Bluetooth: Fix connection establishment with low security requirement
[linux-2.6] / net / phonet / af_phonet.c
1 /*
2  * File: af_phonet.c
3  *
4  * Phonet protocols family
5  *
6  * Copyright (C) 2008 Nokia Corporation.
7  *
8  * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
9  * Original author: Sakari Ailus <sakari.ailus@nokia.com>
10  *
11  * This program is free software; you can redistribute it and/or
12  * modify it under the terms of the GNU General Public License
13  * version 2 as published by the Free Software Foundation.
14  *
15  * This program is distributed in the hope that it will be useful, but
16  * WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
18  * General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License
21  * along with this program; if not, write to the Free Software
22  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
23  * 02110-1301 USA
24  */
25
26 #include <linux/kernel.h>
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29 #include <net/sock.h>
30
31 #include <linux/if_phonet.h>
32 #include <linux/phonet.h>
33 #include <net/phonet/phonet.h>
34 #include <net/phonet/pn_dev.h>
35
36 /* Transport protocol registration */
37 static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
38 static DEFINE_SPINLOCK(proto_tab_lock);
39
40 static struct phonet_protocol *phonet_proto_get(int protocol)
41 {
42         struct phonet_protocol *pp;
43
44         if (protocol >= PHONET_NPROTO)
45                 return NULL;
46
47         spin_lock(&proto_tab_lock);
48         pp = proto_tab[protocol];
49         if (pp && !try_module_get(pp->prot->owner))
50                 pp = NULL;
51         spin_unlock(&proto_tab_lock);
52
53         return pp;
54 }
55
56 static inline void phonet_proto_put(struct phonet_protocol *pp)
57 {
58         module_put(pp->prot->owner);
59 }
60
61 /* protocol family functions */
62
63 static int pn_socket_create(struct net *net, struct socket *sock, int protocol)
64 {
65         struct sock *sk;
66         struct pn_sock *pn;
67         struct phonet_protocol *pnp;
68         int err;
69
70         if (!capable(CAP_SYS_ADMIN))
71                 return -EPERM;
72
73         if (protocol == 0) {
74                 /* Default protocol selection */
75                 switch (sock->type) {
76                 case SOCK_DGRAM:
77                         protocol = PN_PROTO_PHONET;
78                         break;
79                 case SOCK_SEQPACKET:
80                         protocol = PN_PROTO_PIPE;
81                         break;
82                 default:
83                         return -EPROTONOSUPPORT;
84                 }
85         }
86
87         pnp = phonet_proto_get(protocol);
88         if (pnp == NULL &&
89             request_module("net-pf-%d-proto-%d", PF_PHONET, protocol) == 0)
90                 pnp = phonet_proto_get(protocol);
91
92         if (pnp == NULL)
93                 return -EPROTONOSUPPORT;
94         if (sock->type != pnp->sock_type) {
95                 err = -EPROTONOSUPPORT;
96                 goto out;
97         }
98
99         sk = sk_alloc(net, PF_PHONET, GFP_KERNEL, pnp->prot);
100         if (sk == NULL) {
101                 err = -ENOMEM;
102                 goto out;
103         }
104
105         sock_init_data(sock, sk);
106         sock->state = SS_UNCONNECTED;
107         sock->ops = pnp->ops;
108         sk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
109         sk->sk_protocol = protocol;
110         pn = pn_sk(sk);
111         pn->sobject = 0;
112         pn->resource = 0;
113         sk->sk_prot->init(sk);
114         err = 0;
115
116 out:
117         phonet_proto_put(pnp);
118         return err;
119 }
120
121 static struct net_proto_family phonet_proto_family = {
122         .family = PF_PHONET,
123         .create = pn_socket_create,
124         .owner = THIS_MODULE,
125 };
126
127 /* Phonet device header operations */
128 static int pn_header_create(struct sk_buff *skb, struct net_device *dev,
129                                 unsigned short type, const void *daddr,
130                                 const void *saddr, unsigned len)
131 {
132         u8 *media = skb_push(skb, 1);
133
134         if (type != ETH_P_PHONET)
135                 return -1;
136
137         if (!saddr)
138                 saddr = dev->dev_addr;
139         *media = *(const u8 *)saddr;
140         return 1;
141 }
142
143 static int pn_header_parse(const struct sk_buff *skb, unsigned char *haddr)
144 {
145         const u8 *media = skb_mac_header(skb);
146         *haddr = *media;
147         return 1;
148 }
149
150 struct header_ops phonet_header_ops = {
151         .create = pn_header_create,
152         .parse = pn_header_parse,
153 };
154 EXPORT_SYMBOL(phonet_header_ops);
155
156 /*
157  * Prepends an ISI header and sends a datagram.
