l2cap_signal.c revision 1.13
1 /* $NetBSD: l2cap_signal.c,v 1.13 2011/07/17 20:54:53 joerg Exp $ */ 2 3 /*- 4 * Copyright (c) 2005 Iain Hibbert. 5 * Copyright (c) 2006 Itronix Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of Itronix Inc. may not be used to endorse 17 * or promote products derived from this software without specific 18 * prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: l2cap_signal.c,v 1.13 2011/07/17 20:54:53 joerg Exp $"); 35 36 #include <sys/param.h> 37 #include <sys/kernel.h> 38 #include <sys/mbuf.h> 39 #include <sys/proc.h> 40 #include <sys/queue.h> 41 #include <sys/systm.h> 42 43 #include <netbt/bluetooth.h> 44 #include <netbt/hci.h> 45 #include <netbt/l2cap.h> 46 47 /******************************************************************************* 48 * 49 * L2CAP Signal processing 50 */ 51 52 static void l2cap_recv_command_rej(struct mbuf *, struct hci_link *); 53 static void l2cap_recv_connect_req(struct mbuf *, struct hci_link *); 54 static void l2cap_recv_connect_rsp(struct mbuf *, struct hci_link *); 55 static void l2cap_recv_config_req(struct mbuf *, struct hci_link *); 56 static void l2cap_recv_config_rsp(struct mbuf *, struct hci_link *); 57 static void l2cap_recv_disconnect_req(struct mbuf *, struct hci_link *); 58 static void l2cap_recv_disconnect_rsp(struct mbuf *, struct hci_link *); 59 static void l2cap_recv_info_req(struct mbuf *, struct hci_link *); 60 static int l2cap_send_signal(struct hci_link *, uint8_t, uint8_t, uint16_t, void *); 61 static int l2cap_send_command_rej(struct hci_link *, uint8_t, uint16_t, ...); 62 63 /* 64 * process incoming signal packets (CID 0x0001). Can contain multiple 65 * requests/responses. 66 */ 67 void 68 l2cap_recv_signal(struct mbuf *m, struct hci_link *link) 69 { 70 l2cap_cmd_hdr_t cmd; 71 72 for(;;) { 73 if (m->m_pkthdr.len == 0) 74 goto finish; 75 76 if (m->m_pkthdr.len < sizeof(cmd)) 77 goto reject; 78 79 m_copydata(m, 0, sizeof(cmd), &cmd); 80 cmd.length = le16toh(cmd.length); 81 82 if (m->m_pkthdr.len < sizeof(cmd) + cmd.length) 83 goto reject; 84 85 DPRINTFN(2, "(%s) code %d, ident %d, len %d\n", 86 device_xname(link->hl_unit->hci_dev), 87 cmd.code, cmd.ident, cmd.length); 88 89 switch (cmd.code) { 90 case L2CAP_COMMAND_REJ: 91 if (cmd.length > sizeof(l2cap_cmd_rej_cp)) 92 goto finish; 93 94 l2cap_recv_command_rej(m, link); 95 break; 96 97 case L2CAP_CONNECT_REQ: 98 if (cmd.length != sizeof(l2cap_con_req_cp)) 99 goto reject; 100 101 l2cap_recv_connect_req(m, link); 102 break; 103 104 case L2CAP_CONNECT_RSP: 105 if (cmd.length != sizeof(l2cap_con_rsp_cp)) 106 goto finish; 107 108 l2cap_recv_connect_rsp(m, link); 109 break; 110 111 case L2CAP_CONFIG_REQ: 112 l2cap_recv_config_req(m, link); 113 break; 114 115 case L2CAP_CONFIG_RSP: 116 l2cap_recv_config_rsp(m, link); 117 break; 118 119 case L2CAP_DISCONNECT_REQ: 120 if (cmd.length != sizeof(l2cap_discon_req_cp)) 121 goto reject; 122 123 l2cap_recv_disconnect_req(m, link); 124 break; 125 126 case L2CAP_DISCONNECT_RSP: 127 if (cmd.length != sizeof(l2cap_discon_rsp_cp)) 128 goto finish; 129 130 l2cap_recv_disconnect_rsp(m, link); 131 break; 132 133 case L2CAP_ECHO_REQ: 134 m_adj(m, sizeof(cmd) + cmd.length); 135 l2cap_send_signal(link, L2CAP_ECHO_RSP, cmd.ident, 136 0, NULL); 137 break; 138 139 case L2CAP_ECHO_RSP: 140 m_adj(m, sizeof(cmd) + cmd.length); 141 break; 142 143 case L2CAP_INFO_REQ: 144 if (cmd.length != sizeof(l2cap_info_req_cp)) 145 goto reject; 146 147 l2cap_recv_info_req(m, link); 148 break; 149 150 case L2CAP_INFO_RSP: 151 m_adj(m, sizeof(cmd) + cmd.length); 152 break; 153 154 default: 155 goto reject; 156 } 157 } 158 159 #ifdef