1 /*
2  * WPA Supplicant / UNIX domain socket -based control interface
3  * Copyright (c) 2004-2014, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 #include <sys/un.h>
11 #include <sys/stat.h>
12 #include <grp.h>
13 #include <stddef.h>
14 #include <unistd.h>
15 #include <fcntl.h>
16 #ifdef __linux__
17 #include <sys/ioctl.h>
18 #endif /* __linux__ */
19 #ifdef ANDROID
20 #include <cutils/sockets.h>
21 #endif /* ANDROID */
22 
23 #include "utils/common.h"
24 #include "utils/eloop.h"
25 #include "utils/list.h"
26 #include "common/ctrl_iface_common.h"
27 #include "eapol_supp/eapol_supp_sm.h"
28 #include "config.h"
29 #include "wpa_supplicant_i.h"
30 #include "ctrl_iface.h"
31 
32 /* Per-interface ctrl_iface */
33 
34 struct ctrl_iface_priv {
35 	struct wpa_supplicant *wpa_s;
36 	int sock;
37 	struct dl_list ctrl_dst;
38 	int android_control_socket;
39 	struct dl_list msg_queue;
40 	unsigned int throttle_count;
41 };
42 
43 
44 struct ctrl_iface_global_priv {
45 	struct wpa_global *global;
46 	int sock;
47 	struct dl_list ctrl_dst;
48 	int android_control_socket;
49 	struct dl_list msg_queue;
50 	unsigned int throttle_count;
51 };
52 
53 struct ctrl_iface_msg {
54 	struct dl_list list;
55 	struct wpa_supplicant *wpa_s;
56 	int level;
57 	enum wpa_msg_type type;
58 	const char *txt;
59 	size_t len;
60 };
61 
62 
63 static void wpa_supplicant_ctrl_iface_send(struct wpa_supplicant *wpa_s,
64 					   const char *ifname, int sock,
65 					   struct dl_list *ctrl_dst,
66 					   int level, const char *buf,
67 					   size_t len,
68 					   struct ctrl_iface_priv *priv,
69 					   struct ctrl_iface_global_priv *gp);
70 static int wpas_ctrl_iface_reinit(struct wpa_supplicant *wpa_s,
71 				  struct ctrl_iface_priv *priv);
72 static int wpas_ctrl_iface_global_reinit(struct wpa_global *global,
73 					 struct ctrl_iface_global_priv *priv);
74 
75 
wpas_ctrl_sock_debug(const char * title,int sock,const char * buf,size_t len)76 static void wpas_ctrl_sock_debug(const char *title, int sock, const char *buf,
77 				 size_t len)
78 {
79 #ifdef __linux__
80 	socklen_t optlen;
81 	int sndbuf, outq;
82 	int level = MSG_MSGDUMP;
83 
84 	if (len >= 5 && os_strncmp(buf, "PONG\n", 5) == 0)
85 		level = MSG_EXCESSIVE;
86 
87 	optlen = sizeof(sndbuf);
88 	sndbuf = 0;
89 	if (getsockopt(sock, SOL_SOCKET, SO_SNDBUF, &sndbuf, &optlen) < 0)
90 		sndbuf = -1;
91 
92 	if (ioctl(sock, TIOCOUTQ, &outq) < 0)
93 		outq = -1;
94 
95 	wpa_printf(level,
96 		   "CTRL-DEBUG: %s: sock=%d sndbuf=%d outq=%d send_len=%d",
97 		   title, sock, sndbuf, outq, (int) len);
98 #endif /* __linux__ */
99 }
100 
101 
wpa_supplicant_ctrl_iface_attach(struct dl_list * ctrl_dst,struct sockaddr_storage * from,socklen_t fromlen,int global)102 static int wpa_supplicant_ctrl_iface_attach(struct dl_list *ctrl_dst,
103 					    struct sockaddr_storage *from,
104 					    socklen_t fromlen, int global)
105 {
106 	return ctrl_iface_attach(ctrl_dst, from, fromlen, NULL);
107 }
108 
109 
wpa_supplicant_ctrl_iface_detach(struct dl_list * ctrl_dst,struct sockaddr_storage * from,socklen_t fromlen)110 static int wpa_supplicant_ctrl_iface_detach(struct dl_list *ctrl_dst,
111 					    struct sockaddr_storage *from,
112 					    socklen_t fromlen)
113 {
114 	return ctrl_iface_detach(ctrl_dst, from, fromlen);
115 }
116 
117 
wpa_supplicant_ctrl_iface_level(struct ctrl_iface_priv * priv,struct sockaddr_storage * from,socklen_t fromlen,char * level)118 static int wpa_supplicant_ctrl_iface_level(struct ctrl_iface_priv *priv,
119 					   struct sockaddr_storage *from,
120 					   socklen_t fromlen,
121 					   char *level)
122 {
123 	wpa_printf(MSG_DEBUG, "CTRL_IFACE LEVEL %s", level);
124 
125 	return ctrl_iface_level(&priv->ctrl_dst, from, fromlen, level);
126 }
127 
128 
wpa_supplicant_ctrl_iface_receive(int sock,void * eloop_ctx,void * sock_ctx)129 static void wpa_supplicant_ctrl_iface_receive(int sock, void *eloop_ctx,
130 					      void *sock_ctx)
131 {
132 	struct wpa_supplicant *wpa_s = eloop_ctx;
133 	struct ctrl_iface_priv *priv = sock_ctx;
134 	char buf[4096];
135 	int res;
136 	struct sockaddr_storage from;
137 	socklen_t fromlen = sizeof(from);
138 	char *reply = NULL, *reply_buf = NULL;
139 	size_t reply_len = 0;
140 	int new_attached = 0;
141 
142 	res = recvfrom(sock, buf, sizeof(buf) - 1, 0,
143 		       (struct sockaddr *) &from, &fromlen);
144 	if (res < 0) {
145 		wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s",
146 			   strerror(errno));
147 		return;
148 	}
149 	buf[res] = '\0';
150 
151 	if (os_strcmp(buf, "ATTACH") == 0) {
152 		if (wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst, &from,
153 						     fromlen, 0))
154 			reply_len = 1;
155 		else {
156 			new_attached = 1;
157 			reply_len = 2;
158 		}
159 	} else if (os_strcmp(buf, "DETACH") == 0) {
160 		if (wpa_supplicant_ctrl_iface_detach(&priv->ctrl_dst, &from,
161 						     fromlen))
162 			reply_len = 1;
163 		else
164 			reply_len = 2;
165 	} else if (os_strncmp(buf, "LEVEL ", 6) == 0) {
166 		if (wpa_supplicant_ctrl_iface_level(priv, &from, fromlen,
167 						    buf + 6))
168 			reply_len = 1;
169 		else
170 			reply_len = 2;
171 	} else {
172 		reply_buf = wpa_supplicant_ctrl_iface_process(wpa_s, buf,
173 							      &reply_len);
174 		reply = reply_buf;
175 
176 		/*
177 		 * There could be some password/key material in the command, so
178 		 * clear the buffer explicitly now that it is not needed
179 		 * anymore.
