1 /*
2  * WPA Supplicant / Windows Named Pipe -based control interface
3  * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  *
9  * Alternatively, this software may be distributed under the terms of BSD
10  * license.
11  *
12  * See README and COPYING for more details.
13  */
14 
15 #include "includes.h"
16 
17 #include "common.h"
18 #include "eloop.h"
19 #include "config.h"
20 #include "eapol_supp/eapol_supp_sm.h"
21 #include "wpa_supplicant_i.h"
22 #include "ctrl_iface.h"
23 #include "wpa_ctrl.h"
24 
25 #ifdef __MINGW32_VERSION
26 /* mingw-w32api v3.1 does not yet include sddl.h, so define needed parts here
27  */
28 #define SDDL_REVISION_1 1
29 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorA(
30 	LPCSTR, DWORD, PSECURITY_DESCRIPTOR *, PULONG);
31 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorW(
32 	LPCWSTR, DWORD, PSECURITY_DESCRIPTOR *, PULONG);
33 #ifdef UNICODE
34 #define ConvertStringSecurityDescriptorToSecurityDescriptor \
35 ConvertStringSecurityDescriptorToSecurityDescriptorW
36 #else
37 #define ConvertStringSecurityDescriptorToSecurityDescriptor \
38 ConvertStringSecurityDescriptorToSecurityDescriptorA
39 #endif
40 #else /* __MINGW32_VERSION */
41 #ifndef _WIN32_WINNT
42 #define _WIN32_WINNT 0x0500
43 #endif
44 #include <sddl.h>
45 #endif /* __MINGW32_VERSION */
46 
47 #ifndef WPA_SUPPLICANT_NAMED_PIPE
48 #define WPA_SUPPLICANT_NAMED_PIPE "WpaSupplicant"
49 #endif
50 #define NAMED_PIPE_PREFIX TEXT("\\\\.\\pipe\\") TEXT(WPA_SUPPLICANT_NAMED_PIPE)
51 
52 /* Per-interface ctrl_iface */
53 
54 #define REQUEST_BUFSIZE 256
55 #define REPLY_BUFSIZE 4096
56 
57 struct ctrl_iface_priv;
58 
59 /**
60  * struct wpa_ctrl_dst - Internal data structure of control interface clients
61  *
62  * This structure is used to store information about registered control
63  * interface monitors into struct wpa_supplicant. This data is private to
64  * ctrl_iface_named_pipe.c and should not be touched directly from other files.
65  */
66 struct wpa_ctrl_dst {
67 	/* Note: OVERLAPPED must be the first member of struct wpa_ctrl_dst */
68 	OVERLAPPED overlap;
69 	struct wpa_ctrl_dst *next, *prev;
70 	struct ctrl_iface_priv *priv;
71 	HANDLE pipe;
72 	int attached;
73 	int debug_level;
74 	int errors;
75 	char req_buf[REQUEST_BUFSIZE];
76 	char *rsp_buf;
77 	int used;
78 };
79 
80 
81 struct ctrl_iface_priv {
82 	struct wpa_supplicant *wpa_s;
83 	struct wpa_ctrl_dst *ctrl_dst;
84 	SECURITY_ATTRIBUTES attr;
85 	int sec_attr_set;
86 };
87 
88 
89 static void wpa_supplicant_ctrl_iface_send(struct ctrl_iface_priv *priv,
90 					   int level, const char *buf,
91 					   size_t len);
92 
93 static void ctrl_close_pipe(struct wpa_ctrl_dst *dst);
94 static void wpa_supplicant_ctrl_iface_receive(void *, void *);
95 static VOID WINAPI ctrl_iface_read_completed(DWORD err, DWORD bytes,
96 					     LPOVERLAPPED overlap);
