1 /******************************************************************************
2  *
3  *  Copyright 2001-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  this file contains the main BNEP functions
22  *
23  ******************************************************************************/
24 
25 #define LOG_TAG "bluetooth"
26 
27 #include <bluetooth/log.h>
28 #include <string.h>
29 
30 #include "bnep_api.h"
31 #include "bnep_int.h"
32 #include "bta/include/bta_sec_api.h"
33 #include "hci/controller_interface.h"
34 #include "internal_include/bt_target.h"
35 #include "l2c_api.h"
36 #include "l2cdefs.h"
37 #include "main/shim/entry.h"
38 #include "main/shim/helpers.h"
39 #include "osi/include/allocator.h"
40 #include "stack/include/bt_hdr.h"
41 #include "stack/include/bt_psm_types.h"
42 #include "stack/include/bt_types.h"
43 #include "types/raw_address.h"
44 
45 using namespace bluetooth;
46 
47 /******************************************************************************/
48 /*                     G L O B A L    B N E P       D A T A                   */
49 /******************************************************************************/
50 tBNEP_CB bnep_cb;
51 
52 const uint16_t bnep_frame_hdr_sizes[] = {14, 1, 2, 8, 8};
53 
54 /******************************************************************************/
55 /*            L O C A L    F U N C T I O N     P R O T O T Y P E S            */
56 /******************************************************************************/
57 static void bnep_connect_ind(const RawAddress& bd_addr, uint16_t l2cap_cid,
58                              uint16_t psm, uint8_t l2cap_id);
59 static void bnep_connect_cfm(uint16_t l2cap_cid, uint16_t result);
60 static void bnep_config_cfm(uint16_t l2cap_cid, uint16_t result,
61                             tL2CAP_CFG_INFO* p_cfg);
62 static void bnep_disconnect_ind(uint16_t l2cap_cid, bool ack_needed);
63 static void bnep_data_ind(uint16_t l2cap_cid, BT_HDR* p_msg);
64 static void bnep_congestion_ind(uint16_t lcid, bool is_congested);
65 static void bnep_on_l2cap_error(uint16_t l2cap_cid, uint16_t result);
66 /*******************************************************************************
67  *
68  * Function         bnep_register_with_l2cap
69  *
70  * Description      This function registers BNEP PSM with L2CAP
71  *
72  * Returns          void
73  *
74  ******************************************************************************/
bnep_register_with_l2cap(void)75 tBNEP_RESULT bnep_register_with_l2cap(void) {
76   /* Initialize the L2CAP configuration. We only care about MTU and flush */
77   memset(&bnep_cb.l2cap_my_cfg, 0, sizeof(tL2CAP_CFG_INFO));
78 
79   bnep_cb.l2cap_my_cfg.mtu_present = true;
80   bnep_cb.l2cap_my_cfg.mtu = BNEP_MTU_SIZE;
81 
82   bnep_cb.reg_info.pL2CA_ConnectInd_Cb = bnep_connect_ind;
83   bnep_cb.reg_info.pL2CA_ConnectCfm_Cb = bnep_connect_cfm;
84   bnep_cb.reg_info.pL2CA_ConfigInd_Cb = nullptr;
85   bnep_cb.reg_info.pL2CA_ConfigCfm_Cb = bnep_config_cfm;
86   bnep_cb.reg_info.pL2CA_DisconnectInd_Cb = bnep_disconnect_ind;
87   bnep_cb.reg_info.pL2CA_DataInd_Cb = bnep_data_ind;
88   bnep_cb.reg_info.pL2CA_CongestionStatus_Cb = bnep_congestion_ind;
89   bnep_cb.reg_info.pL2CA_Error_Cb = bnep_on_l2cap_error;
90 
91   /* Now, register with L2CAP */
92   if (!L2CA_RegisterWithSecurity(BT_PSM_BNEP, bnep_cb.reg_info,
93                                  false /* enable_snoop */, nullptr,
94                                  BNEP_MTU_SIZE, BNEP_MTU_SIZE,
95                                  BTA_SEC_AUTHENTICATE | BTA_SEC_ENCRYPT)) {
96     log::error("BNEP - Registration failed");
97     return BNEP_SECURITY_FAIL;
98   }
99 
100   return BNEP_SUCCESS;
101 }
102 
103 /*******************************************************************************
104  *
105  * Function         bnep_connect_ind
106  *
107  * Description      This function handles an inbound connection indication
108  *                  from L2CAP. This is the case where we are acting as a
109  *                  server.