180 		 */
181 		os_memset(buf, 0, res);
182 	}
183 
184 	if (!reply && reply_len == 1) {
185 		reply = "FAIL\n";
186 		reply_len = 5;
187 	} else if (!reply && reply_len == 2) {
188 		reply = "OK\n";
189 		reply_len = 3;
190 	}
191 
192 	if (reply) {
193 		wpas_ctrl_sock_debug("ctrl_sock-sendto", sock, reply,
194 				     reply_len);
195 		if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
196 			   fromlen) < 0) {
197 			int _errno = errno;
198 			wpa_dbg(wpa_s, MSG_DEBUG,
199 				"ctrl_iface sendto failed: %d - %s",
200 				_errno, strerror(_errno));
201 			if (_errno == ENOBUFS || _errno == EAGAIN) {
202 				/*
203 				 * The socket send buffer could be full. This
204 				 * may happen if client programs are not
205 				 * receiving their pending messages. Close and
206 				 * reopen the socket as a workaround to avoid
207 				 * getting stuck being unable to send any new
208 				 * responses.
209 				 */
210 				sock = wpas_ctrl_iface_reinit(wpa_s, priv);
211 				if (sock < 0) {
212 					wpa_dbg(wpa_s, MSG_DEBUG, "Failed to reinitialize ctrl_iface socket");
213 				}
214 			}
215 			if (new_attached) {
216 				wpa_dbg(wpa_s, MSG_DEBUG, "Failed to send response to ATTACH - detaching");
217 				new_attached = 0;
218 				wpa_supplicant_ctrl_iface_detach(
219 					&priv->ctrl_dst, &from, fromlen);
220 			}
221 		}
222 	}
223 	os_free(reply_buf);
224 
225 	if (new_attached)
226 		eapol_sm_notify_ctrl_attached(wpa_s->eapol);
227 }
228 
229 
wpa_supplicant_ctrl_iface_path(struct wpa_supplicant * wpa_s)230 static char * wpa_supplicant_ctrl_iface_path(struct wpa_supplicant *wpa_s)
231 {
232 	char *buf;
233 	size_t len;
234 	char *pbuf, *dir = NULL;
235 	int res;
236 
237 	if (wpa_s->conf->ctrl_interface == NULL)
238 		return NULL;
239 
240 	pbuf = os_strdup(wpa_s->conf->ctrl_interface);
241 	if (pbuf == NULL)
242 		return NULL;
243 	if (os_strncmp(pbuf, "DIR=", 4) == 0) {
244 		char *gid_str;
245 		dir = pbuf + 4;
246 		gid_str = os_strstr(dir, " GROUP=");
247 		if (gid_str)
248 			*gid_str = '\0';
249 	} else
250 		dir = pbuf;
251 
252 	len = os_strlen(dir) + os_strlen(wpa_s->ifname) + 2;
253 	buf = os_malloc(len);
254 	if (buf == NULL) {
255 		os_free(pbuf);
256 		return NULL;
257 	}
258 
259 	res = os_snprintf(buf, len, "%s/%s", dir, wpa_s->ifname);
260 	if (os_snprintf_error(len, res)) {
261 		os_free(pbuf);
262 		os_free(buf);
263 		return NULL;
264 	}
265 #ifdef __CYGWIN__
266 	{
267 		/* Windows/WinPcap uses interface names that are not suitable
268 		 * as a file name - convert invalid chars to underscores */
269 		char *pos = buf;
270 		while (*pos) {
271 			if (*pos == '\\')
272 				*pos = '_';
273 			pos++;
274 		}
275 	}
276 #endif /* __CYGWIN__ */
277 	os_free(pbuf);
278 	return buf;
279 }
280 
281 
wpas_ctrl_iface_throttle(int sock)282 static int wpas_ctrl_iface_throttle(int sock)
283 {
284 #ifdef __linux__
285 	socklen_t optlen;
286 	int sndbuf, outq;
287 
288 	optlen = sizeof(sndbuf);
289 	sndbuf = 0;
290 	if (getsockopt(sock, SOL_SOCKET, SO_SNDBUF, &sndbuf, &optlen) < 0 ||
291 	    ioctl(sock, TIOCOUTQ, &outq) < 0 ||
292 	    sndbuf <= 0 || outq < 0)
293 		return 0;
294 	return outq > sndbuf / 2;
295 #else /* __linux__ */
296 	return 0;
297 #endif /* __linux__ */
298 }
299 
300 
wpas_ctrl_msg_send_pending_global(struct wpa_global * global)301 static void wpas_ctrl_msg_send_pending_global(struct wpa_global *global)
302 {
303 	struct ctrl_iface_global_priv *gpriv;
304 	struct ctrl_iface_msg *msg;
305 
306 	gpriv = global->ctrl_iface;
307 	while (gpriv && !dl_list_empty(&gpriv->msg_queue) &&
308 	       !wpas_ctrl_iface_throttle(gpriv->sock)) {
309 		msg = dl_list_first(&gpriv->msg_queue, struct ctrl_iface_msg,
310 				    list);
311 		if (!msg)
312 			break;
313 		dl_list_del(&msg->list);
314 		wpa_supplicant_ctrl_iface_send(
315 			msg->wpa_s,
316 			msg->type != WPA_MSG_PER_INTERFACE ?
