Revision control
Copy as Markdown
// Copyright (C) 2016 The Qt Company Ltd.
// Copyright (C) 2016 Javier S. Pedro <maemo@javispedro.com>
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
// Qt-Security score:critical reason:data-parser
#include "hcimanager_p.h"
#include "qbluetoothsocketbase_p.h"
#include "qlowenergyconnectionparameters.h"
#include <QtCore/qloggingcategory.h>
#include <cstring>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/uio.h>
#include <unistd.h>
QT_BEGIN_NAMESPACE
Q_DECLARE_LOGGING_CATEGORY(QT_BT_BLUEZ)
HciManager::HciManager(const QBluetoothAddress& deviceAdapter) :
QObject(nullptr), hciSocket(-1), hciDev(-1)
{
hciSocket = ::socket(AF_BLUETOOTH, SOCK_RAW | SOCK_CLOEXEC, BTPROTO_HCI);
if (hciSocket < 0) {
qCWarning(QT_BT_BLUEZ) << "Cannot open HCI socket";
return; //TODO error report
}
hciDev = hciForAddress(deviceAdapter);
if (hciDev < 0) {
qCWarning(QT_BT_BLUEZ) << "Cannot find hci dev for" << deviceAdapter.toString();
close(hciSocket);
hciSocket = -1;
return;
}
struct sockaddr_hci addr;
memset(&addr, 0, sizeof(struct sockaddr_hci));
addr.hci_dev = hciDev;
addr.hci_family = AF_BLUETOOTH;
if (::bind(hciSocket, (struct sockaddr *) (&addr), sizeof(addr)) < 0) {
qCWarning(QT_BT_BLUEZ) << "HCI bind failed:" << strerror(errno);
close(hciSocket);
hciSocket = hciDev = -1;
return;
}
notifier = new QSocketNotifier(hciSocket, QSocketNotifier::Read, this);
connect(notifier, SIGNAL(activated(QSocketDescriptor)), this, SLOT(_q_readNotify()));
}
HciManager::~HciManager()
{
if (hciSocket >= 0)
::close(hciSocket);
}
bool HciManager::isValid() const
{
if (hciSocket && hciDev >= 0)
return true;
return false;
}
int HciManager::hciForAddress(const QBluetoothAddress &deviceAdapter)
{
if (hciSocket < 0)
return -1;
bdaddr_t adapter;
convertAddress(deviceAdapter.toUInt64(), adapter.b);
struct hci_dev_req *devRequest = nullptr;
struct hci_dev_list_req *devRequestList = nullptr;
struct hci_dev_info devInfo;
const int devListSize = sizeof(struct hci_dev_list_req)
+ HCI_MAX_DEV * sizeof(struct hci_dev_req);
devRequestList = (hci_dev_list_req *) malloc(devListSize);
if (!devRequestList)
return -1;
QScopedPointer<hci_dev_list_req, QScopedPointerPodDeleter> p(devRequestList);
memset(p.data(), 0, devListSize);
p->dev_num = HCI_MAX_DEV;
devRequest = p->dev_req;
if (ioctl(hciSocket, HCIGETDEVLIST, devRequestList) < 0)
return -1;
for (int i = 0; i < devRequestList->dev_num; i++) {
devInfo.dev_id = (devRequest+i)->dev_id;
if (ioctl(hciSocket, HCIGETDEVINFO, &devInfo) < 0) {
continue;
}
int result = memcmp(&adapter, &devInfo.bdaddr, sizeof(bdaddr_t));
if (result == 0 || deviceAdapter.isNull()) // addresses match
return devInfo.dev_id;
}
return -1;
}
/*
* Returns true if \a event was successfully enabled
*/
bool HciManager::monitorEvent(HciManager::HciEvent event)
{
if (!isValid())
return false;
// this event is already enabled
// TODO runningEvents does not seem to be used
if (runningEvents.contains(event))
return true;
hci_filter filter;
socklen_t length = sizeof(hci_filter);
if (getsockopt(hciSocket, SOL_HCI, HCI_FILTER, &filter, &length) < 0) {
qCWarning(QT_BT_BLUEZ) << "Cannot retrieve HCI filter settings";
return false;
}
hci_filter_set_ptype(HCI_EVENT_PKT, &filter);
hci_filter_set_event(static_cast<int>(event), &filter);
//hci_filter_all_events(&filter);
if (setsockopt(hciSocket, SOL_HCI, HCI_FILTER, &filter, sizeof(hci_filter)) < 0) {
qCWarning(QT_BT_BLUEZ) << "Could not set HCI socket options:" << strerror(errno);