110  *
111  * Returns          void
112  *
113  ******************************************************************************/
bnep_connect_ind(const RawAddress & bd_addr,uint16_t l2cap_cid,uint16_t,uint8_t l2cap_id)114 static void bnep_connect_ind(const RawAddress& bd_addr, uint16_t l2cap_cid,
115                              uint16_t /* psm */, uint8_t l2cap_id) {
116   tBNEP_CONN* p_bcb = bnepu_find_bcb_by_bd_addr(bd_addr);
117 
118   /* If we are not acting as server, or already have a connection, or have */
119   /* no more resources to handle the connection, reject the connection.    */
120   if (!(bnep_cb.profile_registered) || (p_bcb) ||
121       ((p_bcb = bnepu_allocate_bcb(bd_addr)) == NULL)) {
122     if (!L2CA_DisconnectReq(l2cap_cid)) {
123       log::warn("Unable to request L2CAP disconnect peer:{} cid:{}", bd_addr,
124                 l2cap_cid);
125     }
126     return;
127   }
128 
129   /* Transition to the next appropriate state, waiting for config setup. */
130   p_bcb->con_state = BNEP_STATE_CFG_SETUP;
131 
132   /* Save the L2CAP Channel ID. */
133   p_bcb->l2cap_cid = l2cap_cid;
134 
135   /* Start timer waiting for config setup */
136   alarm_set_on_mloop(p_bcb->conn_timer, BNEP_CONN_TIMEOUT_MS,
137                      bnep_conn_timer_timeout, p_bcb);
138 
139   log::debug("BNEP - Rcvd L2CAP conn ind, CID: 0x{:x}", p_bcb->l2cap_cid);
140 }
141 
bnep_on_l2cap_error(uint16_t l2cap_cid,uint16_t result)142 static void bnep_on_l2cap_error(uint16_t l2cap_cid, uint16_t result) {
143   tBNEP_CONN* p_bcb = bnepu_find_bcb_by_cid(l2cap_cid);
144   if (p_bcb == nullptr) return;
145 
146   /* Tell the upper layer, if there is a callback */
147   if ((p_bcb->con_flags & BNEP_FLAGS_IS_ORIG) && (bnep_cb.p_conn_state_cb)) {
148     (*bnep_cb.p_conn_state_cb)(p_bcb->handle, p_bcb->rem_bda, BNEP_CONN_FAILED,
149                                false);
150   }
151 
152   if (!L2CA_DisconnectReq(p_bcb->l2cap_cid)) {
153     log::warn("Unable to request L2CAP disconnect peer:{} cid:{}",
154               p_bcb->rem_bda, l2cap_cid);
155   }
156 
157   bnepu_release_bcb(p_bcb);
158 }
159 
160 /*******************************************************************************
161  *
162  * Function         bnep_connect_cfm
163  *
164  * Description      This function handles the connect confirm events
165  *                  from L2CAP. This is the case when we are acting as a
166  *                  client and have sent a connect request.
167  *
168  * Returns          void
169  *
170  ******************************************************************************/
bnep_connect_cfm(uint16_t l2cap_cid,uint16_t result)171 static void bnep_connect_cfm(uint16_t l2cap_cid, uint16_t result) {
172   tBNEP_CONN* p_bcb;
173 
174   /* Find CCB based on CID */
175   p_bcb = bnepu_find_bcb_by_cid(l2cap_cid);
176   if (p_bcb == NULL) {
177     log::warn("BNEP - Rcvd conn cnf for unknown CID 0x{:x}", l2cap_cid);
178     return;
179   }
180 
181   /* If the connection response contains success status, then */
182   /* Transition to the next state and startup the timer.      */
183   if ((result == L2CAP_CONN_OK) &&
184       (p_bcb->con_state == BNEP_STATE_CONN_START)) {
185     p_bcb->con_state = BNEP_STATE_CFG_SETUP;
186 
187     /* Start timer waiting for config results */
188     alarm_set_on_mloop(p_bcb->conn_timer, BNEP_CONN_TIMEOUT_MS,
189                        bnep_conn_timer_timeout, p_bcb);
190 
191     log::debug("BNEP - got conn cnf, sent cfg req, CID: 0x{:x}",
192                p_bcb->l2cap_cid);
193   } else {
194     log::error("invoked with non OK status");
195   }
196 }
197 
198 /*******************************************************************************
199  *
200  * Function         bnep_config_cfm
201  *
202  * Description      This function processes the L2CAP configuration confirmation
203  *                  event.
