[Bluetooth] Enforce correct authentication requirements
[pandora-kernel.git] / net / bluetooth / hci_conn.c
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI connection handling. */
26
27 #include <linux/module.h>
28
29 #include <linux/types.h>
30 #include <linux/errno.h>
31 #include <linux/kernel.h>
32 #include <linux/slab.h>
33 #include <linux/poll.h>
34 #include <linux/fcntl.h>
35 #include <linux/init.h>
36 #include <linux/skbuff.h>
37 #include <linux/interrupt.h>
38 #include <linux/notifier.h>
39 #include <net/sock.h>
40
41 #include <asm/system.h>
42 #include <asm/uaccess.h>
43 #include <asm/unaligned.h>
44
45 #include <net/bluetooth/bluetooth.h>
46 #include <net/bluetooth/hci_core.h>
47
48 #ifndef CONFIG_BT_HCI_CORE_DEBUG
49 #undef  BT_DBG
50 #define BT_DBG(D...)
51 #endif
52
53 void hci_acl_connect(struct hci_conn *conn)
54 {
55         struct hci_dev *hdev = conn->hdev;
56         struct inquiry_entry *ie;
57         struct hci_cp_create_conn cp;
58
59         BT_DBG("%p", conn);
60
61         conn->state = BT_CONNECT;
62         conn->out = 1;
63
64         conn->link_mode = HCI_LM_MASTER;
65
66         conn->attempt++;
67
68         conn->link_policy = hdev->link_policy;
69
70         memset(&cp, 0, sizeof(cp));
71         bacpy(&cp.bdaddr, &conn->dst);
72         cp.pscan_rep_mode = 0x02;
73
74         if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
75                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
76                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
77                         cp.pscan_mode     = ie->data.pscan_mode;
78                         cp.clock_offset   = ie->data.clock_offset |
79                                                         cpu_to_le16(0x8000);
80                 }
81
82                 memcpy(conn->dev_class, ie->data.dev_class, 3);
83                 conn->ssp_mode = ie->data.ssp_mode;
84         }
85
86         cp.pkt_type = cpu_to_le16(conn->pkt_type);
87         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
88                 cp.role_switch = 0x01;
89         else
90                 cp.role_switch = 0x00;
91
92         hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
93 }
94
95 static void hci_acl_connect_cancel(struct hci_conn *conn)
96 {
97         struct hci_cp_create_conn_cancel cp;
98
99         BT_DBG("%p", conn);
100
101         if (conn->hdev->hci_ver < 2)
102                 return;
103
104         bacpy(&cp.bdaddr, &conn->dst);
105         hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
106 }
107
108 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
109 {
110         struct hci_cp_disconnect cp;
111
112         BT_DBG("%p", conn);
113
114         conn->state = BT_DISCONN;
115
116         cp.handle = cpu_to_le16(conn->handle);
117         cp.reason = reason;
118         hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
119 }
120
121 void hci_add_sco(struct hci_conn *conn, __u16 handle)
122 {
123         struct hci_dev *hdev = conn->hdev;
124         struct hci_cp_add_sco cp;
125
126         BT_DBG("%p", conn);
127
128         conn->state = BT_CONNECT;
129         conn->out = 1;
130
131         cp.handle   = cpu_to_le16(handle);
132         cp.pkt_type = cpu_to_le16(conn->pkt_type);
133
134         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
135 }
136
137 void hci_setup_sync(struct hci_conn *conn, __u16 handle)
138 {
139         struct hci_dev *hdev = conn->hdev;
140         struct hci_cp_setup_sync_conn cp;
141
142         BT_DBG("%p", conn);
143
144         conn->state = BT_CONNECT;
145         conn->out = 1;
146
147         cp.handle   = cpu_to_le16(handle);
148         cp.pkt_type = cpu_to_le16(conn->pkt_type);
149
150         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
151         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
152         cp.max_latency    = cpu_to_le16(0xffff);
153         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
154         cp.retrans_effort = 0xff;
155
156         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
157 }
158
159 static void hci_conn_timeout(unsigned long arg)
160 {
161         struct hci_conn *conn = (void *) arg;
162         struct hci_dev *hdev = conn->hdev;
163
164         BT_DBG("conn %p state %d", conn, conn->state);
165
166         if (atomic_read(&conn->refcnt))
167                 return;
168
169         hci_dev_lock(hdev);
170
171         switch (conn->state) {
172         case BT_CONNECT:
173         case BT_CONNECT2:
174                 if (conn->type == ACL_LINK)
175                         hci_acl_connect_cancel(conn);
176                 else
177                         hci_acl_disconn(conn, 0x13);