97 
98 struct wpa_global_dst;
99 static void global_close_pipe(struct wpa_global_dst *dst);
100 static void wpa_supplicant_global_iface_receive(void *eloop_data,
101 						void *user_ctx);
102 static VOID WINAPI global_iface_read_completed(DWORD err, DWORD bytes,
103 					       LPOVERLAPPED overlap);
104 
105 
106 static int ctrl_broken_pipe(HANDLE pipe, int used)
107 {
108 	DWORD err;
109 
110 	if (PeekNamedPipe(pipe, NULL, 0, NULL, NULL, NULL))
111 		return 0;
112 
113 	err = GetLastError();
114 	if (err == ERROR_BROKEN_PIPE || (err == ERROR_BAD_PIPE && used))
115 		return 1;
116 	return 0;
117 }
118 
119 
120 static void ctrl_flush_broken_pipes(struct ctrl_iface_priv *priv)
121 {
122 	struct wpa_ctrl_dst *dst, *next;
123 
124 	dst = priv->ctrl_dst;
125 
126 	while (dst) {
127 		next = dst->next;
128 		if (ctrl_broken_pipe(dst->pipe, dst->used)) {
129 			wpa_printf(MSG_DEBUG, "CTRL: closing broken pipe %p",
130 				   dst);
131 			ctrl_close_pipe(dst);
132 		}
133 		dst = next;
134 	}
135 }
136 
137 
138 static int ctrl_open_pipe(struct ctrl_iface_priv *priv)
139 {
140 	struct wpa_ctrl_dst *dst;
141 	DWORD err;
142 	TCHAR name[256];
143 
144 	dst = os_zalloc(sizeof(*dst));
145 	if (dst == NULL)
146 		return -1;
147 	wpa_printf(MSG_DEBUG, "CTRL: Open pipe %p", dst);
148 
149 	dst->priv = priv;
150 	dst->debug_level = MSG_INFO;
151 	dst->pipe = INVALID_HANDLE_VALUE;
152 
153 	dst->overlap.hEvent = CreateEvent(NULL, TRUE, TRUE, NULL);
154 	if (dst->overlap.hEvent == NULL) {
155 		wpa_printf(MSG_ERROR, "CTRL: CreateEvent failed: %d",
156 			   (int) GetLastError());
157 		goto fail;
158 	}
159 
160 	eloop_register_event(dst->overlap.hEvent,
161 			     sizeof(dst->overlap.hEvent),
162 			     wpa_supplicant_ctrl_iface_receive, dst, NULL);
163 
164 #ifdef UNICODE
165 	_snwprintf(name, 256, NAMED_PIPE_PREFIX TEXT("-%S"),
166 		   priv->wpa_s->ifname);
167 #else /* UNICODE */
168 	os_snprintf(name, 256, NAMED_PIPE_PREFIX "-%s",
169 		    priv->wpa_s->ifname);
170 #endif /* UNICODE */
171 
172 	/* TODO: add support for configuring access list for the pipe */
173 	dst->pipe = CreateNamedPipe(name,
174 				    PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED,
175 				    PIPE_TYPE_MESSAGE |
176 				    PIPE_READMODE_MESSAGE |
177 				    PIPE_WAIT,
178 				    15, REPLY_BUFSIZE, REQUEST_BUFSIZE,
179 				    1000,
180 				    priv->sec_attr_set ? &priv->attr : NULL);
181 	if (dst->pipe == INVALID_HANDLE_VALUE) {
182 		wpa_printf(MSG_ERROR, "CTRL: CreateNamedPipe failed: %d",
183 			   (int) GetLastError());
184 		goto fail;
185 	}
186 
187 	if (ConnectNamedPipe(dst->pipe, &dst->overlap)) {
188 		wpa_printf(MSG_ERROR, "CTRL: ConnectNamedPipe failed: %d",
189 			   (int) GetLastError());
190 		CloseHandle(dst->pipe);
191 		os_free(dst);
192 		return -1;
193 	}
194 
195 	err = GetLastError();
196 	switch (err) {
