net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6
   7    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License version 2 as
  11    published by the Free Software Foundation;
  12
  13    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  14    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  15    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  16    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  17    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  18    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  19    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  20    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  21
  22    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  23    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  24    SOFTWARE IS DISCLAIMED.
  25 */
  26
  27 /* Bluetooth L2CAP sockets. */
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/l2cap.h>
  32
  33 static void l2cap_sock_timeout(unsigned long arg)
  34 {
  35         struct sock *sk = (struct sock *) arg;
  36         int reason;
  37
  38         BT_DBG("sock %p state %d", sk, sk->sk_state);
  39
  40         bh_lock_sock(sk);
  41
  42         if (sock_owned_by_user(sk)) {
  43                 /* sk is owned by user. Try again later */
  44                 l2cap_sock_set_timer(sk, HZ / 5);
  45                 bh_unlock_sock(sk);
  46                 sock_put(sk);
  47                 return;
  48         }
  49
  50         if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
  51                 reason = ECONNREFUSED;
  52         else if (sk->sk_state == BT_CONNECT &&
  53                                 l2cap_pi(sk)->sec_level != BT_SECURITY_SDP)
  54                 reason = ECONNREFUSED;
  55         else
  56                 reason = ETIMEDOUT;
  57
  58         __l2cap_sock_close(sk, reason);
  59
  60         bh_unlock_sock(sk);
  61
  62         l2cap_sock_kill(sk);
  63         sock_put(sk);
  64 }
  65
  66 static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
  67 {
  68         struct sock *sk;
  69         struct hlist_node *node;
  70         sk_for_each(sk, node, &l2cap_sk_list.head)
  71                 if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
  72                         goto found;
  73         sk = NULL;
  74 found:
  75         return sk;
  76 }
  77
  78 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  79 {
  80         struct sock *sk = sock->sk;
  81         struct sockaddr_l2 la;
  82         int len, err = 0;
  83
  84         BT_DBG("sk %p", sk);
  85
  86         if (!addr || addr->sa_family != AF_BLUETOOTH)
  87                 return -EINVAL;
  88
  89         memset(&la, 0, sizeof(la));
  90         len = min_t(unsigned int, sizeof(la), alen);
  91         memcpy(&la, addr, len);
  92
  93         if (la.l2_cid)
  94                 return -EINVAL;
  95
  96         lock_sock(sk);
  97
  98         if (sk->sk_state != BT_OPEN) {
  99                 err = -EBADFD;
 100                 goto done;
 101         }
 102
 103         if (la.l2_psm) {
 104                 __u16 psm = __le16_to_cpu(la.l2_psm);
 105
 106                 /* PSM must be odd and lsb of upper byte must be 0 */
 107                 if ((psm & 0x0101) != 0x0001) {
 108                         err = -EINVAL;
 109                         goto done;
 110                 }
 111
 112                 /* Restrict usage of well-known PSMs */
 113                 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
 114                         err = -EACCES;
 115                         goto done;
 116                 }
 117         }
 118
 119         write_lock_bh(&l2cap_sk_list.lock);
 120
 121         if (la.l2_psm && __l2cap_get_sock_by_addr(la.l2_psm, &la.l2_bdaddr)) {
 122                 err = -EADDRINUSE;
 123         } else {
 124                 /* Save source address */
 125                 bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
 126                 l2cap_pi(sk)->psm   = la.l2_psm;
 127                 l2cap_pi(sk)->sport = la.l2_psm;
 128                 sk->sk_state = BT_BOUND;
 129
 130                 if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
 131                                         __le16_to_cpu(la.l2_psm) == 0x0003)