DIAGNOSTIC 160 panic("impossible!"); 161 #endif 162 163 reject: 164 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_NOT_UNDERSTOOD); 165 finish: 166 m_freem(m); 167 } 168 169 /* 170 * Process Received Command Reject. For now we dont try to recover gracefully 171 * from this, it probably means that the link is garbled or the other end is 172 * insufficiently capable of handling normal traffic. (not *my* fault, no way!) 173 */ 174 static void 175 l2cap_recv_command_rej(struct mbuf *m, struct hci_link *link) 176 { 177 struct l2cap_req *req; 178 struct l2cap_channel *chan; 179 l2cap_cmd_hdr_t cmd; 180 l2cap_cmd_rej_cp cp; 181 182 m_copydata(m, 0, sizeof(cmd), &cmd); 183 m_adj(m, sizeof(cmd)); 184 185 cmd.length = le16toh(cmd.length); 186 187 m_copydata(m, 0, cmd.length, &cp); 188 m_adj(m, cmd.length); 189 190 req = l2cap_request_lookup(link, cmd.ident); 191 if (req == NULL) 192 return; 193 194 switch (le16toh(cp.reason)) { 195 case L2CAP_REJ_NOT_UNDERSTOOD: 196 /* 197 * I dont know what to do, just move up the timeout 198 */ 199 callout_schedule(&req->lr_rtx, 0); 200 break; 201 202 case L2CAP_REJ_MTU_EXCEEDED: 203 /* 204 * I didnt send any commands over L2CAP_MTU_MINIMUM size, but.. 205 * 206 * XXX maybe we should resend this, instead? 207 */ 208 link->hl_mtu = le16toh(cp.data[0]); 209 callout_schedule(&req->lr_rtx, 0); 210 break; 211 212 case L2CAP_REJ_INVALID_CID: 213 /* 214 * Well, if they dont have such a channel then our channel is 215 * most likely closed. Make it so. 216 */ 217 chan = req->lr_chan; 218 l2cap_request_free(req); 219 if (chan != NULL && chan->lc_state != L2CAP_CLOSED) 220 l2cap_close(chan, ECONNABORTED); 221 222 break; 223 224 default: 225 UNKNOWN(le16toh(cp.reason)); 226 break; 227 } 228 } 229 230 /* 231 * Process Received Connect Request. Find listening channel matching 232 * psm & addr and ask upper layer for a new channel. 233 */ 234 static void 235 l2cap_recv_connect_req(struct mbuf *m, struct hci_link *link) 236 { 237 struct sockaddr_bt laddr, raddr; 238 struct l2cap_channel *chan, *new; 239 l2cap_cmd_hdr_t cmd; 240 l2cap_con_req_cp cp; 241 int err; 242 243 /* extract cmd */ 244 m_copydata(m, 0, sizeof(cmd), &cmd); 245 m_adj(m, sizeof(cmd)); 246 247 /* extract request */ 248 m_copydata(m, 0, sizeof(cp), &cp); 249 m_adj(m, sizeof(cp)); 250 251 cp.scid = le16toh(cp.scid); 252 cp.psm = le16toh(cp.psm); 253 254 memset(&laddr, 0, sizeof(struct sockaddr_bt)); 255 laddr.bt_len = sizeof(struct sockaddr_bt); 256 laddr.bt_family = AF_BLUETOOTH; 257 laddr.bt_psm = cp.psm; 258 bdaddr_copy(&laddr.bt_bdaddr, &link->hl_unit->hci_bdaddr); 259 260 memset(&raddr, 0, sizeof(struct sockaddr_bt)); 261 raddr.bt_len = sizeof(struct sockaddr_bt); 262 raddr.bt_family = AF_BLUETOOTH; 263 raddr.bt_psm = cp.psm; 264 bdaddr_copy(&raddr.bt_bdaddr, &link->hl_bdaddr); 265 266 LIST_FOREACH(chan, &l2cap_listen_list, lc_ncid) { 267 if (chan->lc_laddr.bt_psm != laddr.bt_psm) 268 continue; 269 270 if (!bdaddr_same(&laddr.bt_bdaddr, &chan->lc_laddr.bt_bdaddr) 271 && bdaddr_any(&chan->lc_laddr.bt_bdaddr) == 0) 272 continue; 273 274 new= (*chan->lc_proto->newconn)(chan->lc_upper, &laddr, &raddr); 275 if (new == NULL) 276 continue; 277 278 err = l2cap_cid_alloc(new); 279 if (err) { 280 l2cap_send_connect_rsp(link, cmd.ident, 281 0, cp.scid, 282 L2CAP_NO_RESOURCES); 283 284 (*new->lc_proto->disconnected)(new->lc_upper, err); 285 return; 286 } 287 288 new->lc_link = hci_acl_open(link->hl_unit, &link->hl_bdaddr); 289 KASSERT(new->lc_link == link); 290 291 new->lc_rcid = cp.scid; 292 new->lc_ident = cmd.ident; 293 294 memcpy(&new->lc_laddr, &laddr, sizeof(struct sockaddr_bt)); 295 