l2cap_signal.c revision 1.6
1 /* $NetBSD: l2cap_signal.c,v 1.6 2007/03/15 19:47:51 plunky Exp $ */ 2 3 /*- 4 * Copyright (c) 2005 Iain Hibbert. 5 * Copyright (c) 2006 Itronix Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of Itronix Inc. may not be used to endorse 17 * or promote products derived from this software without specific 18 * prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: l2cap_signal.c,v 1.6 2007/03/15 19:47:51 plunky Exp $"); 35 36 #include <sys/param.h> 37 #include <sys/kernel.h> 38 #include <sys/mbuf.h> 39 #include <sys/proc.h> 40 #include <sys/queue.h> 41 #include <sys/systm.h> 42 43 #include <machine/stdarg.h> 44 45 #include <netbt/bluetooth.h> 46 #include <netbt/hci.h> 47 #include <netbt/l2cap.h> 48 49 /******************************************************************************* 50 * 51 * L2CAP Signal processing 52 */ 53 54 static void l2cap_recv_command_rej(struct mbuf *, struct hci_link *); 55 static void l2cap_recv_connect_req(struct mbuf *, struct hci_link *); 56 static void l2cap_recv_connect_rsp(struct mbuf *, struct hci_link *); 57 static void l2cap_recv_config_req(struct mbuf *, struct hci_link *); 58 static void l2cap_recv_config_rsp(struct mbuf *, struct hci_link *); 59 static void l2cap_recv_disconnect_req(struct mbuf *, struct hci_link *); 60 static void l2cap_recv_disconnect_rsp(struct mbuf *, struct hci_link *); 61 static void l2cap_recv_info_req(struct mbuf *, struct hci_link *); 62 static int l2cap_send_signal(struct hci_link *, uint8_t, uint8_t, uint16_t, void *); 63 static int l2cap_send_command_rej(struct hci_link *, uint8_t, uint16_t, ...); 64 65 /* 66 * process incoming signal packets (CID 0x0001). Can contain multiple 67 * requests/responses. 68 */ 69 void 70 l2cap_recv_signal(struct mbuf *m, struct hci_link *link) 71 { 72 l2cap_cmd_hdr_t cmd; 73 74 for(;;) { 75 if (m->m_pkthdr.len == 0) 76 goto finish; 77 78 if (m->m_pkthdr.len < sizeof(cmd)) 79 goto reject; 80 81 m_copydata(m, 0, sizeof(cmd), &cmd); 82 cmd.length = le16toh(cmd.length); 83 84 if (m->m_pkthdr.len < sizeof(cmd) + cmd.length) 85 goto reject; 86 87 DPRINTFN(2, "(%s) code %d, ident %d, len %d\n", 88 link->hl_unit->hci_devname, 89 cmd.code, cmd.ident, cmd.length); 90 91 switch (cmd.code) { 92 case L2CAP_COMMAND_REJ: 93 if (cmd.length > sizeof(l2cap_cmd_rej_cp)) 94 goto finish; 95 96 l2cap_recv_command_rej(m, link); 97 break; 98 99 case L2CAP_CONNECT_REQ: 100 if (cmd.length != sizeof(l2cap_con_req_cp)) 101 goto reject; 102 103 l2cap_recv_connect_req(m, link); 104 break; 105 106 case L2CAP_CONNECT_RSP: 107 if (cmd.length != sizeof(l2cap_con_rsp_cp)) 108 goto finish; 109 110 l2cap_recv_connect_rsp(m, link); 111 break; 112 113 case L2CAP_CONFIG_REQ: 114 l2cap_recv_config_req(m, link); 115 break; 116 117 case L2CAP_CONFIG_RSP: 118 l2cap_recv_config_rsp(m, link); 119 break; 120 121 case L2CAP_DISCONNECT_REQ: 122 if (cmd.length != sizeof(l2cap_discon_req_cp)) 123 goto reject; 124 125 l2cap_recv_disconnect_req(m, link); 126 break; 127 128 case L2CAP_DISCONNECT_RSP: 129 if (cmd.length != sizeof(l2cap_discon_rsp_cp)) 130 goto finish; 131 132 l2cap_recv_disconnect_rsp(m, link); 133 break; 134 135 case L2CAP_ECHO_REQ: 136 m_adj(m, sizeof(cmd) + cmd.length); 137 l2cap_send_signal(link, L2CAP_ECHO_RSP, cmd.ident, 138 0, NULL); 139 break; 140 141 case L2CAP_ECHO_RSP: 142 m_adj(m, sizeof(cmd) + cmd.length); 143 break; 144 145 case L2CAP_INFO_REQ: 