1 /* 2 * WPA Supplicant / privileged helper program 3 * Copyright (c) 2007-2009, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 #ifdef __linux__ 11 #include <fcntl.h> 12 #endif /* __linux__ */ 13 #include <sys/un.h> 14 #include <sys/stat.h> 15 16 #include "common.h" 17 #include "eloop.h" 18 #include "common/version.h" 19 #include "drivers/driver.h" 20 #include "l2_packet/l2_packet.h" 21 #include "common/privsep_commands.h" 22 #include "common/ieee802_11_defs.h" 23 24 #define WPA_PRIV_MAX_L2 3 25 26 struct wpa_priv_interface { 27 struct wpa_priv_interface *next; 28 char *driver_name; 29 char *ifname; 30 char *sock_name; 31 int fd; 32 33 void *ctx; 34 35 const struct wpa_driver_ops *driver; 36 void *drv_priv; 37 void *drv_global_priv; 38 struct sockaddr_un drv_addr; 39 socklen_t drv_addr_len; 40 int wpas_registered; 41 42 struct l2_packet_data *l2[WPA_PRIV_MAX_L2]; 43 struct sockaddr_un l2_addr[WPA_PRIV_MAX_L2]; 44 socklen_t l2_addr_len[WPA_PRIV_MAX_L2]; 45 struct wpa_priv_l2 { 46 struct wpa_priv_interface *parent; 47 int idx; 48 } l2_ctx[WPA_PRIV_MAX_L2]; 49 }; 50 51 struct wpa_priv_global { 52 struct wpa_priv_interface *interfaces; 53 }; 54 55 56 static void wpa_priv_cmd_register(struct wpa_priv_interface *iface, 57 struct sockaddr_un *from, socklen_t fromlen) 58 { 59 int i; 60 61 if (iface->drv_priv) { 62 wpa_printf(MSG_DEBUG, "Cleaning up forgotten driver instance"); 63 if (iface->driver->deinit) 64 iface->driver->deinit(iface->drv_priv); 65 iface->drv_priv = NULL; 66 if (iface->drv_global_priv) { 67 iface->driver->global_deinit(iface->drv_global_priv); 68 iface->drv_global_priv = NULL; 69 } 70 iface->wpas_registered = 0; 71 } 72 73 for (i = 0; i < WPA_PRIV_MAX_L2; i++) { 74 if (iface->l2[i]) { 75 wpa_printf(MSG_DEBUG, 76 "Cleaning up forgotten l2_packet instance"); 77 l2_packet_deinit(iface->l2[i]); 78 iface->l2[i] = NULL; 79 } 80 } 81 82 if (iface->driver->init2) { 83 if (iface->driver->global_init) { 84 iface->drv_global_priv = 85 iface->driver->global_init(iface->ctx); 86 if (!iface->drv_global_priv) { 87 wpa_printf(MSG_INFO, 88 "Failed to initialize driver global context"); 89 return; 90 } 91 } else { 92 iface->drv_global_priv = NULL; 93 } 94 iface->drv_priv = iface->driver->init2(iface, iface->ifname, 95 iface->drv_global_priv); 96 } else if (iface->driver->init) { 97 iface->drv_priv = iface->driver->init(iface, iface->ifname); 98 } else { 99 return; 100 } 101 if (iface->drv_priv == NULL) { 102 wpa_printf(MSG_DEBUG, "Failed to initialize driver wrapper"); 103 return; 104 } 105 106 wpa_printf(MSG_DEBUG, "Driver wrapper '%s' initialized for interface " 107 "'%s'", iface->driver_name, iface->ifname); 108 109 os_memcpy(&iface->drv_addr, from, fromlen); 110 iface->drv_addr_len = fromlen; 111 iface->wpas_registered = 1; 112 113 if (iface->driver->set_param && 114 iface->driver->set_param(iface->drv_priv, NULL) < 0) { 115 wpa_printf(MSG_ERROR, "Driver interface rejected param"); 116 } 117 } 118 119 120 static void wpa_priv_cmd_unregister(struct wpa_priv_interface *iface, 121 struct sockaddr_un *from) 122 { 123 if (iface->drv_priv) { 124 if (iface->driver->deinit) 125 iface->driver->deinit(iface->drv_priv); 126 iface->drv_priv = NULL; 127 if (iface->drv_global_priv) { 128 iface->driver->global_deinit(iface->drv_global_priv); 129 iface->drv_global_priv = NULL; 130 } 131 iface->wpas_registered = 0; 132 } 133 } 134 135 136 static void wpa_priv_cmd_scan(struct wpa_priv_interface *iface, 137 void *buf, size_t len) 138 { 139 struct wpa_driver_scan_params params; 140 struct privsep_cmd_scan *scan; 141 unsigned int i; 142 int freqs[PRIVSEP_MAX_SCAN_FREQS + 1]; 143 144 if (iface->drv_priv == NULL) 145 return; 146 147 if (len < sizeof(*scan)) { 148 wpa_printf(MSG_DEBUG, "Invalid scan request"); 149 return; 150 } 151 152 scan = buf; 153 154 os_memset(¶ms, 0, sizeof(params)); 155 if (scan->num_ssids > WPAS_MAX_SCAN_SSIDS) { 156 wpa_printf(MSG_DEBUG, "Invalid scan request (num_ssids)"); 157 return; 158 } 159 params.num_ssids = scan->num_ssids; 160 for (i = 0; i < scan->num_ssids; i++) { 161 params.ssids[i].ssid = scan->ssids[i]; 162 params.ssids[i].ssid_len = scan->ssid_lens[i]; 163 } 164 165 if (scan->num_freqs > PRIVSEP_MAX_SCAN_FREQS) { 166 wpa_printf(MSG_DEBUG, "Invalid scan request (num_freqs)"); 167 return; 168 } 169 if (scan->num_freqs) { 170 for (i = 0; i < scan->num_freqs; i++) 171 freqs[i] = scan->freqs[i]; 172 freqs[i] = 0; 173 params.freqs = freqs; 174 } 175 176 if (iface->driver->scan2) 177 iface->driver->scan2(iface->drv_priv, ¶ms); 178 } 179 180 181 static void wpa_priv_get_scan_results2(struct wpa_priv_interface *iface, 182 struct sockaddr_un *from, 183 socklen_t fromlen) 184 { 185 struct wpa_scan_results *res; 186 u8 *buf = NULL, *pos, *end; 187 int val; 188 size_t i; 189 190 if (iface->driver->get_scan_results) 191 res = iface->driver->get_scan_results(iface->drv_priv, NULL); 192 else 193 res = iface->driver->get_scan_results2(iface->drv_priv); 194 if (res == NULL) 195 goto fail; 196 197 buf = os_malloc(60000); 198 if (buf == NULL) 199 goto fail; 200 pos = buf; 201 end = buf + 60000; 202 val = res->num; 203 os_memcpy(pos, &val, sizeof(int)); 204 pos += sizeof(int); 205 206 for (i = 0; i < res->num; i++) { 207 struct wpa_scan_res *r = res->res[i]; 208 val = sizeof(*r) + r->ie_len + r->beacon_ie_len; 209 if (end - pos < (int) sizeof(int) + val) 210 break; 211 os_memcpy(pos, &val, sizeof(int)); 212 pos += sizeof(int); 213 os_memcpy(pos, r, val); 214 pos += val; 215 } 216 217 sendto(iface->fd, buf, pos - buf, 0, (struct sockaddr *) from, fromlen); 218 219 os_free(buf); 220 wpa_scan_results_free(res); 221 return; 222 223 fail: 224 os_free(buf); 225 wpa_scan_results_free(res); 226 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, fromlen); 227 } 228 229 230 static void wpa_priv_cmd_get_scan_results(struct wpa_priv_interface *iface, 231 struct sockaddr_un *from, 232 socklen_t fromlen) 233 { 234 if (iface->drv_priv == NULL) 235 return; 236 237 if (iface->driver->get_scan_results || iface->driver->get_scan_results2) 238 wpa_priv_get_scan_results2(iface, from, fromlen); 239 else 240 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, fromlen); 241 } 242 243 244 static void wpa_priv_cmd_authenticate(struct wpa_priv_interface *iface, 245 void *buf, size_t len) 246 { 247 struct wpa_driver_auth_params params; 248 struct privsep_cmd_authenticate *auth; 249 int res, i; 250 251 if (iface->drv_priv == NULL || iface->driver->authenticate == NULL) 252 return; 253 254 if (len < sizeof(*auth)) { 255 wpa_printf(MSG_DEBUG, "Invalid authentication request"); 256 return; 257 } 258 259 auth = buf; 260 if (sizeof(*auth) + auth->ie_len + auth->auth_data_len > len) { 261 wpa_printf(MSG_DEBUG, "Authentication request overflow"); 262 return; 263 } 264 265 os_memset(¶ms, 0, sizeof(params)); 266 params.freq = auth->freq; 267 params.bssid = auth->bssid; 268 params.ssid = auth->ssid; 269 if (auth->ssid_len > SSID_MAX_LEN) 270 return; 271 params.ssid_len = auth->ssid_len; 272 params.auth_alg = auth->auth_alg; 273 for (i = 0; i < 4; i++) { 274 if (auth->wep_key_len[i]) { 275 params.wep_key[i] = auth->wep_key[i]; 276 params.wep_key_len[i] = auth->wep_key_len[i]; 277 } 278 } 279 params.wep_tx_keyidx = auth->wep_tx_keyidx; 280 params.local_state_change = auth->local_state_change; 281 params.p2p = auth->p2p; 282 if (auth->ie_len) { 283 params.ie = (u8 *) (auth + 1); 284 params.ie_len = auth->ie_len; 285 } 286 if (auth->auth_data_len) { 287 params.auth_data = ((u8 *) (auth + 1)) + auth->ie_len; 288 params.auth_data_len = auth->auth_data_len; 289 } 290 291 res = iface->driver->authenticate(iface->drv_priv, ¶ms); 292 wpa_printf(MSG_DEBUG, "drv->authenticate: res=%d", res); 293 } 294 295 296 static void wpa_priv_cmd_associate(struct wpa_priv_interface *iface, 297 void *buf, size_t len) 298 { 299 struct wpa_driver_associate_params params; 300 struct privsep_cmd_associate *assoc; 301 u8 *bssid; 302 int res; 303 304 if (iface->drv_priv == NULL || iface->driver->associate == NULL) 305 return; 306 307 if (len < sizeof(*assoc)) { 308 wpa_printf(MSG_DEBUG, "Invalid association request"); 309 return; 310 } 311 312 assoc = buf; 313 if (sizeof(*assoc) + assoc->wpa_ie_len > len) { 314 wpa_printf(MSG_DEBUG, "Association request overflow"); 315 return; 316 } 317 318 os_memset(¶ms, 0, sizeof(params)); 319 bssid = assoc->bssid; 320 if (bssid[0] | bssid[1] | bssid[2] | bssid[3] | bssid[4] | bssid[5]) 321 params.bssid = bssid; 322 params.ssid = assoc->ssid; 323 if (assoc->ssid_len > SSID_MAX_LEN) 324 return; 