197 	case ERROR_IO_PENDING:
198 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe: connection in "
199 			   "progress");
200 		break;
201 	case ERROR_PIPE_CONNECTED:
202 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe: already "
203 			   "connected");
204 		if (SetEvent(dst->overlap.hEvent))
205 			break;
206 		/* fall through */
207 	default:
208 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe error: %d",
209 			   (int) err);
210 		CloseHandle(dst->pipe);
211 		os_free(dst);
212 		return -1;
213 	}
214 
215 	dst->next = priv->ctrl_dst;
216 	if (dst->next)
217 		dst->next->prev = dst;
218 	priv->ctrl_dst = dst;
219 
220 	return 0;
221 
222 fail:
223 	ctrl_close_pipe(dst);
224 	return -1;
225 }
226 
227 
228 static void ctrl_close_pipe(struct wpa_ctrl_dst *dst)
229 {
230 	wpa_printf(MSG_DEBUG, "CTRL: close pipe %p", dst);
231 
232 	if (dst->overlap.hEvent) {
233 		eloop_unregister_event(dst->overlap.hEvent,
234 				       sizeof(dst->overlap.hEvent));
235 		CloseHandle(dst->overlap.hEvent);
236 	}
237 
238 	if (dst->pipe != INVALID_HANDLE_VALUE) {
239 		/*
240 		 * Could use FlushFileBuffers() here to guarantee that all data
241 		 * gets delivered to the client, but that can block, so let's
242 		 * not do this for now.
243 		 * FlushFileBuffers(dst->pipe);
244 		 */
245 		CloseHandle(dst->pipe);
246 	}
247 
248 	if (dst->prev)
249 		dst->prev->next = dst->next;
250 	else
251 		dst->priv->ctrl_dst = dst->next;
252 	if (dst->next)
253 		dst->next->prev = dst->prev;
254 
255 	os_free(dst->rsp_buf);
256 	os_free(dst);
257 }
258 
259 
260 static VOID WINAPI ctrl_iface_write_completed(DWORD err, DWORD bytes,
261 					      LPOVERLAPPED overlap)
262 {
263 	struct wpa_ctrl_dst *dst = (struct wpa_ctrl_dst *) overlap;
264 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped write completed: dst=%p "
265 		   "err=%d bytes=%d", dst, (int) err, (int) bytes);
266 	if (err) {
267 		ctrl_close_pipe(dst);
268 		return;
269 	}
270 
271 	os_free(dst->rsp_buf);
272 	dst->rsp_buf = NULL;
273 
274 	if (!ReadFileEx(dst->pipe, dst->req_buf, sizeof(dst->req_buf),
275 			&dst->overlap, ctrl_iface_read_completed)) {
276 		wpa_printf(MSG_DEBUG, "CTRL: ReadFileEx failed: %d",
277 			   (int) GetLastError());
278 		ctrl_close_pipe(dst);
279 		return;
280 	}
281 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped read started for %p", dst);
282 }
283 
284 
285 static void wpa_supplicant_ctrl_iface_rx(struct wpa_ctrl_dst *dst, size_t len)
286 {
287 	struct wpa_supplicant *wpa_s = dst->priv->wpa_s;
288 	char *reply = NULL, *send_buf;
289 	size_t reply_len = 0, send_len;
290 	int new_attached = 0;
291 	char *buf = dst->req_buf;
292 
293 	dst->used = 1;
294 	if (len >= REQUEST_BUFSIZE)
295 		len = REQUEST_BUFSIZE - 1;
296 	buf[len] = '\0';
297 
298 	if (os_strcmp(buf, "ATTACH") == 0) {
299 		dst->attached = 1;