memcpy(&new->lc_raddr, &raddr, sizeof(struct sockaddr_bt)); 296 297 new->lc_mode = chan->lc_mode; 298 299 err = l2cap_setmode(new); 300 if (err == EINPROGRESS) { 301 new->lc_state = L2CAP_WAIT_SEND_CONNECT_RSP; 302 (*new->lc_proto->connecting)(new->lc_upper); 303 return; 304 } 305 if (err) { 306 new->lc_state = L2CAP_CLOSED; 307 hci_acl_close(link, err); 308 new->lc_link = NULL; 309 310 l2cap_send_connect_rsp(link, cmd.ident, 311 0, cp.scid, 312 L2CAP_NO_RESOURCES); 313 314 (*new->lc_proto->disconnected)(new->lc_upper, err); 315 return; 316 } 317 318 err = l2cap_send_connect_rsp(link, cmd.ident, 319 new->lc_lcid, new->lc_rcid, 320 L2CAP_SUCCESS); 321 if (err) { 322 l2cap_close(new, err); 323 return; 324 } 325 326 new->lc_state = L2CAP_WAIT_CONFIG; 327 new->lc_flags |= (L2CAP_WAIT_CONFIG_REQ | L2CAP_WAIT_CONFIG_RSP); 328 err = l2cap_send_config_req(new); 329 if (err) 330 l2cap_close(new, err); 331 332 return; 333 } 334 335 l2cap_send_connect_rsp(link, cmd.ident, 336 0, cp.scid, 337 L2CAP_PSM_NOT_SUPPORTED); 338 } 339 340 /* 341 * Process Received Connect Response. 342 */ 343 static void 344 l2cap_recv_connect_rsp(struct mbuf *m, struct hci_link *link) 345 { 346 l2cap_cmd_hdr_t cmd; 347 l2cap_con_rsp_cp cp; 348 struct l2cap_req *req; 349 struct l2cap_channel *chan; 350 351 m_copydata(m, 0, sizeof(cmd), &cmd); 352 m_adj(m, sizeof(cmd)); 353 354 m_copydata(m, 0, sizeof(cp), &cp); 355 m_adj(m, sizeof(cp)); 356 357 cp.scid = le16toh(cp.scid); 358 cp.dcid = le16toh(cp.dcid); 359 cp.result = le16toh(cp.result); 360 361 req = l2cap_request_lookup(link, cmd.ident); 362 if (req == NULL || req->lr_code != L2CAP_CONNECT_REQ) 363 return; 364 365 chan = req->lr_chan; 366 if (chan != NULL && chan->lc_lcid != cp.scid) 367 return; 368 369 if (chan == NULL || chan->lc_state != L2CAP_WAIT_RECV_CONNECT_RSP) { 370 l2cap_request_free(req); 371 return; 372 } 373 374 switch (cp.result) { 375 case L2CAP_SUCCESS: 376 /* 377 * Ok, at this point we have a connection to the other party. We 378 * could indicate upstream that we are ready for business and 379 * wait for a "Configure Channel Request" but I'm not so sure 380 * that is required in our case - we will proceed directly to 381 * sending our config request. We set two state bits because in 382 * the config state we are waiting for requests and responses. 383 */ 384 l2cap_request_free(req); 385 chan->lc_rcid = cp.dcid; 386 chan->lc_state = L2CAP_WAIT_CONFIG; 387 chan->lc_flags |= (L2CAP_WAIT_CONFIG_REQ | L2CAP_WAIT_CONFIG_RSP); 388 l2cap_send_config_req(chan); 389 break; 390 391 case L2CAP_PENDING: 392 /* XXX dont release request, should start eRTX timeout? */ 393 (*chan->lc_proto->connecting)(chan->lc_upper); 394 break; 395 396 case L2CAP_PSM_NOT_SUPPORTED: 397 case L2CAP_SECURITY_BLOCK: 398 case L2CAP_NO_RESOURCES: 399 default: 400 l2cap_request_free(req); 401 l2cap_close(chan, ECONNREFUSED); 402 break; 403 } 404 } 405 406 /* 407 * Process Received Config Reqest. 408 */ 409 static void 410 l2cap_recv_config_req(struct mbuf *m, struct hci_link *link) 411 { 412 uint8_t buf[L2CAP_MTU_MINIMUM]; 413 l2cap_cmd_hdr_t cmd; 414 l2cap_cfg_req_cp cp; 415 l2cap_cfg_opt_t opt; 416 l2cap_cfg_opt_val_t val; 417 l2cap_cfg_rsp_cp rp; 418 struct l2cap_channel *chan; 419 int left, len; 420 421 m_copydata(m, 0, sizeof(cmd), &cmd); 422 m_adj(m, sizeof(cmd)); 423 left = le16toh(cmd.length); 424 425 if (left < sizeof(cp)) 426 goto reject; 427 428 m_copydata(m, 0, sizeof(cp), &cp); 429 m_adj(m, sizeof(cp)); 430 left -= sizeof(cp); 431 432 cp.dcid = le16toh(cp.dcid); 433 cp.flags = le16toh(cp.flags); 434 435 chan = l2cap_cid_lookup(cp.dcid); 436 if (chan == NULL || chan->lc_link != link 437 || chan->lc_state != L2CAP_WAIT_CONFIG 438 || (chan->lc_flags & L2CAP_WAIT_CONFIG_REQ) == 0) { 439 /* XXX we should really accept reconfiguration requests */ 440 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_INVALID_CID, 441 L2CAP_NULL_CID, cp.dcid); 442 goto out; 443 } 444 445 /* ready our response packet */ 446 rp.scid = htole16(chan->lc_rcid); 447 rp.flags = 0; /* "No Continuation" */ 448 rp.result = L2CAP_SUCCESS; 449 len = sizeof(rp); 450 451 /* 452 * Process the packet. We build the return packet on the fly adding any 453 * unacceptable parameters as we go. As we can only return one result, 454 * unknown option takes precedence so we start our return packet anew 455 * and ignore option values thereafter as they will be re-sent. 456 * 457 * Since we do not support enough options to make overflowing the min 458 * MTU size an issue in normal use, we just reject config requests that 459 * make that happen. This could be because options are repeated or the 460 * packet is corrupted in some way. 461 * 462 * If unknown option types threaten to overflow the packet, we just 463 * ignore them. We can deny them next time. 464 */ 465 while (left > 0) { 466 if (left < sizeof(opt)) 467 goto reject; 468 469 m_copydata(m, 0, sizeof(opt), &opt); 470 m_adj(m, sizeof(opt)); 471 left -= sizeof(opt); 472 473 if (left < opt.length) 474 goto reject; 475 476 switch(opt.type & L2CAP_OPT_HINT_MASK) { 477 case L2CAP_OPT_MTU: 478 if (rp.result == L2CAP_UNKNOWN_OPTION) 479 break; 480 481 if (opt.length != L2CAP_OPT_MTU_SIZE) 482 goto reject; 483 484 m_copydata(m, 0, L2CAP_OPT_MTU_SIZE, &val); 485 val.mtu = le16toh(val.mtu); 486 487 /* 488 * XXX how do we know what the minimum acceptable MTU is 489 * for a channel? Spec says some profiles have a higher 490 * minimum but I have no way to find that out at this 491 * juncture.. 492 */ 493 if (val.mtu < L2CAP_MTU_MINIMUM) { 494 if (len + sizeof(opt) + L2CAP_OPT_MTU_SIZE > sizeof(buf)) 495 goto reject; 496 497 rp.result = L2CAP_UNACCEPTABLE_PARAMS; 498 memcpy(buf + len, &opt, sizeof(opt)); 499 len += sizeof(opt); 500 val.mtu = htole16(L2CAP_MTU_MINIMUM); 501 memcpy(buf + len, &val, L2CAP_OPT_MTU_SIZE); 502 len += L2CAP_OPT_MTU_SIZE; 503 } else 504 chan->lc_omtu = val.mtu; 505 506 break; 507 508 case L2CAP_OPT_FLUSH_TIMO: 509 if (rp.result == L2CAP_UNKNOWN_OPTION) 510 break; 511 512 if (opt.length != L2CAP_OPT_FLUSH_TIMO_SIZE) 513 goto reject; 514 515 /* 516 * I think that this is informational only - he is 517 * informing us of the flush timeout he will be using. 518 * I dont think this affects us in any significant way, 519 * so just ignore this value for now. 520 */ 521 break; 522 523 case L2CAP_OPT_QOS: 524 default: 525 /* ignore hints */ 526 if (opt.type & L2CAP_OPT_HINT_BIT) 527 break; 528 529 /* unknown options supercede all else */ 530 if (rp.result != L2CAP_UNKNOWN_OPTION) { 531 rp.result = L2CAP_UNKNOWN_OPTION; 532 len = sizeof(rp); 533 } 534 535 /* ignore if it don't fit */ 536 if (len + sizeof(opt) > sizeof(buf)) 537 break; 538 539 /* return unknown option type, but no data */ 540 buf[len++] = opt.type; 541 buf[len++] = 0; 542 break; 543 } 544 545 m_adj(m, opt.length); 546 left -= opt.length; 547 } 548 549 rp.result = htole16(rp.result); 550 memcpy(buf, &rp, sizeof(rp)); 551 l2cap_send_signal(link, L2CAP_CONFIG_RSP, cmd.ident, len, buf); 552 553 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0 554 && rp.result == le16toh(L2CAP_SUCCESS)) { 555 556 chan->lc_flags &= ~L2CAP_WAIT_CONFIG_REQ; 557 558 if ((chan->lc_flags & L2CAP_WAIT_CONFIG_RSP) == 0) { 559 chan->lc_state = L2CAP_OPEN; 560 /* XXX how to distinguish REconfiguration? */ 561 (*chan->lc_proto->connected)(chan->lc_upper); 562 } 563 } 564 return; 565 566 reject: 567 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_NOT_UNDERSTOOD); 568 out: 569 m_adj(m, left); 570 } 571 572 /* 573 * Process Received Config Response. 