1 /*
2 *
3 * BlueZ - Bluetooth protocol stack for Linux
4 *
5 * Copyright (C) 2000-2001 Qualcomm Incorporated
6 * Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com>
7 * Copyright (C) 2002-2008 Marcel Holtmann <marcel@holtmann.org>
8 *
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23 *
24 */
25
26 #ifdef HAVE_CONFIG_H
27 #include <config.h>
28 #endif
29
30 #include <stdio.h>
31 #include <errno.h>
32 #include <ctype.h>
33 #include <fcntl.h>
34 #include <unistd.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <signal.h>
38 #include <time.h>
39 #include <sys/time.h>
40 #include <sys/param.h>
41 #include <sys/ioctl.h>
42 #include <sys/socket.h>
43
44 #include <bluetooth/bluetooth.h>
45 #include <bluetooth/hci.h>
46 #include <bluetooth/hci_lib.h>
47
48 #include <glib.h>
49
50 #include <dbus/dbus.h>
51
52 #include "hcid.h"
53 #include "textfile.h"
54 #include "adapter.h"
55 #include "dbus-hci.h"
56
57 struct g_io_info {
58 GIOChannel *channel;
59 int watch_id;
60 int pin_length;
61 };
62
63 static struct g_io_info io_data[HCI_MAX_DEV];
64
65 static int pairing = HCID_PAIRING_MULTI;
66
67 static GSList *hci_req_queue = NULL;
68
hci_req_data_new(int dev_id,const bdaddr_t * dba,uint16_t ogf,uint16_t ocf,int event,const void * cparam,int clen)69 struct hci_req_data *hci_req_data_new(int dev_id, const bdaddr_t *dba, uint16_t ogf, uint16_t ocf, int event, const void *cparam, int clen)
70 {
71 struct hci_req_data *data;
72
73 data = g_new0(struct hci_req_data, 1);
74
75 data->cparam = g_malloc(clen);
76 memcpy(data->cparam, cparam, clen);
77
78 bacpy(&data->dba, dba);
79
80 data->dev_id = dev_id;
81 data->status = REQ_PENDING;
82 data->ogf = ogf;
83 data->ocf = ocf;
84 data->event = event;
85 data->clen = clen;
86
87 return data;
88 }
89
hci_req_find_by_devid(const void * data,const void * user_data)90 static int hci_req_find_by_devid(const void *data, const void *user_data)
91 {
92 const struct hci_req_data *req = data;
93 const int *dev_id = user_data;
94
95 return (*dev_id - req->dev_id);
96 }
97
hci_req_queue_process(int dev_id)98 static void hci_req_queue_process(int dev_id)
99 {
100 int dd, ret_val;
101
102 /* send the next pending cmd */
103 dd = hci_open_dev(dev_id);
104 do {
105 struct hci_req_data *data;
106 GSList *l = g_slist_find_custom(hci_req_queue, &dev_id, hci_req_find_by_devid);
107
108 if (!l)
109 break;
110
111 data = l->data;
112 data->status = REQ_SENT;
113
114 ret_val = hci_send_cmd(dd, data->ogf, data->ocf, data->clen, data->cparam);
115 if (ret_val < 0) {
116 hci_req_queue = g_slist_remove(hci_req_queue, data);
117 g_free(data->cparam);
118 g_free(data);
119 }
120
121 } while(ret_val < 0);
122
123 hci_close_dev(dd);
124 }
125
hci_req_queue_append(struct hci_req_data * data)126 void hci_req_queue_append(struct hci_req_data *data)
127 {
128 GSList *l;
129 struct hci_req_data *match;
130
131
132 hci_req_queue = g_slist_append(hci_req_queue, data);
133
134 l = g_slist_find_custom(hci_req_queue, &data->dev_id, hci_req_find_by_devid);
135 match = l->data;
136
137 if (match->status == REQ_SENT)
138 return;
139
140 hci_req_queue_process(data->dev_id);
141 }
142
hci_req_queue_remove(int dev_id,bdaddr_t * dba)143 void hci_req_queue_remove(int dev_id, bdaddr_t *dba)
144 {
145 GSList *cur, *next;
146 struct hci_req_data *req;
147
148 for (cur = hci_req_queue; cur != NULL; cur = next) {
149 req = cur->data;
150 next = cur->next;
151 if ((req->dev_id != dev_id) || (bacmp(&req->dba, dba)))
152 continue;
153
154 hci_req_queue = g_slist_remove(hci_req_queue, req);
155 g_free(req->cparam);
156 g_free(req);
157 }
158 }