204  *
205  * Returns          void
206  *
207  ******************************************************************************/
bnep_config_cfm(uint16_t l2cap_cid,uint16_t initiator,tL2CAP_CFG_INFO * p_cfg)208 static void bnep_config_cfm(uint16_t l2cap_cid, uint16_t initiator,
209                             tL2CAP_CFG_INFO* p_cfg) {
210   tBNEP_CONN* p_bcb;
211 
212   log::debug("BNEP - Rcvd cfg cfm, CID: 0x{:x}", l2cap_cid);
213 
214   /* Find CCB based on CID */
215   p_bcb = bnepu_find_bcb_by_cid(l2cap_cid);
216   if (p_bcb == NULL) {
217     log::warn("BNEP - Rcvd L2CAP cfg ind, unknown CID: 0x{:x}", l2cap_cid);
218     return;
219   }
220 
221   /* For now, always accept configuration from the other side */
222   p_bcb->con_state = BNEP_STATE_SEC_CHECKING;
223 
224   /* Start timer waiting for setup or response */
225   alarm_set_on_mloop(p_bcb->conn_timer, BNEP_HOST_TIMEOUT_MS,
226                      bnep_conn_timer_timeout, p_bcb);
227 
228   if (p_bcb->con_flags & BNEP_FLAGS_IS_ORIG) {
229     bnep_sec_check_complete(&p_bcb->rem_bda, BT_TRANSPORT_BR_EDR, p_bcb);
230   }
231 }
232 
233 /*******************************************************************************
234  *
235  * Function         bnep_disconnect_ind
236  *
237  * Description      This function handles a disconnect event from L2CAP. If
238  *                  requested to, we ack the disconnect before dropping the CCB
239  *
240  * Returns          void
241  *
242  ******************************************************************************/
bnep_disconnect_ind(uint16_t l2cap_cid,bool ack_needed)243 static void bnep_disconnect_ind(uint16_t l2cap_cid, bool ack_needed) {
244   tBNEP_CONN* p_bcb;
245 
246   /* Find CCB based on CID */
247   p_bcb = bnepu_find_bcb_by_cid(l2cap_cid);
248   if (p_bcb == NULL) {
249     log::warn("BNEP - Rcvd L2CAP disc, unknown CID: 0x{:x}", l2cap_cid);
250     return;
251   }
252 
253   log::debug("BNEP - Rcvd L2CAP disc, CID: 0x{:x}", l2cap_cid);
254 
255   /* Tell the user if there is a callback */
256   if (p_bcb->con_state == BNEP_STATE_CONNECTED) {
257     if (bnep_cb.p_conn_state_cb)
258       (*bnep_cb.p_conn_state_cb)(p_bcb->handle, p_bcb->rem_bda,
259                                  BNEP_CONN_DISCONNECTED, false);
260   } else {
261     if ((bnep_cb.p_conn_state_cb) &&
262         ((p_bcb->con_flags & BNEP_FLAGS_IS_ORIG) ||
263          (p_bcb->con_flags & BNEP_FLAGS_CONN_COMPLETED)))
264       (*bnep_cb.p_conn_state_cb)(p_bcb->handle, p_bcb->rem_bda,
265                                  BNEP_CONN_FAILED, false);
266   }
267 
268   bnepu_release_bcb(p_bcb);
269 }
270 
271 /*******************************************************************************
272  *
273  * Function         bnep_congestion_ind
274  *
275  * Description      This is a callback function called by L2CAP when
276  *                  congestion status changes
277  *
278  ******************************************************************************/
bnep_congestion_ind(uint16_t l2cap_cid,bool is_congested)279 static void bnep_congestion_ind(uint16_t l2cap_cid, bool is_congested) {
280   tBNEP_CONN* p_bcb;
281 
282   /* Find BCB based on CID */
283   p_bcb = bnepu_find_bcb_by_cid(l2cap_cid);
284   if (p_bcb == NULL) {
285     log::warn("BNEP - Rcvd L2CAP cong, unknown CID: 0x{:x}", l2cap_cid);
286     return;
287   }
288 
289   if (is_congested) {
290     p_bcb->con_flags |= BNEP_FLAGS_L2CAP_CONGESTED;
