1 /*
2 * WPA Supplicant / privileged helper program
3 * Copyright (c) 2007-2009, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10 #ifdef __linux__
11 #include <fcntl.h>
12 #endif /* __linux__ */
13 #include <sys/un.h>
14 #include <sys/stat.h>
15
16 #include "common.h"
17 #include "eloop.h"
18 #include "common/version.h"
19 #include "drivers/driver.h"
20 #include "l2_packet/l2_packet.h"
21 #include "common/privsep_commands.h"
22 #include "common/ieee802_11_defs.h"
23
24 #define WPA_PRIV_MAX_L2 3
25
26 struct wpa_priv_interface {
27 struct wpa_priv_interface *next;
28 char *driver_name;
29 char *ifname;
30 char *sock_name;
31 int fd;
32
33 void *ctx;
34
35 const struct wpa_driver_ops *driver;
36 void *drv_priv;
37 void *drv_global_priv;
38 struct sockaddr_un drv_addr;
39 socklen_t drv_addr_len;
40 int wpas_registered;
41
42 struct l2_packet_data *l2[WPA_PRIV_MAX_L2];
43 struct sockaddr_un l2_addr[WPA_PRIV_MAX_L2];
44 socklen_t l2_addr_len[WPA_PRIV_MAX_L2];
45 struct wpa_priv_l2 {
46 struct wpa_priv_interface *parent;
47 int idx;
48 } l2_ctx[WPA_PRIV_MAX_L2];
49 };
50
51 struct wpa_priv_global {
52 struct wpa_priv_interface *interfaces;
53 };
54
55
wpa_priv_cmd_register(struct wpa_priv_interface * iface,struct sockaddr_un * from,socklen_t fromlen)56 static void wpa_priv_cmd_register(struct wpa_priv_interface *iface,
57 struct sockaddr_un *from, socklen_t fromlen)
58 {
59 int i;
60
61 if (iface->drv_priv) {
62 wpa_printf(MSG_DEBUG, "Cleaning up forgotten driver instance");
63 if (iface->driver->deinit)
64 iface->driver->deinit(iface->drv_priv);
65 iface->drv_priv = NULL;
66 if (iface->drv_global_priv) {
67 iface->driver->global_deinit(iface->drv_global_priv);
68 iface->drv_global_priv = NULL;
69 }
70 iface->wpas_registered = 0;
71 }
72
73 for (i = 0; i < WPA_PRIV_MAX_L2; i++) {
74 if (iface->l2[i]) {
75 wpa_printf(MSG_DEBUG,
76 "Cleaning up forgotten l2_packet instance");
77 l2_packet_deinit(iface->l2[i]);
78 iface->l2[i] = NULL;
79 }
80 }
81
82 if (iface->driver->init2) {
83 if (iface->driver->global_init) {
84 iface->drv_global_priv =
85 iface->driver->global_init(iface->ctx);
86 if (!iface->drv_global_priv) {
87 wpa_printf(MSG_INFO,
88 "Failed to initialize driver global context");
89 return;
90 }
91 } else {
92 iface->drv_global_priv = NULL;
93 }
94 iface->drv_priv = iface->driver->init2(iface, iface->ifname,
95 iface->drv_global_priv);
96 } else if (iface->driver->init) {
97 iface->drv_priv = iface->driver->init(iface, iface->ifname);
98 } else {
99 return;
100 }
101 if (iface->drv_priv == NULL) {
102 wpa_printf(MSG_DEBUG, "Failed to initialize driver wrapper");
103 return;
104 }
105
106 wpa_printf(MSG_DEBUG, "Driver wrapper '%s' initialized for interface "
107 "'%s'", iface->driver_name, iface->ifname);
108
109 os_memcpy(&iface->drv_addr, from, fromlen);
110 iface->drv_addr_len = fromlen;
111 iface->wpas_registered = 1;
112
113 if (iface->driver->set_param &&
114 iface->driver->set_param(iface->drv_priv, NULL) < 0) {
115 wpa_printf(MSG_ERROR, "Driver interface rejected param");
116 }
117 }
118
119
wpa_priv_cmd_unregister(struct wpa_priv_interface * iface,struct sockaddr_un * from)120 static void wpa_priv_cmd_unregister(struct wpa_priv_interface *iface,
121 struct sockaddr_un *from)
122 {
123 if (iface->drv_priv) {
124 if (iface->driver->deinit)
125 iface->driver->deinit(iface->drv_priv);
126 iface->drv_priv = NULL;
127 if (iface->drv_global_priv) {
128 iface->driver->global_deinit(iface->drv_global_priv);
129 iface->drv_global_priv = NULL;
130 }
131 iface->wpas_registered = 0;
132 }
133 }
134
135
wpa_priv_cmd_scan(struct wpa_priv_interface * iface,void * buf,size_t len)136 static void wpa_priv_cmd_scan(struct wpa_priv_interface *iface,
137 void *buf, size_t len)
138 {
139 struct wpa_driver_scan_params params;
140 struct privsep_cmd_scan *scan;
141 unsigned int i;
142 int freqs[PRIVSEP_MAX_SCAN_FREQS + 1];
143
144 if (iface->drv_priv == NULL)
145 return;
146
147 if (len < sizeof(*scan)) {
148 wpa_printf(MSG_DEBUG, "Invalid scan request");
149 return;
150 }
151
152 scan = buf;
153
154 os_memset(¶ms, 0, sizeof(params));
155 if (scan->num_ssids > WPAS_MAX_SCAN_SSIDS) {
156 wpa_printf(MSG_DEBUG, "Invalid scan request (num_ssids)");
157 return;
158 }
159 params.num_ssids = scan->num_ssids;
160 for (i = 0; i < scan->num_ssids; i++) {
161 params.ssids[i].ssid = scan->ssids[i];
162 params.ssids[i].ssid_len = scan->ssid_lens[i];
163 }
164
165 if (scan->num_freqs > PRIVSEP_MAX_SCAN_FREQS) {
166 wpa_printf(MSG_DEBUG, "Invalid scan request (num_freqs)");
167 return;
168 }
169 if (scan->num_freqs) {