return false;
}
return true;
}
bool HciManager::monitorAclPackets()
{
if (!isValid())
return false;
hci_filter filter;
socklen_t length = sizeof(hci_filter);
if (getsockopt(hciSocket, SOL_HCI, HCI_FILTER, &filter, &length) < 0) {
qCWarning(QT_BT_BLUEZ) << "Cannot retrieve HCI filter settings";
return false;
}
hci_filter_set_ptype(HCI_ACL_PKT, &filter);
hci_filter_all_events(&filter);
if (setsockopt(hciSocket, SOL_HCI, HCI_FILTER, &filter, sizeof(hci_filter)) < 0) {
qCWarning(QT_BT_BLUEZ) << "Could not set HCI socket options:" << strerror(errno);
return false;
}
return true;
}
bool HciManager::sendCommand(QBluezConst::OpCodeGroupField ogf, QBluezConst::OpCodeCommandField ocf, const QByteArray ¶meters)
{
qCDebug(QT_BT_BLUEZ) << "sending command; ogf:" << ogf << "ocf:" << ocf;
quint8 packetType = HCI_COMMAND_PKT;
hci_command_hdr command = {
opCodePack(ogf, ocf),
static_cast<uint8_t>(parameters.size())
};
static_assert(sizeof command == 3, "unexpected struct size");
struct iovec iv[3];
iv[0].iov_base = &packetType;
iv[0].iov_len = 1;
iv[1].iov_base = &command;
iv[1].iov_len = sizeof command;
int ivn = 2;
if (!parameters.isEmpty()) {
iv[2].iov_base = const_cast<char *>(parameters.constData()); // const_cast is safe, since iov_base will not get modified.
iv[2].iov_len = parameters.size();
++ivn;
}
while (writev(hciSocket, iv, ivn) < 0) {
if (errno == EAGAIN || errno == EINTR)
continue;
qCDebug(QT_BT_BLUEZ()) << "hci command failure:" << strerror(errno);
return false;
}
qCDebug(QT_BT_BLUEZ) << "command sent successfully";
return true;
}
/*
* Unsubscribe from all events
*/
void HciManager::stopEvents()
{
if (!isValid())
return;
hci_filter filter;
hci_filter_clear(&filter);
if (setsockopt(hciSocket, SOL_HCI, HCI_FILTER, &filter, sizeof(hci_filter)) < 0) {
qCWarning(QT_BT_BLUEZ) << "Could not clear HCI socket options:" << strerror(errno);
return;
}
runningEvents.clear();
}
QBluetoothAddress HciManager::addressForConnectionHandle(quint16 handle) const
{
if (!isValid())
return QBluetoothAddress();
hci_conn_info *info;
hci_conn_list_req *infoList;
const int maxNoOfConnections = 20;
infoList = (hci_conn_list_req *)
malloc(sizeof(hci_conn_list_req) + maxNoOfConnections * sizeof(hci_conn_info));
if (!infoList)
return QBluetoothAddress();
QScopedPointer<hci_conn_list_req, QScopedPointerPodDeleter> p(infoList);
p->conn_num = maxNoOfConnections;
p->dev_id = hciDev;
info = p->conn_info;
if (ioctl(hciSocket, HCIGETCONNLIST, (void *) infoList) < 0) {
qCWarning(QT_BT_BLUEZ) << "Cannot retrieve connection list";
return QBluetoothAddress();
}
for (int i = 0; i < infoList->conn_num; i++) {
if (info[i].handle == handle)
return QBluetoothAddress(convertAddress(info[i].bdaddr.b));
}
return QBluetoothAddress();
}
QList<quint16> HciManager::activeLowEnergyConnections() const
{
if (!isValid())
return QList<quint16>();
hci_conn_info *info;
hci_conn_list_req *infoList;
const int maxNoOfConnections = 20;
infoList = (hci_conn_list_req *)
malloc(sizeof(hci_conn_list_req) + maxNoOfConnections * sizeof(hci_conn_info));
if (!infoList)
return QList<quint16>();
QScopedPointer<hci_conn_list_req, QScopedPointerPodDeleter> p(infoList);
p->conn_num = maxNoOfConnections;
p->dev_id = hciDev;
info = p->conn_info;
if (ioctl(hciSocket, HCIGETCONNLIST, (void *) infoList) < 0) {
qCWarning(QT_BT_BLUEZ) << "Cannot retrieve connection list";
return QList<quint16>();
}
QList<quint16> activeLowEnergyHandles;
for (int i = 0; i < infoList->conn_num; i++) {
