Home | History | Annotate | Download | only in wpa_supplicant
      1 /*
      2  * WPA Supplicant / Windows Named Pipe -based control interface
      3  * Copyright (c) 2004-2006, Jouni Malinen <j (at) w1.fi>
      4  *
      5  * This program is free software; you can redistribute it and/or modify
      6  * it under the terms of the GNU General Public License version 2 as
      7  * published by the Free Software Foundation.
      8  *
      9  * Alternatively, this software may be distributed under the terms of BSD
     10  * license.
     11  *
     12  * See README and COPYING for more details.
     13  */
     14 
     15 #include "includes.h"
     16 
     17 #include "common.h"
     18 #include "eloop.h"
     19 #include "config.h"
     20 #include "eapol_supp/eapol_supp_sm.h"
     21 #include "wpa_supplicant_i.h"
     22 #include "ctrl_iface.h"
     23 #include "wpa_ctrl.h"
     24 
     25 #ifdef __MINGW32_VERSION
     26 /* mingw-w32api v3.1 does not yet include sddl.h, so define needed parts here
     27  */
     28 #define SDDL_REVISION_1 1
     29 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorA(
     30 	LPCSTR, DWORD, PSECURITY_DESCRIPTOR *, PULONG);
     31 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorW(
     32 	LPCWSTR, DWORD, PSECURITY_DESCRIPTOR *, PULONG);
     33 #ifdef UNICODE
     34 #define ConvertStringSecurityDescriptorToSecurityDescriptor \
     35 ConvertStringSecurityDescriptorToSecurityDescriptorW
     36 #else
     37 #define ConvertStringSecurityDescriptorToSecurityDescriptor \
     38 ConvertStringSecurityDescriptorToSecurityDescriptorA
     39 #endif
     40 #else /* __MINGW32_VERSION */
     41 #ifndef _WIN32_WINNT
     42 #define _WIN32_WINNT 0x0500
     43 #endif
     44 #include <sddl.h>
     45 #endif /* __MINGW32_VERSION */
     46 
     47 #ifndef WPA_SUPPLICANT_NAMED_PIPE
     48 #define WPA_SUPPLICANT_NAMED_PIPE "WpaSupplicant"
     49 #endif
     50 #define NAMED_PIPE_PREFIX TEXT("\\\\.\\pipe\\") TEXT(WPA_SUPPLICANT_NAMED_PIPE)
     51 
     52 /* Per-interface ctrl_iface */
     53 
     54 #define REQUEST_BUFSIZE 256
     55 #define REPLY_BUFSIZE 4096
     56 
     57 struct ctrl_iface_priv;
     58 
     59 /**
     60  * struct wpa_ctrl_dst - Internal data structure of control interface clients
     61  *
     62  * This structure is used to store information about registered control
     63  * interface monitors into struct wpa_supplicant. This data is private to
     64  * ctrl_iface_named_pipe.c and should not be touched directly from other files.
     65  */
     66 struct wpa_ctrl_dst {
     67 	/* Note: OVERLAPPED must be the first member of struct wpa_ctrl_dst */
     68 	OVERLAPPED overlap;
     69 	struct wpa_ctrl_dst *next, *prev;
     70 	struct ctrl_iface_priv *priv;
     71 	HANDLE pipe;
     72 	int attached;
     73 	int debug_level;
     74 	int errors;
     75 	char req_buf[REQUEST_BUFSIZE];
     76 	char *rsp_buf;
     77 	int used;
     78 };
     79 
     80 
     81 struct ctrl_iface_priv {
     82 	struct wpa_supplicant *wpa_s;
     83 	struct wpa_ctrl_dst *ctrl_dst;
     84 	SECURITY_ATTRIBUTES attr;
     85 	int sec_attr_set;
     86 };
     87 
     88 
     89 static void wpa_supplicant_ctrl_iface_send(struct ctrl_iface_priv *priv,
     90 					   int level, const char *buf,