170 for (i = 0; i < scan->num_freqs; i++)
171 freqs[i] = scan->freqs[i];
172 freqs[i] = 0;
173 params.freqs = freqs;
174 }
175
176 if (iface->driver->scan2)
177 iface->driver->scan2(iface->drv_priv, ¶ms);
178 }
179
180
wpa_priv_get_scan_results2(struct wpa_priv_interface * iface,struct sockaddr_un * from,socklen_t fromlen)181 static void wpa_priv_get_scan_results2(struct wpa_priv_interface *iface,
182 struct sockaddr_un *from,
183 socklen_t fromlen)
184 {
185 struct wpa_scan_results *res;
186 u8 *buf = NULL, *pos, *end;
187 int val;
188 size_t i;
189
190 if (iface->driver->get_scan_results)
191 res = iface->driver->get_scan_results(iface->drv_priv, NULL);
192 else
193 res = iface->driver->get_scan_results2(iface->drv_priv);
194 if (res == NULL)
195 goto fail;
196
197 buf = os_malloc(60000);
198 if (buf == NULL)
199 goto fail;
200 pos = buf;
201 end = buf + 60000;
202 val = res->num;
203 os_memcpy(pos, &val, sizeof(int));
204 pos += sizeof(int);
205
206 for (i = 0; i < res->num; i++) {
207 struct wpa_scan_res *r = res->res[i];
208 val = sizeof(*r) + r->ie_len + r->beacon_ie_len;
209 if (end - pos < (int) sizeof(int) + val)
210 break;
211 os_memcpy(pos, &val, sizeof(int));
212 pos += sizeof(int);
213 os_memcpy(pos, r, val);
214 pos += val;
215 }
216
217 sendto(iface->fd, buf, pos - buf, 0, (struct sockaddr *) from, fromlen);
218
219 os_free(buf);
220 wpa_scan_results_free(res);
221 return;
222
223 fail:
224 os_free(buf);
225 wpa_scan_results_free(res);
226 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, fromlen);
227 }
228
229
wpa_priv_cmd_get_scan_results(struct wpa_priv_interface * iface,struct sockaddr_un * from,socklen_t fromlen)230 static void wpa_priv_cmd_get_scan_results(struct wpa_priv_interface *iface,
231 struct sockaddr_un *from,
232 socklen_t fromlen)
233 {
234 if (iface->drv_priv == NULL)
235 return;
236
237 if (iface->driver->get_scan_results || iface->driver->get_scan_results2)
238 wpa_priv_get_scan_results2(iface, from, fromlen);
239 else
240 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, fromlen);
241 }
242
243
wpa_priv_cmd_authenticate(struct wpa_priv_interface * iface,void * buf,size_t len)244 static void wpa_priv_cmd_authenticate(struct wpa_priv_interface *iface,
245 void *buf, size_t len)
246 {
247 struct wpa_driver_auth_params params;
248 struct privsep_cmd_authenticate *auth;
249 int res, i;
250
251 if (iface->drv_priv == NULL || iface->driver->authenticate == NULL)
252 return;
253
254 if (len < sizeof(*auth)) {
255 wpa_printf(MSG_DEBUG, "Invalid authentication request");
256 return;
257 }
258
259 auth = buf;
260 if (sizeof(*auth) + auth->ie_len + auth->auth_data_len > len) {
261 wpa_printf(MSG_DEBUG, "Authentication request overflow");
262 return;
263 }
264
265 os_memset(¶ms, 0, sizeof(params));
266 params.freq = auth->freq;
267 params.bssid = auth->bssid;
268 params.ssid = auth->ssid;
269 if (auth->ssid_len > SSID_MAX_LEN)
270 return;
271 params.ssid_len = auth->ssid_len;
272 params.auth_alg = auth->auth_alg;
273 for (i = 0; i < 4; i++) {
274 if (auth->wep_key_len[i]) {
275 params.wep_key[i] = auth->wep_key[i];
276 params.wep_key_len[i] = auth->wep_key_len[i];
277 }
278 }
279 params.wep_tx_keyidx = auth->wep_tx_keyidx;
280 params.local_state_change = auth->local_state_change;
281 params.p2p = auth->p2p;
282 if (auth->ie_len) {
283 params.ie = (u8 *) (auth + 1);
284 params.ie_len = auth->ie_len;
285 }
286 if (auth->auth_data_len) {
287 params.auth_data = ((u8 *) (auth + 1)) + auth->ie_len;
288 params.auth_data_len = auth->auth_data_len;
289 }
290
291 res = iface->driver->authenticate(iface->drv_priv, ¶ms);
292 wpa_printf(MSG_DEBUG, "drv->authenticate: res=%d", res);
293 }
294
295
wpa_priv_cmd_associate(struct wpa_priv_interface * iface,void * buf,size_t len)296 static void wpa_priv_cmd_associate(struct wpa_priv_interface *iface,
297 void *buf, size_t len)
298 {
299 struct wpa_driver_associate_params params;
300 struct privsep_cmd_associate *assoc;
301 u8 *bssid;
302 int res;
303
304 if (iface->drv_priv == NULL || iface->driver->associate == NULL)
305 return;
306
307 if (len < sizeof(*assoc)) {
308 wpa_printf(MSG_DEBUG, "Invalid association request");
309 return;
310 }
311
312 assoc = buf;
313 if (sizeof(*assoc) + assoc->wpa_ie_len > len) {
314 wpa_printf(MSG_DEBUG, "Association request overflow");
315 return;
316 }
317
318 os_memset(¶ms, 0, sizeof(params));
319 bssid = assoc->bssid;
320 if (bssid[0] | bssid[1] | bssid[2] | bssid[3] | bssid[4] | bssid[5])
321 params.bssid = bssid;
322 params.ssid = assoc->ssid;
323 if (assoc->ssid_len > SSID_MAX_LEN)
324 return;
325 params.ssid_len = assoc->ssid_len;