159
check_pending_hci_req(int dev_id,int event)160 static void check_pending_hci_req(int dev_id, int event)
161 {
162 struct hci_req_data *data;
163 GSList *l;
164
165 if (!hci_req_queue)
166 return;
167
168 /* find the first element(pending)*/
169 l = g_slist_find_custom(hci_req_queue, &dev_id, hci_req_find_by_devid);
170
171 if (!l)
172 return;
173
174 data = l->data;
175
176 /* skip if there is pending confirmation */
177 if (data->status == REQ_SENT) {
178 if (data->event != event)
179 return;
180
181 /* remove the confirmed cmd */
182 hci_req_queue = g_slist_remove(hci_req_queue, data);
183 g_free(data->cparam);
184 g_free(data);
185 }
186
187 hci_req_queue_process(dev_id);
188 }
189
get_handle(int dev,bdaddr_t * sba,bdaddr_t * dba,uint16_t * handle)190 static int get_handle(int dev, bdaddr_t *sba, bdaddr_t *dba, uint16_t *handle)
191 {
192 struct hci_conn_list_req *cl;
193 struct hci_conn_info *ci;
194 char addr[18];
195 int i;
196
197 cl = g_malloc0(10 * sizeof(*ci) + sizeof(*cl));
198
199 ba2str(sba, addr);
200 cl->dev_id = hci_devid(addr);
201 cl->conn_num = 10;
202 ci = cl->conn_info;
203
204 if (ioctl(dev, HCIGETCONNLIST, (void *) cl) < 0) {
205 g_free(cl);
206 return -EIO;
207 }
208
209 for (i = 0; i < cl->conn_num; i++, ci++) {
210 if (bacmp(&ci->bdaddr, dba) == 0) {
211 *handle = ci->handle;
212 g_free(cl);
213 return 0;
214 }
215 }
216
217 g_free(cl);
218
219 return -ENOENT;
220 }
221
get_bdaddr(int dev,bdaddr_t * sba,uint16_t handle,bdaddr_t * dba)222 static inline int get_bdaddr(int dev, bdaddr_t *sba, uint16_t handle, bdaddr_t *dba)
223 {
224 struct hci_conn_list_req *cl;
225 struct hci_conn_info *ci;
226 char addr[18];
227 int i;
228
229 cl = g_malloc0(10 * sizeof(*ci) + sizeof(*cl));
230
231 ba2str(sba, addr);
232 cl->dev_id = hci_devid(addr);
233 cl->conn_num = 10;
234 ci = cl->conn_info;
235
236 if (ioctl(dev, HCIGETCONNLIST, (void *) cl) < 0) {
237 g_free(cl);
238 return -EIO;
239 }
240
241 for (i = 0; i < cl->conn_num; i++, ci++)
242 if (ci->handle == handle) {
243 bacpy(dba, &ci->bdaddr);
244 g_free(cl);
245 return 0;
246 }
247
248 g_free(cl);
249
250 return -ENOENT;
251 }
252
update_lastseen(bdaddr_t * sba,bdaddr_t * dba)253 static inline void update_lastseen(bdaddr_t *sba, bdaddr_t *dba)
254 {
255 time_t t;
256 struct tm *tm;
257
258 t = time(NULL);
259 tm = gmtime(&t);
260
261 write_lastseen_info(sba, dba, tm);
262 }
263
update_lastused(bdaddr_t * sba,bdaddr_t * dba)264 static inline void update_lastused(bdaddr_t *sba, bdaddr_t *dba)
265 {
266 time_t t;
267 struct tm *tm;
268
269 t = time(NULL);
270 tm = gmtime(&t);
271
272 write_lastused_info(sba, dba, tm);
273 }
274
275 /* Link Key handling */
276
link_key_request(int dev,bdaddr_t * sba,bdaddr_t * dba)277 static void link_key_request(int dev, bdaddr_t *sba, bdaddr_t *dba)
278 {
279 struct hci_auth_info_req req;
280 unsigned char key[16];
281 char sa[18], da[18];
282 uint8_t type;
283 int err;
284
285 ba2str(sba, sa); ba2str(dba, da);
286 info("link_key_request (sba=%s, dba=%s)", sa, da);
287
288 memset(&req, 0, sizeof(req));
289 bacpy(&req.bdaddr, dba);
290
291 err = ioctl(dev, HCIGETAUTHINFO, (unsigned long) &req);
292 if (err < 0 && errno != EINVAL)
293 debug("HCIGETAUTHINFO failed %s (%d)",
294 strerror(errno), errno);
295 else
296 req.type = 0x00;
297
298 debug("kernel auth requirements = 0x%02x", req.type);
299
300 err = read_link_key(sba, dba, key, &type);
301 if (err < 0) {
302 /* Link key not found */
303 hci_send_cmd(dev, OGF_LINK_CTL, OCF_LINK_KEY_NEG_REPLY, 6, dba);
304 } else {
305 /* Link key found */
306 link_key_reply_cp lr;