178                 break;
179         case BT_CONFIG:
180         case BT_CONNECTED:
181                 hci_acl_disconn(conn, 0x13);
182                 break;
183         default:
184                 conn->state = BT_CLOSED;
185                 break;
186         }
187
188         hci_dev_unlock(hdev);
189 }
190
191 static void hci_conn_idle(unsigned long arg)
192 {
193         struct hci_conn *conn = (void *) arg;
194
195         BT_DBG("conn %p mode %d", conn, conn->mode);
196
197         hci_conn_enter_sniff_mode(conn);
198 }
199
200 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
201 {
202         struct hci_conn *conn;
203
204         BT_DBG("%s dst %s", hdev->name, batostr(dst));
205
206         conn = kzalloc(sizeof(struct hci_conn), GFP_ATOMIC);
207         if (!conn)
208                 return NULL;
209
210         bacpy(&conn->dst, dst);
211         conn->hdev  = hdev;
212         conn->type  = type;
213         conn->mode  = HCI_CM_ACTIVE;
214         conn->state = BT_OPEN;
215
216         conn->power_save = 1;
217
218         switch (type) {
219         case ACL_LINK:
220                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
221                 break;
222         case SCO_LINK:
223                 if (lmp_esco_capable(hdev))
224                         conn->pkt_type = hdev->esco_type & SCO_ESCO_MASK;
225                 else
226                         conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK;
227                 break;
228         case ESCO_LINK:
229                 conn->pkt_type = hdev->esco_type;
230                 break;
231         }
232
233         skb_queue_head_init(&conn->data_q);
234
235         setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
236         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
237
238         atomic_set(&conn->refcnt, 0);
239
240         hci_dev_hold(hdev);
241
242         tasklet_disable(&hdev->tx_task);
243
244         hci_conn_hash_add(hdev, conn);
245         if (hdev->notify)
246                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
247
248         tasklet_enable(&hdev->tx_task);
249
250         return conn;
251 }
252
253 int hci_conn_del(struct hci_conn *conn)
254 {
255         struct hci_dev *hdev = conn->hdev;
256
257         BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
258
259         del_timer(&conn->idle_timer);
260
261         del_timer(&conn->disc_timer);
262
263         if (conn->type == ACL_LINK) {
264                 struct hci_conn *sco = conn->link;
265                 if (sco)
266                         sco->link = NULL;
267
268                 /* Unacked frames */
269                 hdev->acl_cnt += conn->sent;
270         } else {
271                 struct hci_conn *acl = conn->link;
272                 if (acl) {
273                         acl->link = NULL;
274                         hci_conn_put(acl);
275                 }
276         }
277
278         tasklet_disable(&hdev->tx_task);
279
280         hci_conn_hash_del(hdev, conn);
281         if (hdev->notify)
282                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
283
284         tasklet_enable(&hdev->tx_task);
285
286         skb_queue_purge(&conn->data_q);
287
288         return 0;
289 }
290
291 struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
292 {
293         int use_src = bacmp(src, BDADDR_ANY);
294         struct hci_dev *hdev = NULL;
295         struct list_head *p;
296
297         BT_DBG("%s -> %s", batostr(src), batostr(dst));
298
299         read_lock_bh(&hci_dev_list_lock);
300
301         list_for_each(p, &hci_dev_list) {
302                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
303
304                 if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
305                         continue;
306
307                 /* Simple routing:
308                  *   No source address - find interface with bdaddr != dst
309                  *   Source address    - find interface with bdaddr == src
310                  */
311
312                 if (use_src) {
313                         if (!bacmp(&d->bdaddr, src)) {
314                                 hdev = d; break;
315                         }
316                 } else {
317                         if (bacmp(&d->bdaddr, dst)) {
318                                 hdev = d; break;
319                         }
320                 }
321         }
322
323         if (hdev)
324                 hdev = hci_dev_hold(hdev);
325
326         read_unlock_bh(&hci_dev_list_lock);
327         return hdev;
328 }
329 EXPORT_SYMBOL(hci_get_route);
330
331 /* Create SCO or ACL connection.