326 params.freq.mode = assoc->hwmode;
327 params.freq.freq = assoc->freq;
328 params.freq.channel = assoc->channel;
329 if (assoc->wpa_ie_len) {
330 params.wpa_ie = (u8 *) (assoc + 1);
331 params.wpa_ie_len = assoc->wpa_ie_len;
332 }
333 params.pairwise_suite = assoc->pairwise_suite;
334 params.group_suite = assoc->group_suite;
335 params.key_mgmt_suite = assoc->key_mgmt_suite;
336 params.auth_alg = assoc->auth_alg;
337 params.mode = assoc->mode;
338
339 res = iface->driver->associate(iface->drv_priv, ¶ms);
340 wpa_printf(MSG_DEBUG, "drv->associate: res=%d", res);
341 }
342
343
wpa_priv_cmd_get_bssid(struct wpa_priv_interface * iface,struct sockaddr_un * from,socklen_t fromlen)344 static void wpa_priv_cmd_get_bssid(struct wpa_priv_interface *iface,
345 struct sockaddr_un *from, socklen_t fromlen)
346 {
347 u8 bssid[ETH_ALEN];
348
349 if (iface->drv_priv == NULL)
350 goto fail;
351
352 if (iface->driver->get_bssid == NULL ||
353 iface->driver->get_bssid(iface->drv_priv, bssid) < 0)
354 goto fail;
355
356 sendto(iface->fd, bssid, ETH_ALEN, 0, (struct sockaddr *) from,
357 fromlen);
358 return;
359
360 fail:
361 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, fromlen);
362 }
363
364
wpa_priv_cmd_get_ssid(struct wpa_priv_interface * iface,struct sockaddr_un * from,socklen_t fromlen)365 static void wpa_priv_cmd_get_ssid(struct wpa_priv_interface *iface,
366 struct sockaddr_un *from, socklen_t fromlen)
367 {
368 u8 ssid[sizeof(int) + SSID_MAX_LEN];
369 int res;
370
371 if (iface->drv_priv == NULL)
372 goto fail;
373
374 if (iface->driver->get_ssid == NULL)
375 goto fail;
376
377 os_memset(ssid, 0, sizeof(ssid));
378 res = iface->driver->get_ssid(iface->drv_priv, &ssid[sizeof(int)]);
379 if (res < 0 || res > SSID_MAX_LEN)
380 goto fail;
381 os_memcpy(ssid, &res, sizeof(int));
382
383 sendto(iface->fd, ssid, sizeof(ssid), 0, (struct sockaddr *) from,
384 fromlen);
385 return;
386
387 fail:
388 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, fromlen);
389 }
390
391
wpa_priv_cmd_set_key(struct wpa_priv_interface * iface,void * buf,size_t len)392 static void wpa_priv_cmd_set_key(struct wpa_priv_interface *iface,
393 void *buf, size_t len)
394 {
395 struct privsep_cmd_set_key *params;
396 int res;
397 struct wpa_driver_set_key_params p;
398
399 if (iface->drv_priv == NULL || iface->driver->set_key == NULL)
400 return;
401
402 if (len != sizeof(*params)) {
403 wpa_printf(MSG_DEBUG, "Invalid set_key request");
404 return;
405 }
406
407 params = buf;
408
409 os_memset(&p, 0, sizeof(p));
410 p.ifname = iface->ifname;
411 p.alg = params->alg;
412 p.addr = params->addr;
413 p.key_idx = params->key_idx;
414 p.set_tx = params->set_tx;
415 p.seq = params->seq_len ? params->seq : NULL;
416 p.seq_len = params->seq_len;
417 p.key = params->key_len ? params->key : NULL;
418 p.key_len = params->key_len;
419 p.key_flag = params->key_flag;
420 p.link_id = -1;
421
422 res = iface->driver->set_key(iface->drv_priv, &p);
423 wpa_printf(MSG_DEBUG, "drv->set_key: res=%d", res);
424 }
425
426
wpa_priv_cmd_get_capa(struct wpa_priv_interface * iface,struct sockaddr_un * from,socklen_t fromlen)427 static void wpa_priv_cmd_get_capa(struct wpa_priv_interface *iface,
428 struct sockaddr_un *from, socklen_t fromlen)
429 {
430 struct wpa_driver_capa capa;
431
432 if (iface->drv_priv == NULL)
433 goto fail;
434
435 if (iface->driver->get_capa == NULL ||
436 iface->driver->get_capa(iface->drv_priv, &capa) < 0)
437 goto fail;
438
439 /* For now, no support for passing extended_capa pointers */
440 capa.extended_capa = NULL;
441 capa.extended_capa_mask = NULL;
442 capa.extended_capa_len = 0;
443 sendto(iface->fd, &capa, sizeof(capa), 0, (struct sockaddr *) from,
444 fromlen);
445 return;
446
447 fail:
448 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, fromlen);
449 }
450
451
wpa_priv_l2_rx(void * ctx,const u8 * src_addr,const u8 * buf,size_t len)452 static void wpa_priv_l2_rx(void *ctx, const u8 *src_addr, const u8 *buf,
453 size_t len)
454 {
455 struct wpa_priv_l2 *l2_ctx = ctx;
456 struct wpa_priv_interface *iface = l2_ctx->parent;
457 struct msghdr msg;
458 struct iovec io[2];
459
460 io[0].iov_base = (u8 *) src_addr;
461 io[0].iov_len = ETH_ALEN;
462 io[1].iov_base = (u8 *) buf;
463 io[1].iov_len = len;
464
465 os_memset(&msg, 0, sizeof(msg));
466 msg.msg_iov = io;
467 msg.msg_iovlen = 2;
468 msg.msg_name = &iface->l2_addr[l2_ctx->idx];
469 msg.msg_namelen = iface->l2_addr_len[l2_ctx->idx];
470
471 if (sendmsg(iface->fd, &msg, 0) < 0) {
472 wpa_printf(MSG_ERROR, "sendmsg(l2 rx): %s", strerror(errno));
473 }
474 }
475