300 		wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor attached");
301 		new_attached = 1;
302 		reply_len = 2;
303 	} else if (os_strcmp(buf, "DETACH") == 0) {
304 		dst->attached = 0;
305 		wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor detached");
306 		reply_len = 2;
307 	} else if (os_strncmp(buf, "LEVEL ", 6) == 0) {
308 		wpa_printf(MSG_DEBUG, "CTRL_IFACE LEVEL %s", buf + 6);
309 		dst->debug_level = atoi(buf + 6);
310 		reply_len = 2;
311 	} else {
312 		reply = wpa_supplicant_ctrl_iface_process(wpa_s, buf,
313 							  &reply_len);
314 	}
315 
316 	if (reply) {
317 		send_buf = reply;
318 		send_len = reply_len;
319 	} else if (reply_len == 2) {
320 		send_buf = "OK\n";
321 		send_len = 3;
322 	} else {
323 		send_buf = "FAIL\n";
324 		send_len = 5;
325 	}
326 
327 	os_free(dst->rsp_buf);
328 	dst->rsp_buf = os_malloc(send_len);
329 	if (dst->rsp_buf == NULL) {
330 		ctrl_close_pipe(dst);
331 		os_free(reply);
332 		return;
333 	}
334 	os_memcpy(dst->rsp_buf, send_buf, send_len);
335 	os_free(reply);
336 
337 	if (!WriteFileEx(dst->pipe, dst->rsp_buf, send_len, &dst->overlap,
338 			 ctrl_iface_write_completed)) {
339 		wpa_printf(MSG_DEBUG, "CTRL: WriteFileEx failed: %d",
340 			   (int) GetLastError());
341 		ctrl_close_pipe(dst);
342 	} else {
343 		wpa_printf(MSG_DEBUG, "CTRL: Overlapped write started for %p",
344 			   dst);
345 	}
346 
347 	if (new_attached)
348 		eapol_sm_notify_ctrl_attached(wpa_s->eapol);
349 }
350 
351 
352 static VOID WINAPI ctrl_iface_read_completed(DWORD err, DWORD bytes,
353 					     LPOVERLAPPED overlap)
354 {
355 	struct wpa_ctrl_dst *dst = (struct wpa_ctrl_dst *) overlap;
356 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped read completed: dst=%p err=%d "
357 		   "bytes=%d", dst, (int) err, (int) bytes);
358 	if (err == 0 && bytes > 0)
359 		wpa_supplicant_ctrl_iface_rx(dst, bytes);
360 }
361 
362 
363 static void wpa_supplicant_ctrl_iface_receive(void *eloop_data, void *user_ctx)
364 {
365 	struct wpa_ctrl_dst *dst = eloop_data;
366 	struct ctrl_iface_priv *priv = dst->priv;
367 	DWORD bytes;
368 
369 	wpa_printf(MSG_DEBUG, "CTRL: wpa_supplicant_ctrl_iface_receive");
370 	ResetEvent(dst->overlap.hEvent);
371 
372 	if (!GetOverlappedResult(dst->pipe, &dst->overlap, &bytes, FALSE)) {
373 		wpa_printf(MSG_DEBUG, "CTRL: GetOverlappedResult failed: %d",
374 			   (int) GetLastError());
375 		return;
376 	}
377 	wpa_printf(MSG_DEBUG, "CTRL: GetOverlappedResult: New client "
378 		   "connected");
379 
380 	/* Open a new named pipe for the next client. */
381 	ctrl_open_pipe(priv);
382 
383 	/* Use write completion function to start reading a command */
384 	ctrl_iface_write_completed(0, 0, &dst->overlap);
385 
386 	ctrl_flush_broken_pipes(priv);
387 }
388 
389 
390 static int ctrl_iface_parse(struct ctrl_iface_priv *priv, const char *params)
391 {