325 params.ssid_len = assoc->ssid_len; 326 params.freq.mode = assoc->hwmode; 327 params.freq.freq = assoc->freq; 328 params.freq.channel = assoc->channel; 329 if (assoc->wpa_ie_len) { 330 params.wpa_ie = (u8 *) (assoc + 1); 331 params.wpa_ie_len = assoc->wpa_ie_len; 332 } 333 params.pairwise_suite = assoc->pairwise_suite; 334 params.group_suite = assoc->group_suite; 335 params.key_mgmt_suite = assoc->key_mgmt_suite; 336 params.auth_alg = assoc->auth_alg; 337 params.mode = assoc->mode; 338 339 res = iface->driver->associate(iface->drv_priv, ¶ms); 340 wpa_printf(MSG_DEBUG, "drv->associate: res=%d", res); 341 } 342 343 344 static void wpa_priv_cmd_get_bssid(struct wpa_priv_interface *iface, 345 struct sockaddr_un *from, socklen_t fromlen) 346 { 347 u8 bssid[ETH_ALEN]; 348 349 if (iface->drv_priv == NULL) 350 goto fail; 351 352 if (iface->driver->get_bssid == NULL || 353 iface->driver->get_bssid(iface->drv_priv, bssid) < 0) 354 goto fail; 355 356 sendto(iface->fd, bssid, ETH_ALEN, 0, (struct sockaddr *) from, 357 fromlen); 358 return; 359 360 fail: 361 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, fromlen); 362 } 363 364 365 static void wpa_priv_cmd_get_ssid(struct wpa_priv_interface *iface, 366 struct sockaddr_un *from, socklen_t fromlen) 367 { 368 u8 ssid[sizeof(int) + SSID_MAX_LEN]; 369 int res; 370 371 if (iface->drv_priv == NULL) 372 goto fail; 373 374 if (iface->driver->get_ssid == NULL) 375 goto fail; 376 377 os_memset(ssid, 0, sizeof(ssid)); 378 res = iface->driver->get_ssid(iface->drv_priv, &ssid[sizeof(int)]); 379 if (res < 0 || res > SSID_MAX_LEN) 380 goto fail; 381 os_memcpy(ssid, &res, sizeof(int)); 382 383 sendto(iface->fd, ssid, sizeof(ssid), 0, (struct sockaddr *) from, 384 fromlen); 385 return; 386 387 fail: 388 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, fromlen); 389 } 390 391 392 static void wpa_priv_cmd_set_key(struct wpa_priv_interface *iface, 393 void *buf, size_t len) 394 { 395 struct privsep_cmd_set_key *params; 396 int res; 397 struct wpa_driver_set_key_params p; 398 399 if (iface->drv_priv == NULL || iface->driver->set_key == NULL) 400 return; 401 402 if (len != sizeof(*params)) { 403 wpa_printf(MSG_DEBUG, "Invalid set_key request"); 404 return; 405 } 406 407 params = buf; 408 409 os_memset(&p, 0, sizeof(p)); 410 p.ifname = iface->ifname; 411 p.alg = params->alg; 412 p.addr = params->addr; 413 p.key_idx = params->key_idx; 414 p.set_tx = params->set_tx; 415 p.seq = params->seq_len ? params->seq : NULL; 416 p.seq_len = params->seq_len; 417 p.key = params->key_len ? params->key : NULL; 418 p.key_len = params->key_len; 419 p.key_flag = params->key_flag; 420 p.link_id = -1; 421 422 res = iface->driver->set_key(iface->drv_priv, &p); 423 wpa_printf(MSG_DEBUG, "drv->set_key: res=%d", res); 424 } 425 426 427 static void wpa_priv_cmd_get_capa(struct wpa_priv_interface *iface, 428 struct sockaddr_un *from, socklen_t fromlen) 429 { 430 struct wpa_driver_capa capa; 431 432 if (iface->drv_priv == NULL) 433 goto fail; 434 435 if (iface->driver->get_capa == NULL || 436 iface->driver->get_capa(iface->drv_priv, &capa) < 0) 437 goto fail; 438 439 /* For now, no support for passing extended_capa pointers */ 440 capa.extended_capa = NULL; 441 capa.extended_capa_mask = NULL; 442 capa.extended_capa_len = 0; 443 sendto(iface->fd, &capa, sizeof(capa), 0, (struct sockaddr *) from, 444 fromlen); 445 return; 446 447 fail: 448 sendto(iface->fd, "", 0, 0, (struct sockaddr *) from, fromlen); 449 } 450 451 452 static void wpa_priv_l2_rx(void *ctx, const u8 *src_addr, const u8 *buf, 453 size_t len) 454 { 455 struct wpa_priv_l2 *l2_ctx = ctx; 456 struct wpa_priv_interface *iface = l2_ctx->parent; 457 struct msghdr msg; 458 struct iovec io[2]; 459 460 io[0].iov_base = (u8 *) src_addr; 461 io[0].iov_len = ETH_ALEN; 462 io[1].iov_base = (u8 *) buf; 463 io[1].iov_len = len; 464 465 os_memset(&msg, 0, sizeof(msg)); 466 msg.msg_iov = io; 467 msg.msg_iovlen = 2; 468 msg.msg_name = &iface->l2_addr[l2_ctx->idx]; 469 msg.msg_namelen = iface->l2_addr_len[l2_ctx->idx]; 470 471 if (sendmsg(iface->fd, &msg, 0) < 0) { 472 wpa_printf(MSG_ERROR, "sendmsg(l2 rx): %s", strerror(errno)); 473 } 474 } 475 476 477 static int wpa_priv_allowed_l2_proto(u16 proto) 478 { 479 return proto == ETH_P_EAPOL || proto == ETH_P_RSN_PREAUTH || 480 proto == ETH_P_80211_ENCAP; 481 } 482 483 484 static void wpa_priv_cmd_l2_register(struct wpa_priv_interface *iface, 485 struct sockaddr_un *from, 486 socklen_t fromlen, 487 void *buf, size_t len) 488 { 489 int *reg_cmd = buf; 490 u8 own_addr[ETH_ALEN]; 491 int res; 492 u16 proto; 493 int idx; 494 495 if (len != 2 * sizeof(int)) { 496 wpa_printf(MSG_DEBUG, "Invalid l2_register length %lu", 497 (unsigned long) len); 498 return; 499 } 500 501 proto = reg_cmd[0]; 502 if (!wpa_priv_allowed_l2_proto(proto)) { 503 wpa_printf(MSG_DEBUG, "Refused l2_packet connection for " 504 "ethertype 0x%x", proto); 505 return; 506 } 507 508 for (idx = 0; idx < WPA_PRIV_MAX_L2; idx++) { 509 if (!iface->l2[idx]) 510 break; 511 } 512 if (idx == WPA_PRIV_MAX_L2) { 513 wpa_printf(MSG_DEBUG, "No free l2_packet connection found"); 514 return; 515 } 516 517 os_memcpy(&iface->l2_addr[idx], from, fromlen); 518 iface->l2_addr_len[idx] = fromlen; 519 520 iface->l2_ctx[idx].idx = idx; 521 iface->l2_ctx[idx].parent = iface; 522 iface->l2[idx] = l2_packet_init(iface->ifname, NULL, proto, 523 wpa_priv_l2_rx, &iface->l2_ctx[idx], 524 reg_cmd[1]); 525 if (!iface->l2[idx]) { 526 wpa_printf(MSG_DEBUG, "Failed to initialize l2_packet " 527 "instance for protocol %d", proto); 528 return; 529 } 530 531 if (l2_packet_get_own_addr(iface->l2[idx], own_addr) < 0) { 532 wpa_printf(MSG_DEBUG, "Failed to get own address from " 533 "l2_packet"); 534 l2_packet_deinit(iface->l2[idx]); 535 iface->l2[idx] = NULL; 536 return; 537 } 538 539 res = sendto(iface->fd, own_addr, ETH_ALEN, 0, 540 (struct sockaddr *) from, fromlen); 541 wpa_printf(MSG_DEBUG, "L2 registration[idx=%d]: res=%d", idx, res); 542 } 543 544 545 static void wpa_priv_cmd_l2_unregister(struct wpa_priv_interface *iface, 546 struct sockaddr_un *from, 547 socklen_t fromlen) 548 { 549 int idx; 550 551 for (idx = 0; idx < WPA_PRIV_MAX_L2; idx++) { 552 if (iface->l2_addr_len[idx] == fromlen && 553 os_memcmp(&iface->l2_addr[idx], from, fromlen) == 0) 554 break; 555 } 556 if (idx == WPA_PRIV_MAX_L2) { 557 wpa_printf(MSG_DEBUG, 558 "No registered l2_packet socket found for unregister request"); 559 return; 560 } 561 562 if (iface->l2[idx]) { 563 l2_packet_deinit(iface->l2[idx]); 564 iface->l2[idx] = NULL; 565 } 566 } 567 568 569 static void wpa_priv_cmd_l2_notify_auth_start(struct wpa_priv_interface *iface, 570 struct sockaddr_un *from) 571 { 572 int idx; 573 574 for (idx = 0; idx < WPA_PRIV_MAX_L2; idx++) { 575 if (iface->l2[idx]) 576 l2_packet_notify_auth_start(iface->l2[idx]); 577 } 578 } 579 580 581 static void wpa_priv_cmd_l2_send(struct wpa_priv_interface *iface, 582 struct sockaddr_un *from, socklen_t fromlen, 583 void *buf, size_t len) 584 { 585 u8 *dst_addr; 586 u16 proto; 587 int res; 588 int idx; 589 590 for (idx = 0; idx < WPA_PRIV_MAX_L2; idx++) { 591 if (iface->l2_addr_len[idx] == fromlen && 592 os_memcmp(&iface->l2_addr[idx], from, fromlen) == 0) 593 break; 594 } 595 if (idx == WPA_PRIV_MAX_L2) { 596 wpa_printf(MSG_DEBUG, 597 "No registered l2_packet socket found for send request"); 598 return; 599 } 600 601 if (iface->l2[idx] == NULL) 602 return; 603 604 if (len < ETH_ALEN + 2) { 605 wpa_printf(MSG_DEBUG, "Too short L2 send packet (len=%lu)", 606 (unsigned long) len); 607 return; 608 } 609 610 dst_addr = buf; 611 os_memcpy(&proto, (char *) buf + ETH_ALEN, 2); 612 613 if (!wpa_priv_allowed_l2_proto(proto)) { 614 wpa_printf(MSG_DEBUG, "Refused l2_packet send for ethertype " 615 "0x%x", proto); 616 return; 617 } 618 619 res = l2_packet_send(iface->l2[idx], dst_addr, proto, 620 (unsigned char *) buf + ETH_ALEN + 2, 621 len - ETH_ALEN - 2); 622 wpa_printf(MSG_DEBUG, "L2 send[idx=%d]: res=%d", idx, res); 623 } 624 625 626 static void wpa_priv_cmd_set_country(struct wpa_priv_interface *iface, 627 char *buf) 628 { 629 if (iface->drv_priv == NULL || iface->driver->set_country == NULL || 630 *buf == '\0') 631 return; 632 633 iface->driver->set_country(iface->drv_priv, buf); 634 } 635 636 637 static void wpa_priv_receive(int sock, void *eloop_ctx, void *sock_ctx) 638 { 639 struct wpa_priv_interface *iface = eloop_ctx; 640 char buf[2000], *pos; 641 void *cmd_buf; 642 size_t cmd_len; 643 int res, cmd; 644 struct sockaddr_un from; 645 