     91 					   size_t len);
     92 
     93 static void ctrl_close_pipe(struct wpa_ctrl_dst *dst);
     94 static void wpa_supplicant_ctrl_iface_receive(void *, void *);
     95 static VOID WINAPI ctrl_iface_read_completed(DWORD err, DWORD bytes,
     96 					     LPOVERLAPPED overlap);
     97 
     98 struct wpa_global_dst;
     99 static void global_close_pipe(struct wpa_global_dst *dst);
    100 static void wpa_supplicant_global_iface_receive(void *eloop_data,
    101 						void *user_ctx);
    102 static VOID WINAPI global_iface_read_completed(DWORD err, DWORD bytes,
    103 					       LPOVERLAPPED overlap);
    104 
    105 
    106 static int ctrl_broken_pipe(HANDLE pipe, int used)
    107 {
    108 	DWORD err;
    109 
    110 	if (PeekNamedPipe(pipe, NULL, 0, NULL, NULL, NULL))
    111 		return 0;
    112 
    113 	err = GetLastError();
    114 	if (err == ERROR_BROKEN_PIPE || (err == ERROR_BAD_PIPE && used))
    115 		return 1;
    116 	return 0;
    117 }
    118 
    119 
    120 static void ctrl_flush_broken_pipes(struct ctrl_iface_priv *priv)
    121 {
    122 	struct wpa_ctrl_dst *dst, *next;
    123 
    124 	dst = priv->ctrl_dst;
    125 
    126 	while (dst) {
    127 		next = dst->next;
    128 		if (ctrl_broken_pipe(dst->pipe, dst->used)) {
    129 			wpa_printf(MSG_DEBUG, "CTRL: closing broken pipe %p",
    130 				   dst);
    131 			ctrl_close_pipe(dst);
    132 		}
    133 		dst = next;
    134 	}
    135 }
    136 
    137 
    138 static int ctrl_open_pipe(struct ctrl_iface_priv *priv)
    139 {
    140 	struct wpa_ctrl_dst *dst;
    141 	DWORD err;
    142 	TCHAR name[256];
    143 
    144 	dst = os_zalloc(sizeof(*dst));
    145 	if (dst == NULL)
    146 		return -1;
    147 	wpa_printf(MSG_DEBUG, "CTRL: Open pipe %p", dst);
    148 
    149 	dst->priv = priv;
    150 	dst->debug_level = MSG_INFO;
    151 	dst->pipe = INVALID_HANDLE_VALUE;
    152 
    153 	dst->overlap.hEvent = CreateEvent(NULL, TRUE, TRUE, NULL);
    154 	if (dst->overlap.hEvent == NULL) {
    155 		wpa_printf(MSG_ERROR, "CTRL: CreateEvent failed: %d",
    156 			   (int) GetLastError());
    157 		goto fail;
    158 	}
    159 
    160 	eloop_register_event(dst->overlap.hEvent,
    161 			     sizeof(dst->overlap.hEvent),
    162 			     wpa_supplicant_ctrl_iface_receive, dst, NULL);
    163 
    164 #ifdef UNICODE
    165 	_snwprintf(name, 256, NAMED_PIPE_PREFIX TEXT("-%S"),
    166 		   priv->wpa_s->ifname);
    167 #else /* UNICODE */
    168 	os_snprintf(name, 256, NAMED_PIPE_PREFIX "-%s",
    169 		    priv->wpa_s->ifname);
    170 #endif /* UNICODE */
    171 
    172 	/* TODO: add support for configuring access list for the pipe */
    173 	dst->pipe = CreateNamedPipe(name,
    174 				    PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED,
    175 				    PIPE_TYPE_MESSAGE |
    176 				    PIPE_READMODE_MESSAGE |
    177 				    PIPE_WAIT,
    178 				    15, REPLY_BUFSIZE, REQUEST_BUFSIZE,
    179 				    1000,
    180 				    priv->sec_attr_set ? &priv->attr : NULL);
    181 	if (dst->pipe == INVALID_HANDLE_VALUE) {
    182 		wpa_printf(MSG_ERROR, "CTRL: CreateNamedPipe failed: %d",
    183 			   (int) GetLastError());
    184 		goto fail;
    185 	}
    186 
    187 	if (ConnectNamedPipe(dst->pipe, &dst->overlap)) {