 132                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 133         }
 134
 135         write_unlock_bh(&l2cap_sk_list.lock);
 136
 137 done:
 138         release_sock(sk);
 139         return err;
 140 }
 141
 142 static int l2cap_sock_listen(struct socket *sock, int backlog)
 143 {
 144         struct sock *sk = sock->sk;
 145         int err = 0;
 146
 147         BT_DBG("sk %p backlog %d", sk, backlog);
 148
 149         lock_sock(sk);
 150
 151         if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
 152                         || sk->sk_state != BT_BOUND) {
 153                 err = -EBADFD;
 154                 goto done;
 155         }
 156
 157         switch (l2cap_pi(sk)->mode) {
 158         case L2CAP_MODE_BASIC:
 159                 break;
 160         case L2CAP_MODE_ERTM:
 161         case L2CAP_MODE_STREAMING:
 162                 if (!disable_ertm)
 163                         break;
 164                 /* fall through */
 165         default:
 166                 err = -ENOTSUPP;
 167                 goto done;
 168         }
 169
 170         if (!l2cap_pi(sk)->psm) {
 171                 bdaddr_t *src = &bt_sk(sk)->src;
 172                 u16 psm;
 173
 174                 err = -EINVAL;
 175
 176                 write_lock_bh(&l2cap_sk_list.lock);
 177
 178                 for (psm = 0x1001; psm < 0x1100; psm += 2)
 179                         if (!__l2cap_get_sock_by_addr(cpu_to_le16(psm), src)) {
 180                                 l2cap_pi(sk)->psm   = cpu_to_le16(psm);
 181                                 l2cap_pi(sk)->sport = cpu_to_le16(psm);
 182                                 err = 0;
 183                                 break;
 184                         }
 185
 186                 write_unlock_bh(&l2cap_sk_list.lock);
 187
 188                 if (err < 0)
 189                         goto done;
 190         }
 191
 192         sk->sk_max_ack_backlog = backlog;
 193         sk->sk_ack_backlog = 0;
 194         sk->sk_state = BT_LISTEN;
 195
 196 done:
 197         release_sock(sk);
 198         return err;
 199 }
 200
 201 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 202 {
 203         DECLARE_WAITQUEUE(wait, current);
 204         struct sock *sk = sock->sk, *nsk;
 205         long timeo;
 206         int err = 0;
 207
 208         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 209
 210         if (sk->sk_state != BT_LISTEN) {
 211                 err = -EBADFD;
 212                 goto done;
 213         }
 214
 215         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 216
 217         BT_DBG("sk %p timeo %ld", sk, timeo);
 218
 219         /* Wait for an incoming connection. (wake-one). */
 220         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 221         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
 222                 set_current_state(TASK_INTERRUPTIBLE);
 223                 if (!timeo) {
 224                         err = -EAGAIN;
 225                         break;
 226                 }
 227
 228                 release_sock(sk);
 229                 timeo = schedule_timeout(timeo);
 230                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 231
 232                 if (sk->sk_state != BT_LISTEN) {
 233                         err = -EBADFD;
 234                         break;
 235                 }
 236
 237                 if (signal_pending(current)) {
 238                         err = sock_intr_errno(timeo);
 239                         break;
 240                 }
 241         }
 242         set_current_state(TASK_RUNNING);
 243         remove_wait_queue(sk_sleep(sk), &wait);
 244
 245         if (err)
 246                 goto done;
 247
 248         newsock->state = SS_CONNECTED;
 249
 250         BT_DBG("new socket %p", nsk);
 251
 252 done:
 253         release_sock(sk);
 254         return err;
 255 }
 256
 257 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 258 {
 259         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 260         struct sock *sk = sock->sk;
 261
 262         BT_DBG("sock %p, sk %p", sock, sk);
 263
 264         addr->sa_family = AF_BLUETOOTH;
 265         *len = sizeof(struct sockaddr_l2);
 266
 267         if (peer) {
 268                 la->l2_psm = l2cap_pi(sk)->psm;
 269                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