476
wpa_priv_allowed_l2_proto(u16 proto)477 static int wpa_priv_allowed_l2_proto(u16 proto)
478 {
479 return proto == ETH_P_EAPOL || proto == ETH_P_RSN_PREAUTH ||
480 proto == ETH_P_80211_ENCAP;
481 }
482
483
wpa_priv_cmd_l2_register(struct wpa_priv_interface * iface,struct sockaddr_un * from,socklen_t fromlen,void * buf,size_t len)484 static void wpa_priv_cmd_l2_register(struct wpa_priv_interface *iface,
485 struct sockaddr_un *from,
486 socklen_t fromlen,
487 void *buf, size_t len)
488 {
489 int *reg_cmd = buf;
490 u8 own_addr[ETH_ALEN];
491 int res;
492 u16 proto;
493 int idx;
494
495 if (len != 2 * sizeof(int)) {
496 wpa_printf(MSG_DEBUG, "Invalid l2_register length %lu",
497 (unsigned long) len);
498 return;
499 }
500
501 proto = reg_cmd[0];
502 if (!wpa_priv_allowed_l2_proto(proto)) {
503 wpa_printf(MSG_DEBUG, "Refused l2_packet connection for "
504 "ethertype 0x%x", proto);
505 return;
506 }
507
508 for (idx = 0; idx < WPA_PRIV_MAX_L2; idx++) {
509 if (!iface->l2[idx])
510 break;
511 }
512 if (idx == WPA_PRIV_MAX_L2) {
513 wpa_printf(MSG_DEBUG, "No free l2_packet connection found");
514 return;
515 }
516
517 os_memcpy(&iface->l2_addr[idx], from, fromlen);
518 iface->l2_addr_len[idx] = fromlen;
519
520 iface->l2_ctx[idx].idx = idx;
521 iface->l2_ctx[idx].parent = iface;
522 iface->l2[idx] = l2_packet_init(iface->ifname, NULL, proto,
523 wpa_priv_l2_rx, &iface->l2_ctx[idx],
524 reg_cmd[1]);
525 if (!iface->l2[idx]) {
526 wpa_printf(MSG_DEBUG, "Failed to initialize l2_packet "
527 "instance for protocol %d", proto);
528 return;
529 }
530
531 if (l2_packet_get_own_addr(iface->l2[idx], own_addr) < 0) {
532 wpa_printf(MSG_DEBUG, "Failed to get own address from "
533 "l2_packet");
534 l2_packet_deinit(iface->l2[idx]);
535 iface->l2[idx] = NULL;
536 return;
537 }
538
539 res = sendto(iface->fd, own_addr, ETH_ALEN, 0,
540 (struct sockaddr *) from, fromlen);
541 wpa_printf(MSG_DEBUG, "L2 registration[idx=%d]: res=%d", idx, res);
542 }
543
544
wpa_priv_cmd_l2_unregister(struct wpa_priv_interface * iface,struct sockaddr_un * from,socklen_t fromlen)545 static void wpa_priv_cmd_l2_unregister(struct wpa_priv_interface *iface,
546 struct sockaddr_un *from,
547 socklen_t fromlen)
548 {
549 int idx;
550
551 for (idx = 0; idx < WPA_PRIV_MAX_L2; idx++) {
552 if (iface->l2_addr_len[idx] == fromlen &&
553 os_memcmp(&iface->l2_addr[idx], from, fromlen) == 0)
554 break;
555 }
556 if (idx == WPA_PRIV_MAX_L2) {
557 wpa_printf(MSG_DEBUG,
558 "No registered l2_packet socket found for unregister request");
559 return;
560 }
561
562 if (iface->l2[idx]) {
563 l2_packet_deinit(iface->l2[idx]);
564 iface->l2[idx] = NULL;
565 }
566 }
567
568
wpa_priv_cmd_l2_notify_auth_start(struct wpa_priv_interface * iface,struct sockaddr_un * from)569 static void wpa_priv_cmd_l2_notify_auth_start(struct wpa_priv_interface *iface,
570 struct sockaddr_un *from)
571 {
572 int idx;
573
574 for (idx = 0; idx < WPA_PRIV_MAX_L2; idx++) {
575 if (iface->l2[idx])
576 l2_packet_notify_auth_start(iface->l2[idx]);
577 }
578 }
579
580
wpa_priv_cmd_l2_send(struct wpa_priv_interface * iface,struct sockaddr_un * from,socklen_t fromlen,void * buf,size_t len)581 static void wpa_priv_cmd_l2_send(struct wpa_priv_interface *iface,
582 struct sockaddr_un *from, socklen_t fromlen,
583 void *buf, size_t len)
584 {
585 u8 *dst_addr;
586 u16 proto;
587 int res;
588 int idx;
589
590 for (idx = 0; idx < WPA_PRIV_MAX_L2; idx++) {
591 if (iface->l2_addr_len[idx] == fromlen &&
592 os_memcmp(&iface->l2_addr[idx], from, fromlen) == 0)
593 break;
594 }
595 if (idx == WPA_PRIV_MAX_L2) {
596 wpa_printf(MSG_DEBUG,
597 "No registered l2_packet socket found for send request");
598 return;
599 }
600
601 if (iface->l2[idx] == NULL)
602 return;
603
604 if (len < ETH_ALEN + 2) {
605 wpa_printf(MSG_DEBUG, "Too short L2 send packet (len=%lu)",
606 (unsigned long) len);
607 return;
608 }
609
610 dst_addr = buf;
611 os_memcpy(&proto, (char *) buf + ETH_ALEN, 2);
612
613 if (!wpa_priv_allowed_l2_proto(proto)) {
614 wpa_printf(MSG_DEBUG, "Refused l2_packet send for ethertype "
615 "0x%x", proto);
616 return;
617 }
618
619 res = l2_packet_send(iface->l2[idx], dst_addr, proto,
620 (unsigned char *) buf + ETH_ALEN + 2,
621 len - ETH_ALEN - 2);
622 wpa_printf(MSG_DEBUG, "L2 send[idx=%d]: res=%d", idx, res);
623 }
624
625
wpa_priv_cmd_set_country(struct wpa_priv_interface * iface,char * buf)626 static void wpa_priv_cmd_set_country(struct wpa_priv_interface *iface,
627 char *buf)
628 {
629 if (iface->drv_priv == NULL || iface->driver->set_country == NULL ||
630 *buf == '\0')
631 return;
632
