1 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 // Windows Vista uses the Native Wifi (WLAN) API for accessing WiFi cards. See
6 // http://msdn.microsoft.com/en-us/library/ms705945(VS.85).aspx. Windows XP
7 // Service Pack 3 (and Windows XP Service Pack 2, if upgraded with a hot fix)
8 // also support a limited version of the WLAN API. See
9 // http://msdn.microsoft.com/en-us/library/bb204766.aspx. The WLAN API uses
10 // wlanapi.h, which is not part of the SDK used by Gears, so is replicated
11 // locally using data from the MSDN.
13 // Windows XP from Service Pack 2 onwards supports the Wireless Zero
14 // Configuration (WZC) programming interface. See
15 // http://msdn.microsoft.com/en-us/library/ms706587(VS.85).aspx.
17 // The MSDN recommends that one use the WLAN API where available, and WZC
20 // However, it seems that WZC fails for some wireless cards. Also, WLAN seems
21 // not to work on XP SP3. So we use WLAN on Vista, and use NDIS directly
24 #include "content/browser/geolocation/wifi_data_provider_win.h"
30 #include "base/metrics/histogram.h"
31 #include "base/strings/utf_string_conversions.h"
32 #include "base/win/windows_version.h"
33 #include "content/browser/geolocation/wifi_data_provider_common.h"
34 #include "content/browser/geolocation/wifi_data_provider_common_win.h"
36 // Taken from ndis.h for WinCE.
37 #define NDIS_STATUS_INVALID_LENGTH ((NDIS_STATUS)0xC0010014L)
38 #define NDIS_STATUS_BUFFER_TOO_SHORT ((NDIS_STATUS)0xC0010016L)
42 // The limits on the size of the buffer used for the OID query.
43 const int kInitialBufferSize = 2 << 12; // Good for about 50 APs.
44 const int kMaximumBufferSize = 2 << 20; // 2MB
46 // Length for generic string buffers passed to Win32 APIs.
47 const int kStringLength = 512;
49 // The time periods, in milliseconds, between successive polls of the wifi data.
50 const int kDefaultPollingInterval = 10000; // 10s
51 const int kNoChangePollingInterval = 120000; // 2 mins
52 const int kTwoNoChangePollingInterval = 600000; // 10 mins
53 const int kNoWifiPollingIntervalMilliseconds = 20 * 1000; // 20s
56 typedef DWORD (WINAPI* WlanOpenHandleFunction)(DWORD dwClientVersion,
58 PDWORD pdwNegotiatedVersion,
59 PHANDLE phClientHandle);
62 typedef DWORD (WINAPI* WlanEnumInterfacesFunction)(
65 PWLAN_INTERFACE_INFO_LIST* ppInterfaceList);
67 // WlanGetNetworkBssList
68 typedef DWORD (WINAPI* WlanGetNetworkBssListFunction)(
70 const GUID* pInterfaceGuid,
71 const PDOT11_SSID pDot11Ssid,
72 DOT11_BSS_TYPE dot11BssType,
73 BOOL bSecurityEnabled,
75 PWLAN_BSS_LIST* ppWlanBssList
79 typedef VOID (WINAPI* WlanFreeMemoryFunction)(PVOID pMemory);
82 typedef DWORD (WINAPI* WlanCloseHandleFunction)(HANDLE hClientHandle,
86 // Local classes and functions
87 class WindowsWlanApi : public WifiDataProviderCommon::WlanApiInterface {
89 virtual ~WindowsWlanApi();
90 // Factory function. Will return NULL if this API is unavailable.
91 static WindowsWlanApi* Create();
94 virtual bool GetAccessPointData(WifiData::AccessPointDataSet* data);
97 // Takes ownership of the library handle.
98 explicit WindowsWlanApi(HINSTANCE library);
100 // Loads the required functions from the DLL.
101 void GetWLANFunctions(HINSTANCE wlan_library);
102 int GetInterfaceDataWLAN(HANDLE wlan_handle,
103 const GUID& interface_id,
104 WifiData::AccessPointDataSet* data);
106 // Logs number of detected wlan interfaces.
107 static void LogWlanInterfaceCount(int count);
109 // Handle to the wlanapi.dll library.