307 memcpy(lr.link_key, key, 16);
308 bacpy(&lr.bdaddr, dba);
309
310 debug("stored link key type = 0x%02x", type);
311
312 if ((type == 0x03 || type == 0x04) && (req.type & 0x01))
313 hci_send_cmd(dev, OGF_LINK_CTL,
314 OCF_LINK_KEY_NEG_REPLY, 6, dba);
315 else
316 hci_send_cmd(dev, OGF_LINK_CTL, OCF_LINK_KEY_REPLY,
317 LINK_KEY_REPLY_CP_SIZE, &lr);
318 }
319 }
320
link_key_notify(int dev,bdaddr_t * sba,void * ptr)321 static void link_key_notify(int dev, bdaddr_t *sba, void *ptr)
322 {
323 evt_link_key_notify *evt = ptr;
324 bdaddr_t *dba = &evt->bdaddr;
325 char sa[18], da[18];
326 int dev_id, err;
327
328 ba2str(sba, sa); ba2str(dba, da);
329 info("link_key_notify (sba=%s, dba=%s)", sa, da);
330
331 dev_id = hci_devid(sa);
332
333 err = write_link_key(sba, dba, evt->link_key, evt->key_type,
334 io_data[dev_id].pin_length);
335 if (err < 0) {
336 uint16_t handle;
337
338 error("write_link_key: %s (%d)", strerror(-err), -err);
339
340 hcid_dbus_bonding_process_complete(sba, dba, HCI_MEMORY_FULL);
341
342 if (get_handle(dev, sba, dba, &handle) == 0) {
343 disconnect_cp cp;
344
345 memset(&cp, 0, sizeof(cp));
346 cp.handle = htobs(handle);
347 cp.reason = HCI_OE_LOW_RESOURCES;
348
349 hci_send_cmd(dev, OGF_LINK_CTL, OCF_DISCONNECT,
350 DISCONNECT_CP_SIZE, &cp);
351 }
352 } else
353 hcid_dbus_bonding_process_complete(sba, dba, 0);
354
355 io_data[dev_id].pin_length = -1;
356 }
357
return_link_keys(int dev,bdaddr_t * sba,void * ptr)358 static void return_link_keys(int dev, bdaddr_t *sba, void *ptr)
359 {
360 evt_return_link_keys *evt = ptr;
361 uint8_t num = evt->num_keys;
362 unsigned char key[16];
363 char sa[18], da[18];
364 bdaddr_t dba;
365 int i;
366
367 ba2str(sba, sa);
368 ptr++;
369
370 for (i = 0; i < num; i++) {
371 bacpy(&dba, ptr); ba2str(&dba, da);
372 memcpy(key, ptr + 6, 16);
373
374 info("return_link_keys (sba=%s, dba=%s)", sa, da);
375
376 ptr += 22;
377 }
378 }
379
380 /* Simple Pairing handling */
381
user_confirm_request(int dev,bdaddr_t * sba,void * ptr)382 static void user_confirm_request(int dev, bdaddr_t *sba, void *ptr)
383 {
384 evt_user_confirm_request *req = ptr;
385
386 if (hcid_dbus_user_confirm(sba, &req->bdaddr,
387 btohl(req->passkey)) < 0)
388 hci_send_cmd(dev, OGF_LINK_CTL,
389 OCF_USER_CONFIRM_NEG_REPLY, 6, ptr);
390 }
391
user_passkey_request(int dev,bdaddr_t * sba,void * ptr)392 static void user_passkey_request(int dev, bdaddr_t *sba, void *ptr)
393 {
394 evt_user_passkey_request *req = ptr;
395
396 if (hcid_dbus_user_passkey(sba, &req->bdaddr) < 0)
397 hci_send_cmd(dev, OGF_LINK_CTL,
398 OCF_USER_PASSKEY_NEG_REPLY, 6, ptr);
399 }
400
user_passkey_notify(int dev,bdaddr_t * sba,void * ptr)401 static void user_passkey_notify(int dev, bdaddr_t *sba, void *ptr)
402 {
403 evt_user_passkey_notify *req = ptr;
404
405 hcid_dbus_user_notify(sba, &req->bdaddr, btohl(req->passkey));
406 }
407
remote_oob_data_request(int dev,bdaddr_t * sba,void * ptr)408 static void remote_oob_data_request(int dev, bdaddr_t *sba, void *ptr)
409 {
410 hci_send_cmd(dev, OGF_LINK_CTL, OCF_REMOTE_OOB_DATA_NEG_REPLY, 6, ptr);
411 }
412
io_capa_request(int dev,bdaddr_t * sba,bdaddr_t * dba)413 static void io_capa_request(int dev, bdaddr_t *sba, bdaddr_t *dba)
414 {
415 char sa[18], da[18];
416 uint8_t cap, auth;
417
418 ba2str(sba, sa); ba2str(dba, da);
419 info("io_capa_request (sba=%s, dba=%s)", sa, da);
420
421 if (hcid_dbus_get_io_cap(sba, dba, &cap, &auth) < 0) {
422 io_capability_neg_reply_cp cp;
423 memset(&cp, 0, sizeof(cp));
424 bacpy(&cp.bdaddr, dba);
425 cp.reason = HCI_PAIRING_NOT_ALLOWED;