146 if (cmd.length != sizeof(l2cap_info_req_cp)) 147 goto reject; 148 149 l2cap_recv_info_req(m, link); 150 break; 151 152 case L2CAP_INFO_RSP: 153 m_adj(m, sizeof(cmd) + cmd.length); 154 break; 155 156 default: 157 goto reject; 158 } 159 } 160 161 #ifdef DIAGNOSTIC 162 panic("impossible!"); 163 #endif 164 165 reject: 166 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_NOT_UNDERSTOOD); 167 finish: 168 m_freem(m); 169 } 170 171 /* 172 * Process Received Command Reject. For now we dont try to recover gracefully 173 * from this, it probably means that the link is garbled or the other end is 174 * insufficiently capable of handling normal traffic. (not *my* fault, no way!) 175 */ 176 static void 177 l2cap_recv_command_rej(struct mbuf *m, struct hci_link *link) 178 { 179 struct l2cap_req *req; 180 struct l2cap_channel *chan; 181 l2cap_cmd_hdr_t cmd; 182 l2cap_cmd_rej_cp cp; 183 184 m_copydata(m, 0, sizeof(cmd), &cmd); 185 m_adj(m, sizeof(cmd)); 186 187 cmd.length = le16toh(cmd.length); 188 189 m_copydata(m, 0, cmd.length, &cp); 190 m_adj(m, cmd.length); 191 192 req = l2cap_request_lookup(link, cmd.ident); 193 if (req == NULL) 194 return; 195 196 switch (le16toh(cp.reason)) { 197 case L2CAP_REJ_NOT_UNDERSTOOD: 198 /* 199 * I dont know what to do, just move up the timeout 200 */ 201 callout_schedule(&req->lr_rtx, 0); 202 break; 203 204 case L2CAP_REJ_MTU_EXCEEDED: 205 /* 206 * I didnt send any commands over L2CAP_MTU_MINIMUM size, but.. 207 * 208 * XXX maybe we should resend this, instead? 209 */ 210 link->hl_mtu = le16toh(cp.data[0]); 211 callout_schedule(&req->lr_rtx, 0); 212 break; 213 214 case L2CAP_REJ_INVALID_CID: 215 /* 216 * Well, if they dont have such a channel then our channel is 217 * most likely closed. Make it so. 218 */ 219 chan = req->lr_chan; 220 l2cap_request_free(req); 221 if (chan != NULL && chan->lc_state != L2CAP_CLOSED) 222 l2cap_close(chan, ECONNABORTED); 223 224 break; 225 226 default: 227 UNKNOWN(le16toh(cp.reason)); 228 break; 229 } 230 } 231 232 /* 233 * Process Received Connect Request. Find listening channel matching 234 * psm & addr and ask upper layer for a new channel. 235 */ 236 static void 237 l2cap_recv_connect_req(struct mbuf *m, struct hci_link *link) 238 { 239 struct sockaddr_bt laddr, raddr; 240 struct l2cap_channel *chan, *new; 241 l2cap_cmd_hdr_t cmd; 242 l2cap_con_req_cp cp; 243 l2cap_con_rsp_cp rp; 244 int err; 245 246 /* extract cmd */ 247 m_copydata(m, 0, sizeof(cmd), &cmd); 248 m_adj(m, sizeof(cmd)); 249 250 /* extract request */ 251 m_copydata(m, 0, sizeof(cp), &cp); 252 m_adj(m, sizeof(cp)); 253 254 /* init response */ 255 memset(&rp, 0, sizeof(rp)); 256 rp.scid = cp.scid; 257 258 memset(&laddr, 0, sizeof(struct sockaddr_bt)); 259 laddr.bt_len = sizeof(struct sockaddr_bt); 260 laddr.bt_family = AF_BLUETOOTH; 261 laddr.bt_psm = le16toh(cp.psm); 262 bdaddr_copy(&laddr.bt_bdaddr, &link->hl_unit->hci_bdaddr); 263 264 memset(&raddr, 0, sizeof(struct sockaddr_bt)); 265 raddr.bt_len = sizeof(struct sockaddr_bt); 266 raddr.bt_family = AF_BLUETOOTH; 267 raddr.bt_psm = le16toh(cp.psm); 268 bdaddr_copy(&raddr.bt_bdaddr, &link->hl_bdaddr); 269 270 LIST_FOREACH(chan, &l2cap_listen_list, lc_ncid) { 271 if (chan->lc_laddr.bt_psm != laddr.bt_psm 272 && chan->lc_laddr.bt_psm != L2CAP_PSM_ANY) 273 continue; 274 275 if (!bdaddr_same(&laddr.bt_bdaddr, &chan->lc_laddr.bt_bdaddr) 276 && bdaddr_any(&chan->lc_laddr.bt_bdaddr) == 