1/* 2 * WPA Supplicant / UNIX domain socket -based control interface 3 * Copyright (c) 2004-2014, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "includes.h" 10#include <sys/un.h> 11#include <sys/stat.h> 12#include <grp.h> 13#include <stddef.h> 14#include <unistd.h> 15#include <fcntl.h> 16#ifdef __linux__ 17#include <sys/ioctl.h> 18#endif /* __linux__ */ 19#ifdef ANDROID 20#include <cutils/sockets.h> 21#endif /* ANDROID */ 22 23#include "utils/common.h" 24#include "utils/eloop.h" 25#include "utils/list.h" 26#include "common/ctrl_iface_common.h" 27#include "eapol_supp/eapol_supp_sm.h" 28#include "config.h" 29#include "wpa_supplicant_i.h" 30#include "ctrl_iface.h" 31 32/* Per-interface ctrl_iface */ 33 34struct ctrl_iface_priv { 35 struct wpa_supplicant *wpa_s; 36 int sock; 37 struct dl_list ctrl_dst; 38 int android_control_socket; 39 struct dl_list msg_queue; 40 unsigned int throttle_count; 41}; 42 43 44struct ctrl_iface_global_priv { 45 struct wpa_global *global; 46 int sock; 47 struct dl_list ctrl_dst; 48 int android_control_socket; 49 struct dl_list msg_queue; 50 unsigned int throttle_count; 51}; 52 53struct ctrl_iface_msg { 54 struct dl_list list; 55 struct wpa_supplicant *wpa_s; 56 int level; 57 enum wpa_msg_type type; 58 const char *txt; 59 size_t len; 60}; 61 62 63static void wpa_supplicant_ctrl_iface_send(struct wpa_supplicant *wpa_s, 64 const char *ifname, int sock, 65 struct dl_list *ctrl_dst, 66 int level, const char *buf, 67 size_t len, 68 struct ctrl_iface_priv *priv, 69 struct ctrl_iface_global_priv *gp); 70static int wpas_ctrl_iface_reinit(struct wpa_supplicant *wpa_s, 71 struct ctrl_iface_priv *priv); 72static int wpas_ctrl_iface_global_reinit(struct wpa_global *global, 73 struct ctrl_iface_global_priv *priv); 74 75 76static void wpas_ctrl_sock_debug(const char *title, int sock, const char *buf, 77 size_t len) 78{ 79#ifdef __linux__ 80 socklen_t optlen; 81 int sndbuf, outq; 82 int level = MSG_MSGDUMP; 83 84 if (len >= 5 && os_strncmp(buf, "PONG\n", 5) == 0) 85 level = MSG_EXCESSIVE; 86 87 optlen = sizeof(sndbuf); 88 sndbuf = 0; 89 if (getsockopt(sock, SOL_SOCKET, SO_SNDBUF, &sndbuf, &optlen) < 0) 90 sndbuf = -1; 91 92 if (ioctl(sock, TIOCOUTQ, &outq) < 0) 93 outq = -1; 94 95 wpa_printf(level, 96 "CTRL-DEBUG: %s: sock=%d sndbuf=%d outq=%d send_len=%d", 97 title, sock, sndbuf, outq, (int) len); 98#endif /* __linux__ */ 99} 100 101 102static int wpa_supplicant_ctrl_iface_attach(struct dl_list *ctrl_dst, 103 struct sockaddr_storage *from, 104 socklen_t fromlen, int global) 105{ 106 return ctrl_iface_attach(ctrl_dst, from, fromlen, NULL); 107} 108 109 110static int wpa_supplicant_ctrl_iface_detach(struct dl_list *ctrl_dst, 111 struct sockaddr_storage *from, 112 socklen_t fromlen) 113{ 114 return ctrl_iface_detach(ctrl_dst, from, fromlen); 115} 116 117 118static int wpa_supplicant_ctrl_iface_level(struct ctrl_iface_priv *priv, 119 struct sockaddr_storage *from, 120 socklen_t fromlen, 121 char *level) 122{ 123 wpa_printf(MSG_DEBUG, "CTRL_IFACE LEVEL %s", level); 124 125 return ctrl_iface_level(&priv->ctrl_dst, from, fromlen, level); 126} 127 128 129static void wpa_supplicant_ctrl_iface_receive(int sock, void *eloop_ctx, 130 void *sock_ctx) 131{ 132 struct wpa_supplicant *wpa_s = eloop_ctx; 133 struct ctrl_iface_priv *priv = sock_ctx; 134 char buf[4096]; 135 int res; 136 struct sockaddr_storage from; 137 socklen_t fromlen = sizeof(from); 138 char *reply = NULL, *reply_buf = NULL; 139 size_t reply_len = 0; 140 int new_attached = 0; 141 142 res = recvfrom(sock, buf, sizeof(buf) - 1, 0, 143 (struct sockaddr *) &from, &fromlen); 144 if (res < 0) { 145 wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s", 146 strerror(errno)); 147 return; 148 } 149 buf[res] = '\0'; 150 151 if (os_strcmp(buf, "ATTACH") == 0) { 152 if (wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst, &from, 153 fromlen, 0)) 154 reply_len = 1; 155 else { 156 new_attached = 1; 157 reply_len = 2; 158 } 159 } else if (os_strcmp(buf, "DETACH") == 0) { 160 if (wpa_supplicant_ctrl_iface_detach(&priv->ctrl_dst, &from, 161 fromlen)) 162 reply_len = 1; 163 else 164 reply_len = 2; 165 } else if (os_strncmp(buf, "LEVEL ", 6) == 0) { 166 if (wpa_supplicant_ctrl_iface_level(priv, &from, fromlen, 167 buf + 6)) 168 reply_len = 1; 169 else 170 reply_len = 2; 171 } else { 172 reply_buf = wpa_supplicant_ctrl_iface_process(wpa_s, buf, 173 &reply_len); 174 reply = reply_buf; 175 176 /* 177 * There could be some password/key material in the command, so 178 * clear the buffer explicitly now that it is not needed 179 * anymore. 