426 hci_send_cmd(dev, OGF_LINK_CTL, OCF_IO_CAPABILITY_NEG_REPLY,
427 IO_CAPABILITY_NEG_REPLY_CP_SIZE, &cp);
428 } else {
429 io_capability_reply_cp cp;
430 memset(&cp, 0, sizeof(cp));
431 bacpy(&cp.bdaddr, dba);
432 cp.capability = cap;
433 cp.oob_data = 0x00;
434 cp.authentication = auth;
435 hci_send_cmd(dev, OGF_LINK_CTL, OCF_IO_CAPABILITY_REPLY,
436 IO_CAPABILITY_REPLY_CP_SIZE, &cp);
437 }
438 }
439
io_capa_response(int dev,bdaddr_t * sba,void * ptr)440 static void io_capa_response(int dev, bdaddr_t *sba, void *ptr)
441 {
442 evt_io_capability_response *evt = ptr;
443 char sa[18], da[18];
444
445 ba2str(sba, sa); ba2str(&evt->bdaddr, da);
446 info("io_capa_response (sba=%s, dba=%s)", sa, da);
447
448 hcid_dbus_set_io_cap(sba, &evt->bdaddr,
449 evt->capability, evt->authentication);
450 }
451
452 /* PIN code handling */
453
set_pin_length(bdaddr_t * sba,int length)454 void set_pin_length(bdaddr_t *sba, int length)
455 {
456 char addr[18];
457 int dev_id;
458
459 ba2str(sba, addr);
460 dev_id = hci_devid(addr);
461
462 io_data[dev_id].pin_length = length;
463 }
464
pin_code_request(int dev,bdaddr_t * sba,bdaddr_t * dba)465 static void pin_code_request(int dev, bdaddr_t *sba, bdaddr_t *dba)
466 {
467 pin_code_reply_cp pr;
468 struct hci_conn_info_req *cr;
469 struct hci_conn_info *ci;
470 unsigned char key[16];
471 char sa[18], da[18], pin[17];
472 int err, pinlen;
473
474 memset(&pr, 0, sizeof(pr));
475 bacpy(&pr.bdaddr, dba);
476
477 ba2str(sba, sa); ba2str(dba, da);
478 info("pin_code_request (sba=%s, dba=%s)", sa, da);
479
480 cr = g_malloc0(sizeof(*cr) + sizeof(*ci));
481
482 bacpy(&cr->bdaddr, dba);
483 cr->type = ACL_LINK;
484 if (ioctl(dev, HCIGETCONNINFO, (unsigned long) cr) < 0) {
485 error("Can't get conn info: %s (%d)", strerror(errno), errno);
486 goto reject;
487 }
488 ci = cr->conn_info;
489
490 memset(pin, 0, sizeof(pin));
491 pinlen = read_pin_code(sba, dba, pin);
492
493 if (pairing == HCID_PAIRING_ONCE) {
494 err = read_link_key(sba, dba, key, NULL);
495 if (!err) {
496 ba2str(dba, da);
497 error("PIN code request for already paired device %s", da);
498 goto reject;
499 }
500 } else if (pairing == HCID_PAIRING_NONE)
501 goto reject;
502
503 if (hcid.security == HCID_SEC_AUTO && !ci->out) {
504 set_pin_length(sba, hcid.pin_len);
505 memcpy(pr.pin_code, hcid.pin_code, hcid.pin_len);
506 pr.pin_len = hcid.pin_len;
507 hci_send_cmd(dev, OGF_LINK_CTL, OCF_PIN_CODE_REPLY,
508 PIN_CODE_REPLY_CP_SIZE, &pr);
509 } else {
510 if (pinlen > 0) {
511 set_pin_length(sba, pinlen);
512 memcpy(pr.pin_code, pin, pinlen);
513 pr.pin_len = pinlen;
514 hci_send_cmd(dev, OGF_LINK_CTL, OCF_PIN_CODE_REPLY,
515 PIN_CODE_REPLY_CP_SIZE, &pr);
516 } else {
517 /* Request PIN from passkey agent */
518 if (hcid_dbus_request_pin(dev, sba, ci) < 0)
519 goto reject;
520 }
521 }
522
523 g_free(cr);
524
525 return;
526
527 reject:
528 g_free(cr);
529
530 hci_send_cmd(dev, OGF_LINK_CTL, OCF_PIN_CODE_NEG_REPLY, 6, dba);
531 }
532
cmd_status(int dev,bdaddr_t * sba,void * ptr)533 static inline void cmd_status(int dev, bdaddr_t *sba, void *ptr)
534 {
535 evt_cmd_status *evt = ptr;
536 uint16_t opcode = btohs(evt->opcode);
537
538 if (evt->status)
539 return;
540
541 if (opcode == cmd_opcode_pack(OGF_LINK_CTL, OCF_INQUIRY))
542 hcid_dbus_inquiry_start(sba);
543 }
544
cmd_complete(int dev,bdaddr_t * sba,void * ptr)545 static inline void cmd_complete(int dev, bdaddr_t *sba, void *ptr)
546 {
547 evt_cmd_complete *evt = ptr;
548 uint16_t opcode = btohs(evt->opcode);
549 uint8_t status;
550
551 switch (opcode) {
552 case cmd_opcode_pack(OGF_LINK_CTL, OCF_PERIODIC_INQUIRY):