socklen_t fromlen = sizeof(from); 646 647 res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &from, 648 &fromlen); 649 if (res < 0) { 650 wpa_printf(MSG_ERROR, "recvfrom: %s", strerror(errno)); 651 return; 652 } 653 654 if (res < (int) sizeof(int)) { 655 wpa_printf(MSG_DEBUG, "Too short command (len=%d)", res); 656 return; 657 } 658 659 os_memcpy(&cmd, buf, sizeof(int)); 660 wpa_printf(MSG_DEBUG, "Command %d for interface %s", 661 cmd, iface->ifname); 662 cmd_buf = &buf[sizeof(int)]; 663 cmd_len = res - sizeof(int); 664 665 switch (cmd) { 666 case PRIVSEP_CMD_REGISTER: 667 wpa_priv_cmd_register(iface, &from, fromlen); 668 break; 669 case PRIVSEP_CMD_UNREGISTER: 670 wpa_priv_cmd_unregister(iface, &from); 671 break; 672 case PRIVSEP_CMD_SCAN: 673 wpa_priv_cmd_scan(iface, cmd_buf, cmd_len); 674 break; 675 case PRIVSEP_CMD_GET_SCAN_RESULTS: 676 wpa_priv_cmd_get_scan_results(iface, &from, fromlen); 677 break; 678 case PRIVSEP_CMD_ASSOCIATE: 679 wpa_priv_cmd_associate(iface, cmd_buf, cmd_len); 680 break; 681 case PRIVSEP_CMD_GET_BSSID: 682 wpa_priv_cmd_get_bssid(iface, &from, fromlen); 683 break; 684 case PRIVSEP_CMD_GET_SSID: 685 wpa_priv_cmd_get_ssid(iface, &from, fromlen); 686 break; 687 case PRIVSEP_CMD_SET_KEY: 688 wpa_priv_cmd_set_key(iface, cmd_buf, cmd_len); 689 break; 690 case PRIVSEP_CMD_GET_CAPA: 691 wpa_priv_cmd_get_capa(iface, &from, fromlen); 692 break; 693 case PRIVSEP_CMD_L2_REGISTER: 694 wpa_priv_cmd_l2_register(iface, &from, fromlen, 695 cmd_buf, cmd_len); 696 break; 697 case PRIVSEP_CMD_L2_UNREGISTER: 698 wpa_priv_cmd_l2_unregister(iface, &from, fromlen); 699 break; 700 case PRIVSEP_CMD_L2_NOTIFY_AUTH_START: 701 wpa_priv_cmd_l2_notify_auth_start(iface, &from); 702 break; 703 case PRIVSEP_CMD_L2_SEND: 704 wpa_priv_cmd_l2_send(iface, &from, fromlen, cmd_buf, cmd_len); 705 break; 706 case PRIVSEP_CMD_SET_COUNTRY: 707 pos = cmd_buf; 708 if (pos + cmd_len >= buf + sizeof(buf)) 709 break; 710 pos[cmd_len] = '\0'; 711 wpa_priv_cmd_set_country(iface, pos); 712 break; 713 case PRIVSEP_CMD_AUTHENTICATE: 714 wpa_priv_cmd_authenticate(iface, cmd_buf, cmd_len); 715 break; 716 } 717 } 718 719 720 static void wpa_priv_interface_deinit(struct wpa_priv_interface *iface) 721 { 722 int i; 723 724 if (iface->drv_priv) { 725 if (iface->driver->deinit) 726 iface->driver->deinit(iface->drv_priv); 727 if (iface->drv_global_priv) 728 iface->driver->global_deinit(iface->drv_global_priv); 729 } 730 731 if (iface->fd >= 0) { 732 eloop_unregister_read_sock(iface->fd); 733 close(iface->fd); 734 unlink(iface->sock_name); 735 } 736 737 for (i = 0; i < WPA_PRIV_MAX_L2; i++) { 738 if (iface->l2[i]) 739 l2_packet_deinit(iface->l2[i]); 740 } 741 742 os_free(iface->ifname); 743 os_free(iface->driver_name); 744 os_free(iface->sock_name); 745 os_free(iface); 746 } 747 748 749 static struct wpa_priv_interface * 750 wpa_priv_interface_init(void *ctx, const char *dir, const char *params) 751 { 752 struct wpa_priv_interface *iface; 753 char *pos; 754 size_t len; 755 struct sockaddr_un addr; 756 int i; 757 758 pos = os_strchr(params, ':'); 759 if (pos == NULL) 760 return NULL; 761 762 iface = os_zalloc(sizeof(*iface)); 763 if (iface == NULL) 764 return NULL; 765 iface->fd = -1; 766 iface->ctx = ctx; 767 768 len = pos - params; 769 iface->driver_name = dup_binstr(params, len); 770 if (iface->driver_name == NULL) { 771 wpa_priv_interface_deinit(iface); 772 return NULL; 773 } 774 775 for (i = 0; wpa_drivers[i]; i++) { 776 if (os_strcmp(iface->driver_name, 777 wpa_drivers[i]->name) == 0) { 778 iface->driver = wpa_drivers[i]; 779 break; 780 } 781 } 782 if (iface->driver == NULL) { 783 wpa_printf(MSG_ERROR, "Unsupported driver '%s'", 784 iface->driver_name); 785 wpa_priv_interface_deinit(iface); 786 return NULL; 787 } 788 789 pos++; 790 iface->ifname = os_strdup(pos); 791 if (iface->ifname == NULL) { 792 wpa_priv_interface_deinit(iface); 793 return NULL; 794 } 795 796 len = os_strlen(dir) + 1 + os_strlen(iface->ifname); 797 iface->sock_name = os_malloc(len + 1); 798 if (iface->sock_name == NULL) { 799 wpa_priv_interface_deinit(iface); 800 return NULL; 801 } 802 803 os_snprintf(iface->sock_name, len + 1, "%s/%s", dir, iface->ifname); 804 if (os_strlen(iface->sock_name) >= sizeof(addr.sun_path)) { 805 wpa_priv_interface_deinit(iface); 