 270                 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->dcid);
 271         } else {
 272                 la->l2_psm = l2cap_pi(sk)->sport;
 273                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
 274                 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->scid);
 275         }
 276
 277         return 0;
 278 }
 279
 280 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 281 {
 282         struct sock *sk = sock->sk;
 283         struct l2cap_options opts;
 284         int len, err = 0;
 285         u32 opt;
 286
 287         BT_DBG("sk %p", sk);
 288
 289         lock_sock(sk);
 290
 291         switch (optname) {
 292         case L2CAP_OPTIONS:
 293                 if (sk->sk_state == BT_CONNECTED) {
 294                         err = -EINVAL;
 295                         break;
 296                 }
 297
 298                 opts.imtu     = l2cap_pi(sk)->imtu;
 299                 opts.omtu     = l2cap_pi(sk)->omtu;
 300                 opts.flush_to = l2cap_pi(sk)->flush_to;
 301                 opts.mode     = l2cap_pi(sk)->mode;
 302                 opts.fcs      = l2cap_pi(sk)->fcs;
 303                 opts.max_tx   = l2cap_pi(sk)->max_tx;
 304                 opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
 305
 306                 len = min_t(unsigned int, sizeof(opts), optlen);
 307                 if (copy_from_user((char *) &opts, optval, len)) {
 308                         err = -EFAULT;
 309                         break;
 310                 }
 311
 312                 if (opts.txwin_size > L2CAP_DEFAULT_TX_WINDOW) {
 313                         err = -EINVAL;
 314                         break;
 315                 }
 316
 317                 l2cap_pi(sk)->mode = opts.mode;
 318                 switch (l2cap_pi(sk)->mode) {
 319                 case L2CAP_MODE_BASIC:
 320                         l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_STATE2_DEVICE;
 321                         break;
 322                 case L2CAP_MODE_ERTM:
 323                 case L2CAP_MODE_STREAMING:
 324                         if (!disable_ertm)
 325                                 break;
 326                         /* fall through */
 327                 default:
 328                         err = -EINVAL;
 329                         break;
 330                 }
 331
 332                 l2cap_pi(sk)->imtu = opts.imtu;
 333                 l2cap_pi(sk)->omtu = opts.omtu;
 334                 l2cap_pi(sk)->fcs  = opts.fcs;
 335                 l2cap_pi(sk)->max_tx = opts.max_tx;
 336                 l2cap_pi(sk)->tx_win = (__u8)opts.txwin_size;
 337                 break;
 338
 339         case L2CAP_LM:
 340                 if (get_user(opt, (u32 __user *) optval)) {
 341                         err = -EFAULT;
 342                         break;
 343                 }
 344
 345                 if (opt & L2CAP_LM_AUTH)
 346                         l2cap_pi(sk)->sec_level = BT_SECURITY_LOW;
 347                 if (opt & L2CAP_LM_ENCRYPT)
 348                         l2cap_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 349                 if (opt & L2CAP_LM_SECURE)
 350                         l2cap_pi(sk)->sec_level = BT_SECURITY_HIGH;
 351
 352                 l2cap_pi(sk)->role_switch    = (opt & L2CAP_LM_MASTER);
 353                 l2cap_pi(sk)->force_reliable = (opt & L2CAP_LM_RELIABLE);
 354                 break;
 355
 356         default:
 357                 err = -ENOPROTOOPT;
 358                 break;
 359         }
 360
 361         release_sock(sk);
 362         return err;
 363 }
 364
 365 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 366 {
 367         struct sock *sk = sock->sk;
 368         struct bt_security sec;
 369         int len, err = 0;
 370         u32 opt;
 371
 372         BT_DBG("sk %p", sk);
 373
 374         if (level == SOL_L2CAP)
 375                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 376
 377         if (level != SOL_BLUETOOTH)
 378                 return -ENOPROTOOPT;
 379
 380         lock_sock(sk);
 381
 382         switch (optname) {
 383         case BT_SECURITY:
 384                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 385                                 && sk->sk_type != SOCK_RAW) {
