;
5305 	char *info = NULL;
5306 	u8 role = P2PS_SETUP_NONE;
5307 	long long unsigned val;
5308 	int i;
5309 
5310 	pos = os_strstr(cmd, "info=");
5311 	if (pos) {
5312 		pos += 5;
5313 		info_len = os_strlen(pos);
5314 
5315 		if (info_len) {
5316 			info = os_malloc(info_len + 1);
5317 			if (info) {
5318 				info_len = utf8_unescape(pos, info_len,
5319 							 info, info_len + 1);
5320 			} else
5321 				info_len = 0;
5322 		}
5323 	}
5324 
5325 	p2ps_prov = os_zalloc(sizeof(struct p2ps_provision) + info_len + 1);
5326 	if (p2ps_prov == NULL) {
5327 		os_free(info);
5328 		return NULL;
5329 	}
5330 
5331 	if (info) {
5332 		os_memcpy(p2ps_prov->info, info, info_len);
5333 		p2ps_prov->info[info_len] = '\0';
5334 		os_free(info);
5335 	}
5336 
5337 	pos = os_strstr(cmd, "status=");
5338 	if (pos)
5339 		p2ps_prov->status = atoi(pos + 7);
5340 	else
5341 		p2ps_prov->status = -1;
5342 
5343 	pos = os_strstr(cmd, "adv_id=");
5344 	if (!pos || sscanf(pos + 7, "%llx", &val) != 1 || val > 0xffffffffULL)
5345 		goto invalid_args;
5346 	p2ps_prov->adv_id = val;
5347 
5348 	pos = os_strstr(cmd, "method=");
5349 	if (pos)
5350 		p2ps_prov->method = strtol(pos + 7, NULL, 16);
5351 	else
5352 		p2ps_prov->method = 0;
5353 
5354 	pos = os_strstr(cmd, "session=");
5355 	if (!pos || sscanf(pos + 8, "%llx", &val) != 1 || val > 0xffffffffULL)
5356 		goto invalid_args;
5357 	p2ps_prov->session_id = val;
5358 
5359 	pos = os_strstr(cmd, "adv_mac=");
5360 	if (!pos || hwaddr_aton(pos + 8, p2ps_prov->adv_mac))
5361 		goto invalid_args;
5362 
5363 	pos = os_strstr(cmd, "session_mac=");
5364 	if (!pos || hwaddr_aton(pos + 12, p2ps_prov->session_mac))
5365 		goto invalid_args;
5366 
5367 	pos = os_strstr(cmd, "cpt=");
5368 	if (pos) {
5369 		if (p2ps_ctrl_parse_cpt_priority(pos + 4,
5370 						 p2ps_prov->cpt_priority))
5371 			goto invalid_args;
5372 	} else {
5373 		p2ps_prov->cpt_priority[0] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
5374 	}
5375 
5376 	for (i = 0; p2ps_prov->cpt_priority[i]; i++)
5377 		p2ps_prov->cpt_mask |= p2ps_prov->cpt_priority[i];
5378 
5379 	/* force conncap with tstCap (no sanity checks) */
5380 	pos = os_strstr(cmd, "tstCap=");
5381 	if (pos) {
5382 		role = strtol(pos + 7, NULL, 16);
5383 	} else {
5384 		pos = os_strstr(cmd, "role=");
5385 		if (pos) {
5386 			role = strtol(pos + 5, NULL, 16);
5387 			if (role != P2PS_SETUP_CLIENT &&
5388 			    role != P2PS_SETUP_GROUP_OWNER)
5389 				role = P2PS_SETUP_NONE;
5390 		}
5391 	}
5392 	p2ps_prov->role = role;
5393 
5394 	return p2ps_prov;
5395 
5396 invalid_args:
5397 	os_free(p2ps_prov);
5398 	return NULL;
5399 }
5400 
5401 
5402 static int p2p_ctrl_asp_provision_resp(struct wpa_supplicant *wpa_s, char *cmd)
5403 {
5404 	u8 addr[ETH_ALEN];
5405 	struct p2ps_provision *p2ps_prov;
5406 	char *pos;
5407 
5408 	/* <addr> id=<adv_id> [role=<conncap>] [info=<infodata>] */
5409 
5410 	wpa_printf(MSG_DEBUG, "%s: %s", __func__, cmd);
5411 
5412 	if (hwaddr_aton(cmd, addr))
5413 		return -1;
5414 
5415 	pos = cmd + 17;
5416 	if (*pos != ' ')
5417 		return -1;
5418 
5419 	p2ps_prov = p2p_parse_asp_provision_cmd(pos);
5420 	if (!p2ps_prov)
5421 		return -1;
5422 
5423 	if (p2ps_prov->status < 0) {
5424 		os_free(p2ps_prov);
5425 		return -1;
5426 	}
5427 
5428 	return wpas_p2p_prov_disc(wpa_s, addr, NULL, WPAS_P2P_PD_FOR_ASP,
5429 				  p2ps_prov);
5430 }
5431 
5432 
5433 static int p2p_ctrl_asp_provision(struct wpa_supplicant *wpa_s, char *cmd)
5434 {
5435 	u8 addr[ETH_ALEN];
5436 	struct p2ps_provision *p2ps_prov;
5437 	char *pos;
5438 
5439 	/* <addr> id=<adv_id> adv_mac=<adv_mac> conncap=<conncap>
5440 	 *        session=<ses_id> mac=<ses_mac> [info=<infodata>]
5441 	 */
5442 
5443 	wpa_printf(MSG_DEBUG, "%s: %s", __func__, cmd);
5444 	if (hwaddr_aton(cmd, addr))
5445 		return -1;
5446 
5447 	pos = cmd + 17;
5448 	if (*pos != ' ')
5449 		return -1;
5450 
5451 	p2ps_prov = p2p_parse_asp_provision_cmd(pos);
5452 	if (!p2ps_prov)
5453 		return -1;
5454 
5455 	p2ps_prov->pd_seeker = 1;
5456 
5457 	return wpas_p2p_prov_disc(wpa_s, addr, NULL, WPAS_P2P_PD_FOR_ASP,
5458 				  p2ps_prov);
5459 }
5460 
5461 
5462 static int parse_freq(int chwidth, int freq2)
5463 {
5464 	if (freq2 < 0)
5465 		return -1;
5466 	if (freq2)
5467 		return VHT_CHANWIDTH_80P80MHZ;
5468 
5469 	switch (chwidth) {
5470 	case 0:
5471 	case 20:
5472 	case 40:
5473 		return VHT_CHANWIDTH_USE_HT;
5474 	case 80:
5475 		return VHT_CHANWIDTH_80MHZ;
5476 	case 160:
5477 		return VHT_CHANWIDTH_160MHZ;
5478 	default:
5479 		wpa_printf(MSG_DEBUG, "Unknown max oper bandwidth: %d",
5480 			   chwidth);
5481 		return -1;
5482 	}
5483 }
5484 
5485 
5486 static int p2p_ctrl_connect(struct wpa_supplicant *wpa_s, char *cmd,
5487 			    char *buf, size_t buflen)
5488 {
5489 	u8 addr[ETH_ALEN];
5490 	char *pos, *pos2;
5491 	char *pin = NULL;
5492 	enum p2p_wps_method wps_method;
5493 	int new_pin;
5494 	int ret;
5495 	int persistent_group, persistent_id = -1;
5496 	int join;
5497 	int auth;
5498 	int automatic;
5499 	int go_intent = -1;
5500 	int freq = 0;
5501 	int pd;
5502 	int ht40, vht, max_oper_chwidth, chwidth = 0, freq2 = 0;
5503 	u8 _group_ssid[SSID_MAX_LEN], *group_ssid = NULL;
5504 	size_t group_ssid_len = 0;
5505 
5506 	if (!wpa_s->global->p2p_init_wpa_s)
5507 		return -1;
5508 	if (wpa_s->global->p2p_init_wpa_s != wpa_s) {
5509 		wpa_dbg(wpa_s, MSG_DEBUG, "Direct P2P_CONNECT command to %s",
5510 			wpa_s->global->p2p_init_wpa_s->ifname);
5511 		wpa_s = wpa_s->global->p2p_init_wpa_s;
5512 	}
5513 
5514 	/* <addr> <"pbc" | "pin" | PIN> [label|display|keypad|p2ps]
5515 	 * [persistent|persistent=<network id>]
5516 	 * [join] [auth] [go_intent=<0..15>] [freq=<in MHz>] [provdisc]
5517 	 * [ht40] [vht] [auto] [ssid=<hexdump>] */
5518 
5519 	if (hwaddr_aton(cmd, addr))
5520 		return -1;
5521 
5522 	pos = cmd + 17;
5523 	if (*pos != ' ')
5524 		return -1;
5525 	pos++;
5526 
5527 	persistent_group = os_strstr(pos, " persistent") != NULL;
5528 	pos2 = os_strstr(pos, " persistent=");
5529 	if (pos2) {
5530 		struct wpa_ssid *ssid;
5531 		persistent_id = atoi(pos2 + 12);
5532 		ssid = wpa_config_get_network(wpa_s->conf, persistent_id);
5533 		if (ssid == NULL || ssid->disabled != 2 ||
5534 		    ssid->mode != WPAS_MODE_P2P_GO) {
5535 			wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find "
5536 				   "SSID id=%d for persistent P2P group (GO)",
5537 				   persistent_id);
5538 			return -1;
5539 		}
5540 	}
5541 	join = os_strstr(pos, " join") != NULL;
5542 	auth = os_strstr(pos, " auth") != NULL;
5543 	automatic = os_strstr(pos, " auto") != NULL;
5544 	pd = os_strstr(pos, " provdisc") != NULL;
5545 	vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
5546 	ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
5547 		vht;
5548 
5549 	pos2 = os_strstr(pos, " go_intent=");
5550 	if (pos2) {
5551 		pos2 += 11;
5552 		go_intent = atoi(pos2);
5553 		if (go_intent < 0 || go_intent > 15)
5554 			return -1;
5555 	}
5556 
5557 	pos2 = os_strstr(pos, " freq=");
5558 	if (pos2) {
5559 		pos2 += 6;
5560 		freq = atoi(pos2);
5561 		if (freq <= 0)
5562 			return -1;
5563 	}
5564 
5565 	pos2 = os_strstr(pos, " freq2=");
5566 	if (pos2)
5567 		freq2 = atoi(pos2 + 7);
5568 
5569 	pos2 = os_strstr(pos, " max_oper_chwidth=");
5570 	if (pos2)
5571 		chwidth = atoi(pos2 + 18);
5572 
5573 	max_oper_chwidth = parse_freq(chwidth, freq2);
5574 	if (max_oper_chwidth < 0)
5575 		return -1;
5576 
5577 	pos2 = os_strstr(pos, " ssid=");
5578 	if (pos2) {
5579 		char *end;
5580 
5581 		pos2 += 6;
5582 		end = os_strchr(pos2, ' ');
5583 		if (!end)
5584 			group_ssid_len = os_strlen(pos2) / 2;
5585 		else
5586 			group_ssid_len = (end - pos2) / 2;
5587 		if (group_ssid_len == 0 || group_ssid_len > SSID_MAX_LEN ||
5588 		    hexstr2bin(pos2, _group_ssid, group_ssid_len) < 0)
5589 			return -1;
5590 		group_ssid = _group_ssid;
5591 	}
5592 
5593 	if (os_strncmp(pos, "pin", 3) == 0) {
5594 		/* Request random PIN (to be displayed) and enable the PIN */
5595 		wps_method = WPS_PIN_DISPLAY;
5596 	} else if (os_strncmp(pos, "pbc", 3) == 0) {
5597 		wps_method = WPS_PBC;
5598 	} else if (os_strstr(pos, "p2ps") != NULL) {
5599 		wps_method = WPS_P2PS;
5600 	} else {
5601 		pin = pos;
5602 		pos = os_strchr(pin, ' ');
5603 		wps_method = WPS_PIN_KEYPAD;
5604 		if (pos) {
5605 			*pos++ = '\0';
5606 			if (os_strncmp(pos, "display", 7) == 0)
5607 				wps_method = WPS_PIN_DISPLAY;
5608 		}
5609 		if (!wps_pin_str_valid(pin)) {
5610 			os_memcpy(buf, "FAIL-INVALID-PIN\n", 17);
5611 			return 17;
5612 		}
5613 	}
5614 
5615 	new_pin = wpas_p2p_connect(wpa_s, addr, pin, wps_method,
5616 				   persistent_group, automatic, join,
5617 				   auth, go_intent, freq, freq2, persistent_id,
5618 				   pd, ht40, vht, max_oper_chwidth,
5619 				   group_ssid, group_ssid_len);
5620 	if (new_pin == -2) {
5621 		os_memcpy(buf, "FAIL-CHANNEL-UNAVAILABLE\n", 25);
5622 		return 25;
5623 	}
5624 	if (new_pin == -3) {
5625 		os_memcpy(buf, "FAIL-CHANNEL-UNSUPPORTED\n", 25);
5626 		return 25;
5627 	}
5628 	if (new_pin < 0)
5629 		return -1;
5630 	if (wps_method == WPS_PIN_DISPLAY && pin == NULL) {
5631 		ret = os_snprintf(buf, buflen, "%08d", new_pin);
5632 		if (os_snprintf_error(buflen, ret))
5633 			return -1;
5634 		return ret;
5635 	}
5636 
5637 	os_memcpy(buf, "OK\n", 3);
5638 	return 3;
5639 }
5640 
5641 
5642 static int p2p_ctrl_listen(struct wpa_supplicant *wpa_s, char *cmd)
5643 {
5644 	unsigned int timeout = atoi(cmd);
5645 	if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
5646 		wpa_dbg(wpa_s, MSG_INFO,
5647 			"Reject P2P_LISTEN since interface is disabled");
5648 		return -1;
5649 	}
5650 	return wpas_p2p_listen(wpa_s, timeout);
5651 }
5652 
5653 
5654 static int p2p_ctrl_prov_disc(struct wpa_supplicant *wpa_s, char *cmd)
5655 {
5656 	u8 addr[ETH_ALEN];
5657 	char *pos;
5658 	enum wpas_p2p_prov_disc_use use = WPAS_P2P_PD_FOR_GO_NEG;
5659 
5660 	/* <addr> <config method> [join|auto] */
5661 
5662 	if (hwaddr_aton(cmd, addr))
5663 		return -1;
5664 
5665 	pos = cmd + 17;
5666 	if (*pos != ' ')
5667 		return -1;
5668 	pos++;
5669 
5670 	if (os_strstr(pos, " join") != NULL)
5671 		use = WPAS_P2P_PD_FOR_JOIN;
5672 	else if (os_strstr(pos, " auto") != NULL)
5673 		use = WPAS_P2P_PD_AUTO;
5674 
5675 	return wpas_p2p_prov_disc(wpa_s, addr, pos, use, NULL);
5676 }
5677 
5678 
5679 static int p2p_get_passphrase(struct wpa_supplicant *wpa_s, char *buf,
5680 			      size_t buflen)
5681 {
5682 	struct wpa_ssid *ssid = wpa_s->current_ssid;
5683 
5684 	if (ssid == NULL || ssid->mode != WPAS_MODE_P2P_GO ||
5685 	    ssid->passphrase == NULL)
5686 		return -1;
5687 
5688 	os_strlcpy(buf, ssid->passphrase, buflen);
5689 	return os_strlen(buf);
5690 }
5691 
5692 
5693 static int p2p_ctrl_serv_disc_req(struct wpa_supplicant *wpa_s, char *cmd,
5694 				  char *buf, size_t buflen)
5695 {
5696 	u64 ref;
5697 	int res;
5698 	u8 dst_buf[ETH_ALEN], *dst;
5699 	struct wpabuf *tlvs;
5700 	char *pos;
5701 	size_t len;
5702 
5703 	if (hwaddr_aton(cmd, dst_buf))
5704 		return -1;
5705 	dst = dst_buf;
5706 	if (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
5707 	    dst[3] == 0 && dst[4] == 0 && dst[5] == 0)
5708 		dst = NULL;
5709 	pos = cmd + 17;
5710 	if (*pos != ' ')
5711 		return -1;
5712 	pos++;
5713 
5714 	if (os_strncmp(pos, "upnp ", 5) == 0) {
5715 		u8 version;
5716 		pos += 5;
5717 		if (hexstr2bin(pos, &version, 1) < 0)
5718 			return -1;
5719 		pos += 2;
5720 		if (*pos != ' ')
5721 			return -1;
5722 		pos++;
5723 		ref = wpas_p2p_sd_request_upnp(wpa_s, dst, version, pos);
5724 #ifdef CONFIG_WIFI_DISPLAY
5725 	} else if (os_strncmp(pos, "wifi-display ", 13) == 0) {
5726 		ref = wpas_p2p_sd_request_wifi_display(wpa_s, dst, pos + 13);
5727 #endif /* CONFIG_WIFI_DISPLAY */
5728 	} else if (os_strncmp(pos, "asp ", 4) == 0) {
5729 		char *svc_str;
5730 		char *svc_info = NULL;
5731 		u32 id;
5732 
5733 		pos += 4;
5734 		if (sscanf(pos, "%x", &id) != 1 || id > 0xff)
5735 			return -1;
5736 
5737 		pos = os_strchr(pos, ' ');
5738 		if (pos == NULL || pos[1] == '\0' || pos[1] == ' ')
5739 			return -1;
5740 
5741 		svc_str = pos + 1;
5742 
5743 		pos = os_strchr(svc_str, ' ');
5744 
5745 		if (pos)
5746 			*pos++ = '\0';
5747 
5748 		/* All remaining data is the svc_info string */
5749 		if (pos && pos[0] && pos[0] != ' ') {
5750 			len = os_strlen(pos);
5751 
5752 			/* Unescape in place */
5753 			len = utf8_unescape(pos, len, pos, len);
5754 			if (len > 0xff)
5755 				return -1;
5756 
5757 			svc_info = pos;
5758 		}
5759 
5760 		ref = wpas_p2p_sd_request_asp(wpa_s, dst, (u8) id,
5761 					      svc_str, svc_info);
5762 	} else {
5763 		len = os_strlen(pos);
5764 		if (len & 1)
5765 			return -1;
5766 		len /= 2;
5767 		tlvs = wpabuf_alloc(len);
5768 		if (tlvs == NULL)
5769 			return -1;
5770 		if (hexstr2bin(pos, wpabuf_put(tlvs, len), len) < 0) {
5771 			wpabuf_free(tlvs);
5772 			return -1;
5773 		}
5774 
5775 		ref = wpas_p2p_sd_request(wpa_s, dst, tlvs);
5776 		wpabuf_free(tlvs);
5777 	}
5778 	if (ref == 0)
5779 		return -1;
5780 	res = os_snprintf(buf, buflen, "%llx", (long long unsigned) ref);
5781 	if (os_snprintf_error(buflen, res))
5782 		return -1;
5783 	return res;
5784 }
5785 
5786 
5787 static int p2p_ctrl_serv_disc_cancel_req(struct wpa_supplicant *wpa_s,
5788 					 char *cmd)
5789 {
5790 	long long unsigned val;
5791 	u64 req;
5792 	if (sscanf(cmd, "%llx", &val) != 1)
5793 		return -1;
5794 	req = val;
5795 	return wpas_p2p_sd_cancel_request(wpa_s, req);
5796 }
5797 
5798 
5799 static int p2p_ctrl_serv_disc_resp(struct wpa_supplicant *wpa_s, char *cmd)
5800 {
5801 	int freq;
5802 	u8 dst[ETH_ALEN];
5803 	u8 dialog_token;
5804 	struct wpabuf *resp_tlvs;
5805 	char *pos, *pos2;
5806 	size_t len;
5807 
5808 	pos = os_strchr(cmd, ' ');
5809 	if (pos == NULL)
5810 		return -1;
5811 	*pos++ = '\0';
5812 	freq = atoi(cmd);
5813 	if (freq == 0)
5814 		return -1;
5815 
5816 	if (hwaddr_aton(pos, dst))
5817 		return -1;
5818 	pos += 17;
5819 	if (*pos != ' ')
5820 		return -1;
5821 	pos++;
5822 
5823 	pos2 = os_strchr(pos, ' ');
5824 	if (pos2 == NULL)
5825 		return -1;
5826 	*pos2++ = '\0';
5827 	dialog_token = atoi(pos);
5828 
5829 	len = os_strlen(pos2);
5830 	if (len & 1)
5831 		return -1;
5832 	len /= 2;
5833 	resp_tlvs = wpabuf_alloc(len);
5834 	if (resp_tlvs == NULL)
5835 		return -1;
5836 	if (hexstr2bin(pos2, wpabuf_put(resp_tlvs, len), len) < 0) {
5837 		wpabuf_free(resp_tlvs);
5838 		return -1;
5839 	}
5840 
5841 	wpas_p2p_sd_response(wpa_s, freq, dst, dialog_token, resp_tlvs);
5842 	wpabuf_free(resp_tlvs);
5843 	return 0;
5844 }
5845 
5846 
5847 static int p2p_ctrl_serv_disc_external(struct wpa_supplicant *wpa_s,
5848 				       char *cmd)
5849 {
5850 	if (os_strcmp(cmd, "0") && os_strcmp(cmd, "1"))
5851 		return -1;
5852 	wpa_s->p2p_sd_over_ctrl_iface = atoi(cmd);
5853 	return 0;
5854 }
5855 
5856 
5857 static int p2p_ctrl_service_add_bonjour(struct wpa_supplicant *wpa_s,
5858 					char *cmd)
5859 {
5860 	char *pos;
5861 	size_t len;
5862 	struct wpabuf *query, *resp;
5863 
5864 	pos = os_strchr(cmd, ' ');
5865 	if (pos == NULL)
5866 		return -1;
5867 	*pos++ = '\0';
5868 
5869 	len = os_strlen(cmd);
5870 	if (len & 1)
5871 		return -1;
5872 	len /= 2;
5873 	query = wpabuf_alloc(len);
5874 	if (query == NULL)
5875 		return -1;
5876 	if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
5877 		wpabuf_free(query);
5878 		return -1;
5879 	}
5880 
5881 	len = os_strlen(pos);
5882 	if (len & 1) {
5883 		wpabuf_free(query);
5884 		return -1;
5885 	}
5886 	len /= 2;
5887 	resp = wpabuf_alloc(len);
5888 	if (resp == NULL) {
5889 		wpabuf_free(query);
5890 		return -1;
5891 	}
5892 	if (hexstr2bin(pos, wpabuf_put(resp, len), len) < 0) {
5893 		wpabuf_free(query);
5894 		wpabuf_free(resp);
5895 		return -1;
5896 	}
5897 
5898 	if (wpas_p2p_service_add_bonjour(wpa_s, query, resp) < 0) {
5899 		wpabuf_free(query);
5900 		wpabuf_free(resp);
5901 		return -1;
5902 	}
5903 	return 0;
5904 }
5905 
5906 
5907 static int p2p_ctrl_service_add_upnp(struct wpa_supplicant *wpa_s, char *cmd)
5908 {
5909 	char *pos;
5910 	u8 version;
5911 
5912 	pos = os_strchr(cmd, ' ');
5913 	if (pos == NULL)
5914 		return -1;
5915 	*pos++ = '\0';
5916 
5917 	if (hexstr2bin(cmd, &version, 1) < 0)
5918 		return -1;
5919 
5920 	return wpas_p2p_service_add_upnp(wpa_s, version, pos);
5921 }
5922 
5923 
5924 static int p2p_ctrl_service_add_asp(struct wpa_supplicant *wpa_s,
5925 				    u8 replace, char *cmd)
5926 {
5927 	char *pos;
5928 	char *adv_str;
5929 	u32 auto_accept, adv_id, svc_state, config_methods;
5930 	char *svc_info = NULL;
5931 	char *cpt_prio_str;
5932 	u8 cpt_prio[P2PS_FEATURE_CAPAB_CPT_MAX + 1];
5933 
5934 	pos = os_strchr(cmd, ' ');
5935 	if (pos == NULL)
5936 		return -1;
5937 	*pos++ = '\0';
5938 
5939 	/* Auto-Accept value is mandatory, and must be one of the
5940 	 * single values (0, 1, 2, 4) */
5941 	auto_accept = atoi(cmd);
5942 	switch (auto_accept) {
5943 	case P2PS_SETUP_NONE: /* No auto-accept */
5944 	case P2PS_SETUP_NEW:
5945 	case P2PS_SETUP_CLIENT:
5946 	case P2PS_SETUP_GROUP_OWNER:
5947 		break;
5948 	default:
5949 		return -1;
5950 	}
5951 
5952 	/* Advertisement ID is mandatory */
5953 	cmd = pos;
5954 	pos = os_strchr(cmd, ' ');
5955 	if (pos == NULL)
5956 		return -1;
5957 	*pos++ = '\0';
5958 
5959 	/* Handle Adv_ID == 0 (wildcard "org.wi-fi.wfds") internally. */
5960 	if (sscanf(cmd, "%x", &adv_id) != 1 || adv_id == 0)
5961 		return -1;
5962 
5963 	/* Only allow replacements if exist, and adds if not */
5964 	if (wpas_p2p_service_p2ps_id_exists(wpa_s, adv_id)) {
5965 		if (!replace)
5966 			return -1;
5967 	} else {
5968 		if (replace)
5969 			return -1;
5970 	}
5971 
5972 	/* svc_state between 0 - 0xff is mandatory */
5973 	if (sscanf(pos, "%x", &svc_state) != 1 || svc_state > 0xff)
5974 		return -1;
5975 
5976 	pos = os_strchr(pos, ' ');
5977 	if (pos == NULL)
5978 		return -1;
5979 
5980 	/* config_methods is mandatory */
5981 	pos++;
5982 	if (sscanf(pos, "%x", &config_methods) != 1)
5983 		return -1;
5984 
5985 	if (!(config_methods &
5986 	      (WPS_CONFIG_DISPLAY | WPS_CONFIG_KEYPAD | WPS_CONFIG_P2PS)))
5987 		return -1;
5988 
5989 	pos = os_strchr(pos, ' ');
5990 	if (pos == NULL)
5991 		return -1;
5992 
5993 	pos++;
5994 	adv_str = pos;
5995 
5996 	/* Advertisement string is mandatory */
5997 	if (!pos[0] || pos[0] == ' ')
5998 		return -1;
5999 
6000 	/* Terminate svc string */
6001 	pos = os_strchr(pos, ' ');
6002 	if (pos != NULL)
6003 		*pos++ = '\0';
6004 
6005 	cpt_prio_str = (pos && pos[0]) ? os_strstr(pos, "cpt=") : NULL;
6006 	if (cpt_prio_str) {
6007 		pos = os_strchr(pos, ' ');
6008 		if (pos != NULL)
6009 			*pos++ = '\0';
6010 
6011 		if (p2ps_ctrl_parse_cpt_priority(cpt_prio_str + 4, cpt_prio))
6012 			return -1;
6013 	} else {
6014 		cpt_prio[0] = P2PS_FEATURE_CAPAB_UDP_TRANSPORT;
6015 		cpt_prio[1] = 0;
6016 	}
6017 
6018 	/* Service and Response Information are optional */
6019 	if (pos && pos[0]) {
6020 		size_t len;
6021 
6022 		/* Note the bare ' included, which cannot exist legally
6023 		 * in unescaped string. */
6024 		svc_info = os_strstr(pos, "svc_info='");
6025 
6026 		if (svc_info) {
6027 			svc_info += 9;
6028 			len = os_strlen(svc_info);
6029 			utf8_unescape(svc_info, len, svc_info, len);
6030 		}
6031 	}
6032 
6033 	return wpas_p2p_service_add_asp(wpa_s, auto_accept, adv_id, adv_str,
6034 					(u8) svc_state, (u16) config_methods,
6035 					svc_info, cpt_prio);
6036 }
6037 
6038 
6039 static int p2p_ctrl_service_add(struct wpa_supplicant *wpa_s, char *cmd)
6040 {
6041 	char *pos;
6042 
6043 	pos = os_strchr(cmd, ' ');
6044 	if (pos == NULL)
6045 		return -1;
6046 	*pos++ = '\0';
6047 
6048 	if (os_strcmp(cmd, "bonjour") == 0)
6049 		return p2p_ctrl_service_add_bonjour(wpa_s, pos);
6050 	if (os_strcmp(cmd, "upnp") == 0)
6051 		return p2p_ctrl_service_add_upnp(wpa_s, pos);
6052 	if (os_strcmp(cmd, "asp") == 0)
6053 		return p2p_ctrl_service_add_asp(wpa_s, 0, pos);
6054 	wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
6055 	return -1;
6056 }
6057 
6058 
6059 static int p2p_ctrl_service_del_bonjour(struct wpa_supplicant *wpa_s,
6060 					char *cmd)
6061 {
6062 	size_t len;
6063 	struct wpabuf *query;
6064 	int ret;
6065 
6066 	len = os_strlen(cmd);
6067 	if (len & 1)
6068 		return -1;
6069 	len /= 2;
6070 	query = wpabuf_alloc(len);
6071 	if (query == NULL)
6072 		return -1;
6073 	if (hexstr2bin(cmd, wpabuf_put(query, len), len) < 0) {
6074 		wpabuf_free(query);
6075 		return -1;
6076 	}
6077 
6078 	ret = wpas_p2p_service_del_bonjour(wpa_s, query);
6079 	wpabuf_free(query);
6080 	return ret;
6081 }
6082 
6083 
6084 static int p2p_ctrl_service_del_upnp(struct wpa_supplicant *wpa_s, char *cmd)
6085 {
6086 	char *pos;
6087 	u8 version;
6088 
6089 	pos = os_strchr(cmd, ' ');
6090 	if (pos == NULL)
6091 		return -1;
6092 	*pos++ = '\0';
6093 
6094 	if (hexstr2bin(cmd, &version, 1) < 0)
6095 		return -1;
6096 
6097 	return wpas_p2p_service_del_upnp(wpa_s, version, pos);
6098 }
6099 
6100 
6101 static int p2p_ctrl_service_del_asp(struct wpa_supplicant *wpa_s, char *cmd)
6102 {
6103 	u32 adv_id;
6104 
6105 	if (os_strcmp(cmd, "all") == 0) {
6106 		wpas_p2p_service_flush_asp(wpa_s);
6107 		return 0;
6108 	}
6109 
6110 	if (sscanf(cmd, "%x", &adv_id) != 1)
6111 		return -1;
6112 
6113 	return wpas_p2p_service_del_asp(wpa_s, adv_id);
6114 }
6115 
6116 
6117 static int p2p_ctrl_service_del(struct wpa_supplicant *wpa_s, char *cmd)
6118 {
6119 	char *pos;
6120 
6121 	pos = os_strchr(cmd, ' ');
6122 	if (pos == NULL)
6123 		return -1;
6124 	*pos++ = '\0';
6125 
6126 	if (os_strcmp(cmd, "bonjour") == 0)
6127 		return p2p_ctrl_service_del_bonjour(wpa_s, pos);
6128 	if (os_strcmp(cmd, "upnp") == 0)
6129 		return p2p_ctrl_service_del_upnp(wpa_s, pos);
6130 	if (os_strcmp(cmd, "asp") == 0)
6131 		return p2p_ctrl_service_del_asp(wpa_s, pos);
6132 	wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
6133 	return -1;
6134 }
6135 
6136 
6137 static int p2p_ctrl_service_replace(struct wpa_supplicant *wpa_s, char *cmd)
6138 {
6139 	char *pos;
6140 
6141 	pos = os_strchr(cmd, ' ');
6142 	if (pos == NULL)
6143 		return -1;
6144 	*pos++ = '\0';
6145 
6146 	if (os_strcmp(cmd, "asp") == 0)
6147 		return p2p_ctrl_service_add_asp(wpa_s, 1, pos);
6148 
6149 	wpa_printf(MSG_DEBUG, "Unknown service '%s'", cmd);
6150 	return -1;
6151 }
6152 
6153 
6154 static int p2p_ctrl_reject(struct wpa_supplicant *wpa_s, char *cmd)
6155 {
6156 	u8 addr[ETH_ALEN];
6157 
6158 	/* <addr> */
6159 
6160 	if (hwaddr_aton(cmd, addr))
6161 		return -1;
6162 
6163 	return wpas_p2p_reject(wpa_s, addr);
6164 }
6165 
6166 
6167 static int p2p_ctrl_invite_persistent(struct wpa_supplicant *wpa_s, char *cmd)
6168 {
6169 	char *pos;
6170 	int id;
6171 	struct wpa_ssid *ssid;
6172 	u8 *_peer = NULL, peer[ETH_ALEN];
6173 	int freq = 0, pref_freq = 0;
6174 	int ht40, vht, max_oper_chwidth, chwidth = 0, freq2 = 0;
6175 
6176 	id = atoi(cmd);
6177 	pos = os_strstr(cmd, " peer=");
6178 	if (pos) {
6179 		pos += 6;
6180 		if (hwaddr_aton(pos, peer))
6181 			return -1;
6182 		_peer = peer;
6183 	}
6184 	ssid = wpa_config_get_network(wpa_s->conf, id);
6185 	if (ssid == NULL || ssid->disabled != 2) {
6186 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
6187 			   "for persistent P2P group",
6188 			   id);
6189 		return -1;
6190 	}
6191 
6192 	pos = os_strstr(cmd, " freq=");
6193 	if (pos) {
6194 		pos += 6;
6195 		freq = atoi(pos);
6196 		if (freq <= 0)
6197 			return -1;
6198 	}
6199 
6200 	pos = os_strstr(cmd, " pref=");
6201 	if (pos) {
6202 		pos += 6;
6203 		pref_freq = atoi(pos);
6204 		if (pref_freq <= 0)
6205 			return -1;
6206 	}
6207 
6208 	vht = (os_strstr(cmd, " vht") != NULL) || wpa_s->conf->p2p_go_vht;
6209 	ht40 = (os_strstr(cmd, " ht40") != NULL) || wpa_s->conf->p2p_go_ht40 ||
6210 		vht;
6211 
6212 	pos = os_strstr(cmd, "freq2=");
6213 	if (pos)
6214 		freq2 = atoi(pos + 6);
6215 
6216 	pos = os_strstr(cmd, " max_oper_chwidth=");
6217 	if (pos)
6218 		chwidth = atoi(pos + 18);
6219 
6220 	max_oper_chwidth = parse_freq(chwidth, freq2);
6221 	if (max_oper_chwidth < 0)
6222 		return -1;
6223 
6224 	return wpas_p2p_invite(wpa_s, _peer, ssid, NULL, freq, freq2, ht40, vht,
6225 			       max_oper_chwidth, pref_freq);
6226 }
6227 
6228 
6229 static int p2p_ctrl_invite_group(struct wpa_supplicant *wpa_s, char *cmd)
6230 {
6231 	char *pos;
6232 	u8 peer[ETH_ALEN], go_dev_addr[ETH_ALEN], *go_dev = NULL;
6233 
6234 	pos = os_strstr(cmd, " peer=");
6235 	if (!pos)
6236 		return -1;
6237 
6238 	*pos = '\0';
6239 	pos += 6;
6240 	if (hwaddr_aton(pos, peer)) {
6241 		wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'", pos);
6242 		return -1;
6243 	}
6244 
6245 	pos = os_strstr(pos, " go_dev_addr=");
6246 	if (pos) {
6247 		pos += 13;
6248 		if (hwaddr_aton(pos, go_dev_addr)) {
6249 			wpa_printf(MSG_DEBUG, "P2P: Invalid MAC address '%s'",
6250 				   pos);