291     if (bnep_cb.p_tx_data_flow_cb) {
292       bnep_cb.p_tx_data_flow_cb(p_bcb->handle, BNEP_TX_FLOW_OFF);
293     }
294   } else {
295     p_bcb->con_flags &= ~BNEP_FLAGS_L2CAP_CONGESTED;
296 
297     if (bnep_cb.p_tx_data_flow_cb) {
298       bnep_cb.p_tx_data_flow_cb(p_bcb->handle, BNEP_TX_FLOW_ON);
299     }
300 
301     /* While not congested, send as many buffers as we can */
302     while (!(p_bcb->con_flags & BNEP_FLAGS_L2CAP_CONGESTED)) {
303       BT_HDR* p_buf = (BT_HDR*)fixed_queue_try_dequeue(p_bcb->xmit_q);
304 
305       if (!p_buf) break;
306 
307       if (L2CA_DataWrite(l2cap_cid, p_buf) != L2CAP_DW_SUCCESS) {
308         log::warn("Unable to write L2CAP data peer:{} cid:{} len:{}",
309                   p_bcb->rem_bda, l2cap_cid, p_buf->len);
310       }
311     }
312   }
313 }
314 
315 /*******************************************************************************
316  *
317  * Function         bnep_data_ind
318  *
319  * Description      This function is called when data is received from L2CAP.
320  *                  if we are the originator of the connection, we are the SDP
321  *                  client, and the received message is queued for the client.
322  *
323  *                  If we are the destination of the connection, we are the SDP
324  *                  server, so the message is passed to the server processing
325  *                  function.
326  *
327  * Returns          void
328  *
329  ******************************************************************************/
bnep_data_ind(uint16_t l2cap_cid,BT_HDR * p_buf)330 static void bnep_data_ind(uint16_t l2cap_cid, BT_HDR* p_buf) {
331   tBNEP_CONN* p_bcb;
332   uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
333   uint16_t rem_len = p_buf->len;
334   if (rem_len == 0) {
335     osi_free(p_buf);
336     return;
337   }
338   uint8_t type, ctrl_type, ext_type = 0;
339   bool extension_present, fw_ext_present;
340   uint16_t protocol = 0;
341 
342   /* Find CCB based on CID */
343   p_bcb = bnepu_find_bcb_by_cid(l2cap_cid);
344   if (p_bcb == NULL) {
345     log::warn("BNEP - Rcvd L2CAP data, unknown CID: 0x{:x}", l2cap_cid);
346     osi_free(p_buf);
347     return;
348   }
349 
350   /* Get the type and extension bits */
351   type = *p++;
352   extension_present = type >> 7;
353   type &= 0x7f;
354   if (type >= sizeof(bnep_frame_hdr_sizes) / sizeof(bnep_frame_hdr_sizes[0])) {
355     log::info("BNEP - rcvd frame, bad type: 0x{:02x}", type);
356     osi_free(p_buf);
357     return;
358   }
359   if ((rem_len <= bnep_frame_hdr_sizes[type]) || (rem_len > BNEP_MTU_SIZE)) {
360     log::debug("BNEP - rcvd frame, bad len: {}  type: 0x{:02x}", p_buf->len,
361                type);
362     osi_free(p_buf);
363     return;
364   }
365 
366   rem_len--;
367 
368   if ((p_bcb->con_state != BNEP_STATE_CONNECTED) &&
369       (!(p_bcb->con_flags & BNEP_FLAGS_CONN_COMPLETED)) &&
370       (type != BNEP_FRAME_CONTROL)) {
371     log::warn("BNEP - Ignored L2CAP data while in state: {}, CID: 0x{:x}",
372               p_bcb->con_state, l2cap_cid);
373 
374     if (extension_present) {
375       /*
376       ** When there is no connection if a data packet is received
377       ** with unknown control extension headers then those should be processed
378       ** according to complain/ignore law
379       */
380       uint8_t ext, length;
381       uint16_t org_len, new_len;