180 */ 181 os_memset(buf, 0, res); 182 } 183 184 if (!reply && reply_len == 1) { 185 reply = "FAIL\n"; 186 reply_len = 5; 187 } else if (!reply && reply_len == 2) { 188 reply = "OK\n"; 189 reply_len = 3; 190 } 191 192 if (reply) { 193 wpas_ctrl_sock_debug("ctrl_sock-sendto", sock, reply, 194 reply_len); 195 if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from, 196 fromlen) < 0) { 197 int _errno = errno; 198 wpa_dbg(wpa_s, MSG_DEBUG, 199 "ctrl_iface sendto failed: %d - %s", 200 _errno, strerror(_errno)); 201 if (_errno == ENOBUFS || _errno == EAGAIN) { 202 /* 203 * The socket send buffer could be full. This 204 * may happen if client programs are not 205 * receiving their pending messages. Close and 206 * reopen the socket as a workaround to avoid 207 * getting stuck being unable to send any new 208 * responses. 209 */ 210 sock = wpas_ctrl_iface_reinit(wpa_s, priv); 211 if (sock < 0) { 212 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to reinitialize ctrl_iface socket"); 213 } 214 } 215 if (new_attached) { 216 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to send response to ATTACH - detaching"); 217 new_attached = 0; 218 wpa_supplicant_ctrl_iface_detach( 219 &priv->ctrl_dst, &from, fromlen); 220 } 221 } 222 } 223 os_free(reply_buf); 224 225 if (new_attached) 226 eapol_sm_notify_ctrl_attached(wpa_s->eapol); 227} 228 229 230static char * wpa_supplicant_ctrl_iface_path(struct wpa_supplicant *wpa_s) 231{ 232 char *buf; 233 size_t len; 234 char *pbuf, *dir = NULL; 235 int res; 236 237 if (wpa_s->conf->ctrl_interface == NULL) 238 return NULL; 239 240 pbuf = os_strdup(wpa_s->conf->ctrl_interface); 241 if (pbuf == NULL) 242 return NULL; 243 if (os_strncmp(pbuf, "DIR=", 4) == 0) { 244 char *gid_str; 245 dir = pbuf + 4; 246 gid_str = os_strstr(dir, " GROUP="); 247 if (gid_str) 248 *gid_str = '\0'; 249 } else 250 dir = pbuf; 251 252 len = os_strlen(dir) + os_strlen(wpa_s->ifname) + 2; 253 buf = os_malloc(len); 254 if (buf == NULL) { 255 os_free(pbuf); 256 return NULL; 257 } 258 259 res = os_snprintf(buf, len, "%s/%s", dir, wpa_s->ifname); 260 if (os_snprintf_error(len, res)) { 261 os_free(pbuf); 262 os_free(buf); 263 return NULL; 264 } 265#ifdef __CYGWIN__ 266 { 267 /* Windows/WinPcap uses interface names that are not suitable 268 * as a file name - convert invalid chars to underscores */ 269 char *pos = buf; 270 while (*pos) { 271 if (*pos == '\\') 272 *pos = '_'; 273 pos++; 274 } 275 } 276#endif /* __CYGWIN__ */ 277 os_free(pbuf); 278 return buf; 279} 280 281 282static int wpas_ctrl_iface_throttle(int sock) 283{ 284#ifdef __linux__ 285 socklen_t optlen; 286 int sndbuf, outq; 287 288 optlen = sizeof(sndbuf); 289 sndbuf = 0; 290 if (getsockopt(sock, SOL_SOCKET, SO_SNDBUF, &sndbuf, &optlen) < 0 || 291 ioctl(sock, TIOCOUTQ, &outq) < 0 || 292 sndbuf <= 0 || outq < 0) 293 return 0; 294 return outq > sndbuf / 2; 295#else /* __linux__ */ 296 return 0; 297#endif /* __linux__ */ 298} 299 300 301static void wpas_ctrl_msg_send_pending_global(struct wpa_global *global) 302{ 303 struct ctrl_iface_global_priv *gpriv; 304 struct ctrl_iface_msg *msg; 305 306 gpriv = global->ctrl_iface; 307 while (gpriv && !dl_list_empty(&gpriv->msg_queue) && 308 !wpas_ctrl_iface_throttle(gpriv->sock)) { 309 msg = dl_list_first(&gpriv->msg_queue, struct ctrl_iface_msg, 310 list); 311 if (!msg) 312 break; 313 dl_list_del(&msg->list); 314 wpa_supplicant_ctrl_iface_send( 315 msg->wpa_s, 316 msg->type != WPA_MSG_PER_INTERFACE ? 317 NULL : msg->wpa_s->ifname, 318 gpriv->sock, &gpriv->ctrl_dst, msg->level, 319 msg->txt, msg->len, NULL, gpriv); 320 os_free(msg); 321 } 322} 323 324 325static void wpas_ctrl_msg_send_pending_iface(struct wpa_supplicant *wpa_s) 326{ 327 struct ctrl_iface_priv *priv; 328 struct ctrl_iface_msg *msg; 329 330 priv = wpa_s->ctrl_iface; 331 while (priv && !dl_list_empty(&priv->msg_queue) && 332 !wpas_ctrl_iface_throttle(priv->sock)) { 333 msg = dl_list_first(&priv->msg_queue, struct ctrl_iface_msg, 334 list); 335 if (!msg) 336 break; 337 dl_list_del(&msg->list); 338 wpa_supplicant_ctrl_iface_send(wpa_s, NULL, priv->sock, 339 &priv->ctrl_dst, msg->level, 340 msg->txt, msg->len, priv, NULL); 341 os_free(msg); 342 } 343} 344 345 346static void wpas_ctrl_msg_queue_timeout(void *eloop_ctx, void *timeout_ctx) 347{ 348 struct wpa_supplicant *wpa_s = eloop_ctx; 349 struct ctrl_iface_priv *priv; 350 struct ctrl_iface_global_priv *gpriv; 351 int sock = -1, gsock = -1; 352 353 wpas_ctrl_msg_send_pending_global(wpa_s->global); 354 wpas_ctrl_msg_send_pending_iface(wpa_s); 355 356 priv = wpa_s->ctrl_iface; 357 if (priv && !dl_list_empty(&priv->msg_queue)) 358 sock = priv->sock; 359 360 gpriv = wpa_s->global->ctrl_iface; 361 if (gpriv && !dl_list_empty(&gpriv->msg_queue)) 362 gsock = gpriv->sock; 363 364 if (sock > -1 || gsock > -1) { 365 /* Continue pending