392 	const char *sddl = NULL;
393 	TCHAR *t_sddl;
394 
395 	if (os_strncmp(params, "SDDL=", 5) == 0)
396 		sddl = params + 5;
397 	if (!sddl) {
398 		sddl = os_strstr(params, " SDDL=");
399 		if (sddl)
400 			sddl += 6;
401 	}
402 
403 	if (!sddl)
404 		return 0;
405 
406 	wpa_printf(MSG_DEBUG, "CTRL: SDDL='%s'", sddl);
407 	os_memset(&priv->attr, 0, sizeof(priv->attr));
408 	priv->attr.nLength = sizeof(priv->attr);
409 	priv->attr.bInheritHandle = FALSE;
410 	t_sddl = wpa_strdup_tchar(sddl);
411 	if (t_sddl == NULL)
412 		return -1;
413 	if (!ConvertStringSecurityDescriptorToSecurityDescriptor(
414 		    t_sddl, SDDL_REVISION_1,
415 		    (PSECURITY_DESCRIPTOR *) (void *)
416 		    &priv->attr.lpSecurityDescriptor,
417 		    NULL)) {
418 		os_free(t_sddl);
419 		wpa_printf(MSG_ERROR, "CTRL: SDDL='%s' - could not convert to "
420 			   "security descriptor: %d",
421 			   sddl, (int) GetLastError());
422 		return -1;
423 	}
424 	os_free(t_sddl);
425 
426 	priv->sec_attr_set = 1;
427 
428 	return 0;
429 }
430 
431 
432 static void wpa_supplicant_ctrl_iface_msg_cb(void *ctx, int level,
433 					     const char *txt, size_t len)
434 {
435 	struct wpa_supplicant *wpa_s = ctx;
436 	if (wpa_s == NULL || wpa_s->ctrl_iface == NULL)
437 		return;
438 	wpa_supplicant_ctrl_iface_send(wpa_s->ctrl_iface, level, txt, len);
439 }
440 
441 
442 struct ctrl_iface_priv *
443 wpa_supplicant_ctrl_iface_init(struct wpa_supplicant *wpa_s)
444 {
445 	struct ctrl_iface_priv *priv;
446 
447 	priv = os_zalloc(sizeof(*priv));
448 	if (priv == NULL)
449 		return NULL;
450 	priv->wpa_s = wpa_s;
451 
452 	if (wpa_s->conf->ctrl_interface == NULL)
453 		return priv;
454 
455 	if (ctrl_iface_parse(priv, wpa_s->conf->ctrl_interface) < 0) {
456 		os_free(priv);
457 		return NULL;
458 	}
459 
460 	if (ctrl_open_pipe(priv) < 0) {
461 		os_free(priv);
462 		return NULL;
463 	}
464 
465 	wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb);
466 
467 	return priv;
468 }
469 
470 
471 void wpa_supplicant_ctrl_iface_deinit(struct ctrl_iface_priv *priv)
472 {
473 	while (priv->ctrl_dst)
474 		ctrl_close_pipe(priv->ctrl_dst);
475 	if (priv->sec_attr_set)
476 		LocalFree(priv->attr.lpSecurityDescriptor);
477 	os_free(priv);
478 }
479 
480 
481 static void wpa_supplicant_ctrl_iface_send(struct ctrl_iface_priv *priv,
482 					   int level, const char *buf,
483 					   size_t len)
484 {
485 	struct wpa_ctrl_dst *dst, *next;
486 	char levelstr[10];
487 	int idx;
488 	char *sbuf;
489 	int llen;
490 	DWORD written;
491 
492 	dst = priv->ctrl_dst;
493 	if (dst == NULL)
494 		return;
495 
496 	os_snprintf(levelstr, sizeof(levelstr), "<%d>", level);
497 
498 	llen = os_strlen(levelstr);
499 	sbuf = os_malloc(llen + len);
500 	if (sbuf == NULL)
501 		return;
502 
503 	os_memcpy(sbuf, levelstr, llen);
504 	os_memcpy(sbuf + llen, buf, len);
505 
506 	idx = 0;
507 	while (dst) {