 386                         err = -EINVAL;
 387                         break;
 388                 }
 389
 390                 sec.level = BT_SECURITY_LOW;
 391
 392                 len = min_t(unsigned int, sizeof(sec), optlen);
 393                 if (copy_from_user((char *) &sec, optval, len)) {
 394                         err = -EFAULT;
 395                         break;
 396                 }
 397
 398                 if (sec.level < BT_SECURITY_LOW ||
 399                                         sec.level > BT_SECURITY_HIGH) {
 400                         err = -EINVAL;
 401                         break;
 402                 }
 403
 404                 l2cap_pi(sk)->sec_level = sec.level;
 405                 break;
 406
 407         case BT_DEFER_SETUP:
 408                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 409                         err = -EINVAL;
 410                         break;
 411                 }
 412
 413                 if (get_user(opt, (u32 __user *) optval)) {
 414                         err = -EFAULT;
 415                         break;
 416                 }
 417
 418                 bt_sk(sk)->defer_setup = opt;
 419                 break;
 420
 421         case BT_FLUSHABLE:
 422                 if (get_user(opt, (u32 __user *) optval)) {
 423                         err = -EFAULT;
 424                         break;
 425                 }
 426
 427                 if (opt > BT_FLUSHABLE_ON) {
 428                         err = -EINVAL;
 429                         break;
 430                 }
 431
 432                 if (opt == BT_FLUSHABLE_OFF) {
 433                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 434                         /* proceed futher only when we have l2cap_conn and
 435                            No Flush support in the LM */
 436                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 437                                 err = -EINVAL;
 438                                 break;
 439                         }
 440                 }
 441
 442                 l2cap_pi(sk)->flushable = opt;
 443                 break;
 444
 445         default:
 446                 err = -ENOPROTOOPT;
 447                 break;
 448         }
 449
 450         release_sock(sk);
 451         return err;
 452 }
 453
 454 static int l2cap_sock_release(struct socket *sock)
 455 {
 456         struct sock *sk = sock->sk;
 457         int err;
 458
 459         BT_DBG("sock %p, sk %p", sock, sk);
 460
 461         if (!sk)
 462                 return 0;
 463
 464         err = l2cap_sock_shutdown(sock, 2);
 465
 466         sock_orphan(sk);
 467         l2cap_sock_kill(sk);
 468         return err;
 469 }
 470
 471 static void l2cap_sock_destruct(struct sock *sk)
 472 {
 473         BT_DBG("sk %p", sk);
 474
 475         skb_queue_purge(&sk->sk_receive_queue);
 476         skb_queue_purge(&sk->sk_write_queue);
 477 }
 478
 479 void l2cap_sock_init(struct sock *sk, struct sock *parent)
 480 {
 481         struct l2cap_pinfo *pi = l2cap_pi(sk);
 482
 483         BT_DBG("sk %p", sk);
 484
 485         if (parent) {
 486                 sk->sk_type = parent->sk_type;
 487                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 488
 489                 pi->imtu = l2cap_pi(parent)->imtu;
 490                 pi->omtu = l2cap_pi(parent)->omtu;
 491                 pi->conf_state = l2cap_pi(parent)->conf_state;
 492                 pi->mode = l2cap_pi(parent)->mode;
 493                 pi->fcs  = l2cap_pi(parent)->fcs;
 494                 pi->max_tx = l2cap_pi(parent)->max_tx;
 495                 pi->tx_win = l2cap_pi(parent)->tx_win;
 496                 pi->sec_level = l2cap_pi(parent)->sec_level;
 497                 pi->role_switch = l2cap_pi(parent)->role_switch;
 498                 pi->force_reliable = l2cap_pi(parent)->force_reliable;
 499                 pi->flushable = l2cap_pi(parent)->flushable;
 500         } else {
 501                 pi->imtu = L2CAP_DEFAULT_MTU;
 502                 pi->omtu = 0;
 503                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
 504                         pi->mode = L2CAP_MODE_ERTM;
 505                         pi->conf_state |= L2CAP_CONF_STATE2_DEVICE;
 506                 } else {
 507                         pi->mode = L2CAP_MODE_BASIC;
 508                 }