    188 		wpa_printf(MSG_ERROR, "CTRL: ConnectNamedPipe failed: %d",
    189 			   (int) GetLastError());
    190 		CloseHandle(dst->pipe);
    191 		os_free(dst);
    192 		return -1;
    193 	}
    194 
    195 	err = GetLastError();
    196 	switch (err) {
    197 	case ERROR_IO_PENDING:
    198 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe: connection in "
    199 			   "progress");
    200 		break;
    201 	case ERROR_PIPE_CONNECTED:
    202 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe: already "
    203 			   "connected");
    204 		if (SetEvent(dst->overlap.hEvent))
    205 			break;
    206 		/* fall through */
    207 	default:
    208 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe error: %d",
    209 			   (int) err);
    210 		CloseHandle(dst->pipe);
    211 		os_free(dst);
    212 		return -1;
    213 	}
    214 
    215 	dst->next = priv->ctrl_dst;
    216 	if (dst->next)
    217 		dst->next->prev = dst;
    218 	priv->ctrl_dst = dst;
    219 
    220 	return 0;
    221 
    222 fail:
    223 	ctrl_close_pipe(dst);
    224 	return -1;
    225 }
    226 
    227 
    228 static void ctrl_close_pipe(struct wpa_ctrl_dst *dst)
    229 {
    230 	wpa_printf(MSG_DEBUG, "CTRL: close pipe %p", dst);
    231 
    232 	if (dst->overlap.hEvent) {
    233 		eloop_unregister_event(dst->overlap.hEvent,
    234 				       sizeof(dst->overlap.hEvent));
    235 		CloseHandle(dst->overlap.hEvent);
    236 	}
    237 
    238 	if (dst->pipe != INVALID_HANDLE_VALUE) {
    239 		/*
    240 		 * Could use FlushFileBuffers() here to guarantee that all data
    241 		 * gets delivered to the client, but that can block, so let's
    242 		 * not do this for now.
    243 		 * FlushFileBuffers(dst->pipe);
    244 		 */
    245 		CloseHandle(dst->pipe);
    246 	}
    247 
    248 	if (dst->prev)
    249 		dst->prev->next = dst->next;
    250 	else
    251 		dst->priv->ctrl_dst = dst->next;
    252 	if (dst->next)
    253 		dst->next->prev = dst->prev;
    254 
    255 	os_free(dst->rsp_buf);
    256 	os_free(dst);
    257 }
    258 
    259 
    260 static VOID WINAPI ctrl_iface_write_completed(DWORD err, DWORD bytes,
    261 					      LPOVERLAPPED overlap)
    262 {
    263 	struct wpa_ctrl_dst *dst = (struct wpa_ctrl_dst *) overlap;
    264 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped write completed: dst=%p "
    265 		   "err=%d bytes=%d", dst, (int) err, (int) bytes);
    266 	if (err) {
    267 		ctrl_close_pipe(dst);
    268 		return;
    269 	}
    270 
    271 	os_free(dst->rsp_buf);
    272 	dst->rsp_buf = NULL;
    273 
    274 	if (!ReadFileEx(dst->pipe, dst->req_buf, sizeof(dst->req_buf),
    275 			&dst->overlap, ctrl_iface_read_completed)) {
    276 		wpa_printf(MSG_DEBUG, "CTRL: ReadFileEx failed: %d",
    277 			   (int) GetLastError());
    278 		ctrl_close_pipe(dst);
    279 		return;
    280 	}
    281 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped read started for %p", dst);
    282 }
    283 
    284 
    285 static void wpa_supplicant_ctrl_iface_rx(struct wpa_ctrl_dst *dst, size_t len)
    286 {
    287 	struct wpa_supplicant *wpa_s = dst->priv->wpa_s;
    288 	char *reply = NULL, *send_buf;
    289 	size_t reply_len = 0, send_len;
    290 	int new_attached = 0;
    291 	char *buf = dst->req_buf;
    292 
    293 	dst->used = 1;
