1 /******************************************************************************
2 *
3 * Copyright 1999-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * This file contains functions for the SMP L2Cap interface
22 *
23 ******************************************************************************/
24
25 #include <cutils/log.h>
26 #include "bt_target.h"
27
28 #include <string.h>
29 #include "btm_ble_api.h"
30 #include "common/metrics.h"
31 #include "l2c_api.h"
32
33 #include "smp_int.h"
34
35 static void smp_tx_complete_callback(uint16_t cid, uint16_t num_pkt);
36
37 static void smp_connect_callback(uint16_t channel, const RawAddress& bd_addr,
38 bool connected, uint16_t reason,
39 tBT_TRANSPORT transport);
40 static void smp_data_received(uint16_t channel, const RawAddress& bd_addr,
41 BT_HDR* p_buf);
42
43 static void smp_br_connect_callback(uint16_t channel, const RawAddress& bd_addr,
44 bool connected, uint16_t reason,
45 tBT_TRANSPORT transport);
46 static void smp_br_data_received(uint16_t channel, const RawAddress& bd_addr,
47 BT_HDR* p_buf);
48
49 /*******************************************************************************
50 *
51 * Function smp_l2cap_if_init
52 *
53 * Description This function is called during the SMP task startup
54 * to register interface functions with L2CAP.
55 *
56 ******************************************************************************/
smp_l2cap_if_init(void)57 void smp_l2cap_if_init(void) {
58 tL2CAP_FIXED_CHNL_REG fixed_reg;
59 SMP_TRACE_EVENT("SMDBG l2c %s", __func__);
60 fixed_reg.fixed_chnl_opts.mode = L2CAP_FCR_BASIC_MODE;
61 fixed_reg.fixed_chnl_opts.max_transmit = 0;
62 fixed_reg.fixed_chnl_opts.rtrans_tout = 0;
63 fixed_reg.fixed_chnl_opts.mon_tout = 0;
64 fixed_reg.fixed_chnl_opts.mps = 0;
65 fixed_reg.fixed_chnl_opts.tx_win_sz = 0;
66
67 fixed_reg.pL2CA_FixedConn_Cb = smp_connect_callback;
68 fixed_reg.pL2CA_FixedData_Cb = smp_data_received;
69 fixed_reg.pL2CA_FixedTxComplete_Cb = smp_tx_complete_callback;
70
71 fixed_reg.pL2CA_FixedCong_Cb =
72 NULL; /* do not handle congestion on this channel */
73 fixed_reg.default_idle_tout =
74 60; /* set 60 seconds timeout, 0xffff default idle timeout */
75
76 L2CA_RegisterFixedChannel(L2CAP_SMP_CID, &fixed_reg);
77
78 fixed_reg.pL2CA_FixedConn_Cb = smp_br_connect_callback;
79 fixed_reg.pL2CA_FixedData_Cb = smp_br_data_received;
80
81 L2CA_RegisterFixedChannel(L2CAP_SMP_BR_CID, &fixed_reg);
82 }
83
84 /*******************************************************************************
85 *
86 * Function smp_connect_callback
87 *
88 * Description This callback function is called by L2CAP to indicate that
89 * SMP channel is
90 * connected (conn = true)/disconnected (conn = false).
91 *
92 ******************************************************************************/
smp_connect_callback(uint16_t channel,const RawAddress & bd_addr,bool connected,uint16_t reason,tBT_TRANSPORT transport)93 static void smp_connect_callback(uint16_t channel, const RawAddress& bd_addr,
94 bool connected, uint16_t reason,
95 tBT_TRANSPORT transport) {
96 tSMP_CB* p_cb = &smp_cb;
97 tSMP_INT_DATA int_data;
98
99 SMP_TRACE_EVENT("%s: SMDBG l2c: bd_addr=%s, p_cb->pairing_bda=%s", __func__,
100 bd_addr.ToString().c_str(),
101 p_cb->pairing_bda.ToString().c_str());
102
103 if (transport == BT_TRANSPORT_BR_EDR || bd_addr.IsEmpty()) return;
104
105 if (bd_addr == p_cb->pairing_bda) {
106 VLOG(2) << __func__ << " for pairing BDA: " << bd_addr
107 << " Event: " << ((connected) ? "connected" : "disconnected");
108
109 if (connected) {
110 if (!p_cb->connect_initialized) {
111 p_cb->connect_initialized = true;
112 /* initiating connection established */
113 p_cb->role = L2CA_GetBleConnRole(bd_addr);
114
115 /* initialize local i/r key to be default keys */
116 p_cb->local_r_key = p_cb->local_i_key = SMP_SEC_DEFAULT_KEY;
117 p_cb->loc_auth_req = p_cb->peer_auth_req = SMP_DEFAULT_AUTH_REQ;
118 p_cb->cb_evt = SMP_IO_CAP_REQ_EVT;
119 smp_sm_event(p_cb, SMP_L2CAP_CONN_EVT, NULL);
120 }
121 } else {
122 int_data.reason = reason;
123 /* Disconnected while doing security */
124 smp_sm_event(p_cb, SMP_L2CAP_DISCONN_EVT, &int_data);
125 }
126 }
127 }
128
129 /*******************************************************************************
130 *
131 * Function smp_data_received
132 *
133 * Description This function is called when data is received from L2CAP on
134 * SMP channel.
