hci_socket.c revision 1.6
1 /* $NetBSD: hci_socket.c,v 1.6 2007/03/04 06:03:19 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 2005 Iain Hibbert. 5 * Copyright (c) 2006 Itronix Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of Itronix Inc. may not be used to endorse 17 * or promote products derived from this software without specific 18 * prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.6 2007/03/04 06:03:19 christos Exp $"); 35 36 #include "opt_bluetooth.h" 37 #ifdef BLUETOOTH_DEBUG 38 #define PRCOREQUESTS 39 #endif 40 41 #include <sys/param.h> 42 #include <sys/domain.h> 43 #include <sys/kauth.h> 44 #include <sys/kernel.h> 45 #include <sys/mbuf.h> 46 #include <sys/proc.h> 47 #include <sys/protosw.h> 48 #include <sys/socket.h> 49 #include <sys/socketvar.h> 50 #include <sys/systm.h> 51 52 #include <netbt/bluetooth.h> 53 #include <netbt/hci.h> 54 55 /******************************************************************************* 56 * 57 * HCI SOCK_RAW Sockets - for control of Bluetooth Devices 58 * 59 */ 60 61 /* 62 * the raw HCI protocol control block 63 */ 64 struct hci_pcb { 65 struct socket *hp_socket; /* socket */ 66 unsigned int hp_flags; /* flags */ 67 bdaddr_t hp_laddr; /* local address */ 68 bdaddr_t hp_raddr; /* remote address */ 69 struct hci_filter hp_efilter; /* user event filter */ 70 struct hci_filter hp_pfilter; /* user packet filter */ 71 LIST_ENTRY(hci_pcb) hp_next; /* next HCI pcb */ 72 }; 73 74 /* hp_flags */ 75 #define HCI_PRIVILEGED (1<<0) /* no security filter for root */ 76 #define HCI_DIRECTION (1<<1) /* direction control messages */ 77 #define HCI_PROMISCUOUS (1<<2) /* listen to all units */ 78 79 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb); 80 81 /* sysctl defaults */ 82 int hci_sendspace = HCI_CMD_PKT_SIZE; 83 int hci_recvspace = 4096; 84 85 /* 86 * Security filter routines for unprivileged users. 87 * Allow all but a few critical events, and only permit read commands. 88 */ 89 90 static int 91 hci_security_check_opcode(uint16_t opcode) 92 { 93 94 switch (opcode) { 95 /* Link control */ 96 case HCI_CMD_INQUIRY: 97 case HCI_CMD_REMOTE_NAME_REQ: 98 case HCI_CMD_READ_REMOTE_FEATURES: 99 case HCI_CMD_READ_REMOTE_EXTENDED_FEATURES: 100 case HCI_CMD_READ_REMOTE_VER_INFO: 101 case HCI_CMD_READ_CLOCK_OFFSET: 102 case HCI_CMD_READ_LMP_HANDLE: 103 104 /* Link policy */ 105 case HCI_CMD_ROLE_DISCOVERY: 106 case HCI_CMD_READ_LINK_POLICY_SETTINGS: 107 case HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS: 108 109 /* Host controller and baseband */ 110 case HCI_CMD_READ_PIN_TYPE: 111 case HCI_CMD_READ_LOCAL_NAME: 112 case HCI_CMD_READ_CON_ACCEPT_TIMEOUT: 113 case HCI_CMD_READ_PAGE_TIMEOUT: 114 case HCI_CMD_READ_SCAN_ENABLE: 115 case HCI_CMD_READ_PAGE_SCAN_ACTIVITY: 116 case HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY: 117 case HCI_CMD_READ_AUTH_ENABLE: 118 case HCI_CMD_READ_ENCRYPTION_MODE: 119 case HCI_CMD_READ_UNIT_CLASS: 120 case HCI_CMD_READ_VOICE_SETTING: 121 case HCI_CMD_READ_AUTO_FLUSH_TIMEOUT: 122 case HCI_CMD_READ_NUM_BROADCAST_RETRANS: 123 case HCI_CMD_READ_HOLD_MODE_ACTIVITY: 124 case HCI_CMD_READ_XMIT_LEVEL: 125 case HCI_CMD_READ_SCO_FLOW_CONTROL: 126 case HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT: 127 case HCI_CMD_READ_NUM_SUPPORTED_IAC: 128 case