112 // Function pointers for WLAN
113 WlanOpenHandleFunction WlanOpenHandle_function_;
114 WlanEnumInterfacesFunction WlanEnumInterfaces_function_;
115 WlanGetNetworkBssListFunction WlanGetNetworkBssList_function_;
116 WlanFreeMemoryFunction WlanFreeMemory_function_;
117 WlanCloseHandleFunction WlanCloseHandle_function_;
120 class WindowsNdisApi : public WifiDataProviderCommon::WlanApiInterface {
122 virtual ~WindowsNdisApi();
123 static WindowsNdisApi* Create();
126 virtual bool GetAccessPointData(WifiData::AccessPointDataSet* data);
129 static bool GetInterfacesNDIS(
130 std::vector<string16>* interface_service_names_out);
132 // Swaps in content of the vector passed
133 explicit WindowsNdisApi(std::vector<string16>* interface_service_names);
135 bool GetInterfaceDataNDIS(HANDLE adapter_handle,
136 WifiData::AccessPointDataSet* data);
138 std::vector<string16> interface_service_names_;
140 // Remembers scan result buffer size across calls.
141 int oid_buffer_size_;
144 // Extracts data for an access point and converts to Gears format.
145 bool GetNetworkData(const WLAN_BSS_ENTRY& bss_entry,
146 AccessPointData* access_point_data);
147 bool UndefineDosDevice(const string16& device_name);
148 bool DefineDosDeviceIfNotExists(const string16& device_name);
149 HANDLE GetFileHandle(const string16& device_name);
150 // Makes the OID query and returns a Win32 error code.
151 int PerformQuery(HANDLE adapter_handle,
155 bool ResizeBuffer(int requested_size, scoped_ptr_malloc<BYTE>* buffer);
156 // Gets the system directory and appends a trailing slash if not already
158 bool GetSystemDirectory(string16* path);
161 WifiDataProviderImplBase* WifiDataProvider::DefaultFactoryFunction() {
162 return new Win32WifiDataProvider();
165 Win32WifiDataProvider::Win32WifiDataProvider() {
168 Win32WifiDataProvider::~Win32WifiDataProvider() {
171 WifiDataProviderCommon::WlanApiInterface* Win32WifiDataProvider::NewWlanApi() {
172 // Use the WLAN interface if we're on Vista and if it's available. Otherwise,
174 WlanApiInterface* api = WindowsWlanApi::Create();
178 return WindowsNdisApi::Create();
181 WifiPollingPolicy* Win32WifiDataProvider::NewPollingPolicy() {
182 return new GenericWifiPollingPolicy<kDefaultPollingInterval,
183 kNoChangePollingInterval,
184 kTwoNoChangePollingInterval,
185 kNoWifiPollingIntervalMilliseconds>;
188 // Local classes and functions
192 WindowsWlanApi::WindowsWlanApi(HINSTANCE library)
193 : library_(library) {
194 GetWLANFunctions(library_);
197 WindowsWlanApi::~WindowsWlanApi() {
198 FreeLibrary(library_);
201 WindowsWlanApi* WindowsWlanApi::Create() {
202 if (base::win::GetVersion() < base::win::VERSION_VISTA)
204 // We use an absolute path to load the DLL to avoid DLL preloading attacks.
205 string16 system_directory;
206 if (!GetSystemDirectory(&system_directory)) {
209 DCHECK(!system_directory.empty());
210 string16 dll_path = system_directory + L"wlanapi.dll";
211 HINSTANCE library = LoadLibraryEx(dll_path.c_str(),
213 LOAD_WITH_ALTERED_SEARCH_PATH);
217 return new WindowsWlanApi(library);
220 void WindowsWlanApi::GetWLANFunctions(HINSTANCE wlan_library) {
221 DCHECK(wlan_library);
222 WlanOpenHandle_function_ = reinterpret_cast<WlanOpenHandleFunction>(
223 GetProcAddress(wlan_library, "WlanOpenHandle"));
224 WlanEnumInterfaces_function_ = reinterpret_cast<WlanEnumInterfacesFunction>(
225 GetProcAddress(wlan_library, "WlanEnumInterfaces"));
226 WlanGetNetworkBssList_function_ =
227 reinterpret_cast<WlanGetNetworkBssListFunction>(
228 GetProcAddress(wlan_library, "WlanGetNetworkBssList"));
229 WlanFreeMemory_function_ = reinterpret_cast<WlanFreeMemoryFunction>(
230 GetProcAddress(wlan_library, "WlanFreeMemory"));
231 WlanCloseHandle_function_ = reinterpret_cast<WlanCloseHandleFunction>(
232 GetProcAddress(wlan_library, "WlanCloseHandle"));
233 DCHECK(WlanOpenHandle_function_ &&
234 WlanEnumInterfaces_function_ &&
235 WlanGetNetworkBssList_function_ &&
236 WlanFreeMemory_function_ &&
237 WlanCloseHandle_function_);
240 void WindowsWlanApi::LogWlanInterfaceCount(int count) {
241 UMA_HISTOGRAM_CUSTOM_COUNTS(
242 "Net.Wifi.InterfaceCount",
249 bool WindowsWlanApi::GetAccessPointData(
250 WifiData::AccessPointDataSet* data) {
253 // Get the handle to the WLAN API.