0) 277 continue; 278 279 new= (*chan->lc_proto->newconn)(chan->lc_upper, &laddr, &raddr); 280 if (new == NULL) 281 continue; 282 283 err = l2cap_cid_alloc(new); 284 if (err) { 285 rp.result = htole16(L2CAP_NO_RESOURCES); 286 l2cap_send_signal(link, L2CAP_CONNECT_RSP, 287 cmd.ident, sizeof(rp), &rp); 288 (*new->lc_proto->disconnected)(new->lc_upper, err); 289 return; 290 } 291 292 new->lc_link = hci_acl_open(link->hl_unit, &link->hl_bdaddr); 293 KASSERT(new->lc_link == link); 294 295 new->lc_rcid = le16toh(cp.scid); 296 297 memcpy(&new->lc_laddr, &laddr, sizeof(struct sockaddr_bt)); 298 memcpy(&new->lc_raddr, &raddr, sizeof(struct sockaddr_bt)); 299 300 rp.dcid = htole16(new->lc_lcid); 301 rp.result = htole16(L2CAP_SUCCESS); 302 l2cap_send_signal(link, L2CAP_CONNECT_RSP, cmd.ident, 303 sizeof(rp), &rp); 304 305 new->lc_state = L2CAP_WAIT_CONFIG; 306 new->lc_flags |= (L2CAP_WAIT_CONFIG_REQ | L2CAP_WAIT_CONFIG_RSP); 307 l2cap_send_config_req(new); 308 return; 309 } 310 311 rp.result = htole16(L2CAP_PSM_NOT_SUPPORTED); 312 l2cap_send_signal(link, L2CAP_CONNECT_RSP, cmd.ident, sizeof(rp), &rp); 313 } 314 315 /* 316 * Process Received Connect Response. 317 */ 318 static void 319 l2cap_recv_connect_rsp(struct mbuf *m, struct hci_link *link) 320 { 321 l2cap_cmd_hdr_t cmd; 322 l2cap_con_rsp_cp cp; 323 struct l2cap_req *req; 324 struct l2cap_channel *chan; 325 326 m_copydata(m, 0, sizeof(cmd), &cmd); 327 m_adj(m, sizeof(cmd)); 328 329 m_copydata(m, 0, sizeof(cp), &cp); 330 m_adj(m, sizeof(cp)); 331 332 cp.scid = le16toh(cp.scid); 333 cp.dcid = le16toh(cp.dcid); 334 cp.result = le16toh(cp.result); 335 336 req = l2cap_request_lookup(link, cmd.ident); 337 if (req == NULL || req->lr_code != L2CAP_CONNECT_REQ) 338 return; 339 340 chan = req->lr_chan; 341 if (chan != NULL && chan->lc_lcid != cp.scid) 342 return; 343 344 if (chan == NULL || chan->lc_state != L2CAP_WAIT_CONNECT_RSP) { 345 l2cap_request_free(req); 346 return; 347 } 348 349 switch (cp.result) { 350 case L2CAP_SUCCESS: 351 /* 352 * Ok, at this point we have a connection to the other party. We 353 * could indicate upstream that we are ready for business and 354 * wait for a "Configure Channel Request" but I'm not so sure 355 * that is required in our case - we will proceed directly to 356 * sending our config request. We set two state bits because in 357 * the config state we are waiting for requests and responses. 358 */ 359 l2cap_request_free(req); 360 chan->lc_rcid = cp.dcid; 361 chan->lc_state = L2CAP_WAIT_CONFIG; 362 chan->lc_flags |= (L2CAP_WAIT_CONFIG_REQ | L2CAP_WAIT_CONFIG_RSP); 363 l2cap_send_config_req(chan); 364 break; 365 366 case L2CAP_PENDING: 367 /* XXX dont release request, should start eRTX timeout? */ 368 (*chan->lc_proto->connecting)(chan->lc_upper); 369 break; 370 371 case L2CAP_PSM_NOT_SUPPORTED: 372 case L2CAP_SECURITY_BLOCK: 373 case L2CAP_NO_RESOURCES: 374 default: 375 l2cap_request_free(req); 376 l2cap_close(chan, ECONNREFUSED); 377 break; 378 } 379 } 380 381 /* 382 * Process Received Config Reqest. 