message transmission from a timeout */ 366 wpa_printf(MSG_MSGDUMP, 367 "CTRL: Had to throttle pending event message transmission for (sock %d gsock %d)", 368 sock, gsock); 369 eloop_register_timeout(0, 20000, wpas_ctrl_msg_queue_timeout, 370 wpa_s, NULL); 371 } 372} 373 374 375static void wpas_ctrl_msg_queue(struct dl_list *queue, 376 struct wpa_supplicant *wpa_s, int level, 377 enum wpa_msg_type type, 378 const char *txt, size_t len) 379{ 380 struct ctrl_iface_msg *msg; 381 382 msg = os_zalloc(sizeof(*msg) + len); 383 if (!msg) 384 return; 385 386 msg->wpa_s = wpa_s; 387 msg->level = level; 388 msg->type = type; 389 os_memcpy(msg + 1, txt, len); 390 msg->txt = (const char *) (msg + 1); 391 msg->len = len; 392 dl_list_add_tail(queue, &msg->list); 393 eloop_cancel_timeout(wpas_ctrl_msg_queue_timeout, wpa_s, NULL); 394 eloop_register_timeout(0, 0, wpas_ctrl_msg_queue_timeout, wpa_s, NULL); 395} 396 397 398static void wpas_ctrl_msg_queue_limit(unsigned int throttle_count, 399 struct dl_list *queue) 400{ 401 struct ctrl_iface_msg *msg; 402 403 if (throttle_count < 2000) 404 return; 405 406 msg = dl_list_first(queue, struct ctrl_iface_msg, list); 407 if (msg) { 408 wpa_printf(MSG_DEBUG, "CTRL: Dropped oldest pending message"); 409 dl_list_del(&msg->list); 410 os_free(msg); 411 } 412} 413 414 415static void wpa_supplicant_ctrl_iface_msg_cb(void *ctx, int level, 416 enum wpa_msg_type type, 417 const char *txt, size_t len) 418{ 419 struct wpa_supplicant *wpa_s = ctx; 420 struct ctrl_iface_priv *priv; 421 struct ctrl_iface_global_priv *gpriv; 422 423 if (wpa_s == NULL) 424 return; 425 426 gpriv = wpa_s->global->ctrl_iface; 427 428 if (type != WPA_MSG_NO_GLOBAL && gpriv && 429 !dl_list_empty(&gpriv->ctrl_dst)) { 430 if (!dl_list_empty(&gpriv->msg_queue) || 431 wpas_ctrl_iface_throttle(gpriv->sock)) { 432 if (gpriv->throttle_count == 0) { 433 wpa_printf(MSG_MSGDUMP, 434 "CTRL: Had to throttle global event message for sock %d", 435 gpriv->sock); 436 } 437 gpriv->throttle_count++; 438 wpas_ctrl_msg_queue_limit(gpriv->throttle_count, 439 &gpriv->msg_queue); 440 wpas_ctrl_msg_queue(&gpriv->msg_queue, wpa_s, level, 441 type, txt, len); 442 } else { 443 if (gpriv->throttle_count) { 444 wpa_printf(MSG_MSGDUMP, 445 "CTRL: Had to throttle %u global event message(s) for sock %d", 446 gpriv->throttle_count, gpriv->sock); 447 } 448 gpriv->throttle_count = 0; 449 wpa_supplicant_ctrl_iface_send( 450 wpa_s, 451 type != WPA_MSG_PER_INTERFACE ? 452 NULL : wpa_s->ifname, 453 gpriv->sock, &gpriv->ctrl_dst, level, 454 txt, len, NULL, gpriv); 455 } 456 } 457 458 priv = wpa_s->ctrl_iface; 459 460 if (type != WPA_MSG_ONLY_GLOBAL && priv) { 461 if (!dl_list_empty(&priv->msg_queue) || 462 wpas_ctrl_iface_throttle(priv->sock)) { 463 if (priv->throttle_count == 0) { 464 wpa_printf(MSG_MSGDUMP, 465 "CTRL: Had to throttle event message for sock %d", 466 priv->sock); 467 } 468 priv->throttle_count++; 469 wpas_ctrl_msg_queue_limit(priv->throttle_count, 470 &priv->msg_queue); 471 wpas_ctrl_msg_queue(&priv->msg_queue, wpa_s, level, 472 type, txt, len); 473 } else { 474 if (priv->throttle_count) { 475 wpa_printf(MSG_MSGDUMP, 476 "CTRL: Had to throttle %u event message(s) for sock %d", 477 priv->throttle_count, priv->sock); 478 } 479 priv->throttle_count = 0; 480 wpa_supplicant_ctrl_iface_send(wpa_s, NULL, priv->sock, 481 &priv->ctrl_dst, level, 482 txt, len, priv, NULL); 483 } 484 } 485} 486 487 488static int wpas_ctrl_iface_open_sock(struct wpa_supplicant *wpa_s, 489 struct ctrl_iface_priv *priv) 490{ 491 struct sockaddr_un addr; 492 char *fname = NULL; 493 gid_t gid = 0; 494 int gid_set = 0; 495 char *buf, *dir = NULL, *gid_str = NULL; 496 struct group *grp; 497 char *endp; 498 int flags; 499 500 buf = os_strdup(wpa_s->conf->ctrl_interface); 501 if (buf == NULL) 502 goto fail; 503#ifdef ANDROID 504 os_snprintf(addr.sun_path, sizeof(addr.sun_path), "wpa_%s", 505 wpa_s->conf->ctrl_interface); 506 priv->sock = android_get_control_socket(addr.sun_path); 507 if (priv->sock >= 0) { 508 priv->android_control_socket = 1; 509 goto havesock; 510 } 511#endif /* ANDROID */ 512 if (os_strncmp(buf, "DIR=", 4) == 0) { 513 dir = buf + 4; 514 gid_str = os_strstr(dir, " GROUP="); 515 if (gid_str) { 516 *gid_str = '\0'; 517 gid_str += 7; 518 } 519 } else { 520 dir = buf; 521 gid_str = wpa_s->conf->ctrl_interface_group; 522 } 523 524 if (mkdir(dir, S_IRWXU | S_IRWXG) < 0) { 525 if (errno == EEXIST) { 526 wpa_printf(MSG_DEBUG, "Using existing control " 527 "interface directory."); 528 } else { 529 wpa_printf(MSG_ERROR, "mkdir[ctrl_interface=%s]: %s", 530 dir, strerror(errno)); 531 goto fail; 532 } 533 } 534 535#ifdef ANDROID 536 /* 537 * wpa_supplicant is started from /init.