806 return NULL; 807 } 808 809 iface->fd = socket(PF_UNIX, SOCK_DGRAM, 0); 810 if (iface->fd < 0) { 811 wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno)); 812 wpa_priv_interface_deinit(iface); 813 return NULL; 814 } 815 816 os_memset(&addr, 0, sizeof(addr)); 817 addr.sun_family = AF_UNIX; 818 os_strlcpy(addr.sun_path, iface->sock_name, sizeof(addr.sun_path)); 819 820 if (bind(iface->fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) { 821 wpa_printf(MSG_DEBUG, "bind(PF_UNIX) failed: %s", 822 strerror(errno)); 823 if (connect(iface->fd, (struct sockaddr *) &addr, 824 sizeof(addr)) < 0) { 825 wpa_printf(MSG_DEBUG, "Socket exists, but does not " 826 "allow connections - assuming it was " 827 "leftover from forced program termination"); 828 if (unlink(iface->sock_name) < 0) { 829 wpa_printf(MSG_ERROR, 830 "Could not unlink existing ctrl_iface socket '%s': %s", 831 iface->sock_name, strerror(errno)); 832 goto fail; 833 } 834 if (bind(iface->fd, (struct sockaddr *) &addr, 835 sizeof(addr)) < 0) { 836 wpa_printf(MSG_ERROR, 837 "wpa-priv-iface-init: bind(PF_UNIX): %s", 838 strerror(errno)); 839 goto fail; 840 } 841 wpa_printf(MSG_DEBUG, "Successfully replaced leftover " 842 "socket '%s'", iface->sock_name); 843 } else { 844 wpa_printf(MSG_INFO, "Socket exists and seems to be " 845 "in use - cannot override it"); 846 wpa_printf(MSG_INFO, "Delete '%s' manually if it is " 847 "not used anymore", iface->sock_name); 848 goto fail; 849 } 850 } 851 852 if (chmod(iface->sock_name, S_IRWXU | S_IRWXG | S_IRWXO) < 0) { 853 wpa_printf(MSG_ERROR, "chmod: %s", strerror(errno)); 854 goto fail; 855 } 856 857 eloop_register_read_sock(iface->fd, wpa_priv_receive, iface, NULL); 858 859 return iface; 860 861 fail: 862 wpa_priv_interface_deinit(iface); 863 return NULL; 864 } 865 866 867 static int wpa_priv_send_event(struct wpa_priv_interface *iface, int event, 868 const void *data, size_t data_len) 869 { 870 struct msghdr msg; 871 struct iovec io[2]; 872 873 io[0].iov_base = &event; 874 io[0].iov_len = sizeof(event); 875 io[1].iov_base = (u8 *) data; 876 io[1].iov_len = data_len; 877 878 os_memset(&msg, 0, sizeof(msg)); 879 msg.msg_iov = io; 880 msg.msg_iovlen = data ? 2 : 1; 881 msg.msg_name = &iface->drv_addr; 882 msg.msg_namelen = iface->drv_addr_len; 883 884 if (sendmsg(iface->fd, &msg, 0) < 0) { 885 wpa_printf(MSG_ERROR, "sendmsg(wpas_socket): %s", 886 strerror(errno)); 887 return -1; 888 } 889 890 return 0; 891 } 892 893 894 static void wpa_priv_send_auth(struct wpa_priv_interface *iface, 895 union wpa_event_data *data) 896 { 897 size_t buflen = sizeof(struct privsep_event_auth) + data->auth.ies_len; 898 struct privsep_event_auth *auth; 899 u8 *buf, *pos; 900 901 buf = os_zalloc(buflen); 902 if (buf == NULL) 903 return; 904 905 auth = (struct privsep_event_auth *) buf; 906 pos = (u8 *) (auth + 1); 907 908 os_memcpy(auth->peer, data->auth.peer, ETH_ALEN); 909 os_memcpy(auth->bssid, data->auth.bssid, ETH_ALEN); 910 auth->auth_type = data->auth.auth_type; 911 auth->auth_transaction = data->auth.auth_transaction; 912 auth->status_code = data->auth.status_code; 913 if (data->auth.ies) { 914 os_memcpy(pos, data->auth.ies, data->auth.ies_len); 915 auth->ies_len = data->auth.ies_len; 916 } 917 918 wpa_priv_send_event(iface, PRIVSEP_EVENT_AUTH, buf, buflen); 919 920 os_free(buf); 921 } 922 923 924 static void wpa_priv_send_assoc(struct wpa_priv_interface *iface, int event, 925 union wpa_event_data *data) 926 { 927 size_t buflen = 3 * sizeof(int); 928 u8 *buf, *pos; 929 int len; 930 931 if (data) { 932 buflen += data->assoc_info.req_ies_len + 933 data->assoc_info.resp_ies_len + 934 data->assoc_info.beacon_ies_len; 935 } 936 937 buf = os_malloc(buflen); 938 if (buf == NULL) 939 return; 940 941 pos = buf; 942 943 if (data && data->assoc_info.req_ies) { 944 len = data->assoc_info.req_ies_len; 945 os_memcpy(pos, &len, sizeof(int)); 946 pos += sizeof(int); 947 os_memcpy(pos, data->assoc_info.req_ies, len); 948 pos += len; 949 } else { 950 len = 0; 951 os_memcpy(pos, &len, sizeof(int)); 952 pos += sizeof(int); 953 } 954 955 if (data && data->assoc_info.resp_ies) { 956 len = data->assoc_info.resp_ies_len; 957 os_memcpy(pos, &len, sizeof(int)); 958 pos += sizeof(int); 959 