317 			NULL : msg->wpa_s->ifname,
318 			gpriv->sock, &gpriv->ctrl_dst, msg->level,
319 			msg->txt, msg->len, NULL, gpriv);
320 		os_free(msg);
321 	}
322 }
323 
324 
wpas_ctrl_msg_send_pending_iface(struct wpa_supplicant * wpa_s)325 static void wpas_ctrl_msg_send_pending_iface(struct wpa_supplicant *wpa_s)
326 {
327 	struct ctrl_iface_priv *priv;
328 	struct ctrl_iface_msg *msg;
329 
330 	priv = wpa_s->ctrl_iface;
331 	while (priv && !dl_list_empty(&priv->msg_queue) &&
332 	       !wpas_ctrl_iface_throttle(priv->sock)) {
333 		msg = dl_list_first(&priv->msg_queue, struct ctrl_iface_msg,
334 				    list);
335 		if (!msg)
336 			break;
337 		dl_list_del(&msg->list);
338 		wpa_supplicant_ctrl_iface_send(wpa_s, NULL, priv->sock,
339 					       &priv->ctrl_dst, msg->level,
340 					       msg->txt, msg->len, priv, NULL);
341 		os_free(msg);
342 	}
343 }
344 
345 
wpas_ctrl_msg_queue_timeout(void * eloop_ctx,void * timeout_ctx)346 static void wpas_ctrl_msg_queue_timeout(void *eloop_ctx, void *timeout_ctx)
347 {
348 	struct wpa_supplicant *wpa_s = eloop_ctx;
349 	struct ctrl_iface_priv *priv;
350 	struct ctrl_iface_global_priv *gpriv;
351 	int sock = -1, gsock = -1;
352 
353 	wpas_ctrl_msg_send_pending_global(wpa_s->global);
354 	wpas_ctrl_msg_send_pending_iface(wpa_s);
355 
356 	priv = wpa_s->ctrl_iface;
357 	if (priv && !dl_list_empty(&priv->msg_queue))
358 		sock = priv->sock;
359 
360 	gpriv = wpa_s->global->ctrl_iface;
361 	if (gpriv && !dl_list_empty(&gpriv->msg_queue))
362 		gsock = gpriv->sock;
363 
364 	if (sock > -1 || gsock > -1) {
365 		/* Continue pending message transmission from a timeout */
366 		wpa_printf(MSG_MSGDUMP,
367 			   "CTRL: Had to throttle pending event message transmission for (sock %d gsock %d)",
368 			   sock, gsock);
369 		eloop_register_timeout(0, 20000, wpas_ctrl_msg_queue_timeout,
370 				       wpa_s, NULL);
371 	}
372 }
373 
374 
wpas_ctrl_msg_queue(struct dl_list * queue,struct wpa_supplicant * wpa_s,int level,enum wpa_msg_type type,const char * txt,size_t len)375 static void wpas_ctrl_msg_queue(struct dl_list *queue,
376 				struct wpa_supplicant *wpa_s, int level,
377 				enum wpa_msg_type type,
378 				const char *txt, size_t len)
379 {
380 	struct ctrl_iface_msg *msg;
381 
382 	msg = os_zalloc(sizeof(*msg) + len);
383 	if (!msg)
384 		return;
385 
386 	msg->wpa_s = wpa_s;
387 	msg->level = level;
388 	msg->type = type;
389 	os_memcpy(msg + 1, txt, len);
390 	msg->txt = (const char *) (msg + 1);
391 	msg->len = len;
392 	dl_list_add_tail(queue, &msg->list);
393 	eloop_cancel_timeout(wpas_ctrl_msg_queue_timeout, wpa_s, NULL);
394 	eloop_register_timeout(0, 0, wpas_ctrl_msg_queue_timeout, wpa_s, NULL);
395 }
396 
397 
wpas_ctrl_msg_queue_limit(unsigned int throttle_count,struct dl_list * queue)398 static void wpas_ctrl_msg_queue_limit(unsigned int throttle_count,
399 				      struct dl_list *queue)
400 {
401 	struct ctrl_iface_msg *msg;
402 
403 	if (throttle_count < 2000)
404 		return;
405 
406 	msg = dl_list_first(queue, struct ctrl_iface_msg, list);
407 	if (msg) {
408 		wpa_printf(MSG_DEBUG, "CTRL: Dropped oldest pending message");
409 		dl_list_del(&msg->list);
410 		os_free(msg);
411 	}
412 }
413 
414 
wpa_supplicant_ctrl_iface_msg_cb(void * ctx,int level,enum wpa_msg_type type,const char * txt,size_t len)415 static void wpa_supplicant_ctrl_iface_msg_cb(void *ctx, int level,
416 					     enum wpa_msg_type type,
417 					     const char *txt, size_t len)
418 {
419 	struct wpa_supplicant *wpa_s = ctx;
420 	struct ctrl_iface_priv *priv;
421 	struct ctrl_iface_global_priv *gpriv;
422 
423 	if (wpa_s == NULL)
424 		return;
425 
426 	gpriv = wpa_s->global->ctrl_iface;
427 
428 	if (type != WPA_MSG_NO_GLOBAL && gpriv &&
429 	    !dl_list_empty(&gpriv->ctrl_dst)) {
430 		if (!dl_list_empty(&gpriv->msg_queue) ||
431 		    wpas_ctrl_iface_throttle(gpriv->sock)) {
432 			if (gpriv->throttle_count == 0) {
433 				wpa_printf(MSG_MSGDUMP,
434 					   "CTRL: Had to throttle global event message for sock %d",
435 					   gpriv->sock);
436 			}
437 			gpriv->throttle_count++;
438 			wpas_ctrl_msg_queue_limit(gpriv->throttle_count,
439 						  &gpriv->msg_queue);
440 			wpas_ctrl_msg_queue(&gpriv->msg_queue, wpa_s, level,
441 					    type, txt, len);
442 		} else {
443 			if (gpriv->throttle_count) {
444 				wpa_printf(MSG_MSGDUMP,
445 					   "CTRL: Had to throttle %u global event message(s) for sock %d",
446 					   gpriv->throttle_count, gpriv->sock);
447 			}
448 			gpriv->throttle_count = 0;
449 			wpa_supplicant_ctrl_iface_send(
450 				wpa_s,
451 				type != WPA_MSG_PER_INTERFACE ?
452 				NULL : wpa_s->ifname,
453 				gpriv->sock, &gpriv->ctrl_dst, level,
454 				txt, len, NULL, gpriv);
455 		}
456 	}
457 
458 	priv = wpa_s->ctrl_iface;
459 
460 	if (type != WPA_MSG_ONLY_GLOBAL && priv) {
461 		if (!dl_list_empty(&priv->msg_queue) ||
462 		    wpas_ctrl_iface_throttle(priv->sock)) {
463 			if (priv->throttle_count == 0) {
464 				wpa_printf(MSG_MSGDUMP,
465 					   "CTRL: Had to throttle event message for sock %d",
466 					   priv->sock);
467 			}
468 			priv->throttle_count++;
469 			wpas_ctrl_msg_queue_limit(priv->throttle_count,
470 						  &priv->msg_queue);
471 			wpas_ctrl_msg_queue(&priv->msg_queue, wpa_s, level,
472 					    type, txt, len);
473 		} else {
474 			if (priv->throttle_count) {
475 				wpa_printf(MSG_MSGDUMP,
476 					   "CTRL: Had to throttle %u event message(s) for sock %d",
477 					   priv->throttle_count, priv->sock);
478 			}
479 			priv->throttle_count = 0;
480 			wpa_supplicant_ctrl_iface_send(wpa_s, NULL, priv->sock,
481 						       &priv->ctrl_dst, level,
482 						       txt, len, priv, NULL);
483 		}
484 	}
485 }
486 
487 
wpas_ctrl_iface_open_sock(struct wpa_supplicant * wpa_s,struct ctrl_iface_priv * priv)488 static int wpas_ctrl_iface_open_sock(struct wpa_supplicant *wpa_s,
489 				     struct ctrl_iface_priv *priv)
490 {
491 	struct sockaddr_un addr;
492 	char *fname = NULL;
493 	gid_t gid = 0;
494 	int gid_set = 0;
495 	char *buf, *dir = NULL, *gid_str = NULL;
496 	struct group *grp;
497 	char *endp;
498 	int flags;
499 
500 	buf = os_strdup(wpa_s->conf->ctrl_interface);
501 	if (buf == NULL)
502 		goto fail;
503 #ifdef ANDROID
504 	os_snprintf(addr.sun_path, sizeof(addr.sun_path), "wpa_%s",
505 		    wpa_s->conf->ctrl_interface);
506 	priv->sock = android_get_control_socket(addr.sun_path);
507 	if (priv->sock >= 0) {
508 		priv->android_control_socket = 1;
509 		goto havesock;
510 	}
511 #endif /* ANDROID */
512 	if (os_strncmp(buf, "DIR=", 4) == 0) {
513 		dir = buf + 4;
514 		gid_str = os_strstr(dir, " GROUP=");
515 		if (gid_str) {
516 			*gid_str = '\0';
517 			gid_str += 7;
518 		}
519 	} else {
520 		dir = buf;
521 		gid_str = wpa_s->conf->ctrl_interface_group;
522 	}
523 
524 	if (mkdir(dir, S_IRWXU | S_IRWXG) < 0) {
525 		if (errno == EEXIST) {
526 			wpa_printf(MSG_DEBUG, "Using existing control "
527 				   "interface directory.");
528 		} else {
529 			wpa_printf(MSG_ERROR, "mkdir[ctrl_interface=%s]: %s",
530 				   dir, strerror(errno));
531 			goto fail;
532 		}
533 	}
534 
535 #ifdef ANDROID
536 	/*
537 	 * wpa_supplicant is started from /init.*.rc on Android and that seems
538 	 * to be using umask 0077 which would leave the control interface
539 	 * directory without group access. This breaks things since Wi-Fi
540 	 * framework assumes that this directory can be accessed by other
541 	 * applications in the wifi group. Fix this by adding group access even
542 	 * if umask value would prevent this.