633 iface->driver->set_country(iface->drv_priv, buf);
634 }
635
636
wpa_priv_receive(int sock,void * eloop_ctx,void * sock_ctx)637 static void wpa_priv_receive(int sock, void *eloop_ctx, void *sock_ctx)
638 {
639 struct wpa_priv_interface *iface = eloop_ctx;
640 char buf[2000], *pos;
641 void *cmd_buf;
642 size_t cmd_len;
643 int res, cmd;
644 struct sockaddr_un from;
645 socklen_t fromlen = sizeof(from);
646
647 res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &from,
648 &fromlen);
649 if (res < 0) {
650 wpa_printf(MSG_ERROR, "recvfrom: %s", strerror(errno));
651 return;
652 }
653
654 if (res < (int) sizeof(int)) {
655 wpa_printf(MSG_DEBUG, "Too short command (len=%d)", res);
656 return;
657 }
658
659 os_memcpy(&cmd, buf, sizeof(int));
660 wpa_printf(MSG_DEBUG, "Command %d for interface %s",
661 cmd, iface->ifname);
662 cmd_buf = &buf[sizeof(int)];
663 cmd_len = res - sizeof(int);
664
665 switch (cmd) {
666 case PRIVSEP_CMD_REGISTER:
667 wpa_priv_cmd_register(iface, &from, fromlen);
668 break;
669 case PRIVSEP_CMD_UNREGISTER:
670 wpa_priv_cmd_unregister(iface, &from);
671 break;
672 case PRIVSEP_CMD_SCAN:
673 wpa_priv_cmd_scan(iface, cmd_buf, cmd_len);
674 break;
675 case PRIVSEP_CMD_GET_SCAN_RESULTS:
676 wpa_priv_cmd_get_scan_results(iface, &from, fromlen);
677 break;
678 case PRIVSEP_CMD_ASSOCIATE:
679 wpa_priv_cmd_associate(iface, cmd_buf, cmd_len);
680 break;
681 case PRIVSEP_CMD_GET_BSSID:
682 wpa_priv_cmd_get_bssid(iface, &from, fromlen);
683 break;
684 case PRIVSEP_CMD_GET_SSID:
685 wpa_priv_cmd_get_ssid(iface, &from, fromlen);
686 break;
687 case PRIVSEP_CMD_SET_KEY:
688 wpa_priv_cmd_set_key(iface, cmd_buf, cmd_len);
689 break;
690 case PRIVSEP_CMD_GET_CAPA:
691 wpa_priv_cmd_get_capa(iface, &from, fromlen);
692 break;
693 case PRIVSEP_CMD_L2_REGISTER:
694 wpa_priv_cmd_l2_register(iface, &from, fromlen,
695 cmd_buf, cmd_len);
696 break;
697 case PRIVSEP_CMD_L2_UNREGISTER:
698 wpa_priv_cmd_l2_unregister(iface, &from, fromlen);
699 break;
700 case PRIVSEP_CMD_L2_NOTIFY_AUTH_START:
701 wpa_priv_cmd_l2_notify_auth_start(iface, &from);
702 break;
703 case PRIVSEP_CMD_L2_SEND:
704 wpa_priv_cmd_l2_send(iface, &from, fromlen, cmd_buf, cmd_len);
705 break;
706 case PRIVSEP_CMD_SET_COUNTRY:
707 pos = cmd_buf;
708 if (pos + cmd_len >= buf + sizeof(buf))
709 break;
710 pos[cmd_len] = '\0';
711 wpa_priv_cmd_set_country(iface, pos);
712 break;
713 case PRIVSEP_CMD_AUTHENTICATE:
714 wpa_priv_cmd_authenticate(iface, cmd_buf, cmd_len);
715 break;
716 }
717 }
718
719
wpa_priv_interface_deinit(struct wpa_priv_interface * iface)720 static void wpa_priv_interface_deinit(struct wpa_priv_interface *iface)
721 {
722 int i;
723
724 if (iface->drv_priv) {
725 if (iface->driver->deinit)
726 iface->driver->deinit(iface->drv_priv);
727 if (iface->drv_global_priv)
728 iface->driver->global_deinit(iface->drv_global_priv);
729 }
730
731 if (iface->fd >= 0) {
732 eloop_unregister_read_sock(iface->fd);
733 close(iface->fd);
734 unlink(iface->sock_name);
735 }
736
737 for (i = 0; i < WPA_PRIV_MAX_L2; i++) {
738 if (iface->l2[i])
739 l2_packet_deinit(iface->l2[i]);
740 }
741
742 os_free(iface->ifname);
743 os_free(iface->driver_name);
744 os_free(iface->sock_name);
745 os_free(iface);
746 }
747
748
749 static struct wpa_priv_interface *
wpa_priv_interface_init(void * ctx,const char * dir,const char * params)750 wpa_priv_interface_init(void *ctx, const char *dir, const char *params)
751 {
752 struct wpa_priv_interface *iface;
753 char *pos;
754 size_t len;
755 struct sockaddr_un addr;
756 int i;
757
758 pos = os_strchr(params, ':');
759 if (pos == NULL)
760 return NULL;
761
762 iface = os_zalloc(sizeof(*iface));
763 if (iface == NULL)
764 return NULL;
765 iface->fd = -1;
766 iface->ctx = ctx;
767
768 len = pos - params;
769 iface->driver_name = dup_binstr(params, len);
770 if (iface->driver_name == NULL) {
771 wpa_priv_interface_deinit(iface);
772 return NULL;
773 }
774
775 for (i = 0; wpa_drivers[i]; i++) {
776 if (os_strcmp(iface->driver_name,
777 wpa_drivers[i]->name) == 0) {
778 iface->driver = wpa_drivers[i];
779 break;
780 }
781 }
782 if (iface->driver == NULL) {
783 wpa_printf(MSG_ERROR, "Unsupported driver '%s'",
784 iface->driver_name);
785 wpa_priv_interface_deinit(iface);
786 return NULL;
787 }
788
789 pos++;
790 iface->ifname = os_strdup(pos);
791 if (iface->ifname == NULL) {
792 wpa_priv_interface_deinit(iface);
793 return NULL;
794 }
795
796 len = os_strlen(dir) + 1 + os_strlen(iface->ifname);
797 iface->sock_name = os_malloc(len + 1);
798 if (iface->sock_name == NULL) {
799 wpa_priv_interface_deinit(iface);
800 return NULL;
801 }