383 */ 384 static void 385 l2cap_recv_config_req(struct mbuf *m, struct hci_link *link) 386 { 387 uint8_t buf[L2CAP_MTU_MINIMUM]; 388 l2cap_cmd_hdr_t cmd; 389 l2cap_cfg_req_cp cp; 390 l2cap_cfg_opt_t opt; 391 l2cap_cfg_opt_val_t val; 392 l2cap_cfg_rsp_cp rp; 393 struct l2cap_channel *chan; 394 int left, len; 395 396 m_copydata(m, 0, sizeof(cmd), &cmd); 397 m_adj(m, sizeof(cmd)); 398 left = le16toh(cmd.length); 399 400 if (left < sizeof(cp)) 401 goto reject; 402 403 m_copydata(m, 0, sizeof(cp), &cp); 404 m_adj(m, sizeof(cp)); 405 left -= sizeof(cp); 406 407 cp.dcid = le16toh(cp.dcid); 408 cp.flags = le16toh(cp.flags); 409 410 chan = l2cap_cid_lookup(cp.dcid); 411 if (chan == NULL || chan->lc_link != link 412 || chan->lc_state != L2CAP_WAIT_CONFIG 413 || (chan->lc_flags & L2CAP_WAIT_CONFIG_REQ) == 0) { 414 /* XXX we should really accept reconfiguration requests */ 415 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_INVALID_CID, 416 L2CAP_NULL_CID, cp.dcid); 417 goto out; 418 } 419 420 /* ready our response packet */ 421 rp.scid = htole16(chan->lc_rcid); 422 rp.flags = 0; /* "No Continuation" */ 423 rp.result = L2CAP_SUCCESS; 424 len = sizeof(rp); 425 426 /* 427 * Process the packet. We build the return packet on the fly adding any 428 * unacceptable parameters as we go. As we can only return one result, 429 * unknown option takes precedence so we start our return packet anew 430 * and ignore option values thereafter as they will be re-sent. 431 * 432 * Since we do not support enough options to make overflowing the min 433 * MTU size an issue in normal use, we just reject config requests that 434 * make that happen. This could be because options are repeated or the 435 * packet is corrupted in some way. 436 * 437 * If unknown option types threaten to overflow the packet, we just 438 * ignore them. We can deny them next time. 439 */ 440 while (left > 0) { 441 if (left < sizeof(opt)) 442 goto reject; 443 444 m_copydata(m, 0, sizeof(opt), &opt); 445 m_adj(m, sizeof(opt)); 446 left -= sizeof(opt); 447 448 if (left < opt.length) 449 goto reject; 450 451 switch(opt.type & L2CAP_OPT_HINT_MASK) { 452 case L2CAP_OPT_MTU: 453 if (rp.result == L2CAP_UNKNOWN_OPTION) 454 break; 455 456 if (opt.length != L2CAP_OPT_MTU_SIZE) 457 goto reject; 458 459 m_copydata(m, 0, L2CAP_OPT_MTU_SIZE, &val); 460 val.mtu = le16toh(val.mtu); 461 462 /* 463 * XXX how do we know what the minimum acceptable MTU is 464 * for a channel? Spec says some profiles have a higher 465 * minimum but I have no way to find that out at this 466 * juncture.. 467 */ 468 if (val.mtu < L2CAP_MTU_MINIMUM) { 469 if (len + sizeof(opt) + L2CAP_OPT_MTU_SIZE > sizeof(buf)) 470 goto reject; 471 472 rp.result = L2CAP_UNACCEPTABLE_PARAMS; 473 memcpy(buf + len, &opt, sizeof(opt)); 474 len += sizeof(opt); 475 val.mtu = htole16(L2CAP_MTU_MINIMUM); 476 memcpy(buf + len, &val, L2CAP_OPT_MTU_SIZE); 477 len += L2CAP_OPT_MTU_SIZE; 478 } else 479 chan->lc_omtu = val.mtu; 480 481 break; 482 483 case L2CAP_OPT_FLUSH_TIMO: 484 if (rp.result == L2CAP_UNKNOWN_OPTION) 485 break; 486 487 if (opt.length != L2CAP_OPT_FLUSH_TIMO_SIZE) 488 goto reject; 489 490 /* 491 * I think that this is informational only - he is 492 * informing us of the flush timeout he will be using. 493 * I dont think this affects us in any significant way, 494 * so just ignore this value for now. 495 */ 496 break; 497 498 case L2CAP_OPT_QOS: 499 default: 500 /* ignore hints */ 501 if (opt.type & L2CAP_OPT_HINT_BIT) 502 break; 503 504 /* unknown options supercede all else */ 505 if (rp.result != L2CAP_UNKNOWN_OPTION) { 506 rp.result = L2CAP_UNKNOWN_OPTION; 507 len = sizeof(rp); 508 } 509 510 /* ignore if it don't fit */ 511 if (len + sizeof(opt) > sizeof(buf)) 512 break; 513 514 /* return unknown option