*.rc on Android and that seems 538 * to be using umask 0077 which would leave the control interface 539 * directory without group access. This breaks things since Wi-Fi 540 * framework assumes that this directory can be accessed by other 541 * applications in the wifi group. Fix this by adding group access even 542 * if umask value would prevent this. 543 */ 544 if (chmod(dir, S_IRWXU | S_IRWXG) < 0) { 545 wpa_printf(MSG_ERROR, "CTRL: Could not chmod directory: %s", 546 strerror(errno)); 547 /* Try to continue anyway */ 548 } 549#endif /* ANDROID */ 550 551 if (gid_str) { 552 grp = getgrnam(gid_str); 553 if (grp) { 554 gid = grp->gr_gid; 555 gid_set = 1; 556 wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d" 557 " (from group name '%s')", 558 (int) gid, gid_str); 559 } else { 560 /* Group name not found - try to parse this as gid */ 561 gid = strtol(gid_str, &endp, 10); 562 if (*gid_str == '\0' || *endp != '\0') { 563 wpa_printf(MSG_ERROR, "CTRL: Invalid group " 564 "'%s'", gid_str); 565 goto fail; 566 } 567 gid_set = 1; 568 wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d", 569 (int) gid); 570 } 571 } 572 573 if (gid_set && lchown(dir, -1, gid) < 0) { 574 wpa_printf(MSG_ERROR, "lchown[ctrl_interface=%s,gid=%d]: %s", 575 dir, (int) gid, strerror(errno)); 576 goto fail; 577 } 578 579 /* Make sure the group can enter and read the directory */ 580 if (gid_set && 581 chmod(dir, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP) < 0) { 582 wpa_printf(MSG_ERROR, "CTRL: chmod[ctrl_interface]: %s", 583 strerror(errno)); 584 goto fail; 585 } 586 587 if (os_strlen(dir) + 1 + os_strlen(wpa_s->ifname) >= 588 sizeof(addr.sun_path)) { 589 wpa_printf(MSG_ERROR, "ctrl_iface path limit exceeded"); 590 goto fail; 591 } 592 593 priv->sock = socket(PF_UNIX, SOCK_DGRAM, 0); 594 if (priv->sock < 0) { 595 wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno)); 596 goto fail; 597 } 598 599 os_memset(&addr, 0, sizeof(addr)); 600#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) 601 addr.sun_len = sizeof(addr); 602#endif /* __FreeBSD__ */ 603 addr.sun_family = AF_UNIX; 604 fname = wpa_supplicant_ctrl_iface_path(wpa_s); 605 if (fname == NULL) 606 goto fail; 607 os_strlcpy(addr.sun_path, fname, sizeof(addr.sun_path)); 608 if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) { 609 wpa_printf(MSG_DEBUG, "ctrl_iface bind(PF_UNIX) failed: %s", 610 strerror(errno)); 611 if (connect(priv->sock, (struct sockaddr *) &addr, 612 sizeof(addr)) < 0) { 613 wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not" 614 " allow connections - assuming it was left" 615 "over from forced program termination"); 616 if (unlink(fname) < 0) { 617 wpa_printf(MSG_ERROR, 618 "Could not unlink existing ctrl_iface socket '%s': %s", 619 fname, strerror(errno)); 620 goto fail; 621 } 622 if (bind(priv->sock, (struct sockaddr *) &addr, 623 sizeof(addr)) < 0) { 624 wpa_printf(MSG_ERROR, "supp-ctrl-iface-init: bind(PF_UNIX): %s", 625 strerror(errno)); 626 goto fail; 627 } 628 wpa_printf(MSG_DEBUG, "Successfully replaced leftover " 629 "ctrl_iface socket '%s'", fname); 630 } else { 631 wpa_printf(MSG_INFO, "ctrl_iface exists and seems to " 632 "be in use - cannot override it"); 633 wpa_printf(MSG_INFO, "Delete '%s' manually if it is " 634 "not used anymore", fname); 635 os_free(fname); 636 fname = NULL; 637 goto fail; 638 } 639 } 640 641 if (gid_set && lchown(fname, -1, gid) < 0) { 642 wpa_printf(MSG_ERROR, "lchown[ctrl_interface=%s,gid=%d]: %s", 643 fname, (int) gid, strerror(errno)); 644 goto fail; 645 } 646 647 if (chmod(fname, S_IRWXU | S_IRWXG) < 0) { 648 wpa_printf(MSG_ERROR, "chmod[ctrl_interface=%s]: %s", 649 fname, strerror(errno)); 650 goto fail; 651 } 652 os_free(fname); 653 654#ifdef ANDROID 655havesock: 656#endif /* ANDROID */ 657 658 /* 659 * Make socket non-blocking so that we don't hang forever if 660 * target dies unexpectedly. 661 */ 662 flags = fcntl(priv->sock, F_GETFL); 663 if (flags >= 0) { 664 flags |= O_NONBLOCK; 665 if (fcntl(priv->sock, F_SETFL, flags) < 0) { 666 wpa_printf(MSG_INFO, "fcntl(ctrl, O_NONBLOCK): %s", 667 strerror(errno)); 668 /* Not fatal, continue on.