574 */ 575 static void 576 l2cap_recv_config_rsp(struct mbuf *m, struct hci_link *link) 577 { 578 l2cap_cmd_hdr_t cmd; 579 l2cap_cfg_rsp_cp cp; 580 l2cap_cfg_opt_t opt; 581 l2cap_cfg_opt_val_t val; 582 struct l2cap_req *req; 583 struct l2cap_channel *chan; 584 int left; 585 586 m_copydata(m, 0, sizeof(cmd), &cmd); 587 m_adj(m, sizeof(cmd)); 588 left = le16toh(cmd.length); 589 590 if (left < sizeof(cp)) 591 goto out; 592 593 m_copydata(m, 0, sizeof(cp), &cp); 594 m_adj(m, sizeof(cp)); 595 left -= sizeof(cp); 596 597 cp.scid = le16toh(cp.scid); 598 cp.flags = le16toh(cp.flags); 599 cp.result = le16toh(cp.result); 600 601 req = l2cap_request_lookup(link, cmd.ident); 602 if (req == NULL || req->lr_code != L2CAP_CONFIG_REQ) 603 goto out; 604 605 chan = req->lr_chan; 606 if (chan != NULL && chan->lc_lcid != cp.scid) 607 goto out; 608 609 l2cap_request_free(req); 610 611 if (chan == NULL || chan->lc_state != L2CAP_WAIT_CONFIG 612 || (chan->lc_flags & L2CAP_WAIT_CONFIG_RSP) == 0) 613 goto out; 614 615 if ((cp.flags & L2CAP_OPT_CFLAG_BIT)) { 616 l2cap_cfg_req_cp rp; 617 618 /* 619 * They have more to tell us and want another ID to 620 * use, so send an empty config request 621 */ 622 if (l2cap_request_alloc(chan, L2CAP_CONFIG_REQ)) 623 goto discon; 624 625 rp.dcid = htole16(cp.scid); 626 rp.flags = 0; 627 628 if (l2cap_send_signal(link, L2CAP_CONFIG_REQ, link->hl_lastid, 629 sizeof(rp), &rp)) 630 goto discon; 631 } 632 633 switch(cp.result) { 634 case L2CAP_SUCCESS: 635 /* 636 * If continuation flag was not set, our config request was 637 * accepted. We may have to wait for their config request to 638 * complete, so check that but otherwise we are open 639 * 640 * There may be 'advisory' values in the packet but we just 641 * ignore those.. 642 */ 643 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0) { 644 chan->lc_flags &= ~L2CAP_WAIT_CONFIG_RSP; 645 646 if ((chan->lc_flags & L2CAP_WAIT_CONFIG_REQ) == 0) { 647 chan->lc_state = L2CAP_OPEN; 648 /* XXX how to distinguish REconfiguration? */ 649 (*chan->lc_proto->connected)(chan->lc_upper); 650 } 651 } 652 goto out; 653 654 case L2CAP_UNACCEPTABLE_PARAMS: 655 /* 656 * Packet contains unacceptable parameters with preferred values 657 */ 658 while (left > 0) { 659 if (left < sizeof(opt)) 660 goto discon; 661 662 m_copydata(m, 0, sizeof(opt), &opt); 663 m_adj(m, sizeof(opt)); 664 left -= sizeof(opt); 665 666 if (left < opt.length) 667 goto discon; 668 669 switch (opt.type) { 670 case L2CAP_OPT_MTU: 671 if (opt.length != L2CAP_OPT_MTU_SIZE) 672 goto discon; 673 674 m_copydata(m, 0, L2CAP_OPT_MTU_SIZE, &val); 675 chan->lc_imtu = le16toh(val.mtu); 676 if (chan->lc_imtu < L2CAP_MTU_MINIMUM) 677 chan->lc_imtu = L2CAP_MTU_DEFAULT; 678 break; 679 680 case L2CAP_OPT_FLUSH_TIMO: 681 if (opt.length != L2CAP_OPT_FLUSH_TIMO_SIZE) 682 goto discon; 683 684 /* 685 * Spec says: If we cannot honor proposed value, 686 * either disconnect or try again with original 687 * value. I can't really see why they want to 688 * interfere with OUR flush timeout in any case 689 * so we just punt for now. 690 */ 691 goto discon; 692 693 case L2CAP_OPT_QOS: 694 break; 695 696 default: 697 UNKNOWN(opt.type); 698 goto discon; 699 } 700 701 m_adj(m, opt.length); 702 left -= opt.length; 703 } 704 705 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0) 706 l2cap_send_config_req(chan); /* no state change */ 707 708 goto out; 709 710 case L2CAP_REJECT: 711 goto discon; 712 713 case L2CAP_UNKNOWN_OPTION: 714 /* 715 * Packet contains options not understood. Turn off unknown 716 * options by setting them to default values (means they will 717 * not be requested again). 