switch (info[i].type) {
case SCO_LINK:
case ACL_LINK:
case ESCO_LINK:
continue;
case LE_LINK:
activeLowEnergyHandles.append(info[i].handle);
break;
default:
qCWarning(QT_BT_BLUEZ) << "Unknown active connection type:" << Qt::hex << info[i].type;
break;
}
}
return activeLowEnergyHandles;
}
quint16 forceIntervalIntoRange(double connectionInterval)
{
return qMin<double>(qMax<double>(7.5, connectionInterval), 4000) / 1.25;
}
struct ConnectionUpdateData {
quint16 minInterval;
quint16 maxInterval;
quint16 slaveLatency;
quint16 timeout;
};
ConnectionUpdateData connectionUpdateData(const QLowEnergyConnectionParameters ¶ms)
{
ConnectionUpdateData data;
const quint16 minInterval = forceIntervalIntoRange(params.minimumInterval());
const quint16 maxInterval = forceIntervalIntoRange(params.maximumInterval());
data.minInterval = qToLittleEndian(minInterval);
data.maxInterval = qToLittleEndian(maxInterval);
const quint16 latency = qMax<quint16>(0, qMin<quint16>(params.latency(), 499));
data.slaveLatency = qToLittleEndian(latency);
const quint16 timeout
= qMax<quint16>(100, qMin<quint16>(32000, params.supervisionTimeout())) / 10;
data.timeout = qToLittleEndian(timeout);
return data;
}
bool HciManager::sendConnectionUpdateCommand(quint16 handle,
const QLowEnergyConnectionParameters ¶ms)
{
struct CommandParams {
quint16 handle;
ConnectionUpdateData data;
quint16 minCeLength;
quint16 maxCeLength;
} commandParams;
commandParams.handle = qToLittleEndian(handle);
commandParams.data = connectionUpdateData(params);
commandParams.minCeLength = 0;
commandParams.maxCeLength = qToLittleEndian(quint16(0xffff));
const QByteArray data = QByteArray::fromRawData(reinterpret_cast<char *>(&commandParams),
sizeof commandParams);
return sendCommand(QBluezConst::OgfLinkControl, QBluezConst::OcfLeConnectionUpdate, data);
}
bool HciManager::sendConnectionParameterUpdateRequest(quint16 handle,
const QLowEnergyConnectionParameters ¶ms)
{
ConnectionUpdateData connUpdateData = connectionUpdateData(params);
// Vol 3, part A, 4
struct SignalingPacket {
quint8 code;
quint8 identifier;
quint16 length;
} signalingPacket;
signalingPacket.code = 0x12;
signalingPacket.identifier = ++sigPacketIdentifier;
const quint16 sigPacketLen = sizeof connUpdateData;
signalingPacket.length = qToLittleEndian(sigPacketLen);
L2CapHeader l2CapHeader;
const quint16 l2CapHeaderLen = sizeof signalingPacket + sigPacketLen;
l2CapHeader.length = qToLittleEndian(l2CapHeaderLen);
l2CapHeader.channelId = qToLittleEndian(quint16(SIGNALING_CHANNEL_ID));
// Vol 2, part E, 5.4.2
AclData aclData;
aclData.handle = qToLittleEndian(handle); // Works because the next two values are zero.
aclData.pbFlag = 0;
aclData.bcFlag = 0;
aclData.dataLen = qToLittleEndian(quint16(sizeof l2CapHeader + l2CapHeaderLen));
struct iovec iv[5];
quint8 packetType = HCI_ACL_PKT;
iv[0].iov_base = &packetType;
iv[0].iov_len = 1;
iv[1].iov_base = &aclData;
iv[1].iov_len = sizeof aclData;
iv[2].iov_base = &l2CapHeader;
iv[2].iov_len = sizeof l2CapHeader;
iv[3].iov_base = &signalingPacket;
iv[3].iov_len = sizeof signalingPacket;
iv[4].iov_base = &connUpdateData;
iv[4].iov_len = sizeof connUpdateData;
while (writev(hciSocket, iv, sizeof iv / sizeof *iv) < 0) {
if (errno == EAGAIN || errno == EINTR)
continue;
qCDebug(QT_BT_BLUEZ()) << "failure writing HCI ACL packet:" << strerror(errno);
return false;
}
qCDebug(QT_BT_BLUEZ) << "Connection Update Request packet sent successfully";
return true;
}
/*!