254 DWORD negotiated_version;
255 HANDLE wlan_handle = NULL;
256 // We could be executing on either Windows XP or Windows Vista, so use the
257 // lower version of the client WLAN API. It seems that the negotiated version
258 // is the Vista version irrespective of what we pass!
259 static const int kXpWlanClientVersion = 1;
260 if ((*WlanOpenHandle_function_)(kXpWlanClientVersion,
263 &wlan_handle) != ERROR_SUCCESS) {
264 LogWlanInterfaceCount(0);
269 // Get the list of interfaces. WlanEnumInterfaces allocates interface_list.
270 WLAN_INTERFACE_INFO_LIST* interface_list = NULL;
271 if ((*WlanEnumInterfaces_function_)(wlan_handle, NULL, &interface_list) !=
273 LogWlanInterfaceCount(0);
276 DCHECK(interface_list);
278 LogWlanInterfaceCount(interface_list->dwNumberOfItems);
280 // Go through the list of interfaces and get the data for each.
281 for (int i = 0; i < static_cast<int>(interface_list->dwNumberOfItems); ++i) {
282 // Skip any interface that is midway through association; the
283 // WlanGetNetworkBssList function call is known to hang indefinitely
284 // when it's in this state. http://crbug.com/39300
285 if (interface_list->InterfaceInfo[i].isState ==
286 wlan_interface_state_associating) {
287 LOG(WARNING) << "Skipping wifi scan on adapter " << i << " ("
288 << interface_list->InterfaceInfo[i].strInterfaceDescription
289 << ") in 'associating' state. Repeated occurrences "
290 "indicates a non-responding adapter.";
293 GetInterfaceDataWLAN(wlan_handle,
294 interface_list->InterfaceInfo[i].InterfaceGuid,
298 // Free interface_list.
299 (*WlanFreeMemory_function_)(interface_list);
302 if ((*WlanCloseHandle_function_)(wlan_handle, NULL) != ERROR_SUCCESS) {
309 // Appends the data for a single interface to the data vector. Returns the
310 // number of access points found, or -1 on error.
311 int WindowsWlanApi::GetInterfaceDataWLAN(
312 const HANDLE wlan_handle,
313 const GUID& interface_id,
314 WifiData::AccessPointDataSet* data) {
317 const base::TimeTicks start_time = base::TimeTicks::Now();
319 // WlanGetNetworkBssList allocates bss_list.