543 	 */
544 	if (chmod(dir, S_IRWXU | S_IRWXG) < 0) {
545 		wpa_printf(MSG_ERROR, "CTRL: Could not chmod directory: %s",
546 			   strerror(errno));
547 		/* Try to continue anyway */
548 	}
549 #endif /* ANDROID */
550 
551 	if (gid_str) {
552 		grp = getgrnam(gid_str);
553 		if (grp) {
554 			gid = grp->gr_gid;
555 			gid_set = 1;
556 			wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d"
557 				   " (from group name '%s')",
558 				   (int) gid, gid_str);
559 		} else {
560 			/* Group name not found - try to parse this as gid */
561 			gid = strtol(gid_str, &endp, 10);
562 			if (*gid_str == '\0' || *endp != '\0') {
563 				wpa_printf(MSG_ERROR, "CTRL: Invalid group "
564 					   "'%s'", gid_str);
565 				goto fail;
566 			}
567 			gid_set = 1;
568 			wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d",
569 				   (int) gid);
570 		}
571 	}
572 
573 	if (gid_set && lchown(dir, -1, gid) < 0) {
574 		wpa_printf(MSG_ERROR, "lchown[ctrl_interface=%s,gid=%d]: %s",
575 			   dir, (int) gid, strerror(errno));
576 		goto fail;
577 	}
578 
579 	/* Make sure the group can enter and read the directory */
580 	if (gid_set &&
581 	    chmod(dir, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP) < 0) {
582 		wpa_printf(MSG_ERROR, "CTRL: chmod[ctrl_interface]: %s",
583 			   strerror(errno));
584 		goto fail;
585 	}
586 
587 	if (os_strlen(dir) + 1 + os_strlen(wpa_s->ifname) >=
588 	    sizeof(addr.sun_path)) {
589 		wpa_printf(MSG_ERROR, "ctrl_iface path limit exceeded");
590 		goto fail;
591 	}
592 
593 	priv->sock = socket(PF_UNIX, SOCK_DGRAM, 0);
594 	if (priv->sock < 0) {
595 		wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno));
596 		goto fail;
597 	}
598 
599 	os_memset(&addr, 0, sizeof(addr));
600 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
601 	addr.sun_len = sizeof(addr);
602 #endif /* __FreeBSD__ */
603 	addr.sun_family = AF_UNIX;
604 	fname = wpa_supplicant_ctrl_iface_path(wpa_s);
605 	if (fname == NULL)
606 		goto fail;
607 	os_strlcpy(addr.sun_path, fname, sizeof(addr.sun_path));
608 	if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
609 		wpa_printf(MSG_DEBUG, "ctrl_iface bind(PF_UNIX) failed: %s",
610 			   strerror(errno));
611 		if (connect(priv->sock, (struct sockaddr *) &addr,
612 			    sizeof(addr)) < 0) {
613 			wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not"
614 				   " allow connections - assuming it was left"
615 				   "over from forced program termination");
616 			if (unlink(fname) < 0) {
617 				wpa_printf(MSG_ERROR,
618 					   "Could not unlink existing ctrl_iface socket '%s': %s",
619 					   fname, strerror(errno));
620 				goto fail;
621 			}
622 			if (bind(priv->sock, (struct sockaddr *) &addr,
623 				 sizeof(addr)) < 0) {
624 				wpa_printf(MSG_ERROR, "supp-ctrl-iface-init: bind(PF_UNIX): %s",
625 					   strerror(errno));
626 				goto fail;
627 			}
628 			wpa_printf(MSG_DEBUG, "Successfully replaced leftover "
629 				   "ctrl_iface socket '%s'", fname);
630 		} else {
631 			wpa_printf(MSG_INFO, "ctrl_iface exists and seems to "
632 				   "be in use - cannot override it");
633 			wpa_printf(MSG_INFO, "Delete '%s' manually if it is "
634 				   "not used anymore", fname);
635 			os_free(fname);
636 			fname = NULL;
637 			goto fail;
638 		}
639 	}
640 
641 	if (gid_set && lchown(fname, -1, gid) < 0) {
642 		wpa_printf(MSG_ERROR, "lchown[ctrl_interface=%s,gid=%d]: %s",
643 			   fname, (int) gid, strerror(errno));
644 		goto fail;
645 	}
646 
647 	if (chmod(fname, S_IRWXU | S_IRWXG) < 0) {
648 		wpa_printf(MSG_ERROR, "chmod[ctrl_interface=%s]: %s",
649 			   fname, strerror(errno));
650 		goto fail;
651 	}
652 	os_free(fname);
653 
654 #ifdef ANDROID
655 havesock:
656 #endif /* ANDROID */
657 
658 	/*
659 	 * Make socket non-blocking so that we don't hang forever if
660 	 * target dies unexpectedly.