* Process all incoming HCI events. Function cannot process anything else but events.
*/
void HciManager::_q_readNotify()
{
unsigned char buffer[qMax<int>(HCI_MAX_EVENT_SIZE, sizeof(AclData))];
const auto size = ::read(hciSocket, buffer, sizeof(buffer));
if (size < 0) {
if (errno != EAGAIN && errno != EINTR)
qCWarning(QT_BT_BLUEZ) << "Failed reading HCI events:" << qt_error_string(errno);
return;
}
if (size == 0) {
qCWarning(QT_BT_BLUEZ) << "No data when trying to read HCI events";
return;
}
switch (buffer[0]) {
case HCI_EVENT_PKT:
handleHciEventPacket(buffer + 1, size - 1);
break;
case HCI_ACL_PKT:
handleHciAclPacket(buffer + 1, size - 1);
break;
default:
qCWarning(QT_BT_BLUEZ) << "Ignoring unexpected HCI packet type" << buffer[0];
}
}
void HciManager::handleHciEventPacket(const quint8 *data, int size)
{
if (size < HCI_EVENT_HDR_SIZE) {
qCWarning(QT_BT_BLUEZ) << "Unexpected HCI event packet size:" << size;
return;
}
hci_event_hdr *header = (hci_event_hdr *) data;
size -= HCI_EVENT_HDR_SIZE;
data += HCI_EVENT_HDR_SIZE;
if (header->plen != size) {
qCWarning(QT_BT_BLUEZ) << "Invalid HCI event packet size";
return;
}
qCDebug(QT_BT_BLUEZ) << "HCI event triggered, type:" << (HciManager::HciEvent)header->evt
<< "type code:" << Qt::hex << header->evt;
switch ((HciManager::HciEvent)header->evt) {
case HciEvent::EVT_ENCRYPT_CHANGE: {
if (size < static_cast<int>(sizeof(evt_encrypt_change))) {
qCWarning(QT_BT_BLUEZ) << "EVT_ENCRYPT_CHANGE: unexpected event packet size";
return;
}
const evt_encrypt_change *event = reinterpret_cast<const evt_encrypt_change *>(data);
qCDebug(QT_BT_BLUEZ) << "HCI Encrypt change, status:"
<< (event->status == 0 ? "Success" : "Failed")
<< "handle:" << Qt::hex << event->handle
<< "encrypt:" << event->encrypt;
QBluetoothAddress remoteDevice = addressForConnectionHandle(event->handle);
if (!remoteDevice.isNull())
emit encryptionChangedEvent(remoteDevice, event->status == 0);
} break;
case HciEvent::EVT_CMD_COMPLETE: {
constexpr auto eventSize = sizeof(evt_cmd_complete);
static_assert(eventSize == 3, "unexpected struct size");
// There is always a status byte right after the generic structure,
// that's why we need +1 here
if (size < static_cast<int>(eventSize + 1)) {
qCWarning(QT_BT_BLUEZ) << "EVT_CMD_COMPLETE: unexpected event packet size";
return;
}
auto * const event = reinterpret_cast<const evt_cmd_complete *>(data);
// Status byte is right after then event struct
const quint8 status = data[eventSize];
const auto additionalData = QByteArray(reinterpret_cast<const char *>(data)
+ eventSize + 1, size - eventSize - 1);
emit commandCompleted(event->opcode, status, additionalData);
} break;
case HciEvent::EVT_LE_META_EVENT:
handleLeMetaEvent(data, size);
break;
default:
break;
}
}
void HciManager::handleHciAclPacket(const quint8 *data, int size)
{
if (size < int(sizeof(AclData))) {
qCWarning(QT_BT_BLUEZ) << "Unexpected HCI ACL packet size";
return;
}
quint16 rawAclData[sizeof(AclData) / sizeof(quint16)];
rawAclData[0] = bt_get_le16(data);
rawAclData[1] = bt_get_le16(data + sizeof(quint16));
const AclData *aclData = reinterpret_cast<AclData *>(rawAclData);
data += sizeof *aclData;
size -= sizeof *aclData;
// Consider only directed, complete messages.