*/ 669 } 670 } 671 672 eloop_register_read_sock(priv->sock, wpa_supplicant_ctrl_iface_receive, 673 wpa_s, priv); 674 wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb); 675 676 os_free(buf); 677 return 0; 678 679fail: 680 if (priv->sock >= 0) { 681 close(priv->sock); 682 priv->sock = -1; 683 } 684 if (fname) { 685 unlink(fname); 686 os_free(fname); 687 } 688 os_free(buf); 689 return -1; 690} 691 692 693struct ctrl_iface_priv * 694wpa_supplicant_ctrl_iface_init(struct wpa_supplicant *wpa_s) 695{ 696 struct ctrl_iface_priv *priv; 697 698 priv = os_zalloc(sizeof(*priv)); 699 if (priv == NULL) 700 return NULL; 701 dl_list_init(&priv->ctrl_dst); 702 dl_list_init(&priv->msg_queue); 703 priv->wpa_s = wpa_s; 704 priv->sock = -1; 705 706 if (wpa_s->conf->ctrl_interface == NULL) 707 return priv; 708 709#ifdef ANDROID 710 if (wpa_s->global->params.ctrl_interface) { 711 int same = 0; 712 713 if (wpa_s->global->params.ctrl_interface[0] == '/') { 714 if (os_strcmp(wpa_s->global->params.ctrl_interface, 715 wpa_s->conf->ctrl_interface) == 0) 716 same = 1; 717 } else if (os_strncmp(wpa_s->global->params.ctrl_interface, 718 "@android:", 9) == 0 || 719 os_strncmp(wpa_s->global->params.ctrl_interface, 720 "@abstract:", 10) == 0) { 721 char *pos; 722 723 /* 724 * Currently, Android uses @android:wpa_* as the naming 725 * convention for the global ctrl interface. This logic 726 * needs to be revisited if the above naming convention 727 * is modified. 728 */ 729 pos = os_strchr(wpa_s->global->params.ctrl_interface, 730 '_'); 731 if (pos && 732 os_strcmp(pos + 1, 733 wpa_s->conf->ctrl_interface) == 0) 734 same = 1; 735 } 736 737 if (same) { 738 /* 739 * The invalid configuration combination might be 740 * possible to hit in an Android OTA upgrade case, so 741 * instead of refusing to start the wpa_supplicant 742 * process, do not open the per-interface ctrl_iface 743 * and continue with the global control interface that 744 * was set from the command line since the Wi-Fi 745 * framework will use it for operations. 746 */ 747 wpa_printf(MSG_ERROR, 748 "global ctrl interface %s matches ctrl interface %s - do not open per-interface ctrl interface", 749 wpa_s->global->params.ctrl_interface, 750 wpa_s->conf->ctrl_interface); 751 return priv; 752 } 753 } 754#endif /* ANDROID */ 755 756 if (wpas_ctrl_iface_open_sock(wpa_s, priv) < 0) { 757 os_free(priv); 758 return NULL; 759 } 760 761 return priv; 762} 763 764 765static int wpas_ctrl_iface_reinit(struct wpa_supplicant *wpa_s, 766 struct ctrl_iface_priv *priv) 767{ 768 int res; 769 770 if (priv->sock <= 0) 771 return -1; 772 773 /* 774 * On Android, the control socket being used may be the socket 775 * that is created when wpa_supplicant is started as a /init.*.rc 776 * service. Such a socket is maintained as a key-value pair in 777 * Android's environment. Closing this control socket would leave us 778 * in a bad state with an invalid socket descriptor. 779 */ 780 if (priv->android_control_socket) 781 return priv->sock; 782 783 eloop_unregister_read_sock(priv->sock); 784 close(priv->sock); 785 priv->sock = -1; 786 res = wpas_ctrl_iface_open_sock(wpa_s, priv); 787 if (res < 0) 788 return -1; 789 return priv->sock; 790} 791 792 793void wpa_supplicant_ctrl_iface_deinit(struct ctrl_iface_priv *priv) 794{ 795 struct wpa_ctrl_dst *dst, *prev; 796 struct ctrl_iface_msg *msg, *prev_msg; 797 struct ctrl_iface_global_priv *gpriv; 798 799 if (priv->sock > -1) { 800 char *fname; 801 char *buf, *dir = NULL; 802 eloop_unregister_read_sock(priv->sock); 803 if (!dl_list_empty(&priv->ctrl_dst)) { 804 /* 805 * Wait before closing the control socket if 806 * there are any attached monitors in order to allow 807 * them to receive any pending messages. 808 */ 809 wpa_printf(MSG_DEBUG, "CTRL_IFACE wait for attached " 810 "monitors to receive messages"); 811 os_sleep(0, 100000); 812 } 813 close(priv->sock); 814 priv->sock = -1; 815 fname = wpa_supplicant_ctrl_iface_path(priv->wpa_s); 816 if (fname) { 817 unlink(fname); 818 os_free(fname); 819 } 820 821 if (priv->wpa_s->conf->ctrl_interface == NULL) 822 goto free_dst; 823 buf = os_strdup(priv->wpa_s->conf->ctrl_interface); 824 if (buf == NULL) 825 goto free_dst; 826 if (os_strncmp(buf, "DIR=", 4) == 0) { 827 char *gid_str; 828 dir = buf + 4; 829 gid_str = os_strstr(dir, " GROUP="); 830 if (gid_str) 831 *gid_str = '\0'; 832 } else 833 dir = buf; 834 835 if (rmdir(dir) < 0) { 836 if (errno == ENOTEMPTY) { 837 wpa_printf(MSG_DEBUG, "Control interface " 838 "directory not empty - leaving it " 839 "behind"); 840 } else { 841 wpa_printf(MSG_ERROR, 842 "rmdir[ctrl_interface=%s]: %s", 843 dir, strerror(errno)); 844 } 845 } 846 os_free(buf); 847 } 848 849free_dst: 850 dl_list_for_each_safe(dst, prev, &priv->ctrl_dst, struct wpa_ctrl_dst, 851 list) { 852 dl_list_del(&dst->list); 853 os_free(dst); 854 } 855 dl_list_for_each_safe(msg, prev_msg, &priv->msg_queue, 856 struct ctrl_iface_msg, list) { 857 dl_list_del(&msg->list); 858 os_free(msg); 859 } 860 gpriv = priv->wpa_s->global->ctrl_iface; 861 if (gpriv) { 862 dl_list_for_each_safe(msg, prev_msg, &gpriv->msg_queue, 863 struct ctrl_iface_msg, list) { 864 if (msg->wpa_s == priv->wpa_s) { 865 dl_list_del(&msg->list); 866 os_free(msg); 867 } 868 } 869 } 870 eloop_cancel_timeout(wpas_ctrl_msg_queue_timeout, priv->wpa_s, NULL); 871 os_free(priv); 872} 873 874 875/** 876 * wpa_supplicant_ctrl_iface_send - Send a control interface packet to monitors 877 * @ifname: Interface name for global control socket or %NULL 878 * @sock: Local socket fd 879 * @ctrl_dst: List of attached listeners 880 * @level: Priority level of the message 881 * @buf: Message data 882 * @len: Message length 883 * 884 * Send a packet to all monitor programs attached to the control interface. 