382       /* parse the extension headers and process unknown control headers */
383       org_len = rem_len;
384       do {
385         if (org_len < 2) {
386           break;
387         }
388         ext = *p++;
389         length = *p++;
390 
391         new_len = (length + 2);
392         if (new_len > org_len) {
393           break;
394         }
395 
396         if ((ext & 0x7F) == BNEP_EXTENSION_FILTER_CONTROL) {
397           if (length == 0) {
398             break;
399           }
400           if (*p > BNEP_FILTER_MULTI_ADDR_RESPONSE_MSG) {
401             bnep_send_command_not_understood(p_bcb, *p);
402           }
403         }
404 
405         p += length;
406 
407         org_len -= new_len;
408       } while (ext & 0x80);
409     }
410     osi_free(p_buf);
411     return;
412   }
413 
414   if (type > BNEP_FRAME_COMPRESSED_ETHERNET_DEST_ONLY) {
415     log::debug("BNEP - rcvd frame, unknown type: 0x{:02x}", type);
416     osi_free(p_buf);
417     return;
418   }
419 
420   log::debug("BNEP - rcv frame, type: {} len: {} Ext: {}", type, p_buf->len,
421              extension_present);
422 
423   /* Initialize addresses to 'not supplied' */
424   RawAddress src_addr = RawAddress::kEmpty;
425   RawAddress dst_addr = RawAddress::kEmpty;
426 
427   switch (type) {
428     case BNEP_FRAME_GENERAL_ETHERNET:
429       dst_addr = *(RawAddress*)p;
430       p += BD_ADDR_LEN;
431       src_addr = *(RawAddress*)p;
432       p += BD_ADDR_LEN;
433       BE_STREAM_TO_UINT16(protocol, p);
434       rem_len -= 14;
435       break;
436 
437     case BNEP_FRAME_CONTROL:
438       ctrl_type = *p;
439       p = bnep_process_control_packet(p_bcb, p, &rem_len, false);
440 
441       if (ctrl_type == BNEP_SETUP_CONNECTION_REQUEST_MSG &&
442           p_bcb->con_state != BNEP_STATE_CONNECTED && extension_present && p &&
443           rem_len) {
444         osi_free(p_bcb->p_pending_data);
445         p_bcb->p_pending_data = (BT_HDR*)osi_malloc(rem_len + sizeof(BT_HDR));
446         memcpy((uint8_t*)(p_bcb->p_pending_data + 1), p, rem_len);
447         p_bcb->p_pending_data->len = rem_len;
448         p_bcb->p_pending_data->offset = 0;
449       } else {
450         while (extension_present && p && rem_len) {
451           ext_type = *p++;
452           rem_len--;
453           extension_present = ext_type >> 7;
454           ext_type &= 0x7F;
455 
456           /* if unknown extension present stop processing */
457           if (ext_type != BNEP_EXTENSION_FILTER_CONTROL) break;
458 
459           p = bnep_process_control_packet(p_bcb, p, &rem_len, true);
460         }
461       }
462       osi_free(p_buf);
463       return;
464 
465     case BNEP_FRAME_COMPRESSED_ETHERNET:
466       BE_STREAM_TO_UINT16(protocol, p);
467       rem_len -= 2;
468       break;
469 
470     case BNEP_FRAME_COMPRESSED_ETHERNET_SRC_ONLY:
471       src_addr = *(RawAddress*)p;
472       p += BD_ADDR_LEN;
473       BE_STREAM_TO_UINT16(protocol, p);
474       rem_len -= 8;
475       break;
476 
477     case BNEP_FRAME_COMPRESSED_ETHERNET_DEST_ONLY:
478       dst_addr = *(RawAddress*)p;
479       p += BD_ADDR_LEN;
480       BE_STREAM_TO_UINT16(protocol, p);
481       rem_len -= 8;
482       break;
483   }
484 
485   /* Process the header extension if there is one */
486   while (extension_present && p && rem_len) {
487     ext_type = *p;
488     extension_present = ext_type >> 7;