553 status = *((uint8_t *) ptr + EVT_CMD_COMPLETE_SIZE);
554 hcid_dbus_periodic_inquiry_start(sba, status);
555 break;
556 case cmd_opcode_pack(OGF_LINK_CTL, OCF_EXIT_PERIODIC_INQUIRY):
557 status = *((uint8_t *) ptr + EVT_CMD_COMPLETE_SIZE);
558 hcid_dbus_periodic_inquiry_exit(sba, status);
559 break;
560 case cmd_opcode_pack(OGF_LINK_CTL, OCF_INQUIRY_CANCEL):
561 hcid_dbus_inquiry_complete(sba);
562 break;
563 case cmd_opcode_pack(OGF_HOST_CTL, OCF_CHANGE_LOCAL_NAME):
564 hcid_dbus_setname_complete(sba);
565 break;
566 case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE):
567 hcid_dbus_setscan_enable_complete(sba);
568 break;
569 case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_CLASS_OF_DEV):
570 hcid_dbus_write_class_complete(sba);
571 break;
572 case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_SIMPLE_PAIRING_MODE):
573 hcid_dbus_write_simple_pairing_mode_complete(sba);
574 break;
575 };
576 }
577
remote_name_information(int dev,bdaddr_t * sba,void * ptr)578 static inline void remote_name_information(int dev, bdaddr_t *sba, void *ptr)
579 {
580 evt_remote_name_req_complete *evt = ptr;
581 bdaddr_t dba;
582 char name[249];
583
584 memset(name, 0, sizeof(name));
585 bacpy(&dba, &evt->bdaddr);
586
587 if (!evt->status) {
588 char *end;
589 memcpy(name, evt->name, 248);
590 /* It's ok to cast end between const and non-const since
591 * we know it points to inside of name which is non-const */
592 if (!g_utf8_validate(name, -1, (const char **) &end))
593 *end = '\0';
594 write_device_name(sba, &dba, name);
595 }
596
597 hcid_dbus_remote_name(sba, &dba, evt->status, name);
598 }
599
remote_version_information(int dev,bdaddr_t * sba,void * ptr)600 static inline void remote_version_information(int dev, bdaddr_t *sba, void *ptr)
601 {
602 evt_read_remote_version_complete *evt = ptr;
603 bdaddr_t dba;
604
605 if (evt->status)
606 return;
607
608 if (get_bdaddr(dev, sba, btohs(evt->handle), &dba) < 0)
609 return;
610
611 write_version_info(sba, &dba, btohs(evt->manufacturer),
612 evt->lmp_ver, btohs(evt->lmp_subver));
613 }
614
inquiry_complete(int dev,bdaddr_t * sba,void * ptr)615 static inline void inquiry_complete(int dev, bdaddr_t *sba, void *ptr)
616 {
617 hcid_dbus_inquiry_complete(sba);
618 }
619
inquiry_result(int dev,bdaddr_t * sba,int plen,void * ptr)620 static inline void inquiry_result(int dev, bdaddr_t *sba, int plen, void *ptr)
621 {
622 uint8_t num = *(uint8_t *) ptr++;
623 int i;
624
625 for (i = 0; i < num; i++) {
626 inquiry_info *info = ptr;
627 uint32_t class = info->dev_class[0]
628 | (info->dev_class[1] << 8)
629 | (info->dev_class[2] << 16);
630
631 hcid_dbus_inquiry_result(sba, &info->bdaddr, class, 0, NULL);
632
633 update_lastseen(sba, &info->bdaddr);
634
635 ptr += INQUIRY_INFO_SIZE;
636 }
637 }
638
inquiry_result_with_rssi(int dev,bdaddr_t * sba,int plen,void * ptr)639 static inline void inquiry_result_with_rssi(int dev, bdaddr_t *sba, int plen, void *ptr)
640 {
641 uint8_t num = *(uint8_t *) ptr++;
642 int i;
643
644 if (!num)
645 return;
646
647 if ((plen - 1) / num == INQUIRY_INFO_WITH_RSSI_AND_PSCAN_MODE_SIZE) {
648 for (i = 0; i < num; i++) {
649 inquiry_info_with_rssi_and_pscan_mode *info = ptr;
650 uint32_t class = info->dev_class[0]
651 | (info->dev_class[1] << 8)
652 | (info->dev_class[2] << 16);
653
654 hcid_dbus_inquiry_result(sba, &info->bdaddr,
655 class, info->rssi, NULL);
656
657 update_lastseen(sba, &info->bdaddr);
658
659 ptr += INQUIRY_INFO_WITH_RSSI_AND_PSCAN_MODE_SIZE;
660 }
661 } else {
662 for (i = 0; i < num; i++) {
663 inquiry_info_with_rssi *info = ptr;
