1 /* 2 * WPA Supplicant / UNIX domain socket -based control interface 3 * Copyright (c) 2004-2014, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 #include <sys/un.h> 11 #include <sys/stat.h> 12 #include <grp.h> 13 #include <stddef.h> 14 #include <unistd.h> 15 #include <fcntl.h> 16 #ifdef ANDROID 17 #include <cutils/sockets.h> 18 #endif /* ANDROID */ 19 20 #include "utils/common.h" 21 #include "utils/eloop.h" 22 #include "utils/list.h" 23 #include "eapol_supp/eapol_supp_sm.h" 24 #include "config.h" 25 #include "wpa_supplicant_i.h" 26 #include "ctrl_iface.h" 27 28 /* Per-interface ctrl_iface */ 29 30 /** 31 * struct wpa_ctrl_dst - Internal data structure of control interface monitors 32 * 33 * This structure is used to store information about registered control 34 * interface monitors into struct wpa_supplicant. This data is private to 35 * ctrl_iface_unix.c and should not be touched directly from other files. 36 */ 37 struct wpa_ctrl_dst { 38 struct dl_list list; 39 struct sockaddr_un addr; 40 socklen_t addrlen; 41 int debug_level; 42 int errors; 43 }; 44 45 46 struct ctrl_iface_priv { 47 struct wpa_supplicant *wpa_s; 48 int sock; 49 struct dl_list ctrl_dst; 50 int android_control_socket; 51 }; 52 53 54 struct ctrl_iface_global_priv { 55 struct wpa_global *global; 56 int sock; 57 struct dl_list ctrl_dst; 58 int android_control_socket; 59 }; 60 61 62 static void wpa_supplicant_ctrl_iface_send(struct wpa_supplicant *wpa_s, 63 const char *ifname, int sock, 64 struct dl_list *ctrl_dst, 65 int level, const char *buf, 66 size_t len, 67 struct ctrl_iface_priv *priv, 68 struct ctrl_iface_global_priv *gp); 69 static int wpas_ctrl_iface_reinit(struct wpa_supplicant *wpa_s, 70 struct ctrl_iface_priv *priv); 71 static int wpas_ctrl_iface_global_reinit(struct wpa_global *global, 72 struct ctrl_iface_global_priv *priv); 73 74 75 static int wpa_supplicant_ctrl_iface_attach(struct dl_list *ctrl_dst, 76 struct sockaddr_un *from, 77 socklen_t fromlen, int global) 78 { 79 struct wpa_ctrl_dst *dst; 80 char addr_txt[200]; 81 82 dst = os_zalloc(sizeof(*dst)); 83 if (dst == NULL) 84 return -1; 85 os_memcpy(&dst->addr, from, sizeof(struct sockaddr_un)); 86 dst->addrlen = fromlen; 87 dst->debug_level = MSG_INFO; 88 dl_list_add(ctrl_dst, &dst->list); 89 printf_encode(addr_txt, sizeof(addr_txt), 90 (u8 *) from->sun_path, 91 fromlen - offsetof(struct sockaddr_un, sun_path)); 92 wpa_printf(MSG_DEBUG, "CTRL_IFACE %smonitor attached %s", 93 global ? "global " : "", addr_txt); 94 return 0; 95 } 96 97 98 static int wpa_supplicant_ctrl_iface_detach(struct dl_list *ctrl_dst, 99 struct sockaddr_un *from, 100 socklen_t fromlen) 101 { 102 struct wpa_ctrl_dst *dst; 103 104 dl_list_for_each(dst, ctrl_dst, struct wpa_ctrl_dst, list) { 105 if (fromlen == dst->addrlen && 106 os_memcmp(from->sun_path, dst->addr.sun_path, 107 fromlen - offsetof(struct sockaddr_un, sun_path)) 108 == 0) { 109 char addr_txt[200]; 110 printf_encode(addr_txt, sizeof(addr_txt), 111 (u8 *) from->sun_path, 112 fromlen - 113 offsetof(struct sockaddr_un, sun_path)); 114 wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor detached %s", 115 addr_txt); 116 dl_list_del(&dst->list); 117 os_free(dst); 118 return 0; 119 } 120 } 121 return -1; 122 } 123 124 125 static int wpa_supplicant_ctrl_iface_level(struct ctrl_iface_priv *priv, 126 struct sockaddr_un *from, 127 socklen_t fromlen, 128 char *level) 129 { 130 struct wpa_ctrl_dst *dst; 131 132 wpa_printf(MSG_DEBUG, "CTRL_IFACE LEVEL %s", level); 133 134 dl_list_for_each(dst, &priv->ctrl_dst, struct wpa_ctrl_dst, list) { 135 if (fromlen == dst->addrlen && 136 os_memcmp(from->sun_path, dst->addr.sun_path, 137 fromlen - offsetof(struct sockaddr_un, sun_path)) 138 == 0) { 139 char addr_txt[200]; 140 dst->debug_level = atoi(level); 141 printf_encode(addr_txt, sizeof(addr_txt), 142 (u8 *) from->sun_path, fromlen - 