HCI_CMD_READ_IAC_LAP: 129 case HCI_CMD_READ_PAGE_SCAN_PERIOD: 130 case HCI_CMD_READ_PAGE_SCAN: 131 case HCI_CMD_READ_INQUIRY_SCAN_TYPE: 132 case HCI_CMD_READ_INQUIRY_MODE: 133 case HCI_CMD_READ_PAGE_SCAN_TYPE: 134 case HCI_CMD_READ_AFH_ASSESSMENT: 135 136 /* Informational */ 137 case HCI_CMD_READ_LOCAL_VER: 138 case HCI_CMD_READ_LOCAL_COMMANDS: 139 case HCI_CMD_READ_LOCAL_FEATURES: 140 case HCI_CMD_READ_LOCAL_EXTENDED_FEATURES: 141 case HCI_CMD_READ_BUFFER_SIZE: 142 case HCI_CMD_READ_COUNTRY_CODE: 143 case HCI_CMD_READ_BDADDR: 144 145 /* Status */ 146 case HCI_CMD_READ_FAILED_CONTACT_CNTR: 147 case HCI_CMD_READ_LINK_QUALITY: 148 case HCI_CMD_READ_RSSI: 149 case HCI_CMD_READ_AFH_CHANNEL_MAP: 150 case HCI_CMD_READ_CLOCK: 151 152 /* Testing */ 153 case HCI_CMD_READ_LOOPBACK_MODE: 154 return 1; 155 } 156 157 return 0; 158 } 159 160 static int 161 hci_security_check_event(uint8_t event) 162 { 163 164 switch (event) { 165 case HCI_EVENT_RETURN_LINK_KEYS: 166 case HCI_EVENT_LINK_KEY_NOTIFICATION: 167 case HCI_EVENT_VENDOR: 168 return 0; 169 } 170 171 return 1; 172 } 173 174 /* 175 * When command packet reaches the device, we can drop 176 * it from the socket buffer (called from hci_output_acl) 177 */ 178 void 179 hci_drop(void *arg) 180 { 181 struct socket *so = arg; 182 183 sbdroprecord(&so->so_snd); 184 sowwakeup(so); 185 } 186 187 /* 188 * HCI socket is going away and has some pending packets. We let them 189 * go by design, but remove the context pointer as it will be invalid 190 * and we no longer need to be notified. 191 */ 192 static void 193 hci_cmdwait_flush(struct socket *so) 194 { 195 struct hci_unit *unit; 196 struct socket *ctx; 197 struct mbuf *m; 198 199 DPRINTF("flushing %p\n", so); 200 201 SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) { 202 m = MBUFQ_FIRST(&unit->hci_cmdwait); 203 while (m != NULL) { 204 ctx = M_GETCTX(m, struct socket *); 205 if (ctx == so) 206 M_SETCTX(m, NULL); 207 208 m = MBUFQ_NEXT(m); 209 } 210 } 211 } 212 213 /* 214 * HCI send packet 215 * This came from userland, so check it out. 216 */ 217 static int 218 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr) 219 { 220 struct hci_unit *unit; 221 struct mbuf *m0; 222 hci_cmd_hdr_t hdr; 223 int err; 224 225 KASSERT(m); 226 KASSERT(addr); 227 228 /* wants at least a header to start with */ 229 if (m->m_pkthdr.len < sizeof(hdr)) { 230 err = EMSGSIZE; 231 goto bad; 232 } 233 m_copydata(m, 0, sizeof(hdr), &hdr); 234 235 /* only allows CMD packets to be sent */ 236 if (hdr.type != HCI_CMD_PKT) { 237 err = EINVAL; 238 goto bad; 239 } 240 241 /* validates packet length */ 242 if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) { 243 err = EMSGSIZE; 244 goto bad; 245 } 246 247 /* security checks for unprivileged users */ 248 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 249 && (hci_security_check_opcode(le16toh(hdr.opcode)) == 0)) { 250 err = EPERM; 251 goto bad; 252 } 253 254 /* finds destination */ 255 unit = hci_unit_lookup(addr); 256 if (unit == NULL) { 257 err = ENETDOWN; 258 goto bad; 259 } 260 261 /* makess a copy for precious to keep */ 262 m0 = m_copypacket(m, M_DONTWAIT); 263 if (m0 == NULL) { 264 err = ENOMEM; 265 goto bad; 266 } 267 sbappendrecord(&pcb->hp_socket->so_snd, m0); 268 M_SETCTX(m, pcb->hp_socket); /* enable drop callback */ 269 270 DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", unit->hci_devname, 271 HCI_OGF(le16toh(hdr.opcode)), HCI_OCF(le16toh(hdr.opcode))); 272 273 /* Sendss it */ 274 if (unit->hci_num_cmd_pkts == 0) 275 MBUFQ_ENQUEUE(&unit->hci_cmdwait, m); 276 else 277 hci_output_cmd(unit, m); 278 279 return 0; 280 281 bad: 282 DPRINTF("packet (%d bytes) not sent (error %d)\n", 283 m->m_pkthdr.len, err); 284 if (m) m_freem(m); 285 return err; 286 } 287 288 /* 289 * User Request. 