type, but no data */ 515 buf[len++] = opt.type; 516 buf[len++] = 0; 517 break; 518 } 519 520 m_adj(m, opt.length); 521 left -= opt.length; 522 } 523 524 rp.result = htole16(rp.result); 525 memcpy(buf, &rp, sizeof(rp)); 526 l2cap_send_signal(link, L2CAP_CONFIG_RSP, cmd.ident, len, buf); 527 528 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0 529 && rp.result == le16toh(L2CAP_SUCCESS)) { 530 531 chan->lc_flags &= ~L2CAP_WAIT_CONFIG_REQ; 532 533 if ((chan->lc_flags & L2CAP_WAIT_CONFIG_RSP) == 0) { 534 chan->lc_state = L2CAP_OPEN; 535 /* XXX how to distinguish REconfiguration? */ 536 (*chan->lc_proto->connected)(chan->lc_upper); 537 } 538 } 539 return; 540 541 reject: 542 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_NOT_UNDERSTOOD); 543 out: 544 m_adj(m, left); 545 } 546 547 /* 548 * Process Received Config Response. 549 */ 550 static void 551 l2cap_recv_config_rsp(struct mbuf *m, struct hci_link *link) 552 { 553 l2cap_cmd_hdr_t cmd; 554 l2cap_cfg_rsp_cp cp; 555 l2cap_cfg_opt_t opt; 556 l2cap_cfg_opt_val_t val; 557 struct l2cap_req *req; 558 struct l2cap_channel *chan; 559 int left; 560 561 m_copydata(m, 0, sizeof(cmd), &cmd); 562 m_adj(m, sizeof(cmd)); 563 left = le16toh(cmd.length); 564 565 if (left < sizeof(cp)) 566 goto out; 567 568 m_copydata(m, 0, sizeof(cp), &cp); 569 m_adj(m, sizeof(cp)); 570 left -= sizeof(cp); 571 572 cp.scid = le16toh(cp.scid); 573 cp.flags = le16toh(cp.flags); 574 cp.result = le16toh(cp.result); 575 576 req = l2cap_request_lookup(link, cmd.ident); 577 if (req == NULL || req->lr_code != L2CAP_CONFIG_REQ) 578 goto out; 579 580 chan = req->lr_chan; 581 if (chan != NULL && chan->lc_lcid != cp.scid) 582 goto out; 583 584 l2cap_request_free(req); 585 586 if (chan == NULL || chan->lc_state != L2CAP_WAIT_CONFIG 587 || (chan->lc_flags & L2CAP_WAIT_CONFIG_RSP) == 0) 588 goto out; 589 590 if ((cp.flags & L2CAP_OPT_CFLAG_BIT)) { 591 l2cap_cfg_req_cp rp; 592 593 /* 594 * They have more to tell us and want another ID to 595 * use, so send an empty config request 596 */ 597 if (l2cap_request_alloc(chan, L2CAP_CONFIG_REQ)) 598 goto discon; 599 600 rp.dcid = htole16(cp.scid); 601 rp.flags = 0; 602 603 if (l2cap_send_signal(link, L2CAP_CONFIG_REQ, link->hl_lastid, 604 sizeof(rp), &rp)) 605 goto discon; 606 } 607 608 switch(cp.result) { 609 case L2CAP_SUCCESS: 610 /* 611 * If continuation flag was not set, our config request was 612 * accepted. We may have to wait for their config request to 613 * complete, so check that but otherwise we are open 614 * 615 * There may be 'advisory' values in the packet but we just 616 * ignore those.. 617 */ 618 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0) { 619 chan->lc_flags &= ~L2CAP_WAIT_CONFIG_RSP; 620 621 if ((chan->lc_flags & L2CAP_WAIT_CONFIG_REQ) == 0) { 622 chan->lc_state = L2CAP_OPEN; 623 /* XXX how to distinguish REconfiguration? */ 624 (*chan->lc_proto->connected)(chan->lc_upper); 625 } 626 } 627 goto out; 628 629 case L2CAP_UNACCEPTABLE_PARAMS: 630 /* 631 * Packet contains unacceptable parameters with preferred values 632 */ 633 while (left > 0) { 634 if (left < sizeof(opt)) 635 goto discon; 636 637 m_copydata(m, 0, sizeof(opt), &opt); 638 m_adj(m, sizeof(opt)); 639 left -= sizeof(opt); 640 641 if (left < opt.length) 642 goto discon; 643 644 switch (opt.type) { 645 case L2CAP_OPT_MTU: 646 if (opt.length != L2CAP_OPT_MTU_SIZE) 647 goto discon; 648 649 m_copydata(m, 