1 /******************************************************************************
2  *
3  *  Copyright 1999-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This file contains functions for the SMP L2Cap interface
22  *
23  ******************************************************************************/
24 
25 #define LOG_TAG "smp"
26 
27 #include <bluetooth/log.h>
28 #include <com_android_bluetooth_flags.h>
29 
30 #include "internal_include/bt_target.h"
31 #include "osi/include/allocator.h"
32 #include "smp_int.h"
33 #include "stack/btm/btm_dev.h"
34 #include "stack/include/bt_hdr.h"
35 #include "stack/include/bt_types.h"
36 #include "stack/include/l2cap_interface.h"
37 #include "stack/include/l2cdefs.h"
38 #include "types/raw_address.h"
39 
40 using namespace bluetooth;
41 
42 static void smp_tx_complete_callback(uint16_t cid, uint16_t num_pkt);
43 
44 static void smp_connect_callback(uint16_t channel, const RawAddress& bd_addr, bool connected,
45                                  uint16_t reason, tBT_TRANSPORT transport);
46 static void smp_data_received(uint16_t channel, const RawAddress& bd_addr, BT_HDR* p_buf);
47 
48 static void smp_br_connect_callback(uint16_t channel, const RawAddress& bd_addr, bool connected,
49                                     uint16_t reason, tBT_TRANSPORT transport);
50 static void smp_br_data_received(uint16_t channel, const RawAddress& bd_addr, BT_HDR* p_buf);
51 
52 /*******************************************************************************
53  *
54  * Function         smp_l2cap_if_init
55  *
56  * Description      This function is called during the SMP task startup
57  *                  to register interface functions with L2CAP.
58  *
59  ******************************************************************************/
smp_l2cap_if_init(void)60 void smp_l2cap_if_init(void) {
61   tL2CAP_FIXED_CHNL_REG fixed_reg;
62   log::verbose("SMDBG l2c");
63 
64   fixed_reg.pL2CA_FixedConn_Cb = smp_connect_callback;
65   fixed_reg.pL2CA_FixedData_Cb = smp_data_received;
66   fixed_reg.pL2CA_FixedTxComplete_Cb = smp_tx_complete_callback;
67 
68   fixed_reg.pL2CA_FixedCong_Cb = NULL; /* do not handle congestion on this channel */
69   fixed_reg.default_idle_tout = 60;    /* set 60 seconds timeout, 0xffff default idle timeout */
70 
71   if (!stack::l2cap::get_interface().L2CA_RegisterFixedChannel(L2CAP_SMP_CID, &fixed_reg)) {
72     log::error("Unable to register with L2CAP fixed channel profile SMP psm:{}", L2CAP_SMP_CID);
73   }
74 
75   fixed_reg.pL2CA_FixedConn_Cb = smp_br_connect_callback;
76   fixed_reg.pL2CA_FixedData_Cb = smp_br_data_received;
77 
78   if (!stack::l2cap::get_interface().L2CA_RegisterFixedChannel(L2CAP_SMP_BR_CID, &fixed_reg)) {
79     log::error("Unable to register with L2CAP fixed channel profile SMP_BR psm:{}",
80                L2CAP_SMP_BR_CID);
81   }
82 }
83 
84 /*******************************************************************************
85  *
86  * Function         smp_connect_callback
87  *
88  * Description      This callback function is called by L2CAP to indicate that
89  *                  SMP channel is
90  *                      connected (conn = true)/disconnected (conn = false).