135 *
136 *
137 * Returns void
138 *
139 ******************************************************************************/
smp_data_received(uint16_t channel,const RawAddress & bd_addr,BT_HDR * p_buf)140 static void smp_data_received(uint16_t channel, const RawAddress& bd_addr,
141 BT_HDR* p_buf) {
142 tSMP_CB* p_cb = &smp_cb;
143 uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
144 uint8_t cmd;
145
146 if (p_buf->len < 1) {
147 android_errorWriteLog(0x534e4554, "111215315");
148 SMP_TRACE_WARNING("%s: smp packet length %d too short: must be at least 1",
149 __func__, p_buf->len);
150 osi_free(p_buf);
151 return;
152 }
153
154 STREAM_TO_UINT8(cmd, p);
155
156 SMP_TRACE_EVENT("%s: SMDBG l2c, cmd=0x%x", __func__, cmd);
157
158 /* sanity check */
159 if ((SMP_OPCODE_MAX < cmd) || (SMP_OPCODE_MIN > cmd)) {
160 SMP_TRACE_WARNING("Ignore received command with RESERVED code 0x%02x", cmd);
161 osi_free(p_buf);
162 return;
163 }
164
165 /* reject the pairing request if there is an on-going SMP pairing */
166 if (SMP_OPCODE_PAIRING_REQ == cmd || SMP_OPCODE_SEC_REQ == cmd) {
167 if ((p_cb->state == SMP_STATE_IDLE) &&
168 (p_cb->br_state == SMP_BR_STATE_IDLE) &&
169 !(p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD)) {
170 p_cb->role = L2CA_GetBleConnRole(bd_addr);
171 p_cb->pairing_bda = bd_addr;
172 } else if (bd_addr != p_cb->pairing_bda) {
173 osi_free(p_buf);
174 smp_reject_unexpected_pairing_command(bd_addr);
175 return;
176 }
177 /* else, out of state pairing request/security request received, passed into
178 * SM */
179 }
180
181 if (bd_addr == p_cb->pairing_bda) {
182 alarm_set_on_mloop(p_cb->smp_rsp_timer_ent, SMP_WAIT_FOR_RSP_TIMEOUT_MS,
183 smp_rsp_timeout, NULL);
184
185 smp_log_metrics(p_cb->pairing_bda, false /* incoming */,
186 p_buf->data + p_buf->offset, p_buf->len);
187
188 if (cmd == SMP_OPCODE_CONFIRM) {
189 SMP_TRACE_DEBUG(
190 "in %s cmd = 0x%02x, peer_auth_req = 0x%02x,"
191 "loc_auth_req = 0x%02x",
192 __func__, cmd, p_cb->peer_auth_req, p_cb->loc_auth_req);
193
194 if ((p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT) &&
195 (p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT)) {
196 cmd = SMP_OPCODE_PAIR_COMMITM;
197 }
198 }
199
200 p_cb->rcvd_cmd_code = cmd;
201 p_cb->rcvd_cmd_len = (uint8_t)p_buf->len;
202 tSMP_INT_DATA smp_int_data;
203 smp_int_data.p_data = p;
204 smp_sm_event(p_cb, cmd, &smp_int_data);
205 }
206
207 osi_free(p_buf);
208 }
209
210 /*******************************************************************************
211 *
212 * Function smp_tx_complete_callback
213 *
214 * Description SMP channel tx complete callback
215 *
216 ******************************************************************************/
smp_tx_complete_callback(uint16_t cid,uint16_t num_pkt)217 static void smp_tx_complete_callback(uint16_t cid, uint16_t num_pkt) {
218 tSMP_CB* p_cb = &smp_cb;
219
220 if (p_cb->total_tx_unacked >= num_pkt)
221 p_cb->total_tx_unacked -= num_pkt;
222 else
223 SMP_TRACE_ERROR("Unexpected %s: num_pkt = %d", __func__, num_pkt);
224
225 if (p_cb->total_tx_unacked == 0 && p_cb->wait_for_authorization_complete) {
226 tSMP_INT_DATA smp_int_data;
227 smp_int_data.status = SMP_SUCCESS;
228 if (cid == L2CAP_SMP_CID) {
229 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
230 } else {
231 smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &smp_int_data);
232 }
233 }
234 }
235
236 /*******************************************************************************
237 *
238 * Function smp_br_connect_callback
239 *
240 * Description This callback function is called by L2CAP to indicate that
241 * SMP BR channel is
242 * connected (conn = true)/disconnected (conn = false).