158  */
159 static int pn_send(struct sk_buff *skb, struct net_device *dev,
160                         u16 dst, u16 src, u8 res, u8 irq)
161 {
162         struct phonethdr *ph;
163         int err;
164
165         if (skb->len + 2 > 0xffff /* Phonet length field limit */ ||
166             skb->len + sizeof(struct phonethdr) > dev->mtu) {
167                 err = -EMSGSIZE;
168                 goto drop;
169         }
170
171         skb_reset_transport_header(skb);
172         WARN_ON(skb_headroom(skb) & 1); /* HW assumes word alignment */
173         skb_push(skb, sizeof(struct phonethdr));
174         skb_reset_network_header(skb);
175         ph = pn_hdr(skb);
176         ph->pn_rdev = pn_dev(dst);
177         ph->pn_sdev = pn_dev(src);
178         ph->pn_res = res;
179         ph->pn_length = __cpu_to_be16(skb->len + 2 - sizeof(*ph));
180         ph->pn_robj = pn_obj(dst);
181         ph->pn_sobj = pn_obj(src);
182
183         skb->protocol = htons(ETH_P_PHONET);
184         skb->priority = 0;
185         skb->dev = dev;
186
187         if (pn_addr(src) == pn_addr(dst)) {
188                 skb_reset_mac_header(skb);
189                 skb->pkt_type = PACKET_LOOPBACK;
190                 skb_orphan(skb);
191                 if (irq)
192                         netif_rx(skb);
193                 else
194                         netif_rx_ni(skb);
195                 err = 0;
196         } else {
197                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
198                                         NULL, NULL, skb->len);
199                 if (err < 0) {
200                         err = -EHOSTUNREACH;
201                         goto drop;
202                 }
203                 err = dev_queue_xmit(skb);
204         }
205
206         return err;
207 drop:
208         kfree_skb(skb);
209         return err;
210 }
211
212 static int pn_raw_send(const void *data, int len, struct net_device *dev,
213                         u16 dst, u16 src, u8 res)
214 {
215         struct sk_buff *skb = alloc_skb(MAX_PHONET_HEADER + len, GFP_ATOMIC);
216         if (skb == NULL)
217                 return -ENOMEM;
218
219         skb_reserve(skb, MAX_PHONET_HEADER);
220         __skb_put(skb, len);
221         skb_copy_to_linear_data(skb, data, len);
222         return pn_send(skb, dev, dst, src, res, 1);
223 }
224
225 /*
226  * Create a Phonet header for the skb and send it out. Returns
227  * non-zero error code if failed. The skb is freed then.