664 uint32_t class = info->dev_class[0]
665 | (info->dev_class[1] << 8)
666 | (info->dev_class[2] << 16);
667
668 hcid_dbus_inquiry_result(sba, &info->bdaddr,
669 class, info->rssi, NULL);
670
671 update_lastseen(sba, &info->bdaddr);
672
673 ptr += INQUIRY_INFO_WITH_RSSI_SIZE;
674 }
675 }
676 }
677
extended_inquiry_result(int dev,bdaddr_t * sba,int plen,void * ptr)678 static inline void extended_inquiry_result(int dev, bdaddr_t *sba, int plen, void *ptr)
679 {
680 uint8_t num = *(uint8_t *) ptr++;
681 int i;
682
683 for (i = 0; i < num; i++) {
684 extended_inquiry_info *info = ptr;
685 uint32_t class = info->dev_class[0]
686 | (info->dev_class[1] << 8)
687 | (info->dev_class[2] << 16);
688
689 hcid_dbus_inquiry_result(sba, &info->bdaddr, class,
690 info->rssi, info->data);
691
692 update_lastseen(sba, &info->bdaddr);
693
694 ptr += EXTENDED_INQUIRY_INFO_SIZE;
695 }
696 }
697
remote_features_information(int dev,bdaddr_t * sba,void * ptr)698 static inline void remote_features_information(int dev, bdaddr_t *sba, void *ptr)
699 {
700 evt_read_remote_features_complete *evt = ptr;
701 bdaddr_t dba;
702
703 if (evt->status)
704 return;
705
706 if (get_bdaddr(dev, sba, btohs(evt->handle), &dba) < 0)
707 return;
708
709 write_features_info(sba, &dba, evt->features);
710 }
711
conn_complete(int dev,int dev_id,bdaddr_t * sba,void * ptr)712 static inline void conn_complete(int dev, int dev_id, bdaddr_t *sba, void *ptr)
713 {
714 evt_conn_complete *evt = ptr;
715 char filename[PATH_MAX];
716 remote_name_req_cp cp_name;
717 struct hci_req_data *data;
718 char local_addr[18], peer_addr[18], *str;
719
720 if (evt->link_type != ACL_LINK)
721 return;
722
723 hcid_dbus_conn_complete(sba, evt->status, btohs(evt->handle),
724 &evt->bdaddr);
725
726 if (evt->status)
727 return;
728
729 update_lastused(sba, &evt->bdaddr);
730
731 /* Request remote name */
732 memset(&cp_name, 0, sizeof(cp_name));
733 bacpy(&cp_name.bdaddr, &evt->bdaddr);
734 cp_name.pscan_rep_mode = 0x02;
735
736 data = hci_req_data_new(dev_id, &evt->bdaddr, OGF_LINK_CTL,
737 OCF_REMOTE_NAME_REQ, EVT_REMOTE_NAME_REQ_COMPLETE,
738 &cp_name, REMOTE_NAME_REQ_CP_SIZE);
739
740 hci_req_queue_append(data);
741
742 /* check if the remote version needs be requested */
743 ba2str(sba, local_addr);
744 ba2str(&evt->bdaddr, peer_addr);
745
746 create_name(filename, sizeof(filename), STORAGEDIR, local_addr, "manufacturers");
747
748 str = textfile_get(filename, peer_addr);
749 if (!str) {
750 read_remote_version_cp cp;
751
752 memset(&cp, 0, sizeof(cp));
753 cp.handle = evt->handle;
754
755 data = hci_req_data_new(dev_id, &evt->bdaddr, OGF_LINK_CTL,
756 OCF_READ_REMOTE_VERSION, EVT_READ_REMOTE_VERSION_COMPLETE,
757 &cp, READ_REMOTE_VERSION_CP_SIZE);
758
759 hci_req_queue_append(data);
760 } else
761 free(str);
762 }
763
disconn_complete(int dev,bdaddr_t * sba,void * ptr)764 static inline void disconn_complete(int dev, bdaddr_t *sba, void *ptr)
765 {
766 evt_disconn_complete *evt = ptr;
767
768 hcid_dbus_disconn_complete(sba, evt->status, btohs(evt->handle),
769 evt->reason);
770 }
771
auth_complete(int dev,bdaddr_t * sba,void * ptr)772 static inline void auth_complete(int dev, bdaddr_t *sba, void *ptr)
773 {
774 evt_auth_complete *evt = ptr;
775 bdaddr_t dba;
776
777 if (get_bdaddr(dev, sba, btohs(evt->handle), &dba) < 0)
778 return;
779
780 if (evt->status)
781 hcid_dbus_bonding_process_complete(sba, &dba, evt->status);
782 }
783
conn_request(int dev,bdaddr_t * sba,void * ptr)784 static inline void conn_request(int dev, bdaddr_t *sba, void *ptr)
785 {
786 evt_conn_request *evt = ptr;