885 */ 886static void wpa_supplicant_ctrl_iface_send(struct wpa_supplicant *wpa_s, 887 const char *ifname, int sock, 888 struct dl_list *ctrl_dst, 889 int level, const char *buf, 890 size_t len, 891 struct ctrl_iface_priv *priv, 892 struct ctrl_iface_global_priv *gp) 893{ 894 struct wpa_ctrl_dst *dst, *next; 895 char levelstr[10]; 896 int idx, res; 897 struct msghdr msg; 898 struct iovec io[5]; 899 900 if (sock < 0 || dl_list_empty(ctrl_dst)) 901 return; 902 903 res = os_snprintf(levelstr, sizeof(levelstr), "<%d>", level); 904 if (os_snprintf_error(sizeof(levelstr), res)) 905 return; 906 idx = 0; 907 if (ifname) { 908 io[idx].iov_base = "IFNAME="; 909 io[idx].iov_len = 7; 910 idx++; 911 io[idx].iov_base = (char *) ifname; 912 io[idx].iov_len = os_strlen(ifname); 913 idx++; 914 io[idx].iov_base = " "; 915 io[idx].iov_len = 1; 916 idx++; 917 } 918 io[idx].iov_base = levelstr; 919 io[idx].iov_len = os_strlen(levelstr); 920 idx++; 921 io[idx].iov_base = (char *) buf; 922 io[idx].iov_len = len; 923 idx++; 924 os_memset(&msg, 0, sizeof(msg)); 925 msg.msg_iov = io; 926 msg.msg_iovlen = idx; 927 928 dl_list_for_each_safe(dst, next, ctrl_dst, struct wpa_ctrl_dst, list) { 929 int _errno; 930 char txt[200]; 931 932 if (level < dst->debug_level) 933 continue; 934 935 msg.msg_name = (void *) &dst->addr; 936 msg.msg_namelen = dst->addrlen; 937 wpas_ctrl_sock_debug("ctrl_sock-sendmsg", sock, buf, len); 938 if (sendmsg(sock, &msg, MSG_DONTWAIT) >= 0) { 939 sockaddr_print(MSG_MSGDUMP, 940 "CTRL_IFACE monitor sent successfully to", 941 &dst->addr, dst->addrlen); 942 dst->errors = 0; 943 continue; 944 } 945 946 _errno = errno; 947 os_snprintf(txt, sizeof(txt), "CTRL_IFACE monitor: %d (%s) for", 948 _errno, strerror(_errno)); 949 sockaddr_print(MSG_DEBUG, txt, &dst->addr, dst->addrlen); 950 dst->errors++; 951 952 if (dst->errors > 10 || _errno == ENOENT || _errno == EPERM) { 953 sockaddr_print(MSG_INFO, "CTRL_IFACE: Detach monitor that cannot receive messages:", 954 &dst->addr, dst->addrlen); 955 wpa_supplicant_ctrl_iface_detach(ctrl_dst, &dst->addr, 956 dst->addrlen); 957 } 958 959 if (_errno == ENOBUFS || _errno == EAGAIN) { 960 /* 961 * The socket send buffer could be full. This may happen 962 * if client programs are not receiving their pending 963 * messages. Close and reopen the socket as a workaround 964 * to avoid getting stuck being unable to send any new 965 * responses. 966 */ 967 if (priv) 968 sock = wpas_ctrl_iface_reinit(wpa_s, priv); 969 else if (gp) 970 sock = wpas_ctrl_iface_global_reinit( 971 wpa_s->global, gp); 972 else 973 break; 974 if (sock < 0) { 975 wpa_dbg(wpa_s, MSG_DEBUG, 976 "Failed to reinitialize ctrl_iface socket"); 977 break; 978 } 979 } 980 } 981} 982 983 984void wpa_supplicant_ctrl_iface_wait(struct ctrl_iface_priv *priv) 985{ 986 char buf[256]; 987 int res; 988 struct sockaddr_storage from; 989 socklen_t fromlen = sizeof(from); 990 991 if (priv->sock == -1) 992 return; 993 994 for (;;) { 995 wpa_printf(MSG_DEBUG, "CTRL_IFACE - %s - wait for monitor to " 996 "attach", priv->wpa_s->ifname); 997 eloop_wait_for_read_sock(priv->sock); 998 999 res = recvfrom(priv->sock, buf, sizeof(buf) - 1, 0, 1000 (struct sockaddr *) &from, &fromlen); 1001 if (res < 0) { 1002 wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s", 1003 strerror(errno)); 1004 continue; 1005 } 1006 buf[res] = '\0'; 1007 1008 if (os_strcmp(buf, "ATTACH") == 0) { 1009 /* handle ATTACH signal of first monitor interface */ 1010 if (!wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst, 1011 &from, fromlen, 1012 0)) { 1013 if (sendto(priv->sock, "OK\n", 3, 0, 1014 (struct sockaddr *) &from, fromlen) < 1015 0) { 1016 wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s", 1017 strerror(errno)); 1018 } 1019 /* OK to continue */ 1020 return; 1021 } else { 1022 if (sendto(priv->sock, "FAIL\n", 5, 0, 1023 (struct sockaddr *) &from, fromlen) < 1024 0) { 1025 wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s", 1026 strerror(errno)); 1027 } 1028 } 1029 } else { 1030 /* return FAIL for all other signals */ 1031 if (sendto(priv->sock, "FAIL\n", 5, 0, 1032 (struct sockaddr *) &from, fromlen) < 0) { 1033 wpa_printf(MSG_DEBUG, 1034 "ctrl_iface sendto failed: %s", 1035 