661 	 */
662 	flags = fcntl(priv->sock, F_GETFL);
663 	if (flags >= 0) {
664 		flags |= O_NONBLOCK;
665 		if (fcntl(priv->sock, F_SETFL, flags) < 0) {
666 			wpa_printf(MSG_INFO, "fcntl(ctrl, O_NONBLOCK): %s",
667 				   strerror(errno));
668 			/* Not fatal, continue on.*/
669 		}
670 	}
671 
672 	eloop_register_read_sock(priv->sock, wpa_supplicant_ctrl_iface_receive,
673 				 wpa_s, priv);
674 	wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb);
675 
676 	os_free(buf);
677 	return 0;
678 
679 fail:
680 	if (priv->sock >= 0) {
681 		close(priv->sock);
682 		priv->sock = -1;
683 	}
684 	if (fname) {
685 		unlink(fname);
686 		os_free(fname);
687 	}
688 	os_free(buf);
689 	return -1;
690 }
691 
692 
693 struct ctrl_iface_priv *
wpa_supplicant_ctrl_iface_init(struct wpa_supplicant * wpa_s)694 wpa_supplicant_ctrl_iface_init(struct wpa_supplicant *wpa_s)
695 {
696 	struct ctrl_iface_priv *priv;
697 
698 	priv = os_zalloc(sizeof(*priv));
699 	if (priv == NULL)
700 		return NULL;
701 	dl_list_init(&priv->ctrl_dst);
702 	dl_list_init(&priv->msg_queue);
703 	priv->wpa_s = wpa_s;
704 	priv->sock = -1;
705 
706 	if (wpa_s->conf->ctrl_interface == NULL)
707 		return priv;
708 
709 #ifdef ANDROID
710 	if (wpa_s->global->params.ctrl_interface) {
711 		int same = 0;
712 
713 		if (wpa_s->global->params.ctrl_interface[0] == '/') {
714 			if (os_strcmp(wpa_s->global->params.ctrl_interface,
715 				      wpa_s->conf->ctrl_interface) == 0)
716 				same = 1;
717 		} else if (os_strncmp(wpa_s->global->params.ctrl_interface,
718 				      "@android:", 9) == 0 ||
719 			   os_strncmp(wpa_s->global->params.ctrl_interface,
720 				      "@abstract:", 10) == 0) {
721 			char *pos;
722 
723 			/*
724 			 * Currently, Android uses @android:wpa_* as the naming
725 			 * convention for the global ctrl interface. This logic
726 			 * needs to be revisited if the above naming convention
727 			 * is modified.
728 			 */
729 			pos = os_strchr(wpa_s->global->params.ctrl_interface,
730 					'_');
731 			if (pos &&
732 			    os_strcmp(pos + 1,
733 				      wpa_s->conf->ctrl_interface) == 0)
734 				same = 1;
735 		}
736 
737 		if (same) {
738 			/*
739 			 * The invalid configuration combination might be
740 			 * possible to hit in an Android OTA upgrade case, so
741 			 * instead of refusing to start the wpa_supplicant
742 			 * process, do not open the per-interface ctrl_iface
743 			 * and continue with the global control interface that
744 			 * was set from the command line since the Wi-Fi
745 			 * framework will use it for operations.
746 			 */
747 			wpa_printf(MSG_ERROR,
748 				   "global ctrl interface %s matches ctrl interface %s - do not open per-interface ctrl interface",
749 				   wpa_s->global->params.ctrl_interface,
750 				   wpa_s->conf->ctrl_interface);
751 			return priv;
752 		}
753 	}
754 #endif /* ANDROID */
755 
756 	if (wpas_ctrl_iface_open_sock(wpa_s, priv) < 0) {
757 		os_free(priv);
758 		return NULL;
759 	}
760 
761 	return priv;
762 }
763 
764 
wpas_ctrl_iface_reinit(struct wpa_supplicant * wpa_s,struct ctrl_iface_priv * priv)765 static int wpas_ctrl_iface_reinit(struct wpa_supplicant *wpa_s,
766 				  struct ctrl_iface_priv *priv)
767 {
768 	int res;
769 
770 	if (priv->sock <= 0)
771 		return -1;
772 
773 	/*
774 	 * On Android, the control socket being used may be the socket
775 	 * that is created when wpa_supplicant is started as a /init.*.rc
776 	 * service. Such a socket is maintained as a key-value pair in
777 	 * Android's environment. Closing this control socket would leave us
778 	 * in a bad state with an invalid socket descriptor.
779 	 */
780 	if (priv->android_control_socket)
781 		return priv->sock;
782 
783 	eloop_unregister_read_sock(priv->sock);
784 	close(priv->sock);
785 	priv->sock = -1;
786 	res = wpas_ctrl_iface_open_sock(wpa_s, priv);
787 	if (res < 0)
788 		return -1;
789 	return priv->sock;
790 }
791 
792 
wpa_supplicant_ctrl_iface_deinit(struct ctrl_iface_priv * priv)793 void wpa_supplicant_ctrl_iface_deinit(struct ctrl_iface_priv *priv)
794 {
795 	struct wpa_ctrl_dst *dst, *prev;
796 	struct ctrl_iface_msg *msg, *prev_msg;
797 	struct ctrl_iface_global_priv *gpriv;
798 
799 	if (priv->sock > -1) {
800 		char *fname;
801 		char *buf, *dir = NULL;
802 		eloop_unregister_read_sock(priv->sock);
803 		if (!dl_list_empty(&priv->ctrl_dst)) {
804 			/*
805 			 * Wait before closing the control socket if
806 			 * there are any attached monitors in order to allow
807 			 * them to receive any pending messages.
808 			 */
809 			wpa_printf(MSG_DEBUG, "CTRL_IFACE wait for attached "
810 				   "monitors to receive messages");
811 			os_sleep(0, 100000);
812 		}
813 		close(priv->sock);
814 		priv->sock = -1;
815 		fname = wpa_supplicant_ctrl_iface_path(priv->wpa_s);
816 		if (fname) {
817 			unlink(fname);
818 			os_free(fname);
819 		}
820 
821 		if (priv->wpa_s->conf->ctrl_interface == NULL)
822 			goto free_dst;
823 		buf = os_strdup(priv->wpa_s->conf->ctrl_interface);
824 		if (buf == NULL)
825 			goto free_dst;
826 		if (os_strncmp(buf, "DIR=", 4) == 0) {
827 			char *gid_str;
828 			dir = buf + 4;
829 			gid_str = os_strstr(dir, " GROUP=");
830 			if (gid_str)
831 				*gid_str = '\0';
832 		} else
833 			dir = buf;
834 
835 		if (rmdir(dir) < 0) {
836 			if (errno == ENOTEMPTY) {
837 				wpa_printf(MSG_DEBUG, "Control interface "
838 					   "directory not empty - leaving it "
839 					   "behind");
840 			} else {
841 				wpa_printf(MSG_ERROR,
842 					   "rmdir[ctrl_interface=%s]: %s",
843 					   dir, strerror(errno));
844 			}
845 		}
846 		os_free(buf);
847 	}
848 
849 free_dst:
850 	dl_list_for_each_safe(dst, prev, &priv->ctrl_dst, struct wpa_ctrl_dst,
851 			      list) {
852 		dl_list_del(&dst->list);
853 		os_free(dst);
854 	}
855 	dl_list_for_each_safe(msg, prev_msg, &priv->msg_queue,
856 			      struct ctrl_iface_msg, list) {
857 		dl_list_del(&msg->list);
858 		os_free(msg);
859 	}
860 	gpriv = priv->wpa_s->global->ctrl_iface;
861 	if (gpriv) {
862 		dl_list_for_each_safe(msg, prev_msg, &gpriv->msg_queue,
863 				      struct ctrl_iface_msg, list) {
864 			if (msg->wpa_s == priv->wpa_s) {
865 				dl_list_del(&msg->list);
866 				os_free(msg);
867 			}
868 		}
869 	}
870 	eloop_cancel_timeout(wpas_ctrl_msg_queue_timeout, priv->wpa_s, NULL);
871 	os_free(priv);
872 }
873 
874 
875 /**
876  * wpa_supplicant_ctrl_iface_send - Send a control interface packet to monitors
877  * @ifname: Interface name for global control socket or %NULL
878  * @sock: Local socket fd
879  * @ctrl_dst: List of attached listeners
880  * @level: Priority level of the message
881  * @buf: Message data
882  * @len: Message length
883  *
884  * Send a packet to all monitor programs attached to the control interface.