508 		next = dst->next;
509 		if (dst->attached && level >= dst->debug_level) {
510 			wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor send %p",
511 				   dst);
512 			if (!WriteFile(dst->pipe, sbuf, llen + len, &written,
513 				       NULL)) {
514 				wpa_printf(MSG_DEBUG, "CTRL: WriteFile to dst "
515 					   "%p failed: %d",
516 					   dst, (int) GetLastError());
517 				dst->errors++;
518 				if (dst->errors > 10)
519 					ctrl_close_pipe(dst);
520 			} else
521 				dst->errors = 0;
522 		}
523 		idx++;
524 		dst = next;
525 	}
526 	os_free(sbuf);
527 }
528 
529 
530 void wpa_supplicant_ctrl_iface_wait(struct ctrl_iface_priv *priv)
531 {
532 	wpa_printf(MSG_DEBUG, "CTRL_IFACE - %s - wait for monitor",
533 		   priv->wpa_s->ifname);
534 	if (priv->ctrl_dst == NULL)
535 		return;
536 	WaitForSingleObject(priv->ctrl_dst->pipe, INFINITE);
537 }
538 
539 
540 /* Global ctrl_iface */
541 
542 struct ctrl_iface_global_priv;
543 
544 struct wpa_global_dst {
545 	/* Note: OVERLAPPED must be the first member of struct wpa_global_dst
546 	 */
547 	OVERLAPPED overlap;
548 	struct wpa_global_dst *next, *prev;
549 	struct ctrl_iface_global_priv *priv;
550 	HANDLE pipe;
551 	char req_buf[REQUEST_BUFSIZE];
552 	char *rsp_buf;
553 	int used;
554 };
555 
556 struct ctrl_iface_global_priv {
557 	struct wpa_global *global;
558 	struct wpa_global_dst *ctrl_dst;
559 };
560 
561 
562 static void global_flush_broken_pipes(struct ctrl_iface_global_priv *priv)
563 {
564 	struct wpa_global_dst *dst, *next;
565 
566 	dst = priv->ctrl_dst;
567 
568 	while (dst) {
569 		next = dst->next;
570 		if (ctrl_broken_pipe(dst->pipe, dst->used)) {
571 			wpa_printf(MSG_DEBUG, "CTRL: closing broken pipe %p",
572 				   dst);
573 			global_close_pipe(dst);
574 		}
575 		dst = next;
576 	}
577 }
578 
579 
580 static int global_open_pipe(struct ctrl_iface_global_priv *priv)
581 {
582 	struct wpa_global_dst *dst;
583 	DWORD err;
584 
585 	dst = os_zalloc(sizeof(*dst));
586 	if (dst == NULL)
587 		return -1;
588 	wpa_printf(MSG_DEBUG, "CTRL: Open pipe %p", dst);
589 
590 	dst->priv = priv;
591 	dst->pipe = INVALID_HANDLE_VALUE;
592 
593 	dst->overlap.hEvent = CreateEvent(NULL, TRUE, TRUE, NULL);
594 	if (dst->overlap.hEvent == NULL) {
595 		wpa_printf(MSG_ERROR, "CTRL: CreateEvent failed: %d",
596 			   (int) GetLastError());
597 		goto fail;
598 	}
599 
600 	eloop_register_event(dst->overlap.hEvent,
601 			     sizeof(dst->overlap.hEvent),
602 			     wpa_supplicant_global_iface_receive, dst, NULL);
603 
604 	/* TODO: add support for configuring access list for the pipe */
605 	dst->pipe = CreateNamedPipe(NAMED_PIPE_PREFIX,
606 				    PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED,
607 				    PIPE_TYPE_MESSAGE |
608 				    PIPE_READMODE_MESSAGE |
609 				    PIPE_WAIT,
610 				    10, REPLY_BUFSIZE, REQUEST_BUFSIZE,
611 				    1000, NULL);