718 * 719 * If our option was already off then fail (paranoia?) 720 * 721 * XXX Should we consider that options were set for a reason? 722 */ 723 while (left > 0) { 724 if (left < sizeof(opt)) 725 goto discon; 726 727 m_copydata(m, 0, sizeof(opt), &opt); 728 m_adj(m, sizeof(opt)); 729 left -= sizeof(opt); 730 731 if (left < opt.length) 732 goto discon; 733 734 m_adj(m, opt.length); 735 left -= opt.length; 736 737 switch(opt.type) { 738 case L2CAP_OPT_MTU: 739 if (chan->lc_imtu == L2CAP_MTU_DEFAULT) 740 goto discon; 741 742 chan->lc_imtu = L2CAP_MTU_DEFAULT; 743 break; 744 745 case L2CAP_OPT_FLUSH_TIMO: 746 if (chan->lc_flush == L2CAP_FLUSH_TIMO_DEFAULT) 747 goto discon; 748 749 chan->lc_flush = L2CAP_FLUSH_TIMO_DEFAULT; 750 break; 751 752 case L2CAP_OPT_QOS: 753 break; 754 755 default: 756 UNKNOWN(opt.type); 757 goto discon; 758 } 759 } 760 761 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0) 762 l2cap_send_config_req(chan); /* no state change */ 763 764 goto out; 765 766 default: 767 UNKNOWN(cp.result); 768 goto discon; 769 } 770 771 DPRINTF("how did I get here!?\n"); 772 773 discon: 774 l2cap_send_disconnect_req(chan); 775 l2cap_close(chan, ECONNABORTED); 776 777 out: 778 m_adj(m, left); 779 } 780 781 /* 782 * Process Received Disconnect Request. We must validate scid and dcid 783 * just in case but otherwise this connection is finished. 784 */ 785 static void 786 l2cap_recv_disconnect_req(struct mbuf *m, struct hci_link *link) 787 { 788 l2cap_cmd_hdr_t cmd; 789 l2cap_discon_req_cp cp; 790 l2cap_discon_rsp_cp rp; 791 struct l2cap_channel *chan; 792 793 m_copydata(m, 0, sizeof(cmd), &cmd); 794 m_adj(m, sizeof(cmd)); 795 796 m_copydata(m, 0, sizeof(cp), &cp); 797 m_adj(m, sizeof(cp)); 798 799 cp.scid = le16toh(cp.scid); 800 cp.dcid = le16toh(cp.dcid); 801 802 chan = l2cap_cid_lookup(cp.dcid); 803 if (chan == NULL || chan->lc_link != link || chan->lc_rcid != cp.scid) { 804 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_INVALID_CID, 805 cp.dcid, cp.scid); 806 return; 807 } 808 809 rp.dcid = htole16(chan->lc_lcid); 810 rp.scid = htole16(chan->lc_rcid); 811 l2cap_send_signal(link, L2CAP_DISCONNECT_RSP, cmd.ident, 812 sizeof(rp), &rp); 813 814 if (chan->lc_state != L2CAP_CLOSED) 815 l2cap_close(chan, 0); 816 } 817 818 /* 819 * Process Received Disconnect Response. We must validate scid and dcid but 820 * unless we were waiting for this signal, ignore it. 821 */ 822 static void 823 l2cap_recv_disconnect_rsp(struct mbuf *m, struct hci_link *link) 824 { 825 l2cap_cmd_hdr_t cmd; 826 l2cap_discon_rsp_cp cp; 827 struct l2cap_req *req; 828 struct l2cap_channel *chan; 829 830 m_copydata(m, 0, sizeof(cmd), &cmd); 831 m_adj(m, sizeof(cmd)); 832 833 m_copydata(m, 0, sizeof(cp), &cp); 834 m_adj(m, sizeof(cp)); 835 836 cp.scid = le16toh(cp.scid); 837 cp.dcid = le16toh(cp.dcid); 838 839 req = l2cap_request_lookup(link, cmd.ident); 840 if (req == NULL || req->lr_code != L2CAP_DISCONNECT_REQ) 841 return; 842 843 chan = req->lr_chan; 844 if (chan == NULL 845 || chan->lc_lcid != cp.scid 846 || chan->lc_rcid != cp.dcid) 847 return; 848 849 l2cap_request_free(req); 850 851 if (chan->lc_state != L2CAP_WAIT_DISCONNECT) 852 return; 853 854 l2cap_close(chan, 0); 855 } 856 857 /* 858 * Process Received Info Request. 