489     ext_type &= 0x7F;
490 
491     /* if unknown extension present stop processing */
492     if (ext_type) {
493       log::debug("Data extension type 0x{:x} found", ext_type);
494       break;
495     }
496 
497     p++;
498     rem_len--;
499     p = bnep_process_control_packet(p_bcb, p, &rem_len, true);
500   }
501 
502   p_buf->offset += p_buf->len - rem_len;
503   p_buf->len = rem_len;
504 
505   /* Always give the upper layer MAC addresses */
506   if (src_addr == RawAddress::kEmpty) src_addr = p_bcb->rem_bda;
507 
508   if (dst_addr == RawAddress::kEmpty)
509     dst_addr = bluetooth::ToRawAddress(
510         bluetooth::shim::GetController()->GetMacAddress());
511 
512   /* check whether there are any extensions to be forwarded */
513   if (ext_type)
514     fw_ext_present = true;
515   else
516     fw_ext_present = false;
517 
518   if (bnep_cb.p_data_buf_cb) {
519     (*bnep_cb.p_data_buf_cb)(p_bcb->handle, src_addr, dst_addr, protocol, p_buf,
520                              fw_ext_present);
521   } else if (bnep_cb.p_data_ind_cb) {
522     (*bnep_cb.p_data_ind_cb)(p_bcb->handle, src_addr, dst_addr, protocol, p,
523                              rem_len, fw_ext_present);
524     osi_free(p_buf);
525   }
526 }
527 
528 /*******************************************************************************
529  *
530  * Function         bnep_conn_timer_timeout
531  *
532  * Description      This function processes a timeout. If it is a startup
533  *                  timeout, we check for reading our BD address. If it
534  *                  is an L2CAP timeout, we send a disconnect req to L2CAP.
535  *
536  * Returns          void
537  *
538  ******************************************************************************/
bnep_conn_timer_timeout(void * data)539 void bnep_conn_timer_timeout(void* data) {
540   tBNEP_CONN* p_bcb = (tBNEP_CONN*)data;
541 
542   log::debug(
543       "BNEP - CCB timeout in state: {}  CID: 0x{:x} flags {:x}, re_transmit {}",
544       p_bcb->con_state, p_bcb->l2cap_cid, p_bcb->con_flags,
545       p_bcb->re_transmits);
546 
547   if (p_bcb->con_state == BNEP_STATE_CONN_SETUP) {
548     log::debug("BNEP - CCB timeout in state: {}  CID: 0x{:x}", p_bcb->con_state,
549                p_bcb->l2cap_cid);
550 
551     if (!(p_bcb->con_flags & BNEP_FLAGS_IS_ORIG)) {
552       if (!L2CA_DisconnectReq(p_bcb->l2cap_cid)) {
553         log::warn("Unable to request L2CAP disconnect peer:{} cid:{}",
554                   p_bcb->rem_bda, p_bcb->l2cap_cid);
555       }
556       bnepu_release_bcb(p_bcb);
557       return;
558     }
559 
560     if (p_bcb->re_transmits++ != BNEP_MAX_RETRANSMITS) {
561       bnep_send_conn_req(p_bcb);
562       alarm_set_on_mloop(p_bcb->conn_timer, BNEP_CONN_TIMEOUT_MS,
563                          bnep_conn_timer_timeout, p_bcb);
564     } else {
565       if (!L2CA_DisconnectReq(p_bcb->l2cap_cid)) {
566         log::warn("Unable to request L2CAP disconnect peer:{} cid:{}",
567                   p_bcb->rem_bda, p_bcb->l2cap_cid);
568       }
569 
570       if ((p_bcb->con_flags & BNEP_FLAGS_IS_ORIG) && (bnep_cb.p_conn_state_cb))
571         (*bnep_cb.p_conn_state_cb)(p_bcb->handle, p_bcb->rem_bda,
572                                    BNEP_CONN_FAILED, false);
573 
574       bnepu_release_bcb(p_bcb);
575       return;
576     }
577   } else if (p_bcb->con_state != BNEP_STATE_CONNECTED) {
