/*    BNEP implementation for Linux Bluetooth stack (BlueZ).   Copyright (C) 2001-2002 Inventel Systemes   Written 2001-2002 by	Cl閙ent Moreau <clement.moreau@inventel.fr>	David Libault  <david.libault@inventel.fr>   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>   This program is free software; you can redistribute it and/or modify   it under the terms of the GNU General Public License version 2 as   published by the Free Software Foundation;   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS    SOFTWARE IS DISCLAIMED.*//* * $Id: core.c,v 1.20 2002/08/04 21:23:58 maxk Exp $ */ #include <linux/config.h>#include <linux/module.h>#include <linux/kernel.h>#include <linux/sched.h>#include <linux/signal.h>#include <linux/init.h>#include <linux/wait.h>#include <linux/errno.h>#include <linux/smp_lock.h>#include <linux/net.h>#include <net/sock.h>#include <linux/socket.h>#include <linux/file.h>#include <linux/netdevice.h>#include <linux/etherdevice.h>#include <linux/skbuff.h>#include <asm/unaligned.h>#include <net/bluetooth/bluetooth.h>#include <net/bluetooth/l2cap.h>#include "bnep.h"#ifndef CONFIG_BT_BNEP_DEBUG#undef  BT_DBG#define BT_DBG(D...)#endif#define VERSION "1.2"static LIST_HEAD(bnep_session_list);static DECLARE_RWSEM(bnep_session_sem);static struct bnep_session *__bnep_get_session(u8 *dst){	struct bnep_session *s;	struct list_head *p;	BT_DBG("");	list_for_each(p, &bnep_session_list) {		s = list_entry(p, struct bnep_session, list);			if (!memcmp(dst, s->eh.h_source, ETH_ALEN))			return s;	}	return NULL;}static void __bnep_link_session(struct bnep_session *s){	/* It's safe to call __module_get() here because sessions are added	   by the socket layer which has to hold the refference to this module.	 */	__module_get(THIS_MODULE);	list_add(&s->list, &bnep_session_list);	}static void __bnep_unlink_session(struct bnep_session *s){	list_del(&s->list);	module_put(THIS_MODULE);}static int bnep_send(struct bnep_session *s, void *data, size_t len){	struct socket *sock = s->sock;	struct kvec iv = { data, len };	return kernel_sendmsg(sock, &s->msg, &iv, 1, len);}static int bnep_send_rsp(struct bnep_session *s, u8 ctrl, u16 resp){	struct bnep_control_rsp rsp;	rsp.type = BNEP_CONTROL;	rsp.ctrl = ctrl;	rsp.resp = htons(resp);	return bnep_send(s, &rsp, sizeof(rsp));}#ifdef CONFIG_BT_BNEP_PROTO_FILTERstatic inline void bnep_set_default_proto_filter(struct bnep_session *s){	/* (IPv4, ARP)  */	s->proto_filter[0].start = htons(0x0800);	s->proto_filter[0].end   = htons(0x0806);	/* (RARP, AppleTalk) */	s->proto_filter[1].start = htons(0x8035);	s->proto_filter[1].end   = htons(0x80F3);	/* (IPX, IPv6) */	s->proto_filter[2].start = htons(0x8137);	s->proto_filter[2].end   = htons(0x86DD);}#endifstatic int bnep_ctrl_set_netfilter(struct bnep_session *s, u16 *data, int len){	int n;	if (len < 2)		return -EILSEQ;	n = ntohs(get_unaligned(data));	data++; len -= 2;	if (len < n)		return -EILSEQ;	BT_DBG("filter len %d", n);#ifdef CONFIG_BT_BNEP_PROTO_FILTER	n /= 4;	if (n <= BNEP_MAX_PROTO_FILTERS) {		struct bnep_proto_filter *f = s->proto_filter;		int i;		for (i = 0; i < n; i++) {			f[i].start = get_unaligned(data++);			f[i].end   = get_unaligned(data++);			BT_DBG("proto filter start %d end %d",				f[i].start, f[i].end);		}		if (i < BNEP_MAX_PROTO_FILTERS)			memset(f + i, 0, sizeof(*f));		if (n == 0)			bnep_set_default_proto_filter(s);		bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_SUCCESS);	} else {		bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_FILTER_LIMIT_REACHED);	}#else	bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_FILTER_UNSUPPORTED_REQ);#endif	return 0;}static int bnep_ctrl_set_mcfilter(struct bnep_session *s, u8 *data, int len){	int n;	if (len < 2)		return -EILSEQ;	n = ntohs(get_unaligned((u16 *) data)); 	data += 2; len -= 2;	if (len < n)		return -EILSEQ;	BT_DBG("filter len %d", n);#ifdef CONFIG_BT_BNEP_MC_FILTER	n /= (ETH_ALEN * 2);	if (n > 0) {		s->mc_filter = 0;		/* Always send broadcast */		set_bit(bnep_mc_hash(s->dev->broadcast), (ulong *) &s->mc_filter);		/* Add address ranges to the multicast hash */		for (; n > 0; n--) {			u8 a1[6], *a2;			memcpy(a1, data, ETH_ALEN); data += ETH_ALEN;			a2 = data; data += ETH_ALEN;				BT_DBG("mc filter %s -> %s",				batostr((void *) a1), batostr((void *) a2));			#define INCA(a) { int i = 5; while (i >=0 && ++a[i--] == 0); }			/* Iterate from a1 to a2 */			set_bit(bnep_mc_hash(a1), (ulong *) &s->mc_filter);			while (memcmp(a1, a2, 6) < 0 && s->mc_filter != ~0LL) {				INCA(a1);				set_bit(bnep_mc_hash(a1), (ulong *) &s->mc_filter);			}		}	}	BT_DBG("mc filter hash 0x%llx", s->mc_filter);	bnep_send_rsp(s, BNEP_FILTER_MULTI_ADDR_RSP, BNEP_SUCCESS);#else	bnep_send_rsp(s, BNEP_FILTER_MULTI_ADDR_RSP, BNEP_FILTER_UNSUPPORTED_REQ);#endif	return 0;}static int bnep_rx_control(struct bnep_session *s, void *data, int len){	u8  cmd = *(u8 *)data;	int err = 0;	data++; len--;	switch (cmd) {	case BNEP_CMD_NOT_UNDERSTOOD:	case BNEP_SETUP_CONN_REQ:	case BNEP_SETUP_CONN_RSP:	case BNEP_FILTER_NET_TYPE_RSP:	case BNEP_FILTER_MULTI_ADDR_RSP:		/* Ignore these for now */		break;	case BNEP_FILTER_NET_TYPE_SET:		err = bnep_ctrl_set_netfilter(s, data, len);		break;	case BNEP_FILTER_MULTI_ADDR_SET:		err = bnep_ctrl_set_mcfilter(s, data, len);		break;	default: {			u8 pkt[3];			pkt[0] = BNEP_CONTROL;			pkt[1] = BNEP_CMD_NOT_UNDERSTOOD;			pkt[2] = cmd;			bnep_send(s, pkt, sizeof(pkt));		}		break;	}	return err;}static int bnep_rx_extension(struct bnep_session *s, struct sk_buff *skb){	struct bnep_ext_hdr *h;	int err = 0;	do {		h = (void *) skb->data;		if (!skb_pull(skb, sizeof(*h))) {			err = -EILSEQ;			break;		}		BT_DBG("type 0x%x len %d", h->type, h->len);			switch (h->type & BNEP_TYPE_MASK) {		case BNEP_EXT_CONTROL:			bnep_rx_control(s, skb->data, skb->len);			break;		default:			/* Unknown extension, skip it. */			break;		}		if (!skb_pull(skb, h->len)) {			err = -EILSEQ;			break;		}	} while (!err && (h->type & BNEP_EXT_HEADER));		return err;}static u8 __bnep_rx_hlen[] = {	ETH_HLEN,     /* BNEP_GENERAL */	0,            /* BNEP_CONTROL */	2,            /* BNEP_COMPRESSED */	ETH_ALEN + 2, /* BNEP_COMPRESSED_SRC_ONLY */	ETH_ALEN + 2  /* BNEP_COMPRESSED_DST_ONLY */};#define BNEP_RX_TYPES	(sizeof(__bnep_rx_hlen) - 1)static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb){	struct net_device *dev = s->dev;	struct sk_buff *nskb;	u8 type;	dev->last_rx = jiffies;	s->stats.rx_bytes += skb->len;	type = *(u8 *) skb->data; skb_pull(skb, 1);	if ((type & BNEP_TYPE_MASK) > BNEP_RX_TYPES)		goto badframe;		if ((type & BNEP_TYPE_MASK) == BNEP_CONTROL) {		bnep_rx_control(s, skb->data, skb->len);		kfree_skb(skb);		return 0;	}	skb->mac.raw = skb->data;	/* Verify and pull out header */	if (!skb_pull(skb, __bnep_rx_hlen[type & BNEP_TYPE_MASK]))		goto badframe;	s->eh.h_proto = get_unaligned((u16 *) (skb->data - 2));	if (type & BNEP_EXT_HEADER) {		if (bnep_rx_extension(s, skb) < 0)			goto badframe;	}	/* Strip 802.1p header */	if (ntohs(s->eh.h_proto) == 0x8100) {		if (!skb_pull(skb, 4))			goto badframe;		s->eh.h_proto = get_unaligned((u16 *) (skb->data - 2));	}		/* We have to alloc new skb and copy data here :(. Because original skb	 * may not be modified and because of the alignment requirements. */	nskb = alloc_skb(2 + ETH_HLEN + skb->len, GFP_KERNEL);	if (!nskb) {		s->stats.rx_dropped++;		kfree_skb(skb);		return -ENOMEM;	}	skb_reserve(nskb, 2);