6251 			return -1;
6252 		}
6253 		go_dev = go_dev_addr;
6254 	}
6255 
6256 	return wpas_p2p_invite_group(wpa_s, cmd, peer, go_dev);
6257 }
6258 
6259 
6260 static int p2p_ctrl_invite(struct wpa_supplicant *wpa_s, char *cmd)
6261 {
6262 	if (os_strncmp(cmd, "persistent=", 11) == 0)
6263 		return p2p_ctrl_invite_persistent(wpa_s, cmd + 11);
6264 	if (os_strncmp(cmd, "group=", 6) == 0)
6265 		return p2p_ctrl_invite_group(wpa_s, cmd + 6);
6266 
6267 	return -1;
6268 }
6269 
6270 
6271 static int p2p_ctrl_group_add_persistent(struct wpa_supplicant *wpa_s,
6272 					 int id, int freq, int vht_center_freq2,
6273 					 int ht40, int vht, int vht_chwidth)
6274 {
6275 	struct wpa_ssid *ssid;
6276 
6277 	ssid = wpa_config_get_network(wpa_s->conf, id);
6278 	if (ssid == NULL || ssid->disabled != 2) {
6279 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: Could not find SSID id=%d "
6280 			   "for persistent P2P group",
6281 			   id);
6282 		return -1;
6283 	}
6284 
6285 	return wpas_p2p_group_add_persistent(wpa_s, ssid, 0, freq,
6286 					     vht_center_freq2, 0, ht40, vht,
6287 					     vht_chwidth, NULL, 0, 0);
6288 }
6289 
6290 
6291 static int p2p_ctrl_group_add(struct wpa_supplicant *wpa_s, char *cmd)
6292 {
6293 	int freq = 0, persistent = 0, group_id = -1;
6294 	int vht = wpa_s->conf->p2p_go_vht;
6295 	int ht40 = wpa_s->conf->p2p_go_ht40 || vht;
6296 	int max_oper_chwidth, chwidth = 0, freq2 = 0;
6297 	char *token, *context = NULL;
6298 #ifdef CONFIG_ACS
6299 	int acs = 0;
6300 #endif /* CONFIG_ACS */
6301 
6302 	while ((token = str_token(cmd, " ", &context))) {
6303 		if (sscanf(token, "freq2=%d", &freq2) == 1 ||
6304 		    sscanf(token, "persistent=%d", &group_id) == 1 ||
6305 		    sscanf(token, "max_oper_chwidth=%d", &chwidth) == 1) {
6306 			continue;
6307 #ifdef CONFIG_ACS
6308 		} else if (os_strcmp(token, "freq=acs") == 0) {
6309 			acs = 1;
6310 #endif /* CONFIG_ACS */
6311 		} else if (sscanf(token, "freq=%d", &freq) == 1) {
6312 			continue;
6313 		} else if (os_strcmp(token, "ht40") == 0) {
6314 			ht40 = 1;
6315 		} else if (os_strcmp(token, "vht") == 0) {
6316 			vht = 1;
6317 			ht40 = 1;
6318 		} else if (os_strcmp(token, "persistent") == 0) {
6319 			persistent = 1;
6320 		} else {
6321 			wpa_printf(MSG_DEBUG,
6322 				   "CTRL: Invalid P2P_GROUP_ADD parameter: '%s'",
6323 				   token);
6324 			return -1;
6325 		}
6326 	}
6327 
6328 #ifdef CONFIG_ACS
6329 	if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_ACS_OFFLOAD) &&
6330 	    (acs || freq == 2 || freq == 5)) {
6331 		if (freq == 2 && wpa_s->best_24_freq <= 0) {
6332 			wpa_s->p2p_go_acs_band = HOSTAPD_MODE_IEEE80211G;
6333 			wpa_s->p2p_go_do_acs = 1;
6334 			freq = 0;
6335 		} else if (freq == 5 && wpa_s->best_5_freq <= 0) {
6336 			wpa_s->p2p_go_acs_band = HOSTAPD_MODE_IEEE80211A;
6337 			wpa_s->p2p_go_do_acs = 1;
6338 			freq = 0;
6339 		} else {
6340 			wpa_s->p2p_go_acs_band = HOSTAPD_MODE_IEEE80211ANY;
6341 			wpa_s->p2p_go_do_acs = 1;
6342 		}
6343 	}
6344 #endif /* CONFIG_ACS */
6345 
6346 	max_oper_chwidth = parse_freq(chwidth, freq2);
6347 	if (max_oper_chwidth < 0)
6348 		return -1;
6349 
6350 	if (group_id >= 0)
6351 		return p2p_ctrl_group_add_persistent(wpa_s, group_id,
6352 						     freq, freq2, ht40, vht,
6353 						     max_oper_chwidth);
6354 
6355 	return wpas_p2p_group_add(wpa_s, persistent, freq, freq2, ht40, vht,
6356 				  max_oper_chwidth);
6357 }
6358 
6359 
6360 static int p2p_ctrl_group_member(struct wpa_supplicant *wpa_s, const char *cmd,
6361 				 char *buf, size_t buflen)
6362 {
6363 	u8 dev_addr[ETH_ALEN];
6364 	struct wpa_ssid *ssid;
6365 	int res;
6366 	const u8 *iaddr;
6367 
6368 	ssid = wpa_s->current_ssid;
6369 	if (!wpa_s->global->p2p || !ssid || ssid->mode != WPAS_MODE_P2P_GO ||
6370 	    hwaddr_aton(cmd, dev_addr))
6371 		return -1;
6372 
6373 	iaddr = p2p_group_get_client_interface_addr(wpa_s->p2p_group, dev_addr);
6374 	if (!iaddr)
6375 		return -1;
6376 	res = os_snprintf(buf, buflen, MACSTR, MAC2STR(iaddr));
6377 	if (os_snprintf_error(buflen, res))
6378 		return -1;
6379 	return res;
6380 }
6381 
6382 
6383 static int wpas_find_p2p_dev_addr_bss(struct wpa_global *global,
6384 				      const u8 *p2p_dev_addr)
6385 {
6386 	struct wpa_supplicant *wpa_s;
6387 
6388 	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
6389 		if (wpa_bss_get_p2p_dev_addr(wpa_s, p2p_dev_addr))
6390 			return 1;
6391 	}
6392 
6393 	return 0;
6394 }
6395 
6396 
6397 static int p2p_ctrl_peer(struct wpa_supplicant *wpa_s, char *cmd,
6398 			 char *buf, size_t buflen)
6399 {
6400 	u8 addr[ETH_ALEN], *addr_ptr, group_capab;
6401 	int next, res;
6402 	const struct p2p_peer_info *info;
6403 	char *pos, *end;
6404 	char devtype[WPS_DEV_TYPE_BUFSIZE];
6405 	struct wpa_ssid *ssid;
6406 	size_t i;
6407 
6408 	if (!wpa_s->global->p2p)
6409 		return -1;
6410 
6411 	if (os_strcmp(cmd, "FIRST") == 0) {
6412 		addr_ptr = NULL;
6413 		next = 0;
6414 	} else if (os_strncmp(cmd, "NEXT-", 5) == 0) {
6415 		if (hwaddr_aton(cmd + 5, addr) < 0)
6416 			return -1;
6417 		addr_ptr = addr;
6418 		next = 1;
6419 	} else {
6420 		if (hwaddr_aton(cmd, addr) < 0)
6421 			return -1;
6422 		addr_ptr = addr;
6423 		next = 0;
6424 	}
6425 
6426 	info = p2p_get_peer_info(wpa_s->global->p2p, addr_ptr, next);
6427 	if (info == NULL)
6428 		return -1;
6429 	group_capab = info->group_capab;
6430 
6431 	if (group_capab &&
6432 	    !wpas_find_p2p_dev_addr_bss(wpa_s->global, info->p2p_device_addr)) {
6433 		wpa_printf(MSG_DEBUG,
6434 			   "P2P: Could not find any BSS with p2p_dev_addr "
6435 			   MACSTR ", hence override group_capab from 0x%x to 0",
6436 			   MAC2STR(info->p2p_device_addr), group_capab);
6437 		group_capab = 0;
6438 	}
6439 
6440 	pos = buf;
6441 	end = buf + buflen;
6442 
6443 	res = os_snprintf(pos, end - pos, MACSTR "\n"
6444 			  "pri_dev_type=%s\n"
6445 			  "device_name=%s\n"
6446 			  "manufacturer=%s\n"
6447 			  "model_name=%s\n"
6448 			  "model_number=%s\n"
6449 			  "serial_number=%s\n"
6450 			  "config_methods=0x%x\n"
6451 			  "dev_capab=0x%x\n"
6452 			  "group_capab=0x%x\n"
6453 			  "level=%d\n",
6454 			  MAC2STR(info->p2p_device_addr),
6455 			  wps_dev_type_bin2str(info->pri_dev_type,
6456 					       devtype, sizeof(devtype)),
6457 			  info->device_name,
6458 			  info->manufacturer,
6459 			  info->model_name,
6460 			  info->model_number,
6461 			  info->serial_number,
6462 			  info->config_methods,
6463 			  info->dev_capab,
6464 			  group_capab,
6465 			  info->level);
6466 	if (os_snprintf_error(end - pos, res))
6467 		return pos - buf;
6468 	pos += res;
6469 
6470 	for (i = 0; i < info->wps_sec_dev_type_list_len / WPS_DEV_TYPE_LEN; i++)
6471 	{
6472 		const u8 *t;
6473 		t = &info->wps_sec_dev_type_list[i * WPS_DEV_TYPE_LEN];
6474 		res = os_snprintf(pos, end - pos, "sec_dev_type=%s\n",
6475 				  wps_dev_type_bin2str(t, devtype,
6476 						       sizeof(devtype)));
6477 		if (os_snprintf_error(end - pos, res))
6478 			return pos - buf;
6479 		pos += res;
6480 	}
6481 
6482 	ssid = wpas_p2p_get_persistent(wpa_s, info->p2p_device_addr, NULL, 0);
6483 	if (ssid) {
6484 		res = os_snprintf(pos, end - pos, "persistent=%d\n", ssid->id);
6485 		if (os_snprintf_error(end - pos, res))
6486 			return pos - buf;
6487 		pos += res;
6488 	}
6489 
6490 	res = p2p_get_peer_info_txt(info, pos, end - pos);
6491 	if (res < 0)
6492 		return pos - buf;
6493 	pos += res;
6494 
6495 	if (info->vendor_elems) {
6496 		res = os_snprintf(pos, end - pos, "vendor_elems=");
6497 		if (os_snprintf_error(end - pos, res))
6498 			return pos - buf;
6499 		pos += res;
6500 
6501 		pos += wpa_snprintf_hex(pos, end - pos,
6502 					wpabuf_head(info->vendor_elems),
6503 					wpabuf_len(info->vendor_elems));
6504 
6505 		res = os_snprintf(pos, end - pos, "\n");
6506 		if (os_snprintf_error(end - pos, res))
6507 			return pos - buf;
6508 		pos += res;
6509 	}
6510 
6511 	return pos - buf;
6512 }
6513 
6514 
6515 static int p2p_ctrl_disallow_freq(struct wpa_supplicant *wpa_s,
6516 				  const char *param)
6517 {
6518 	unsigned int i;
6519 
6520 	if (wpa_s->global->p2p == NULL)
6521 		return -1;
6522 
6523 	if (freq_range_list_parse(&wpa_s->global->p2p_disallow_freq, param) < 0)
6524 		return -1;
6525 
6526 	for (i = 0; i < wpa_s->global->p2p_disallow_freq.num; i++) {
6527 		struct wpa_freq_range *freq;
6528 		freq = &wpa_s->global->p2p_disallow_freq.range[i];
6529 		wpa_printf(MSG_DEBUG, "P2P: Disallowed frequency range %u-%u",
6530 			   freq->min, freq->max);
6531 	}
6532 
6533 	wpas_p2p_update_channel_list(wpa_s, WPAS_P2P_CHANNEL_UPDATE_DISALLOW);
6534 	return 0;
6535 }
6536 
6537 
6538 static int p2p_ctrl_set(struct wpa_supplicant *wpa_s, char *cmd)
6539 {
6540 	char *param;
6541 
6542 	if (wpa_s->global->p2p == NULL)
6543 		return -1;
6544 
6545 	param = os_strchr(cmd, ' ');
6546 	if (param == NULL)
6547 		return -1;
6548 	*param++ = '\0';
6549 
6550 	if (os_strcmp(cmd, "discoverability") == 0) {
6551 		p2p_set_client_discoverability(wpa_s->global->p2p,
6552 					       atoi(param));
6553 		return 0;
6554 	}
6555 
6556 	if (os_strcmp(cmd, "managed") == 0) {
6557 		p2p_set_managed_oper(wpa_s->global->p2p, atoi(param));
6558 		return 0;
6559 	}
6560 
6561 	if (os_strcmp(cmd, "listen_channel") == 0) {
6562 		char *pos;
6563 		u8 channel, op_class;
6564 
6565 		channel = atoi(param);
6566 		pos = os_strchr(param, ' ');
6567 		op_class = pos ? atoi(pos) : 81;
6568 
6569 		return p2p_set_listen_channel(wpa_s->global->p2p, op_class,
6570 					      channel, 1);
6571 	}
6572 
6573 	if (os_strcmp(cmd, "ssid_postfix") == 0) {
6574 		return p2p_set_ssid_postfix(wpa_s->global->p2p, (u8 *) param,
6575 					    os_strlen(param));
6576 	}
6577 
6578 	if (os_strcmp(cmd, "noa") == 0) {
6579 		char *pos;
6580 		int count, start, duration;
6581 		/* GO NoA parameters: count,start_offset(ms),duration(ms) */
6582 		count = atoi(param);
6583 		pos = os_strchr(param, ',');
6584 		if (pos == NULL)
6585 			return -1;
6586 		pos++;
6587 		start = atoi(pos);
6588 		pos = os_strchr(pos, ',');
6589 		if (pos == NULL)
6590 			return -1;
6591 		pos++;
6592 		duration = atoi(pos);
6593 		if (count < 0 || count > 255 || start < 0 || duration < 0)
6594 			return -1;
6595 		if (count == 0 && duration > 0)
6596 			return -1;
6597 		wpa_printf(MSG_DEBUG, "CTRL_IFACE: P2P_SET GO NoA: count=%d "
6598 			   "start=%d duration=%d", count, start, duration);
6599 		return wpas_p2p_set_noa(wpa_s, count, start, duration);
6600 	}
6601 
6602 	if (os_strcmp(cmd, "ps") == 0)
6603 		return wpa_drv_set_p2p_powersave(wpa_s, atoi(param), -1, -1);
6604 
6605 	if (os_strcmp(cmd, "oppps") == 0)
6606 		return wpa_drv_set_p2p_powersave(wpa_s, -1, atoi(param), -1);
6607 
6608 	if (os_strcmp(cmd, "ctwindow") == 0)
6609 		return wpa_drv_set_p2p_powersave(wpa_s, -1, -1, atoi(param));
6610 
6611 	if (os_strcmp(cmd, "disabled") == 0) {
6612 		wpa_s->global->p2p_disabled = atoi(param);
6613 		wpa_printf(MSG_DEBUG, "P2P functionality %s",
6614 			   wpa_s->global->p2p_disabled ?
6615 			   "disabled" : "enabled");
6616 		if (wpa_s->global->p2p_disabled) {
6617 			wpas_p2p_stop_find(wpa_s);
6618 			os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
6619 			p2p_flush(wpa_s->global->p2p);
6620 		}
6621 		return 0;
6622 	}
6623 
6624 	if (os_strcmp(cmd, "conc_pref") == 0) {
6625 		if (os_strcmp(param, "sta") == 0)
6626 			wpa_s->global->conc_pref = WPA_CONC_PREF_STA;
6627 		else if (os_strcmp(param, "p2p") == 0)
6628 			wpa_s->global->conc_pref = WPA_CONC_PREF_P2P;
6629 		else {
6630 			wpa_printf(MSG_INFO, "Invalid conc_pref value");
6631 			return -1;
6632 		}
6633 		wpa_printf(MSG_DEBUG, "Single channel concurrency preference: "
6634 			   "%s", param);
6635 		return 0;
6636 	}
6637 
6638 	if (os_strcmp(cmd, "force_long_sd") == 0) {
6639 		wpa_s->force_long_sd = atoi(param);
6640 		return 0;
6641 	}
6642 
6643 	if (os_strcmp(cmd, "peer_filter") == 0) {
6644 		u8 addr[ETH_ALEN];
6645 		if (hwaddr_aton(param, addr))
6646 			return -1;
6647 		p2p_set_peer_filter(wpa_s->global->p2p, addr);
6648 		return 0;
6649 	}
6650 
6651 	if (os_strcmp(cmd, "cross_connect") == 0)
6652 		return wpas_p2p_set_cross_connect(wpa_s, atoi(param));
6653 
6654 	if (os_strcmp(cmd, "go_apsd") == 0) {
6655 		if (os_strcmp(param, "disable") == 0)
6656 			wpa_s->set_ap_uapsd = 0;
6657 		else {
6658 			wpa_s->set_ap_uapsd = 1;
6659 			wpa_s->ap_uapsd = atoi(param);
6660 		}
6661 		return 0;
6662 	}
6663 
6664 	if (os_strcmp(cmd, "client_apsd") == 0) {
6665 		if (os_strcmp(param, "disable") == 0)
6666 			wpa_s->set_sta_uapsd = 0;
6667 		else {
6668 			int be, bk, vi, vo;
6669 			char *pos;
6670 			/* format: BE,BK,VI,VO;max SP Length */
6671 			be = atoi(param);
6672 			pos = os_strchr(param, ',');
6673 			if (pos == NULL)
6674 				return -1;
6675 			pos++;
6676 			bk = atoi(pos);
6677 			pos = os_strchr(pos, ',');
6678 			if (pos == NULL)
6679 				return -1;
6680 			pos++;
6681 			vi = atoi(pos);
6682 			pos = os_strchr(pos, ',');
6683 			if (pos == NULL)
6684 				return -1;
6685 			pos++;
6686 			vo = atoi(pos);
6687 			/* ignore max SP Length for now */
6688 
6689 			wpa_s->set_sta_uapsd = 1;
6690 			wpa_s->sta_uapsd = 0;
6691 			if (be)
6692 				wpa_s->sta_uapsd |= BIT(0);
6693 			if (bk)
6694 				wpa_s->sta_uapsd |= BIT(1);
6695 			if (vi)
6696 				wpa_s->sta_uapsd |= BIT(2);
6697 			if (vo)
6698 				wpa_s->sta_uapsd |= BIT(3);
6699 		}
6700 		return 0;
6701 	}
6702 
6703 	if (os_strcmp(cmd, "disallow_freq") == 0)
6704 		return p2p_ctrl_disallow_freq(wpa_s, param);
6705 
6706 	if (os_strcmp(cmd, "disc_int") == 0) {
6707 		int min_disc_int, max_disc_int, max_disc_tu;
6708 		char *pos;
6709 
6710 		pos = param;
6711 
6712 		min_disc_int = atoi(pos);
6713 		pos = os_strchr(pos, ' ');
6714 		if (pos == NULL)
6715 			return -1;
6716 		*pos++ = '\0';
6717 
6718 		max_disc_int = atoi(pos);
6719 		pos = os_strchr(pos, ' ');
6720 		if (pos == NULL)
6721 			return -1;
6722 		*pos++ = '\0';
6723 
6724 		max_disc_tu = atoi(pos);
6725 
6726 		return p2p_set_disc_int(wpa_s->global->p2p, min_disc_int,
6727 					max_disc_int, max_disc_tu);
6728 	}
6729 
6730 	if (os_strcmp(cmd, "per_sta_psk") == 0) {
6731 		wpa_s->global->p2p_per_sta_psk = !!atoi(param);
6732 		return 0;
6733 	}
6734 
6735 #ifdef CONFIG_WPS_NFC
6736 	if (os_strcmp(cmd, "nfc_tag") == 0)
6737 		return wpas_p2p_nfc_tag_enabled(wpa_s, !!atoi(param));
6738 #endif /* CONFIG_WPS_NFC */
6739 
6740 	if (os_strcmp(cmd, "disable_ip_addr_req") == 0) {
6741 		wpa_s->p2p_disable_ip_addr_req = !!atoi(param);
6742 		return 0;
6743 	}
6744 
6745 	if (os_strcmp(cmd, "override_pref_op_chan") == 0) {
6746 		int op_class, chan;
6747 
6748 		op_class = atoi(param);
6749 		param = os_strchr(param, ':');
6750 		if (!param)
6751 			return -1;
6752 		param++;
6753 		chan = atoi(param);
6754 		p2p_set_override_pref_op_chan(wpa_s->global->p2p, op_class,
6755 					      chan);
6756 		return 0;
6757 	}
6758 
6759 	wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown P2P_SET field value '%s'",
6760 		   cmd);
6761 
6762 	return -1;
6763 }
6764 
6765 
6766 static void p2p_ctrl_flush(struct wpa_supplicant *wpa_s)
6767 {
6768 	os_memset(wpa_s->p2p_auth_invite, 0, ETH_ALEN);
6769 	wpa_s->force_long_sd = 0;
6770 
6771 #ifdef CONFIG_TESTING_OPTIONS
6772 	os_free(wpa_s->get_pref_freq_list_override);
6773 	wpa_s->get_pref_freq_list_override = NULL;
6774 #endif /* CONFIG_TESTING_OPTIONS */
6775 
6776 	wpas_p2p_stop_find(wpa_s);
6777 	wpa_s->parent->p2ps_method_config_any = 0;
6778 	if (wpa_s->global->p2p)
6779 		p2p_flush(wpa_s->global->p2p);
6780 }
6781 
6782 
6783 static int p2p_ctrl_presence_req(struct wpa_supplicant *wpa_s, char *cmd)
6784 {
6785 	char *pos, *pos2;
6786 	unsigned int dur1 = 0, int1 = 0, dur2 = 0, int2 = 0;
6787 
6788 	if (cmd[0]) {
6789 		pos = os_strchr(cmd, ' ');
6790 		if (pos == NULL)
6791 			return -1;
6792 		*pos++ = '\0';
6793 		dur1 = atoi(cmd);
6794 
6795 		pos2 = os_strchr(pos, ' ');
6796 		if (pos2)
6797 			*pos2++ = '\0';
6798 		int1 = atoi(pos);
6799 	} else
6800 		pos2 = NULL;
6801 
6802 	if (pos2) {
6803 		pos = os_strchr(pos2, ' ');
6804 		if (pos == NULL)
6805 			return -1;
6806 		*pos++ = '\0';
6807 		dur2 = atoi(pos2);
6808 		int2 = atoi(pos);
6809 	}
6810 
6811 	return wpas_p2p_presence_req(wpa_s, dur1, int1, dur2, int2);
6812 }
6813 
6814 
6815 static int p2p_ctrl_ext_listen(struct wpa_supplicant *wpa_s, char *cmd)
6816 {
6817 	char *pos;
6818 	unsigned int period = 0, interval = 0;
6819 
6820 	if (cmd[0]) {
6821 		pos = os_strchr(cmd, ' ');
6822 		if (pos == NULL)
6823 			return -1;
6824 		*pos++ = '\0';
6825 		period = atoi(cmd);
6826 		interval = atoi(pos);
6827 	}
6828 
6829 	return wpas_p2p_ext_listen(wpa_s, period, interval);
6830 }
6831 
6832 
6833 static int p2p_ctrl_remove_client(struct wpa_supplicant *wpa_s, const char *cmd)
6834 {
6835 	const char *pos;
6836 	u8 peer[ETH_ALEN];
6837 	int iface_addr = 0;
6838 
6839 	pos = cmd;
6840 	if (os_strncmp(pos, "iface=", 6) == 0) {
6841 		iface_addr = 1;
6842 		pos += 6;
6843 	}
6844 	if (hwaddr_aton(pos, peer))
6845 		return -1;
6846 
6847 	wpas_p2p_remove_client(wpa_s, peer, iface_addr);
6848 	return 0;
6849 }
6850 
6851 
6852 static int p2p_ctrl_iface_p2p_lo_start(struct wpa_supplicant *wpa_s, char *cmd)
6853 {
6854 	int freq = 0, period = 0, interval = 0, count = 0;
6855 
6856 	if (sscanf(cmd, "%d %d %d %d", &freq, &period, &interval, &count) != 4)
6857 	{
6858 		wpa_printf(MSG_DEBUG,
6859 			   "CTRL: Invalid P2P LO Start parameter: '%s'", cmd);
6860 		return -1;
6861 	}
6862 
6863 	return wpas_p2p_lo_start(wpa_s, freq, period, interval, count);
6864 }
6865 
6866 #endif /* CONFIG_P2P */
6867 
6868 
6869 static int * freq_range_to_channel_list(struct wpa_supplicant *wpa_s, char *val)
6870 {
6871 	struct wpa_freq_range_list ranges;
6872 	int *freqs = NULL;
6873 	struct hostapd_hw_modes *mode;
6874 	u16 i;
6875 
6876 	if (wpa_s->hw.modes == NULL)
6877 		return NULL;
6878 
6879 	os_memset(&ranges, 0, sizeof(ranges));
6880 	if (freq_range_list_parse(&ranges, val) < 0)
6881 		return NULL;
6882 
6883 	for (i = 0; i < wpa_s->hw.num_modes; i++) {
6884 		int j;
6885 
6886 		mode = &wpa_s->hw.modes[i];
6887 		for (j = 0; j < mode->num_channels; j++) {
6888 			unsigned int freq;
6889 
6890 			if (mode->channels[j].flag & HOSTAPD_CHAN_DISABLED)
6891 				continue;
6892 
6893 			freq = mode->channels[j].freq;
6894 			if (!freq_range_list_includes(&ranges, freq))
6895 				continue;
6896 
6897 			int_array_add_unique(&freqs, freq);
6898 		}
6899 	}
6900 
6901 	os_free(ranges.range);
6902 	return freqs;
6903 }
6904 
6905 
6906 #ifdef CONFIG_INTERWORKING
6907 
6908 static int ctrl_interworking_select(struct wpa_supplicant *wpa_s, char *param)
6909 {
6910 	int auto_sel = 0;
6911 	int *freqs = NULL;
6912 
6913 	if (param) {
6914 		char *pos;
6915 
6916 		auto_sel = os_strstr(param, "auto") != NULL;
6917 
6918 		pos = os_strstr(param, "freq=");
6919 		if (pos) {
6920 			freqs = freq_range_to_channel_list(wpa_s, pos + 5);
6921 			if (freqs == NULL)
6922 				return -1;
6923 		}
6924 
6925 	}
6926 
6927 	return interworking_select(wpa_s, auto_sel, freqs);
6928 }
6929 
6930 
6931 static int ctrl_interworking_connect(struct wpa_supplicant *wpa_s, char *dst,
6932 				     int only_add)
6933 {
6934 	u8 bssid[ETH_ALEN];
6935 	struct wpa_bss *bss;
6936 
6937 	if (hwaddr_aton(dst, bssid)) {
6938 		wpa_printf(MSG_DEBUG, "Invalid BSSID '%s'", dst);
6939 		return -1;
6940 	}
6941 
6942 	bss = wpa_bss_get_bssid(wpa_s, bssid);
6943 	if (bss == NULL) {
6944 		wpa_printf(MSG_DEBUG, "Could not find BSS " MACSTR,
6945 			   MAC2STR(bssid));
6946 		return -1;
6947 	}
6948 
6949 	if (bss->ssid_len == 0) {
6950 		int found = 0;
6951 
6952 		wpa_printf(MSG_DEBUG, "Selected BSS entry for " MACSTR
6953 			   " does not have SSID information", MAC2STR(bssid));
6954 
6955 		dl_list_for_each_reverse(bss, &wpa_s->bss, struct wpa_bss,
6956 					 list) {
6957 			if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0 &&
6958 			    bss->ssid_len > 0) {
6959 				found = 1;
6960 				break;
6961 			}
6962 		}
6963 
6964 		if (!found)
6965 			return -1;
6966 		wpa_printf(MSG_DEBUG,
6967 			   "Found another matching BSS entry with SSID");
6968 	}
6969 
6970 	return interworking_connect(wpa_s, bss, only_add);
6971 }
6972 
6973 
6974 static int get_anqp(struct wpa_supplicant *wpa_s, char *dst)
6975 {
6976 	u8 dst_addr[ETH_ALEN];
6977 	int used;
6978 	char *pos;
6979 #define MAX_ANQP_INFO_ID 100
6980 	u16 id[MAX_ANQP_INFO_ID];
6981 	size_t num_id = 0;
6982 	u32 subtypes = 0;
6983 	u32 mbo_subtypes = 0;
6984 
6985 	used = hwaddr_aton2(dst, dst_addr);
6986 	if (used < 0)
6987 		return -1;
6988 	pos = dst + used;
6989 	if (*pos == ' ')
6990 		pos++;
6991 	while (num_id < MAX_ANQP_INFO_ID) {
6992 		if (os_strncmp(pos, "hs20:", 5) == 0) {
6993 #ifdef CONFIG_HS20
6994 			int num = atoi(pos + 5);
6995 			if (num <= 0 || num > 31)
6996 				return -1;
6997 			subtypes |= BIT(num);
6998 #else /* CONFIG_HS20 */
6999 			return -1;
7000 #endif /* CONFIG_HS20 */
7001 		} else if (os_strncmp(pos, "mbo:", 4) == 0) {
7002 #ifdef CONFIG_MBO
7003 			int num = atoi(pos + 4);
7004 
7005 			if (num <= 0 || num > MAX_MBO_ANQP_SUBTYPE)
7006 				return -1;
7007 			mbo_subtypes |= BIT(num);
7008 #else /* CONFIG_MBO */
7009 			return -1;
7010 #endif /* CONFIG_MBO */
7011 		} else {
7012 			id[num_id] = atoi(pos);
7013 			if (id[num_id])
7014 				num_id++;
7015 		}
7016 		pos = os_strchr(pos + 1, ',');
7017 		if (pos == NULL)
7018 			break;
7019 		pos++;
7020 	}
7021 
7022 	if (num_id == 0 && !subtypes && !mbo_subtypes)
7023 		return -1;
7024 
7025 	return anqp_send_req(wpa_s, dst_addr, id, num_id, subtypes,
7026 			     mbo_subtypes);
7027 }
7028 
7029 
7030 static int gas_request(struct wpa_supplicant *wpa_s, char *cmd)
7031 {
7032 	u8 dst_addr[ETH_ALEN];
7033 	struct wpabuf *advproto, *query = NULL;
7034 	int used, ret = -1;
7035 	char *pos, *end;
7036 	size_t len;
7037 
7038 	used = hwaddr_aton2(cmd, dst_addr);
7039 	if (used < 0)
7040 		return -1;
7041 
7042 	pos = cmd + used;
7043 	while (*pos == ' ')
7044 		pos++;
7045 
7046 	/* Advertisement Protocol ID */
7047 	end = os_strchr(pos, ' ');
7048 	if (end)
7049 		len = end - pos;
7050 	else
7051 		len = os_strlen(pos);
7052 	if (len & 0x01)
7053 		return -1;
7054 	len /= 2;
7055 	if (len == 0)
7056 		return -1;
7057 	advproto = wpabuf_alloc(len);
7058 	if (advproto == NULL)
7059 		return -1;
7060 	if (hexstr2bin(pos, wpabuf_put(advproto, len), len) < 0)
7061 		goto fail;
7062 
7063 	if (end) {
7064 		/* Optional Query Request */
7065 		pos = end + 1;
7066 		while (*pos == ' ')
7067 			pos++;
7068 
7069 		len = os_strlen(pos);
7070 		if (len) {
7071 			if (len & 0x01)
7072 				goto fail;
7073 			len /= 2;
7074 			if (len == 0)
7075 				goto fail;
7076 			query = wpabuf_alloc(len);
7077 			if (query == NULL)
7078 				goto fail;
7079 			if (hexstr2bin(pos, wpabuf_put(query, len), len) < 0)
7080 				goto fail;
7081 		}
7082 	}
7083 
7084 	ret = gas_send_request(wpa_s, dst_addr, advproto, query);
7085 
7086 fail:
7087 	wpabuf_free(advproto);
7088 	wpabuf_free(query);
7089 
7090 	return ret;
7091 }
7092 
7093 
7094 static int gas_response_get(struct wpa_supplicant *wpa_s, char *cmd, char *buf,
7095 			    size_t buflen)
7096 {
7097 	u8 addr[ETH_ALEN];
7098 	int dialog_token;
7099 	int used;
7100 	char *pos;
7101 	size_t resp_len, start, requested_len;
7102 	struct wpabuf *resp;
7103 	int ret;
7104 
7105 	used = hwaddr_aton2(cmd, addr);
7106 	if (used < 0)
7107 		return -1;
7108 
7109 	pos = cmd + used;
7110 	while (*pos == ' ')
7111 		pos++;
7112 	dialog_token = atoi(pos);
7113 
7114 	if (wpa_s->last_gas_resp &&
7115 	    os_memcmp(addr, wpa_s->last_gas_addr, ETH_ALEN) == 0 &&
7116 	    dialog_token == wpa_s->last_gas_dialog_token)
7117 		resp = wpa_s->last_gas_resp;
7118 	else if (wpa_s->prev_gas_resp &&
7119 		 os_memcmp(addr, wpa_s->prev_gas_addr, ETH_ALEN) == 0 &&
7120 		 dialog_token == wpa_s->prev_gas_dialog_token)
7121 		resp = wpa_s->prev_gas_resp;
7122 	else
7123 		return -1;
7124 
7125 	resp_len = wpabuf_len(resp);
7126 	start = 0;
7127 	requested_len = resp_len;
7128 
7129 	pos = os_strchr(pos, ' ');
7130 	if (pos) {
7131 		start = atoi(pos);
7132 		if (start > resp_len)
7133 			return os_snprintf(buf, buflen, "FAIL-Invalid range");
7134 		pos = os_strchr(pos, ',');
7135 		if (pos == NULL)
7136 			return -1;
7137 		pos++;
7138 		requested_len = atoi(pos);
7139 		if (start + requested_len > resp_len)
7140 			return os_snprintf(buf, buflen, "FAIL-Invalid range");
7141 	}
7142 
7143 	if (requested_len * 2 + 1 > buflen)
7144 		return os_snprintf(buf, buflen, "FAIL-Too long response");
7145 
7146 	ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(resp) + start,
7147 			       requested_len);
7148 
7149 	if (start + requested_len == resp_len) {
7150 		/*
7151 		 * Free memory by dropping the response after it has been
7152 		 * fetched.