787 uint32_t class = evt->dev_class[0] | (evt->dev_class[1] << 8)
788 | (evt->dev_class[2] << 16);
789
790 hcid_dbus_remote_class(sba, &evt->bdaddr, class);
791
792 write_remote_class(sba, &evt->bdaddr, class);
793 }
794
io_security_event(GIOChannel * chan,GIOCondition cond,gpointer data)795 static gboolean io_security_event(GIOChannel *chan, GIOCondition cond, gpointer data)
796 {
797 unsigned char buf[HCI_MAX_EVENT_SIZE], *ptr = buf;
798 struct hci_dev_info *di = data;
799 int type, dev;
800 size_t len;
801 hci_event_hdr *eh;
802 GIOError err;
803
804 if (cond & (G_IO_NVAL | G_IO_HUP | G_IO_ERR)) {
805 g_io_channel_unref(chan);
806 return FALSE;
807 }
808
809 if ((err = g_io_channel_read(chan, (gchar *) buf, sizeof(buf), &len))) {
810 if (err == G_IO_ERROR_AGAIN)
811 return TRUE;
812 g_io_channel_unref(chan);
813 return FALSE;
814 }
815
816 type = *ptr++;
817
818 if (type != HCI_EVENT_PKT)
819 return TRUE;
820
821 eh = (hci_event_hdr *) ptr;
822 ptr += HCI_EVENT_HDR_SIZE;
823
824 dev = g_io_channel_unix_get_fd(chan);
825
826 ioctl(dev, HCIGETDEVINFO, (void *) di);
827
828 if (hci_test_bit(HCI_RAW, &di->flags))
829 return TRUE;
830
831 switch (eh->evt) {
832 case EVT_CMD_STATUS:
833 cmd_status(dev, &di->bdaddr, ptr);
834 break;
835
836 case EVT_CMD_COMPLETE:
837 cmd_complete(dev, &di->bdaddr, ptr);
838 break;
839
840 case EVT_REMOTE_NAME_REQ_COMPLETE:
841 remote_name_information(dev, &di->bdaddr, ptr);
842 break;
843
844 case EVT_READ_REMOTE_VERSION_COMPLETE:
845 remote_version_information(dev, &di->bdaddr, ptr);
846 break;
847
848 case EVT_READ_REMOTE_FEATURES_COMPLETE:
849 remote_features_information(dev, &di->bdaddr, ptr);
850 break;
851
852 case EVT_INQUIRY_COMPLETE:
853 inquiry_complete(dev, &di->bdaddr, ptr);
854 break;
855
856 case EVT_INQUIRY_RESULT:
857 inquiry_result(dev, &di->bdaddr, eh->plen, ptr);
858 break;
859
860 case EVT_INQUIRY_RESULT_WITH_RSSI:
861 inquiry_result_with_rssi(dev, &di->bdaddr, eh->plen, ptr);
862 break;
863
864 case EVT_EXTENDED_INQUIRY_RESULT:
865 extended_inquiry_result(dev, &di->bdaddr, eh->plen, ptr);
866 break;
867
868 case EVT_CONN_COMPLETE:
869 conn_complete(dev, di->dev_id, &di->bdaddr, ptr);
870 break;
871
872 case EVT_DISCONN_COMPLETE:
873 disconn_complete(dev, &di->bdaddr, ptr);
874 break;
875
876 case EVT_AUTH_COMPLETE:
877 auth_complete(dev, &di->bdaddr, ptr);
878 break;
879
880 case EVT_CONN_REQUEST:
881 conn_request(dev, &di->bdaddr, ptr);
882 break;
883 }
884
885 /* Check for pending command request */
886 check_pending_hci_req(di->dev_id, eh->evt);
887
888 if (hci_test_bit(HCI_SECMGR, &di->flags))
889 return TRUE;
890
891 switch (eh->evt) {
892 case EVT_PIN_CODE_REQ:
893 pin_code_request(dev, &di->bdaddr, (bdaddr_t *) ptr);
894 break;
895
896 case EVT_LINK_KEY_REQ:
897 link_key_request(dev, &di->bdaddr, (bdaddr_t *) ptr);
898 break;
899
900 case EVT_LINK_KEY_NOTIFY:
901 link_key_notify(dev, &di->bdaddr, ptr);
902 break;
903
904 case EVT_RETURN_LINK_KEYS:
905 return_link_keys(dev, &di->bdaddr, ptr);
906 break;
907
908 case EVT_IO_CAPABILITY_REQUEST:
909 io_capa_request(dev, &di->bdaddr, (bdaddr_t *) ptr);
910 break;
911
912 case EVT_IO_CAPABILITY_RESPONSE:
913 io_capa_response(dev, &di->bdaddr, ptr);
914 break;
915
916 case EVT_USER_CONFIRM_REQUEST:
917 user_confirm_request(dev, &di->bdaddr, ptr);
918 break;
919
920 case EVT_USER_PASSKEY_REQUEST:
921 user_passkey_request(dev, &di->bdaddr, ptr);
922 break;
923
924 case EVT_USER_PASSKEY_NOTIFY:
925 user_passkey_notify(dev, &di->bdaddr, ptr);
926 break;
927
928 case EVT_REMOTE_OOB_DATA_REQUEST:
929 remote_oob_data_request(dev, &di->bdaddr, ptr);
930 break;