228  */
229 int pn_skb_send(struct sock *sk, struct sk_buff *skb,
230                 const struct sockaddr_pn *target)
231 {
232         struct net_device *dev;
233         struct pn_sock *pn = pn_sk(sk);
234         int err;
235         u16 src;
236         u8 daddr = pn_sockaddr_get_addr(target), saddr = PN_NO_ADDR;
237
238         err = -EHOSTUNREACH;
239         if (sk->sk_bound_dev_if)
240                 dev = dev_get_by_index(sock_net(sk), sk->sk_bound_dev_if);
241         else
242                 dev = phonet_device_get(sock_net(sk));
243         if (!dev || !(dev->flags & IFF_UP))
244                 goto drop;
245
246         saddr = phonet_address_get(dev, daddr);
247         if (saddr == PN_NO_ADDR)
248                 goto drop;
249
250         src = pn->sobject;
251         if (!pn_addr(src))
252                 src = pn_object(saddr, pn_obj(src));
253
254         err = pn_send(skb, dev, pn_sockaddr_get_object(target),
255                         src, pn_sockaddr_get_resource(target), 0);
256         dev_put(dev);
257         return err;
258
259 drop:
260         kfree_skb(skb);
261         if (dev)
262                 dev_put(dev);
263         return err;
264 }
265 EXPORT_SYMBOL(pn_skb_send);
266
267 /* Do not send an error message in response to an error message */
268 static inline int can_respond(struct sk_buff *skb)
269 {
270         const struct phonethdr *ph;
271         const struct phonetmsg *pm;
272         u8 submsg_id;
273
274         if (!pskb_may_pull(skb, 3))
275                 return 0;
276
277         ph = pn_hdr(skb);
278         if (ph->pn_res == PN_PREFIX && !pskb_may_pull(skb, 5))
279                 return 0;
280         if (ph->pn_res == PN_COMMGR) /* indications */
281                 return 0;
282
283         ph = pn_hdr(skb); /* re-acquires the pointer */
284         pm = pn_msg(skb);
285         if (pm->pn_msg_id != PN_COMMON_MESSAGE)
286                 return 1;
287         submsg_id = (ph->pn_res == PN_PREFIX)
288                 ? pm->pn_e_submsg_id : pm->pn_submsg_id;
289         if (submsg_id != PN_COMM_ISA_ENTITY_NOT_REACHABLE_RESP &&
290                 pm->pn_e_submsg_id != PN_COMM_SERVICE_NOT_IDENTIFIED_RESP)
291                 return 1;
292         return 0;
293 }
294
295 static int send_obj_unreachable(struct sk_buff *rskb)
296 {
297         const struct phonethdr *oph = pn_hdr(rskb);
298         const struct phonetmsg *opm = pn_msg(rskb);
299         struct phonetmsg resp;
300
301         memset(&resp, 0, sizeof(resp));
302         resp.pn_trans_id = opm->pn_trans_id;
303         resp.pn_msg_id = PN_COMMON_MESSAGE;
304         if (oph->pn_res == PN_PREFIX) {
305                 resp.pn_e_res_id = opm->pn_e_res_id;
306                 resp.pn_e_submsg_id = PN_COMM_ISA_ENTITY_NOT_REACHABLE_RESP;
307                 resp.pn_e_orig_msg_id = opm->pn_msg_id;
308                 resp.pn_e_status = 0;
309         } else {
310                 resp.pn_submsg_id = PN_COMM_ISA_ENTITY_NOT_REACHABLE_RESP;
311                 resp.pn_orig_msg_id = opm->pn_msg_id;
312                 resp.pn_status = 0;
313         }
314         return pn_raw_send(&resp, sizeof(resp), rskb->dev,
315                                 pn_object(oph->pn_sdev, oph->pn_sobj),
316                                 pn_object(oph->pn_rdev, oph->pn_robj),
317                                 oph->pn_res);
318 }
319
320 static int send_reset_indications(struct sk_buff *rskb)
321 {
322         struct phonethdr *oph = pn_hdr(rskb);
323         static const u8 data[4] = {
324                 0x00 /* trans ID */, 0x10 /* subscribe msg */,
325                 0x00 /* subscription count */, 0x00 /* dummy */
326         };
327
328         return pn_raw_send(data, sizeof(data), rskb->dev,
329                                 pn_object(oph->pn_sdev, 0x00),
330                                 pn_object(oph->pn_rdev, oph->pn_robj),
331                                 PN_COMMGR);
332 }
333
334
335 /* packet type functions */
336
337 /*
338  * Stuff received packets to associated sockets.
339  * On error, returns non-zero and releases the skb.