91  *
92  ******************************************************************************/
smp_connect_callback(uint16_t,const RawAddress & bd_addr,bool connected,uint16_t,tBT_TRANSPORT transport)93 static void smp_connect_callback(uint16_t /* channel */, const RawAddress& bd_addr, bool connected,
94                                  uint16_t /* reason */, tBT_TRANSPORT transport) {
95   tSMP_CB* p_cb = &smp_cb;
96   tSMP_INT_DATA int_data;
97 
98   log::debug("bd_addr:{} transport:{}, connected:{}", bd_addr, bt_transport_text(transport),
99              connected);
100 
101   if (bd_addr.IsEmpty()) {
102     log::warn("empty address");
103     return;
104   }
105 
106   if (transport == BT_TRANSPORT_BR_EDR) {
107     log::warn("unexpected transport");
108     return;
109   }
110 
111   if (bd_addr == p_cb->pairing_bda) {
112     log::debug("in pairing process");
113 
114     if (connected) {
115       if (!p_cb->connect_initialized) {
116         p_cb->connect_initialized = true;
117         /* initiating connection established */
118         p_cb->role = stack::l2cap::get_interface().L2CA_GetBleConnRole(bd_addr);
119 
120         /* initialize local i/r key to be default keys */
121         p_cb->local_r_key = p_cb->local_i_key = SMP_SEC_DEFAULT_KEY;
122         p_cb->loc_auth_req = p_cb->peer_auth_req = SMP_DEFAULT_AUTH_REQ;
123         p_cb->cb_evt = SMP_IO_CAP_REQ_EVT;
124         smp_sm_event(p_cb, SMP_L2CAP_CONN_EVT, NULL);
125       }
126     } else {
127       /* Disconnected while doing security */
128       smp_sm_event(p_cb, SMP_L2CAP_DISCONN_EVT, &int_data);
129     }
130   }
131 }
132 
133 /*******************************************************************************
134  *
135  * Function         smp_data_received
136  *
137  * Description      This function is called when data is received from L2CAP on
138  *                  SMP channel.
139  *
140  *
141  * Returns          void
142  *
143  ******************************************************************************/
smp_data_received(uint16_t channel,const RawAddress & bd_addr,BT_HDR * p_buf)144 static void smp_data_received(uint16_t channel, const RawAddress& bd_addr, BT_HDR* p_buf) {
145   tSMP_CB* p_cb = &smp_cb;
146   uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
147   uint8_t cmd;
148 
149   if (p_buf->len < 1) {
150     log::warn("packet too short");
151     osi_free(p_buf);
152     return;
153   }
154 
155   STREAM_TO_UINT8(cmd, p);
156 
157   log::verbose("cmd={}[0x{:02x}]", smp_opcode_text(static_cast<tSMP_OPCODE>(cmd)), cmd);
158 
159   /* sanity check */
160   if ((SMP_OPCODE_MAX < cmd) || (SMP_OPCODE_MIN > cmd)) {
161     log::warn("invalid command");
162     osi_free(p_buf);
163     return;
164   }
165 
166   /* reject the pairing request if there is an on-going SMP pairing */
167   if (SMP_OPCODE_PAIRING_REQ == cmd || SMP_OPCODE_SEC_REQ == cmd) {
168     if ((p_cb->state == SMP_STATE_IDLE) && (p_cb->br_state == SMP_BR_STATE_IDLE) &&
169         !(p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD)) {
170       p_cb->role = bluetooth::stack::l2cap::get_interface().L2CA_GetBleConnRole(bd_addr);
171       p_cb->pairing_bda = bd_addr;
172     } else if (bd_addr != p_cb->pairing_bda) {
173       osi_free(p_buf);
174       smp_reject_unexpected_pairing_command(bd_addr);
175       return;
176     }
177     /* else, out of state pairing request/security request received, passed into
178      * SM */
179   }
180 
181   if (bd_addr == p_cb->pairing_bda) {
182     alarm_set_on_mloop(p_cb->smp_rsp_timer_ent, SMP_WAIT_FOR_RSP_TIMEOUT_MS, smp_rsp_timeout, NULL);
183 
184     smp_log_metrics(p_cb->pairing_bda, false /* incoming */, p_buf->data + p_buf->offset,
185                     p_buf->len, false /* is_over_br */);
186 
187     if (cmd == SMP_OPCODE_CONFIRM) {
188       log::verbose("peer_auth_req=0x{:02x}, loc_auth_req=0x{:02x}", p_cb->peer_auth_req,
189                    p_cb->loc_auth_req);
190 
191       if ((p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT) && (p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT)) {
192         cmd = SMP_OPCODE_PAIR_COMMITM;
193       }
194     }
195 
196     p_cb->rcvd_cmd_code = cmd;
197     p_cb->rcvd_cmd_len = (uint8_t)p_buf->len;
198     tSMP_INT_DATA smp_int_data;
199     smp_int_data.p_data = p;