strerror(errno)); 1036 } 1037 } 1038 } 1039} 1040 1041 1042/* Global ctrl_iface */ 1043 1044static void wpa_supplicant_global_ctrl_iface_receive(int sock, void *eloop_ctx, 1045 void *sock_ctx) 1046{ 1047 struct wpa_global *global = eloop_ctx; 1048 struct ctrl_iface_global_priv *priv = sock_ctx; 1049 char buf[4096]; 1050 int res; 1051 struct sockaddr_storage from; 1052 socklen_t fromlen = sizeof(from); 1053 char *reply = NULL, *reply_buf = NULL; 1054 size_t reply_len; 1055 1056 res = recvfrom(sock, buf, sizeof(buf) - 1, 0, 1057 (struct sockaddr *) &from, &fromlen); 1058 if (res < 0) { 1059 wpa_printf(MSG_ERROR, "recvfrom(ctrl_iface): %s", 1060 strerror(errno)); 1061 return; 1062 } 1063 buf[res] = '\0'; 1064 1065 if (os_strcmp(buf, "ATTACH") == 0) { 1066 if (wpa_supplicant_ctrl_iface_attach(&priv->ctrl_dst, &from, 1067 fromlen, 1)) 1068 reply_len = 1; 1069 else 1070 reply_len = 2; 1071 } else if (os_strcmp(buf, "DETACH") == 0) { 1072 if (wpa_supplicant_ctrl_iface_detach(&priv->ctrl_dst, &from, 1073 fromlen)) 1074 reply_len = 1; 1075 else 1076 reply_len = 2; 1077 } else { 1078 reply_buf = wpa_supplicant_global_ctrl_iface_process( 1079 global, buf, &reply_len); 1080 reply = reply_buf; 1081 1082 /* 1083 * There could be some password/key material in the command, so 1084 * clear the buffer explicitly now that it is not needed 1085 * anymore. 1086 */ 1087 os_memset(buf, 0, res); 1088 } 1089 1090 if (!reply && reply_len == 1) { 1091 reply = "FAIL\n"; 1092 reply_len = 5; 1093 } else if (!reply && reply_len == 2) { 1094 reply = "OK\n"; 1095 reply_len = 3; 1096 } 1097 1098 if (reply) { 1099 wpas_ctrl_sock_debug("global_ctrl_sock-sendto", 1100 sock, reply, reply_len); 1101 if (sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from, 1102 fromlen) < 0) { 1103 wpa_printf(MSG_DEBUG, "ctrl_iface sendto failed: %s", 1104 strerror(errno)); 1105 } 1106 } 1107 os_free(reply_buf); 1108} 1109 1110 1111static int wpas_global_ctrl_iface_open_sock(struct wpa_global *global, 1112 struct ctrl_iface_global_priv *priv) 1113{ 1114 struct sockaddr_un addr; 1115 const char *ctrl = global->params.ctrl_interface; 1116 int flags; 1117 1118 wpa_printf(MSG_DEBUG, "Global control interface '%s'", ctrl); 1119 1120#ifdef ANDROID 1121 if (os_strncmp(ctrl, "@android:", 9) == 0) { 1122 priv->sock = android_get_control_socket(ctrl + 9); 1123 if (priv->sock < 0) { 1124 wpa_printf(MSG_ERROR, "Failed to open Android control " 1125 "socket '%s'", ctrl + 9); 1126 goto fail; 1127 } 1128 wpa_printf(MSG_DEBUG, "Using Android control socket '%s'", 1129 ctrl + 9); 1130 priv->android_control_socket = 1; 1131 goto havesock; 1132 } 1133 1134 if (os_strncmp(ctrl, "@abstract:", 10) != 0) { 1135 /* 1136 * Backwards compatibility - try to open an Android control 1137 * socket and if that fails, assume this was a UNIX domain 1138 * socket instead. 1139 */ 1140 priv->sock = android_get_control_socket(ctrl); 1141 if (priv->sock >= 0) { 1142 wpa_printf(MSG_DEBUG, 1143 "Using Android control socket '%s'", 1144 ctrl); 1145 priv->android_control_socket = 1; 1146 goto havesock; 1147 } 1148 } 1149#endif /* ANDROID */ 1150 1151 priv->sock = socket(PF_UNIX, SOCK_DGRAM, 0); 1152 if (priv->sock < 0) { 1153 wpa_printf(MSG_ERROR, "socket(PF_UNIX): %s", strerror(errno)); 1154 goto fail; 1155 } 1156 1157 os_memset(&addr, 0, sizeof(addr)); 1158#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) 1159 addr.sun_len = sizeof(addr); 1160#endif /* __FreeBSD__ */ 1161 addr.sun_family = AF_UNIX; 1162 1163 if (os_strncmp(ctrl, "@abstract:", 10) == 0) { 1164 addr.sun_path[0] = '\0'; 1165 os_strlcpy(addr.sun_path + 1, ctrl + 10, 1166 sizeof(addr.sun_path) - 1); 1167 if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 1168 0) { 1169 wpa_printf(MSG_ERROR, "supp-global-ctrl-iface-init: " 1170 "bind(PF_UNIX;%s) failed: %s", 1171 ctrl, strerror(errno)); 1172 goto fail; 1173 } 1174 wpa_printf(MSG_DEBUG, "Using Abstract control socket '%s'", 1175 ctrl + 10); 1176 goto havesock; 1177 } 1178 1179 os_strlcpy(addr.sun_path, ctrl, sizeof(addr.sun_path)); 1180 if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) { 1181 wpa_printf(MSG_INFO, "supp-global-ctrl-iface-init(%s) (will try fixup): bind(PF_UNIX): %s", 1182 ctrl, strerror(errno)); 1183 if (connect(priv->sock, (struct sockaddr *) &addr, 1184 sizeof(addr)) < 0) { 1185 wpa_printf(MSG_DEBUG, "ctrl_iface exists, but does not" 1186 " allow connections - assuming it was left" 1187 "over from forced program termination"); 1188 if (unlink(ctrl) < 0) { 1189 wpa_printf(MSG_ERROR, 1190 "Could not unlink existing ctrl_iface socket '%s': %s", 1191 ctrl, strerror(errno)); 1192 goto fail; 1193 } 1194 if (bind(priv->sock, (struct sockaddr *) &addr, 1195 sizeof(addr)) < 