143 offsetof(struct sockaddr_un, sun_path)); 144 wpa_printf(MSG_DEBUG, "CTRL_IFACE changed monitor level to %d for %s", 145 dst->debug_level, addr_txt); 146 return 0; 147 } 148 } 149 150 return -1; 151 } 152 153 154 static void wpa_supplicant_ctrl_iface_receive(int sock, void *eloop_ctx, 155 void *sock_ctx) 156 { 157 struct wpa_supplicant *wpa_s = eloop_ctx; 158 struct ctrl_iface_priv *priv = sock_ctx; 159 char buf[4096]; 160 int res; 161 struct sockaddr_un from; 162 socklen_t fromlen = sizeof(from); 163 char *reply = NULL, *reply_buf = NULL; 164 size_t reply_len = 0; 165 int new_attached = 0; 166 167 res = recvfrom(sock, buf, sizeof(buf) - 1, 0, 168 (struct sockaddr *) &from, &fromlen); 169 if (res < 0) { 170 wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s", 171 strerror(errno)); 172 return; 173 } 174 buf[res] = '\0'; 175 176 if (os_strcmp(buf, "ATTACH") == 0) { 177 if (wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst, &from, 178 fromlen, 0)) 179 reply_len = 1; 180 else { 181 new_attached = 1; 182 reply_len = 2; 183 } 184 } else if (os_strcmp(buf, "DETACH") == 0) { 185 if (wpa_supplicant_ctrl_iface_detach(&priv->ctrl_dst, &from, 186 fromlen)) 187 reply_len = 1; 188 else 189 reply_len = 2; 190 } else if (os_strncmp(buf, "LEVEL ", 6) == 0) { 191 if (wpa_supplicant_ctrl_iface_level(priv, &from, fromlen, 192 buf + 6)) 193 reply_len = 1; 194 else 195 reply_len = 2; 196 } else { 197 reply_buf = wpa_supplicant_ctrl_iface_process(wpa_s, buf, 198 &reply_len); 199 reply = reply_buf; 200 201 /* 202 * There could be some password/key material in the command, so 203 * clear the buffer explicitly now that it is not needed 204 * anymore. 205 */ 206 os_memset(buf, 0, res); 207 } 208 209 if (!reply && reply_len == 1) { 210 reply = "FAIL\n"; 211 reply_len = 5; 212 } else if (!reply && reply_len == 2) { 213 reply = "OK\n"; 214 reply_len = 3; 215 } 216 217 if (reply) { 218 if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from, 219 fromlen) < 0) { 220 int _errno = errno; 221 wpa_dbg(wpa_s, MSG_DEBUG, 222 "ctrl_iface sendto failed: %d - %s", 223 _errno, strerror(_errno)); 224 if (_errno == ENOBUFS || _errno == EAGAIN) { 225 /* 226 * The socket send buffer could be full. This 227 * may happen if client programs are not 228 * receiving their pending messages. Close and 229 * reopen the socket as a workaround to avoid 230 * getting stuck being unable to send any new 231 * responses. 232 */ 233 sock = wpas_ctrl_iface_reinit(wpa_s, priv); 234 if (sock < 0) { 235 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to reinitialize ctrl_iface socket"); 236 } 237 } 238 if (new_attached) { 239 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to send response to ATTACH - detaching"); 240 new_attached = 0; 241 wpa_supplicant_ctrl_iface_detach( 242 &priv->ctrl_dst, &from, fromlen); 243 } 244 } 245 } 246 os_free(reply_buf); 247 248 if (new_attached) 249 eapol_sm_notify_ctrl_attached(wpa_s->eapol); 250 } 251 252 253 static char * wpa_supplicant_ctrl_iface_path(struct wpa_supplicant *wpa_s) 254 { 255 char *buf; 256 size_t len; 257 char *pbuf, *dir = NULL; 258 int res; 259 260 if (wpa_s->conf->ctrl_interface == NULL) 261 return NULL; 262 263 pbuf = os_strdup(wpa_s->conf->ctrl_interface); 264 if (pbuf == NULL) 265 return NULL; 266 if (os_strncmp(pbuf, "DIR=", 4) == 0) { 267 char *gid_str; 268 dir = pbuf + 4; 269 gid_str = os_strstr(dir, " GROUP="); 270 if (gid_str) 271 *gid_str = '\0'; 272 } else 273 dir = pbuf; 274 275 len = os_strlen(dir) + os_strlen(wpa_s->ifname) + 2; 276 buf = os_malloc(len); 277 if (buf == NULL) { 278 os_free(pbuf); 279 return NULL; 280 } 281 282 res = os_snprintf(buf, len, "%s/%s", dir, wpa_s->ifname); 283 if (os_snprintf_error(len, res)) { 284 os_free(pbuf); 285 os_free(buf); 286 return NULL; 287 } 288 #ifdef __CYGWIN__ 289 { 290 /* Windows/WinPcap uses interface names that are