200     smp_sm_event(p_cb, static_cast<tSMP_EVENT>(cmd), &smp_int_data);
201   } else {
202     if (!stack::l2cap::get_interface().L2CA_RemoveFixedChnl(channel, bd_addr)) {
203       log::error("Unable to remove fixed channel peer:{} cid:{}", bd_addr, channel);
204     }
205   }
206 
207   osi_free(p_buf);
208 }
209 
210 /*******************************************************************************
211  *
212  * Function         smp_tx_complete_callback
213  *
214  * Description      SMP channel tx complete callback
215  *
216  ******************************************************************************/
smp_tx_complete_callback(uint16_t cid,uint16_t num_pkt)217 static void smp_tx_complete_callback(uint16_t cid, uint16_t num_pkt) {
218   tSMP_CB* p_cb = &smp_cb;
219 
220   if (!com::android::bluetooth::flags::l2cap_tx_complete_cb_info()) {
221     log::verbose("Exit since l2cap_tx_complete_cb_info is disabled");
222     return;
223   }
224 
225   log::verbose("l2cap_tx_complete_cb_info is enabled, continue");
226   if (p_cb->total_tx_unacked >= num_pkt) {
227     p_cb->total_tx_unacked -= num_pkt;
228   } else {
229     log::error("Unexpected complete callback: num_pkt = {}", num_pkt);
230   }
231 
232   if (p_cb->total_tx_unacked == 0 && p_cb->wait_for_authorization_complete) {
233     tSMP_INT_DATA smp_int_data;
234     smp_int_data.status = SMP_SUCCESS;
235     if (cid == L2CAP_SMP_CID) {
236       smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
237     } else {
238       smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &smp_int_data);
239     }
240   }
241 }
242 
243 /*******************************************************************************
244  *
245  * Function         smp_br_connect_callback
246  *
247  * Description      This callback function is called by L2CAP to indicate that
248  *                  SMP BR channel is
249  *                      connected (conn = true)/disconnected (conn = false).
250  *
251  ******************************************************************************/
smp_br_connect_callback(uint16_t,const RawAddress & bd_addr,bool connected,uint16_t,tBT_TRANSPORT transport)252 static void smp_br_connect_callback(uint16_t /* channel */, const RawAddress& bd_addr,
253                                     bool connected, uint16_t /* reason */,
254                                     tBT_TRANSPORT transport) {
255   tSMP_CB* p_cb = &smp_cb;
256   tSMP_INT_DATA int_data;
257 
258   if (transport != BT_TRANSPORT_BR_EDR) {
259     log::warn("unexpected transport {}", bt_transport_text(transport));
260     return;
261   }
262 
263   log::info("BDA:{} pairing_bda:{}, connected:{}", bd_addr, p_cb->pairing_bda, connected);
264 
265   if (bd_addr != p_cb->pairing_bda) {
266     if (!com::android::bluetooth::flags::smp_state_machine_stuck_after_disconnection_fix()) {
267       log::info(
268               "If your pairing failed, get a build with "
269               "smp_state_machine_stuck_after_disconnection_fix and try again :)");
270       return;
271     }
272 
273     tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
274     /* When pairing was initiated to RPA, and connection was on LE transport first using RPA, then
275      * we must check record pseudo address, it might be same device */
276     if (p_dev_rec == nullptr || p_dev_rec->RemoteAddress() != p_cb->pairing_bda) {
277       return;
278     }
279   }
280 
281   /* Check if we already finished SMP pairing over LE, and are waiting to
282    * check if other side returns some errors. Connection/disconnection on
283    * Classic transport shouldn't impact that.
284    */
285   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(p_cb->pairing_bda);
286   if ((smp_get_state() == SMP_STATE_BOND_PENDING || smp_get_state() == SMP_STATE_IDLE) &&
287       (p_dev_rec && p_dev_rec->sec_rec.is_link_key_known()) &&
288       alarm_is_scheduled(p_cb->delayed_auth_timer_ent)) {
289     /* If we were to not return here, we would reset SMP control block, and
290      * delayed_auth_timer_ent would never be executed. Even though we stored all
291      * keys, stack would consider device as not bonded. It would reappear after
292      * stack restart, when we re-read record from storage. Service discovery
293      * would stay broken.