 509                 pi->max_tx = L2CAP_DEFAULT_MAX_TX;
 510                 pi->fcs  = L2CAP_FCS_CRC16;
 511                 pi->tx_win = L2CAP_DEFAULT_TX_WINDOW;
 512                 pi->sec_level = BT_SECURITY_LOW;
 513                 pi->role_switch = 0;
 514                 pi->force_reliable = 0;
 515                 pi->flushable = BT_FLUSHABLE_OFF;
 516         }
 517
 518         /* Default config options */
 519         pi->conf_len = 0;
 520         pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 521         skb_queue_head_init(TX_QUEUE(sk));
 522         skb_queue_head_init(SREJ_QUEUE(sk));
 523         skb_queue_head_init(BUSY_QUEUE(sk));
 524         INIT_LIST_HEAD(SREJ_LIST(sk));
 525 }
 526
 527 static struct proto l2cap_proto = {
 528         .name           = "L2CAP",
 529         .owner          = THIS_MODULE,
 530         .obj_size       = sizeof(struct l2cap_pinfo)
 531 };
 532
 533 struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 534 {
 535         struct sock *sk;
 536
 537         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
 538         if (!sk)
 539                 return NULL;
 540
 541         sock_init_data(sock, sk);
 542         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 543
 544         sk->sk_destruct = l2cap_sock_destruct;
 545         sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 546
 547         sock_reset_flag(sk, SOCK_ZAPPED);
 548
 549         sk->sk_protocol = proto;
 550         sk->sk_state = BT_OPEN;
 551
 552         setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
 553
 554         bt_sock_link(&l2cap_sk_list, sk);
 555         return sk;
 556 }
 557
 558 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
 559                              int kern)
 560 {
 561         struct sock *sk;
 562
 563         BT_DBG("sock %p", sock);
 564
 565         sock->state = SS_UNCONNECTED;
 566
 567         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
 568                         sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
 569                 return -ESOCKTNOSUPPORT;
 570
 571         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
 572                 return -EPERM;
 573
 574         sock->ops = &l2cap_sock_ops;
 575
 576         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 577         if (!sk)
 578                 return -ENOMEM;
 579
 580         l2cap_sock_init(sk, NULL);
 581         return 0;
 582 }
 583
 584 const struct proto_ops l2cap_sock_ops = {
 585         .family         = PF_BLUETOOTH,
 586         .owner          = THIS_MODULE,
 587         .release        = l2cap_sock_release,
 588         .bind           = l2cap_sock_bind,
 589         .connect        = l2cap_sock_connect,
 590         .listen         = l2cap_sock_listen,
 591         .accept         = l2cap_sock_accept,
 592         .getname        = l2cap_sock_getname,
 593         .sendmsg        = l2cap_sock_sendmsg,
 594         .recvmsg        = l2cap_sock_recvmsg,
 595         .poll           = bt_sock_poll,
 596         .ioctl          = bt_sock_ioctl,
 597         .mmap           = sock_no_mmap,
 598         .socketpair     = sock_no_socketpair,
 599         .shutdown       = l2cap_sock_shutdown,
 600         .setsockopt     = l2cap_sock_setsockopt,
 601         .getsockopt     = l2cap_sock_getsockopt
 602 };
 603
 604 static const struct net_proto_family l2cap_sock_family_ops = {
 605         .family = PF_BLUETOOTH,
 606         .owner  = THIS_MODULE,
 607         .create = l2cap_sock_create,
 608 };
 609
 610 int __init l2cap_init_sockets(void)
 611 {
 612        int err;
 613
 614        err = proto_register(&l2cap_proto, 0);
 615        if (err < 0)
 616                return err;
 617
 618        err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
 619        if (err < 0)
 620                goto error;
 621
 622        BT_INFO("L2CAP socket layer initialized");
 623
 624        return 0;
 625
 626 error:
 627        BT_ERR("L2CAP socket registration failed");
 628        proto_unregister(&l2cap_proto);
 629        return err;
 630 }
 631
 632 void l2cap_cleanup_sockets(void)
 633 {
 634        if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
 635                BT_ERR("L2CAP socket unregistration failed");
 636
 637        proto_unregister(&l2cap_proto);
 638 }