not suitable 291 * as a file name - convert invalid chars to underscores */ 292 char *pos = buf; 293 while (*pos) { 294 if (*pos == '\\') 295 *pos = '_'; 296 pos++; 297 } 298 } 299 #endif /* __CYGWIN__ */ 300 os_free(pbuf); 301 return buf; 302 } 303 304 305 static void wpa_supplicant_ctrl_iface_msg_cb(void *ctx, int level, 306 enum wpa_msg_type type, 307 const char *txt, size_t len) 308 { 309 struct wpa_supplicant *wpa_s = ctx; 310 311 if (wpa_s == NULL) 312 return; 313 314 if (type != WPA_MSG_NO_GLOBAL && wpa_s->global->ctrl_iface) { 315 struct ctrl_iface_global_priv *priv = wpa_s->global->ctrl_iface; 316 if (!dl_list_empty(&priv->ctrl_dst)) { 317 wpa_supplicant_ctrl_iface_send( 318 wpa_s, 319 type == WPA_MSG_GLOBAL ? NULL : wpa_s->ifname, 320 priv->sock, &priv->ctrl_dst, level, txt, len, 321 NULL, priv); 322 } 323 } 324 325 if (wpa_s->ctrl_iface == NULL) 326 return; 327 wpa_supplicant_ctrl_iface_send(wpa_s, NULL, wpa_s->ctrl_iface->sock, 328 &wpa_s->ctrl_iface->ctrl_dst, 329 level, txt, len, wpa_s->ctrl_iface, 330 NULL); 331 } 332 333 334 static int wpas_ctrl_iface_open_sock(struct wpa_supplicant *wpa_s, 335 struct ctrl_iface_priv *priv) 336 { 337 struct sockaddr_un addr; 338 char *fname = NULL; 339 gid_t gid = 0; 340 int gid_set = 0; 341 char *buf, *dir = NULL, *gid_str = NULL; 342 struct group *grp; 343 char *endp; 344 int flags; 345 346 buf = os_strdup(wpa_s->conf->ctrl_interface); 347 if (buf == NULL) 348 goto fail; 349 #ifdef ANDROID 350 os_snprintf(addr.sun_path, sizeof(addr.sun_path), "wpa_%s", 351 wpa_s->conf->ctrl_interface); 352 priv->sock = android_get_control_socket(addr.sun_path); 353 if (priv->sock >= 0) { 354 priv->android_control_socket = 1; 355 goto havesock; 356 } 357 #endif /* ANDROID */ 358 if (os_strncmp(buf, "DIR=", 4) == 0) { 359 dir = buf + 4; 360 gid_str = os_strstr(dir, " GROUP="); 361 if (gid_str) { 362 *gid_str = '\0'; 363 gid_str += 7; 364 } 365 } else { 366 dir = buf; 367 gid_str = wpa_s->conf->ctrl_interface_group; 368 } 369 370 if (mkdir(dir, S_IRWXU | S_IRWXG) < 0) { 371 if (errno == EEXIST) { 372 wpa_printf(MSG_DEBUG, "Using existing control " 373 "interface directory."); 374 } else { 375 wpa_printf(MSG_ERROR, "mkdir[ctrl_interface=%s]: %s", 376 dir, strerror(errno)); 377 goto fail; 378 } 379 } 380 381 #ifdef ANDROID 382 /* 383 * wpa_supplicant is started from /init.*.rc on Android and that seems 384 * to be using umask 0077 which would leave the control interface 385 * directory without group access. This breaks things since Wi-Fi 386 * framework assumes that this directory can be accessed by other 387 * applications in the wifi group. Fix this by adding group access even 388 * if umask value would prevent this. 389 */ 390 if (chmod(dir, S_IRWXU | S_IRWXG) < 0) { 391 wpa_printf(MSG_ERROR, "CTRL: Could not chmod directory: %s", 392 strerror(errno)); 393 /* Try to continue anyway */ 394 } 395 #endif /* ANDROID */ 396 397 if (gid_str) { 398 grp = getgrnam(gid_str); 399 if (grp) { 400 gid = grp->gr_gid; 401 gid_set = 1; 402 wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d" 403 " (from group name '%s')", 404 (int) gid, gid_str); 405 } else { 406 /* Group name not found - try to parse this as gid */ 407 gid = strtol(gid_str, &endp, 10); 408 if (*gid_str == '\0' || *endp != '\0') { 409 wpa_printf(MSG_ERROR, "CTRL: Invalid group " 410 "'%s'", gid_str); 411 goto fail; 412 } 413 gid_set = 1; 414 wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d", 415 (int) gid); 416 } 417 } 418 419 if (gid_set && chown(dir, -1, gid) < 0) { 420 wpa_printf(MSG_ERROR, "chown[ctrl_interface=%s,gid=%d]: %s", 421 dir, (int) gid, strerror(errno)); 422 goto fail; 423 } 424 425 /* Make sure the group can enter and read the directory */ 426 if (gid_set && 427 chmod(dir, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP) < 0) { 428 wpa_printf(MSG_ERROR, "CTRL: chmod[ctrl_interface]: %s", 429 strerror(errno)); 430 goto fail; 431 } 432 433 if (os_strlen(dir) + 1 + os_strlen(wpa_s->ifname) >= 434 sizeof(addr.sun_path)) { 435 wpa_printf(MSG_ERROR, "ctrl_iface path limit exceeded"); 436 goto fail; 437 } 438 439 priv->sock = socket(PF_UNIX, SOCK_DGRAM, 0); 440 if (priv->sock < 0) { 441 wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno)); 442 goto fail; 443 } 444 445 os_memset(&addr, 0, sizeof(addr)); 446 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) 447 addr.sun_len = sizeof(addr); 448 #endif /* __FreeBSD__ */ 449 addr.sun_family = AF_UNIX; 450 fname = wpa_supplicant_ctrl_iface_path(wpa_s); 451 if (fname == NULL) 452 goto fail; 453 os_strlcpy(addr.sun_path, fname, sizeof(addr.sun_path)); 454 if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) { 455 wpa_printf(MSG_DEBUG, "ctrl_iface bind(PF_UNIX) failed: %s", 456 strerror(errno)); 457 if (connect(priv->sock, (struct sockaddr *) &addr, 458 sizeof(addr)) < 0) { 459 wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not" 460 " allow connections - assuming it was left" 461 "over from forced program termination"); 462 if (unlink(fname) < 0) { 463 wpa_printf(MSG_ERROR, 464 "Could not unlink existing ctrl_iface socket '%s': %s", 465 fname, strerror(errno)); 466 goto fail; 467 } 468 if (bind(priv->sock, (struct sockaddr *) &addr, 469 sizeof(addr)) < 0) { 470 wpa_printf(MSG_ERROR, "supp-ctrl-iface-init: bind(PF_UNIX): %s", 471 strerror(errno)); 472 goto fail; 473 } 474 wpa_printf(MSG_DEBUG, "Successfully replaced leftover " 475 "ctrl_iface socket '%s'", fname); 476 } else { 477 wpa_printf(MSG_INFO, "ctrl_iface exists and seems to " 478 "be in use - cannot override it"); 479 wpa_printf(MSG_INFO, "Delete '%s' manually if it is " 480 "not used anymore", fname); 481 os_free(fname); 482 fname = NULL; 483 goto fail; 484 } 485 } 486 487 if (gid_set && chown(fname, -1, gid) < 0) { 488 wpa_printf(MSG_ERROR, "chown[ctrl_interface=%s,gid=%d]: %s", 489 fname, (int) gid, strerror(errno)); 490 goto fail; 491 } 492 493 if (chmod(fname, S_IRWXU | S_IRWXG) < 0) { 494 wpa_printf(MSG_ERROR, "chmod[ctrl_interface=%s]: %s", 495 fname, strerror(errno)); 496 goto fail; 497 } 498 os_free(fname); 499 500 #ifdef ANDROID 501 havesock: 502 #endif /* ANDROID */ 503 504 /* 505 * Make socket non-blocking so that we don't hang forever if 506 * target dies unexpectedly. 507 */ 508 flags = fcntl(priv->sock, F_GETFL); 509 if (flags >= 0) { 510 flags |= O_NONBLOCK; 511 if (fcntl(priv->sock, F_SETFL, flags) < 0) { 512 wpa_printf(MSG_INFO, "fcntl(ctrl, O_NONBLOCK): %s", 513 strerror(errno)); 514 /* Not fatal, continue on.*/ 515 } 516 } 517 518 eloop_register_read_sock(priv->sock, wpa_supplicant_ctrl_iface_receive, 519 wpa_s, priv); 520 wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb); 521 522 os_free(buf); 523 return 0; 524 525 fail: 526 if (priv->sock >= 0) { 527 close(priv->sock); 528 priv->sock = -1; 529 } 530 if (fname) { 531 unlink(fname); 532 os_free(fname); 533 } 534 os_free(buf); 535 return -1; 536 } 537 538 539 struct ctrl_iface_priv * 540 wpa_supplicant_ctrl_iface_init(struct wpa_supplicant *wpa_s) 541 { 542 struct ctrl_iface_priv *priv; 543 544 priv = os_zalloc(sizeof(*priv)); 545 if (priv == NULL) 546 return NULL; 547 dl_list_init(&priv->ctrl_dst); 548 priv->wpa_s = wpa_s; 549 priv->sock = -1; 550 551 if (wpa_s->conf->ctrl_interface == NULL) 552 return priv; 553 554 if (wpas_ctrl_iface_open_sock(wpa_s, priv) < 0) { 555 os_free(priv); 556 return NULL; 557 } 558 559 return priv; 560 } 561 562 563 static int wpas_ctrl_iface_reinit(struct wpa_supplicant *wpa_s, 564 struct ctrl_iface_priv *priv) 565 { 566 int res; 567 568 if (priv->sock <= 0) 569 return -1; 570 571 /* 572 * On Android, the control socket being used may be the socket 573 * that is created when wpa_supplicant is started as a /init.