320 WLAN_BSS_LIST* bss_list = NULL;
321 if ((*WlanGetNetworkBssList_function_)(wlan_handle,
323 NULL, // Use all SSIDs.
325 false, // bSecurityEnabled - unused
327 &bss_list) != ERROR_SUCCESS) {
330 // According to http://www.attnetclient.com/kb/questions.php?questionid=75
331 // WlanGetNetworkBssList can sometimes return success, but leave the bss
336 const base::TimeDelta duration = base::TimeTicks::Now() - start_time;
338 UMA_HISTOGRAM_CUSTOM_TIMES(
339 "Net.Wifi.ScanLatency",
341 base::TimeDelta::FromMilliseconds(1),
342 base::TimeDelta::FromMinutes(1),
347 for (int i = 0; i < static_cast<int>(bss_list->dwNumberOfItems); ++i) {
348 AccessPointData access_point_data;
349 if (GetNetworkData(bss_list->wlanBssEntries[i], &access_point_data)) {
351 data->insert(access_point_data);
355 (*WlanFreeMemory_function_)(bss_list);
361 WindowsNdisApi::WindowsNdisApi(
362 std::vector<string16>* interface_service_names)
363 : oid_buffer_size_(kInitialBufferSize) {
364 DCHECK(!interface_service_names->empty());
365 interface_service_names_.swap(*interface_service_names);
368 WindowsNdisApi::~WindowsNdisApi() {
371 WindowsNdisApi* WindowsNdisApi::Create() {
372 std::vector<string16> interface_service_names;
373 if (GetInterfacesNDIS(&interface_service_names)) {
374 return new WindowsNdisApi(&interface_service_names);
379 bool WindowsNdisApi::GetAccessPointData(WifiData::AccessPointDataSet* data) {
381 int interfaces_failed = 0;
382 int interfaces_succeeded = 0;
384 for (int i = 0; i < static_cast<int>(interface_service_names_.size()); ++i) {
385 // First, check that we have a DOS device for this adapter.
386 if (!DefineDosDeviceIfNotExists(interface_service_names_[i])) {
390 // Get the handle to the device. This will fail if the named device is not
392 HANDLE adapter_handle = GetFileHandle(interface_service_names_[i]);
393 if (adapter_handle == INVALID_HANDLE_VALUE) {
398 if (GetInterfaceDataNDIS(adapter_handle, data)) {
399 ++interfaces_succeeded;
405 CloseHandle(adapter_handle);
406 UndefineDosDevice(interface_service_names_[i]);
409 // Return true if at least one interface succeeded, or at the very least none
411 return interfaces_succeeded > 0 || interfaces_failed == 0;
414 bool WindowsNdisApi::GetInterfacesNDIS(
415 std::vector<string16>* interface_service_names_out) {
416 HKEY network_cards_key = NULL;
419 L"Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards",
422 &network_cards_key) != ERROR_SUCCESS) {
425 DCHECK(network_cards_key);
427 for (int i = 0; ; ++i) {
428 TCHAR name[kStringLength];
429 DWORD name_size = kStringLength;
431 if (RegEnumKeyEx(network_cards_key,
438 &time) != ERROR_SUCCESS) {
441 HKEY hardware_key = NULL;
442 if (RegOpenKeyEx(network_cards_key, name, 0, KEY_READ, &hardware_key) !=
446 DCHECK(hardware_key);
448 TCHAR service_name[kStringLength];
449 DWORD service_name_size = kStringLength;
451 if (RegQueryValueEx(hardware_key,
455 reinterpret_cast<LPBYTE>(service_name),
456 &service_name_size) == ERROR_SUCCESS) {
457 interface_service_names_out->push_back(service_name);
459 RegCloseKey(hardware_key);
462 RegCloseKey(network_cards_key);
467 bool WindowsNdisApi::GetInterfaceDataNDIS(HANDLE adapter_handle,
468 WifiData::AccessPointDataSet* data) {
471 scoped_ptr_malloc<BYTE> buffer(
472 reinterpret_cast<BYTE*>(malloc(oid_buffer_size_)));
473 if (buffer == NULL) {
482 result = PerformQuery(adapter_handle, buffer.get(),
483 oid_buffer_size_, &bytes_out);
484 if (result == ERROR_GEN_FAILURE || // Returned by some Intel cards.
485 result == ERROR_INSUFFICIENT_BUFFER ||
486 result == ERROR_MORE_DATA ||
487 result == NDIS_STATUS_INVALID_LENGTH ||
488 result == NDIS_STATUS_BUFFER_TOO_SHORT) {
489 // The buffer we supplied is too small, so increase it. bytes_out should
490 // provide the required buffer size, but this is not always the case.
491 if (bytes_out > static_cast<DWORD>(oid_buffer_size_)) {
492 oid_buffer_size_ = bytes_out;
494 oid_buffer_size_ *= 2;
496 if (!ResizeBuffer(oid_buffer_size_, &buffer)) {
497 oid_buffer_size_ = kInitialBufferSize; // Reset for next time.
501 // The buffer is not too small.