0, L2CAP_OPT_MTU_SIZE, &val); 650 chan->lc_imtu = le16toh(val.mtu); 651 if (chan->lc_imtu < L2CAP_MTU_MINIMUM) 652 chan->lc_imtu = L2CAP_MTU_DEFAULT; 653 break; 654 655 case L2CAP_OPT_FLUSH_TIMO: 656 if (opt.length != L2CAP_OPT_FLUSH_TIMO_SIZE) 657 goto discon; 658 659 /* 660 * Spec says: If we cannot honor proposed value, 661 * either disconnect or try again with original 662 * value. I can't really see why they want to 663 * interfere with OUR flush timeout in any case 664 * so we just punt for now. 665 */ 666 goto discon; 667 668 case L2CAP_OPT_QOS: 669 break; 670 671 default: 672 UNKNOWN(opt.type); 673 goto discon; 674 } 675 676 m_adj(m, opt.length); 677 left -= opt.length; 678 } 679 680 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0) 681 l2cap_send_config_req(chan); /* no state change */ 682 683 goto out; 684 685 case L2CAP_REJECT: 686 goto discon; 687 688 case L2CAP_UNKNOWN_OPTION: 689 /* 690 * Packet contains options not understood. Turn off unknown 691 * options by setting them to default values (means they will 692 * not be requested again). 693 * 694 * If our option was already off then fail (paranoia?) 695 * 696 * XXX Should we consider that options were set for a reason? 697 */ 698 while (left > 0) { 699 if (left < sizeof(opt)) 700 goto discon; 701 702 m_copydata(m, 0, sizeof(opt), &opt); 703 m_adj(m, sizeof(opt)); 704 left -= sizeof(opt); 705 706 if (left < opt.length) 707 goto discon; 708 709 m_adj(m, opt.length); 710 left -= opt.length; 711 712 switch(opt.type) { 713 case L2CAP_OPT_MTU: 714 if (chan->lc_imtu == L2CAP_MTU_DEFAULT) 715 goto discon; 716 717 chan->lc_imtu = L2CAP_MTU_DEFAULT; 718 break; 719 720 case L2CAP_OPT_FLUSH_TIMO: 721 if (chan->lc_flush == L2CAP_FLUSH_TIMO_DEFAULT) 722 goto discon; 723 724 chan->lc_flush = L2CAP_FLUSH_TIMO_DEFAULT; 725 break; 726 727 case L2CAP_OPT_QOS: 728 break; 729 730 default: 731 UNKNOWN(opt.type); 732 goto discon; 733 } 734 } 735 736 if ((cp.flags & L2CAP_OPT_CFLAG_BIT) == 0) 737 l2cap_send_config_req(chan); /* no state change */ 738 739 goto out; 740 741 default: 742 UNKNOWN(cp.result); 743 goto discon; 744 } 745 746 DPRINTF("how did I get here!?\n"); 747 748 discon: 749 l2cap_send_disconnect_req(chan); 750 l2cap_close(chan, ECONNABORTED); 751 752 out: 753 m_adj(m, left); 754 } 755 756 /* 757 * Process Received Disconnect Request. We must validate scid and dcid 758 * just in case but otherwise this connection is finished. 759 */ 760 static void 761 l2cap_recv_disconnect_req(struct mbuf *m, struct hci_link *link) 762 { 763 l2cap_cmd_hdr_t cmd; 764 l2cap_discon_req_cp cp; 765 l2cap_discon_rsp_cp rp; 766 struct l2cap_channel *chan; 767 768 m_copydata(m, 0, sizeof(cmd), &cmd); 769 m_adj(m, sizeof(cmd)); 770 771 m_copydata(m, 0, sizeof(cp), &cp); 772 m_adj(m, sizeof(cp)); 773 774 cp.scid = le16toh(cp.scid); 775 cp.dcid = le16toh(cp.dcid); 776 777 chan = l2cap_cid_lookup(cp.dcid); 778 if (chan == NULL || chan->lc_link != link || chan->lc_rcid != cp.scid) { 779 l2cap_send_command_rej(link, cmd.ident, L2CAP_REJ_INVALID_CID, 780 cp.dcid, cp.scid); 781 return; 782 } 783 784 rp.dcid = htole16(chan->lc_lcid); 785 rp.scid = htole16(chan->lc_rcid); 786 l2cap_send_signal(link, L2CAP_DISCONNECT_RSP, cmd.ident, 787 sizeof(rp), &rp); 788 789 if (chan->lc_state != L2CAP_CLOSED) 790 l2cap_close(chan, ECONNRESET); 791 } 792 793 /* 794 * Process Received Disconnect Response. We must validate scid