332  * Device _must_ be locked */
333 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 auth_type)
334 {
335         struct hci_conn *acl;
336         struct hci_conn *sco;
337
338         BT_DBG("%s dst %s", hdev->name, batostr(dst));
339
340         if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
341                 if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
342                         return NULL;
343         }
344
345         hci_conn_hold(acl);
346
347         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
348                 acl->auth_type = auth_type;
349                 hci_acl_connect(acl);
350         }
351
352         if (type == ACL_LINK)
353                 return acl;
354
355         if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
356                 if (!(sco = hci_conn_add(hdev, type, dst))) {
357                         hci_conn_put(acl);
358                         return NULL;
359                 }
360         }
361
362         acl->link = sco;
363         sco->link = acl;
364
365         hci_conn_hold(sco);
366
367         if (acl->state == BT_CONNECTED &&
368                         (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
369                 if (lmp_esco_capable(hdev))
370                         hci_setup_sync(sco, acl->handle);
371                 else
372                         hci_add_sco(sco, acl->handle);
373         }
374
375         return sco;
376 }
377 EXPORT_SYMBOL(hci_connect);
378
379 /* Authenticate remote device */
380 int hci_conn_auth(struct hci_conn *conn)
381 {
382         BT_DBG("conn %p", conn);
383
384         if (conn->ssp_mode > 0 && conn->hdev->ssp_mode > 0) {
385                 if (!(conn->auth_type & 0x01)) {
386                         conn->auth_type |= 0x01;
387                         conn->link_mode &= ~HCI_LM_AUTH;
388                 }
389         }
390
391         if (conn->link_mode & HCI_LM_AUTH)
392                 return 1;
393
394         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
395                 struct hci_cp_auth_requested cp;
396                 cp.handle = cpu_to_le16(conn->handle);
397                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
398                                                         sizeof(cp), &cp);
399         }
400         return 0;
401 }
402 EXPORT_SYMBOL(hci_conn_auth);
403
404 /* Enable encryption */
405 int hci_conn_encrypt(struct hci_conn *conn)
406 {
407         BT_DBG("conn %p", conn);
408
409         if (conn->link_mode & HCI_LM_ENCRYPT)
410                 return hci_conn_auth(conn);
411
412         if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
413                 return 0;
414
415         if (hci_conn_auth(conn)) {
416                 struct hci_cp_set_conn_encrypt cp;
417                 cp.handle  = cpu_to_le16(conn->handle);
418                 cp.encrypt = 1;
419                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
420                                                         sizeof(cp), &cp);
421         }
422         return 0;
423 }
424 EXPORT_SYMBOL(hci_conn_encrypt);
425
426 /* Change link key */
427 int hci_conn_change_link_key(struct hci_conn *conn)
428 {
429         BT_DBG("conn %p", conn);
430
431         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
432                 struct hci_cp_change_conn_link_key cp;
433                 cp.handle = cpu_to_le16(conn->handle);
434                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
435                                                         sizeof(cp), &cp);
436         }
437         return 0;
438 }
439 EXPORT_SYMBOL(hci_conn_change_link_key);
440
441 /* Switch role */
442 int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
443 {
444         BT_DBG("conn %p", conn);
445
446         if (!role && conn->link_mode & HCI_LM_MASTER)
447                 return 1;
448
449         if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
450                 struct hci_cp_switch_role cp;
451                 bacpy(&cp.bdaddr, &conn->dst);
452                 cp.role = role;
453                 hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
454         }
455         return 0;
456 }
457 EXPORT_SYMBOL(hci_conn_switch_role);
458
459 /* Enter active mode */
460 void hci_conn_enter_active_mode(struct hci_conn *conn)
461 {
462         struct hci_dev *hdev = conn->hdev;
463
464         BT_DBG("conn %p mode %d", conn, conn->mode);
465
466         if (test_bit(HCI_RAW, &hdev->flags))
467                 return;
468
469         if (conn->mode != HCI_CM_SNIFF || !conn->power_save)
470                 goto timer;
471
472         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
473                 struct hci_cp_exit_sniff_mode cp;
474                 cp.handle = cpu_to_le16(conn->handle);
475                 hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
476         }
477
478 timer:
479         if (hdev->idle_timeout > 0)
480                 mod_timer(&conn->idle_timer,
481                         jiffies + msecs_to_jiffies(hdev->idle_timeout));
482 }
483
484 /* Enter sniff mode */
485 void hci_conn_enter_sniff_mode(struct hci_conn *conn)
486 {
487         struct hci_dev *hdev = conn->hdev;
488
489         BT_DBG("conn %p mode %d", conn, conn->mode);
490
491         if (test_bit(HCI_RAW, &hdev->flags))
492                 return;
493
494         if (!lmp_sniff_capable(hdev) || !lmp_sniff_capable(conn))