7153 		 */
7154 		if (resp == wpa_s->prev_gas_resp) {
7155 			wpabuf_free(wpa_s->prev_gas_resp);
7156 			wpa_s->prev_gas_resp = NULL;
7157 		} else {
7158 			wpabuf_free(wpa_s->last_gas_resp);
7159 			wpa_s->last_gas_resp = NULL;
7160 		}
7161 	}
7162 
7163 	return ret;
7164 }
7165 #endif /* CONFIG_INTERWORKING */
7166 
7167 
7168 #ifdef CONFIG_HS20
7169 
7170 static int get_hs20_anqp(struct wpa_supplicant *wpa_s, char *dst)
7171 {
7172 	u8 dst_addr[ETH_ALEN];
7173 	int used;
7174 	char *pos;
7175 	u32 subtypes = 0;
7176 
7177 	used = hwaddr_aton2(dst, dst_addr);
7178 	if (used < 0)
7179 		return -1;
7180 	pos = dst + used;
7181 	if (*pos == ' ')
7182 		pos++;
7183 	for (;;) {
7184 		int num = atoi(pos);
7185 		if (num <= 0 || num > 31)
7186 			return -1;
7187 		subtypes |= BIT(num);
7188 		pos = os_strchr(pos + 1, ',');
7189 		if (pos == NULL)
7190 			break;
7191 		pos++;
7192 	}
7193 
7194 	if (subtypes == 0)
7195 		return -1;
7196 
7197 	return hs20_anqp_send_req(wpa_s, dst_addr, subtypes, NULL, 0, 0);
7198 }
7199 
7200 
7201 static int hs20_nai_home_realm_list(struct wpa_supplicant *wpa_s,
7202 				    const u8 *addr, const char *realm)
7203 {
7204 	u8 *buf;
7205 	size_t rlen, len;
7206 	int ret;
7207 
7208 	rlen = os_strlen(realm);
7209 	len = 3 + rlen;
7210 	buf = os_malloc(len);
7211 	if (buf == NULL)
7212 		return -1;
7213 	buf[0] = 1; /* NAI Home Realm Count */
7214 	buf[1] = 0; /* Formatted in accordance with RFC 4282 */
7215 	buf[2] = rlen;
7216 	os_memcpy(buf + 3, realm, rlen);
7217 
7218 	ret = hs20_anqp_send_req(wpa_s, addr,
7219 				 BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
7220 				 buf, len, 0);
7221 
7222 	os_free(buf);
7223 
7224 	return ret;
7225 }
7226 
7227 
7228 static int hs20_get_nai_home_realm_list(struct wpa_supplicant *wpa_s,
7229 					char *dst)
7230 {
7231 	struct wpa_cred *cred = wpa_s->conf->cred;
7232 	u8 dst_addr[ETH_ALEN];
7233 	int used;
7234 	u8 *buf;
7235 	size_t len;
7236 	int ret;
7237 
7238 	used = hwaddr_aton2(dst, dst_addr);
7239 	if (used < 0)
7240 		return -1;
7241 
7242 	while (dst[used] == ' ')
7243 		used++;
7244 	if (os_strncmp(dst + used, "realm=", 6) == 0)
7245 		return hs20_nai_home_realm_list(wpa_s, dst_addr,
7246 						dst + used + 6);
7247 
7248 	len = os_strlen(dst + used);
7249 
7250 	if (len == 0 && cred && cred->realm)
7251 		return hs20_nai_home_realm_list(wpa_s, dst_addr, cred->realm);
7252 
7253 	if (len & 1)
7254 		return -1;
7255 	len /= 2;
7256 	buf = os_malloc(len);
7257 	if (buf == NULL)
7258 		return -1;
7259 	if (hexstr2bin(dst + used, buf, len) < 0) {
7260 		os_free(buf);
7261 		return -1;
7262 	}
7263 
7264 	ret = hs20_anqp_send_req(wpa_s, dst_addr,
7265 				 BIT(HS20_STYPE_NAI_HOME_REALM_QUERY),
7266 				 buf, len, 0);
7267 	os_free(buf);
7268 
7269 	return ret;
7270 }
7271 
7272 
7273 static int get_hs20_icon(struct wpa_supplicant *wpa_s, char *cmd, char *reply,
7274 			 int buflen)
7275 {
7276 	u8 dst_addr[ETH_ALEN];
7277 	int used;
7278 	char *ctx = NULL, *icon, *poffset, *psize;
7279 
7280 	used = hwaddr_aton2(cmd, dst_addr);
7281 	if (used < 0)
7282 		return -1;
7283 	cmd += used;
7284 
7285 	icon = str_token(cmd, " ", &ctx);
7286 	poffset = str_token(cmd, " ", &ctx);
7287 	psize = str_token(cmd, " ", &ctx);
7288 	if (!icon || !poffset || !psize)
7289 		return -1;
7290 
7291 	wpa_s->fetch_osu_icon_in_progress = 0;
7292 	return hs20_get_icon(wpa_s, dst_addr, icon, atoi(poffset), atoi(psize),
7293 			     reply, buflen);
7294 }
7295 
7296 
7297 static int del_hs20_icon(struct wpa_supplicant *wpa_s, char *cmd)
7298 {
7299 	u8 dst_addr[ETH_ALEN];
7300 	int used;
7301 	char *icon;
7302 
7303 	if (!cmd[0])
7304 		return hs20_del_icon(wpa_s, NULL, NULL);
7305 
7306 	used = hwaddr_aton2(cmd, dst_addr);
7307 	if (used < 0)
7308 		return -1;
7309 
7310 	while (cmd[used] == ' ')
7311 		used++;
7312 	icon = cmd[used] ? &cmd[used] : NULL;
7313 
7314 	return hs20_del_icon(wpa_s, dst_addr, icon);
7315 }
7316 
7317 
7318 static int hs20_icon_request(struct wpa_supplicant *wpa_s, char *cmd, int inmem)
7319 {
7320 	u8 dst_addr[ETH_ALEN];
7321 	int used;
7322 	char *icon;
7323 
7324 	used = hwaddr_aton2(cmd, dst_addr);
7325 	if (used < 0)
7326 		return -1;
7327 
7328 	while (cmd[used] == ' ')
7329 		used++;
7330 	icon = &cmd[used];
7331 
7332 	wpa_s->fetch_osu_icon_in_progress = 0;
7333 	return hs20_anqp_send_req(wpa_s, dst_addr, BIT(HS20_STYPE_ICON_REQUEST),
7334 				  (u8 *) icon, os_strlen(icon), inmem);
7335 }
7336 
7337 #endif /* CONFIG_HS20 */
7338 
7339 
7340 #ifdef CONFIG_AUTOSCAN
7341 
7342 static int wpa_supplicant_ctrl_iface_autoscan(struct wpa_supplicant *wpa_s,
7343 					      char *cmd)
7344 {
7345 	enum wpa_states state = wpa_s->wpa_state;
7346 	char *new_params = NULL;
7347 
7348 	if (os_strlen(cmd) > 0) {
7349 		new_params = os_strdup(cmd);
7350 		if (new_params == NULL)
7351 			return -1;
7352 	}
7353 
7354 	os_free(wpa_s->conf->autoscan);
7355 	wpa_s->conf->autoscan = new_params;
7356 
7357 	if (wpa_s->conf->autoscan == NULL)
7358 		autoscan_deinit(wpa_s);
7359 	else if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
7360 		autoscan_init(wpa_s, 1);
7361 	else if (state == WPA_SCANNING)
7362 		wpa_supplicant_reinit_autoscan(wpa_s);
7363 	else
7364 		wpa_printf(MSG_DEBUG, "No autoscan update in state %s",
7365 			   wpa_supplicant_state_txt(state));
7366 
7367 	return 0;
7368 }
7369 
7370 #endif /* CONFIG_AUTOSCAN */
7371 
7372 
7373 #ifdef CONFIG_WNM
7374 
7375 static int wpas_ctrl_iface_wnm_sleep(struct wpa_supplicant *wpa_s, char *cmd)
7376 {
7377 	int enter;
7378 	int intval = 0;
7379 	char *pos;
7380 	int ret;
7381 	struct wpabuf *tfs_req = NULL;
7382 
7383 	if (os_strncmp(cmd, "enter", 5) == 0)
7384 		enter = 1;
7385 	else if (os_strncmp(cmd, "exit", 4) == 0)
7386 		enter = 0;
7387 	else
7388 		return -1;
7389 
7390 	pos = os_strstr(cmd, " interval=");
7391 	if (pos)
7392 		intval = atoi(pos + 10);
7393 
7394 	pos = os_strstr(cmd, " tfs_req=");
7395 	if (pos) {
7396 		char *end;
7397 		size_t len;
7398 		pos += 9;
7399 		end = os_strchr(pos, ' ');
7400 		if (end)
7401 			len = end - pos;
7402 		else
7403 			len = os_strlen(pos);
7404 		if (len & 1)
7405 			return -1;
7406 		len /= 2;
7407 		tfs_req = wpabuf_alloc(len);
7408 		if (tfs_req == NULL)
7409 			return -1;
7410 		if (hexstr2bin(pos, wpabuf_put(tfs_req, len), len) < 0) {
7411 			wpabuf_free(tfs_req);
7412 			return -1;
7413 		}
7414 	}
7415 
7416 	ret = ieee802_11_send_wnmsleep_req(wpa_s, enter ? WNM_SLEEP_MODE_ENTER :
7417 					   WNM_SLEEP_MODE_EXIT, intval,
7418 					   tfs_req);
7419 	wpabuf_free(tfs_req);
7420 
7421 	return ret;
7422 }
7423 
7424 
7425 static int wpas_ctrl_iface_wnm_bss_query(struct wpa_supplicant *wpa_s, char *cmd)
7426 {
7427 	int query_reason, list = 0;
7428 	char *btm_candidates = NULL;
7429 
7430 	query_reason = atoi(cmd);
7431 
7432 	cmd = os_strchr(cmd, ' ');
7433 	if (cmd) {
7434 		if (os_strncmp(cmd, " list", 5) == 0)
7435 			list = 1;
7436 		else
7437 			btm_candidates = cmd;
7438 	}
7439 
7440 	wpa_printf(MSG_DEBUG,
7441 		   "CTRL_IFACE: WNM_BSS_QUERY query_reason=%d%s",
7442 		   query_reason, list ? " candidate list" : "");
7443 
7444 	return wnm_send_bss_transition_mgmt_query(wpa_s, query_reason,
7445 						  btm_candidates,
7446 						  list);
7447 }
7448 
7449 
7450 static int wpas_ctrl_iface_coloc_intf_report(struct wpa_supplicant *wpa_s,
7451 					     char *cmd)
7452 {
7453 	struct wpabuf *elems;
7454 	int ret;
7455 
7456 	elems = wpabuf_parse_bin(cmd);
7457 	if (!elems)
7458 		return -1;
7459 
7460 	ret = wnm_send_coloc_intf_report(wpa_s, 0, elems);
7461 	wpabuf_free(elems);
7462 	return ret;
7463 }
7464 
7465 #endif /* CONFIG_WNM */
7466 
7467 
7468 static int wpa_supplicant_signal_poll(struct wpa_supplicant *wpa_s, char *buf,
7469 				      size_t buflen)
7470 {
7471 	struct wpa_signal_info si;
7472 	int ret;
7473 	char *pos, *end;
7474 
7475 	ret = wpa_drv_signal_poll(wpa_s, &si);
7476 	if (ret)
7477 		return -1;
7478 
7479 	pos = buf;
7480 	end = buf + buflen;
7481 
7482 	ret = os_snprintf(pos, end - pos, "RSSI=%d\nLINKSPEED=%d\n"
7483 			  "NOISE=%d\nFREQUENCY=%u\n",
7484 			  si.current_signal, si.current_txrate / 1000,
7485 			  si.current_noise, si.frequency);
7486 	if (os_snprintf_error(end - pos, ret))
7487 		return -1;
7488 	pos += ret;
7489 
7490 	if (si.chanwidth != CHAN_WIDTH_UNKNOWN) {
7491 		ret = os_snprintf(pos, end - pos, "WIDTH=%s\n",
7492 				  channel_width_to_string(si.chanwidth));
7493 		if (os_snprintf_error(end - pos, ret))
7494 			return -1;
7495 		pos += ret;
7496 	}
7497 
7498 	if (si.center_frq1 > 0) {
7499 		ret = os_snprintf(pos, end - pos, "CENTER_FRQ1=%d\n",
7500 				  si.center_frq1);
7501 		if (os_snprintf_error(end - pos, ret))
7502 			return -1;
7503 		pos += ret;
7504 	}
7505 
7506 	if (si.center_frq2 > 0) {
7507 		ret = os_snprintf(pos, end - pos, "CENTER_FRQ2=%d\n",
7508 				  si.center_frq2);
7509 		if (os_snprintf_error(end - pos, ret))
7510 			return -1;
7511 		pos += ret;
7512 	}
7513 
7514 	if (si.avg_signal) {
7515 		ret = os_snprintf(pos, end - pos,
7516 				  "AVG_RSSI=%d\n", si.avg_signal);
7517 		if (os_snprintf_error(end - pos, ret))
7518 			return -1;
7519 		pos += ret;
7520 	}
7521 
7522 	if (si.avg_beacon_signal) {
7523 		ret = os_snprintf(pos, end - pos,
7524 				  "AVG_BEACON_RSSI=%d\n", si.avg_beacon_signal);
7525 		if (os_snprintf_error(end - pos, ret))
7526 			return -1;
7527 		pos += ret;
7528 	}
7529 
7530 	return pos - buf;
7531 }
7532 
7533 
7534 static int wpas_ctrl_iface_signal_monitor(struct wpa_supplicant *wpa_s,
7535 					  const char *cmd)
7536 {
7537 	const char *pos;
7538 	int threshold = 0;
7539 	int hysteresis = 0;
7540 
7541 	if (wpa_s->bgscan && wpa_s->bgscan_priv) {
7542 		wpa_printf(MSG_DEBUG,
7543 			   "Reject SIGNAL_MONITOR command - bgscan is active");
7544 		return -1;
7545 	}
7546 	pos = os_strstr(cmd, "THRESHOLD=");
7547 	if (pos)
7548 		threshold = atoi(pos + 10);
7549 	pos = os_strstr(cmd, "HYSTERESIS=");
7550 	if (pos)
7551 		hysteresis = atoi(pos + 11);
7552 	return wpa_drv_signal_monitor(wpa_s, threshold, hysteresis);
7553 }
7554 
7555 
7556 #ifdef CONFIG_TESTING_OPTIONS
7557 int wpas_ctrl_iface_get_pref_freq_list_override(struct wpa_supplicant *wpa_s,
7558 						enum wpa_driver_if_type if_type,
7559 						unsigned int *num,
7560 						unsigned int *freq_list)
7561 {
7562 	char *pos = wpa_s->get_pref_freq_list_override;
7563 	char *end;
7564 	unsigned int count = 0;
7565 
7566 	/* Override string format:
7567 	 *  <if_type1>:<freq1>,<freq2>,... <if_type2>:... */
7568 
7569 	while (pos) {
7570 		if (atoi(pos) == (int) if_type)
7571 			break;
7572 		pos = os_strchr(pos, ' ');
7573 		if (pos)
7574 			pos++;
7575 	}
7576 	if (!pos)
7577 		return -1;
7578 	pos = os_strchr(pos, ':');
7579 	if (!pos)
7580 		return -1;
7581 	pos++;
7582 	end = os_strchr(pos, ' ');
7583 	while (pos && (!end || pos < end) && count < *num) {
7584 		freq_list[count++] = atoi(pos);
7585 		pos = os_strchr(pos, ',');
7586 		if (pos)
7587 			pos++;
7588 	}
7589 
7590 	*num = count;
7591 	return 0;
7592 }
7593 #endif /* CONFIG_TESTING_OPTIONS */
7594 
7595 
7596 static int wpas_ctrl_iface_get_pref_freq_list(
7597 	struct wpa_supplicant *wpa_s, char *cmd, char *buf, size_t buflen)
7598 {
7599 	unsigned int freq_list[100], num = 100, i;
7600 	int ret;
7601 	enum wpa_driver_if_type iface_type;
7602 	char *pos, *end;
7603 
7604 	pos = buf;
7605 	end = buf + buflen;
7606 
7607 	/* buf: "<interface_type>" */
7608 	if (os_strcmp(cmd, "STATION") == 0)
7609 		iface_type = WPA_IF_STATION;
7610 	else if (os_strcmp(cmd, "AP") == 0)
7611 		iface_type = WPA_IF_AP_BSS;
7612 	else if (os_strcmp(cmd, "P2P_GO") == 0)
7613 		iface_type = WPA_IF_P2P_GO;
7614 	else if (os_strcmp(cmd, "P2P_CLIENT") == 0)
7615 		iface_type = WPA_IF_P2P_CLIENT;
7616 	else if (os_strcmp(cmd, "IBSS") == 0)
7617 		iface_type = WPA_IF_IBSS;
7618 	else if (os_strcmp(cmd, "TDLS") == 0)
7619 		iface_type = WPA_IF_TDLS;
7620 	else
7621 		return -1;
7622 
7623 	wpa_printf(MSG_DEBUG,
7624 		   "CTRL_IFACE: GET_PREF_FREQ_LIST iface_type=%d (%s)",
7625 		   iface_type, buf);
7626 
7627 	ret = wpa_drv_get_pref_freq_list(wpa_s, iface_type, &num, freq_list);
7628 	if (ret)
7629 		return -1;
7630 
7631 	for (i = 0; i < num; i++) {
7632 		ret = os_snprintf(pos, end - pos, "%s%u",
7633 				  i > 0 ? "," : "", freq_list[i]);
7634 		if (os_snprintf_error(end - pos, ret))
7635 			return -1;
7636 		pos += ret;
7637 	}
7638 
7639 	return pos - buf;
7640 }
7641 
7642 
7643 static int wpas_ctrl_iface_driver_flags(struct wpa_supplicant *wpa_s,
7644 					char *buf, size_t buflen)
7645 {
7646 	int ret, i;
7647 	char *pos, *end;
7648 
7649 	ret = os_snprintf(buf, buflen, "%016llX:\n",
7650 			  (long long unsigned) wpa_s->drv_flags);
7651 	if (os_snprintf_error(buflen, ret))
7652 		return -1;
7653 
7654 	pos = buf + ret;
7655 	end = buf + buflen;
7656 
7657 	for (i = 0; i < 64; i++) {
7658 		if (wpa_s->drv_flags & (1LLU << i)) {
7659 			ret = os_snprintf(pos, end - pos, "%s\n",
7660 					  driver_flag_to_string(1LLU << i));
7661 			if (os_snprintf_error(end - pos, ret))
7662 				return -1;
7663 			pos += ret;
7664 		}
7665 	}
7666 
7667 	return pos - buf;
7668 }
7669 
7670 
7671 static int wpa_supplicant_pktcnt_poll(struct wpa_supplicant *wpa_s, char *buf,
7672 				      size_t buflen)
7673 {
7674 	struct hostap_sta_driver_data sta;
7675 	int ret;
7676 
7677 	ret = wpa_drv_pktcnt_poll(wpa_s, &sta);
7678 	if (ret)
7679 		return -1;
7680 
7681 	ret = os_snprintf(buf, buflen, "TXGOOD=%lu\nTXBAD=%lu\nRXGOOD=%lu\n",
7682 			  sta.tx_packets, sta.tx_retry_failed, sta.rx_packets);
7683 	if (os_snprintf_error(buflen, ret))
7684 		return -1;
7685 	return ret;
7686 }
7687 
7688 
7689 #ifdef ANDROID
7690 static int wpa_supplicant_driver_cmd(struct wpa_supplicant *wpa_s, char *cmd,
7691 				     char *buf, size_t buflen)
7692 {
7693 	int ret;
7694 
7695 	ret = wpa_drv_driver_cmd(wpa_s, cmd, buf, buflen);
7696 	if (ret == 0) {
7697 		if (os_strncasecmp(cmd, "COUNTRY", 7) == 0) {
7698 			struct p2p_data *p2p = wpa_s->global->p2p;
7699 			if (p2p) {
7700 				char country[3];
7701 				country[0] = cmd[8];
7702 				country[1] = cmd[9];
7703 				country[2] = 0x04;
7704 				p2p_set_country(p2p, country);
7705 			}
7706 		}
7707 		ret = os_snprintf(buf, buflen, "%s\n", "OK");
7708 		if (os_snprintf_error(buflen, ret))
7709 			ret = -1;
7710 	}
7711 	return ret;
7712 }
7713 #endif /* ANDROID */
7714 
7715 
7716 static int wpa_supplicant_vendor_cmd(struct wpa_supplicant *wpa_s, char *cmd,
7717 				     char *buf, size_t buflen)
7718 {
7719 	int ret;
7720 	char *pos;
7721 	u8 *data = NULL;
7722 	unsigned int vendor_id, subcmd;
7723 	struct wpabuf *reply;
7724 	size_t data_len = 0;
7725 
7726 	/* cmd: <vendor id> <subcommand id> [<hex formatted data>] */
7727 	vendor_id = strtoul(cmd, &pos, 16);
7728 	if (!isblank((unsigned char) *pos))
7729 		return -EINVAL;
7730 
7731 	subcmd = strtoul(pos, &pos, 10);
7732 
7733 	if (*pos != '\0') {
7734 		if (!isblank((unsigned char) *pos++))
7735 			return -EINVAL;
7736 		data_len = os_strlen(pos);
7737 	}
7738 
7739 	if (data_len) {
7740 		data_len /= 2;
7741 		data = os_malloc(data_len);
7742 		if (!data)
7743 			return -1;
7744 
7745 		if (hexstr2bin(pos, data, data_len)) {
7746 			wpa_printf(MSG_DEBUG,
7747 				   "Vendor command: wrong parameter format");
7748 			os_free(data);
7749 			return -EINVAL;
7750 		}
7751 	}
7752 
7753 	reply = wpabuf_alloc((buflen - 1) / 2);
7754 	if (!reply) {
7755 		os_free(data);
7756 		return -1;
7757 	}
7758 
7759 	ret = wpa_drv_vendor_cmd(wpa_s, vendor_id, subcmd, data, data_len,
7760 				 reply);
7761 
7762 	if (ret == 0)
7763 		ret = wpa_snprintf_hex(buf, buflen, wpabuf_head_u8(reply),
7764 				       wpabuf_len(reply));
7765 
7766 	wpabuf_free(reply);
7767 	os_free(data);
7768 
7769 	return ret;
7770 }
7771 
7772 
7773 static void wpa_supplicant_ctrl_iface_flush(struct wpa_supplicant *wpa_s)
7774 {
7775 #ifdef CONFIG_P2P
7776 	struct wpa_supplicant *p2p_wpa_s = wpa_s->global->p2p_init_wpa_s ?
7777 		wpa_s->global->p2p_init_wpa_s : wpa_s;
7778 #endif /* CONFIG_P2P */
7779 
7780 	wpa_dbg(wpa_s, MSG_DEBUG, "Flush all wpa_supplicant state");
7781 
7782 	if (wpas_abort_ongoing_scan(wpa_s) == 0)
7783 		wpa_s->ignore_post_flush_scan_res = 1;
7784 
7785 	if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
7786 		/*
7787 		 * Avoid possible auto connect re-connection on getting
7788 		 * disconnected due to state flush.