802
803 os_snprintf(iface->sock_name, len + 1, "%s/%s", dir, iface->ifname);
804 if (os_strlen(iface->sock_name) >= sizeof(addr.sun_path)) {
805 wpa_priv_interface_deinit(iface);
806 return NULL;
807 }
808
809 iface->fd = socket(PF_UNIX, SOCK_DGRAM, 0);
810 if (iface->fd < 0) {
811 wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno));
812 wpa_priv_interface_deinit(iface);
813 return NULL;
814 }
815
816 os_memset(&addr, 0, sizeof(addr));
817 addr.sun_family = AF_UNIX;
818 os_strlcpy(addr.sun_path, iface->sock_name, sizeof(addr.sun_path));
819
820 if (bind(iface->fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
821 wpa_printf(MSG_DEBUG, "bind(PF_UNIX) failed: %s",
822 strerror(errno));
823 if (connect(iface->fd, (struct sockaddr *) &addr,
824 sizeof(addr)) < 0) {
825 wpa_printf(MSG_DEBUG, "Socket exists, but does not "
826 "allow connections - assuming it was "
827 "leftover from forced program termination");
828 if (unlink(iface->sock_name) < 0) {
829 wpa_printf(MSG_ERROR,
830 "Could not unlink existing ctrl_iface socket '%s': %s",
831 iface->sock_name, strerror(errno));
832 goto fail;
833 }
834 if (bind(iface->fd, (struct sockaddr *) &addr,
835 sizeof(addr)) < 0) {
836 wpa_printf(MSG_ERROR,
837 "wpa-priv-iface-init: bind(PF_UNIX): %s",
838 strerror(errno));
839 goto fail;
840 }
841 wpa_printf(MSG_DEBUG, "Successfully replaced leftover "
842 "socket '%s'", iface->sock_name);
843 } else {
844 wpa_printf(MSG_INFO, "Socket exists and seems to be "
845 "in use - cannot override it");
846 wpa_printf(MSG_INFO, "Delete '%s' manually if it is "
847 "not used anymore", iface->sock_name);
848 goto fail;
849 }
850 }
851
852 if (chmod(iface->sock_name, S_IRWXU | S_IRWXG | S_IRWXO) < 0) {
853 wpa_printf(MSG_ERROR, "chmod: %s", strerror(errno));
854 goto fail;
855 }
856
857 eloop_register_read_sock(iface->fd, wpa_priv_receive, iface, NULL);
858
859 return iface;
860
861 fail:
862 wpa_priv_interface_deinit(iface);
863 return NULL;
864 }
865
866
wpa_priv_send_event(struct wpa_priv_interface * iface,int event,const void * data,size_t data_len)867 static int wpa_priv_send_event(struct wpa_priv_interface *iface, int event,
868 const void *data, size_t data_len)
869 {
870 struct msghdr msg;
871 struct iovec io[2];
872
873 io[0].iov_base = &event;
874 io[0].iov_len = sizeof(event);
875 io[1].iov_base = (u8 *) data;
876 io[1].iov_len = data_len;
877
878 os_memset(&msg, 0, sizeof(msg));
879 msg.msg_iov = io;
880 msg.msg_iovlen = data ? 2 : 1;
881 msg.msg_name = &iface->drv_addr;
882 msg.msg_namelen = iface->drv_addr_len;
883
884 if (sendmsg(iface->fd, &msg, 0) < 0) {
885 wpa_printf(MSG_ERROR, "sendmsg(wpas_socket): %s",
886 strerror(errno));
887 return -1;
888 }
889
890 return 0;
891 }
892
893
wpa_priv_send_auth(struct wpa_priv_interface * iface,union wpa_event_data * data)894 static void wpa_priv_send_auth(struct wpa_priv_interface *iface,
895 union wpa_event_data *data)
896 {
897 size_t buflen = sizeof(struct privsep_event_auth) + data->auth.ies_len;
898 struct privsep_event_auth *auth;
899 u8 *buf, *pos;
900
901 buf = os_zalloc(buflen);
902 if (buf == NULL)
903 return;
904
905 auth = (struct privsep_event_auth *) buf;
906 pos = (u8 *) (auth + 1);
907
908 os_memcpy(auth->peer, data->auth.peer, ETH_ALEN);
909 os_memcpy(auth->bssid, data->auth.bssid, ETH_ALEN);
910 auth->auth_type = data->auth.auth_type;
911 auth->auth_transaction = data->auth.auth_transaction;
912 auth->status_code = data->auth.status_code;
913 if (data->auth.ies) {
914 os_memcpy(pos, data->auth.ies, data->auth.ies_len);
915 auth->ies_len = data->auth.ies_len;
916 }
917
918 wpa_priv_send_event(iface, PRIVSEP_EVENT_AUTH, buf, buflen);
919
920 os_free(buf);
921 }
922
923
wpa_priv_send_assoc(struct wpa_priv_interface * iface,int event,union wpa_event_data * data)924 static void wpa_priv_send_assoc(struct wpa_priv_interface *iface, int event,
925 union wpa_event_data *data)
926 {
927 size_t buflen = 3 * sizeof(int);
928 u8 *buf, *pos;
929 int len;
930
931 if (data) {
932 buflen += data->assoc_info.req_ies_len +
933 data->assoc_info.resp_ies_len +
934 data->assoc_info.beacon_ies_len;
935 }
936
937 buf = os_malloc(buflen);
938 if (buf == NULL)
939 return;
940
941 pos = buf;
942
943 if (data && data->assoc_info.req_ies) {
944 len = data->assoc_info.req_ies_len;
945 os_memcpy(pos, &len, sizeof(int));
946 pos += sizeof(int);
947 os_memcpy(pos, data->assoc_info.req_ies, len);
948 pos += len;
949 } else {
950 len = 0;
951 os_memcpy(pos, &len, sizeof(int));
952 pos += sizeof(int);
953 }
954
955 if (data && data->assoc_info.resp_ies) {
956 len = data->assoc_info.resp_ies_len;