    294 	if (len >= REQUEST_BUFSIZE)
    295 		len = REQUEST_BUFSIZE - 1;
    296 	buf[len] = '\0';
    297 
    298 	if (os_strcmp(buf, "ATTACH") == 0) {
    299 		dst->attached = 1;
    300 		wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor attached");
    301 		new_attached = 1;
    302 		reply_len = 2;
    303 	} else if (os_strcmp(buf, "DETACH") == 0) {
    304 		dst->attached = 0;
    305 		wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor detached");
    306 		reply_len = 2;
    307 	} else if (os_strncmp(buf, "LEVEL ", 6) == 0) {
    308 		wpa_printf(MSG_DEBUG, "CTRL_IFACE LEVEL %s", buf + 6);
    309 		dst->debug_level = atoi(buf + 6);
    310 		reply_len = 2;
    311 	} else {
    312 		reply = wpa_supplicant_ctrl_iface_process(wpa_s, buf,
    313 							  &reply_len);
    314 	}
    315 
    316 	if (reply) {
    317 		send_buf = reply;
    318 		send_len = reply_len;
    319 	} else if (reply_len == 2) {
    320 		send_buf = "OK\n";
    321 		send_len = 3;
    322 	} else {
    323 		send_buf = "FAIL\n";
    324 		send_len = 5;
    325 	}
    326 
    327 	os_free(dst->rsp_buf);
    328 	dst->rsp_buf = os_malloc(send_len);
    329 	if (dst->rsp_buf == NULL) {
    330 		ctrl_close_pipe(dst);
    331 		os_free(reply);
    332 		return;
    333 	}
    334 	os_memcpy(dst->rsp_buf, send_buf, send_len);
    335 	os_free(reply);
    336 
    337 	if (!WriteFileEx(dst->pipe, dst->rsp_buf, send_len, &dst->overlap,
    338 			 ctrl_iface_write_completed)) {
    339 		wpa_printf(MSG_DEBUG, "CTRL: WriteFileEx failed: %d",
    340 			   (int) GetLastError());
    341 		ctrl_close_pipe(dst);
    342 	} else {
    343 		wpa_printf(MSG_DEBUG, "CTRL: Overlapped write started for %p",
    344 			   dst);
    345 	}
    346 
    347 	if (new_attached)
    348 		eapol_sm_notify_ctrl_attached(wpa_s->eapol);
    349 }
    350 
    351 
    352 static VOID WINAPI ctrl_iface_read_completed(DWORD err, DWORD bytes,
    353 					     LPOVERLAPPED overlap)
    354 {
    355 	struct wpa_ctrl_dst *dst = (struct wpa_ctrl_dst *) overlap;
    356 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped read completed: dst=%p err=%d "
    357 		   "bytes=%d", dst, (int) err, (int) bytes);
    358 	if (err == 0 && bytes > 0)
    359 		wpa_supplicant_ctrl_iface_rx(dst, bytes);
    360 }
    361 
    362 
    363 static void wpa_supplicant_ctrl_iface_receive(void *eloop_data, void *user_ctx)
    364 {
    365 	struct wpa_ctrl_dst *dst = eloop_data;
    366 	struct ctrl_iface_priv *priv = dst->priv;
    367 	DWORD bytes;
    368 
    369 	wpa_printf(MSG_DEBUG, "CTRL: wpa_supplicant_ctrl_iface_receive");
    370 	ResetEvent(dst->overlap.hEvent);
    371 
    372 	if (!GetOverlappedResult(dst->pipe, &dst->overlap, &bytes, FALSE)) {
    373 		wpa_printf(MSG_DEBUG, "CTRL: GetOverlappedResult failed: %d",
    374 			   (int) GetLastError());
    375 		return;
    376 	}
    377 	wpa_printf(MSG_DEBUG, "CTRL: GetOverlappedResult: New client "
    378 		   "connected");
    379 
    380 	/* Open a new named pipe for the next client. */
    381 	ctrl_open_pipe(priv);
    382 
    383 	/* Use write completion function to start reading a command */
    384 	ctrl_iface_write_completed(0, 0, &dst->overlap);
    385 
    386 	ctrl_flush_broken_pipes(priv);
    387 }
    388 
    389 