7789 		 */
7790 		wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
7791 	}
7792 
7793 #ifdef CONFIG_P2P
7794 	wpas_p2p_group_remove(p2p_wpa_s, "*");
7795 	wpas_p2p_cancel(p2p_wpa_s);
7796 	p2p_ctrl_flush(p2p_wpa_s);
7797 	wpas_p2p_service_flush(p2p_wpa_s);
7798 	p2p_wpa_s->global->p2p_disabled = 0;
7799 	p2p_wpa_s->global->p2p_per_sta_psk = 0;
7800 	p2p_wpa_s->conf->num_sec_device_types = 0;
7801 	p2p_wpa_s->p2p_disable_ip_addr_req = 0;
7802 	os_free(p2p_wpa_s->global->p2p_go_avoid_freq.range);
7803 	p2p_wpa_s->global->p2p_go_avoid_freq.range = NULL;
7804 	p2p_wpa_s->global->p2p_go_avoid_freq.num = 0;
7805 	p2p_wpa_s->global->pending_p2ps_group = 0;
7806 	p2p_wpa_s->global->pending_p2ps_group_freq = 0;
7807 #endif /* CONFIG_P2P */
7808 
7809 #ifdef CONFIG_WPS_TESTING
7810 	wps_version_number = 0x20;
7811 	wps_testing_dummy_cred = 0;
7812 	wps_corrupt_pkhash = 0;
7813 	wps_force_auth_types_in_use = 0;
7814 	wps_force_encr_types_in_use = 0;
7815 #endif /* CONFIG_WPS_TESTING */
7816 #ifdef CONFIG_WPS
7817 	wpa_s->wps_fragment_size = 0;
7818 	wpas_wps_cancel(wpa_s);
7819 	wps_registrar_flush(wpa_s->wps->registrar);
7820 #endif /* CONFIG_WPS */
7821 	wpa_s->after_wps = 0;
7822 	wpa_s->known_wps_freq = 0;
7823 
7824 #ifdef CONFIG_DPP
7825 	wpas_dpp_deinit(wpa_s);
7826 	wpa_s->dpp_init_max_tries = 0;
7827 	wpa_s->dpp_init_retry_time = 0;
7828 	wpa_s->dpp_resp_wait_time = 0;
7829 	wpa_s->dpp_resp_max_tries = 0;
7830 	wpa_s->dpp_resp_retry_time = 0;
7831 #ifdef CONFIG_TESTING_OPTIONS
7832 	os_memset(dpp_pkex_own_mac_override, 0, ETH_ALEN);
7833 	os_memset(dpp_pkex_peer_mac_override, 0, ETH_ALEN);
7834 	dpp_pkex_ephemeral_key_override_len = 0;
7835 	dpp_protocol_key_override_len = 0;
7836 	dpp_nonce_override_len = 0;
7837 #endif /* CONFIG_TESTING_OPTIONS */
7838 #endif /* CONFIG_DPP */
7839 
7840 #ifdef CONFIG_TDLS
7841 #ifdef CONFIG_TDLS_TESTING
7842 	tdls_testing = 0;
7843 #endif /* CONFIG_TDLS_TESTING */
7844 	wpa_drv_tdls_oper(wpa_s, TDLS_ENABLE, NULL);
7845 	wpa_tdls_enable(wpa_s->wpa, 1);
7846 #endif /* CONFIG_TDLS */
7847 
7848 	eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
7849 	wpa_supplicant_stop_countermeasures(wpa_s, NULL);
7850 
7851 	wpa_s->no_keep_alive = 0;
7852 	wpa_s->own_disconnect_req = 0;
7853 
7854 	os_free(wpa_s->disallow_aps_bssid);
7855 	wpa_s->disallow_aps_bssid = NULL;
7856 	wpa_s->disallow_aps_bssid_count = 0;
7857 	os_free(wpa_s->disallow_aps_ssid);
7858 	wpa_s->disallow_aps_ssid = NULL;
7859 	wpa_s->disallow_aps_ssid_count = 0;
7860 
7861 	wpa_s->set_sta_uapsd = 0;
7862 	wpa_s->sta_uapsd = 0;
7863 
7864 	wpa_drv_radio_disable(wpa_s, 0);
7865 	wpa_blacklist_clear(wpa_s);
7866 	wpa_s->extra_blacklist_count = 0;
7867 	wpa_supplicant_ctrl_iface_remove_network(wpa_s, "all");
7868 	wpa_supplicant_ctrl_iface_remove_cred(wpa_s, "all");
7869 	wpa_config_flush_blobs(wpa_s->conf);
7870 	wpa_s->conf->auto_interworking = 0;
7871 	wpa_s->conf->okc = 0;
7872 
7873 	wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
7874 	rsn_preauth_deinit(wpa_s->wpa);
7875 
7876 	wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME, 43200);
7877 	wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD, 70);
7878 	wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT, 60);
7879 	eapol_sm_notify_logoff(wpa_s->eapol, FALSE);
7880 
7881 	radio_remove_works(wpa_s, NULL, 1);
7882 	wpa_s->ext_work_in_progress = 0;
7883 
7884 	wpa_s->next_ssid = NULL;
7885 
7886 #ifdef CONFIG_INTERWORKING
7887 #ifdef CONFIG_HS20
7888 	hs20_cancel_fetch_osu(wpa_s);
7889 	hs20_del_icon(wpa_s, NULL, NULL);
7890 #endif /* CONFIG_HS20 */
7891 #endif /* CONFIG_INTERWORKING */
7892 
7893 	wpa_s->ext_mgmt_frame_handling = 0;
7894 	wpa_s->ext_eapol_frame_io = 0;
7895 #ifdef CONFIG_TESTING_OPTIONS
7896 	wpa_s->extra_roc_dur = 0;
7897 	wpa_s->test_failure = WPAS_TEST_FAILURE_NONE;
7898 	wpa_s->p2p_go_csa_on_inv = 0;
7899 	wpa_s->ignore_auth_resp = 0;
7900 	wpa_s->ignore_assoc_disallow = 0;
7901 	wpa_s->testing_resend_assoc = 0;
7902 	wpa_s->reject_btm_req_reason = 0;
7903 	wpa_sm_set_test_assoc_ie(wpa_s->wpa, NULL);
7904 	os_free(wpa_s->get_pref_freq_list_override);
7905 	wpa_s->get_pref_freq_list_override = NULL;
7906 	wpabuf_free(wpa_s->sae_commit_override);
7907 	wpa_s->sae_commit_override = NULL;
7908 #ifdef CONFIG_DPP
7909 	os_free(wpa_s->dpp_config_obj_override);
7910 	wpa_s->dpp_config_obj_override = NULL;
7911 	os_free(wpa_s->dpp_discovery_override);
7912 	wpa_s->dpp_discovery_override = NULL;
7913 	os_free(wpa_s->dpp_groups_override);
7914 	wpa_s->dpp_groups_override = NULL;
7915 	dpp_test = DPP_TEST_DISABLED;
7916 #endif /* CONFIG_DPP */
7917 #endif /* CONFIG_TESTING_OPTIONS */
7918 
7919 	wpa_s->disconnected = 0;
7920 	os_free(wpa_s->next_scan_freqs);
7921 	wpa_s->next_scan_freqs = NULL;
7922 	os_free(wpa_s->select_network_scan_freqs);
7923 	wpa_s->select_network_scan_freqs = NULL;
7924 
7925 	wpa_bss_flush(wpa_s);
7926 	if (!dl_list_empty(&wpa_s->bss)) {
7927 		wpa_printf(MSG_DEBUG,
7928 			   "BSS table not empty after flush: %u entries, current_bss=%p bssid="
7929 			   MACSTR " pending_bssid=" MACSTR,
7930 			   dl_list_len(&wpa_s->bss), wpa_s->current_bss,
7931 			   MAC2STR(wpa_s->bssid),
7932 			   MAC2STR(wpa_s->pending_bssid));
7933 	}
7934 
7935 	eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
7936 	wpa_s->wnmsleep_used = 0;
7937 
7938 #ifdef CONFIG_SME
7939 	wpa_s->sme.last_unprot_disconnect.sec = 0;
7940 #endif /* CONFIG_SME */
7941 
7942 	wpabuf_free(wpa_s->ric_ies);
7943 	wpa_s->ric_ies = NULL;
7944 }
7945 
7946 
7947 static int wpas_ctrl_radio_work_show(struct wpa_supplicant *wpa_s,
7948 				     char *buf, size_t buflen)
7949 {
7950 	struct wpa_radio_work *work;
7951 	char *pos, *end;
7952 	struct os_reltime now, diff;
7953 
7954 	pos = buf;
7955 	end = buf + buflen;
7956 
7957 	os_get_reltime(&now);
7958 
7959 	dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
7960 	{
7961 		int ret;
7962 
7963 		os_reltime_sub(&now, &work->time, &diff);
7964 		ret = os_snprintf(pos, end - pos, "%s@%s:%u:%u:%ld.%06ld\n",
7965 				  work->type, work->wpa_s->ifname, work->freq,
7966 				  work->started, diff.sec, diff.usec);
7967 		if (os_snprintf_error(end - pos, ret))
7968 			break;
7969 		pos += ret;
7970 	}
7971 
7972 	return pos - buf;
7973 }
7974 
7975 
7976 static void wpas_ctrl_radio_work_timeout(void *eloop_ctx, void *timeout_ctx)
7977 {
7978 	struct wpa_radio_work *work = eloop_ctx;
7979 	struct wpa_external_work *ework = work->ctx;
7980 
7981 	wpa_dbg(work->wpa_s, MSG_DEBUG,
7982 		"Timing out external radio work %u (%s)",
7983 		ework->id, work->type);
7984 	wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_TIMEOUT "%u", ework->id);
7985 	work->wpa_s->ext_work_in_progress = 0;
7986 	radio_work_done(work);
7987 	os_free(ework);
7988 }
7989 
7990 
7991 static void wpas_ctrl_radio_work_cb(struct wpa_radio_work *work, int deinit)
7992 {
7993 	struct wpa_external_work *ework = work->ctx;
7994 
7995 	if (deinit) {
7996 		if (work->started)
7997 			eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
7998 					     work, NULL);
7999 
8000 		/*
8001 		 * work->type points to a buffer in ework, so need to replace
8002 		 * that here with a fixed string to avoid use of freed memory
8003 		 * in debug prints.
8004 		 */
8005 		work->type = "freed-ext-work";
8006 		work->ctx = NULL;
8007 		os_free(ework);
8008 		return;
8009 	}
8010 
8011 	wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting external radio work %u (%s)",
8012 		ework->id, ework->type);
8013 	wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_START "%u", ework->id);
8014 	work->wpa_s->ext_work_in_progress = 1;
8015 	if (!ework->timeout)
8016 		ework->timeout = 10;
8017 	eloop_register_timeout(ework->timeout, 0, wpas_ctrl_radio_work_timeout,
8018 			       work, NULL);
8019 }
8020 
8021 
8022 static int wpas_ctrl_radio_work_add(struct wpa_supplicant *wpa_s, char *cmd,
8023 				    char *buf, size_t buflen)
8024 {
8025 	struct wpa_external_work *ework;
8026 	char *pos, *pos2;
8027 	size_t type_len;
8028 	int ret;
8029 	unsigned int freq = 0;
8030 
8031 	/* format: <name> [freq=<MHz>] [timeout=<seconds>] */
8032 
8033 	ework = os_zalloc(sizeof(*ework));
8034 	if (ework == NULL)
8035 		return -1;
8036 
8037 	pos = os_strchr(cmd, ' ');
8038 	if (pos) {
8039 		type_len = pos - cmd;
8040 		pos++;
8041 
8042 		pos2 = os_strstr(pos, "freq=");
8043 		if (pos2)
8044 			freq = atoi(pos2 + 5);
8045 
8046 		pos2 = os_strstr(pos, "timeout=");
8047 		if (pos2)
8048 			ework->timeout = atoi(pos2 + 8);
8049 	} else {
8050 		type_len = os_strlen(cmd);
8051 	}
8052 	if (4 + type_len >= sizeof(ework->type))
8053 		type_len = sizeof(ework->type) - 4 - 1;
8054 	os_strlcpy(ework->type, "ext:", sizeof(ework->type));
8055 	os_memcpy(ework->type + 4, cmd, type_len);
8056 	ework->type[4 + type_len] = '\0';
8057 
8058 	wpa_s->ext_work_id++;
8059 	if (wpa_s->ext_work_id == 0)
8060 		wpa_s->ext_work_id++;
8061 	ework->id = wpa_s->ext_work_id;
8062 
8063 	if (radio_add_work(wpa_s, freq, ework->type, 0, wpas_ctrl_radio_work_cb,
8064 			   ework) < 0) {
8065 		os_free(ework);
8066 		return -1;
8067 	}
8068 
8069 	ret = os_snprintf(buf, buflen, "%u", ework->id);
8070 	if (os_snprintf_error(buflen, ret))
8071 		return -1;
8072 	return ret;
8073 }
8074 
8075 
8076 static int wpas_ctrl_radio_work_done(struct wpa_supplicant *wpa_s, char *cmd)
8077 {
8078 	struct wpa_radio_work *work;
8079 	unsigned int id = atoi(cmd);
8080 
8081 	dl_list_for_each(work, &wpa_s->radio->work, struct wpa_radio_work, list)
8082 	{
8083 		struct wpa_external_work *ework;
8084 
8085 		if (os_strncmp(work->type, "ext:", 4) != 0)
8086 			continue;
8087 		ework = work->ctx;
8088 		if (id && ework->id != id)
8089 			continue;
8090 		wpa_dbg(wpa_s, MSG_DEBUG,
8091 			"Completed external radio work %u (%s)",
8092 			ework->id, ework->type);
8093 		eloop_cancel_timeout(wpas_ctrl_radio_work_timeout, work, NULL);
8094 		wpa_s->ext_work_in_progress = 0;
8095 		radio_work_done(work);
8096 		os_free(ework);
8097 		return 3; /* "OK\n" */
8098 	}
8099 
8100 	return -1;
8101 }
8102 
8103 
8104 static int wpas_ctrl_radio_work(struct wpa_supplicant *wpa_s, char *cmd,
8105 				char *buf, size_t buflen)
8106 {
8107 	if (os_strcmp(cmd, "show") == 0)
8108 		return wpas_ctrl_radio_work_show(wpa_s, buf, buflen);
8109 	if (os_strncmp(cmd, "add ", 4) == 0)
8110 		return wpas_ctrl_radio_work_add(wpa_s, cmd + 4, buf, buflen);
8111 	if (os_strncmp(cmd, "done ", 5) == 0)
8112 		return wpas_ctrl_radio_work_done(wpa_s, cmd + 4);
8113 	return -1;
8114 }
8115 
8116 
8117 void wpas_ctrl_radio_work_flush(struct wpa_supplicant *wpa_s)
8118 {
8119 	struct wpa_radio_work *work, *tmp;
8120 
8121 	if (!wpa_s || !wpa_s->radio)
8122 		return;
8123 
8124 	dl_list_for_each_safe(work, tmp, &wpa_s->radio->work,
8125 			      struct wpa_radio_work, list) {
8126 		struct wpa_external_work *ework;
8127 
8128 		if (os_strncmp(work->type, "ext:", 4) != 0)
8129 			continue;
8130 		ework = work->ctx;
8131 		wpa_dbg(wpa_s, MSG_DEBUG,
8132 			"Flushing%s external radio work %u (%s)",
8133 			work->started ? " started" : "", ework->id,
8134 			ework->type);
8135 		if (work->started)
8136 			eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
8137 					     work, NULL);
8138 		radio_work_done(work);
8139 		os_free(ework);
8140 	}
8141 }
8142 
8143 
8144 static void wpas_ctrl_eapol_response(void *eloop_ctx, void *timeout_ctx)
8145 {
8146 	struct wpa_supplicant *wpa_s = eloop_ctx;
8147 	eapol_sm_notify_ctrl_response(wpa_s->eapol);
8148 }
8149 
8150 
8151 static int scan_id_list_parse(struct wpa_supplicant *wpa_s, const char *value,
8152 			      unsigned int *scan_id_count, int scan_id[])
8153 {
8154 	const char *pos = value;
8155 
8156 	while (pos) {
8157 		if (*pos == ' ' || *pos == '\0')
8158 			break;
8159 		if (*scan_id_count == MAX_SCAN_ID)
8160 			return -1;
8161 		scan_id[(*scan_id_count)++] = atoi(pos);
8162 		pos = os_strchr(pos, ',');
8163 		if (pos)
8164 			pos++;
8165 	}
8166 
8167 	return 0;
8168 }
8169 
8170 
8171 static void wpas_ctrl_scan(struct wpa_supplicant *wpa_s, char *params,
8172 			   char *reply, int reply_size, int *reply_len)
8173 {
8174 	char *pos;
8175 	unsigned int manual_scan_passive = 0;
8176 	unsigned int manual_scan_use_id = 0;
8177 	unsigned int manual_scan_only_new = 0;
8178 	unsigned int scan_only = 0;
8179 	unsigned int scan_id_count = 0;
8180 	int scan_id[MAX_SCAN_ID];
8181 	void (*scan_res_handler)(struct wpa_supplicant *wpa_s,
8182 				 struct wpa_scan_results *scan_res);
8183 	int *manual_scan_freqs = NULL;
8184 	struct wpa_ssid_value *ssid = NULL, *ns;
8185 	unsigned int ssid_count = 0;
8186 
8187 	if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
8188 		*reply_len = -1;
8189 		return;
8190 	}
8191 
8192 	if (radio_work_pending(wpa_s, "scan")) {
8193 		wpa_printf(MSG_DEBUG,
8194 			   "Pending scan scheduled - reject new request");
8195 		*reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
8196 		return;
8197 	}
8198 
8199 #ifdef CONFIG_INTERWORKING
8200 	if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select) {
8201 		wpa_printf(MSG_DEBUG,
8202 			   "Interworking select in progress - reject new scan");
8203 		*reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
8204 		return;
8205 	}
8206 #endif /* CONFIG_INTERWORKING */
8207 
8208 	if (params) {
8209 		if (os_strncasecmp(params, "TYPE=ONLY", 9) == 0)
8210 			scan_only = 1;
8211 
8212 		pos = os_strstr(params, "freq=");
8213 		if (pos) {
8214 			manual_scan_freqs = freq_range_to_channel_list(wpa_s,
8215 								       pos + 5);
8216 			if (manual_scan_freqs == NULL) {
8217 				*reply_len = -1;
8218 				goto done;
8219 			}
8220 		}
8221 
8222 		pos = os_strstr(params, "passive=");
8223 		if (pos)
8224 			manual_scan_passive = !!atoi(pos + 8);
8225 
8226 		pos = os_strstr(params, "use_id=");
8227 		if (pos)
8228 			manual_scan_use_id = atoi(pos + 7);
8229 
8230 		pos = os_strstr(params, "only_new=1");
8231 		if (pos)
8232 			manual_scan_only_new = 1;
8233 
8234 		pos = os_strstr(params, "scan_id=");
8235 		if (pos && scan_id_list_parse(wpa_s, pos + 8, &scan_id_count,
8236 					      scan_id) < 0) {
8237 			*reply_len = -1;
8238 			goto done;
8239 		}
8240 
8241 		pos = os_strstr(params, "bssid=");
8242 		if (pos) {
8243 			u8 bssid[ETH_ALEN];
8244 
8245 			pos += 6;
8246 			if (hwaddr_aton(pos, bssid)) {
8247 				wpa_printf(MSG_ERROR, "Invalid BSSID %s", pos);
8248 				*reply_len = -1;
8249 				goto done;
8250 			}
8251 			os_memcpy(wpa_s->next_scan_bssid, bssid, ETH_ALEN);
8252 		}
8253 
8254 		pos = params;
8255 		while (pos && *pos != '\0') {
8256 			if (os_strncmp(pos, "ssid ", 5) == 0) {
8257 				char *end;
8258 
8259 				pos += 5;
8260 				end = pos;
8261 				while (*end) {
8262 					if (*end == '\0' || *end == ' ')
8263 						break;
8264 					end++;
8265 				}
8266 
8267 				ns = os_realloc_array(
8268 					ssid, ssid_count + 1,
8269 					sizeof(struct wpa_ssid_value));
8270 				if (ns == NULL) {
8271 					*reply_len = -1;
8272 					goto done;
8273 				}
8274 				ssid = ns;
8275 
8276 				if ((end - pos) & 0x01 ||
8277 				    end - pos > 2 * SSID_MAX_LEN ||
8278 				    hexstr2bin(pos, ssid[ssid_count].ssid,
8279 					       (end - pos) / 2) < 0) {
8280 					wpa_printf(MSG_DEBUG,
8281 						   "Invalid SSID value '%s'",
8282 						   pos);
8283 					*reply_len = -1;
8284 					goto done;
8285 				}
8286 				ssid[ssid_count].ssid_len = (end - pos) / 2;
8287 				wpa_hexdump_ascii(MSG_DEBUG, "scan SSID",
8288 						  ssid[ssid_count].ssid,
8289 						  ssid[ssid_count].ssid_len);
8290 				ssid_count++;
8291 				pos = end;
8292 			}
8293 
8294 			pos = os_strchr(pos, ' ');
8295 			if (pos)
8296 				pos++;
8297 		}
8298 	}
8299 
8300 	wpa_s->num_ssids_from_scan_req = ssid_count;
8301 	os_free(wpa_s->ssids_from_scan_req);
8302 	if (ssid_count) {
8303 		wpa_s->ssids_from_scan_req = ssid;
8304 		ssid = NULL;
8305 	} else {
8306 		wpa_s->ssids_from_scan_req = NULL;
8307 	}
8308 
8309 	if (scan_only)
8310 		scan_res_handler = scan_only_handler;
8311 	else if (wpa_s->scan_res_handler == scan_only_handler)
8312 		scan_res_handler = NULL;
8313 	else
8314 		scan_res_handler = wpa_s->scan_res_handler;
8315 
8316 	if (!wpa_s->sched_scanning && !wpa_s->scanning &&
8317 	    ((wpa_s->wpa_state <= WPA_SCANNING) ||
8318 	     (wpa_s->wpa_state == WPA_COMPLETED))) {
8319 		wpa_s->manual_scan_passive = manual_scan_passive;
8320 		wpa_s->manual_scan_use_id = manual_scan_use_id;
8321 		wpa_s->manual_scan_only_new = manual_scan_only_new;
8322 		wpa_s->scan_id_count = scan_id_count;
8323 		os_memcpy(wpa_s->scan_id, scan_id, scan_id_count * sizeof(int));
8324 		wpa_s->scan_res_handler = scan_res_handler;
8325 		os_free(wpa_s->manual_scan_freqs);
8326 		wpa_s->manual_scan_freqs = manual_scan_freqs;
8327 		manual_scan_freqs = NULL;
8328 
8329 		wpa_s->normal_scans = 0;
8330 		wpa_s->scan_req = MANUAL_SCAN_REQ;
8331 		wpa_s->after_wps = 0;
8332 		wpa_s->known_wps_freq = 0;
8333 		wpa_supplicant_req_scan(wpa_s, 0, 0);
8334 		if (wpa_s->manual_scan_use_id) {
8335 			wpa_s->manual_scan_id++;
8336 			wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
8337 				wpa_s->manual_scan_id);
8338 			*reply_len = os_snprintf(reply, reply_size, "%u\n",
8339 						 wpa_s->manual_scan_id);
8340 		}
8341 	} else if (wpa_s->sched_scanning) {
8342 		wpa_s->manual_scan_passive = manual_scan_passive;
8343 		wpa_s->manual_scan_use_id = manual_scan_use_id;
8344 		wpa_s->manual_scan_only_new = manual_scan_only_new;
8345 		wpa_s->scan_id_count = scan_id_count;
8346 		os_memcpy(wpa_s->scan_id, scan_id, scan_id_count * sizeof(int));
8347 		wpa_s->scan_res_handler = scan_res_handler;
8348 		os_free(wpa_s->manual_scan_freqs);
8349 		wpa_s->manual_scan_freqs = manual_scan_freqs;
8350 		manual_scan_freqs = NULL;
8351 
8352 		wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to allow requested full scan to proceed");
8353 		wpa_supplicant_cancel_sched_scan(wpa_s);
8354 		wpa_s->scan_req = MANUAL_SCAN_REQ;
8355 		wpa_supplicant_req_scan(wpa_s, 0, 0);
8356 		if (wpa_s->manual_scan_use_id) {
8357 			wpa_s->manual_scan_id++;
8358 			*reply_len = os_snprintf(reply, reply_size, "%u\n",
8359 						 wpa_s->manual_scan_id);
8360 			wpa_dbg(wpa_s, MSG_DEBUG, "Assigned scan id %u",
8361 				wpa_s->manual_scan_id);
8362 		}
8363 	} else {
8364 		wpa_printf(MSG_DEBUG, "Ongoing scan action - reject new request");
8365 		*reply_len = os_snprintf(reply, reply_size, "FAIL-BUSY\n");
8366 	}
8367 
8368 done:
8369 	os_free(manual_scan_freqs);
8370 	os_free(ssid);
8371 }
8372 
8373 
8374 #ifdef CONFIG_TESTING_OPTIONS
8375 
8376 static void wpas_ctrl_iface_mgmt_tx_cb(struct wpa_supplicant *wpa_s,
8377 				       unsigned int freq, const u8 *dst,
8378 				       const u8 *src, const u8 *bssid,
8379 				       const u8 *data, size_t data_len,
8380 				       enum offchannel_send_action_result
8381 				       result)
8382 {
8383 	wpa_msg(wpa_s, MSG_INFO, "MGMT-TX-STATUS freq=%u dst=" MACSTR
8384 		" src=" MACSTR " bssid=" MACSTR " result=%s",
8385 		freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid),
8386 		result == OFFCHANNEL_SEND_ACTION_SUCCESS ?
8387 		"SUCCESS" : (result == OFFCHANNEL_SEND_ACTION_NO_ACK ?