957 os_memcpy(pos, &len, sizeof(int));
958 pos += sizeof(int);
959 os_memcpy(pos, data->assoc_info.resp_ies, len);
960 pos += len;
961 } else {
962 len = 0;
963 os_memcpy(pos, &len, sizeof(int));
964 pos += sizeof(int);
965 }
966
967 if (data && data->assoc_info.beacon_ies) {
968 len = data->assoc_info.beacon_ies_len;
969 os_memcpy(pos, &len, sizeof(int));
970 pos += sizeof(int);
971 os_memcpy(pos, data->assoc_info.beacon_ies, len);
972 pos += len;
973 } else {
974 len = 0;
975 os_memcpy(pos, &len, sizeof(int));
976 pos += sizeof(int);
977 }
978
979 wpa_priv_send_event(iface, event, buf, buflen);
980
981 os_free(buf);
982 }
983
984
wpa_priv_send_interface_status(struct wpa_priv_interface * iface,union wpa_event_data * data)985 static void wpa_priv_send_interface_status(struct wpa_priv_interface *iface,
986 union wpa_event_data *data)
987 {
988 int ievent;
989 size_t len, maxlen;
990 u8 *buf;
991 char *ifname;
992
993 if (data == NULL)
994 return;
995
996 ievent = data->interface_status.ievent;
997 maxlen = sizeof(data->interface_status.ifname);
998 ifname = data->interface_status.ifname;
999 for (len = 0; len < maxlen && ifname[len]; len++)
1000 ;
1001
1002 buf = os_malloc(sizeof(int) + len);
1003 if (buf == NULL)
1004 return;
1005
1006 os_memcpy(buf, &ievent, sizeof(int));
1007 os_memcpy(buf + sizeof(int), ifname, len);
1008
1009 wpa_priv_send_event(iface, PRIVSEP_EVENT_INTERFACE_STATUS,
1010 buf, sizeof(int) + len);
1011
1012 os_free(buf);
1013
1014 }
1015
1016
wpa_priv_send_ft_response(struct wpa_priv_interface * iface,union wpa_event_data * data)1017 static void wpa_priv_send_ft_response(struct wpa_priv_interface *iface,
1018 union wpa_event_data *data)
1019 {
1020 size_t len;
1021 u8 *buf, *pos;
1022
1023 if (data == NULL || data->ft_ies.ies == NULL)
1024 return;
1025
1026 len = sizeof(int) + ETH_ALEN + data->ft_ies.ies_len;
1027 buf = os_malloc(len);
1028 if (buf == NULL)
1029 return;
1030
1031 pos = buf;
1032 os_memcpy(pos, &data->ft_ies.ft_action, sizeof(int));
1033 pos += sizeof(int);
1034 os_memcpy(pos, data->ft_ies.target_ap, ETH_ALEN);
1035 pos += ETH_ALEN;
1036 os_memcpy(pos, data->ft_ies.ies, data->ft_ies.ies_len);
1037
1038 wpa_priv_send_event(iface, PRIVSEP_EVENT_FT_RESPONSE, buf, len);
1039
1040 os_free(buf);
1041
1042 }
1043
1044
wpa_supplicant_event(void * ctx,enum wpa_event_type event,union wpa_event_data * data)1045 void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
1046 union wpa_event_data *data)
1047 {
1048 struct wpa_priv_interface *iface = ctx;
1049
1050 wpa_printf(MSG_DEBUG, "%s - event=%d", __func__, event);
1051
1052 if (!iface->wpas_registered) {
1053 wpa_printf(MSG_DEBUG, "Driver event received, but "
1054 "wpa_supplicant not registered");
1055 return;
1056 }
1057
1058 switch (event) {
1059 case EVENT_ASSOC:
1060 wpa_priv_send_assoc(iface, PRIVSEP_EVENT_ASSOC, data);
1061 break;
1062 case EVENT_DISASSOC:
1063 wpa_priv_send_event(iface, PRIVSEP_EVENT_DISASSOC, NULL, 0);
1064 break;
1065 case EVENT_ASSOCINFO:
1066 if (data == NULL)
1067 return;
1068 wpa_priv_send_assoc(iface, PRIVSEP_EVENT_ASSOCINFO, data);
1069 break;
1070 case EVENT_MICHAEL_MIC_FAILURE:
1071 if (data == NULL)
1072 return;
1073 wpa_priv_send_event(iface, PRIVSEP_EVENT_MICHAEL_MIC_FAILURE,
1074 &data->michael_mic_failure.unicast,
1075 sizeof(int));
1076 break;
1077 case EVENT_SCAN_STARTED:
1078 wpa_priv_send_event(iface, PRIVSEP_EVENT_SCAN_STARTED, NULL,
1079 0);
1080 break;
1081 case EVENT_SCAN_RESULTS:
1082 wpa_priv_send_event(iface, PRIVSEP_EVENT_SCAN_RESULTS, NULL,
1083 0);
1084 break;
1085 case EVENT_INTERFACE_STATUS:
1086 wpa_priv_send_interface_status(iface, data);
1087 break;
1088 case EVENT_PMKID_CANDIDATE:
1089 if (data == NULL)
1090 return;
1091 wpa_priv_send_event(iface, PRIVSEP_EVENT_PMKID_CANDIDATE,
1092 &data->pmkid_candidate,
1093 sizeof(struct pmkid_candidate));
1094 break;
1095 case EVENT_FT_RESPONSE:
1096 wpa_priv_send_ft_response(iface, data);
1097 break;
1098 case EVENT_AUTH:
1099 wpa_priv_send_auth(iface, data);
1100 break;
1101 default:
1102 wpa_printf(MSG_DEBUG, "Unsupported driver event %d (%s) - TODO",
1103 event, event_to_string(event));
1104 break;
1105 }
1106 }
1107
1108
wpa_supplicant_event_global(void * ctx,enum wpa_event_type event,union wpa_event_data * data)1109 void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
1110 union wpa_event_data *data)
1111 {
1112 struct wpa_priv_global *global = ctx;
1113 struct wpa_priv_interface *iface;
1114
1115 if (event != EVENT_INTERFACE_STATUS)
1116 return;
1117
1118 for (iface = global->interfaces; iface; iface = iface->next) {