0) { 1196 wpa_printf(MSG_ERROR, "supp-glb-iface-init: bind(PF_UNIX;%s): %s", 1197 ctrl, strerror(errno)); 1198 goto fail; 1199 } 1200 wpa_printf(MSG_DEBUG, "Successfully replaced leftover " 1201 "ctrl_iface socket '%s'", 1202 ctrl); 1203 } else { 1204 wpa_printf(MSG_INFO, "ctrl_iface exists and seems to " 1205 "be in use - cannot override it"); 1206 wpa_printf(MSG_INFO, "Delete '%s' manually if it is " 1207 "not used anymore", 1208 ctrl); 1209 goto fail; 1210 } 1211 } 1212 1213 wpa_printf(MSG_DEBUG, "Using UNIX control socket '%s'", ctrl); 1214 1215 if (global->params.ctrl_interface_group) { 1216 char *gid_str = global->params.ctrl_interface_group; 1217 gid_t gid = 0; 1218 struct group *grp; 1219 char *endp; 1220 1221 grp = getgrnam(gid_str); 1222 if (grp) { 1223 gid = grp->gr_gid; 1224 wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d" 1225 " (from group name '%s')", 1226 (int) gid, gid_str); 1227 } else { 1228 /* Group name not found - try to parse this as gid */ 1229 gid = strtol(gid_str, &endp, 10); 1230 if (*gid_str == '\0' || *endp != '\0') { 1231 wpa_printf(MSG_ERROR, "CTRL: Invalid group " 1232 "'%s'", gid_str); 1233 goto fail; 1234 } 1235 wpa_printf(MSG_DEBUG, "ctrl_interface_group=%d", 1236 (int) gid); 1237 } 1238 if (lchown(ctrl, -1, gid) < 0) { 1239 wpa_printf(MSG_ERROR, 1240 "lchown[global_ctrl_interface=%s,gid=%d]: %s", 1241 ctrl, (int) gid, strerror(errno)); 1242 goto fail; 1243 } 1244 1245 if (chmod(ctrl, S_IRWXU | S_IRWXG) < 0) { 1246 wpa_printf(MSG_ERROR, 1247 "chmod[global_ctrl_interface=%s]: %s", 1248 ctrl, strerror(errno)); 1249 goto fail; 1250 } 1251 } else { 1252 if (chmod(ctrl, S_IRWXU) < 0) { 1253 wpa_printf(MSG_DEBUG, 1254 "chmod[global_ctrl_interface=%s](S_IRWXU): %s", 1255 ctrl, strerror(errno)); 1256 /* continue anyway since group change was not required 1257 */ 1258 } 1259 } 1260 1261havesock: 1262 1263 /* 1264 * Make socket non-blocking so that we don't hang forever if 1265 * target dies unexpectedly. 1266 */ 1267 flags = fcntl(priv->sock, F_GETFL); 1268 if (flags >= 0) { 1269 flags |= O_NONBLOCK; 1270 if (fcntl(priv->sock, F_SETFL, flags) < 0) { 1271 wpa_printf(MSG_INFO, "fcntl(ctrl, O_NONBLOCK): %s", 1272 strerror(errno)); 1273 /* Not fatal, continue on.*/ 1274 } 1275 } 1276 1277 eloop_register_read_sock(priv->sock, 1278 wpa_supplicant_global_ctrl_iface_receive, 1279 global, priv); 1280 1281 return 0; 1282 1283fail: 1284 if (priv->sock >= 0) { 1285 close(priv->sock); 1286 priv->sock = -1; 1287 } 1288 return -1; 1289} 1290 1291 1292struct ctrl_iface_global_priv * 1293wpa_supplicant_global_ctrl_iface_init(struct wpa_global *global) 1294{ 1295 struct ctrl_iface_global_priv *priv; 1296 1297 priv = os_zalloc(sizeof(*priv)); 1298 if (priv == NULL) 1299 return NULL; 1300 dl_list_init(&priv->ctrl_dst); 1301 dl_list_init(&priv->msg_queue); 1302 priv->global = global; 1303 priv->sock = -1; 1304 1305 if (global->params.ctrl_interface == NULL) 1306 return priv; 1307 1308 if (wpas_global_ctrl_iface_open_sock(global, priv) < 0) { 1309 os_free(priv); 1310 return NULL; 1311 } 1312 1313 wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb); 1314 1315 return priv; 1316} 1317 1318 1319static int wpas_ctrl_iface_global_reinit(struct wpa_global *global, 1320 struct ctrl_iface_global_priv *priv) 1321{ 1322 int res; 1323 1324 if (priv->sock <= 0) 1325 return -1; 1326 1327 /* 1328 * On Android, the control socket being used may be the socket 1329 * that is created when wpa_supplicant is started as a /init.*.rc 1330 * service. Such a socket is maintained as a key-value pair in 1331 * Android's environment. Closing this control socket would leave us 1332 * in a bad state with an invalid socket descriptor. 1333 */ 1334 if (priv->android_control_socket) 1335 return priv->sock; 1336 1337 eloop_unregister_read_sock(priv->sock); 1338 close(priv->sock); 1339 priv->sock = -1; 1340 res = wpas_global_ctrl_iface_open_sock(global, priv); 1341 if (res < 0) 1342 return -1; 1343 return priv->sock; 1344} 1345 1346 1347void 1348wpa_supplicant_global_ctrl_iface_deinit(struct ctrl_iface_global_priv *priv) 1349{ 1350 struct wpa_ctrl_dst *dst, *prev; 1351 struct ctrl_iface_msg *msg, *prev_msg; 1352 1353 if (priv->sock >= 0) { 1354 eloop_unregister_read_sock(priv->sock); 1355 close(priv->sock); 1356 } 1357 if (priv->global->params.ctrl_interface) 1358 unlink(priv->global->params.ctrl_interface); 1359 dl_list_for_each_safe(dst, prev, &priv->ctrl_dst, struct wpa_ctrl_dst, 1360 list) { 1361 dl_list_del(&dst->list); 1362 os_free(dst); 1363 } 1364 dl_list_for_each_safe(msg, prev_msg, &priv->msg_queue, 1365 struct ctrl_iface_msg, list) { 1366 dl_list_del(&msg->list); 1367 os_free(msg); 1368 } 1369 os_free(priv); 1370} 1371