8388 			     "NO_ACK" : "FAILED"));
8389 }
8390 
8391 
8392 static int wpas_ctrl_iface_mgmt_tx(struct wpa_supplicant *wpa_s, char *cmd)
8393 {
8394 	char *pos, *param;
8395 	size_t len;
8396 	u8 *buf, da[ETH_ALEN], bssid[ETH_ALEN];
8397 	int res, used;
8398 	int freq = 0, no_cck = 0, wait_time = 0;
8399 
8400 	/* <DA> <BSSID> [freq=<MHz>] [wait_time=<ms>] [no_cck=1]
8401 	 *    <action=Action frame payload> */
8402 
8403 	wpa_printf(MSG_DEBUG, "External MGMT TX: %s", cmd);
8404 
8405 	pos = cmd;
8406 	used = hwaddr_aton2(pos, da);
8407 	if (used < 0)
8408 		return -1;
8409 	pos += used;
8410 	while (*pos == ' ')
8411 		pos++;
8412 	used = hwaddr_aton2(pos, bssid);
8413 	if (used < 0)
8414 		return -1;
8415 	pos += used;
8416 
8417 	param = os_strstr(pos, " freq=");
8418 	if (param) {
8419 		param += 6;
8420 		freq = atoi(param);
8421 	}
8422 
8423 	param = os_strstr(pos, " no_cck=");
8424 	if (param) {
8425 		param += 8;
8426 		no_cck = atoi(param);
8427 	}
8428 
8429 	param = os_strstr(pos, " wait_time=");
8430 	if (param) {
8431 		param += 11;
8432 		wait_time = atoi(param);
8433 	}
8434 
8435 	param = os_strstr(pos, " action=");
8436 	if (param == NULL)
8437 		return -1;
8438 	param += 8;
8439 
8440 	len = os_strlen(param);
8441 	if (len & 1)
8442 		return -1;
8443 	len /= 2;
8444 
8445 	buf = os_malloc(len);
8446 	if (buf == NULL)
8447 		return -1;
8448 
8449 	if (hexstr2bin(param, buf, len) < 0) {
8450 		os_free(buf);
8451 		return -1;
8452 	}
8453 
8454 	res = offchannel_send_action(wpa_s, freq, da, wpa_s->own_addr, bssid,
8455 				     buf, len, wait_time,
8456 				     wpas_ctrl_iface_mgmt_tx_cb, no_cck);
8457 	os_free(buf);
8458 	return res;
8459 }
8460 
8461 
8462 static void wpas_ctrl_iface_mgmt_tx_done(struct wpa_supplicant *wpa_s)
8463 {
8464 	wpa_printf(MSG_DEBUG, "External MGMT TX - done waiting");
8465 	offchannel_send_action_done(wpa_s);
8466 }
8467 
8468 
8469 static int wpas_ctrl_iface_mgmt_rx_process(struct wpa_supplicant *wpa_s,
8470 					   char *cmd)
8471 {
8472 	char *pos, *param;
8473 	size_t len;
8474 	u8 *buf;
8475 	int freq = 0, datarate = 0, ssi_signal = 0;
8476 	union wpa_event_data event;
8477 
8478 	if (!wpa_s->ext_mgmt_frame_handling)
8479 		return -1;
8480 
8481 	/* freq=<MHz> datarate=<val> ssi_signal=<val> frame=<frame hexdump> */
8482 
8483 	wpa_printf(MSG_DEBUG, "External MGMT RX process: %s", cmd);
8484 
8485 	pos = cmd;
8486 	param = os_strstr(pos, "freq=");
8487 	if (param) {
8488 		param += 5;
8489 		freq = atoi(param);
8490 	}
8491 
8492 	param = os_strstr(pos, " datarate=");
8493 	if (param) {
8494 		param += 10;
8495 		datarate = atoi(param);
8496 	}
8497 
8498 	param = os_strstr(pos, " ssi_signal=");
8499 	if (param) {
8500 		param += 12;
8501 		ssi_signal = atoi(param);
8502 	}
8503 
8504 	param = os_strstr(pos, " frame=");
8505 	if (param == NULL)
8506 		return -1;
8507 	param += 7;
8508 
8509 	len = os_strlen(param);
8510 	if (len & 1)
8511 		return -1;
8512 	len /= 2;
8513 
8514 	buf = os_malloc(len);
8515 	if (buf == NULL)
8516 		return -1;
8517 
8518 	if (hexstr2bin(param, buf, len) < 0) {
8519 		os_free(buf);
8520 		return -1;
8521 	}
8522 
8523 	os_memset(&event, 0, sizeof(event));
8524 	event.rx_mgmt.freq = freq;
8525 	event.rx_mgmt.frame = buf;
8526 	event.rx_mgmt.frame_len = len;
8527 	event.rx_mgmt.ssi_signal = ssi_signal;
8528 	event.rx_mgmt.datarate = datarate;
8529 	wpa_s->ext_mgmt_frame_handling = 0;
8530 	wpa_supplicant_event(wpa_s, EVENT_RX_MGMT, &event);
8531 	wpa_s->ext_mgmt_frame_handling = 1;
8532 
8533 	os_free(buf);
8534 
8535 	return 0;
8536 }
8537 
8538 
8539 static int wpas_ctrl_iface_driver_scan_res(struct wpa_supplicant *wpa_s,
8540 					   char *param)
8541 {
8542 	struct wpa_scan_res *res;
8543 	struct os_reltime now;
8544 	char *pos, *end;
8545 	int ret = -1;
8546 
8547 	if (!param)
8548 		return -1;
8549 
8550 	if (os_strcmp(param, "START") == 0) {
8551 		wpa_bss_update_start(wpa_s);
8552 		return 0;
8553 	}
8554 
8555 	if (os_strcmp(param, "END") == 0) {
8556 		wpa_bss_update_end(wpa_s, NULL, 1);
8557 		return 0;
8558 	}
8559 
8560 	if (os_strncmp(param, "BSS ", 4) != 0)
8561 		return -1;
8562 	param += 3;
8563 
8564 	res = os_zalloc(sizeof(*res) + os_strlen(param) / 2);
8565 	if (!res)
8566 		return -1;
8567 
8568 	pos = os_strstr(param, " flags=");
8569 	if (pos)
8570 		res->flags = strtol(pos + 7, NULL, 16);
8571 
8572 	pos = os_strstr(param, " bssid=");
8573 	if (pos && hwaddr_aton(pos + 7, res->bssid))
8574 		goto fail;
8575 
8576 	pos = os_strstr(param, " freq=");
8577 	if (pos)
8578 		res->freq = atoi(pos + 6);
8579 
8580 	pos = os_strstr(param, " beacon_int=");
8581 	if (pos)
8582 		res->beacon_int = atoi(pos + 12);
8583 
8584 	pos = os_strstr(param, " caps=");
8585 	if (pos)
8586 		res->caps = strtol(pos + 6, NULL, 16);
8587 
8588 	pos = os_strstr(param, " qual=");
8589 	if (pos)
8590 		res->qual = atoi(pos + 6);
8591 
8592 	pos = os_strstr(param, " noise=");
8593 	if (pos)
8594 		res->noise = atoi(pos + 7);
8595 
8596 	pos = os_strstr(param, " level=");
8597 	if (pos)
8598 		res->level = atoi(pos + 7);
8599 
8600 	pos = os_strstr(param, " tsf=");
8601 	if (pos)
8602 		res->tsf = strtoll(pos + 5, NULL, 16);
8603 
8604 	pos = os_strstr(param, " age=");
8605 	if (pos)
8606 		res->age = atoi(pos + 5);
8607 
8608 	pos = os_strstr(param, " est_throughput=");
8609 	if (pos)
8610 		res->est_throughput = atoi(pos + 16);
8611 
8612 	pos = os_strstr(param, " snr=");
8613 	if (pos)
8614 		res->snr = atoi(pos + 5);
8615 
8616 	pos = os_strstr(param, " parent_tsf=");
8617 	if (pos)
8618 		res->parent_tsf = strtoll(pos + 7, NULL, 16);
8619 
8620 	pos = os_strstr(param, " tsf_bssid=");
8621 	if (pos && hwaddr_aton(pos + 11, res->tsf_bssid))
8622 		goto fail;
8623 
8624 	pos = os_strstr(param, " ie=");
8625 	if (pos) {
8626 		pos += 4;
8627 		end = os_strchr(pos, ' ');
8628 		if (!end)
8629 			end = pos + os_strlen(pos);
8630 		res->ie_len = (end - pos) / 2;
8631 		if (hexstr2bin(pos, (u8 *) (res + 1), res->ie_len))
8632 			goto fail;
8633 	}
8634 
8635 	pos = os_strstr(param, " beacon_ie=");
8636 	if (pos) {
8637 		pos += 11;
8638 		end = os_strchr(pos, ' ');
8639 		if (!end)
8640 			end = pos + os_strlen(pos);
8641 		res->beacon_ie_len = (end - pos) / 2;
8642 		if (hexstr2bin(pos, ((u8 *) (res + 1)) + res->ie_len,
8643 			       res->beacon_ie_len))
8644 			goto fail;
8645 	}
8646 
8647 	os_get_reltime(&now);
8648 	wpa_bss_update_scan_res(wpa_s, res, &now);
8649 	ret = 0;
8650 fail:
8651 	os_free(res);
8652 
8653 	return ret;
8654 }
8655 
8656 
8657 static int wpas_ctrl_iface_driver_event(struct wpa_supplicant *wpa_s, char *cmd)
8658 {
8659 	char *pos, *param;
8660 	union wpa_event_data event;
8661 	enum wpa_event_type ev;
8662 
8663 	/* <event name> [parameters..] */
8664 
8665 	wpa_dbg(wpa_s, MSG_DEBUG, "Testing - external driver event: %s", cmd);
8666 
8667 	pos = cmd;
8668 	param = os_strchr(pos, ' ');
8669 	if (param)
8670 		*param++ = '\0';
8671 
8672 	os_memset(&event, 0, sizeof(event));
8673 
8674 	if (os_strcmp(cmd, "INTERFACE_ENABLED") == 0) {
8675 		ev = EVENT_INTERFACE_ENABLED;
8676 	} else if (os_strcmp(cmd, "INTERFACE_DISABLED") == 0) {
8677 		ev = EVENT_INTERFACE_DISABLED;
8678 	} else if (os_strcmp(cmd, "AVOID_FREQUENCIES") == 0) {
8679 		ev = EVENT_AVOID_FREQUENCIES;
8680 		if (param == NULL)
8681 			param = "";
8682 		if (freq_range_list_parse(&event.freq_range, param) < 0)
8683 			return -1;
8684 		wpa_supplicant_event(wpa_s, ev, &event);
8685 		os_free(event.freq_range.range);
8686 		return 0;
8687 	} else if (os_strcmp(cmd, "SCAN_RES") == 0) {
8688 		return wpas_ctrl_iface_driver_scan_res(wpa_s, param);
8689 	} else {
8690 		wpa_dbg(wpa_s, MSG_DEBUG, "Testing - unknown driver event: %s",
8691 			cmd);
8692 		return -1;
8693 	}
8694 
8695 	wpa_supplicant_event(wpa_s, ev, &event);
8696 
8697 	return 0;
8698 }
8699 
8700 
8701 static int wpas_ctrl_iface_eapol_rx(struct wpa_supplicant *wpa_s, char *cmd)
8702 {
8703 	char *pos;
8704 	u8 src[ETH_ALEN], *buf;
8705 	int used;
8706 	size_t len;
8707 
8708 	wpa_printf(MSG_DEBUG, "External EAPOL RX: %s", cmd);
8709 
8710 	pos = cmd;
8711 	used = hwaddr_aton2(pos, src);
8712 	if (used < 0)
8713 		return -1;
8714 	pos += used;
8715 	while (*pos == ' ')
8716 		pos++;
8717 
8718 	len = os_strlen(pos);
8719 	if (len & 1)
8720 		return -1;
8721 	len /= 2;
8722 
8723 	buf = os_malloc(len);
8724 	if (buf == NULL)
8725 		return -1;
8726 
8727 	if (hexstr2bin(pos, buf, len) < 0) {
8728 		os_free(buf);
8729 		return -1;
8730 	}
8731 
8732 	wpa_supplicant_rx_eapol(wpa_s, src, buf, len);
8733 	os_free(buf);
8734 
8735 	return 0;
8736 }
8737 
8738 
8739 static u16 ipv4_hdr_checksum(const void *buf, size_t len)
8740 {
8741 	size_t i;
8742 	u32 sum = 0;
8743 	const u16 *pos = buf;
8744 
8745 	for (i = 0; i < len / 2; i++)
8746 		sum += *pos++;
8747 
8748 	while (sum >> 16)
8749 		sum = (sum & 0xffff) + (sum >> 16);
8750 
8751 	return sum ^ 0xffff;
8752 }
8753 
8754 
8755 #define HWSIM_PACKETLEN 1500
8756 #define HWSIM_IP_LEN (HWSIM_PACKETLEN - sizeof(struct ether_header))
8757 
8758 static void wpas_data_test_rx(void *ctx, const u8 *src_addr, const u8 *buf,
8759 			      size_t len)
8760 {
8761 	struct wpa_supplicant *wpa_s = ctx;
8762 	const struct ether_header *eth;
8763 	struct iphdr ip;
8764 	const u8 *pos;
8765 	unsigned int i;
8766 
8767 	if (len != HWSIM_PACKETLEN)
8768 		return;
8769 
8770 	eth = (const struct ether_header *) buf;
8771 	os_memcpy(&ip, eth + 1, sizeof(ip));
8772 	pos = &buf[sizeof(*eth) + sizeof(ip)];
8773 
8774 	if (ip.ihl != 5 || ip.version != 4 ||
8775 	    ntohs(ip.tot_len) != HWSIM_IP_LEN)
8776 		return;
8777 
8778 	for (i = 0; i < HWSIM_IP_LEN - sizeof(ip); i++) {
8779 		if (*pos != (u8) i)
8780 			return;
8781 		pos++;
8782 	}
8783 
8784 	wpa_msg(wpa_s, MSG_INFO, "DATA-TEST-RX " MACSTR " " MACSTR,
8785 		MAC2STR(eth->ether_dhost), MAC2STR(eth->ether_shost));
8786 }
8787 
8788 
8789 static int wpas_ctrl_iface_data_test_config(struct wpa_supplicant *wpa_s,
8790 					    char *cmd)
8791 {
8792 	int enabled = atoi(cmd);
8793 	char *pos;
8794 	const char *ifname;
8795 
8796 	if (!enabled) {
8797 		if (wpa_s->l2_test) {
8798 			l2_packet_deinit(wpa_s->l2_test);
8799 			wpa_s->l2_test = NULL;
8800 			wpa_dbg(wpa_s, MSG_DEBUG, "test data: Disabled");
8801 		}
8802 		return 0;
8803 	}
8804 
8805 	if (wpa_s->l2_test)
8806 		return 0;
8807 
8808 	pos = os_strstr(cmd, " ifname=");
8809 	if (pos)
8810 		ifname = pos + 8;
8811 	else
8812 		ifname = wpa_s->ifname;
8813 
8814 	wpa_s->l2_test = l2_packet_init(ifname, wpa_s->own_addr,
8815 					ETHERTYPE_IP, wpas_data_test_rx,
8816 					wpa_s, 1);
8817 	if (wpa_s->l2_test == NULL)
8818 		return -1;
8819 
8820 	wpa_dbg(wpa_s, MSG_DEBUG, "test data: Enabled");
8821 
8822 	return 0;
8823 }
8824 
8825 
8826 static int wpas_ctrl_iface_data_test_tx(struct wpa_supplicant *wpa_s, char *cmd)
8827 {
8828 	u8 dst[ETH_ALEN], src[ETH_ALEN];
8829 	char *pos;
8830 	int used;
8831 	long int val;
8832 	u8 tos;
8833 	u8 buf[2 + HWSIM_PACKETLEN];
8834 	struct ether_header *eth;
8835 	struct iphdr *ip;
8836 	u8 *dpos;
8837 	unsigned int i;
8838 
8839 	if (wpa_s->l2_test == NULL)
8840 		return -1;
8841 
8842 	/* format: <dst> <src> <tos> */
8843 
8844 	pos = cmd;
8845 	used = hwaddr_aton2(pos, dst);
8846 	if (used < 0)
8847 		return -1;
8848 	pos += used;
8849 	while (*pos == ' ')
8850 		pos++;
8851 	used = hwaddr_aton2(pos, src);
8852 	if (used < 0)
8853 		return -1;
8854 	pos += used;
8855 
8856 	val = strtol(pos, NULL, 0);
8857 	if (val < 0 || val > 0xff)
8858 		return -1;
8859 	tos = val;
8860 
8861 	eth = (struct ether_header *) &buf[2];
8862 	os_memcpy(eth->ether_dhost, dst, ETH_ALEN);
8863 	os_memcpy(eth->ether_shost, src, ETH_ALEN);
8864 	eth->ether_type = htons(ETHERTYPE_IP);
8865 	ip = (struct iphdr *) (eth + 1);
8866 	os_memset(ip, 0, sizeof(*ip));
8867 	ip->ihl = 5;
8868 	ip->version = 4;
8869 	ip->ttl = 64;
8870 	ip->tos = tos;
8871 	ip->tot_len = htons(HWSIM_IP_LEN);
8872 	ip->protocol = 1;
8873 	ip->saddr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 1);
8874 	ip->daddr = htonl(192U << 24 | 168 << 16 | 1 << 8 | 2);
8875 	ip->check = ipv4_hdr_checksum(ip, sizeof(*ip));
8876 	dpos = (u8 *) (ip + 1);
8877 	for (i = 0; i < HWSIM_IP_LEN - sizeof(*ip); i++)
8878 		*dpos++ = i;
8879 
8880 	if (l2_packet_send(wpa_s->l2_test, dst, ETHERTYPE_IP, &buf[2],
8881 			   HWSIM_PACKETLEN) < 0)
8882 		return -1;
8883 
8884 	wpa_dbg(wpa_s, MSG_DEBUG, "test data: TX dst=" MACSTR " src=" MACSTR
8885 		" tos=0x%x", MAC2STR(dst), MAC2STR(src), tos);
8886 
8887 	return 0;
8888 }
8889 
8890 
8891 static int wpas_ctrl_iface_data_test_frame(struct wpa_supplicant *wpa_s,
8892 					   char *cmd)
8893 {
8894 	u8 *buf;
8895 	struct ether_header *eth;
8896 	struct l2_packet_data *l2 = NULL;
8897 	size_t len;
8898 	u16 ethertype;
8899 	int res = -1;
8900 
8901 	len = os_strlen(cmd);
8902 	if (len & 1 || len < ETH_HLEN * 2)
8903 		return -1;
8904 	len /= 2;
8905 
8906 	buf = os_malloc(len);
8907 	if (buf == NULL)
8908 		return -1;
8909 
8910 	if (hexstr2bin(cmd, buf, len) < 0)
8911 		goto done;
8912 
8913 	eth = (struct ether_header *) buf;
8914 	ethertype = ntohs(eth->ether_type);
8915 
8916 	l2 = l2_packet_init(wpa_s->ifname, wpa_s->own_addr, ethertype,
8917 			    wpas_data_test_rx, wpa_s, 1);
8918 	if (l2 == NULL)
8919 		goto done;
8920 
8921 	res = l2_packet_send(l2, eth->ether_dhost, ethertype, buf, len);
8922 	wpa_dbg(wpa_s, MSG_DEBUG, "test data: TX frame res=%d", res);
8923 done:
8924 	if (l2)
8925 		l2_packet_deinit(l2);
8926 	os_free(buf);
8927 
8928 	return res < 0 ? -1 : 0;
8929 }
8930 
8931 
8932 static int wpas_ctrl_test_alloc_fail(struct wpa_supplicant *wpa_s, char *cmd)
8933 {
8934 #ifdef WPA_TRACE_BFD
8935 	char *pos;
8936 
8937 	wpa_trace_fail_after = atoi(cmd);
8938 	pos = os_strchr(cmd, ':');
8939 	if (pos) {
8940 		pos++;
8941 		os_strlcpy(wpa_trace_fail_func, pos,
8942 			   sizeof(wpa_trace_fail_func));
8943 	} else {
8944 		wpa_trace_fail_after = 0;
8945 	}
8946 	return 0;
8947 #else /* WPA_TRACE_BFD */
8948 	return -1;
8949 #endif /* WPA_TRACE_BFD */
8950 }
8951 
8952 
8953 static int wpas_ctrl_get_alloc_fail(struct wpa_supplicant *wpa_s,
8954 				    char *buf, size_t buflen)
8955 {
8956 #ifdef WPA_TRACE_BFD
8957 	return os_snprintf(buf, buflen, "%u:%s", wpa_trace_fail_after,
8958 			   wpa_trace_fail_func);
8959 #else /* WPA_TRACE_BFD */
8960 	return -1;
8961 #endif /* WPA_TRACE_BFD */
8962 }
8963 
8964 
8965 static int wpas_ctrl_test_fail(struct wpa_supplicant *wpa_s, char *cmd)
8966 {
8967 #ifdef WPA_TRACE_BFD
8968 	char *pos;
8969 
8970 	wpa_trace_test_fail_after = atoi(cmd);
8971 	pos = os_strchr(cmd, ':');
8972 	if (pos) {
8973 		pos++;
8974 		os_strlcpy(wpa_trace_test_fail_func, pos,
8975 			   sizeof(wpa_trace_test_fail_func));
8976 	} else {
8977 		wpa_trace_test_fail_after = 0;
8978 	}
8979 	return 0;
8980 #else /* WPA_TRACE_BFD */
8981 	return -1;
8982 #endif /* WPA_TRACE_BFD */
8983 }
8984 
8985 
8986 static int wpas_ctrl_get_fail(struct wpa_supplicant *wpa_s,
8987 				    char *buf, size_t buflen)
8988 {
8989 #ifdef WPA_TRACE_BFD
8990 	return os_snprintf(buf, buflen, "%u:%s", wpa_trace_test_fail_after,
8991 			   wpa_trace_test_fail_func);
8992 #else /* WPA_TRACE_BFD */
8993 	return -1;
8994 #endif /* WPA_TRACE_BFD */
8995 }
8996 
8997 
8998 static void wpas_ctrl_event_test_cb(void *eloop_ctx, void *timeout_ctx)
8999 {
9000 	struct wpa_supplicant *wpa_s = eloop_ctx;
9001 	int i, count = (intptr_t) timeout_ctx;
9002 
9003 	wpa_printf(MSG_DEBUG, "TEST: Send %d control interface event messages",
9004 		   count);
9005 	for (i = 0; i < count; i++) {
9006 		wpa_msg_ctrl(wpa_s, MSG_INFO, "TEST-EVENT-MESSAGE %d/%d",
9007 			     i + 1, count);
9008 	}
9009 }
9010 
9011 
9012 static int wpas_ctrl_event_test(struct wpa_supplicant *wpa_s, const char *cmd)
9013 {
9014 	int count;
9015 
9016 	count = atoi(cmd);
9017 	if (count <= 0)
9018 		return -1;
9019 
9020 	return eloop_register_timeout(0, 0, wpas_ctrl_event_test_cb, wpa_s,
9021 				      (void *) (intptr_t) count);
9022 }
9023 
9024 
9025 static int wpas_ctrl_test_assoc_ie(struct wpa_supplicant *wpa_s,
9026 				   const char *cmd)
9027 {
9028 	struct wpabuf *buf;
9029 	size_t len;
9030 
9031 	len = os_strlen(cmd);
9032 	if (len & 1)
9033 		return -1;
9034 	len /= 2;
9035 
9036 	if (len == 0) {
9037 		buf = NULL;
9038 	} else {
9039 		buf = wpabuf_alloc(len);
9040 		if (buf == NULL)
9041 			return -1;
9042 
9043 		if (hexstr2bin(cmd, wpabuf_put(buf, len), len) < 0) {
9044 			wpabuf_free(buf);
9045 			return -1;
9046 		}
9047 	}
9048 
9049 	wpa_sm_set_test_assoc_ie(wpa_s->wpa, buf);
9050 	return 0;
9051 }
9052 
9053 
9054 static int wpas_ctrl_reset_pn(struct wpa_supplicant *wpa_s)
9055 {
9056 	u8 zero[WPA_TK_MAX_LEN];
9057 
9058 	if (wpa_s->last_tk_alg == WPA_ALG_NONE)
9059 		return -1;
9060 
9061 	wpa_printf(MSG_INFO, "TESTING: Reset PN");
9062 	os_memset(zero, 0, sizeof(zero));
9063 
9064 	/* First, use a zero key to avoid any possible duplicate key avoidance
9065 	 * in the driver. */
9066 	if (wpa_drv_set_key(wpa_s, wpa_s->last_tk_alg, wpa_s->last_tk_addr,
9067 			    wpa_s->last_tk_key_idx, 1, zero, 6,
9068 			    zero, wpa_s->last_tk_len) < 0)
9069 		return -1;
9070 
9071 	/* Set the previously configured key to reset its TSC/RSC */
9072 	return wpa_drv_set_key(wpa_s, wpa_s->last_tk_alg, wpa_s->last_tk_addr,
9073 			       wpa_s->last_tk_key_idx, 1, zero, 6,
9074 			       wpa_s->last_tk, wpa_s->last_tk_len);
9075 }
9076 
9077 
9078 static int wpas_ctrl_key_request(struct wpa_supplicant *wpa_s, const char *cmd)
9079 {
9080 	const char *pos = cmd;
9081 	int error, pairwise;
9082 
9083 	error = atoi(pos);
9084 	pos = os_strchr(pos, ' ');
9085 	if (!pos)
9086 		return -1;
9087 	pairwise = atoi(pos);
9088 	wpa_sm_key_request(wpa_s->wpa, error, pairwise);
9089 	return 0;
9090 }
9091 
9092 
9093 static int wpas_ctrl_resend_assoc(struct wpa_supplicant *wpa_s)
9094 {
9095 #ifdef CONFIG_SME
9096 	struct wpa_driver_associate_params params;
9097 	int ret;
9098 
9099 	os_memset(&params, 0, sizeof(params));
9100 	params.bssid = wpa_s->bssid;
9101 	params.ssid = wpa_s->sme.ssid;
9102 	params.ssid_len = wpa_s->sme.ssid_len;
9103 	params.freq.freq = wpa_s->sme.freq;
9104 	if (wpa_s->last_assoc_req_wpa_ie) {
9105 		params.wpa_ie = wpabuf_head(wpa_s->last_assoc_req_wpa_ie);
9106 		params.wpa_ie_len = wpabuf_len(wpa_s->last_assoc_req_wpa_ie);
9107 	}
9108 	params.pairwise_suite = wpa_s->pairwise_cipher;
9109 	params.group_suite = wpa_s->group_cipher;
9110 	params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
9111 	params.key_mgmt_suite = wpa_s->key_mgmt;
9112 	params.wpa_proto = wpa_s->wpa_proto;
9113 	params.mgmt_frame_protection = wpa_s->sme.mfp;
9114 	params.rrm_used = wpa_s->rrm.rrm_used;
9115 	if (wpa_s->sme.prev_bssid_set)
9116 		params.prev_bssid = wpa_s->sme.prev_bssid;
9117 	wpa_printf(MSG_INFO, "TESTING: Resend association request");
9118 	ret = wpa_drv_associate(wpa_s, &params);
9119 	wpa_s->testing_resend_assoc = 1;
9120 	return ret;
9121 #else /* CONFIG_SME */
9122 	return -1;
9123 #endif /* CONFIG_SME */
9124 }
9125 
9126 #endif /* CONFIG_TESTING_OPTIONS */
9127 
9128 
9129 static int wpas_ctrl_vendor_elem_add(struct wpa_supplicant *wpa_s, char *cmd)
9130 {
9131 	char *pos = cmd;
9132 	int frame;
9133 	size_t len;
9134 	struct wpabuf *buf;
9135 	struct ieee802_11_elems elems;
9136 
9137 	frame = atoi(pos);
9138 	if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
9139 		return -1;
9140 	wpa_s = wpas_vendor_elem(wpa_s, frame);
9141 
9142 	pos = os_strchr(pos, ' ');
9143 	if (pos == NULL)
9144 		return -1;
9145 	pos++;
9146 
9147 	len = os_strlen(pos);
9148 	if (len == 0)
9149 		return 0;
9150 	if (len & 1)
9151 		return -1;
9152 	len /= 2;
9153 
9154 	buf = wpabuf_alloc(len);
9155 	if (buf == NULL)
9156 		return -1;
9157 
9158 	if (hexstr2bin(pos, wpabuf_put(buf, len), len) < 0) {
9159 		wpabuf_free(buf);
9160 		return -1;
9161 	}
9162 
9163 	if (ieee802_11_parse_elems(wpabuf_head_u8(buf), len, &elems, 0) ==
9164 	    ParseFailed) {
9165 		wpabuf_free(buf);
9166 		return -1;
9167 	}
9168 
9169 	if (wpa_s->vendor_elem[frame] == NULL) {
9170 		wpa_s->vendor_elem[frame] = buf;
9171 		wpas_vendor_elem_update(wpa_s);
9172 		return 0;
9173 	}
9174 
9175 	if (wpabuf_resize(&wpa_s->vendor_elem[frame], len) < 0) {
9176 		wpabuf_free(buf);
9177 		return -1;
9178 	}
9179 
9180 	wpabuf_put_buf(wpa_s->vendor_elem[frame], buf);
9181 	wpabuf_free(buf);
9182 	wpas_vendor_elem_update(wpa_s);
9183 
9184 	return 0;
9185 }
9186 
9187 
9188 static int wpas_ctrl_vendor_elem_get(struct wpa_supplicant *wpa_s, char *cmd,
9189 				     char *buf, size_t buflen)
9190 {
9191 	int frame = atoi(cmd);
9192 
9193 	if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
9194 		return -1;
9195 	wpa_s = wpas_vendor_elem(wpa_s, frame);
9196 
9197 	if (wpa_s->vendor_elem[frame] == NULL)
9198 		return 0;
9199 
9200 	return wpa_snprintf_hex(buf, buflen,
9201 				wpabuf_head_u8(wpa_s->vendor_elem[frame]),
9202 				wpabuf_len(wpa_s->vendor_elem[frame]));
9203 }
9204 
9205 
9206 static int wpas_ctrl_vendor_elem_remove(struct wpa_supplicant *wpa_s, char *cmd)
9207 {
9208 	char *pos = cmd;
9209 	int frame;
9210 	size_t len;
9211 	u8 *buf;
9212 	struct ieee802_11_elems elems;
9213 	int res;
9214 
9215 	frame = atoi(pos);
9216 	if (frame < 0 || frame >= NUM_VENDOR_ELEM_FRAMES)
9217 		return -1;
9218 	wpa_s = wpas_vendor_elem(wpa_s, frame);
9219 
9220 	pos = os_strchr(pos, ' ');
9221 	if (pos == NULL)
9222 		return -1;
9223 	pos++;
9224 
9225 	if (*pos == '*') {
9226 		wpabuf_free(wpa_s->vendor_elem[frame]);
9227 		wpa_s->vendor_elem[frame] = NULL;
9228 		wpas_vendor_elem_update(wpa_s);
9229 		return 0;
9230 	}
9231 
9232 	if (wpa_s->vendor_elem[frame] == NULL)
9233 		return -1;
9234 
9235 	len = os_strlen(pos);
9236 	if (len == 0)
9237 		return 0;
9238 	if (len & 1)
9239 		return -1;
9240 	len /= 2;
9241 
9242 	buf = os_malloc(len);
9243 	if (buf == NULL)
9244 		return -1;
9245 
9246 	if (hexstr2bin(pos, buf, len) < 0) {
9247 		os_free(buf);
9248 		return -1;
9249 	}
9250 
9251 	if (ieee802_11_parse_elems(buf, len, &elems, 0) == ParseFailed) {
9252 		os_free(buf);
9253 		return -1;
9254 	}
9255 
9256 	res = wpas_vendor_elem_remove(wpa_s, frame, buf, len);
9257 	os_free(buf);
9258 	return res;
9259 }
9260 
9261 
9262 static void wpas_ctrl_neighbor_rep_cb(void *ctx, struct wpabuf *neighbor_rep)
9263 {
9264 	struct wpa_supplicant *wpa_s = ctx;
9265 	size_t len;
9266 	const u8 *data;
9267 
9268 	/*
9269 	 * Neighbor Report element (IEEE P802.11-REVmc/D5.0)
9270 	 * BSSID[6]
9271 	 * BSSID Information[4]
9272 	 * Operating Class[1]
9273 	 * Channel Number[1]
9274 	 * PHY Type[1]
9275 	 * Optional Subelements[variable]
9276 	 */
9277 #define NR_IE_MIN_LEN (ETH_ALEN + 4 + 1 + 1 + 1)
9278 
9279 	if (!neighbor_rep || wpabuf_len(neighbor_rep) == 0) {
9280 		wpa_msg_ctrl(wpa_s, MSG_INFO, RRM_EVENT_NEIGHBOR_REP_FAILED);
9281 		goto out;
9282 	}
9283 
9284 	data = wpabuf_head_u8(neighbor_rep);
9285 	len = wpabuf_len(neighbor_rep);
9286 
9287 	while (len >= 2 + NR_IE_MIN_LEN) {
9288 		const u8 *nr;
9289 		char lci[256 * 2 + 1];
9290 		char civic[256 * 2 + 1];
9291 		u8 nr_len = data[1];
9292 		const u8 *pos = data, *end;
9293 
9294 		if (pos[0] != WLAN_EID_NEIGHBOR_REPORT ||
9295 		    nr_len < NR_IE_MIN_LEN) {
9296 			wpa_printf(MSG_DEBUG,
9297 				   "CTRL: Invalid Neighbor Report element: id=%u len=%u",
9298 				   data[0], nr_len);
9299 			goto out;
9300 		}
9301 
9302 		if (2U + nr_len > len) {
9303 			wpa_printf(MSG_DEBUG,
9304 				   "CTRL: Invalid Neighbor Report element: id=%u len=%zu nr_len=%u",
9305 				   data[0], len, nr_len);
9306 			goto out;
9307 		}
9308 		pos += 2;
9309 		end = pos + nr_len;
9310 
9311 		nr = pos;
9312 		pos += NR_IE_MIN_LEN;
9313 
9314 		lci[0] = '\0';
9315 		civic[0] = '\0';
9316 		while (end - pos > 2) {
9317 			u8 s_id, s_len;
9318 
9319 			s_id = *pos++;
9320 			s_len = *pos++;
9321 			if (s_len > end - pos)
9322 				goto out;
9323 			if (s_id == WLAN_EID_MEASURE_REPORT && s_len > 3) {
9324 				/* Measurement Token[1] */
9325 				/* Measurement Report Mode[1] */
9326 				/* Measurement Type[1] */
9327 				/* Measurement Report[variable] */
9328 				switch (pos[2]) {
9329 				case MEASURE_TYPE_LCI:
9330 					if (lci[0])
9331 						break;
9332 					wpa_snprintf_hex(lci, sizeof(lci),
9333 							 pos, s_len);
9334 					break;
9335 				case MEASURE_TYPE_LOCATION_CIVIC:
9336 					if (civic[0])
9337 						break;
9338 					wpa_snprintf_hex(civic, sizeof(civic),
9339 							 pos, s_len);
9340 					break;
9341 				}
9342 			}
9343 
9344 			pos += s_len;
9345 		}
9346 
9347 		wpa_msg(wpa_s, MSG_INFO, RRM_EVENT_NEIGHBOR_REP_RXED
9348 			"bssid=" MACSTR
9349 			" info=0x%x op_class=%u chan=%u phy_type=%u%s%s%s%s",
9350 			MAC2STR(nr), WPA_GET_LE32(nr + ETH_ALEN),
9351 			nr[ETH_ALEN + 4], nr[ETH_ALEN + 5],
9352 			nr[ETH_ALEN + 6],
9353 			lci[0] ? " lci=" : "", lci,
9354 			civic[0] ? " civic=" : "", civic);
9355 
9356 		data = end;
9357 		len -= 2 + nr_len;
9358 	}
9359 
9360 out:
9361 	wpabuf_free(neighbor_rep);
9362 }
9363 
9364 
9365 static int wpas_ctrl_iface_send_neighbor_rep(struct wpa_supplicant *wpa_s,
9366 					     char *cmd)
9367 {
9368 	struct wpa_ssid_value ssid, *ssid_p = NULL;
9369 	int ret, lci = 0, civic = 0;
9370 	char *ssid_s;
9371 
9372 	ssid_s = os_strstr(cmd, "ssid=");
9373 	if (ssid_s) {
9374 		if (ssid_parse(ssid_s + 5, &ssid)) {
9375 			wpa_printf(MSG_ERROR,
9376 				   "CTRL: Send Neighbor Report: bad SSID");
9377 			return -1;
9378 		}
9379 
9380 		ssid_p = &ssid;
9381 
9382 		/*
9383 		 * Move cmd after the SSID text that may include "lci" or
9384 		 * "civic".