505 DCHECK(buffer.get());
507 if (result == ERROR_SUCCESS) {
508 NDIS_802_11_BSSID_LIST* bssid_list =
509 reinterpret_cast<NDIS_802_11_BSSID_LIST*>(buffer.get());
510 GetDataFromBssIdList(*bssid_list, oid_buffer_size_, data);
516 bool GetNetworkData(const WLAN_BSS_ENTRY& bss_entry,
517 AccessPointData* access_point_data) {
518 // Currently we get only MAC address, signal strength and SSID.
519 DCHECK(access_point_data);
520 access_point_data->mac_address = MacAddressAsString16(bss_entry.dot11Bssid);
521 access_point_data->radio_signal_strength = bss_entry.lRssi;
522 // bss_entry.dot11Ssid.ucSSID is not null-terminated.
523 UTF8ToUTF16(reinterpret_cast<const char*>(bss_entry.dot11Ssid.ucSSID),
524 static_cast<ULONG>(bss_entry.dot11Ssid.uSSIDLength),
525 &access_point_data->ssid);
526 // TODO(steveblock): Is it possible to get the following?
527 // access_point_data->signal_to_noise
528 // access_point_data->age
529 // access_point_data->channel
533 bool UndefineDosDevice(const string16& device_name) {
534 // We remove only the mapping we use, that is \Device\<device_name>.
535 string16 target_path = L"\\Device\\" + device_name;
536 return DefineDosDevice(
537 DDD_RAW_TARGET_PATH | DDD_REMOVE_DEFINITION | DDD_EXACT_MATCH_ON_REMOVE,
539 target_path.c_str()) == TRUE;
542 bool DefineDosDeviceIfNotExists(const string16& device_name) {
543 // We create a DOS device name for the device at \Device\<device_name>.
544 string16 target_path = L"\\Device\\" + device_name;
546 TCHAR target[kStringLength];
547 if (QueryDosDevice(device_name.c_str(), target, kStringLength) > 0 &&
548 target_path.compare(target) == 0) {
549 // Device already exists.
553 if (GetLastError() != ERROR_FILE_NOT_FOUND) {
557 if (!DefineDosDevice(DDD_RAW_TARGET_PATH,
559 target_path.c_str())) {
563 // Check that the device is really there.
564 return QueryDosDevice(device_name.c_str(), target, kStringLength) > 0 &&
565 target_path.compare(target) == 0;
568 HANDLE GetFileHandle(const string16& device_name) {
569 // We access a device with DOS path \Device\<device_name> at
570 // \\.\<device_name>.
571 string16 formatted_device_name = L"\\\\.\\" + device_name;
573 return CreateFile(formatted_device_name.c_str(),
575 FILE_SHARE_READ | FILE_SHARE_WRITE, // share mode
576 0, // security attributes
578 0, // flags and attributes
579 INVALID_HANDLE_VALUE);
582 int PerformQuery(HANDLE adapter_handle,
586 DWORD oid = OID_802_11_BSSID_LIST;
587 if (!DeviceIoControl(adapter_handle,
588 IOCTL_NDIS_QUERY_GLOBAL_STATS,
595 return GetLastError();
597 return ERROR_SUCCESS;
600 bool ResizeBuffer(int requested_size, scoped_ptr_malloc<BYTE>* buffer) {
601 DCHECK_GT(requested_size, 0);
603 if (requested_size > kMaximumBufferSize) {
608 buffer->reset(reinterpret_cast<BYTE*>(
609 realloc(buffer->release(), requested_size)));
610 return buffer != NULL;
613 bool GetSystemDirectory(string16* path) {
615 // Return value includes terminating NULL.
616 int buffer_size = ::GetSystemDirectory(NULL, 0);
617 if (buffer_size == 0) {
620 scoped_ptr<char16[]> buffer(new char16[buffer_size]);
622 // Return value excludes terminating NULL.
623 int characters_written = ::GetSystemDirectory(buffer.get(), buffer_size);
624 if (characters_written == 0) {
627 DCHECK_EQ(buffer_size - 1, characters_written);
629 path->assign(buffer.get(), characters_written);
631 if (*path->rbegin() != L'\\') {
634 DCHECK_EQ(L'\\', *path->rbegin());
639 } // namespace content