612 	if (dst->pipe == INVALID_HANDLE_VALUE) {
613 		wpa_printf(MSG_ERROR, "CTRL: CreateNamedPipe failed: %d",
614 			   (int) GetLastError());
615 		goto fail;
616 	}
617 
618 	if (ConnectNamedPipe(dst->pipe, &dst->overlap)) {
619 		wpa_printf(MSG_ERROR, "CTRL: ConnectNamedPipe failed: %d",
620 			   (int) GetLastError());
621 		CloseHandle(dst->pipe);
622 		os_free(dst);
623 		return -1;
624 	}
625 
626 	err = GetLastError();
627 	switch (err) {
628 	case ERROR_IO_PENDING:
629 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe: connection in "
630 			   "progress");
631 		break;
632 	case ERROR_PIPE_CONNECTED:
633 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe: already "
634 			   "connected");
635 		if (SetEvent(dst->overlap.hEvent))
636 			break;
637 		/* fall through */
638 	default:
639 		wpa_printf(MSG_DEBUG, "CTRL: ConnectNamedPipe error: %d",
640 			   (int) err);
641 		CloseHandle(dst->pipe);
642 		os_free(dst);
643 		return -1;
644 	}
645 
646 	dst->next = priv->ctrl_dst;
647 	if (dst->next)
648 		dst->next->prev = dst;
649 	priv->ctrl_dst = dst;
650 
651 	return 0;
652 
653 fail:
654 	global_close_pipe(dst);
655 	return -1;
656 }
657 
658 
659 static void global_close_pipe(struct wpa_global_dst *dst)
660 {
661 	wpa_printf(MSG_DEBUG, "CTRL: close pipe %p", dst);
662 
663 	if (dst->overlap.hEvent) {
664 		eloop_unregister_event(dst->overlap.hEvent,
665 				       sizeof(dst->overlap.hEvent));
666 		CloseHandle(dst->overlap.hEvent);
667 	}
668 
669 	if (dst->pipe != INVALID_HANDLE_VALUE) {
670 		/*
671 		 * Could use FlushFileBuffers() here to guarantee that all data
672 		 * gets delivered to the client, but that can block, so let's
673 		 * not do this for now.
674 		 * FlushFileBuffers(dst->pipe);
675 		 */
676 		CloseHandle(dst->pipe);
677 	}
678 
679 	if (dst->prev)
680 		dst->prev->next = dst->next;
681 	else
682 		dst->priv->ctrl_dst = dst->next;
683 	if (dst->next)
684 		dst->next->prev = dst->prev;
685 
686 	os_free(dst->rsp_buf);
687 	os_free(dst);
688 }
689 
690 
691 static VOID WINAPI global_iface_write_completed(DWORD err, DWORD bytes,
692 						LPOVERLAPPED overlap)
693 {
694 	struct wpa_global_dst *dst = (struct wpa_global_dst *) overlap;
695 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped write completed: dst=%p "
696 		   "err=%d bytes=%d", dst, (int) err, (int) bytes);
697 	if (err) {
698 		global_close_pipe(dst);
699 		return;
700 	}
701 
702 	os_free(dst->rsp_buf);
703 	dst->rsp_buf = NULL;
704 
705 	if (!ReadFileEx(dst->pipe, dst->req_buf, sizeof(dst->req_buf),
706 			&dst->overlap, global_iface_read_completed)) {
707 		wpa_printf(MSG_DEBUG, "CTRL: ReadFileEx failed: %d",
708 			   (int) GetLastError());
709 		global_close_pipe(dst);
710 		/* FIX: if this was the pipe waiting for new global
711 		 * connections, at this point there are no open global pipes..