    390 static int ctrl_iface_parse(struct ctrl_iface_priv *priv, const char *params)
    391 {
    392 	const char *sddl = NULL;
    393 	TCHAR *t_sddl;
    394 
    395 	if (os_strncmp(params, "SDDL=", 5) == 0)
    396 		sddl = params + 5;
    397 	if (!sddl) {
    398 		sddl = os_strstr(params, " SDDL=");
    399 		if (sddl)
    400 			sddl += 6;
    401 	}
    402 
    403 	if (!sddl)
    404 		return 0;
    405 
    406 	wpa_printf(MSG_DEBUG, "CTRL: SDDL='%s'", sddl);
    407 	os_memset(&priv->attr, 0, sizeof(priv->attr));
    408 	priv->attr.nLength = sizeof(priv->attr);
    409 	priv->attr.bInheritHandle = FALSE;
    410 	t_sddl = wpa_strdup_tchar(sddl);
    411 	if (t_sddl == NULL)
    412 		return -1;
    413 	if (!ConvertStringSecurityDescriptorToSecurityDescriptor(
    414 		    t_sddl, SDDL_REVISION_1,
    415 		    (PSECURITY_DESCRIPTOR *) (void *)
    416 		    &priv->attr.lpSecurityDescriptor,
    417 		    NULL)) {
    418 		os_free(t_sddl);
    419 		wpa_printf(MSG_ERROR, "CTRL: SDDL='%s' - could not convert to "
    420 			   "security descriptor: %d",
    421 			   sddl, (int) GetLastError());
    422 		return -1;
    423 	}
    424 	os_free(t_sddl);
    425 
    426 	priv->sec_attr_set = 1;
    427 
    428 	return 0;
    429 }
    430 
    431 
    432 static void wpa_supplicant_ctrl_iface_msg_cb(void *ctx, int level,
    433 					     const char *txt, size_t len)
    434 {
    435 	struct wpa_supplicant *wpa_s = ctx;
    436 	if (wpa_s == NULL || wpa_s->ctrl_iface == NULL)
    437 		return;
    438 	wpa_supplicant_ctrl_iface_send(wpa_s->ctrl_iface, level, txt, len);
    439 }
    440 
    441 
    442 struct ctrl_iface_priv *
    443 wpa_supplicant_ctrl_iface_init(struct wpa_supplicant *wpa_s)
    444 {
    445 	struct ctrl_iface_priv *priv;
    446 
    447 	priv = os_zalloc(sizeof(*priv));
    448 	if (priv == NULL)
    449 		return NULL;
    450 	priv->wpa_s = wpa_s;
    451 
    452 	if (wpa_s->conf->ctrl_interface == NULL)
    453 		return priv;
    454 
    455 	if (ctrl_iface_parse(priv, wpa_s->conf->ctrl_interface) < 0) {
    456 		os_free(priv);
    457 		return NULL;
    458 	}
    459 
    460 	if (ctrl_open_pipe(priv) < 0) {
    461 		os_free(priv);
    462 		return NULL;
    463 	}
    464 
    465 	wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb);
    466 
    467 	return priv;
    468 }
    469 
    470 
    471 void wpa_supplicant_ctrl_iface_deinit(struct ctrl_iface_priv *priv)
    472 {
    473 	while (priv->ctrl_dst)
    474 		ctrl_close_pipe(priv->ctrl_dst);
    475 	if (priv->sec_attr_set)
    476 		LocalFree(priv->attr.lpSecurityDescriptor);
    477 	os_free(priv);
    478 }
    479 
    480 
    481 static void wpa_supplicant_ctrl_iface_send(struct ctrl_iface_priv *priv,
    482 					   int level, const char *buf,
    483 					   size_t len)
    484 {
    485 	struct wpa_ctrl_dst *dst, *next;
    486 	char levelstr[10];
    487 	int idx;
    488 	char *sbuf;
    489 	int llen;
    490 	DWORD written;
    491 
    492 	dst = priv->ctrl_dst;
    493 	if (dst == NULL)
    494 		return;
    495 
    496 	os_snprintf(levelstr, sizeof(levelstr), "<%d>", level);
    497 
    498 	llen = os_strlen(levelstr);
    499 	sbuf = os_malloc(llen + len);
    500 	if (sbuf == NULL)
    501 		return;
    502 
    503 	os_memcpy(sbuf, levelstr, llen);