1119 if (os_strcmp(iface->ifname, data->interface_status.ifname) ==
1120 0)
1121 break;
1122 }
1123 if (iface && iface->driver->get_ifindex) {
1124 unsigned int ifindex;
1125
1126 ifindex = iface->driver->get_ifindex(iface->drv_priv);
1127 if (ifindex != data->interface_status.ifindex) {
1128 wpa_printf(MSG_DEBUG,
1129 "%s: interface status ifindex %d mismatch (%d)",
1130 iface->ifname, ifindex,
1131 data->interface_status.ifindex);
1132 return;
1133 }
1134 }
1135 if (iface)
1136 wpa_supplicant_event(iface, event, data);
1137 }
1138
1139
wpa_supplicant_rx_eapol(void * ctx,const u8 * src_addr,const u8 * buf,size_t len,enum frame_encryption encrypted)1140 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
1141 const u8 *buf, size_t len,
1142 enum frame_encryption encrypted)
1143 {
1144 struct wpa_priv_interface *iface = ctx;
1145 struct msghdr msg;
1146 struct iovec io[3];
1147 int event = PRIVSEP_EVENT_RX_EAPOL;
1148
1149 wpa_printf(MSG_DEBUG, "RX EAPOL from driver");
1150 io[0].iov_base = &event;
1151 io[0].iov_len = sizeof(event);
1152 io[1].iov_base = (u8 *) src_addr;
1153 io[1].iov_len = ETH_ALEN;
1154 io[2].iov_base = (u8 *) buf;
1155 io[2].iov_len = len;
1156
1157 os_memset(&msg, 0, sizeof(msg));
1158 msg.msg_iov = io;
1159 msg.msg_iovlen = 3;
1160 msg.msg_name = &iface->drv_addr;
1161 msg.msg_namelen = iface->drv_addr_len;
1162
1163 if (sendmsg(iface->fd, &msg, 0) < 0)
1164 wpa_printf(MSG_ERROR, "sendmsg(wpas_socket): %s",
1165 strerror(errno));
1166 }
1167
1168
wpa_priv_terminate(int sig,void * signal_ctx)1169 static void wpa_priv_terminate(int sig, void *signal_ctx)
1170 {
1171 wpa_printf(MSG_DEBUG, "wpa_priv termination requested");
1172 eloop_terminate();
1173 }
1174
1175
wpa_priv_fd_workaround(void)1176 static void wpa_priv_fd_workaround(void)
1177 {
1178 #ifdef __linux__
1179 int s, i;
1180 /* When started from pcmcia-cs scripts, wpa_supplicant might start with
1181 * fd 0, 1, and 2 closed. This will cause some issues because many
1182 * places in wpa_supplicant are still printing out to stdout. As a
1183 * workaround, make sure that fd's 0, 1, and 2 are not used for other
1184 * sockets. */
1185 for (i = 0; i < 3; i++) {
1186 s = open("/dev/null", O_RDWR);
1187 if (s > 2) {
1188 close(s);
1189 break;
1190 }
1191 }
1192 #endif /* __linux__ */
1193 }
1194
1195
usage(void)1196 static void usage(void)
1197 {
1198 printf("wpa_priv v%s\n"
1199 "Copyright (c) 2007-2017, Jouni Malinen <j@w1.fi> and "
1200 "contributors\n"
1201 "\n"
1202 "usage:\n"
1203 " wpa_priv [-Bdd] [-c<ctrl dir>] [-P<pid file>] "
1204 "<driver:ifname> \\\n"
1205 " [driver:ifname ...]\n",
1206 VERSION_STR);
1207 }
1208
1209
main(int argc,char * argv[])1210 int main(int argc, char *argv[])
1211 {
1212 int c, i;
1213 int ret = -1;
1214 char *pid_file = NULL;
1215 int daemonize = 0;
1216 char *ctrl_dir = "/var/run/wpa_priv";
1217 struct wpa_priv_global global;
1218 struct wpa_priv_interface *iface;
1219
1220 if (os_program_init())
1221 return -1;
1222
1223 wpa_priv_fd_workaround();
1224
1225 os_memset(&global, 0, sizeof(global));
1226 global.interfaces = NULL;
1227
1228 for (;;) {
1229 c = getopt(argc, argv, "Bc:dP:");
1230 if (c < 0)
1231 break;
1232 switch (c) {
1233 case 'B':
1234 daemonize++;
1235 break;
1236 case 'c':
1237 ctrl_dir = optarg;
1238 break;
1239 case 'd':
1240 wpa_debug_level--;
1241 break;
1242 case 'P':
1243 pid_file = os_rel2abs_path(optarg);
1244 break;
1245 default:
1246 usage();
1247 goto out2;
1248 }
1249 }
1250
1251 if (optind >= argc) {
1252 usage();
1253 goto out2;
1254 }
1255
1256 wpa_printf(MSG_DEBUG, "wpa_priv control directory: '%s'", ctrl_dir);
1257
1258 if (eloop_init()) {
1259 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
1260 goto out2;
1261 }
1262
1263 for (i = optind; i < argc; i++) {
1264 wpa_printf(MSG_DEBUG, "Adding driver:interface %s", argv[i]);
1265 iface = wpa_priv_interface_init(&global, ctrl_dir, argv[i]);
1266 if (iface == NULL)
1267 goto out;
1268 iface->next = global.interfaces;
1269 global.interfaces = iface;
1270 }
1271
1272 if (daemonize && os_daemonize(pid_file) && eloop_sock_requeue())
1273 goto out;
1274
1275 eloop_register_signal_terminate(wpa_priv_terminate, NULL);
1276 eloop_run();
1277
1278 ret = 0;
1279
1280 out:
1281 iface = global.interfaces;
1282 while (iface) {
1283 struct wpa_priv_interface *prev = iface;
1284 iface = iface->next;
1285 wpa_priv_interface_deinit(prev);
1286 }
1287
1288 eloop_destroy();
1289
1290 out2:
1291 if (daemonize)
1292 os_daemonize_terminate(pid_file);
1293 os_free(pid_file);
1294 os_program_deinit();
1295
1296 return ret;
1297 }
1298