and dcid but 795 * unless we were waiting for this signal, ignore it. 796 */ 797 static void 798 l2cap_recv_disconnect_rsp(struct mbuf *m, struct hci_link *link) 799 { 800 l2cap_cmd_hdr_t cmd; 801 l2cap_discon_rsp_cp cp; 802 struct l2cap_req *req; 803 struct l2cap_channel *chan; 804 805 m_copydata(m, 0, sizeof(cmd), &cmd); 806 m_adj(m, sizeof(cmd)); 807 808 m_copydata(m, 0, sizeof(cp), &cp); 809 m_adj(m, sizeof(cp)); 810 811 cp.scid = le16toh(cp.scid); 812 cp.dcid = le16toh(cp.dcid); 813 814 req = l2cap_request_lookup(link, cmd.ident); 815 if (req == NULL || req->lr_code != L2CAP_DISCONNECT_REQ) 816 return; 817 818 chan = req->lr_chan; 819 if (chan == NULL 820 || chan->lc_lcid != cp.scid 821 || chan->lc_rcid != cp.dcid) 822 return; 823 824 l2cap_request_free(req); 825 826 if (chan->lc_state != L2CAP_WAIT_DISCONNECT) 827 return; 828 829 l2cap_close(chan, 0); 830 } 831 832 /* 833 * Process Received Info Request. We must respond but alas dont 834 * support anything as yet so thats easy. 835 */ 836 static void 837 l2cap_recv_info_req(struct mbuf *m, struct hci_link *link) 838 { 839 l2cap_cmd_hdr_t cmd; 840 l2cap_info_req_cp cp; 841 l2cap_info_rsp_cp rp; 842 843 m_copydata(m, 0, sizeof(cmd), &cmd); 844 m_adj(m, sizeof(cmd)); 845 846 m_copydata(m, 0, sizeof(cp), &cp); 847 m_adj(m, sizeof(cp)); 848 849 switch(le16toh(cp.type)) { 850 case L2CAP_CONNLESS_MTU: 851 case L2CAP_EXTENDED_FEATURES: 852 default: 853 rp.type = cp.type; 854 rp.result = htole16(L2CAP_NOT_SUPPORTED); 855 856 l2cap_send_signal(link, L2CAP_INFO_RSP, cmd.ident, 857 sizeof(rp), &rp); 858 break; 859 } 860 } 861 862 /* 863 * Construct signal and wrap in C-Frame for link. 864 */ 865 static int 866 l2cap_send_signal(struct hci_link *link, uint8_t code, uint8_t ident, 867 uint16_t length, void *data) 868 { 869 struct mbuf *m; 870 l2cap_hdr_t *hdr; 871 l2cap_cmd_hdr_t *cmd; 872 873 #ifdef DIAGNOSTIC 874 if (link == NULL) 875 return ENETDOWN; 876 877 if (sizeof(l2cap_cmd_hdr_t) + length > link->hl_mtu) 878 printf("(%s) exceeding L2CAP Signal MTU for link!\n", 879 link->hl_unit->hci_devname); 880 #endif 881 882 m = m_gethdr(M_DONTWAIT, MT_DATA); 883 if (m == NULL) 884 return ENOMEM; 885 886 hdr = mtod(m, l2cap_hdr_t *); 887 cmd = (l2cap_cmd_hdr_t *)(hdr + 1); 888 889 m->m_len = m->m_pkthdr.len = MHLEN; 890 891 /* Command Data */ 892 if (length > 0) 893 m_copyback(m, sizeof(hdr) + sizeof(cmd), length, data); 894 895 /* Command Header */ 896 cmd->code = code; 897 cmd->ident = ident; 898 cmd->length = htole16(length); 899 length += sizeof(cmd); 900 901 /* C-Frame Header */ 902 hdr->length = htole16(length); 903 hdr->dcid = htole16(L2CAP_SIGNAL_CID); 904 length += sizeof(hdr); 905 906 if (m->m_pkthdr.len != MAX(MHLEN, length)) { 907 m_freem(m); 908 return ENOMEM; 909 } 910 911 m->m_pkthdr.len = length; 912 m->m_len = MIN(length, MHLEN); 913 914 DPRINTFN(2, "(%s) code %d, ident %d, len %d\n", 915 link->hl_unit->hci_devname, code, ident, length); 916 917 return hci_acl_send(m, link, NULL); 918 } 919 920 /* 921 * Send Command Reject packet. 922 */ 923 static int 924 l2cap_send_command_rej(struct hci_link *link, uint8_t ident, 925 uint16_t reason, ...) 