243 *
244 ******************************************************************************/
smp_br_connect_callback(uint16_t channel,const RawAddress & bd_addr,bool connected,uint16_t reason,tBT_TRANSPORT transport)245 static void smp_br_connect_callback(uint16_t channel, const RawAddress& bd_addr,
246 bool connected, uint16_t reason,
247 tBT_TRANSPORT transport) {
248 tSMP_CB* p_cb = &smp_cb;
249 tSMP_INT_DATA int_data;
250
251 SMP_TRACE_EVENT("%s", __func__);
252
253 if (transport != BT_TRANSPORT_BR_EDR) {
254 SMP_TRACE_WARNING("%s is called on unexpected transport %d", __func__,
255 transport);
256 return;
257 }
258
259 VLOG(1) << __func__ << " for pairing BDA: " << bd_addr
260 << ", pairing_bda:" << p_cb->pairing_bda
261 << " Event: " << ((connected) ? "connected" : "disconnected");
262
263 if (bd_addr != p_cb->pairing_bda) return;
264
265 if (connected) {
266 if (!p_cb->connect_initialized) {
267 p_cb->connect_initialized = true;
268 /* initialize local i/r key to be default keys */
269 p_cb->local_r_key = p_cb->local_i_key = SMP_BR_SEC_DEFAULT_KEY;
270 p_cb->loc_auth_req = p_cb->peer_auth_req = 0;
271 p_cb->cb_evt = SMP_BR_KEYS_REQ_EVT;
272 smp_br_state_machine_event(p_cb, SMP_BR_L2CAP_CONN_EVT, NULL);
273 }
274 } else {
275 int_data.reason = reason;
276 /* Disconnected while doing security */
277 smp_br_state_machine_event(p_cb, SMP_BR_L2CAP_DISCONN_EVT, &int_data);
278 }
279 }
280
281 /*******************************************************************************
282 *
283 * Function smp_br_data_received
284 *
285 * Description This function is called when data is received from L2CAP on
286 * SMP BR channel.
287 *
288 * Returns void
289 *
290 ******************************************************************************/
smp_br_data_received(uint16_t channel,const RawAddress & bd_addr,BT_HDR * p_buf)291 static void smp_br_data_received(uint16_t channel, const RawAddress& bd_addr,
292 BT_HDR* p_buf) {
293 tSMP_CB* p_cb = &smp_cb;
294 uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
295 uint8_t cmd;
296 SMP_TRACE_EVENT("SMDBG l2c %s", __func__);
297
298 if (p_buf->len < 1) {
299 android_errorWriteLog(0x534e4554, "111215315");
300 SMP_TRACE_WARNING("%s: smp packet length %d too short: must be at least 1",
301 __func__, p_buf->len);
302 osi_free(p_buf);
303 return;
304 }
305
306 STREAM_TO_UINT8(cmd, p);
307
308 /* sanity check */
309 if ((SMP_OPCODE_MAX < cmd) || (SMP_OPCODE_MIN > cmd)) {
310 SMP_TRACE_WARNING("Ignore received command with RESERVED code 0x%02x", cmd);
311 osi_free(p_buf);
312 return;
313 }
314
315 /* reject the pairing request if there is an on-going SMP pairing */
316 if (SMP_OPCODE_PAIRING_REQ == cmd) {
317 if ((p_cb->state == SMP_STATE_IDLE) &&
318 (p_cb->br_state == SMP_BR_STATE_IDLE)) {
319 p_cb->role = HCI_ROLE_SLAVE;
320 p_cb->smp_over_br = true;
321 p_cb->pairing_bda = bd_addr;
322 } else if (bd_addr != p_cb->pairing_bda) {
323 osi_free(p_buf);
324 smp_reject_unexpected_pairing_command(bd_addr);
325 return;
326 }
327 /* else, out of state pairing request received, passed into State Machine */
328 }
329
330 if (bd_addr == p_cb->pairing_bda) {
331 alarm_set_on_mloop(p_cb->smp_rsp_timer_ent, SMP_WAIT_FOR_RSP_TIMEOUT_MS,
332 smp_rsp_timeout, NULL);
333
334 smp_log_metrics(p_cb->pairing_bda, false /* incoming */,
335 p_buf->data + p_buf->offset, p_buf->len);
336
337 p_cb->rcvd_cmd_code = cmd;
338 p_cb->rcvd_cmd_len = (uint8_t)p_buf->len;
339 tSMP_INT_DATA smp_int_data;
340 smp_int_data.p_data = p;
341 smp_br_state_machine_event(p_cb, cmd, &smp_int_data);
342 }
343
344 osi_free(p_buf);
345 }
346