712 		 * Should try to open a new pipe.. */
713 		return;
714 	}
715 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped read started for %p", dst);
716 }
717 
718 
719 static void wpa_supplicant_global_iface_rx(struct wpa_global_dst *dst,
720 					   size_t len)
721 {
722 	struct wpa_global *global = dst->priv->global;
723 	char *reply = NULL, *send_buf;
724 	size_t reply_len = 0, send_len;
725 	char *buf = dst->req_buf;
726 
727 	dst->used = 1;
728 	if (len >= REQUEST_BUFSIZE)
729 		len = REQUEST_BUFSIZE - 1;
730 	buf[len] = '\0';
731 
732 	reply = wpa_supplicant_global_ctrl_iface_process(global, buf,
733 							 &reply_len);
734 	if (reply) {
735 		send_buf = reply;
736 		send_len = reply_len;
737 	} else if (reply_len) {
738 		send_buf = "FAIL\n";
739 		send_len = 5;
740 	} else {
741 		os_free(dst->rsp_buf);
742 		dst->rsp_buf = NULL;
743 		return;
744 	}
745 
746 	os_free(dst->rsp_buf);
747 	dst->rsp_buf = os_malloc(send_len);
748 	if (dst->rsp_buf == NULL) {
749 		global_close_pipe(dst);
750 		os_free(reply);
751 		return;
752 	}
753 	os_memcpy(dst->rsp_buf, send_buf, send_len);
754 	os_free(reply);
755 
756 	if (!WriteFileEx(dst->pipe, dst->rsp_buf, send_len, &dst->overlap,
757 			 global_iface_write_completed)) {
758 		wpa_printf(MSG_DEBUG, "CTRL: WriteFileEx failed: %d",
759 			   (int) GetLastError());
760 		global_close_pipe(dst);
761 	} else {
762 		wpa_printf(MSG_DEBUG, "CTRL: Overlapped write started for %p",
763 			   dst);
764 	}
765 }
766 
767 
768 static VOID WINAPI global_iface_read_completed(DWORD err, DWORD bytes,
769 					       LPOVERLAPPED overlap)
770 {
771 	struct wpa_global_dst *dst = (struct wpa_global_dst *) overlap;
772 	wpa_printf(MSG_DEBUG, "CTRL: Overlapped read completed: dst=%p err=%d "
773 		   "bytes=%d", dst, (int) err, (int) bytes);
774 	if (err == 0 && bytes > 0)
775 		wpa_supplicant_global_iface_rx(dst, bytes);
776 }
777 
778 
779 static void wpa_supplicant_global_iface_receive(void *eloop_data,
780 						void *user_ctx)
781 {
782 	struct wpa_global_dst *dst = eloop_data;
783 	struct ctrl_iface_global_priv *priv = dst->priv;
784 	DWORD bytes;
785 
786 	wpa_printf(MSG_DEBUG, "CTRL: wpa_supplicant_global_iface_receive");
787 	ResetEvent(dst->overlap.hEvent);
788 
789 	if (!GetOverlappedResult(dst->pipe, &dst->overlap, &bytes, FALSE)) {
790 		wpa_printf(MSG_DEBUG, "CTRL: GetOverlappedResult failed: %d",
791 			   (int) GetLastError());
792 		return;
793 	}
794 	wpa_printf(MSG_DEBUG, "CTRL: GetOverlappedResult: New client "
795 		   "connected");
796 
797 	/* Open a new named pipe for the next client. */
798 	if (global_open_pipe(priv) < 0) {
799 		wpa_printf(MSG_DEBUG, "CTRL: global_open_pipe failed");
800 		return;
801 	}
802 
803 	/* Use write completion function to start reading a command */
804 	global_iface_write_completed(0, 0, &dst->overlap);
805 
806 	global_flush_broken_pipes(priv);
807 }
808 
809 
810 struct ctrl_iface_global_priv *
811 wpa_supplicant_global_ctrl_iface_init(struct wpa_global *global)
812 {
813 	struct ctrl_iface_global_priv *priv;
814 
815 	priv = os_zalloc(sizeof(*priv));
816 	if (priv == NULL)
817 		return NULL;
818 	priv->global = global;
819 
820 	if (global_open_pipe(priv) < 0) {
821 		os_free(priv);
822 		return NULL;
823 	}
824 
825 	return priv;
826 }
827 
828 
829 void
830 wpa_supplicant_global_ctrl_iface_deinit(struct ctrl_iface_global_priv *priv)
831 {
832 	while (priv->ctrl_dst)
833 		global_close_pipe(priv->ctrl_dst);
834 	os_free(priv);
835 }
836