885  */
wpa_supplicant_ctrl_iface_send(struct wpa_supplicant * wpa_s,const char * ifname,int sock,struct dl_list * ctrl_dst,int level,const char * buf,size_t len,struct ctrl_iface_priv * priv,struct ctrl_iface_global_priv * gp)886 static void wpa_supplicant_ctrl_iface_send(struct wpa_supplicant *wpa_s,
887 					   const char *ifname, int sock,
888 					   struct dl_list *ctrl_dst,
889 					   int level, const char *buf,
890 					   size_t len,
891 					   struct ctrl_iface_priv *priv,
892 					   struct ctrl_iface_global_priv *gp)
893 {
894 	struct wpa_ctrl_dst *dst, *next;
895 	char levelstr[10];
896 	int idx, res;
897 	struct msghdr msg;
898 	struct iovec io[5];
899 
900 	if (sock < 0 || dl_list_empty(ctrl_dst))
901 		return;
902 
903 	res = os_snprintf(levelstr, sizeof(levelstr), "<%d>", level);
904 	if (os_snprintf_error(sizeof(levelstr), res))
905 		return;
906 	idx = 0;
907 	if (ifname) {
908 		io[idx].iov_base = "IFNAME=";
909 		io[idx].iov_len = 7;
910 		idx++;
911 		io[idx].iov_base = (char *) ifname;
912 		io[idx].iov_len = os_strlen(ifname);
913 		idx++;
914 		io[idx].iov_base = " ";
915 		io[idx].iov_len = 1;
916 		idx++;
917 	}
918 	io[idx].iov_base = levelstr;
919 	io[idx].iov_len = os_strlen(levelstr);
920 	idx++;
921 	io[idx].iov_base = (char *) buf;
922 	io[idx].iov_len = len;
923 	idx++;
924 	os_memset(&msg, 0, sizeof(msg));
925 	msg.msg_iov = io;
926 	msg.msg_iovlen = idx;
927 
928 	dl_list_for_each_safe(dst, next, ctrl_dst, struct wpa_ctrl_dst, list) {
929 		int _errno;
930 		char txt[200];
931 
932 		if (level < dst->debug_level)
933 			continue;
934 
935 		msg.msg_name = (void *) &dst->addr;
936 		msg.msg_namelen = dst->addrlen;
937 		wpas_ctrl_sock_debug("ctrl_sock-sendmsg", sock, buf, len);
938 		if (sendmsg(sock, &msg, MSG_DONTWAIT) >= 0) {
939 			sockaddr_print(MSG_MSGDUMP,
940 				       "CTRL_IFACE monitor sent successfully to",
941 				       &dst->addr, dst->addrlen);
942 			dst->errors = 0;
943 			continue;
944 		}
945 
946 		_errno = errno;
947 		os_snprintf(txt, sizeof(txt), "CTRL_IFACE monitor: %d (%s) for",
948 			    _errno, strerror(_errno));
949 		sockaddr_print(MSG_DEBUG, txt, &dst->addr, dst->addrlen);
950 		dst->errors++;
951 
952 		if (dst->errors > 10 || _errno == ENOENT || _errno == EPERM) {
953 			sockaddr_print(MSG_INFO, "CTRL_IFACE: Detach monitor that cannot receive messages:",
954 				       &dst->addr, dst->addrlen);
955 			wpa_supplicant_ctrl_iface_detach(ctrl_dst, &dst->addr,
956 							 dst->addrlen);
957 		}
958 
959 		if (_errno == ENOBUFS || _errno == EAGAIN) {
960 			/*
961 			 * The socket send buffer could be full. This may happen
962 			 * if client programs are not receiving their pending
963 			 * messages. Close and reopen the socket as a workaround
964 			 * to avoid getting stuck being unable to send any new
965 			 * responses.
966 			 */
967 			if (priv)
968 				sock = wpas_ctrl_iface_reinit(wpa_s, priv);
969 			else if (gp)
970 				sock = wpas_ctrl_iface_global_reinit(
971 					wpa_s->global, gp);
972 			else
973 				break;
974 			if (sock < 0) {
975 				wpa_dbg(wpa_s, MSG_DEBUG,
976 					"Failed to reinitialize ctrl_iface socket");
977 				break;
978 			}
979 		}
980 	}
981 }
982 
983 
wpa_supplicant_ctrl_iface_wait(struct ctrl_iface_priv * priv)984 void wpa_supplicant_ctrl_iface_wait(struct ctrl_iface_priv *priv)
985 {
986 	char buf[256];
987 	int res;
988 	struct sockaddr_storage from;
989 	socklen_t fromlen = sizeof(from);
990 
991 	if (priv->sock == -1)
992 		return;
993 
994 	for (;;) {
995 		wpa_printf(MSG_DEBUG, "CTRL_IFACE - %s - wait for monitor to "
996 			   "attach", priv->wpa_s->ifname);
997 		eloop_wait_for_read_sock(priv->sock);
998 
999 		res = recvfrom(priv->sock, buf, sizeof(buf) - 1, 0,
1000 			       (struct sockaddr *) &from, &fromlen);
1001 		if (res < 0) {
1002 			wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s",
1003 				   strerror(errno));
1004 			continue;
1005 		}
1006 		buf[res] = '\0';
1007 
1008 		if (os_strcmp(buf, "ATTACH") == 0) {
1009 			/* handle ATTACH signal of first monitor interface */
1010 			if (!wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst,
1011 							      &from, fromlen,
1012 							      0)) {
1013 				if (sendto(priv->sock, "OK\n", 3, 0,
1014 					   (struct sockaddr *) &from, fromlen) <
1015 				    0) {
1016 					wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s",
1017 						   strerror(errno));
1018 				}
1019 				/* OK to continue */
1020 				return;
1021 			} else {
1022 				if (sendto(priv->sock, "FAIL\n", 5, 0,
1023 					   (struct sockaddr *) &from, fromlen) <
1024 				    0) {
1025 					wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s",
1026 						   strerror(errno));
1027 				}
1028 			}
1029 		} else {
1030 			/* return FAIL for all other signals */
1031 			if (sendto(priv->sock, "FAIL\n", 5, 0,
1032 				   (struct sockaddr *) &from, fromlen) < 0) {
1033 				wpa_printf(MSG_DEBUG,
1034 					   "ctrl_iface sendto failed: %s",
1035 					   strerror(errno));
1036 			}
1037 		}
1038 	}
1039 }
1040 
1041 
1042 /* Global ctrl_iface */
1043 
wpa_supplicant_global_ctrl_iface_receive(int sock,void * eloop_ctx,void * sock_ctx)1044 static void wpa_supplicant_global_ctrl_iface_receive(int sock, void *eloop_ctx,