9385 		 */
9386 		cmd = os_strchr(ssid_s + 6, ssid_s[5] == '"' ? '"' : ' ');
9387 		if (cmd)
9388 			cmd++;
9389 
9390 	}
9391 
9392 	if (cmd && os_strstr(cmd, "lci"))
9393 		lci = 1;
9394 
9395 	if (cmd && os_strstr(cmd, "civic"))
9396 		civic = 1;
9397 
9398 	ret = wpas_rrm_send_neighbor_rep_request(wpa_s, ssid_p, lci, civic,
9399 						 wpas_ctrl_neighbor_rep_cb,
9400 						 wpa_s);
9401 
9402 	return ret;
9403 }
9404 
9405 
9406 static int wpas_ctrl_iface_erp_flush(struct wpa_supplicant *wpa_s)
9407 {
9408 	eapol_sm_erp_flush(wpa_s->eapol);
9409 	return 0;
9410 }
9411 
9412 
9413 static int wpas_ctrl_iface_mac_rand_scan(struct wpa_supplicant *wpa_s,
9414 					 char *cmd)
9415 {
9416 	char *token, *context = NULL;
9417 	unsigned int enable = ~0, type = 0;
9418 	u8 _addr[ETH_ALEN], _mask[ETH_ALEN];
9419 	u8 *addr = NULL, *mask = NULL;
9420 
9421 	while ((token = str_token(cmd, " ", &context))) {
9422 		if (os_strcasecmp(token, "scan") == 0) {
9423 			type |= MAC_ADDR_RAND_SCAN;
9424 		} else if (os_strcasecmp(token, "sched") == 0) {
9425 			type |= MAC_ADDR_RAND_SCHED_SCAN;
9426 		} else if (os_strcasecmp(token, "pno") == 0) {
9427 			type |= MAC_ADDR_RAND_PNO;
9428 		} else if (os_strcasecmp(token, "all") == 0) {
9429 			type = wpa_s->mac_addr_rand_supported;
9430 		} else if (os_strncasecmp(token, "enable=", 7) == 0) {
9431 			enable = atoi(token + 7);
9432 		} else if (os_strncasecmp(token, "addr=", 5) == 0) {
9433 			addr = _addr;
9434 			if (hwaddr_aton(token + 5, addr)) {
9435 				wpa_printf(MSG_INFO,
9436 					   "CTRL: Invalid MAC address: %s",
9437 					   token);
9438 				return -1;
9439 			}
9440 		} else if (os_strncasecmp(token, "mask=", 5) == 0) {
9441 			mask = _mask;
9442 			if (hwaddr_aton(token + 5, mask)) {
9443 				wpa_printf(MSG_INFO,
9444 					   "CTRL: Invalid MAC address mask: %s",
9445 					   token);
9446 				return -1;
9447 			}
9448 		} else {
9449 			wpa_printf(MSG_INFO,
9450 				   "CTRL: Invalid MAC_RAND_SCAN parameter: %s",
9451 				   token);
9452 			return -1;
9453 		}
9454 	}
9455 
9456 	if (!type) {
9457 		wpa_printf(MSG_INFO, "CTRL: MAC_RAND_SCAN no type specified");
9458 		return -1;
9459 	}
9460 
9461 	if ((wpa_s->mac_addr_rand_supported & type) != type) {
9462 		wpa_printf(MSG_INFO,
9463 			   "CTRL: MAC_RAND_SCAN types=%u != supported=%u",
9464 			   type, wpa_s->mac_addr_rand_supported);
9465 		return -1;
9466 	}
9467 
9468 	if (enable > 1) {
9469 		wpa_printf(MSG_INFO,
9470 			   "CTRL: MAC_RAND_SCAN enable=<0/1> not specified");
9471 		return -1;
9472 	}
9473 
9474 	if (!enable) {
9475 		wpas_mac_addr_rand_scan_clear(wpa_s, type);
9476 		if (wpa_s->pno) {
9477 			if (type & MAC_ADDR_RAND_PNO) {
9478 				wpas_stop_pno(wpa_s);
9479 				wpas_start_pno(wpa_s);
9480 			}
9481 		} else if (wpa_s->sched_scanning &&
9482 			   (type & MAC_ADDR_RAND_SCHED_SCAN)) {
9483 			wpas_scan_restart_sched_scan(wpa_s);
9484 		}
9485 		return 0;
9486 	}
9487 
9488 	if ((addr && !mask) || (!addr && mask)) {
9489 		wpa_printf(MSG_INFO,
9490 			   "CTRL: MAC_RAND_SCAN invalid addr/mask combination");
9491 		return -1;
9492 	}
9493 
9494 	if (addr && mask && (!(mask[0] & 0x01) || (addr[0] & 0x01))) {
9495 		wpa_printf(MSG_INFO,
9496 			   "CTRL: MAC_RAND_SCAN cannot allow multicast address");
9497 		return -1;
9498 	}
9499 
9500 	if (type & MAC_ADDR_RAND_SCAN) {
9501 		wpas_mac_addr_rand_scan_set(wpa_s, MAC_ADDR_RAND_SCAN,
9502 					    addr, mask);
9503 	}
9504 
9505 	if (type & MAC_ADDR_RAND_SCHED_SCAN) {
9506 		wpas_mac_addr_rand_scan_set(wpa_s, MAC_ADDR_RAND_SCHED_SCAN,
9507 					    addr, mask);
9508 
9509 		if (wpa_s->sched_scanning && !wpa_s->pno)
9510 			wpas_scan_restart_sched_scan(wpa_s);
9511 	}
9512 
9513 	if (type & MAC_ADDR_RAND_PNO) {
9514 		wpas_mac_addr_rand_scan_set(wpa_s, MAC_ADDR_RAND_PNO,
9515 					    addr, mask);
9516 		if (wpa_s->pno) {
9517 			wpas_stop_pno(wpa_s);
9518 			wpas_start_pno(wpa_s);
9519 		}
9520 	}
9521 
9522 	return 0;
9523 }
9524 
9525 
9526 static int wpas_ctrl_iface_pmksa(struct wpa_supplicant *wpa_s,
9527 				 char *buf, size_t buflen)
9528 {
9529 	size_t reply_len;
9530 
9531 	reply_len = wpa_sm_pmksa_cache_list(wpa_s->wpa, buf, buflen);
9532 #ifdef CONFIG_AP
9533 	reply_len += wpas_ap_pmksa_cache_list(wpa_s, &buf[reply_len],
9534 					      buflen - reply_len);
9535 #endif /* CONFIG_AP */
9536 	return reply_len;
9537 }
9538 
9539 
9540 static void wpas_ctrl_iface_pmksa_flush(struct wpa_supplicant *wpa_s)
9541 {
9542 	wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
9543 #ifdef CONFIG_AP
9544 	wpas_ap_pmksa_cache_flush(wpa_s);
9545 #endif /* CONFIG_AP */
9546 }
9547 
9548 
9549 #ifdef CONFIG_PMKSA_CACHE_EXTERNAL
9550 
9551 static int wpas_ctrl_iface_pmksa_get(struct wpa_supplicant *wpa_s,
9552 				     const char *cmd, char *buf, size_t buflen)
9553 {
9554 	struct rsn_pmksa_cache_entry *entry;
9555 	struct wpa_ssid *ssid;
9556 	char *pos, *pos2, *end;
9557 	int ret;
9558 	struct os_reltime now;
9559 
9560 	ssid = wpa_config_get_network(wpa_s->conf, atoi(cmd));
9561 	if (!ssid)
9562 		return -1;
9563 
9564 	pos = buf;
9565 	end = buf + buflen;
9566 
9567 	os_get_reltime(&now);
9568 
9569 	/*
9570 	 * Entry format:
9571 	 * <BSSID> <PMKID> <PMK> <reauth_time in seconds>
9572 	 * <expiration in seconds> <akmp> <opportunistic>
9573 	 * [FILS Cache Identifier]
9574 	 */
9575 
9576 	for (entry = wpa_sm_pmksa_cache_head(wpa_s->wpa); entry;
9577 	     entry = entry->next) {
9578 		if (entry->network_ctx != ssid)
9579 			continue;
9580 
9581 		pos2 = pos;
9582 		ret = os_snprintf(pos2, end - pos2, MACSTR " ",
9583 				  MAC2STR(entry->aa));
9584 		if (os_snprintf_error(end - pos2, ret))
9585 			break;
9586 		pos2 += ret;
9587 
9588 		pos2 += wpa_snprintf_hex(pos2, end - pos2, entry->pmkid,
9589 					 PMKID_LEN);
9590 
9591 		ret = os_snprintf(pos2, end - pos2, " ");
9592 		if (os_snprintf_error(end - pos2, ret))
9593 			break;
9594 		pos2 += ret;
9595 
9596 		pos2 += wpa_snprintf_hex(pos2, end - pos2, entry->pmk,
9597 					 entry->pmk_len);
9598 
9599 		ret = os_snprintf(pos2, end - pos2, " %d %d %d %d",
9600 				  (int) (entry->reauth_time - now.sec),
9601 				  (int) (entry->expiration - now.sec),
9602 				  entry->akmp,
9603 				  entry->opportunistic);
9604 		if (os_snprintf_error(end - pos2, ret))
9605 			break;
9606 		pos2 += ret;
9607 
9608 		if (entry->fils_cache_id_set) {
9609 			ret = os_snprintf(pos2, end - pos2, " %02x%02x",
9610 					  entry->fils_cache_id[0],
9611 					  entry->fils_cache_id[1]);
9612 			if (os_snprintf_error(end - pos2, ret))
9613 				break;
9614 			pos2 += ret;
9615 		}
9616 
9617 		ret = os_snprintf(pos2, end - pos2, "\n");
9618 		if (os_snprintf_error(end - pos2, ret))
9619 			break;
9620 		pos2 += ret;
9621 
9622 		pos = pos2;
9623 	}
9624 
9625 	return pos - buf;
9626 }
9627 
9628 
9629 static int wpas_ctrl_iface_pmksa_add(struct wpa_supplicant *wpa_s,
9630 				     char *cmd)
9631 {
9632 	struct rsn_pmksa_cache_entry *entry;
9633 	struct wpa_ssid *ssid;
9634 	char *pos, *pos2;
9635 	int ret = -1;
9636 	struct os_reltime now;
9637 	int reauth_time = 0, expiration = 0, i;
9638 
9639 	/*
9640 	 * Entry format:
9641 	 * <network_id> <BSSID> <PMKID> <PMK> <reauth_time in seconds>
9642 	 * <expiration in seconds> <akmp> <opportunistic>
9643 	 * [FILS Cache Identifier]
9644 	 */
9645 
9646 	ssid = wpa_config_get_network(wpa_s->conf, atoi(cmd));
9647 	if (!ssid)
9648 		return -1;
9649 
9650 	pos = os_strchr(cmd, ' ');
9651 	if (!pos)
9652 		return -1;
9653 	pos++;
9654 
9655 	entry = os_zalloc(sizeof(*entry));
9656 	if (!entry)
9657 		return -1;
9658 
9659 	if (hwaddr_aton(pos, entry->aa))
9660 		goto fail;
9661 
9662 	pos = os_strchr(pos, ' ');
9663 	if (!pos)
9664 		goto fail;
9665 	pos++;
9666 
9667 	if (hexstr2bin(pos, entry->pmkid, PMKID_LEN) < 0)
9668 		goto fail;
9669 
9670 	pos = os_strchr(pos, ' ');
9671 	if (!pos)
9672 		goto fail;
9673 	pos++;
9674 
9675 	pos2 = os_strchr(pos, ' ');
9676 	if (!pos2)
9677 		goto fail;
9678 	entry->pmk_len = (pos2 - pos) / 2;
9679 	if (entry->pmk_len < PMK_LEN || entry->pmk_len > PMK_LEN_MAX ||
9680 	    hexstr2bin(pos, entry->pmk, entry->pmk_len) < 0)
9681 		goto fail;
9682 
9683 	pos = os_strchr(pos, ' ');
9684 	if (!pos)
9685 		goto fail;
9686 	pos++;
9687 
9688 	if (sscanf(pos, "%d %d %d %d", &reauth_time, &expiration,
9689 		   &entry->akmp, &entry->opportunistic) != 4)
9690 		goto fail;
9691 	for (i = 0; i < 4; i++) {
9692 		pos = os_strchr(pos, ' ');
9693 		if (!pos) {
9694 			if (i < 3)
9695 				goto fail;
9696 			break;
9697 		}
9698 		pos++;
9699 	}
9700 	if (pos) {
9701 		if (hexstr2bin(pos, entry->fils_cache_id,
9702 			       FILS_CACHE_ID_LEN) < 0)
9703 			goto fail;
9704 		entry->fils_cache_id_set = 1;
9705 	}
9706 	os_get_reltime(&now);
9707 	entry->expiration = now.sec + expiration;
9708 	entry->reauth_time = now.sec + reauth_time;
9709 
9710 	entry->network_ctx = ssid;
9711 
9712 	wpa_sm_pmksa_cache_add_entry(wpa_s->wpa, entry);
9713 	entry = NULL;
9714 	ret = 0;
9715 fail:
9716 	os_free(entry);
9717 	return ret;
9718 }
9719 
9720 
9721 #ifdef CONFIG_MESH
9722 
9723 static int wpas_ctrl_iface_mesh_pmksa_get(struct wpa_supplicant *wpa_s,
9724 					  const char *cmd, char *buf,
9725 					  size_t buflen)
9726 {
9727 	u8 spa[ETH_ALEN];
9728 
9729 	if (!wpa_s->ifmsh)
9730 		return -1;
9731 
9732 	if (os_strcasecmp(cmd, "any") == 0)
9733 		return wpas_ap_pmksa_cache_list_mesh(wpa_s, NULL, buf, buflen);
9734 
9735 	if (hwaddr_aton(cmd, spa))
9736 		return -1;
9737 
9738 	return wpas_ap_pmksa_cache_list_mesh(wpa_s, spa, buf, buflen);
9739 }
9740 
9741 
9742 static int wpas_ctrl_iface_mesh_pmksa_add(struct wpa_supplicant *wpa_s,
9743 					  char *cmd)
9744 {
9745 	/*
9746 	 * We do not check mesh interface existance because PMKSA should be
9747 	 * stored before wpa_s->ifmsh creation to suppress commit message
9748 	 * creation.
9749 	 */
9750 	return wpas_ap_pmksa_cache_add_external(wpa_s, cmd);
9751 }
9752 
9753 #endif /* CONFIG_MESH */
9754 #endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
9755 
9756 
9757 #ifdef CONFIG_FILS
9758 static int wpas_ctrl_iface_fils_hlp_req_add(struct wpa_supplicant *wpa_s,
9759 					    const char *cmd)
9760 {
9761 	struct fils_hlp_req *req;
9762 	const char *pos;
9763 
9764 	/* format: <dst> <packet starting from ethertype> */
9765 
9766 	req = os_zalloc(sizeof(*req));
9767 	if (!req)
9768 		return -1;
9769 
9770 	if (hwaddr_aton(cmd, req->dst))
9771 		goto fail;
9772 
9773 	pos = os_strchr(cmd, ' ');
9774 	if (!pos)
9775 		goto fail;
9776 	pos++;
9777 	req->pkt = wpabuf_parse_bin(pos);
9778 	if (!req->pkt)
9779 		goto fail;
9780 
9781 	dl_list_add_tail(&wpa_s->fils_hlp_req, &req->list);
9782 	return 0;
9783 fail:
9784 	wpabuf_free(req->pkt);
9785 	os_free(req);
9786 	return -1;
9787 }
9788 #endif /* CONFIG_FILS */
9789 
9790 
9791 static int wpas_ctrl_cmd_debug_level(const char *cmd)
9792 {
9793 	if (os_strcmp(cmd, "PING") == 0 ||
9794 	    os_strncmp(cmd, "BSS ", 4) == 0 ||
9795 	    os_strncmp(cmd, "GET_NETWORK ", 12) == 0 ||
9796 	    os_strncmp(cmd, "STATUS", 6) == 0 ||
9797 	    os_strncmp(cmd, "STA ", 4) == 0 ||
9798 	    os_strncmp(cmd, "STA-", 4) == 0)
9799 		return MSG_EXCESSIVE;
9800 	return MSG_DEBUG;
9801 }
9802 
9803 
9804 char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
9805 					 char *buf, size_t *resp_len)
9806 {
9807 	char *reply;
9808 	const int reply_size = 4096;
9809 	int reply_len;
9810 
9811 	if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0 ||
9812 	    os_strncmp(buf, "SET_NETWORK ", 12) == 0 ||
9813 	    os_strncmp(buf, "PMKSA_ADD ", 10) == 0 ||
9814 	    os_strncmp(buf, "MESH_PMKSA_ADD ", 15) == 0) {
9815 		if (wpa_debug_show_keys)
9816 			wpa_dbg(wpa_s, MSG_DEBUG,
9817 				"Control interface command '%s'", buf);
9818 		else
9819 			wpa_dbg(wpa_s, MSG_DEBUG,
9820 				"Control interface command '%s [REMOVED]'",
9821 				os_strncmp(buf, WPA_CTRL_RSP,
9822 					   os_strlen(WPA_CTRL_RSP)) == 0 ?
9823 				WPA_CTRL_RSP :
9824 				(os_strncmp(buf, "SET_NETWORK ", 12) == 0 ?
9825 				 "SET_NETWORK" : "key-add"));
9826 	} else if (os_strncmp(buf, "WPS_NFC_TAG_READ", 16) == 0 ||
9827 		   os_strncmp(buf, "NFC_REPORT_HANDOVER", 19) == 0) {
9828 		wpa_hexdump_ascii_key(MSG_DEBUG, "RX ctrl_iface",
9829 				      (const u8 *) buf, os_strlen(buf));
9830 	} else {
9831 		int level = wpas_ctrl_cmd_debug_level(buf);
9832 		wpa_dbg(wpa_s, level, "Control interface command '%s'", buf);
9833 	}
9834 
9835 	reply = os_malloc(reply_size);
9836 	if (reply == NULL) {
9837 		*resp_len = 1;
9838 		return NULL;
9839 	}
9840 
9841 	os_memcpy(reply, "OK\n", 3);
9842 	reply_len = 3;
9843 
9844 	if (os_strcmp(buf, "PING") == 0) {
9845 		os_memcpy(reply, "PONG\n", 5);
9846 		reply_len = 5;
9847 	} else if (os_strcmp(buf, "IFNAME") == 0) {
9848 		reply_len = os_strlen(wpa_s->ifname);
9849 		os_memcpy(reply, wpa_s->ifname, reply_len);
9850 	} else if (os_strncmp(buf, "RELOG", 5) == 0) {
9851 		if (wpa_debug_reopen_file() < 0)
9852 			reply_len = -1;
9853 	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
9854 		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
9855 	} else if (os_strcmp(buf, "MIB") == 0) {
9856 		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
9857 		if (reply_len >= 0) {
9858 			reply_len += eapol_sm_get_mib(wpa_s->eapol,
9859 						      reply + reply_len,
9860 						      reply_size - reply_len);
9861 		}
9862 	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
9863 		reply_len = wpa_supplicant_ctrl_iface_status(
9864 			wpa_s, buf + 6, reply, reply_size);
9865 	} else if (os_strcmp(buf, "PMKSA") == 0) {
9866 		reply_len = wpas_ctrl_iface_pmksa(wpa_s, reply, reply_size);
9867 	} else if (os_strcmp(buf, "PMKSA_FLUSH") == 0) {
9868 		wpas_ctrl_iface_pmksa_flush(wpa_s);
9869 #ifdef CONFIG_PMKSA_CACHE_EXTERNAL
9870 	} else if (os_strncmp(buf, "PMKSA_GET ", 10) == 0) {
9871 		reply_len = wpas_ctrl_iface_pmksa_get(wpa_s, buf + 10,
9872 						      reply, reply_size);
9873 	} else if (os_strncmp(buf, "PMKSA_ADD ", 10) == 0) {
9874 		if (wpas_ctrl_iface_pmksa_add(wpa_s, buf + 10) < 0)
9875 			reply_len = -1;
9876 #ifdef CONFIG_MESH
9877 	} else if (os_strncmp(buf, "MESH_PMKSA_GET ", 15) == 0) {
9878 		reply_len = wpas_ctrl_iface_mesh_pmksa_get(wpa_s, buf + 15,
9879 							   reply, reply_size);
9880 	} else if (os_strncmp(buf, "MESH_PMKSA_ADD ", 15) == 0) {
9881 		if (wpas_ctrl_iface_mesh_pmksa_add(wpa_s, buf + 15) < 0)
9882 			reply_len = -1;
9883 #endif /* CONFIG_MESH */
9884 #endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
9885 	} else if (os_strncmp(buf, "SET ", 4) == 0) {
9886 		if (wpa_supplicant_ctrl_iface_set(wpa_s, buf + 4))
9887 			reply_len = -1;
9888 	} else if (os_strncmp(buf, "DUMP", 4) == 0) {
9889 		reply_len = wpa_config_dump_values(wpa_s->conf,
9890 						   reply, reply_size);
9891 	} else if (os_strncmp(buf, "GET ", 4) == 0) {
9892 		reply_len = wpa_supplicant_ctrl_iface_get(wpa_s, buf + 4,
9893 							  reply, reply_size);
9894 	} else if (os_strcmp(buf, "LOGON") == 0) {
9895 		eapol_sm_notify_logoff(wpa_s->eapol, FALSE);
9896 	} else if (os_strcmp(buf, "LOGOFF") == 0) {
9897 		eapol_sm_notify_logoff(wpa_s->eapol, TRUE);
9898 	} else if (os_strcmp(buf, "REASSOCIATE") == 0) {
9899 		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
9900 			reply_len = -1;
9901 		else
9902 			wpas_request_connection(wpa_s);
9903 	} else if (os_strcmp(buf, "REATTACH") == 0) {
9904 		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED ||
9905 		    !wpa_s->current_ssid)
9906 			reply_len = -1;
9907 		else {
9908 			wpa_s->reattach = 1;
9909 			wpas_request_connection(wpa_s);
9910 		}
9911 	} else if (os_strcmp(buf, "RECONNECT") == 0) {
9912 		if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
9913 			reply_len = -1;
9914 		else if (wpa_s->disconnected)
9915 			wpas_request_connection(wpa_s);
9916 #ifdef IEEE8021X_EAPOL
9917 	} else if (os_strncmp(buf, "PREAUTH ", 8) == 0) {
9918 		if (wpa_supplicant_ctrl_iface_preauth(wpa_s, buf + 8))
9919 			reply_len = -1;
9920 #endif /* IEEE8021X_EAPOL */
9921 #ifdef CONFIG_IEEE80211R
9922 	} else if (os_strncmp(buf, "FT_DS ", 6) == 0) {
9923 		if (wpa_supplicant_ctrl_iface_ft_ds(wpa_s, buf + 6))
9924 			reply_len = -1;
9925 #endif /* CONFIG_IEEE80211R */
9926 #ifdef CONFIG_WPS
9927 	} else if (os_strcmp(buf, "WPS_PBC") == 0) {
9928 		int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, NULL);
9929 		if (res == -2) {
9930 			os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
9931 			reply_len = 17;
9932 		} else if (res)
9933 			reply_len = -1;
9934 	} else if (os_strncmp(buf, "WPS_PBC ", 8) == 0) {
9935 		int res = wpa_supplicant_ctrl_iface_wps_pbc(wpa_s, buf + 8);
9936 		if (res == -2) {
9937 			os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
9938 			reply_len = 17;
9939 		} else if (res)
9940 			reply_len = -1;
9941 	} else if (os_strncmp(buf, "WPS_PIN ", 8) == 0) {
9942 		reply_len = wpa_supplicant_ctrl_iface_wps_pin(wpa_s, buf + 8,
9943 							      reply,
9944 							      reply_size);
9945 	} else if (os_strncmp(buf, "WPS_CHECK_PIN ", 14) == 0) {
9946 		reply_len = wpa_supplicant_ctrl_iface_wps_check_pin(
9947 			wpa_s, buf + 14, reply, reply_size);
9948 	} else if (os_strcmp(buf, "WPS_CANCEL") == 0) {
9949 		if (wpas_wps_cancel(wpa_s))
9950 			reply_len = -1;
9951 #ifdef CONFIG_WPS_NFC
9952 	} else if (os_strcmp(buf, "WPS_NFC") == 0) {
9953 		if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, NULL))
9954 			reply_len = -1;
9955 	} else if (os_strncmp(buf, "WPS_NFC ", 8) == 0) {
9956 		if (wpa_supplicant_ctrl_iface_wps_nfc(wpa_s, buf + 8))
9957 			reply_len = -1;
9958 	} else if (os_strncmp(buf, "WPS_NFC_CONFIG_TOKEN ", 21) == 0) {
9959 		reply_len = wpa_supplicant_ctrl_iface_wps_nfc_config_token(
9960 			wpa_s, buf + 21, reply, reply_size);
9961 	} else if (os_strncmp(buf, "WPS_NFC_TOKEN ", 14) == 0) {
9962 		reply_len = wpa_supplicant_ctrl_iface_wps_nfc_token(
9963 			wpa_s, buf + 14, reply, reply_size);
9964 	} else if (os_strncmp(buf, "WPS_NFC_TAG_READ ", 17) == 0) {
9965 		if (wpa_supplicant_ctrl_iface_wps_nfc_tag_read(wpa_s,
9966 							       buf + 17))
9967 			reply_len = -1;
9968 	} else if (os_strncmp(buf, "NFC_GET_HANDOVER_REQ ", 21) == 0) {
9969 		reply_len = wpas_ctrl_nfc_get_handover_req(
9970 			wpa_s, buf + 21, reply, reply_size);
9971 	} else if (os_strncmp(buf, "NFC_GET_HANDOVER_SEL ", 21) == 0) {
9972 		reply_len = wpas_ctrl_nfc_get_handover_sel(
9973 			wpa_s, buf + 21, reply, reply_size);
9974 	} else if (os_strncmp(buf, "NFC_REPORT_HANDOVER ", 20) == 0) {
9975 		if (wpas_ctrl_nfc_report_handover(wpa_s, buf + 20))
9976 			reply_len = -1;
9977 #endif /* CONFIG_WPS_NFC */
9978 	} else if (os_strncmp(buf, "WPS_REG ", 8) == 0) {
9979 		if (wpa_supplicant_ctrl_iface_wps_reg(wpa_s, buf + 8))
9980 			reply_len = -1;
9981 #ifdef CONFIG_AP
9982 	} else if (os_strncmp(buf, "WPS_AP_PIN ", 11) == 0) {
9983 		reply_len = wpa_supplicant_ctrl_iface_wps_ap_pin(
9984 			wpa_s, buf + 11, reply, reply_size);
9985 #endif /* CONFIG_AP */
9986 #ifdef CONFIG_WPS_ER
9987 	} else if (os_strcmp(buf, "WPS_ER_START") == 0) {
9988 		if (wpas_wps_er_start(wpa_s, NULL))
9989 			reply_len = -1;
9990 	} else if (os_strncmp(buf, "WPS_ER_START ", 13) == 0) {
9991 		if (wpas_wps_er_start(wpa_s, buf + 13))
9992 			reply_len = -1;
9993 	} else if (os_strcmp(buf, "WPS_ER_STOP") == 0) {
9994 		wpas_wps_er_stop(wpa_s);
9995 	} else if (os_strncmp(buf, "WPS_ER_PIN ", 11) == 0) {
9996 		if (wpa_supplicant_ctrl_iface_wps_er_pin(wpa_s, buf + 11))
9997 			reply_len = -1;
9998 	} else if (os_strncmp(buf, "WPS_ER_PBC ", 11) == 0) {
9999 		int ret = wpas_wps_er_pbc(wpa_s, buf + 11);
10000 		if (ret == -2) {
10001 			os_memcpy(reply, "FAIL-PBC-OVERLAP\n", 17);
10002 			reply_len = 17;
10003 		} else if (ret == -3) {
10004 			os_memcpy(reply, "FAIL-UNKNOWN-UUID\n", 18);
10005 			reply_len = 18;
10006 		} else if (ret == -4) {
10007 			os_memcpy(reply, "FAIL-NO-AP-SETTINGS\n", 20);
10008 			reply_len = 20;
10009 		} else if (ret)
10010 			reply_len = -1;
10011 	} else if (os_strncmp(buf, "WPS_ER_LEARN ", 13) == 0) {
10012 		if (wpa_supplicant_ctrl_iface_wps_er_learn(wpa_s, buf + 13))
10013 			reply_len = -1;
10014 	} else if (os_strncmp(buf, "WPS_ER_SET_CONFIG ", 18) == 0) {
10015 		if (wpa_supplicant_ctrl_iface_wps_er_set_config(wpa_s,
10016 								buf + 18))
10017 			reply_len = -1;
10018 	} else if (os_strncmp(buf, "WPS_ER_CONFIG ", 14) == 0) {
10019 		if (wpa_supplicant_ctrl_iface_wps_er_config(wpa_s, buf + 14))
10020 			reply_len = -1;
10021 #ifdef CONFIG_WPS_NFC
10022 	} else if (os_strncmp(buf, "WPS_ER_NFC_CONFIG_TOKEN ", 24) == 0) {
10023 		reply_len = wpa_supplicant_ctrl_iface_wps_er_nfc_config_token(
10024 			wpa_s, buf + 24, reply, reply_size);
10025 #endif /* CONFIG_WPS_NFC */
10026 #endif /* CONFIG_WPS_ER */
10027 #endif /* CONFIG_WPS */
10028 #ifdef CONFIG_IBSS_RSN
10029 	} else if (os_strncmp(buf, "IBSS_RSN ", 9) == 0) {
10030 		if (wpa_supplicant_ctrl_iface_ibss_rsn(wpa_s, buf + 9))
10031 			reply_len = -1;
10032 #endif /* CONFIG_IBSS_RSN */
10033 #ifdef CONFIG_MESH
10034 	} else if (os_strncmp(buf, "MESH_INTERFACE_ADD ", 19) == 0) {
10035 		reply_len = wpa_supplicant_ctrl_iface_mesh_interface_add(
10036 			wpa_s, buf + 19, reply, reply_size);
10037 	} else if (os_strcmp(buf, "MESH_INTERFACE_ADD") == 0) {
10038 		reply_len = wpa_supplicant_ctrl_iface_mesh_interface_add(
10039 			wpa_s, "", reply, reply_size);
10040 	} else if (os_strncmp(buf, "MESH_GROUP_ADD ", 15) == 0) {
10041 		if (wpa_supplicant_ctrl_iface_mesh_group_add(wpa_s, buf + 15))
10042 			reply_len = -1;
10043 	} else if (os_strncmp(buf, "MESH_GROUP_REMOVE ", 18) == 0) {
10044 		if (wpa_supplicant_ctrl_iface_mesh_group_remove(wpa_s,
10045 								buf + 18))
10046 			reply_len = -1;
10047 	} else if (os_strncmp(buf, "MESH_PEER_REMOVE ", 17) == 0) {
10048 		if (wpa_supplicant_ctrl_iface_mesh_peer_remove(wpa_s, buf + 17))
10049 			reply_len = -1;
10050 	} else if (os_strncmp(buf, "MESH_PEER_ADD ", 14) == 0) {
10051 		if (wpa_supplicant_ctrl_iface_mesh_peer_add(wpa_s, buf + 14))
10052 			reply_len = -1;
10053 #endif /* CONFIG_MESH */
10054 #ifdef CONFIG_P2P
10055 	} else if (os_strncmp(buf, "P2P_FIND ", 9) == 0) {
10056 		if (p2p_ctrl_find(wpa_s, buf + 8))
10057 			reply_len = -1;
10058 	} else if (os_strcmp(buf, "P2P_FIND") == 0) {
10059 		if (p2p_ctrl_find(wpa_s, ""))
10060 			reply_len = -1;
10061 	} else if (os_strcmp(buf, "P2P_STOP_FIND") == 0) {
10062 		wpas_p2p_stop_find(wpa_s);
10063 	} else if (os_strncmp(buf, "P2P_ASP_PROVISION ", 18) == 0) {
10064 		if (p2p_ctrl_asp_provision(wpa_s, buf + 18))
10065 			reply_len = -1;
10066 	} else if (os_strncmp(buf, "P2P_ASP_PROVISION_RESP ", 23) == 0) {
10067 		if (p2p_ctrl_asp_provision_resp(wpa_s, buf + 23))
10068 			reply_len = -1;
10069 	} else if (os_strncmp(buf, "P2P_CONNECT ", 12) == 0) {
10070 		reply_len = p2p_ctrl_connect(wpa_s, buf + 12, reply,
10071 					     reply_size);
10072 	} else if (os_strncmp(buf, "P2P_LISTEN ", 11) == 0) {
10073 		if (p2p_ctrl_listen(wpa_s, buf + 11))
10074 			reply_len = -1;
10075 	} else if (os_strcmp(buf, "P2P_LISTEN") == 0) {
10076 		if (p2p_ctrl_listen(wpa_s, ""))
10077 			reply_len = -1;
10078 	} else if (os_strncmp(buf, "P2P_GROUP_REMOVE ", 17) == 0) {