*.rc 574 * service. Such a socket is maintained as a key-value pair in 575 * Android's environment. Closing this control socket would leave us 576 * in a bad state with an invalid socket descriptor. 577 */ 578 if (priv->android_control_socket) 579 return priv->sock; 580 581 eloop_unregister_read_sock(priv->sock); 582 close(priv->sock); 583 priv->sock = -1; 584 res = wpas_ctrl_iface_open_sock(wpa_s, priv); 585 if (res < 0) 586 return -1; 587 return priv->sock; 588 } 589 590 591 void wpa_supplicant_ctrl_iface_deinit(struct ctrl_iface_priv *priv) 592 { 593 struct wpa_ctrl_dst *dst, *prev; 594 595 if (priv->sock > -1) { 596 char *fname; 597 char *buf, *dir = NULL; 598 eloop_unregister_read_sock(priv->sock); 599 if (!dl_list_empty(&priv->ctrl_dst)) { 600 /* 601 * Wait before closing the control socket if 602 * there are any attached monitors in order to allow 603 * them to receive any pending messages. 604 */ 605 wpa_printf(MSG_DEBUG, "CTRL_IFACE wait for attached " 606 "monitors to receive messages"); 607 os_sleep(0, 100000); 608 } 609 close(priv->sock); 610 priv->sock = -1; 611 fname = wpa_supplicant_ctrl_iface_path(priv->wpa_s); 612 if (fname) { 613 unlink(fname); 614 os_free(fname); 615 } 616 617 if (priv->wpa_s->conf->ctrl_interface == NULL) 618 goto free_dst; 619 buf = os_strdup(priv->wpa_s->conf->ctrl_interface); 620 if (buf == NULL) 621 goto free_dst; 622 if (os_strncmp(buf, "DIR=", 4) == 0) { 623 char *gid_str; 624 dir = buf + 4; 625 gid_str = os_strstr(dir, " GROUP="); 626 if (gid_str) 627 *gid_str = '\0'; 628 } else 629 dir = buf; 630 631 if (rmdir(dir) < 0) { 632 if (errno == ENOTEMPTY) { 633 wpa_printf(MSG_DEBUG, "Control interface " 634 "directory not empty - leaving it " 635 "behind"); 636 } else { 637 wpa_printf(MSG_ERROR, 638 "rmdir[ctrl_interface=%s]: %s", 639 dir, strerror(errno)); 640 } 641 } 642 os_free(buf); 643 } 644 645 free_dst: 646 dl_list_for_each_safe(dst, prev, &priv->ctrl_dst, struct wpa_ctrl_dst, 647 list) 648 os_free(dst); 649 os_free(priv); 650 } 651 652 653 /** 654 * wpa_supplicant_ctrl_iface_send - Send a control interface packet to monitors 655 * @ifname: Interface name for global control socket or %NULL 656 * @sock: Local socket fd 657 * @ctrl_dst: List of attached listeners 658 * @level: Priority level of the message 659 * @buf: Message data 660 * @len: Message length 661 * 662 * Send a packet to all monitor programs attached to the control interface. 663 */ 664 static void wpa_supplicant_ctrl_iface_send(struct wpa_supplicant *wpa_s, 665 const char *ifname, int sock, 666 struct dl_list *ctrl_dst, 667 int level, const char *buf, 668 size_t len, 669 struct ctrl_iface_priv *priv, 670 struct ctrl_iface_global_priv *gp) 671 { 672 struct wpa_ctrl_dst *dst, *next; 673 char levelstr[10]; 674 int idx, res; 675 struct msghdr msg; 676 struct iovec io[5]; 677 678 if (sock < 0 || dl_list_empty(ctrl_dst)) 679 return; 680 681 res = os_snprintf(levelstr, sizeof(levelstr), "<%d>", level); 682 if (os_snprintf_error(sizeof(levelstr), res)) 683 return; 684 idx = 0; 685 if (ifname) { 686 io[idx].iov_base = "IFNAME="; 687 io[idx].iov_len = 7; 688 idx++; 689 io[idx].iov_base = (char *) ifname; 690 io[idx].iov_len = os_strlen(ifname); 691 idx++; 692 io[idx].iov_base = " "; 693 io[idx].iov_len = 1; 694 idx++; 695 } 696 io[idx].iov_base = levelstr; 697 io[idx].iov_len = os_strlen(levelstr); 698 idx++; 699 io[idx].iov_base = (char *) buf; 700 io[idx].iov_len = len; 701 idx++; 702 os_memset(&msg, 0, sizeof(msg)); 703 msg.msg_iov = io; 704 msg.msg_iovlen = idx; 705 706 dl_list_for_each_safe(dst, next, ctrl_dst, struct wpa_ctrl_dst, list) { 707 int _errno; 708 char addr_txt[200]; 709 710 if (level < dst->debug_level) 711 continue; 712 713 printf_encode(addr_txt, sizeof(addr_txt), 714 (u8 *) dst->addr.sun_path, dst->addrlen - 715 offsetof(struct sockaddr_un, sun_path)); 716 msg.msg_name = (void *) &dst->addr; 717 msg.msg_namelen = dst->addrlen; 718 if (sendmsg(sock, &msg, MSG_DONTWAIT) >= 0) { 719 wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor sent successfully to %s", 720 addr_txt); 721 dst->errors = 0; 722 continue; 723 } 724 725 _errno = errno; 726 wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor[%s]: %d - %s", 727 addr_txt, errno, strerror(errno)); 728 dst->errors++; 729 730 if (dst->errors > 10 || _errno == ENOENT || _errno == EPERM) { 731 wpa_printf(MSG_INFO, "CTRL_IFACE: Detach monitor %s that cannot receive messages", 732 addr_txt); 733 wpa_supplicant_ctrl_iface_detach(ctrl_dst, &dst->addr, 734 dst->addrlen); 735 } 736 737 if (_errno == ENOBUFS || _errno == EAGAIN) { 738 /* 739 * The socket send buffer could be full. This may happen 740 * if client programs are not receiving their pending 741 * messages. Close and reopen the socket as a workaround 742 * to avoid getting stuck being unable to send any new 743 * responses. 744 */ 745 if (priv) 746 sock = wpas_ctrl_iface_reinit(wpa_s, priv); 747 else if (gp) 748 sock = wpas_ctrl_iface_global_reinit( 749 wpa_s->global, gp); 750 else 751 break; 752 if (sock < 0) { 753 wpa_dbg(wpa_s, MSG_DEBUG, 754 "Failed to reinitialize ctrl_iface socket"); 755 break; 756 } 757 } 758 } 759 } 760 761 762 void wpa_supplicant_ctrl_iface_wait(struct ctrl_iface_priv *priv) 763 { 764 char buf[256]; 765 int res; 766 struct sockaddr_un from; 767 socklen_t fromlen = sizeof(from); 768 769 for (;;) { 770 wpa_printf(MSG_DEBUG, "CTRL_IFACE - %s - wait for monitor to " 771 "attach", priv->wpa_s->ifname); 772 eloop_wait_for_read_sock(priv->sock); 773 774 res = recvfrom(priv->sock, buf, sizeof(buf) - 1, 0, 775 (struct sockaddr *) &from, &fromlen); 776 if (res < 0) { 777 wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s", 778 strerror(errno)); 779 continue; 780 } 781 buf[res] = '\0'; 782 783 if (os_strcmp(buf, "ATTACH") == 0) { 784 /* handle ATTACH signal of first monitor interface */ 785 if (!wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst, 786 &from, fromlen, 787 0)) { 788 if (sendto(priv->sock, "OK\n", 3, 0, 789 (struct sockaddr *) &from, fromlen) < 790 0) { 791 wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s", 792 strerror(errno)); 793 } 794 /* OK to continue */ 795 return; 796 } else { 797 if (sendto(priv->sock, "FAIL\n", 5, 0, 798 (struct sockaddr *) &from, fromlen) < 799 0) { 800 wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s", 801 strerror(errno)); 802 } 803 } 804 } else { 805 /* return FAIL for all other signals */ 806 if (sendto(priv->sock, "FAIL\n", 5, 0, 807 (struct sockaddr *) &from, fromlen) < 0) { 808 wpa_printf(MSG_DEBUG, 809 "ctrl_iface sendto failed: %s", 810 strerror(errno)); 811 } 812 } 813 } 814 } 815 816 817 /* Global ctrl_iface */ 818 819 static void wpa_supplicant_global_ctrl_iface_receive(int sock, void *eloop_ctx, 820 void *sock_ctx) 821 { 822 struct wpa_global *global = eloop_ctx; 823 struct ctrl_iface_global_priv *priv = sock_ctx; 824 char buf[4096]; 825 int res; 826 struct sockaddr_un from; 827 socklen_t fromlen = sizeof(from); 828 char *reply = NULL, *reply_buf = NULL; 829 size_t reply_len; 830 831 res = recvfrom(sock, buf, sizeof(buf) - 1, 0, 832 (struct sockaddr *) &from, &fromlen); 833 if (res < 0) { 834 wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s", 835 strerror(errno)); 836 return; 837 } 838 buf[res] = '\0'; 839 840 if (os_strcmp(buf, "ATTACH") == 0) { 841 if (wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst, &from, 842 fromlen, 1)) 843 reply_len = 1; 844 else 845 reply_len = 2; 846 } else if (os_strcmp(buf, "DETACH") == 0) { 847 if (wpa_supplicant_ctrl_iface_detach(&priv->ctrl_dst, &from, 848 fromlen)) 849 reply_len = 1; 850 else 851 reply_len = 2; 852 } else { 853 reply_buf = wpa_supplicant_global_ctrl_iface_process( 854 global, buf, &reply_len); 855 reply = reply_buf; 856 857 /* 858 * There could be some password/key material in the command, so 859 * clear the buffer explicitly now that it is not needed 860 * anymore. 