290 * up is socket 291 * m is either 292 * optional mbuf chain containing message 293 * ioctl command (PRU_CONTROL) 294 * nam is either 295 * optional mbuf chain containing an address 296 * ioctl data (PRU_CONTROL) 297 * optionally, protocol number (PRU_ATTACH) 298 * ctl is optional mbuf chain containing socket options 299 * l is pointer to process requesting action (if any) 300 * 301 * we are responsible for disposing of m and ctl if 302 * they are mbuf chains 303 */ 304 int 305 hci_usrreq(struct socket *up, int req, struct mbuf *m, 306 struct mbuf *nam, struct mbuf *ctl, struct lwp *l) 307 { 308 struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb; 309 struct sockaddr_bt *sa; 310 int err = 0; 311 312 DPRINTFN(2, "%s\n", prurequests[req]); 313 314 switch(req) { 315 case PRU_CONTROL: 316 return hci_ioctl((unsigned long)m, (void *)nam, l); 317 318 case PRU_PURGEIF: 319 return EOPNOTSUPP; 320 321 case PRU_ATTACH: 322 if (pcb) 323 return EINVAL; 324 325 err = soreserve(up, hci_sendspace, hci_recvspace); 326 if (err) 327 return err; 328 329 pcb = malloc(sizeof(struct hci_pcb), M_PCB, M_NOWAIT | M_ZERO); 330 if (pcb == NULL) 331 return ENOMEM; 332 333 up->so_pcb = pcb; 334 pcb->hp_socket = up; 335 336 if (l == NULL || kauth_authorize_generic(l->l_cred, 337 KAUTH_GENERIC_ISSUSER, NULL) == 0) 338 pcb->hp_flags |= HCI_PRIVILEGED; 339 340 /* 341 * Set default user filter. By default, socket only passes 342 * Command_Complete and Command_Status Events. 343 */ 344 hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter); 345 hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter); 346 hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter); 347 348 LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next); 349 350 return 0; 351 } 352 353 /* anything after here *requires* a pcb */ 354 if (pcb == NULL) { 355 err = EINVAL; 356 goto release; 357 } 358 359 switch(req) { 360 case PRU_DISCONNECT: 361 bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY); 362 363 /* XXX we cannot call soisdisconnected() here, as it sets 364 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being, 365 * that soisconnected() does not clear these and if you 366 * try to reconnect this socket (which is permitted) you 367 * get a broken pipe when you try to write any data. 368 */ 369 up->so_state &= ~SS_ISCONNECTED; 370 break; 371 372 case PRU_ABORT: 373 soisdisconnected(up); 374 /* fall through to */ 375 case PRU_DETACH: 376 if (up->so_snd.sb_mb != NULL) 377 hci_cmdwait_flush(up); 378 379 up->so_pcb = NULL; 380 LIST_REMOVE(pcb, hp_next); 381 free(pcb, M_PCB); 382 return 0; 383 384 case PRU_BIND: 385 KASSERT(nam); 386 sa = mtod(nam, struct sockaddr_bt *); 387 388 if (sa->bt_len != sizeof(struct sockaddr_bt)) 389 return EINVAL; 390 391 if (sa->bt_family != AF_BLUETOOTH) 392 return EAFNOSUPPORT; 