    504 	os_memcpy(sbuf + llen, buf, len);
    505 
    506 	idx = 0;
    507 	while (dst) {
    508 		next = dst->next;
    509 		if (dst->attached && level >= dst->debug_level) {
    510 			wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor send %p",
    511 				   dst);
    512 			if (!WriteFile(dst->pipe, sbuf, llen + len, &written,
    513 				       NULL)) {
    514 				wpa_printf(MSG_DEBUG, "CTRL: WriteFile to dst "
    515 					   "%p failed: %d",
    516 					   dst, (int) GetLastError());
    517 				dst->errors++;
    518 				if (dst->errors > 10)
    519 					ctrl_close_pipe(dst);
    520 			} else
    521 				dst->errors = 0;
    522 		}
    523 		idx++;
    524 		dst = next;
    525 	}
    526 	os_free(sbuf);
    527 }
    528 
    529 
    530 void wpa_supplicant_ctrl_iface_wait(struct ctrl_iface_priv *priv)
    531 {
    532 	wpa_printf(MSG_DEBUG, "CTRL_IFACE - %s - wait for monitor",
    533 		   priv->wpa_s->ifname);
    534 	if (priv->ctrl_dst == NULL)
    535 		return;
    536 	WaitForSingleObject(priv->ctrl_dst->pipe, INFINITE);
    537 }
    538 
    539 
    540 /* Global ctrl_iface */
    541 
    542 struct ctrl_iface_global_priv;
    543 
    544 struct wpa_global_dst {
    545 	/* Note: OVERLAPPED must be the first member of struct wpa_global_dst
    546 	 */
    547 	OVERLAPPED overlap;
    548 	struct wpa_global_dst *next, *prev;
    549 	struct ctrl_iface_global_priv *priv;
    550 	HANDLE pipe;
    551 	char req_buf[REQUEST_BUFSIZE];
    552 	char *rsp_buf;
    553 	int used;
    554 };
    555 
    556 struct ctrl_iface_global_priv {
    557 	struct wpa_global *global;
    558 	struct wpa_global_dst *ctrl_dst;
    559 };
    560 
    561 
    562 static void global_flush_broken_pipes(struct ctrl_iface_global_priv *priv)
    563 {
    564 	struct wpa_global_dst *dst, *next;
    565 
    566 	dst = priv->ctrl_dst;
    567 
    568 	while (dst) {
    569 		next = dst->next;
    570 		if (ctrl_broken_pipe(dst->pipe, dst->used)) {
    571 			wpa_printf(MSG_DEBUG, "CTRL: closing broken pipe %p",
    572 				   dst);
    573 			global_close_pipe(dst);
    574 		}
    575 		dst = next;
    576 	}
    577 }
    578 
    579 
    580 static int global_open_pipe(struct ctrl_iface_global_priv *priv)
    581 {
    582 	struct wpa_global_dst *dst;
    583 	DWORD err;
    584 
    585 	dst = os_zalloc(sizeof(*dst));
    586 	if (dst == NULL)
    587 		return -1;
    588 	wpa_printf(MSG_DEBUG, "CTRL: Open pipe %p", dst);
    589 
    590 	dst->priv = priv;
    591 	dst->pipe = INVALID_HANDLE_VALUE;
    592 
    593 	dst->overlap.hEvent = CreateEvent(NULL, TRUE, TRUE, NULL);
    594 	if (dst->overlap.hEvent == NULL) {
    595 		wpa_printf(MSG_ERROR, "CTRL: CreateEvent failed: %d",
    596 			   (int) GetLastError());
    597 		goto fail;
    598 	}
    599 
    600 	eloop_register_event(dst->overlap.hEvent,
    601 			     sizeof(dst->overlap.hEvent),
    602 			     wpa_supplicant_global_iface_receive, dst, NULL);
    603 
    604 	/* TODO: add support for configuring access list for the pipe */
    605 	dst->pipe = CreateNamedPipe(NAMED_PIPE_PREFIX,
    606 				    PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED,
    607 				    PIPE_TYPE_MESSAGE |
    608 				    PIPE_READMODE_MESSAGE |
    609 				    PIPE_WAIT,