926 { 927 l2cap_cmd_rej_cp cp; 928 int len = 0; 929 va_list ap; 930 931 va_start(ap, reason); 932 933 cp.reason = htole16(reason); 934 935 switch (reason) { 936 case L2CAP_REJ_NOT_UNDERSTOOD: 937 len = 2; 938 break; 939 940 case L2CAP_REJ_MTU_EXCEEDED: 941 len = 4; 942 cp.data[0] = va_arg(ap, int); /* SigMTU */ 943 cp.data[0] = htole16(cp.data[0]); 944 break; 945 946 case L2CAP_REJ_INVALID_CID: 947 len = 6; 948 cp.data[0] = va_arg(ap, int); /* dcid */ 949 cp.data[0] = htole16(cp.data[0]); 950 cp.data[1] = va_arg(ap, int); /* scid */ 951 cp.data[1] = htole16(cp.data[1]); 952 break; 953 954 default: 955 UNKNOWN(reason); 956 return EINVAL; 957 } 958 959 va_end(ap); 960 961 return l2cap_send_signal(link, L2CAP_COMMAND_REJ, ident, len, &cp); 962 } 963 964 /* 965 * Send Connect Request 966 */ 967 int 968 l2cap_send_connect_req(struct l2cap_channel *chan) 969 { 970 l2cap_con_req_cp cp; 971 int err; 972 973 err = l2cap_request_alloc(chan, L2CAP_CONNECT_REQ); 974 if (err) 975 return err; 976 977 cp.psm = htole16(chan->lc_raddr.bt_psm); 978 cp.scid = htole16(chan->lc_lcid); 979 980 return l2cap_send_signal(chan->lc_link, L2CAP_CONNECT_REQ, 981 chan->lc_link->hl_lastid, sizeof(cp), &cp); 982 } 983 984 /* 985 * Send Config Request 986 * 987 * For outgoing config request, we only put options in the packet if they 988 * differ from the default and would have to be actioned. We dont support 989 * enough option types to make overflowing SigMTU an issue so it can all 990 * go in one packet. 991 */ 992 int 993 l2cap_send_config_req(struct l2cap_channel *chan) 994 { 995 l2cap_cfg_req_cp *cp; 996 l2cap_cfg_opt_t *opt; 997 l2cap_cfg_opt_val_t *val; 998 uint8_t *next, buf[L2CAP_MTU_MINIMUM]; 999 int err; 1000 1001 err = l2cap_request_alloc(chan, L2CAP_CONFIG_REQ); 1002 if (err) 1003 return err; 1004 1005 /* Config Header (4 octets) */ 1006 cp = (l2cap_cfg_req_cp *)buf; 1007 cp->dcid = htole16(chan->lc_rcid); 1008 cp->flags = 0; /* "No Continuation" */ 1009 1010 next = buf + sizeof(l2cap_cfg_req_cp); 1011 1012 /* Incoming MTU (4 octets) */ 1013 if (chan->lc_imtu != L2CAP_MTU_DEFAULT) { 1014 opt = (l2cap_cfg_opt_t *)next; 1015 opt->type = L2CAP_OPT_MTU; 1016 opt->length = L2CAP_OPT_MTU_SIZE; 1017 1018 val = (l2cap_cfg_opt_val_t *)(opt + 1); 1019 val->mtu = htole16(chan->lc_imtu); 1020 1021 next += sizeof(l2cap_cfg_opt_t) + L2CAP_OPT_MTU_SIZE; 1022 } 1023 1024 /* Flush Timeout (4 octets) */ 1025 if (chan->lc_flush != L2CAP_FLUSH_TIMO_DEFAULT) { 1026 opt = (l2cap_cfg_opt_t *)next; 1027 opt->type = L2CAP_OPT_FLUSH_TIMO; 1028 opt->length = L2CAP_OPT_FLUSH_TIMO_SIZE; 1029 1030 val = (l2cap_cfg_opt_val_t *)(opt + 1); 1031 val->flush_timo = htole16(chan->lc_flush); 1032 1033 next += sizeof(l2cap_cfg_opt_t) + L2CAP_OPT_FLUSH_TIMO_SIZE; 1034 } 1035 1036 /* Outgoing QoS Flow (24 octets) */ 1037 /* Retransmission & Flow Control (11 octets) */ 1038 /* 1039 * From here we need to start paying attention to SigMTU as we have 1040 * possibly overflowed the minimum supported.. 1041 */ 1042 1043 return l2cap_send_signal(chan->lc_link, L2CAP_CONFIG_REQ, 1044 chan->lc_link->hl_lastid, (int)(next - buf), buf); 1045 } 1046 1047 /* 1048 * Send Disconnect Request 1049 */ 1050 int 1051 l2cap_send_disconnect_req(struct l2cap_channel *chan) 1052 { 1053 l2cap_discon_req_cp cp; 1054 int err; 1055 1056 err = l2cap_request_alloc(chan, L2CAP_DISCONNECT_REQ); 1057 if (err) 1058 return err; 1059 1060 cp.dcid = htole16(chan->lc_rcid); 1061 cp.scid = htole16(chan->lc_lcid); 1062 1063 return l2cap_send_signal(chan->lc_link, L2CAP_DISCONNECT_REQ, 1064 chan->lc_link->hl_lastid, sizeof(cp), &cp); 1065 } 1066
Indexes created Thu Sep 25 16:09:42 GMT 2025