10079 		if (wpas_p2p_group_remove(wpa_s, buf + 17))
10080 			reply_len = -1;
10081 	} else if (os_strcmp(buf, "P2P_GROUP_ADD") == 0) {
10082 		if (p2p_ctrl_group_add(wpa_s, ""))
10083 			reply_len = -1;
10084 	} else if (os_strncmp(buf, "P2P_GROUP_ADD ", 14) == 0) {
10085 		if (p2p_ctrl_group_add(wpa_s, buf + 14))
10086 			reply_len = -1;
10087 	} else if (os_strncmp(buf, "P2P_GROUP_MEMBER ", 17) == 0) {
10088 		reply_len = p2p_ctrl_group_member(wpa_s, buf + 17, reply,
10089 						  reply_size);
10090 	} else if (os_strncmp(buf, "P2P_PROV_DISC ", 14) == 0) {
10091 		if (p2p_ctrl_prov_disc(wpa_s, buf + 14))
10092 			reply_len = -1;
10093 	} else if (os_strcmp(buf, "P2P_GET_PASSPHRASE") == 0) {
10094 		reply_len = p2p_get_passphrase(wpa_s, reply, reply_size);
10095 	} else if (os_strncmp(buf, "P2P_SERV_DISC_REQ ", 18) == 0) {
10096 		reply_len = p2p_ctrl_serv_disc_req(wpa_s, buf + 18, reply,
10097 						   reply_size);
10098 	} else if (os_strncmp(buf, "P2P_SERV_DISC_CANCEL_REQ ", 25) == 0) {
10099 		if (p2p_ctrl_serv_disc_cancel_req(wpa_s, buf + 25) < 0)
10100 			reply_len = -1;
10101 	} else if (os_strncmp(buf, "P2P_SERV_DISC_RESP ", 19) == 0) {
10102 		if (p2p_ctrl_serv_disc_resp(wpa_s, buf + 19) < 0)
10103 			reply_len = -1;
10104 	} else if (os_strcmp(buf, "P2P_SERVICE_UPDATE") == 0) {
10105 		wpas_p2p_sd_service_update(wpa_s);
10106 	} else if (os_strncmp(buf, "P2P_SERV_DISC_EXTERNAL ", 23) == 0) {
10107 		if (p2p_ctrl_serv_disc_external(wpa_s, buf + 23) < 0)
10108 			reply_len = -1;
10109 	} else if (os_strcmp(buf, "P2P_SERVICE_FLUSH") == 0) {
10110 		wpas_p2p_service_flush(wpa_s);
10111 	} else if (os_strncmp(buf, "P2P_SERVICE_ADD ", 16) == 0) {
10112 		if (p2p_ctrl_service_add(wpa_s, buf + 16) < 0)
10113 			reply_len = -1;
10114 	} else if (os_strncmp(buf, "P2P_SERVICE_DEL ", 16) == 0) {
10115 		if (p2p_ctrl_service_del(wpa_s, buf + 16) < 0)
10116 			reply_len = -1;
10117 	} else if (os_strncmp(buf, "P2P_SERVICE_REP ", 16) == 0) {
10118 		if (p2p_ctrl_service_replace(wpa_s, buf + 16) < 0)
10119 			reply_len = -1;
10120 	} else if (os_strncmp(buf, "P2P_REJECT ", 11) == 0) {
10121 		if (p2p_ctrl_reject(wpa_s, buf + 11) < 0)
10122 			reply_len = -1;
10123 	} else if (os_strncmp(buf, "P2P_INVITE ", 11) == 0) {
10124 		if (p2p_ctrl_invite(wpa_s, buf + 11) < 0)
10125 			reply_len = -1;
10126 	} else if (os_strncmp(buf, "P2P_PEER ", 9) == 0) {
10127 		reply_len = p2p_ctrl_peer(wpa_s, buf + 9, reply,
10128 					      reply_size);
10129 	} else if (os_strncmp(buf, "P2P_SET ", 8) == 0) {
10130 		if (p2p_ctrl_set(wpa_s, buf + 8) < 0)
10131 			reply_len = -1;
10132 	} else if (os_strcmp(buf, "P2P_FLUSH") == 0) {
10133 		p2p_ctrl_flush(wpa_s);
10134 	} else if (os_strncmp(buf, "P2P_UNAUTHORIZE ", 16) == 0) {
10135 		if (wpas_p2p_unauthorize(wpa_s, buf + 16) < 0)
10136 			reply_len = -1;
10137 	} else if (os_strcmp(buf, "P2P_CANCEL") == 0) {
10138 		if (wpas_p2p_cancel(wpa_s))
10139 			reply_len = -1;
10140 	} else if (os_strncmp(buf, "P2P_PRESENCE_REQ ", 17) == 0) {
10141 		if (p2p_ctrl_presence_req(wpa_s, buf + 17) < 0)
10142 			reply_len = -1;
10143 	} else if (os_strcmp(buf, "P2P_PRESENCE_REQ") == 0) {
10144 		if (p2p_ctrl_presence_req(wpa_s, "") < 0)
10145 			reply_len = -1;
10146 	} else if (os_strncmp(buf, "P2P_EXT_LISTEN ", 15) == 0) {
10147 		if (p2p_ctrl_ext_listen(wpa_s, buf + 15) < 0)
10148 			reply_len = -1;
10149 	} else if (os_strcmp(buf, "P2P_EXT_LISTEN") == 0) {
10150 		if (p2p_ctrl_ext_listen(wpa_s, "") < 0)
10151 			reply_len = -1;
10152 	} else if (os_strncmp(buf, "P2P_REMOVE_CLIENT ", 18) == 0) {
10153 		if (p2p_ctrl_remove_client(wpa_s, buf + 18) < 0)
10154 			reply_len = -1;
10155 	} else if (os_strncmp(buf, "P2P_LO_START ", 13) == 0) {
10156 		if (p2p_ctrl_iface_p2p_lo_start(wpa_s, buf + 13))
10157 			reply_len = -1;
10158 	} else if (os_strcmp(buf, "P2P_LO_STOP") == 0) {
10159 		if (wpas_p2p_lo_stop(wpa_s))
10160 			reply_len = -1;
10161 #endif /* CONFIG_P2P */
10162 #ifdef CONFIG_WIFI_DISPLAY
10163 	} else if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0) {
10164 		if (wifi_display_subelem_set(wpa_s->global, buf + 16) < 0)
10165 			reply_len = -1;
10166 	} else if (os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0) {
10167 		reply_len = wifi_display_subelem_get(wpa_s->global, buf + 16,
10168 						     reply, reply_size);
10169 #endif /* CONFIG_WIFI_DISPLAY */
10170 #ifdef CONFIG_INTERWORKING
10171 	} else if (os_strcmp(buf, "FETCH_ANQP") == 0) {
10172 		if (interworking_fetch_anqp(wpa_s) < 0)
10173 			reply_len = -1;
10174 	} else if (os_strcmp(buf, "STOP_FETCH_ANQP") == 0) {
10175 		interworking_stop_fetch_anqp(wpa_s);
10176 	} else if (os_strcmp(buf, "INTERWORKING_SELECT") == 0) {
10177 		if (ctrl_interworking_select(wpa_s, NULL) < 0)
10178 			reply_len = -1;
10179 	} else if (os_strncmp(buf, "INTERWORKING_SELECT ", 20) == 0) {
10180 		if (ctrl_interworking_select(wpa_s, buf + 20) < 0)
10181 			reply_len = -1;
10182 	} else if (os_strncmp(buf, "INTERWORKING_CONNECT ", 21) == 0) {
10183 		if (ctrl_interworking_connect(wpa_s, buf + 21, 0) < 0)
10184 			reply_len = -1;
10185 	} else if (os_strncmp(buf, "INTERWORKING_ADD_NETWORK ", 25) == 0) {
10186 		int id;
10187 
10188 		id = ctrl_interworking_connect(wpa_s, buf + 25, 1);
10189 		if (id < 0)
10190 			reply_len = -1;
10191 		else {
10192 			reply_len = os_snprintf(reply, reply_size, "%d\n", id);
10193 			if (os_snprintf_error(reply_size, reply_len))
10194 				reply_len = -1;
10195 		}
10196 	} else if (os_strncmp(buf, "ANQP_GET ", 9) == 0) {
10197 		if (get_anqp(wpa_s, buf + 9) < 0)
10198 			reply_len = -1;
10199 	} else if (os_strncmp(buf, "GAS_REQUEST ", 12) == 0) {
10200 		if (gas_request(wpa_s, buf + 12) < 0)
10201 			reply_len = -1;
10202 	} else if (os_strncmp(buf, "GAS_RESPONSE_GET ", 17) == 0) {
10203 		reply_len = gas_response_get(wpa_s, buf + 17, reply,
10204 					     reply_size);
10205 #endif /* CONFIG_INTERWORKING */
10206 #ifdef CONFIG_HS20
10207 	} else if (os_strncmp(buf, "HS20_ANQP_GET ", 14) == 0) {
10208 		if (get_hs20_anqp(wpa_s, buf + 14) < 0)
10209 			reply_len = -1;
10210 	} else if (os_strncmp(buf, "HS20_GET_NAI_HOME_REALM_LIST ", 29) == 0) {
10211 		if (hs20_get_nai_home_realm_list(wpa_s, buf + 29) < 0)
10212 			reply_len = -1;
10213 	} else if (os_strncmp(buf, "HS20_ICON_REQUEST ", 18) == 0) {
10214 		if (hs20_icon_request(wpa_s, buf + 18, 0) < 0)
10215 			reply_len = -1;
10216 	} else if (os_strncmp(buf, "REQ_HS20_ICON ", 14) == 0) {
10217 		if (hs20_icon_request(wpa_s, buf + 14, 1) < 0)
10218 			reply_len = -1;
10219 	} else if (os_strncmp(buf, "GET_HS20_ICON ", 14) == 0) {
10220 		reply_len = get_hs20_icon(wpa_s, buf + 14, reply, reply_size);
10221 	} else if (os_strncmp(buf, "DEL_HS20_ICON ", 14) == 0) {
10222 		if (del_hs20_icon(wpa_s, buf + 14) < 0)
10223 			reply_len = -1;
10224 	} else if (os_strcmp(buf, "FETCH_OSU") == 0) {
10225 		if (hs20_fetch_osu(wpa_s, 0) < 0)
10226 			reply_len = -1;
10227 	} else if (os_strcmp(buf, "FETCH_OSU no-scan") == 0) {
10228 		if (hs20_fetch_osu(wpa_s, 1) < 0)
10229 			reply_len = -1;
10230 	} else if (os_strcmp(buf, "CANCEL_FETCH_OSU") == 0) {
10231 		hs20_cancel_fetch_osu(wpa_s);
10232 #endif /* CONFIG_HS20 */
10233 	} else if (os_strncmp(buf, WPA_CTRL_RSP, os_strlen(WPA_CTRL_RSP)) == 0)
10234 	{
10235 		if (wpa_supplicant_ctrl_iface_ctrl_rsp(
10236 			    wpa_s, buf + os_strlen(WPA_CTRL_RSP)))
10237 			reply_len = -1;
10238 		else {
10239 			/*
10240 			 * Notify response from timeout to allow the control
10241 			 * interface response to be sent first.
10242 			 */
10243 			eloop_register_timeout(0, 0, wpas_ctrl_eapol_response,
10244 					       wpa_s, NULL);
10245 		}
10246 	} else if (os_strcmp(buf, "RECONFIGURE") == 0) {
10247 		if (wpa_supplicant_reload_configuration(wpa_s))
10248 			reply_len = -1;
10249 	} else if (os_strcmp(buf, "TERMINATE") == 0) {
10250 		wpa_supplicant_terminate_proc(wpa_s->global);
10251 	} else if (os_strncmp(buf, "BSSID ", 6) == 0) {
10252 		if (wpa_supplicant_ctrl_iface_bssid(wpa_s, buf + 6))
10253 			reply_len = -1;
10254 	} else if (os_strncmp(buf, "BLACKLIST", 9) == 0) {
10255 		reply_len = wpa_supplicant_ctrl_iface_blacklist(
10256 			wpa_s, buf + 9, reply, reply_size);
10257 	} else if (os_strncmp(buf, "LOG_LEVEL", 9) == 0) {
10258 		reply_len = wpa_supplicant_ctrl_iface_log_level(
10259 			wpa_s, buf + 9, reply, reply_size);
10260 	} else if (os_strncmp(buf, "LIST_NETWORKS ", 14) == 0) {
10261 		reply_len = wpa_supplicant_ctrl_iface_list_networks(
10262 			wpa_s, buf + 14, reply, reply_size);
10263 	} else if (os_strcmp(buf, "LIST_NETWORKS") == 0) {
10264 		reply_len = wpa_supplicant_ctrl_iface_list_networks(
10265 			wpa_s, NULL, reply, reply_size);
10266 	} else if (os_strcmp(buf, "DISCONNECT") == 0) {
10267 		wpas_request_disconnection(wpa_s);
10268 	} else if (os_strcmp(buf, "SCAN") == 0) {
10269 		wpas_ctrl_scan(wpa_s, NULL, reply, reply_size, &reply_len);
10270 	} else if (os_strncmp(buf, "SCAN ", 5) == 0) {
10271 		wpas_ctrl_scan(wpa_s, buf + 5, reply, reply_size, &reply_len);
10272 	} else if (os_strcmp(buf, "SCAN_RESULTS") == 0) {
10273 		reply_len = wpa_supplicant_ctrl_iface_scan_results(
10274 			wpa_s, reply, reply_size);
10275 	} else if (os_strcmp(buf, "ABORT_SCAN") == 0) {
10276 		if (wpas_abort_ongoing_scan(wpa_s) < 0)
10277 			reply_len = -1;
10278 	} else if (os_strncmp(buf, "SELECT_NETWORK ", 15) == 0) {
10279 		if (wpa_supplicant_ctrl_iface_select_network(wpa_s, buf + 15))
10280 			reply_len = -1;
10281 	} else if (os_strncmp(buf, "ENABLE_NETWORK ", 15) == 0) {
10282 		if (wpa_supplicant_ctrl_iface_enable_network(wpa_s, buf + 15))
10283 			reply_len = -1;
10284 	} else if (os_strncmp(buf, "DISABLE_NETWORK ", 16) == 0) {
10285 		if (wpa_supplicant_ctrl_iface_disable_network(wpa_s, buf + 16))
10286 			reply_len = -1;
10287 	} else if (os_strcmp(buf, "ADD_NETWORK") == 0) {
10288 		reply_len = wpa_supplicant_ctrl_iface_add_network(
10289 			wpa_s, reply, reply_size);
10290 	} else if (os_strncmp(buf, "REMOVE_NETWORK ", 15) == 0) {
10291 		if (wpa_supplicant_ctrl_iface_remove_network(wpa_s, buf + 15))
10292 			reply_len = -1;
10293 	} else if (os_strncmp(buf, "SET_NETWORK ", 12) == 0) {
10294 		if (wpa_supplicant_ctrl_iface_set_network(wpa_s, buf + 12))
10295 			reply_len = -1;
10296 	} else if (os_strncmp(buf, "GET_NETWORK ", 12) == 0) {
10297 		reply_len = wpa_supplicant_ctrl_iface_get_network(
10298 			wpa_s, buf + 12, reply, reply_size);
10299 	} else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
10300 		if (wpa_supplicant_ctrl_iface_dup_network(wpa_s, buf + 12,
10301 							  wpa_s))
10302 			reply_len = -1;
10303 	} else if (os_strcmp(buf, "LIST_CREDS") == 0) {
10304 		reply_len = wpa_supplicant_ctrl_iface_list_creds(
10305 			wpa_s, reply, reply_size);
10306 	} else if (os_strcmp(buf, "ADD_CRED") == 0) {
10307 		reply_len = wpa_supplicant_ctrl_iface_add_cred(
10308 			wpa_s, reply, reply_size);
10309 	} else if (os_strncmp(buf, "REMOVE_CRED ", 12) == 0) {
10310 		if (wpa_supplicant_ctrl_iface_remove_cred(wpa_s, buf + 12))
10311 			reply_len = -1;
10312 	} else if (os_strncmp(buf, "SET_CRED ", 9) == 0) {
10313 		if (wpa_supplicant_ctrl_iface_set_cred(wpa_s, buf + 9))
10314 			reply_len = -1;
10315 	} else if (os_strncmp(buf, "GET_CRED ", 9) == 0) {
10316 		reply_len = wpa_supplicant_ctrl_iface_get_cred(wpa_s, buf + 9,
10317 							       reply,
10318 							       reply_size);
10319 #ifndef CONFIG_NO_CONFIG_WRITE
10320 	} else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
10321 		if (wpa_supplicant_ctrl_iface_save_config(wpa_s))
10322 			reply_len = -1;
10323 #endif /* CONFIG_NO_CONFIG_WRITE */
10324 	} else if (os_strncmp(buf, "GET_CAPABILITY ", 15) == 0) {
10325 		reply_len = wpa_supplicant_ctrl_iface_get_capability(
10326 			wpa_s, buf + 15, reply, reply_size);
10327 	} else if (os_strncmp(buf, "AP_SCAN ", 8) == 0) {
10328 		if (wpa_supplicant_ctrl_iface_ap_scan(wpa_s, buf + 8))
10329 			reply_len = -1;
10330 	} else if (os_strncmp(buf, "SCAN_INTERVAL ", 14) == 0) {
10331 		if (wpa_supplicant_ctrl_iface_scan_interval(wpa_s, buf + 14))
10332 			reply_len = -1;
10333 	} else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
10334 		reply_len = wpa_supplicant_global_iface_list(
10335 			wpa_s->global, reply, reply_size);
10336 	} else if (os_strncmp(buf, "INTERFACES", 10) == 0) {
10337 		reply_len = wpa_supplicant_global_iface_interfaces(
10338 			wpa_s->global, buf + 10, reply, reply_size);
10339 	} else if (os_strncmp(buf, "BSS ", 4) == 0) {
10340 		reply_len = wpa_supplicant_ctrl_iface_bss(
10341 			wpa_s, buf + 4, reply, reply_size);
10342 #ifdef CONFIG_AP
10343 	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
10344 		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
10345 	} else if (os_strncmp(buf, "STA ", 4) == 0) {
10346 		reply_len = ap_ctrl_iface_sta(wpa_s, buf + 4, reply,
10347 					      reply_size);
10348 	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
10349 		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
10350 						   reply_size);
10351 	} else if (os_strncmp(buf, "DEAUTHENTICATE ", 15) == 0) {
10352 		if (ap_ctrl_iface_sta_deauthenticate(wpa_s, buf + 15))
10353 			reply_len = -1;
10354 	} else if (os_strncmp(buf, "DISASSOCIATE ", 13) == 0) {
10355 		if (ap_ctrl_iface_sta_disassociate(wpa_s, buf + 13))
10356 			reply_len = -1;
10357 	} else if (os_strncmp(buf, "CHAN_SWITCH ", 12) == 0) {
10358 		if (ap_ctrl_iface_chanswitch(wpa_s, buf + 12))
10359 			reply_len = -1;
10360 	} else if (os_strcmp(buf, "STOP_AP") == 0) {
10361 		if (wpas_ap_stop_ap(wpa_s))
10362 			reply_len = -1;
10363 #endif /* CONFIG_AP */
10364 	} else if (os_strcmp(buf, "SUSPEND") == 0) {
10365 		wpas_notify_suspend(wpa_s->global);
10366 	} else if (os_strcmp(buf, "RESUME") == 0) {
10367 		wpas_notify_resume(wpa_s->global);
10368 #ifdef CONFIG_TESTING_OPTIONS
10369 	} else if (os_strcmp(buf, "DROP_SA") == 0) {
10370 		wpa_supplicant_ctrl_iface_drop_sa(wpa_s);
10371 #endif /* CONFIG_TESTING_OPTIONS */
10372 	} else if (os_strncmp(buf, "ROAM ", 5) == 0) {
10373 		if (wpa_supplicant_ctrl_iface_roam(wpa_s, buf + 5))
10374 			reply_len = -1;
10375 	} else if (os_strncmp(buf, "STA_AUTOCONNECT ", 16) == 0) {
10376 		wpa_s->auto_reconnect_disabled = atoi(buf + 16) == 0;
10377 	} else if (os_strncmp(buf, "BSS_EXPIRE_AGE ", 15) == 0) {
10378 		if (wpa_supplicant_ctrl_iface_bss_expire_age(wpa_s, buf + 15))
10379 			reply_len = -1;
10380 	} else if (os_strncmp(buf, "BSS_EXPIRE_COUNT ", 17) == 0) {
10381 		if (wpa_supplicant_ctrl_iface_bss_expire_count(wpa_s,
10382 							       buf + 17))
10383 			reply_len = -1;
10384 	} else if (os_strncmp(buf, "BSS_FLUSH ", 10) == 0) {
10385 		wpa_supplicant_ctrl_iface_bss_flush(wpa_s, buf + 10);
10386 #ifdef CONFIG_TDLS
10387 	} else if (os_strncmp(buf, "TDLS_DISCOVER ", 14) == 0) {
10388 		if (wpa_supplicant_ctrl_iface_tdls_discover(wpa_s, buf + 14))
10389 			reply_len = -1;
10390 	} else if (os_strncmp(buf, "TDLS_SETUP ", 11) == 0) {
10391 		if (wpa_supplicant_ctrl_iface_tdls_setup(wpa_s, buf + 11))
10392 			reply_len = -1;
10393 	} else if (os_strncmp(buf, "TDLS_TEARDOWN ", 14) == 0) {
10394 		if (wpa_supplicant_ctrl_iface_tdls_teardown(wpa_s, buf + 14))
10395 			reply_len = -1;
10396 	} else if (os_strncmp(buf, "TDLS_CHAN_SWITCH ", 17) == 0) {
10397 		if (wpa_supplicant_ctrl_iface_tdls_chan_switch(wpa_s,
10398 							       buf + 17))
10399 			reply_len = -1;
10400 	} else if (os_strncmp(buf, "TDLS_CANCEL_CHAN_SWITCH ", 24) == 0) {
10401 		if (wpa_supplicant_ctrl_iface_tdls_cancel_chan_switch(wpa_s,
10402 								      buf + 24))
10403 			reply_len = -1;
10404 	} else if (os_strncmp(buf, "TDLS_LINK_STATUS ", 17) == 0) {
10405 		reply_len = wpa_supplicant_ctrl_iface_tdls_link_status(
10406 			wpa_s, buf + 17, reply, reply_size);
10407 #endif /* CONFIG_TDLS */
10408 	} else if (os_strcmp(buf, "WMM_AC_STATUS") == 0) {
10409 		reply_len = wpas_wmm_ac_status(wpa_s, reply, reply_size);
10410 	} else if (os_strncmp(buf, "WMM_AC_ADDTS ", 13) == 0) {
10411 		if (wmm_ac_ctrl_addts(wpa_s, buf + 13))
10412 			reply_len = -1;
10413 	} else if (os_strncmp(buf, "WMM_AC_DELTS ", 13) == 0) {
10414 		if (wmm_ac_ctrl_delts(wpa_s, buf + 13))
10415 			reply_len = -1;
10416 	} else if (os_strncmp(buf, "SIGNAL_POLL", 11) == 0) {
10417 		reply_len = wpa_supplicant_signal_poll(wpa_s, reply,
10418 						       reply_size);
10419 	} else if (os_strncmp(buf, "SIGNAL_MONITOR", 14) == 0) {
10420 		if (wpas_ctrl_iface_signal_monitor(wpa_s, buf + 14))
10421 			reply_len = -1;
10422 	} else if (os_strncmp(buf, "PKTCNT_POLL", 11) == 0) {
10423 		reply_len = wpa_supplicant_pktcnt_poll(wpa_s, reply,
10424 						       reply_size);
10425 #ifdef CONFIG_AUTOSCAN
10426 	} else if (os_strncmp(buf, "AUTOSCAN ", 9) == 0) {
10427 		if (wpa_supplicant_ctrl_iface_autoscan(wpa_s, buf + 9))
10428 			reply_len = -1;
10429 #endif /* CONFIG_AUTOSCAN */
10430 	} else if (os_strcmp(buf, "DRIVER_FLAGS") == 0) {
10431 		reply_len = wpas_ctrl_iface_driver_flags(wpa_s, reply,
10432 							 reply_size);
10433 #ifdef ANDROID
10434 	} else if (os_strncmp(buf, "DRIVER ", 7) == 0) {
10435 		reply_len = wpa_supplicant_driver_cmd(wpa_s, buf + 7, reply,
10436 						      reply_size);
10437 #endif /* ANDROID */
10438 	} else if (os_strncmp(buf, "VENDOR ", 7) == 0) {
10439 		reply_len = wpa_supplicant_vendor_cmd(wpa_s, buf + 7, reply,
10440 						      reply_size);
10441 	} else if (os_strcmp(buf, "REAUTHENTICATE") == 0) {
10442 		pmksa_cache_clear_current(wpa_s->wpa);
10443 		eapol_sm_request_reauth(wpa_s->eapol);
10444 #ifdef CONFIG_WNM
10445 	} else if (os_strncmp(buf, "WNM_SLEEP ", 10) == 0) {
10446 		if (wpas_ctrl_iface_wnm_sleep(wpa_s, buf + 10))
10447 			reply_len = -1;
10448 	} else if (os_strncmp(buf, "WNM_BSS_QUERY ", 14) == 0) {
10449 		if (wpas_ctrl_iface_wnm_bss_query(wpa_s, buf + 14))
10450 				reply_len = -1;
10451 	} else if (os_strncmp(buf, "COLOC_INTF_REPORT ", 18) == 0) {
10452 		if (wpas_ctrl_iface_coloc_intf_report(wpa_s, buf + 18))
10453 			reply_len = -1;
10454 #endif /* CONFIG_WNM */
10455 	} else if (os_strcmp(buf, "FLUSH") == 0) {
10456 		wpa_supplicant_ctrl_iface_flush(wpa_s);
10457 	} else if (os_strncmp(buf, "RADIO_WORK ", 11) == 0) {
10458 		reply_len = wpas_ctrl_radio_work(wpa_s, buf + 11, reply,
10459 						 reply_size);
10460 #ifdef CONFIG_TESTING_OPTIONS
10461 	} else if (os_strncmp(buf, "MGMT_TX ", 8) == 0) {
10462 		if (wpas_ctrl_iface_mgmt_tx(wpa_s, buf + 8) < 0)
10463 			reply_len = -1;
10464 	} else if (os_strcmp(buf, "MGMT_TX_DONE") == 0) {
10465 		wpas_ctrl_iface_mgmt_tx_done(wpa_s);
10466 	} else if (os_strncmp(buf, "MGMT_RX_PROCESS ", 16) == 0) {
10467 		if (wpas_ctrl_iface_mgmt_rx_process(wpa_s, buf + 16) < 0)
10468 			reply_len = -1;
10469 	} else if (os_strncmp(buf, "DRIVER_EVENT ", 13) == 0) {
10470 		if (wpas_ctrl_iface_driver_event(wpa_s, buf + 13) < 0)
10471 			reply_len = -1;
10472 	} else if (os_strncmp(buf, "EAPOL_RX ", 9) == 0) {
10473 		if (wpas_ctrl_iface_eapol_rx(wpa_s, buf + 9) < 0)
10474 			reply_len = -1;
10475 	} else if (os_strncmp(buf, "DATA_TEST_CONFIG ", 17) == 0) {
10476 		if (wpas_ctrl_iface_data_test_config(wpa_s, buf + 17) < 0)
10477 			reply_len = -1;
10478 	} else if (os_strncmp(buf, "DATA_TEST_TX ", 13) == 0) {
10479 		if (wpas_ctrl_iface_data_test_tx(wpa_s, buf + 13) < 0)
10480 			reply_len = -1;
10481 	} else if (os_strncmp(buf, "DATA_TEST_FRAME ", 16) == 0) {
10482 		if (wpas_ctrl_iface_data_test_frame(wpa_s, buf + 16) < 0)
10483 			reply_len = -1;
10484 	} else if (os_strncmp(buf, "TEST_ALLOC_FAIL ", 16) == 0) {
10485 		if (wpas_ctrl_test_alloc_fail(wpa_s, buf + 16) < 0)
10486 			reply_len = -1;
10487 	} else if (os_strcmp(buf, "GET_ALLOC_FAIL") == 0) {
10488 		reply_len = wpas_ctrl_get_alloc_fail(wpa_s, reply, reply_size);
10489 	} else if (os_strncmp(buf, "TEST_FAIL ", 10) == 0) {
10490 		if (wpas_ctrl_test_fail(wpa_s, buf + 10) < 0)
10491 			reply_len = -1;
10492 	} else if (os_strcmp(buf, "GET_FAIL") == 0) {
10493 		reply_len = wpas_ctrl_get_fail(wpa_s, reply, reply_size);
10494 	} else if (os_strncmp(buf, "EVENT_TEST ", 11) == 0) {
10495 		if (wpas_ctrl_event_test(wpa_s, buf + 11) < 0)
10496 			reply_len = -1;
10497 	} else if (os_strncmp(buf, "TEST_ASSOC_IE ", 14) == 0) {
10498 		if (wpas_ctrl_test_assoc_ie(wpa_s, buf + 14) < 0)
10499 			reply_len = -1;
10500 	} else if (os_strcmp(buf, "RESET_PN") == 0) {
10501 		if (wpas_ctrl_reset_pn(wpa_s) < 0)
10502 			reply_len = -1;
10503 	} else if (os_strncmp(buf, "KEY_REQUEST ", 12) == 0) {
10504 		if (wpas_ctrl_key_request(wpa_s, buf + 12) < 0)
10505 			reply_len = -1;
10506 	} else if (os_strcmp(buf, "RESEND_ASSOC") == 0) {
10507 		if (wpas_ctrl_resend_assoc(wpa_s) < 0)
10508 			reply_len = -1;
10509 #endif /* CONFIG_TESTING_OPTIONS */
10510 	} else if (os_strncmp(buf, "VENDOR_ELEM_ADD ", 16) == 0) {
10511 		if (wpas_ctrl_vendor_elem_add(wpa_s, buf + 16) < 0)
10512 			reply_len = -1;
10513 	} else if (os_strncmp(buf, "VENDOR_ELEM_GET ", 16) == 0) {
10514 		reply_len = wpas_ctrl_vendor_elem_get(wpa_s, buf + 16, reply,
10515 						      reply_size);
10516 	} else if (os_strncmp(buf, "VENDOR_ELEM_REMOVE ", 19) == 0) {
10517 		if (wpas_ctrl_vendor_elem_remove(wpa_s, buf + 19) < 0)
10518 			reply_len = -1;
10519 	} else if (os_strncmp(buf, "NEIGHBOR_REP_REQUEST", 20) == 0) {
10520 		if (wpas_ctrl_iface_send_neighbor_rep(wpa_s, buf + 20))
10521 			reply_len = -1;
10522 	} else if (os_strcmp(buf, "ERP_FLUSH") == 0) {
10523 		wpas_ctrl_iface_erp_flush(wpa_s);
10524 	} else if (os_strncmp(buf, "MAC_RAND_SCAN ", 14) == 0) {
10525 		if (wpas_ctrl_iface_mac_rand_scan(wpa_s, buf + 14))
10526 			reply_len = -1;
10527 	} else if (os_strncmp(buf, "GET_PREF_FREQ_LIST ", 19) == 0) {
10528 		reply_len = wpas_ctrl_iface_get_pref_freq_list(
10529 			wpa_s, buf + 19, reply, reply_size);
10530 #ifdef CONFIG_FILS
10531 	} else if (os_strncmp(buf, "FILS_HLP_REQ_ADD ", 17) == 0) {
10532 		if (wpas_ctrl_iface_fils_hlp_req_add(wpa_s, buf + 17))
10533 			reply_len = -1;
10534 	} else if (os_strcmp(buf, "FILS_HLP_REQ_FLUSH") == 0) {
10535 		wpas_flush_fils_hlp_req(wpa_s);
10536 #endif /* CONFIG_FILS */
10537 #ifdef CONFIG_DPP
10538 	} else if (os_strncmp(buf, "DPP_QR_CODE ", 12) == 0) {
10539 		int res;
10540 
10541 		res = wpas_dpp_qr_code(wpa_s, buf + 12);
10542 		if (res < 0) {
10543 			reply_len = -1;
10544 		} else {
10545 			reply_len = os_snprintf(reply, reply_size, "%d", res);
10546 			if (os_snprintf_error(reply_size, reply_len))
10547 				reply_len = -1;
10548 		}
10549 	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_GEN ", 18) == 0) {
10550 		int res;
10551 
10552 		res = wpas_dpp_bootstrap_gen(wpa_s, buf + 18);
10553 		if (res < 0) {
10554 			reply_len = -1;
10555 		} else {
10556 			reply_len = os_snprintf(reply, reply_size, "%d", res);
10557 			if (os_snprintf_error(reply_size, reply_len))
10558 				reply_len = -1;
10559 		}
10560 	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_REMOVE ", 21) == 0) {
10561 		if (wpas_dpp_bootstrap_remove(wpa_s, buf + 21) < 0)
10562 			reply_len = -1;
10563 	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_GET_URI ", 22) == 0) {
10564 		const char *uri;
10565 
10566 		uri = wpas_dpp_bootstrap_get_uri(wpa_s, atoi(buf + 22));