1045 						     void *sock_ctx)
1046 {
1047 	struct wpa_global *global = eloop_ctx;
1048 	struct ctrl_iface_global_priv *priv = sock_ctx;
1049 	char buf[4096];
1050 	int res;
1051 	struct sockaddr_storage from;
1052 	socklen_t fromlen = sizeof(from);
1053 	char *reply = NULL, *reply_buf = NULL;
1054 	size_t reply_len;
1055 
1056 	res = recvfrom(sock, buf, sizeof(buf) - 1, 0,
1057 		       (struct sockaddr *) &from, &fromlen);
1058 	if (res < 0) {
1059 		wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s",
1060 			   strerror(errno));
1061 		return;
1062 	}
1063 	buf[res] = '\0';
1064 
1065 	if (os_strcmp(buf, "ATTACH") == 0) {
1066 		if (wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst, &from,
1067 						     fromlen, 1))
1068 			reply_len = 1;
1069 		else
1070 			reply_len = 2;
1071 	} else if (os_strcmp(buf, "DETACH") == 0) {
1072 		if (wpa_supplicant_ctrl_iface_detach(&priv->ctrl_dst, &from,
1073 						     fromlen))
1074 			reply_len = 1;
1075 		else
1076 			reply_len = 2;
1077 	} else {
1078 		reply_buf = wpa_supplicant_global_ctrl_iface_process(
1079 			global, buf, &reply_len);
1080 		reply = reply_buf;
1081 
1082 		/*
1083 		 * There could be some password/key material in the command, so
1084 		 * clear the buffer explicitly now that it is not needed
1085 		 * anymore.
1086 		 */
1087 		os_memset(buf, 0, res);
1088 	}
1089 
1090 	if (!reply && reply_len == 1) {
1091 		reply = "FAIL\n";
1092 		reply_len = 5;
1093 	} else if (!reply && reply_len == 2) {
1094 		reply = "OK\n";
1095 		reply_len = 3;
1096 	}
1097 
1098 	if (reply) {
1099 		wpas_ctrl_sock_debug("global_ctrl_sock-sendto",
1100 				     sock, reply, reply_len);
1101 		if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
1102 			   fromlen) < 0) {
1103 			wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s",
1104 				strerror(errno));
1105 		}
1106 	}
1107 	os_free(reply_buf);
1108 }
1109 
1110 
wpas_global_ctrl_iface_open_sock(struct wpa_global * global,struct ctrl_iface_global_priv * priv)1111 static int wpas_global_ctrl_iface_open_sock(struct wpa_global *global,
1112 					    struct ctrl_iface_global_priv *priv)
1113 {
1114 	struct sockaddr_un addr;
1115 	const char *ctrl = global->params.ctrl_interface;
1116 	int flags;
1117 
1118 	wpa_printf(MSG_DEBUG, "Global control interface '%s'", ctrl);
1119 
1120 #ifdef ANDROID
1121 	if (os_strncmp(ctrl, "@android:", 9) == 0) {
1122 		priv->sock = android_get_control_socket(ctrl + 9);
1123 		if (priv->sock < 0) {
1124 			wpa_printf(MSG_ERROR, "Failed to open Android control "
1125 				   "socket '%s'", ctrl + 9);
1126 			goto fail;
1127 		}
1128 		wpa_printf(MSG_DEBUG, "Using Android control socket '%s'",
1129 			   ctrl + 9);
1130 		priv->android_control_socket = 1;
1131 		goto havesock;
1132 	}
1133 
1134 	if (os_strncmp(ctrl, "@abstract:", 10) != 0) {
1135 		/*
1136 		 * Backwards compatibility - try to open an Android control
1137 		 * socket and if that fails, assume this was a UNIX domain
1138 		 * socket instead.
1139 		 */
1140 		priv->sock = android_get_control_socket(ctrl);
1141 		if (priv->sock >= 0) {
1142 			wpa_printf(MSG_DEBUG,
1143 				   "Using Android control socket '%s'",
1144 				   ctrl);
1145 			priv->android_control_socket = 1;
1146 			goto havesock;
1147 		}
1148 	}
1149 #endif /* ANDROID */
1150 
1151 	priv->sock = socket(PF_UNIX, SOCK_DGRAM, 0);
1152 	if (priv->sock < 0) {
1153 		wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno));
1154 		goto fail;
1155 	}
1156 
1157 	os_memset(&addr, 0, sizeof(addr));
1158 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
1159 	addr.sun_len = sizeof(addr);
1160 #endif /* __FreeBSD__ */
1161 	addr.sun_family = AF_UNIX;
1162 
1163 	if (os_strncmp(ctrl, "@abstract:", 10) == 0) {
1164 		addr.sun_path[0] = '\0';
1165 		os_strlcpy(addr.sun_path + 1, ctrl + 10,
1166 			   sizeof(addr.sun_path) - 1);
1167 		if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) <
1168 		    0) {
1169 			wpa_printf(MSG_ERROR, "supp-global-ctrl-iface-init: "
1170 				   "bind(PF_UNIX;%s) failed: %s",
1171 				   ctrl, strerror(errno));
1172 			goto fail;
1173 		}
1174 		wpa_printf(MSG_DEBUG, "Using Abstract control socket '%s'",
1175 			   ctrl + 10);
1176 		goto havesock;
1177 	}
1178 
1179 	os_strlcpy(addr.sun_path, ctrl, sizeof(addr.sun_path));
1180 	if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
1181 		wpa_printf(MSG_INFO, "supp-global-ctrl-iface-init(%s) (will try fixup): bind(PF_UNIX): %s",
1182 			   ctrl, strerror(errno));
1183 		if (connect(priv->sock, (struct sockaddr *) &addr,
1184 			    sizeof(addr)) < 0) {
1185 			wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not"
1186 				   " allow connections - assuming it was left"
1187 				   "over from forced program termination");
1188 			if (unlink(ctrl) < 0) {
1189 				wpa_printf(MSG_ERROR,
1190 					   "Could not unlink existing ctrl_iface socket '%s': %s",
1191 					   ctrl, strerror(errno));
1192 				goto fail;
1193 			}
1194 			if (bind(priv->sock, (struct sockaddr *) &addr,
1195 				 sizeof(addr)) < 0) {
1196 				wpa_printf(MSG_ERROR, "supp-glb-iface-init: bind(PF_UNIX;%s): %s",
1197 					   ctrl, strerror(errno));
1198 				goto fail;