if ((aclData->pbFlag != 0 && aclData->pbFlag != 2) || aclData->bcFlag != 0)
return;
if (size < aclData->dataLen) {
qCWarning(QT_BT_BLUEZ) << "HCI ACL packet data size" << size
<< "is smaller than specified size" << aclData->dataLen;
return;
}
// qCDebug(QT_BT_BLUEZ) << "handle:" << aclData->handle << "PB:" << aclData->pbFlag
// << "BC:" << aclData->bcFlag << "data len:" << aclData->dataLen;
if (size < int(sizeof(L2CapHeader))) {
qCWarning(QT_BT_BLUEZ) << "Unexpected HCI ACL packet size";
return;
}
L2CapHeader l2CapHeader = *reinterpret_cast<const L2CapHeader*>(data);
l2CapHeader.channelId = qFromLittleEndian(l2CapHeader.channelId);
l2CapHeader.length = qFromLittleEndian(l2CapHeader.length);
data += sizeof l2CapHeader;
size -= sizeof l2CapHeader;
if (size < l2CapHeader.length) {
qCWarning(QT_BT_BLUEZ) << "L2Cap payload size" << size << "is smaller than specified size"
<< l2CapHeader.length;
return;
}
// qCDebug(QT_BT_BLUEZ) << "l2cap channel id:" << l2CapHeader.channelId
// << "payload length:" << l2CapHeader.length;
if (l2CapHeader.channelId != SECURITY_CHANNEL_ID)
return;
if (l2CapHeader.length != 17) {
qCWarning(QT_BT_BLUEZ) << "Unexpected length of the Signing Information packet:"
<< l2CapHeader.length;
return;
}
if (*data != 0xa) // "Signing Information". Spec v4.2, Vol 3, Part H, 3.6.6
return;
BluezUint128 csrk;
memcpy(&csrk, data + 1, sizeof csrk);
const bool isRemoteKey = aclData->pbFlag == 2;
emit signatureResolvingKeyReceived(aclData->handle, isRemoteKey, csrk);
}
void HciManager::handleLeMetaEvent(const quint8 *data, int size)
{
if (size == 0) {
qCWarning(QT_BT_BLUEZ) << "LE Meta Event: not enough bytes to extract event code";
return;
}
// Spec v5.3, Vol 4, part E, 7.7.65.*
switch (*data) {
case 0x1: // HCI_LE_Connection_Complete
case 0xA: // HCI_LE_Enhanced_Connection_Complete
{
// subevent code (1 byte) + status (1 byte) + handle (2 bytes)
if (size < 4) {
qCWarning(QT_BT_BLUEZ) << "LE Meta Event: not enough bytes to parse "
"Connection Complete event";
return;
}
// Skipping status here. TODO: should we process it?
const quint16 handle = bt_get_le16(data + 2);
emit connectionComplete(handle);
break;
}
case 0x3: {
// TODO: From little endian!
struct ConnectionUpdateData {
quint8 status;
quint16 handle;
quint16 interval;
quint16 latency;
quint16 timeout;
} __attribute((packed));
// +1 byte for a status!
if (size < static_cast<int>(sizeof(ConnectionUpdateData) + 1)) {
qCWarning(QT_BT_BLUEZ) << "LE Meta Event: not enough bytes to parse "
"Connection Update Complete event";
return;
}
const auto * const updateData
= reinterpret_cast<const ConnectionUpdateData *>(data + 1);
if (updateData->status == 0) {
QLowEnergyConnectionParameters params;
const double interval = qFromLittleEndian(updateData->interval) * 1.25;
params.setIntervalRange(interval, interval);
params.setLatency(qFromLittleEndian(updateData->latency));
params.setSupervisionTimeout(qFromLittleEndian(updateData->timeout) * 10);
emit connectionUpdate(qFromLittleEndian(updateData->handle), params);
}
break;
}
default:
break;
}
}
QT_END_NAMESPACE
#include "moc_hcimanager_p.cpp"