    610 				    10, REPLY_BUFSIZE, REQUEST_BUFSIZE,
    611 				    1000, NULL);
    612 	if (dst->pipe == INVALID_HANDLE_VALUE) {
    613 		wpa_printf(MSG_ERROR, "CTRL: CreateNamedPipe failed: %d",
    614 			   (int) GetLastError());
    615 		goto fail;
    616 	}
    617 
    618 	if (ConnectNamedPipe(dst->pipe, &dst->overlap)) {
    619 		wpa_printf(MSG_ERROR, "CTRL: ConnectNamedPipe failed: %d",
    620 			   (int) GetLastError());
    621 		CloseHandle(dst->pipe);
    622 		os_free(dst);
    623 		return -1;
    624 	}
    625 
    626 	err = GetLastError();
    627 	switch (err) {
    628 	case ERROR_IO_PENDING:
    629 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe: connection in "
    630 			   "progress");
    631 		break;
    632 	case ERROR_PIPE_CONNECTED:
    633 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe: already "
    634 			   "connected");
    635 		if (SetEvent(dst->overlap.hEvent))
    636 			break;
    637 		/* fall through */
    638 	default:
    639 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe error: %d",
    640 			   (int) err);
    641 		CloseHandle(dst->pipe);
    642 		os_free(dst);
    643 		return -1;
    644 	}
    645 
    646 	dst->next = priv->ctrl_dst;
    647 	if (dst->next)
    648 		dst->next->prev = dst;
    649 	priv->ctrl_dst = dst;
    650 
    651 	return 0;
    652 
    653 fail:
    654 	global_close_pipe(dst);
    655 	return -1;
    656 }
    657 
    658 
    659 static void global_close_pipe(struct wpa_global_dst *dst)
    660 {
    661 	wpa_printf(MSG_DEBUG, "CTRL: close pipe %p", dst);
    662 
    663 	if (dst->overlap.hEvent) {
    664 		eloop_unregister_event(dst->overlap.hEvent,
    665 				       sizeof(dst->overlap.hEvent));
    666 		CloseHandle(dst->overlap.hEvent);
    667 	}
    668 
    669 	if (dst->pipe != INVALID_HANDLE_VALUE) {
    670 		/*
    671 		 * Could use FlushFileBuffers() here to guarantee that all data
    672 		 * gets delivered to the client, but that can block, so let's
    673 		 * not do this for now.
    674 		 * FlushFileBuffers(dst->pipe);
    675 		 */
    676 		CloseHandle(dst->pipe);
    677 	}
    678 
    679 	if (dst->prev)
    680 		dst->prev->next = dst->next;
    681 	else
    682 		dst->priv->ctrl_dst = dst->next;
    683 	if (dst->next)
    684 		dst->next->prev = dst->prev;
    685 
    686 	os_free(dst->rsp_buf);
    687 	os_free(dst);
    688 }
    689 
    690 
    691 static VOID WINAPI global_iface_write_completed(DWORD err, DWORD bytes,
    692 						LPOVERLAPPED overlap)
    693 {
    694 	struct wpa_global_dst *dst = (struct wpa_global_dst *) overlap;
    695 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped write completed: dst=%p "
    696 		   "err=%d bytes=%d", dst, (int) err, (int) bytes);
    697 	if (err) {
    698 		global_close_pipe(dst);
    699 		return;
    700 	}
    701 
    702 	os_free(dst->rsp_buf);
    703 	dst->rsp_buf = NULL;
    704 
    705 	if (!ReadFileEx(dst->pipe, dst->req_buf, sizeof(dst->req_buf),
    706 			&dst->overlap, global_iface_read_completed)) {
    707 		wpa_printf(MSG_DEBUG, "CTRL: ReadFileEx failed: %d",
    708 			   (int) GetLastError());
    709 		global_close_pipe(dst);
    710 		/* FIX: if this was the pipe waiting for new global
    711 		 * connections, at this point there are no open global pipes..