1199 			}
1200 			wpa_printf(MSG_DEBUG, "Successfully replaced leftover "
1201 				   "ctrl_iface socket '%s'",
1202 				   ctrl);
1203 		} else {
1204 			wpa_printf(MSG_INFO, "ctrl_iface exists and seems to "
1205 				   "be in use - cannot override it");
1206 			wpa_printf(MSG_INFO, "Delete '%s' manually if it is "
1207 				   "not used anymore",
1208 				   ctrl);
1209 			goto fail;
1210 		}
1211 	}
1212 
1213 	wpa_printf(MSG_DEBUG, "Using UNIX control socket '%s'", ctrl);
1214 
1215 	if (global->params.ctrl_interface_group) {
1216 		char *gid_str = global->params.ctrl_interface_group;
1217 		gid_t gid = 0;
1218 		struct group *grp;
1219 		char *endp;
1220 
1221 		grp = getgrnam(gid_str);
1222 		if (grp) {
1223 			gid = grp->gr_gid;
1224 			wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d"
1225 				   " (from group name '%s')",
1226 				   (int) gid, gid_str);
1227 		} else {
1228 			/* Group name not found - try to parse this as gid */
1229 			gid = strtol(gid_str, &endp, 10);
1230 			if (*gid_str == '\0' || *endp != '\0') {
1231 				wpa_printf(MSG_ERROR, "CTRL: Invalid group "
1232 					   "'%s'", gid_str);
1233 				goto fail;
1234 			}
1235 			wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d",
1236 				   (int) gid);
1237 		}
1238 		if (lchown(ctrl, -1, gid) < 0) {
1239 			wpa_printf(MSG_ERROR,
1240 				   "lchown[global_ctrl_interface=%s,gid=%d]: %s",
1241 				   ctrl, (int) gid, strerror(errno));
1242 			goto fail;
1243 		}
1244 
1245 		if (chmod(ctrl, S_IRWXU | S_IRWXG) < 0) {
1246 			wpa_printf(MSG_ERROR,
1247 				   "chmod[global_ctrl_interface=%s]: %s",
1248 				   ctrl, strerror(errno));
1249 			goto fail;
1250 		}
1251 	} else {
1252 		if (chmod(ctrl, S_IRWXU) < 0) {
1253 			wpa_printf(MSG_DEBUG,
1254 				   "chmod[global_ctrl_interface=%s](S_IRWXU): %s",
1255 				   ctrl, strerror(errno));
1256 			/* continue anyway since group change was not required
1257 			 */
1258 		}
1259 	}
1260 
1261 havesock:
1262 
1263 	/*
1264 	 * Make socket non-blocking so that we don't hang forever if
1265 	 * target dies unexpectedly.
1266 	 */
1267 	flags = fcntl(priv->sock, F_GETFL);
1268 	if (flags >= 0) {
1269 		flags |= O_NONBLOCK;
1270 		if (fcntl(priv->sock, F_SETFL, flags) < 0) {
1271 			wpa_printf(MSG_INFO, "fcntl(ctrl, O_NONBLOCK): %s",
1272 				   strerror(errno));
1273 			/* Not fatal, continue on.*/
1274 		}
1275 	}
1276 
1277 	eloop_register_read_sock(priv->sock,
1278 				 wpa_supplicant_global_ctrl_iface_receive,
1279 				 global, priv);
1280 
1281 	return 0;
1282 
1283 fail:
1284 	if (priv->sock >= 0) {
1285 		close(priv->sock);
1286 		priv->sock = -1;
1287 	}
1288 	return -1;
1289 }
1290 
1291 
1292 struct ctrl_iface_global_priv *
wpa_supplicant_global_ctrl_iface_init(struct wpa_global * global)1293 wpa_supplicant_global_ctrl_iface_init(struct wpa_global *global)
1294 {
1295 	struct ctrl_iface_global_priv *priv;
1296 
1297 	priv = os_zalloc(sizeof(*priv));
1298 	if (priv == NULL)
1299 		return NULL;
1300 	dl_list_init(&priv->ctrl_dst);
1301 	dl_list_init(&priv->msg_queue);
1302 	priv->global = global;
1303 	priv->sock = -1;
1304 
1305 	if (global->params.ctrl_interface == NULL)
1306 		return priv;
1307 
1308 	if (wpas_global_ctrl_iface_open_sock(global, priv) < 0) {
1309 		os_free(priv);
1310 		return NULL;
1311 	}
1312 
1313 	wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb);
1314 
1315 	return priv;
1316 }
1317 
1318 
wpas_ctrl_iface_global_reinit(struct wpa_global * global,struct ctrl_iface_global_priv * priv)1319 static int wpas_ctrl_iface_global_reinit(struct wpa_global *global,
1320 					 struct ctrl_iface_global_priv *priv)
1321 {
1322 	int res;
1323 
1324 	if (priv->sock <= 0)
1325 		return -1;
1326 
1327 	/*
1328 	 * On Android, the control socket being used may be the socket
1329 	 * that is created when wpa_supplicant is started as a /init.*.rc
1330 	 * service. Such a socket is maintained as a key-value pair in
1331 	 * Android's environment. Closing this control socket would leave us
1332 	 * in a bad state with an invalid socket descriptor.
1333 	 */
1334 	if (priv->android_control_socket)
1335 		return priv->sock;
1336 
1337 	eloop_unregister_read_sock(priv->sock);
1338 	close(priv->sock);
1339 	priv->sock = -1;
1340 	res = wpas_global_ctrl_iface_open_sock(global, priv);
1341 	if (res < 0)
1342 		return -1;
1343 	return priv->sock;
1344 }
1345 
1346 
1347 void
wpa_supplicant_global_ctrl_iface_deinit(struct ctrl_iface_global_priv * priv)1348 wpa_supplicant_global_ctrl_iface_deinit(struct ctrl_iface_global_priv *priv)
1349 {
1350 	struct wpa_ctrl_dst *dst, *prev;
1351 	struct ctrl_iface_msg *msg, *prev_msg;
1352 
1353 	if (priv->sock >= 0) {
1354 		eloop_unregister_read_sock(priv->sock);
1355 		close(priv->sock);
1356 	}
1357 	if (priv->global->params.ctrl_interface)
1358 		unlink(priv->global->params.ctrl_interface);
1359 	dl_list_for_each_safe(dst, prev, &priv->ctrl_dst, struct wpa_ctrl_dst,
1360 			      list) {
1361 		dl_list_del(&dst->list);
1362 		os_free(dst);
1363 	}
1364 	dl_list_for_each_safe(msg, prev_msg, &priv->msg_queue,
1365 			      struct ctrl_iface_msg, list) {
1366 		dl_list_del(&msg->list);
1367 		os_free(msg);
1368 	}
1369 	os_free(priv);
1370 }
1371