os_memcpy(pos, data->assoc_info.resp_ies, len); 960 pos += len; 961 } else { 962 len = 0; 963 os_memcpy(pos, &len, sizeof(int)); 964 pos += sizeof(int); 965 } 966 967 if (data && data->assoc_info.beacon_ies) { 968 len = data->assoc_info.beacon_ies_len; 969 os_memcpy(pos, &len, sizeof(int)); 970 pos += sizeof(int); 971 os_memcpy(pos, data->assoc_info.beacon_ies, len); 972 pos += len; 973 } else { 974 len = 0; 975 os_memcpy(pos, &len, sizeof(int)); 976 pos += sizeof(int); 977 } 978 979 wpa_priv_send_event(iface, event, buf, buflen); 980 981 os_free(buf); 982 } 983 984 985 static void wpa_priv_send_interface_status(struct wpa_priv_interface *iface, 986 union wpa_event_data *data) 987 { 988 int ievent; 989 size_t len, maxlen; 990 u8 *buf; 991 char *ifname; 992 993 if (data == NULL) 994 return; 995 996 ievent = data->interface_status.ievent; 997 maxlen = sizeof(data->interface_status.ifname); 998 ifname = data->interface_status.ifname; 999 for (len = 0; len < maxlen && ifname[len]; len++) 1000 ; 1001 1002 buf = os_malloc(sizeof(int) + len); 1003 if (buf == NULL) 1004 return; 1005 1006 os_memcpy(buf, &ievent, sizeof(int)); 1007 os_memcpy(buf + sizeof(int), ifname, len); 1008 1009 wpa_priv_send_event(iface, PRIVSEP_EVENT_INTERFACE_STATUS, 1010 buf, sizeof(int) + len); 1011 1012 os_free(buf); 1013 1014 } 1015 1016 1017 static void wpa_priv_send_ft_response(struct wpa_priv_interface *iface, 1018 union wpa_event_data *data) 1019 { 1020 size_t len; 1021 u8 *buf, *pos; 1022 1023 if (data == NULL || data->ft_ies.ies == NULL) 1024 return; 1025 1026 len = sizeof(int) + ETH_ALEN + data->ft_ies.ies_len; 1027 buf = os_malloc(len); 1028 if (buf == NULL) 1029 return; 1030 1031 pos = buf; 1032 os_memcpy(pos, &data->ft_ies.ft_action, sizeof(int)); 1033 pos += sizeof(int); 1034 os_memcpy(pos, data->ft_ies.target_ap, ETH_ALEN); 1035 pos += ETH_ALEN; 1036 os_memcpy(pos, data->ft_ies.ies, data->ft_ies.ies_len); 1037 1038 wpa_priv_send_event(iface, PRIVSEP_EVENT_FT_RESPONSE, buf, len); 1039 1040 os_free(buf); 1041 1042 } 1043 1044 1045 void wpa_supplicant_event(void *ctx, enum wpa_event_type event, 1046 union wpa_event_data *data) 1047 { 1048 struct wpa_priv_interface *iface = ctx; 1049 1050 wpa_printf(MSG_DEBUG, "%s - event=%d", __func__, event); 1051 1052 if (!iface->wpas_registered) { 1053 wpa_printf(MSG_DEBUG, "Driver event received, but " 1054 "wpa_supplicant not registered"); 1055 return; 1056 } 1057 1058 switch (event) { 1059 case EVENT_ASSOC: 1060 wpa_priv_send_assoc(iface, PRIVSEP_EVENT_ASSOC, data); 1061 break; 1062 case EVENT_DISASSOC: 1063 wpa_priv_send_event(iface, PRIVSEP_EVENT_DISASSOC, NULL, 0); 1064 break; 1065 case EVENT_ASSOCINFO: 1066 if (data == NULL) 1067 return; 1068 wpa_priv_send_assoc(iface, PRIVSEP_EVENT_ASSOCINFO, data); 1069 break; 1070 case EVENT_MICHAEL_MIC_FAILURE: 1071 if (data == NULL) 1072 return; 1073 wpa_priv_send_event(iface, PRIVSEP_EVENT_MICHAEL_MIC_FAILURE, 1074 &data->michael_mic_failure.unicast, 1075 sizeof(int)); 1076 break; 1077 case EVENT_SCAN_STARTED: 1078 wpa_priv_send_event(iface, PRIVSEP_EVENT_SCAN_STARTED, NULL, 1079 0); 1080 break; 1081 case EVENT_SCAN_RESULTS: 1082 wpa_priv_send_event(iface, PRIVSEP_EVENT_SCAN_RESULTS, NULL, 1083 0); 1084 break; 1085 case EVENT_INTERFACE_STATUS: 1086 wpa_priv_send_interface_status(iface, data); 1087 break; 1088 case EVENT_PMKID_CANDIDATE: 1089 if (data == NULL) 1090 return; 1091 wpa_priv_send_event(iface, PRIVSEP_EVENT_PMKID_CANDIDATE, 1092 &data->pmkid_candidate, 1093 sizeof(struct pmkid_candidate)); 1094 break; 1095 case EVENT_FT_RESPONSE: 1096 wpa_priv_send_ft_response(iface, data); 1097 break; 1098 case EVENT_AUTH: 1099 wpa_priv_send_auth(iface, data); 1100 break; 1101 default: 1102 wpa_printf(MSG_DEBUG, "Unsupported driver event %d (%s) - TODO", 1103 event, event_to_string(event)); 1104 break; 1105 } 1106 } 1107 1108 1109 void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event, 1110 union wpa_event_data *data) 1111 { 1112 struct wpa_priv_global *global = ctx; 1113 struct wpa_priv_interface *iface; 1114 1115 if (event != EVENT_INTERFACE_STATUS) 1116 return; 1117 1118 for (iface = global->interfaces; iface; iface = iface->next) { 1119 if (os_strcmp(iface->ifname, data->interface_status.ifname) == 1120 0) 1121 break; 1122 } 1123 if (iface && iface->driver->get_ifindex) { 1124 unsigned int ifindex; 1125 1126 ifindex = iface->driver->get_ifindex(iface->drv_priv); 1127 if (ifindex != data->interface_status.ifindex) { 1128 wpa_printf(MSG_DEBUG, 1129 "%s: interface status ifindex %d mismatch (%d)", 1130 iface->ifname, ifindex, 1131 data->interface_status.ifindex); 1132 return; 1133 } 1134 } 1135 if (iface) 1136 wpa_supplicant_event(iface, event, data); 1137 } 1138 1139 1140 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr, 1141 const u8 *buf, size_t len, 1142 enum frame_encryption encrypted) 1143 { 1144 struct wpa_priv_interface *iface = ctx; 1145 struct msghdr msg; 1146 struct iovec io[3]; 1147 int event = PRIVSEP_EVENT_RX_EAPOL; 1148 1149 wpa_printf(MSG_DEBUG, "RX EAPOL from driver"); 1150 io[0].iov_base = &event; 1151 io[0].iov_len = sizeof(event); 1152 io[1].iov_base = (u8 *) src_addr; 1153 io[1].iov_len = ETH_ALEN; 1154 io[2].iov_base = (u8 *) buf; 1155 io[2].iov_len = len; 1156 1157 os_memset(&msg, 0, sizeof(msg)); 1158 msg.msg_iov = io; 1159 msg.msg_iovlen = 3; 1160 msg.msg_name = &iface->drv_addr; 1161 msg.msg_namelen = iface->drv_addr_len; 1162 1163 if (sendmsg(iface->fd, &msg, 0) < 0) 1164 wpa_printf(MSG_ERROR, "sendmsg(wpas_socket): %s", 1165 strerror(errno)); 1166 } 1167 1168 1169 static void wpa_priv_terminate(int sig, void *signal_ctx) 1170 { 1171 wpa_printf(MSG_DEBUG, "wpa_priv termination requested"); 1172 eloop_terminate(); 1173 } 1174 1175 1176 static void wpa_priv_fd_workaround(void) 1177 { 1178 #ifdef __linux__ 1179 int s, i; 1180 /* When started from pcmcia-cs scripts, wpa_supplicant might start with 1181 * fd 0, 1, and 2 closed. This will cause some issues because many 1182 * places in wpa_supplicant are still printing out to stdout. As a 1183 * workaround, make sure that fd's 0, 1, and 2 are not used for other 1184 * sockets. */ 1185 for (i = 0; i < 3; i++) { 1186 s = open("/dev/null", O_RDWR); 1187 if (s > 2) { 1188 close(s); 1189 break; 1190 } 1191 } 1192 #endif /* __linux__ */ 1193 } 1194 1195 1196 static void usage(void) 1197 { 1198 printf("wpa_priv v%s\n" 1199 "Copyright (c) 2007-2017, Jouni Malinen <j@w1.fi> and " 1200 "contributors\n" 1201 "\n" 1202 "usage:\n" 1203 " wpa_priv [-Bdd] [-c<ctrl dir>] [-P<pid file>] " 1204 "<driver:ifname> \\\n" 1205 " [driver:ifname ...]\n", 1206 VERSION_STR); 1207 } 1208 1209 1210 int main(int argc, char *argv[]) 1211 { 1212 int c, i; 1213 int ret = -1; 1214 char *pid_file = NULL; 1215 int daemonize = 0; 1216 char *ctrl_dir = "/var/run/wpa_priv"; 1217 struct wpa_priv_global global; 1218 struct wpa_priv_interface *iface; 1219 1220 if (os_program_init()) 1221 return -1; 1222 1223 wpa_priv_fd_workaround(); 1224 1225 os_memset(&global, 0, sizeof(global)); 1226 global.interfaces = NULL; 1227 1228 for (;;) { 1229 c = getopt(argc, argv, "Bc:dP:"); 1230 if (c < 0) 1231 break; 1232 switch (c) { 1233 case 'B': 1234 daemonize++; 1235 break; 1236 case 'c': 1237 ctrl_dir = optarg; 1238 break; 1239 case 'd': 1240 wpa_debug_level--; 1241 break; 1242 case 'P': 1243 pid_file = os_rel2abs_path(optarg); 1244 break; 1245 default: 1246 usage(); 1247 goto out2; 1248 } 1249 } 1250 1251 if (optind >= argc) { 1252 usage(); 1253 goto out2; 1254 } 1255 1256 wpa_printf(MSG_DEBUG, "wpa_priv control directory: '%s'", ctrl_dir); 1257 1258 if (eloop_init()) { 1259 wpa_printf(MSG_ERROR, "Failed to initialize event loop"); 1260 goto out2; 1261 } 1262 1263 for (i = optind; i < argc; i++) { 1264 wpa_printf(MSG_DEBUG, "Adding driver:interface %s", argv[i]); 1265 iface = wpa_priv_interface_init(&global, ctrl_dir, argv[i]); 1266 if (iface == NULL) 1267 goto out; 1268 iface->next = global.interfaces; 1269 global.interfaces = iface; 1270 } 1271 1272 if (daemonize && os_daemonize(pid_file) && eloop_sock_requeue()) 1273 goto out; 1274 1275 eloop_register_signal_terminate(wpa_priv_terminate, NULL); 1276 eloop_run(); 1277 1278 ret = 0; 1279 1280 out: 1281 iface = global.interfaces; 1282 while (iface) { 1283 struct wpa_priv_interface *prev = iface; 1284 iface = iface->next; 1285 wpa_priv_interface_deinit(prev); 1286 } 1287 1288 eloop_destroy(); 1289 1290 out2: 1291 if (daemonize) 1292 os_daemonize_terminate(pid_file); 1293 os_free(pid_file); 1294 os_program_deinit(); 1295 1296 return ret; 1297 } 1298