859 */ 860 static void 861 l2cap_recv_info_req(struct mbuf *m, struct hci_link *link) 862 { 863 l2cap_cmd_hdr_t cmd; 864 l2cap_info_req_cp cp; 865 uint8_t rsp[12]; 866 867 m_copydata(m, 0, sizeof(cmd), &cmd); 868 m_adj(m, sizeof(cmd)); 869 870 m_copydata(m, 0, sizeof(cp), &cp); 871 m_adj(m, sizeof(cp)); 872 873 cp.type = le16toh(cp.type); 874 switch(cp.type) { 875 case L2CAP_EXTENDED_FEATURES: 876 /* 877 * 32-bit data field, unused bits set to zero 878 * 879 * octet bit feature 880 * 0 0 Flow control mode 881 * 0 1 Retransmission mode 882 * 0 2 Bi-directional QoS 883 * 0 3 Enhanced retransmission mode 884 * 0 4 Streaming mode 885 * 0 5 FCS option 886 * 0 6 Extended flow specification for BR/EDR 887 * 0 7 Fixed channels (SET) 888 * 1 0 Extended window size 889 * 1 1 Unicast connectionless data reception 890 */ 891 le16enc(rsp + 0, cp.type); 892 le16enc(rsp + 2, L2CAP_SUCCESS); 893 le32enc(rsp + 4, 0x00000080); 894 l2cap_send_signal(link, L2CAP_INFO_RSP, cmd.ident, 8, rsp); 895 break; 896 897 case L2CAP_FIXED_CHANNELS: 898 /* 899 * 64-bit data field, unused bits set to zero 900 * 901 * octet bit channel 902 * 0 0 0x0000 Null 903 * 0 1 0x0001 L2CAP Signalling Channel (SET) 904 * 0 2 0x0002 Connectionless Reception 905 * 0 3 0x0003 AMP Manager Protocol Channel 906 */ 907 le16enc(rsp + 0, cp.type); 908 le16enc(rsp + 2, L2CAP_SUCCESS); 909 le64enc(rsp + 4, 0x0000000000000002); 910 l2cap_send_signal(link, L2CAP_INFO_RSP, cmd.ident, 12, rsp); 911 break; 912 913 case L2CAP_CONNLESS_MTU: 914 default: 915 le16enc(rsp + 0, cp.type); 916 le16enc(rsp + 2, L2CAP_NOT_SUPPORTED); 917 l2cap_send_signal(link, L2CAP_INFO_RSP, cmd.ident, 4, rsp); 918 break; 919 } 920 } 921 922 /* 923 * Construct signal and wrap in C-Frame for link. 924 */ 925 static int 926 l2cap_send_signal(struct hci_link *link, uint8_t code, uint8_t ident, 927 uint16_t length, void *data) 928 { 929 struct mbuf *m; 930 l2cap_hdr_t *hdr; 931 l2cap_cmd_hdr_t *cmd; 932 933 #ifdef DIAGNOSTIC 934 if (link == NULL) 935 return ENETDOWN; 936 937 if (sizeof(l2cap_cmd_hdr_t) + length > link->hl_mtu) 938 aprint_error_dev(link->hl_unit->hci_dev, 939 "exceeding L2CAP Signal MTU for link!\n"); 940 #endif 941 942 m = m_gethdr(M_DONTWAIT, MT_DATA); 943 if (m == NULL) 944 return ENOMEM; 945 946 hdr = mtod(m, l2cap_hdr_t *); 947 cmd = (l2cap_cmd_hdr_t *)(hdr + 1); 948 949 m->m_len = m->m_pkthdr.len = MHLEN; 950 951 /* Command Data */ 952 if (length > 0) 953 m_copyback(m, sizeof(*hdr) + sizeof(*cmd), length, data); 954 955 /* Command Header */ 956 cmd->code = code; 957 cmd->ident = ident; 958 cmd->length = htole16(length); 959 length += sizeof(*cmd); 960 961 /* C-Frame Header */ 962 hdr->length = htole16(length); 963 hdr->dcid = htole16(L2CAP_SIGNAL_CID); 964 length += sizeof(*hdr); 965 966 if (m->m_pkthdr.len != MAX(MHLEN, length)) { 967 m_freem(m); 968 return ENOMEM; 969 } 970 971 m->m_pkthdr.len = length; 972 m->m_len = MIN(length, MHLEN); 973 974 DPRINTFN(2, "(%s) code %d, ident %d, len %d\n", 975 device_xname(link->hl_unit->hci_dev), code, ident, length); 976 977 return hci_acl_send(m, link, NULL); 978 } 979 980 /* 981 * Send Command Reject packet. 982 */ 983 static int 984 l2cap_send_command_rej(struct hci_link *link, uint8_t ident, 985 uint16_t reason, ...) 