578     log::debug("BNEP - CCB timeout in state: {}  CID: 0x{:x}", p_bcb->con_state,
579                p_bcb->l2cap_cid);
580 
581     if (!L2CA_DisconnectReq(p_bcb->l2cap_cid)) {
582       log::warn("Unable to request L2CAP disconnect peer:{} cid:{}",
583                 p_bcb->rem_bda, p_bcb->l2cap_cid);
584     }
585 
586     /* Tell the user if there is a callback */
587     if ((p_bcb->con_flags & BNEP_FLAGS_IS_ORIG) && (bnep_cb.p_conn_state_cb))
588       (*bnep_cb.p_conn_state_cb)(p_bcb->handle, p_bcb->rem_bda,
589                                  BNEP_CONN_FAILED, false);
590 
591     bnepu_release_bcb(p_bcb);
592   } else if (p_bcb->con_flags & BNEP_FLAGS_FILTER_RESP_PEND) {
593     if (p_bcb->re_transmits++ != BNEP_MAX_RETRANSMITS) {
594       bnepu_send_peer_our_filters(p_bcb);
595       alarm_set_on_mloop(p_bcb->conn_timer, BNEP_FILTER_SET_TIMEOUT_MS,
596                          bnep_conn_timer_timeout, p_bcb);
597     } else {
598       if (!L2CA_DisconnectReq(p_bcb->l2cap_cid)) {
599         log::warn("Unable to request L2CAP disconnect peer:{} cid:{}",
600                   p_bcb->rem_bda, p_bcb->l2cap_cid);
601       }
602 
603       /* Tell the user if there is a callback */
604       if (bnep_cb.p_conn_state_cb)
605         (*bnep_cb.p_conn_state_cb)(p_bcb->handle, p_bcb->rem_bda,
606                                    BNEP_SET_FILTER_FAIL, false);
607 
608       bnepu_release_bcb(p_bcb);
609       return;
610     }
611   } else if (p_bcb->con_flags & BNEP_FLAGS_MULTI_RESP_PEND) {
612     if (p_bcb->re_transmits++ != BNEP_MAX_RETRANSMITS) {
613       bnepu_send_peer_our_multi_filters(p_bcb);
614       alarm_set_on_mloop(p_bcb->conn_timer, BNEP_FILTER_SET_TIMEOUT_MS,
615                          bnep_conn_timer_timeout, p_bcb);
616     } else {
617       if (!L2CA_DisconnectReq(p_bcb->l2cap_cid)) {
618         log::warn("Unable to request L2CAP disconnect peer:{} cid:{}",
619                   p_bcb->rem_bda, p_bcb->l2cap_cid);
620       }
621 
622       /* Tell the user if there is a callback */
623       if (bnep_cb.p_conn_state_cb)
624         (*bnep_cb.p_conn_state_cb)(p_bcb->handle, p_bcb->rem_bda,
625                                    BNEP_SET_FILTER_FAIL, false);
626 
627       bnepu_release_bcb(p_bcb);
628       return;
629     }
630   }
631 }
632 
633 /*******************************************************************************
634  *
635  * Function         bnep_connected
636  *
637  * Description      This function is called when a connection is established
638  *                  (after config).
639  *
640  * Returns          void
641  *
642  ******************************************************************************/
bnep_connected(tBNEP_CONN * p_bcb)643 void bnep_connected(tBNEP_CONN* p_bcb) {
644   bool is_role_change;
645 
646   if (p_bcb->con_flags & BNEP_FLAGS_CONN_COMPLETED)
647     is_role_change = true;
648   else
649     is_role_change = false;
650 
651   p_bcb->con_state = BNEP_STATE_CONNECTED;
652   p_bcb->con_flags |= BNEP_FLAGS_CONN_COMPLETED;
653   p_bcb->con_flags &= (~BNEP_FLAGS_SETUP_RCVD);
654 
655   /* Ensure timer is stopped */
656   alarm_cancel(p_bcb->conn_timer);
657   p_bcb->re_transmits = 0;
658 
659   /* Tell the upper layer, if there is a callback */
660   if (bnep_cb.p_conn_state_cb)
661     (*bnep_cb.p_conn_state_cb)(p_bcb->handle, p_bcb->rem_bda, BNEP_SUCCESS,
662                                is_role_change);
663 }
664