495                 return;
496
497         if (conn->mode != HCI_CM_ACTIVE || !(conn->link_policy & HCI_LP_SNIFF))
498                 return;
499
500         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
501                 struct hci_cp_sniff_subrate cp;
502                 cp.handle             = cpu_to_le16(conn->handle);
503                 cp.max_latency        = cpu_to_le16(0);
504                 cp.min_remote_timeout = cpu_to_le16(0);
505                 cp.min_local_timeout  = cpu_to_le16(0);
506                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
507         }
508
509         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
510                 struct hci_cp_sniff_mode cp;
511                 cp.handle       = cpu_to_le16(conn->handle);
512                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
513                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
514                 cp.attempt      = cpu_to_le16(4);
515                 cp.timeout      = cpu_to_le16(1);
516                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
517         }
518 }
519
520 /* Drop all connection on the device */
521 void hci_conn_hash_flush(struct hci_dev *hdev)
522 {
523         struct hci_conn_hash *h = &hdev->conn_hash;
524         struct list_head *p;
525
526         BT_DBG("hdev %s", hdev->name);
527
528         p = h->list.next;
529         while (p != &h->list) {
530                 struct hci_conn *c;
531
532                 c = list_entry(p, struct hci_conn, list);
533                 p = p->next;
534
535                 c->state = BT_CLOSED;
536
537                 hci_conn_del_sysfs(c);
538
539                 hci_proto_disconn_ind(c, 0x16);
540                 hci_conn_del(c);
541         }
542 }
543
544 /* Check pending connect attempts */
545 void hci_conn_check_pending(struct hci_dev *hdev)
546 {
547         struct hci_conn *conn;
548
549         BT_DBG("hdev %s", hdev->name);
550
551         hci_dev_lock(hdev);
552
553         conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
554         if (conn)
555                 hci_acl_connect(conn);
556
557         hci_dev_unlock(hdev);
558 }
559
560 int hci_get_conn_list(void __user *arg)
561 {
562         struct hci_conn_list_req req, *cl;
563         struct hci_conn_info *ci;
564         struct hci_dev *hdev;
565         struct list_head *p;
566         int n = 0, size, err;
567
568         if (copy_from_user(&req, arg, sizeof(req)))
569                 return -EFAULT;
570
571         if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
572                 return -EINVAL;
573
574         size = sizeof(req) + req.conn_num * sizeof(*ci);
575
576         if (!(cl = kmalloc(size, GFP_KERNEL)))
577                 return -ENOMEM;
578
579         if (!(hdev = hci_dev_get(req.dev_id))) {
580                 kfree(cl);
581                 return -ENODEV;
582         }
583
584         ci = cl->conn_info;
585
586         hci_dev_lock_bh(hdev);
587         list_for_each(p, &hdev->conn_hash.list) {
588                 register struct hci_conn *c;
589                 c = list_entry(p, struct hci_conn, list);
590
591                 bacpy(&(ci + n)->bdaddr, &c->dst);
592                 (ci + n)->handle = c->handle;
593                 (ci + n)->type  = c->type;
594                 (ci + n)->out   = c->out;
595                 (ci + n)->state = c->state;
596                 (ci + n)->link_mode = c->link_mode;
597                 if (++n >= req.conn_num)
598                         break;
599         }
600         hci_dev_unlock_bh(hdev);
601
602         cl->dev_id = hdev->id;
603         cl->conn_num = n;
604         size = sizeof(req) + n * sizeof(*ci);
605
606         hci_dev_put(hdev);
607
608         err = copy_to_user(arg, cl, size);
609         kfree(cl);
610
611         return err ? -EFAULT : 0;
612 }
613
614 int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
615 {
616         struct hci_conn_info_req req;
617         struct hci_conn_info ci;
618         struct hci_conn *conn;
619         char __user *ptr = arg + sizeof(req);
620
621         if (copy_from_user(&req, arg, sizeof(req)))
622                 return -EFAULT;
623
624         hci_dev_lock_bh(hdev);
625         conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
626         if (conn) {
627                 bacpy(&ci.bdaddr, &conn->dst);
628                 ci.handle = conn->handle;
629                 ci.type  = conn->type;
630                 ci.out   = conn->out;
631                 ci.state = conn->state;
632                 ci.link_mode = conn->link_mode;
633         }
634         hci_dev_unlock_bh(hdev);
635
636         if (!conn)
637                 return -ENOENT;
638
639         return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
640 }
641
642 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg)
643 {
644         struct hci_auth_info_req req;
645         struct hci_conn *conn;
646
647         if (copy_from_user(&req, arg, sizeof(req)))
648                 return -EFAULT;
649
650         hci_dev_lock_bh(hdev);
651         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &req.bdaddr);
652         if (conn)
653                 req.type = conn->auth_type;
654         hci_dev_unlock_bh(hdev);
655
656         if (!conn)
657                 return -ENOENT;
658
659         return copy_to_user(arg, &req, sizeof(req)) ? -EFAULT : 0;
660 }