393 394 bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr); 395 396 if (bdaddr_any(&sa->bt_bdaddr)) 397 pcb->hp_flags |= HCI_PROMISCUOUS; 398 else 399 pcb->hp_flags &= ~HCI_PROMISCUOUS; 400 401 return 0; 402 403 case PRU_CONNECT: 404 KASSERT(nam); 405 sa = mtod(nam, struct sockaddr_bt *); 406 407 if (sa->bt_len != sizeof(struct sockaddr_bt)) 408 return EINVAL; 409 410 if (sa->bt_family != AF_BLUETOOTH) 411 return EAFNOSUPPORT; 412 413 if (hci_unit_lookup(&sa->bt_bdaddr) == NULL) 414 return EADDRNOTAVAIL; 415 416 bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr); 417 soisconnected(up); 418 return 0; 419 420 case PRU_PEERADDR: 421 KASSERT(nam); 422 sa = mtod(nam, struct sockaddr_bt *); 423 424 memset(sa, 0, sizeof(struct sockaddr_bt)); 425 nam->m_len = 426 sa->bt_len = sizeof(struct sockaddr_bt); 427 sa->bt_family = AF_BLUETOOTH; 428 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr); 429 return 0; 430 431 case PRU_SOCKADDR: 432 KASSERT(nam); 433 sa = mtod(nam, struct sockaddr_bt *); 434 435 memset(sa, 0, sizeof(struct sockaddr_bt)); 436 nam->m_len = 437 sa->bt_len = sizeof(struct sockaddr_bt); 438 sa->bt_family = AF_BLUETOOTH; 439 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr); 440 return 0; 441 442 case PRU_SHUTDOWN: 443 socantsendmore(up); 444 break; 445 446 case PRU_SEND: 447 sa = NULL; 448 if (nam) { 449 sa = mtod(nam, struct sockaddr_bt *); 450 451 if (sa->bt_len != sizeof(struct sockaddr_bt)) { 452 err = EINVAL; 453 goto release; 454 } 455 456 if (sa->bt_family != AF_BLUETOOTH) { 457 err = EAFNOSUPPORT; 458 goto release; 459 } 460 } 461 462 if (ctl) /* have no use for this */ 463 m_freem(ctl); 464 465 return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr)); 466 467 case PRU_SENSE: 468 return 0; /* (no sense - Doh!) */ 469 470 case PRU_RCVD: 471 case PRU_RCVOOB: 472 return EOPNOTSUPP; /* (no release) */ 473 474 case PRU_ACCEPT: 475 case PRU_CONNECT2: 476 case PRU_LISTEN: 477 case PRU_SENDOOB: 478 case PRU_FASTTIMO: 479 case PRU_SLOWTIMO: 480 case PRU_PROTORCV: 481 case PRU_PROTOSEND: 482 err = EOPNOTSUPP; 483 break; 484 485 default: 486 UNKNOWN(req); 487 err = EOPNOTSUPP; 488 break; 489 } 490 491 release: 492 if (m) 493 m_freem(m); 494 if (ctl) 495 m_freem(ctl); 496 return err; 497 } 498 499 /* 500 * get/set socket options 501 */ 502 int 503 hci_ctloutput(int req, struct socket *so, int level, 504 int optname, struct mbuf **opt) 505 { 506 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 507 struct mbuf *m; 508 int err = 0; 509 510 DPRINTFN(2, "req %s\n", prcorequests[req]); 511 512 if (pcb == NULL) 513 return EINVAL; 514 515 if (level != BTPROTO_HCI) 516 return 0; 517 518 switch(req) { 519 case PRCO_GETOPT: 520 m = m_get(M_WAIT, MT_SOOPTS); 521 switch (optname) { 522 case SO_HCI_EVT_FILTER: 523 m->m_len = sizeof(struct hci_filter); 524 memcpy(mtod(m, void *), &pcb->hp_efilter, m->m_len); 525 break; 526 527 case SO_HCI_PKT_FILTER: 528 m->m_len = sizeof(struct hci_filter); 529 memcpy(mtod(m, void *), &pcb->hp_pfilter, m->m_len); 530 break; 531 532 case SO_HCI_DIRECTION: 533 m->m_len = sizeof(int); 534 if (pcb->hp_flags & HCI_DIRECTION) 535 *mtod(m, int *) = 1; 536 else 537 *mtod(m, int *) = 0; 538 break; 539 540 default: 541 err = EINVAL; 542 m_freem(m); 543 m = NULL; 544 break; 545 } 546 *opt = m; 