10567 		if (!uri) {
10568 			reply_len = -1;
10569 		} else {
10570 			reply_len = os_snprintf(reply, reply_size, "%s", uri);
10571 			if (os_snprintf_error(reply_size, reply_len))
10572 				reply_len = -1;
10573 		}
10574 	} else if (os_strncmp(buf, "DPP_BOOTSTRAP_INFO ", 19) == 0) {
10575 		reply_len = wpas_dpp_bootstrap_info(wpa_s, atoi(buf + 19),
10576 						    reply, reply_size);
10577 	} else if (os_strncmp(buf, "DPP_AUTH_INIT ", 14) == 0) {
10578 		if (wpas_dpp_auth_init(wpa_s, buf + 13) < 0)
10579 			reply_len = -1;
10580 	} else if (os_strncmp(buf, "DPP_LISTEN ", 11) == 0) {
10581 		if (wpas_dpp_listen(wpa_s, buf + 11) < 0)
10582 			reply_len = -1;
10583 	} else if (os_strcmp(buf, "DPP_STOP_LISTEN") == 0) {
10584 		wpas_dpp_stop(wpa_s);
10585 		wpas_dpp_listen_stop(wpa_s);
10586 	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_ADD", 20) == 0) {
10587 		int res;
10588 
10589 		res = wpas_dpp_configurator_add(wpa_s, buf + 20);
10590 		if (res < 0) {
10591 			reply_len = -1;
10592 		} else {
10593 			reply_len = os_snprintf(reply, reply_size, "%d", res);
10594 			if (os_snprintf_error(reply_size, reply_len))
10595 				reply_len = -1;
10596 		}
10597 	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_REMOVE ", 24) == 0) {
10598 		if (wpas_dpp_configurator_remove(wpa_s, buf + 24) < 0)
10599 			reply_len = -1;
10600 	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_SIGN ", 22) == 0) {
10601 		if (wpas_dpp_configurator_sign(wpa_s, buf + 22) < 0)
10602 			reply_len = -1;
10603 	} else if (os_strncmp(buf, "DPP_CONFIGURATOR_GET_KEY ", 25) == 0) {
10604 		reply_len = wpas_dpp_configurator_get_key(wpa_s, atoi(buf + 25),
10605 							  reply, reply_size);
10606 	} else if (os_strncmp(buf, "DPP_PKEX_ADD ", 13) == 0) {
10607 		int res;
10608 
10609 		res = wpas_dpp_pkex_add(wpa_s, buf + 12);
10610 		if (res < 0) {
10611 			reply_len = -1;
10612 		} else {
10613 			reply_len = os_snprintf(reply, reply_size, "%d", res);
10614 			if (os_snprintf_error(reply_size, reply_len))
10615 				reply_len = -1;
10616 		}
10617 	} else if (os_strncmp(buf, "DPP_PKEX_REMOVE ", 16) == 0) {
10618 		if (wpas_dpp_pkex_remove(wpa_s, buf + 16) < 0)
10619 			reply_len = -1;
10620 #endif /* CONFIG_DPP */
10621 	} else {
10622 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
10623 		reply_len = 16;
10624 	}
10625 
10626 	if (reply_len < 0) {
10627 		os_memcpy(reply, "FAIL\n", 5);
10628 		reply_len = 5;
10629 	}
10630 
10631 	*resp_len = reply_len;
10632 	return reply;
10633 }
10634 
10635 
10636 static int wpa_supplicant_global_iface_add(struct wpa_global *global,
10637 					   char *cmd)
10638 {
10639 	struct wpa_interface iface;
10640 	char *pos, *extra;
10641 	struct wpa_supplicant *wpa_s;
10642 	unsigned int create_iface = 0;
10643 	u8 mac_addr[ETH_ALEN];
10644 	enum wpa_driver_if_type type = WPA_IF_STATION;
10645 
10646 	/*
10647 	 * <ifname>TAB<confname>TAB<driver>TAB<ctrl_interface>TAB<driver_param>
10648 	 * TAB<bridge_ifname>[TAB<create>[TAB<interface_type>]]
10649 	 */
10650 	wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_ADD '%s'", cmd);
10651 
10652 	os_memset(&iface, 0, sizeof(iface));
10653 
10654 	do {
10655 		iface.ifname = pos = cmd;
10656 		pos = os_strchr(pos, '\t');
10657 		if (pos)
10658 			*pos++ = '\0';
10659 		if (iface.ifname[0] == '\0')
10660 			return -1;
10661 		if (pos == NULL)
10662 			break;
10663 
10664 		iface.confname = pos;
10665 		pos = os_strchr(pos, '\t');
10666 		if (pos)
10667 			*pos++ = '\0';
10668 		if (iface.confname[0] == '\0')
10669 			iface.confname = NULL;
10670 		if (pos == NULL)
10671 			break;
10672 
10673 		iface.driver = pos;
10674 		pos = os_strchr(pos, '\t');
10675 		if (pos)
10676 			*pos++ = '\0';
10677 		if (iface.driver[0] == '\0')
10678 			iface.driver = NULL;
10679 		if (pos == NULL)
10680 			break;
10681 
10682 		iface.ctrl_interface = pos;
10683 		pos = os_strchr(pos, '\t');
10684 		if (pos)
10685 			*pos++ = '\0';
10686 		if (iface.ctrl_interface[0] == '\0')
10687 			iface.ctrl_interface = NULL;
10688 		if (pos == NULL)
10689 			break;
10690 
10691 		iface.driver_param = pos;
10692 		pos = os_strchr(pos, '\t');
10693 		if (pos)
10694 			*pos++ = '\0';
10695 		if (iface.driver_param[0] == '\0')
10696 			iface.driver_param = NULL;
10697 		if (pos == NULL)
10698 			break;
10699 
10700 		iface.bridge_ifname = pos;
10701 		pos = os_strchr(pos, '\t');
10702 		if (pos)
10703 			*pos++ = '\0';
10704 		if (iface.bridge_ifname[0] == '\0')
10705 			iface.bridge_ifname = NULL;
10706 		if (pos == NULL)
10707 			break;
10708 
10709 		extra = pos;
10710 		pos = os_strchr(pos, '\t');
10711 		if (pos)
10712 			*pos++ = '\0';
10713 		if (!extra[0])
10714 			break;
10715 
10716 		if (os_strcmp(extra, "create") == 0) {
10717 			create_iface = 1;
10718 			if (!pos)
10719 				break;
10720 
10721 			if (os_strcmp(pos, "sta") == 0) {
10722 				type = WPA_IF_STATION;
10723 			} else if (os_strcmp(pos, "ap") == 0) {
10724 				type = WPA_IF_AP_BSS;
10725 			} else {
10726 				wpa_printf(MSG_DEBUG,
10727 					   "INTERFACE_ADD unsupported interface type: '%s'",
10728 					   pos);
10729 				return -1;
10730 			}
10731 		} else {
10732 			wpa_printf(MSG_DEBUG,
10733 				   "INTERFACE_ADD unsupported extra parameter: '%s'",
10734 				   extra);
10735 			return -1;
10736 		}
10737 	} while (0);
10738 
10739 	if (create_iface) {
10740 		wpa_printf(MSG_DEBUG, "CTRL_IFACE creating interface '%s'",
10741 			   iface.ifname);
10742 		if (!global->ifaces)
10743 			return -1;
10744 		if (wpa_drv_if_add(global->ifaces, type, iface.ifname,
10745 				   NULL, NULL, NULL, mac_addr, NULL) < 0) {
10746 			wpa_printf(MSG_ERROR,
10747 				   "CTRL_IFACE interface creation failed");
10748 			return -1;
10749 		}
10750 
10751 		wpa_printf(MSG_DEBUG,
10752 			   "CTRL_IFACE interface '%s' created with MAC addr: "
10753 			   MACSTR, iface.ifname, MAC2STR(mac_addr));
10754 	}
10755 
10756 	if (wpa_supplicant_get_iface(global, iface.ifname))
10757 		goto fail;
10758 
10759 	wpa_s = wpa_supplicant_add_iface(global, &iface, NULL);
10760 	if (!wpa_s)
10761 		goto fail;
10762 	wpa_s->added_vif = create_iface;
10763 	return 0;
10764 
10765 fail:
10766 	if (create_iface)
10767 		wpa_drv_if_remove(global->ifaces, WPA_IF_STATION, iface.ifname);
10768 	return -1;
10769 }
10770 
10771 
10772 static int wpa_supplicant_global_iface_remove(struct wpa_global *global,
10773 					      char *cmd)
10774 {
10775 	struct wpa_supplicant *wpa_s;
10776 	int ret;
10777 	unsigned int delete_iface;
10778 
10779 	wpa_printf(MSG_DEBUG, "CTRL_IFACE GLOBAL INTERFACE_REMOVE '%s'", cmd);
10780 
10781 	wpa_s = wpa_supplicant_get_iface(global, cmd);
10782 	if (wpa_s == NULL)
10783 		return -1;
10784 	delete_iface = wpa_s->added_vif;
10785 	ret = wpa_supplicant_remove_iface(global, wpa_s, 0);
10786 	if (!ret && delete_iface) {
10787 		wpa_printf(MSG_DEBUG, "CTRL_IFACE deleting the interface '%s'",
10788 			   cmd);
10789 		ret = wpa_drv_if_remove(global->ifaces, WPA_IF_STATION, cmd);
10790 	}
10791 	return ret;
10792 }
10793 
10794 
10795 static void wpa_free_iface_info(struct wpa_interface_info *iface)
10796 {
10797 	struct wpa_interface_info *prev;
10798 
10799 	while (iface) {
10800 		prev = iface;
10801 		iface = iface->next;
10802 
10803 		os_free(prev->ifname);
10804 		os_free(prev->desc);
10805 		os_free(prev);
10806 	}
10807 }
10808 
10809 
10810 static int wpa_supplicant_global_iface_list(struct wpa_global *global,
10811 					    char *buf, int len)
10812 {
10813 	int i, res;
10814 	struct wpa_interface_info *iface = NULL, *last = NULL, *tmp;
10815 	char *pos, *end;
10816 
10817 	for (i = 0; wpa_drivers[i]; i++) {
10818 		const struct wpa_driver_ops *drv = wpa_drivers[i];
10819 		if (drv->get_interfaces == NULL)
10820 			continue;
10821 		tmp = drv->get_interfaces(global->drv_priv[i]);
10822 		if (tmp == NULL)
10823 			continue;
10824 
10825 		if (last == NULL)
10826 			iface = last = tmp;
10827 		else
10828 			last->next = tmp;
10829 		while (last->next)
10830 			last = last->next;
10831 	}
10832 
10833 	pos = buf;
10834 	end = buf + len;
10835 	for (tmp = iface; tmp; tmp = tmp->next) {
10836 		res = os_snprintf(pos, end - pos, "%s\t%s\t%s\n",
10837 				  tmp->drv_name, tmp->ifname,
10838 				  tmp->desc ? tmp->desc : "");
10839 		if (os_snprintf_error(end - pos, res)) {
10840 			*pos = '\0';
10841 			break;
10842 		}
10843 		pos += res;
10844 	}
10845 
10846 	wpa_free_iface_info(iface);
10847 
10848 	return pos - buf;
10849 }
10850 
10851 
10852 static int wpa_supplicant_global_iface_interfaces(struct wpa_global *global,
10853 						  const char *input,
10854 						  char *buf, int len)
10855 {
10856 	int res;
10857 	char *pos, *end;
10858 	struct wpa_supplicant *wpa_s;
10859 	int show_ctrl = 0;
10860 
10861 	if (input)
10862 		show_ctrl = !!os_strstr(input, "ctrl");
10863 
10864 	wpa_s = global->ifaces;
10865 	pos = buf;
10866 	end = buf + len;
10867 
10868 	while (wpa_s) {
10869 		if (show_ctrl)
10870 			res = os_snprintf(pos, end - pos, "%s ctrl_iface=%s\n",
10871 					  wpa_s->ifname,
10872 					  wpa_s->conf->ctrl_interface ?
10873 					  wpa_s->conf->ctrl_interface : "N/A");
10874 		else
10875 			res = os_snprintf(pos, end - pos, "%s\n",
10876 					  wpa_s->ifname);
10877 
10878 		if (os_snprintf_error(end - pos, res)) {
10879 			*pos = '\0';
10880 			break;
10881 		}
10882 		pos += res;
10883 		wpa_s = wpa_s->next;
10884 	}
10885 	return pos - buf;
10886 }
10887 
10888 
10889 static char * wpas_global_ctrl_iface_ifname(struct wpa_global *global,
10890 					    const char *ifname,
10891 					    char *cmd, size_t *resp_len)
10892 {
10893 	struct wpa_supplicant *wpa_s;
10894 
10895 	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
10896 		if (os_strcmp(ifname, wpa_s->ifname) == 0)
10897 			break;
10898 	}
10899 
10900 	if (wpa_s == NULL) {
10901 		char *resp = os_strdup("FAIL-NO-IFNAME-MATCH\n");
10902 		if (resp)
10903 			*resp_len = os_strlen(resp);
10904 		else
10905 			*resp_len = 1;
10906 		return resp;
10907 	}
10908 
10909 	return wpa_supplicant_ctrl_iface_process(wpa_s, cmd, resp_len);
10910 }
10911 
10912 
10913 static char * wpas_global_ctrl_iface_redir_p2p(struct wpa_global *global,
10914 					       char *buf, size_t *resp_len)
10915 {
10916 #ifdef CONFIG_P2P
10917 	static const char * cmd[] = {
10918 		"LIST_NETWORKS",
10919 		"P2P_FIND",
10920 		"P2P_STOP_FIND",
10921 		"P2P_LISTEN",
10922 		"P2P_GROUP_ADD",
10923 		"P2P_GET_PASSPHRASE",
10924 		"P2P_SERVICE_UPDATE",
10925 		"P2P_SERVICE_FLUSH",
10926 		"P2P_FLUSH",
10927 		"P2P_CANCEL",
10928 		"P2P_PRESENCE_REQ",
10929 		"P2P_EXT_LISTEN",
10930 #ifdef CONFIG_AP
10931 		"STA-FIRST",
10932 #endif /* CONFIG_AP */
10933 		NULL
10934 	};
10935 	static const char * prefix[] = {
10936 #ifdef ANDROID
10937 		"DRIVER ",
10938 #endif /* ANDROID */
10939 		"GET_CAPABILITY ",
10940 		"GET_NETWORK ",
10941 		"REMOVE_NETWORK ",
10942 		"P2P_FIND ",
10943 		"P2P_CONNECT ",
10944 		"P2P_LISTEN ",
10945 		"P2P_GROUP_REMOVE ",
10946 		"P2P_GROUP_ADD ",
10947 		"P2P_GROUP_MEMBER ",
10948 		"P2P_PROV_DISC ",
10949 		"P2P_SERV_DISC_REQ ",
10950 		"P2P_SERV_DISC_CANCEL_REQ ",
10951 		"P2P_SERV_DISC_RESP ",
10952 		"P2P_SERV_DISC_EXTERNAL ",
10953 		"P2P_SERVICE_ADD ",
10954 		"P2P_SERVICE_DEL ",
10955 		"P2P_SERVICE_REP ",
10956 		"P2P_REJECT ",
10957 		"P2P_INVITE ",
10958 		"P2P_PEER ",
10959 		"P2P_SET ",
10960 		"P2P_UNAUTHORIZE ",
10961 		"P2P_PRESENCE_REQ ",
10962 		"P2P_EXT_LISTEN ",
10963 		"P2P_REMOVE_CLIENT ",
10964 		"WPS_NFC_TOKEN ",
10965 		"WPS_NFC_TAG_READ ",
10966 		"NFC_GET_HANDOVER_SEL ",
10967 		"NFC_GET_HANDOVER_REQ ",
10968 		"NFC_REPORT_HANDOVER ",
10969 		"P2P_ASP_PROVISION ",
10970 		"P2P_ASP_PROVISION_RESP ",
10971 #ifdef CONFIG_AP
10972 		"STA ",
10973 		"STA-NEXT ",
10974 #endif /* CONFIG_AP */
10975 		NULL
10976 	};
10977 	int found = 0;
10978 	int i;
10979 
10980 	if (global->p2p_init_wpa_s == NULL)
10981 		return NULL;
10982 
10983 	for (i = 0; !found && cmd[i]; i++) {
10984 		if (os_strcmp(buf, cmd[i]) == 0)
10985 			found = 1;
10986 	}
10987 
10988 	for (i = 0; !found && prefix[i]; i++) {
10989 		if (os_strncmp(buf, prefix[i], os_strlen(prefix[i])) == 0)
10990 			found = 1;
10991 	}
10992 
10993 	if (found)
10994 		return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
10995 							 buf, resp_len);
10996 #endif /* CONFIG_P2P */
10997 	return NULL;
10998 }
10999 
11000 
11001 static char * wpas_global_ctrl_iface_redir_wfd(struct wpa_global *global,
11002 					       char *buf, size_t *resp_len)
11003 {
11004 #ifdef CONFIG_WIFI_DISPLAY
11005 	if (global->p2p_init_wpa_s == NULL)
11006 		return NULL;
11007 	if (os_strncmp(buf, "WFD_SUBELEM_SET ", 16) == 0 ||
11008 	    os_strncmp(buf, "WFD_SUBELEM_GET ", 16) == 0)
11009 		return wpa_supplicant_ctrl_iface_process(global->p2p_init_wpa_s,
11010 							 buf, resp_len);
11011 #endif /* CONFIG_WIFI_DISPLAY */
11012 	return NULL;
11013 }
11014 
11015 
11016 static char * wpas_global_ctrl_iface_redir(struct wpa_global *global,
11017 					   char *buf, size_t *resp_len)
11018 {
11019 	char *ret;
11020 
11021 	ret = wpas_global_ctrl_iface_redir_p2p(global, buf, resp_len);
11022 	if (ret)
11023 		return ret;
11024 
11025 	ret = wpas_global_ctrl_iface_redir_wfd(global, buf, resp_len);
11026 	if (ret)
11027 		return ret;
11028 
11029 	return NULL;
11030 }
11031 
11032 
11033 static int wpas_global_ctrl_iface_set(struct wpa_global *global, char *cmd)
11034 {
11035 	char *value;
11036 
11037 	value = os_strchr(cmd, ' ');
11038 	if (value == NULL)
11039 		return -1;
11040 	*value++ = '\0';
11041 
11042 	wpa_printf(MSG_DEBUG, "GLOBAL_CTRL_IFACE SET '%s'='%s'", cmd, value);
11043 
11044 #ifdef CONFIG_WIFI_DISPLAY
11045 	if (os_strcasecmp(cmd, "wifi_display") == 0) {
11046 		wifi_display_enable(global, !!atoi(value));
11047 		return 0;
11048 	}
11049 #endif /* CONFIG_WIFI_DISPLAY */
11050 
11051 	/* Restore cmd to its original value to allow redirection */
11052 	value[-1] = ' ';
11053 
11054 	return -1;
11055 }
11056 
11057 
11058 static int wpas_global_ctrl_iface_dup_network(struct wpa_global *global,
11059 					      char *cmd)
11060 {
11061 	struct wpa_supplicant *wpa_s[2]; /* src, dst */
11062 	char *p;
11063 	unsigned int i;
11064 
11065 	/* cmd: "<src ifname> <dst ifname> <src network id> <dst network id>
11066 	 * <variable name> */
11067 
11068 	for (i = 0; i < ARRAY_SIZE(wpa_s) ; i++) {
11069 		p = os_strchr(cmd, ' ');
11070 		if (p == NULL)
11071 			return -1;
11072 		*p = '\0';
11073 
11074 		wpa_s[i] = global->ifaces;
11075 		for (; wpa_s[i]; wpa_s[i] = wpa_s[i]->next) {
11076 			if (os_strcmp(cmd, wpa_s[i]->ifname) == 0)
11077 				break;
11078 		}
11079 
11080 		if (!wpa_s[i]) {
11081 			wpa_printf(MSG_DEBUG,
11082 				   "CTRL_IFACE: Could not find iface=%s", cmd);
11083 			return -1;
11084 		}
11085 
11086 		cmd = p + 1;
11087 	}
11088 
11089 	return wpa_supplicant_ctrl_iface_dup_network(wpa_s[0], cmd, wpa_s[1]);
11090 }
11091 
11092 
11093 #ifndef CONFIG_NO_CONFIG_WRITE
11094 static int wpas_global_ctrl_iface_save_config(struct wpa_global *global)
11095 {
11096 	int ret = 0, saved = 0;
11097 	struct wpa_supplicant *wpa_s;
11098 
11099 	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
11100 		if (!wpa_s->conf->update_config) {
11101 			wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Not allowed to update configuration (update_config=0)");
11102 			continue;
11103 		}
11104 
11105 		if (wpa_config_write(wpa_s->confname, wpa_s->conf)) {
11106 			wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Failed to update configuration");
11107 			ret = 1;
11108 		} else {
11109 			wpa_dbg(wpa_s, MSG_DEBUG, "CTRL_IFACE: SAVE_CONFIG - Configuration updated");
11110 			saved++;
11111 		}
11112 	}
11113 
11114 	if (!saved && !ret) {
11115 		wpa_dbg(wpa_s, MSG_DEBUG,
11116 			"CTRL_IFACE: SAVE_CONFIG - No configuration files could be updated");
11117 		ret = 1;
11118 	}
11119 
11120 	return ret;
11121 }
11122 #endif /* CONFIG_NO_CONFIG_WRITE */
11123 
11124 
11125 static int wpas_global_ctrl_iface_status(struct wpa_global *global,
11126 					 char *buf, size_t buflen)
11127 {
11128 	char *pos, *end;
11129 	int ret;
11130 	struct wpa_supplicant *wpa_s;
11131 
11132 	pos = buf;
11133 	end = buf + buflen;
11134 
11135 #ifdef CONFIG_P2P
11136 	if (global->p2p && !global->p2p_disabled) {
11137 		ret = os_snprintf(pos, end - pos, "p2p_device_address=" MACSTR
11138 				  "\n"
11139 				  "p2p_state=%s\n",
11140 				  MAC2STR(global->p2p_dev_addr),
11141 				  p2p_get_state_txt(global->p2p));
11142 		if (os_snprintf_error(end - pos, ret))
11143 			return pos - buf;
11144 		pos += ret;
11145 	} else if (global->p2p) {
11146 		ret = os_snprintf(pos, end - pos, "p2p_state=DISABLED\n");
11147 		if (os_snprintf_error(end - pos, ret))
11148 			return pos - buf;
11149 		pos += ret;
11150 	}
11151 #endif /* CONFIG_P2P */
11152 
11153 #ifdef CONFIG_WIFI_DISPLAY
11154 	ret = os_snprintf(pos, end - pos, "wifi_display=%d\n",
11155 			  !!global->wifi_display);
11156 	if (os_snprintf_error(end - pos, ret))
11157 		return pos - buf;
11158 	pos += ret;
11159 #endif /* CONFIG_WIFI_DISPLAY */
11160 
11161 	for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
11162 		ret = os_snprintf(pos, end - pos, "ifname=%s\n"
11163 				  "address=" MACSTR "\n",
11164 				  wpa_s->ifname, MAC2STR(wpa_s->own_addr));
11165 		if (os_snprintf_error(end - pos, ret))
11166 			return pos - buf;
11167 		pos += ret;
11168 	}
11169 
11170 	return pos - buf;
11171 }
11172 
11173 
11174 #ifdef CONFIG_FST
11175 
11176 static int wpas_global_ctrl_iface_fst_attach(struct wpa_global *global,
11177 					     char *cmd, char *buf,
11178 					     size_t reply_size)
11179 {
11180 	char ifname[IFNAMSIZ + 1];
11181 	struct fst_iface_cfg cfg;
11182 	struct wpa_supplicant *wpa_s;
11183 	struct fst_wpa_obj iface_obj;
11184 
11185 	if (!fst_parse_attach_command(cmd, ifname, sizeof(ifname), &cfg)) {
11186 		wpa_s = wpa_supplicant_get_iface(global, ifname);
11187 		if (wpa_s) {
11188 			if (wpa_s->fst) {
11189 				wpa_printf(MSG_INFO, "FST: Already attached");
11190 				return -1;
11191 			}
11192 			fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
11193 			wpa_s->fst = fst_attach(ifname, wpa_s->own_addr,
11194 						&iface_obj, &cfg);
11195 			if (wpa_s->fst)
11196 				return os_snprintf(buf, reply_size, "OK\n");
11197 		}
11198 	}
11199 
11200 	return -1;
11201 }
11202 
11203 
11204 static int wpas_global_ctrl_iface_fst_detach(struct wpa_global *global,
11205 					     char *cmd, char *buf,
11206 					     size_t reply_size)
11207 {
11208 	char ifname[IFNAMSIZ + 1];
11209 	struct wpa_supplicant *wpa_s;
11210 
11211 	if (!fst_parse_detach_command(cmd, ifname, sizeof(ifname))) {
11212 		wpa_s = wpa_supplicant_get_iface(global, ifname);
11213 		if (wpa_s) {
11214 			if (!fst_iface_detach(ifname)) {
11215 				wpa_s->fst = NULL;
11216 				return os_snprintf(buf, reply_size, "OK\n");
11217 			}
11218 		}
11219 	}
11220 
11221 	return -1;
11222 }
11223 
11224 #endif /* CONFIG_FST */
11225 
11226 
11227 char * wpa_supplicant_global_ctrl_iface_process(struct wpa_global *global,
11228 						char *buf, size_t *resp_len)
11229 {
11230 	char *reply;
11231 	const int reply_size = 2048;
11232 	int reply_len;
11233 	int level = MSG_DEBUG;
11234 
11235 	if (os_strncmp(buf, "IFNAME=", 7) == 0) {
11236 		char *pos = os_strchr(buf + 7, ' ');
11237 		if (pos) {
11238 			*pos++ = '\0';
11239 			return wpas_global_ctrl_iface_ifname(global,
11240 							     buf + 7, pos,
11241 							     resp_len);
11242 		}
11243 	}
11244 
11245 	reply = wpas_global_ctrl_iface_redir(global, buf, resp_len);
11246 	if (reply)
11247 		return reply;
11248 
11249 	if (os_strcmp(buf, "PING") == 0)
11250 		level = MSG_EXCESSIVE;
11251 	wpa_hexdump_ascii(level, "RX global ctrl_iface",
11252 			  (const u8 *) buf, os_strlen(buf));
11253 
11254 	reply = os_malloc(reply_size);
11255 	if (reply == NULL) {
11256 		*resp_len = 1;
11257 		return NULL;
11258 	}
11259 
11260 	os_memcpy(reply, "OK\n", 3);
11261 	reply_len = 3;
11262 
11263 	if (os_strcmp(buf, "PING") == 0) {
11264 		os_memcpy(reply, "PONG\n", 5);
11265 		reply_len = 5;
11266 	} else if (os_strncmp(buf, "INTERFACE_ADD ", 14) == 0) {
11267 		if (wpa_supplicant_global_iface_add(global, buf + 14))
11268 			reply_len = -1;
11269 	} else if (os_strncmp(buf, "INTERFACE_REMOVE ", 17) == 0) {
11270 		if (wpa_supplicant_global_iface_remove(global, buf + 17))
11271 			reply_len = -1;
11272 	} else if (os_strcmp(buf, "INTERFACE_LIST") == 0) {
11273 		reply_len = wpa_supplicant_global_iface_list(
11274 			global, reply, reply_size);
11275 	} else if (os_strncmp(buf, "INTERFACES", 10) == 0) {
11276 		reply_len = wpa_supplicant_global_iface_interfaces(
11277 			global, buf + 10, reply, reply_size);
11278 #ifdef CONFIG_FST
11279 	} else if (os_strncmp(buf, "FST-ATTACH ", 11) == 0) {
11280 		reply_len = wpas_global_ctrl_iface_fst_attach(global, buf + 11,
11281 							      reply,
11282 							      reply_size);
11283 	} else if (os_strncmp(buf, "FST-DETACH ", 11) == 0) {
11284 		reply_len = wpas_global_ctrl_iface_fst_detach(global, buf + 11,
11285 							      reply,
11286 							      reply_size);
11287 	} else if (os_strncmp(buf, "FST-MANAGER ", 12) == 0) {
11288 		reply_len = fst_ctrl_iface_receive(buf + 12, reply, reply_size);
11289 #endif /* CONFIG_FST */
11290 	} else if (os_strcmp(buf, "TERMINATE") == 0) {
11291 		wpa_supplicant_terminate_proc(global);
11292 	} else if (os_strcmp(buf, "SUSPEND") == 0) {
11293 		wpas_notify_suspend(global);
11294 	} else if (os_strcmp(buf, "RESUME") == 0) {
11295 		wpas_notify_resume(global);
11296 	} else if (os_strncmp(buf, "SET ", 4) == 0) {
11297 		if (wpas_global_ctrl_iface_set(global, buf + 4)) {
11298 #ifdef CONFIG_P2P
11299 			if (global->p2p_init_wpa_s) {
11300 				os_free(reply);
11301 				/* Check if P2P redirection would work for this
11302 				 * command. */
11303 				return wpa_supplicant_ctrl_iface_process(
11304 					global->p2p_init_wpa_s,
11305 					buf, resp_len);
11306 			}
11307 #endif /* CONFIG_P2P */
11308 			reply_len = -1;
11309 		}
11310 	} else if (os_strncmp(buf, "DUP_NETWORK ", 12) == 0) {
11311 		if (wpas_global_ctrl_iface_dup_network(global, buf + 12))
11312 			reply_len = -1;
11313 #ifndef CONFIG_NO_CONFIG_WRITE
11314 	} else if (os_strcmp(buf, "SAVE_CONFIG") == 0) {
11315 		if (wpas_global_ctrl_iface_save_config(global))
11316 			reply_len = -1;
11317 #endif /* CONFIG_NO_CONFIG_WRITE */
11318 	} else if (os_strcmp(buf, "STATUS") == 0) {
11319 		reply_len = wpas_global_ctrl_iface_status(global, reply,
11320 							  reply_size);
11321 #ifdef CONFIG_MODULE_TESTS
11322 	} else if (os_strcmp(buf, "MODULE_TESTS") == 0) {
11323 		if (wpas_module_tests() < 0)
11324 			reply_len = -1;
11325 #endif /* CONFIG_MODULE_TESTS */
11326 	} else if (os_strncmp(buf, "RELOG", 5) == 0) {
11327 		if (wpa_debug_reopen_file() < 0)
11328 			reply_len = -1;
11329 	} else {
11330 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
11331 		reply_len = 16;
11332 	}
11333 
11334 	if (reply_len < 0) {
11335 		os_memcpy(reply, "FAIL\n", 5);
11336 		reply_len = 5;
11337 	}
11338 
11339 	*resp_len = reply_len;
11340 	return reply;
11341 }
11342