986 { 987 l2cap_cmd_rej_cp cp; 988 int len = 0; 989 va_list ap; 990 991 va_start(ap, reason); 992 993 cp.reason = htole16(reason); 994 995 switch (reason) { 996 case L2CAP_REJ_NOT_UNDERSTOOD: 997 len = 2; 998 break; 999 1000 case L2CAP_REJ_MTU_EXCEEDED: 1001 len = 4; 1002 cp.data[0] = va_arg(ap, int); /* SigMTU */ 1003 cp.data[0] = htole16(cp.data[0]); 1004 break; 1005 1006 case L2CAP_REJ_INVALID_CID: 1007 len = 6; 1008 cp.data[0] = va_arg(ap, int); /* dcid */ 1009 cp.data[0] = htole16(cp.data[0]); 1010 cp.data[1] = va_arg(ap, int); /* scid */ 1011 cp.data[1] = htole16(cp.data[1]); 1012 break; 1013 1014 default: 1015 UNKNOWN(reason); 1016 return EINVAL; 1017 } 1018 1019 va_end(ap); 1020 1021 return l2cap_send_signal(link, L2CAP_COMMAND_REJ, ident, len, &cp); 1022 } 1023 1024 /* 1025 * Send Connect Request 1026 */ 1027 int 1028 l2cap_send_connect_req(struct l2cap_channel *chan) 1029 { 1030 l2cap_con_req_cp cp; 1031 int err; 1032 1033 err = l2cap_request_alloc(chan, L2CAP_CONNECT_REQ); 1034 if (err) 1035 return err; 1036 1037 cp.psm = htole16(chan->lc_raddr.bt_psm); 1038 cp.scid = htole16(chan->lc_lcid); 1039 1040 return l2cap_send_signal(chan->lc_link, L2CAP_CONNECT_REQ, 1041 chan->lc_link->hl_lastid, sizeof(cp), &cp); 1042 } 1043 1044 /* 1045 * Send Config Request 1046 * 1047 * For outgoing config request, we only put options in the packet if they 1048 * differ from the default and would have to be actioned. We dont support 1049 * enough option types to make overflowing SigMTU an issue so it can all 1050 * go in one packet. 1051 */ 1052 int 1053 l2cap_send_config_req(struct l2cap_channel *chan) 1054 { 1055 l2cap_cfg_req_cp *cp; 1056 l2cap_cfg_opt_t *opt; 1057 l2cap_cfg_opt_val_t *val; 1058 uint8_t *next, buf[L2CAP_MTU_MINIMUM]; 1059 int err; 1060 1061 err = l2cap_request_alloc(chan, L2CAP_CONFIG_REQ); 1062 if (err) 1063 return err; 1064 1065 /* Config Header (4 octets) */ 1066 cp = (l2cap_cfg_req_cp *)buf; 1067 cp->dcid = htole16(chan->lc_rcid); 1068 cp->flags = 0; /* "No Continuation" */ 1069 1070 next = buf + sizeof(l2cap_cfg_req_cp); 1071 1072 /* Incoming MTU (4 octets) */ 1073 if (chan->lc_imtu != L2CAP_MTU_DEFAULT) { 1074 opt = (l2cap_cfg_opt_t *)next; 1075 opt->type = L2CAP_OPT_MTU; 1076 opt->length = L2CAP_OPT_MTU_SIZE; 1077 1078 val = (l2cap_cfg_opt_val_t *)(opt + 1); 1079 val->mtu = htole16(chan->lc_imtu); 1080 1081 next += sizeof(l2cap_cfg_opt_t) + L2CAP_OPT_MTU_SIZE; 1082 } 1083 1084 /* Flush Timeout (4 octets) */ 1085 if (chan->lc_flush != L2CAP_FLUSH_TIMO_DEFAULT) { 1086 opt = (l2cap_cfg_opt_t *)next; 1087 opt->type = L2CAP_OPT_FLUSH_TIMO; 1088 opt->length = L2CAP_OPT_FLUSH_TIMO_SIZE; 1089 1090 val = (l2cap_cfg_opt_val_t *)(opt + 1); 1091 val->flush_timo = htole16(chan->lc_flush); 1092 1093 next += sizeof(l2cap_cfg_opt_t) + L2CAP_OPT_FLUSH_TIMO_SIZE; 1094 } 1095 1096 /* Outgoing QoS Flow (24 octets) */ 1097 /* Retransmission & Flow Control (11 octets) */ 1098 /* 1099 * From here we need to start paying attention to SigMTU as we have 1100 * possibly overflowed the minimum supported.. 1101 */ 1102 1103 return l2cap_send_signal(chan->lc_link, L2CAP_CONFIG_REQ, 1104 chan->lc_link->hl_lastid, (int)(next - buf), buf); 1105 } 1106 1107 /* 1108 * Send Disconnect Request 1109 */ 1110 int 1111 l2cap_send_disconnect_req(struct l2cap_channel *chan) 1112 { 1113 l2cap_discon_req_cp cp; 1114 int err; 1115 1116 err = l2cap_request_alloc(chan, L2CAP_DISCONNECT_REQ); 1117 if (err) 1118 return err; 1119 1120 cp.dcid = htole16(chan->lc_rcid); 1121 cp.scid = htole16(chan->lc_lcid); 1122 1123 return l2cap_send_signal(chan->lc_link, L2CAP_DISCONNECT_REQ, 1124 chan->lc_link->hl_lastid, sizeof(cp), &cp); 1125 } 1126 1127 /* 1128 * Send Connect Response 1129 */ 1130 int 1131 l2cap_send_connect_rsp(struct hci_link *link, uint8_t ident, uint16_t dcid, uint16_t scid, uint16_t result) 1132 { 1133 l2cap_con_rsp_cp cp; 1134 1135 memset(&cp, 0, sizeof(cp)); 1136 cp.dcid = htole16(dcid); 1137 cp.scid = htole16(scid); 1138 cp.result = htole16(result); 1139 1140 return l2cap_send_signal(link, L2CAP_CONNECT_RSP, ident, sizeof(cp), &cp); 1141 } 1142
Indexes created Tue Sep 30 17:09:57 GMT 2025