340  */
341 static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
342                         struct packet_type *pkttype,
343                         struct net_device *orig_dev)
344 {
345         struct net *net = dev_net(dev);
346         struct phonethdr *ph;
347         struct sockaddr_pn sa;
348         u16 len;
349
350         /* check we have at least a full Phonet header */
351         if (!pskb_pull(skb, sizeof(struct phonethdr)))
352                 goto out;
353
354         /* check that the advertised length is correct */
355         ph = pn_hdr(skb);
356         len = get_unaligned_be16(&ph->pn_length);
357         if (len < 2)
358                 goto out;
359         len -= 2;
360         if ((len > skb->len) || pskb_trim(skb, len))
361                 goto out;
362         skb_reset_transport_header(skb);
363
364         pn_skb_get_dst_sockaddr(skb, &sa);
365
366         /* check if we are the destination */
367         if (phonet_address_lookup(net, pn_sockaddr_get_addr(&sa)) == 0) {
368                 /* Phonet packet input */
369                 struct sock *sk = pn_find_sock_by_sa(net, &sa);
370
371                 if (sk)
372                         return sk_receive_skb(sk, skb, 0);
373
374                 if (can_respond(skb)) {
375                         send_obj_unreachable(skb);
376                         send_reset_indications(skb);
377                 }
378         }
379
380 out:
381         kfree_skb(skb);
382         return NET_RX_DROP;
383 }
384
385 static struct packet_type phonet_packet_type __read_mostly = {
386         .type = cpu_to_be16(ETH_P_PHONET),
387         .func = phonet_rcv,
388 };
389
390 int __init_or_module phonet_proto_register(int protocol,
391                                                 struct phonet_protocol *pp)
392 {
393         int err = 0;
394
395         if (protocol >= PHONET_NPROTO)
396                 return -EINVAL;
397
398         err = proto_register(pp->prot, 1);
399         if (err)
400                 return err;
401
402         spin_lock(&proto_tab_lock);
403         if (proto_tab[protocol])
404                 err = -EBUSY;
405         else
406                 proto_tab[protocol] = pp;
407         spin_unlock(&proto_tab_lock);
408
409         return err;
410 }
411 EXPORT_SYMBOL(phonet_proto_register);
412
413 void phonet_proto_unregister(int protocol, struct phonet_protocol *pp)
414 {
415         spin_lock(&proto_tab_lock);
416         BUG_ON(proto_tab[protocol] != pp);
417         proto_tab[protocol] = NULL;
418         spin_unlock(&proto_tab_lock);
419         proto_unregister(pp->prot);
420 }
421 EXPORT_SYMBOL(phonet_proto_unregister);
422
423 /* Module registration */
424 static int __init phonet_init(void)
425 {
426         int err;
427
428         err = phonet_device_init();
429         if (err)
430                 return err;
431
432         err = sock_register(&phonet_proto_family);
433         if (err) {
434                 printk(KERN_ALERT
435                         "phonet protocol family initialization failed\n");
436                 goto err_sock;
437         }
438
439         dev_add_pack(&phonet_packet_type);
440         phonet_sysctl_init();
441
442         err = isi_register();
443         if (err)
444                 goto err;
445         return 0;
446
447 err:
448         phonet_sysctl_exit();
449         sock_unregister(PF_PHONET);
450         dev_remove_pack(&phonet_packet_type);
451 err_sock:
452         phonet_device_exit();
453         return err;
454 }
455
456 static void __exit phonet_exit(void)
457 {
458         isi_unregister();
459         phonet_sysctl_exit();
460         sock_unregister(PF_PHONET);
461         dev_remove_pack(&phonet_packet_type);
462         phonet_device_exit();
463 }
464
465 module_init(phonet_init);
466 module_exit(phonet_exit);
467 MODULE_DESCRIPTION("Phonet protocol stack for Linux");
468 MODULE_LICENSE("GPL");
469 MODULE_ALIAS_NETPROTO(PF_PHONET);