547 break; 548 549 case PRCO_SETOPT: 550 m = *opt; 551 if (m) switch (optname) { 552 case SO_HCI_EVT_FILTER: /* set event filter */ 553 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 554 memcpy(&pcb->hp_efilter, mtod(m, void *), m->m_len); 555 break; 556 557 case SO_HCI_PKT_FILTER: /* set packet filter */ 558 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 559 memcpy(&pcb->hp_pfilter, mtod(m, void *), m->m_len); 560 break; 561 562 case SO_HCI_DIRECTION: /* request direction ctl messages */ 563 if (*mtod(m, int *)) 564 pcb->hp_flags |= HCI_DIRECTION; 565 else 566 pcb->hp_flags &= ~HCI_DIRECTION; 567 break; 568 569 default: 570 err = EINVAL; 571 break; 572 } 573 m_freem(m); 574 break; 575 576 default: 577 err = EINVAL; 578 break; 579 } 580 581 return err; 582 } 583 584 /* 585 * HCI mbuf tap routine 586 * 587 * copy packets to any raw HCI sockets that wish (and are 588 * permitted) to see them 589 */ 590 void 591 hci_mtap(struct mbuf *m, struct hci_unit *unit) 592 { 593 struct hci_pcb *pcb; 594 struct mbuf *m0, *ctlmsg, **ctl; 595 struct sockaddr_bt sa; 596 uint8_t type; 597 uint8_t event; 598 uint16_t opcode; 599 600 KASSERT(m->m_len >= sizeof(type)); 601 602 type = *mtod(m, uint8_t *); 603 604 memset(&sa, 0, sizeof(sa)); 605 sa.bt_len = sizeof(struct sockaddr_bt); 606 sa.bt_family = AF_BLUETOOTH; 607 bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr); 608 609 LIST_FOREACH(pcb, &hci_pcb, hp_next) { 610 /* 611 * filter according to source address 612 */ 613 if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0 614 && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0) 615 continue; 616 617 /* 618 * filter according to packet type filter 619 */ 620 if (hci_filter_test(type, &pcb->hp_pfilter) == 0) 621 continue; 622 623 /* 624 * filter according to event/security filters 625 */ 626 switch(type) { 627 case HCI_EVENT_PKT: 628 KASSERT(m->m_len >= sizeof(hci_event_hdr_t)); 629 630 event = mtod(m, hci_event_hdr_t *)->event; 631 632 if (hci_filter_test(event, &pcb->hp_efilter) == 0) 633 continue; 634 635 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 636 && hci_security_check_event(event) == 0) 637 continue; 638 break; 639 640 case HCI_CMD_PKT: 641 KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t)); 642 643 opcode = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode); 644 645 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 646 && hci_security_check_opcode(opcode) == 0) 647 continue; 648 break; 649 650 case HCI_ACL_DATA_PKT: 651 case HCI_SCO_DATA_PKT: 652 default: 653 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0) 654 continue; 655 656 break; 657 } 658 659 /* 660 * create control messages 661 */ 662 ctlmsg = NULL; 663 ctl = &ctlmsg; 664 if (pcb->hp_flags & HCI_DIRECTION) { 665 int dir = m->m_flags & M_LINK0 ? 1 : 0; 666 667 *ctl = sbcreatecontrol((void *)&dir, sizeof(dir), 668 SCM_HCI_DIRECTION, BTPROTO_HCI); 669 670 if (*ctl != NULL) 671 ctl = &((*ctl)->m_next); 672 } 673 674 /* 675 * copy to socket 676 */ 677 m0 = m_copypacket(m, M_DONTWAIT); 678 if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv, 679 (struct sockaddr *)&sa, m0, ctlmsg)) { 680 sorwakeup(pcb->hp_socket); 681 } else { 682 m_freem(ctlmsg); 683 m_freem(m0); 684 } 685 } 686 } 687
Indexes created Thu Sep 25 08:09:54 GMT 2025