861 */ 862 os_memset(buf, 0, res); 863 } 864 865 if (!reply && reply_len == 1) { 866 reply = "FAIL\n"; 867 reply_len = 5; 868 } else if (!reply && reply_len == 2) { 869 reply = "OK\n"; 870 reply_len = 3; 871 } 872 873 if (reply) { 874 if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from, 875 fromlen) < 0) { 876 wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s", 877 strerror(errno)); 878 } 879 } 880 os_free(reply_buf); 881 } 882 883 884 static int wpas_global_ctrl_iface_open_sock(struct wpa_global *global, 885 struct ctrl_iface_global_priv *priv) 886 { 887 struct sockaddr_un addr; 888 const char *ctrl = global->params.ctrl_interface; 889 int flags; 890 891 wpa_printf(MSG_DEBUG, "Global control interface '%s'", ctrl); 892 893 #ifdef ANDROID 894 if (os_strncmp(ctrl, "@android:", 9) == 0) { 895 priv->sock = android_get_control_socket(ctrl + 9); 896 if (priv->sock < 0) { 897 wpa_printf(MSG_ERROR, "Failed to open Android control " 898 "socket '%s'", ctrl + 9); 899 goto fail; 900 } 901 wpa_printf(MSG_DEBUG, "Using Android control socket '%s'", 902 ctrl + 9); 903 priv->android_control_socket = 1; 904 goto havesock; 905 } 906 907 if (os_strncmp(ctrl, "@abstract:", 10) != 0) { 908 /* 909 * Backwards compatibility - try to open an Android control 910 * socket and if that fails, assume this was a UNIX domain 911 * socket instead. 912 */ 913 priv->sock = android_get_control_socket(ctrl); 914 if (priv->sock >= 0) { 915 wpa_printf(MSG_DEBUG, 916 "Using Android control socket '%s'", 917 ctrl); 918 priv->android_control_socket = 1; 919 goto havesock; 920 } 921 } 922 #endif /* ANDROID */ 923 924 priv->sock = socket(PF_UNIX, SOCK_DGRAM, 0); 925 if (priv->sock < 0) { 926 wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno)); 927 goto fail; 928 } 929 930 os_memset(&addr, 0, sizeof(addr)); 931 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) 932 addr.sun_len = sizeof(addr); 933 #endif /* __FreeBSD__ */ 934 addr.sun_family = AF_UNIX; 935 936 if (os_strncmp(ctrl, "@abstract:", 10) == 0) { 937 addr.sun_path[0] = '\0'; 938 os_strlcpy(addr.sun_path + 1, ctrl + 10, 939 sizeof(addr.sun_path) - 1); 940 if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 941 0) { 942 wpa_printf(MSG_ERROR, "supp-global-ctrl-iface-init: " 943 "bind(PF_UNIX;%s) failed: %s", 944 ctrl, strerror(errno)); 945 goto fail; 946 } 947 wpa_printf(MSG_DEBUG, "Using Abstract control socket '%s'", 948 ctrl + 10); 949 goto havesock; 950 } 951 952 os_strlcpy(addr.sun_path, ctrl, sizeof(addr.sun_path)); 953 if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) { 954 wpa_printf(MSG_INFO, "supp-global-ctrl-iface-init(%s) (will try fixup): bind(PF_UNIX): %s", 955 ctrl, strerror(errno)); 956 if (connect(priv->sock, (struct sockaddr *) &addr, 957 sizeof(addr)) < 0) { 958 wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not" 959 " allow connections - assuming it was left" 960 "over from forced program termination"); 961 if (unlink(ctrl) < 0) { 962 wpa_printf(MSG_ERROR, 963 "Could not unlink existing ctrl_iface socket '%s': %s", 964 ctrl, strerror(errno)); 965 goto fail; 966 } 967 if (bind(priv->sock, (struct sockaddr *) &addr, 968 sizeof(addr)) < 0) { 969 wpa_printf(MSG_ERROR, "supp-glb-iface-init: bind(PF_UNIX;%s): %s", 970 ctrl, strerror(errno)); 971 goto fail; 972 } 973 wpa_printf(MSG_DEBUG, "Successfully replaced leftover " 974 "ctrl_iface socket '%s'", 975 ctrl); 976 } else { 977 wpa_printf(MSG_INFO, "ctrl_iface exists and seems to " 978 "be in use - cannot override it"); 979 wpa_printf(MSG_INFO, "Delete '%s' manually if it is " 980 "not used anymore", 981 ctrl); 982 goto fail; 983 } 984 } 985 986 wpa_printf(MSG_DEBUG, "Using UNIX control socket '%s'", ctrl); 987 988 if (global->params.ctrl_interface_group) { 989 char *gid_str = global->params.ctrl_interface_group; 990 gid_t gid = 0; 991 struct group *grp; 992 char *endp; 993 994 grp = getgrnam(gid_str); 995 if (grp) { 996 gid = grp->gr_gid; 997 wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d" 998 " (from group name '%s')", 999 (int) gid, gid_str); 1000 } else { 1001 /* Group name not found - try to parse this as gid */ 1002 gid = strtol(gid_str, &endp, 10); 1003 if (*gid_str == '\0' || *endp != '\0') { 1004 wpa_printf(MSG_ERROR, "CTRL: Invalid group " 1005 "'%s'", gid_str); 1006 goto fail; 1007 } 1008 wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d", 1009 (int) gid); 1010 } 1011 if (chown(ctrl, -1, gid) < 0) { 1012 wpa_printf(MSG_ERROR, 1013 "chown[global_ctrl_interface=%s,gid=%d]: %s", 1014 ctrl, (int) gid, strerror(errno)); 1015 goto fail; 1016 } 1017 1018 if (chmod(ctrl, S_IRWXU | S_IRWXG) < 0) { 1019 wpa_printf(MSG_ERROR, 1020 "chmod[global_ctrl_interface=%s]: %s", 1021 ctrl, strerror(errno)); 1022 goto fail; 1023 } 1024 } else { 1025 if (chmod(ctrl, S_IRWXU) < 0) { 1026 wpa_printf(MSG_DEBUG, 1027 "chmod[global_ctrl_interface=%s](S_IRWXU): %s", 1028 ctrl, strerror(errno)); 1029 /* continue anyway since group change was not required 1030 */ 1031 } 1032 } 1033 1034 havesock: 1035 1036 /* 1037 * Make socket non-blocking so that we don't hang forever if 1038 * target dies unexpectedly. 1039 */ 1040 flags = fcntl(priv->sock, F_GETFL); 1041 if (flags >= 0) { 1042 flags |= O_NONBLOCK; 1043 if (fcntl(priv->sock, F_SETFL, flags) < 0) { 1044 wpa_printf(MSG_INFO, "fcntl(ctrl, O_NONBLOCK): %s", 1045 strerror(errno)); 1046 /* Not fatal, continue on.*/ 1047 } 1048 } 1049 1050 eloop_register_read_sock(priv->sock, 1051 wpa_supplicant_global_ctrl_iface_receive, 1052 global, priv); 1053 1054 return 0; 1055 1056 fail: 1057 if (priv->sock >= 0) { 1058 close(priv->sock); 1059 priv->sock = -1; 1060 } 1061 return -1; 1062 } 1063 1064 1065 struct ctrl_iface_global_priv * 1066 wpa_supplicant_global_ctrl_iface_init(struct wpa_global *global) 1067 { 1068 struct ctrl_iface_global_priv *priv; 1069 1070 priv = os_zalloc(sizeof(*priv)); 1071 if (priv == NULL) 1072 return NULL; 1073 dl_list_init(&priv->ctrl_dst); 1074 priv->global = global; 1075 priv->sock = -1; 1076 1077 if (global->params.ctrl_interface == NULL) 1078 return priv; 1079 1080 if (wpas_global_ctrl_iface_open_sock(global, priv) < 0) { 1081 os_free(priv); 1082 return NULL; 1083 } 1084 1085 wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb); 1086 1087 return priv; 1088 } 1089 1090 1091 static int wpas_ctrl_iface_global_reinit(struct wpa_global *global, 1092 struct ctrl_iface_global_priv *priv) 1093 { 1094 int res; 1095 1096 if (priv->sock <= 0) 1097 return -1; 1098 1099 /* 1100 * On Android, the control socket being used may be the socket 1101 * that is created when wpa_supplicant is started as a /init.*.rc 1102 * service. Such a socket is maintained as a key-value pair in 1103 * Android's environment. Closing this control socket would leave us 1104 * in a bad state with an invalid socket descriptor. 1105 */ 1106 if (priv->android_control_socket) 1107 return priv->sock; 1108 1109 eloop_unregister_read_sock(priv->sock); 1110 close(priv->sock); 1111 priv->sock = -1; 1112 res = wpas_global_ctrl_iface_open_sock(global, priv); 1113 if (res < 0) 1114 return -1; 1115 return priv->sock; 1116 } 1117 1118 1119 void 1120 wpa_supplicant_global_ctrl_iface_deinit(struct ctrl_iface_global_priv *priv) 1121 { 1122 struct wpa_ctrl_dst *dst, *prev; 1123 1124 if (priv->sock >= 0) { 1125 eloop_unregister_read_sock(priv->sock); 1126 close(priv->sock); 1127 } 1128 if (priv->global->params.ctrl_interface) 1129 unlink(priv->global->params.ctrl_interface); 1130 dl_list_for_each_safe(dst, prev, &priv->ctrl_dst, struct wpa_ctrl_dst, 1131 list) 1132 os_free(dst); 1133 os_free(priv); 1134 } 1135