294      */
295     log::info("Classic event after CTKD on LE transport");
296     return;
297   }
298 
299   if (connected) {
300     if (!p_cb->connect_initialized) {
301       p_cb->connect_initialized = true;
302       /* initialize local i/r key to be default keys */
303       p_cb->local_r_key = p_cb->local_i_key = SMP_BR_SEC_DEFAULT_KEY;
304       p_cb->loc_auth_req = p_cb->peer_auth_req = 0;
305       p_cb->cb_evt = SMP_BR_KEYS_REQ_EVT;
306       smp_br_state_machine_event(p_cb, SMP_BR_L2CAP_CONN_EVT, NULL);
307     }
308   } else {
309     /* Disconnected while doing security */
310     if (p_cb->smp_over_br) {
311       log::debug("SMP over BR/EDR not supported, terminate the ongoing pairing");
312       smp_br_state_machine_event(p_cb, SMP_BR_L2CAP_DISCONN_EVT, &int_data);
313     } else {
314       log::debug("SMP over BR/EDR not supported, continue the LE pairing");
315     }
316   }
317 }
318 
319 /*******************************************************************************
320  *
321  * Function         smp_br_data_received
322  *
323  * Description      This function is called when data is received from L2CAP on
324  *                  SMP BR channel.
325  *
326  * Returns          void
327  *
328  ******************************************************************************/
smp_br_data_received(uint16_t,const RawAddress & bd_addr,BT_HDR * p_buf)329 static void smp_br_data_received(uint16_t /* channel */, const RawAddress& bd_addr, BT_HDR* p_buf) {
330   tSMP_CB* p_cb = &smp_cb;
331   uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
332   uint8_t cmd;
333   log::verbose("SMDBG l2c");
334 
335   if (p_buf->len < 1) {
336     log::warn("packet too short");
337     osi_free(p_buf);
338     return;
339   }
340 
341   STREAM_TO_UINT8(cmd, p);
342   log::verbose("cmd={}[0x{:02x}]", smp_opcode_text(static_cast<tSMP_OPCODE>(cmd)), cmd);
343 
344   /* sanity check */
345   if ((SMP_OPCODE_MAX < cmd) || (SMP_OPCODE_MIN > cmd)) {
346     log::warn("invalid command 0x{:02x}", cmd);
347     osi_free(p_buf);
348     return;
349   }
350 
351   /* reject the pairing request if there is an on-going SMP pairing */
352   if (SMP_OPCODE_PAIRING_REQ == cmd) {
353     if ((p_cb->state == SMP_STATE_IDLE) && (p_cb->br_state == SMP_BR_STATE_IDLE)) {
354       p_cb->role = HCI_ROLE_PERIPHERAL;
355       p_cb->smp_over_br = true;
356       p_cb->pairing_bda = bd_addr;
357     } else if (bd_addr != p_cb->pairing_bda) {
358       osi_free(p_buf);
359       smp_reject_unexpected_pairing_command(bd_addr);
360       return;
361     }
362     /* else, out of state pairing request received, passed into State Machine */
363   }
364 
365   if (bd_addr == p_cb->pairing_bda) {
366     alarm_set_on_mloop(p_cb->smp_rsp_timer_ent, SMP_WAIT_FOR_RSP_TIMEOUT_MS, smp_rsp_timeout, NULL);
367 
368     smp_log_metrics(p_cb->pairing_bda, false /* incoming */, p_buf->data + p_buf->offset,
369                     p_buf->len, true /* is_over_br */);
370 
371     p_cb->rcvd_cmd_code = cmd;
372     p_cb->rcvd_cmd_len = (uint8_t)p_buf->len;
373     tSMP_INT_DATA smp_int_data;
374     smp_int_data.p_data = p;
375     smp_br_state_machine_event(p_cb, static_cast<tSMP_EVENT>(cmd), &smp_int_data);
376   }
377 
378   osi_free(p_buf);
379 }
380