931 }
932
933 return TRUE;
934 }
935
start_security_manager(int hdev)936 void start_security_manager(int hdev)
937 {
938 GIOChannel *chan = io_data[hdev].channel;
939 struct hci_dev_info *di;
940 struct hci_filter flt;
941 read_stored_link_key_cp cp;
942 int dev;
943
944 if (chan)
945 return;
946
947 info("Starting security manager %d", hdev);
948
949 if ((dev = hci_open_dev(hdev)) < 0) {
950 error("Can't open device hci%d: %s (%d)",
951 hdev, strerror(errno), errno);
952 return;
953 }
954
955 /* Set filter */
956 hci_filter_clear(&flt);
957 hci_filter_set_ptype(HCI_EVENT_PKT, &flt);
958 hci_filter_set_event(EVT_CMD_STATUS, &flt);
959 hci_filter_set_event(EVT_CMD_COMPLETE, &flt);
960 hci_filter_set_event(EVT_PIN_CODE_REQ, &flt);
961 hci_filter_set_event(EVT_LINK_KEY_REQ, &flt);
962 hci_filter_set_event(EVT_LINK_KEY_NOTIFY, &flt);
963 hci_filter_set_event(EVT_RETURN_LINK_KEYS, &flt);
964 hci_filter_set_event(EVT_IO_CAPABILITY_REQUEST, &flt);
965 hci_filter_set_event(EVT_IO_CAPABILITY_RESPONSE, &flt);
966 hci_filter_set_event(EVT_USER_CONFIRM_REQUEST, &flt);
967 hci_filter_set_event(EVT_USER_PASSKEY_REQUEST, &flt);
968 hci_filter_set_event(EVT_REMOTE_OOB_DATA_REQUEST, &flt);
969 hci_filter_set_event(EVT_USER_PASSKEY_NOTIFY, &flt);
970 hci_filter_set_event(EVT_KEYPRESS_NOTIFY, &flt);
971 hci_filter_set_event(EVT_SIMPLE_PAIRING_COMPLETE, &flt);
972 hci_filter_set_event(EVT_AUTH_COMPLETE, &flt);
973 hci_filter_set_event(EVT_REMOTE_NAME_REQ_COMPLETE, &flt);
974 hci_filter_set_event(EVT_READ_REMOTE_VERSION_COMPLETE, &flt);
975 hci_filter_set_event(EVT_READ_REMOTE_FEATURES_COMPLETE, &flt);
976 hci_filter_set_event(EVT_REMOTE_HOST_FEATURES_NOTIFY, &flt);
977 hci_filter_set_event(EVT_INQUIRY_COMPLETE, &flt);
978 hci_filter_set_event(EVT_INQUIRY_RESULT, &flt);
979 hci_filter_set_event(EVT_INQUIRY_RESULT_WITH_RSSI, &flt);
980 hci_filter_set_event(EVT_EXTENDED_INQUIRY_RESULT, &flt);
981 hci_filter_set_event(EVT_CONN_REQUEST, &flt);
982 hci_filter_set_event(EVT_CONN_COMPLETE, &flt);
983 hci_filter_set_event(EVT_DISCONN_COMPLETE, &flt);
984 if (setsockopt(dev, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
985 error("Can't set filter on hci%d: %s (%d)",
986 hdev, strerror(errno), errno);
987 close(dev);
988 return;
989 }
990
991 di = g_new(struct hci_dev_info, 1);
992 if (hci_devinfo(hdev, di) < 0) {
993 error("Can't get device info: %s (%d)",
994 strerror(errno), errno);
995 close(dev);
996 g_free(di);
997 return;
998 }
999
1000 chan = g_io_channel_unix_new(dev);
1001 g_io_channel_set_close_on_unref(chan, TRUE);
1002 io_data[hdev].watch_id = g_io_add_watch_full(chan, G_PRIORITY_HIGH,
1003 G_IO_IN | G_IO_NVAL | G_IO_HUP | G_IO_ERR,
1004 io_security_event, di, (GDestroyNotify) g_free);
1005 io_data[hdev].channel = chan;
1006 io_data[hdev].pin_length = -1;
1007
1008 if (hci_test_bit(HCI_RAW, &di->flags))
1009 return;
1010
1011 bacpy(&cp.bdaddr, BDADDR_ANY);
1012 cp.read_all = 1;
1013
1014 hci_send_cmd(dev, OGF_HOST_CTL, OCF_READ_STORED_LINK_KEY,
1015 READ_STORED_LINK_KEY_CP_SIZE, (void *) &cp);
1016 }
1017
stop_security_manager(int hdev)1018 void stop_security_manager(int hdev)
1019 {
1020 GIOChannel *chan = io_data[hdev].channel;
1021
1022 if (!chan)
1023 return;
1024
1025 info("Stopping security manager %d", hdev);
1026
1027 g_source_remove(io_data[hdev].watch_id);
1028 g_io_channel_unref(io_data[hdev].channel);
1029 io_data[hdev].watch_id = -1;
1030 io_data[hdev].channel = NULL;
1031 io_data[hdev].pin_length = -1;
1032 }
1033
init_security_data(void)1034 void init_security_data(void)
1035 {
1036 pairing = hcid.pairing;
1037 }
1038