    712 		 * Should try to open a new pipe.. */
    713 		return;
    714 	}
    715 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped read started for %p", dst);
    716 }
    717 
    718 
    719 static void wpa_supplicant_global_iface_rx(struct wpa_global_dst *dst,
    720 					   size_t len)
    721 {
    722 	struct wpa_global *global = dst->priv->global;
    723 	char *reply = NULL, *send_buf;
    724 	size_t reply_len = 0, send_len;
    725 	char *buf = dst->req_buf;
    726 
    727 	dst->used = 1;
    728 	if (len >= REQUEST_BUFSIZE)
    729 		len = REQUEST_BUFSIZE - 1;
    730 	buf[len] = '\0';
    731 
    732 	reply = wpa_supplicant_global_ctrl_iface_process(global, buf,
    733 							 &reply_len);
    734 	if (reply) {
    735 		send_buf = reply;
    736 		send_len = reply_len;
    737 	} else if (reply_len) {
    738 		send_buf = "FAIL\n";
    739 		send_len = 5;
    740 	} else {
    741 		os_free(dst->rsp_buf);
    742 		dst->rsp_buf = NULL;
    743 		return;
    744 	}
    745 
    746 	os_free(dst->rsp_buf);
    747 	dst->rsp_buf = os_malloc(send_len);
    748 	if (dst->rsp_buf == NULL) {
    749 		global_close_pipe(dst);
    750 		os_free(reply);
    751 		return;
    752 	}
    753 	os_memcpy(dst->rsp_buf, send_buf, send_len);
    754 	os_free(reply);
    755 
    756 	if (!WriteFileEx(dst->pipe, dst->rsp_buf, send_len, &dst->overlap,
    757 			 global_iface_write_completed)) {
    758 		wpa_printf(MSG_DEBUG, "CTRL: WriteFileEx failed: %d",
    759 			   (int) GetLastError());
    760 		global_close_pipe(dst);
    761 	} else {
    762 		wpa_printf(MSG_DEBUG, "CTRL: Overlapped write started for %p",
    763 			   dst);
    764 	}
    765 }
    766 
    767 
    768 static VOID WINAPI global_iface_read_completed(DWORD err, DWORD bytes,
    769 					       LPOVERLAPPED overlap)
    770 {
    771 	struct wpa_global_dst *dst = (struct wpa_global_dst *) overlap;
    772 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped read completed: dst=%p err=%d "
    773 		   "bytes=%d", dst, (int) err, (int) bytes);
    774 	if (err == 0 && bytes > 0)
    775 		wpa_supplicant_global_iface_rx(dst, bytes);
    776 }
    777 
    778 
    779 static void wpa_supplicant_global_iface_receive(void *eloop_data,
    780 						void *user_ctx)
    781 {
    782 	struct wpa_global_dst *dst = eloop_data;
    783 	struct ctrl_iface_global_priv *priv = dst->priv;
    784 	DWORD bytes;
    785 
    786 	wpa_printf(MSG_DEBUG, "CTRL: wpa_supplicant_global_iface_receive");
    787 	ResetEvent(dst->overlap.hEvent);
    788 
    789 	if (!GetOverlappedResult(dst->pipe, &dst->overlap, &bytes, FALSE)) {
    790 		wpa_printf(MSG_DEBUG, "CTRL: GetOverlappedResult failed: %d",
    791 			   (int) GetLastError());
    792 		return;
    793 	}
    794 	wpa_printf(MSG_DEBUG, "CTRL: GetOverlappedResult: New client "
    795 		   "connected");
    796 
    797 	/* Open a new named pipe for the next client. */
    798 	if (global_open_pipe(priv) < 0) {
    799 		wpa_printf(MSG_DEBUG, "CTRL: global_open_pipe failed");
    800 		return;
    801 	}
    802 
    803 	/* Use write completion function to start reading a command */
    804 	global_iface_write_completed(0, 0, &dst->overlap);
    805 
    806 	global_flush_broken_pipes(priv);
    807 }
    808 
    809 
    810 struct ctrl_iface_global_priv *
    811 wpa_supplicant_global_ctrl_iface_init(struct wpa_global *global)
    812 {
    813 	struct ctrl_iface_global_priv *priv;
    814 
    815 	priv = os_zalloc(sizeof(*priv));
    816 	if (priv == NULL)
    817 		return NULL;
    818 	priv->global = global;
    819 
    820 	if (global_open_pipe(priv) < 0) {
    821 		os_free(priv);
    822 		return NULL;
    823 	}
    824 
    825 	return priv;
    826 }
    827 
    828 
    829 void
    830 wpa_supplicant_global_ctrl_iface_deinit(struct ctrl_iface_global_priv *priv)
    831 {
    832 	while (priv->ctrl_dst)
    833 		global_close_pipe(priv->ctrl_dst);
    834 	os_free(priv);
    835 }
    836