projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix skb allocation check for A2MP
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
d22ef0bc
AB		 38static inline void swap128(u8 src[16], u8 dst[16])
39{
40 int i;
41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i];
43}
44
45static inline void swap56(u8 src[7], u8 dst[7])
46{
47 int i;
48 for (i = 0; i < 7; i++)
49 dst[6 - i] = src[i];
50}
51
52static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{
54 struct blkcipher_desc desc;
55 struct scatterlist sg;
201a5929 56 int err;
d22ef0bc
AB		 57
58 if (tfm == NULL) {
59 BT_ERR("tfm %p", tfm);
60 return -EINVAL;
61 }
62
63 desc.tfm = tfm;
64 desc.flags = 0;
65
66 err = crypto_blkcipher_setkey(tfm, k, 16);
67 if (err) {
68 BT_ERR("cipher setkey failed: %d", err);
69 return err;
70 }
71
72 sg_init_one(&sg, r, 16);
73
d22ef0bc
AB		 74 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
75 if (err)
76 BT_ERR("Encrypt data error %d", err);
77
78 return err;
79}
80
60478054
JH		 81static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
82{
83 u8 _res[16], k[16];
84 int err;
85
86 /* r' = padding || r */
87 memset(_res, 0, 13);
88 _res[13] = r[2];
89 _res[14] = r[1];
90 _res[15] = r[0];
91
92 swap128(irk, k);
93 err = smp_e(tfm, k, _res);
94 if (err) {
95 BT_ERR("Encrypt error");
96 return err;
97 }
98
99 /* The output of the random address function ah is:
100 * ah(h, r) = e(k, r') mod 2^24
101 * The output of the security function e is then truncated to 24 bits
102 * by taking the least significant 24 bits of the output of e as the
103 * result of ah.
104 */
105 res[0] = _res[15];
106 res[1] = _res[14];
107 res[2] = _res[13];
108
109 return 0;
110}
111
112bool smp_irk_matches(struct crypto_blkcipher *tfm, u8 irk[16],
113 bdaddr_t *bdaddr)
114{
115 u8 hash[3];
116 int err;
117
118 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
119
120 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
121 if (err)
122 return false;
123
124 return !memcmp(bdaddr->b, hash, 3);
125}
126
b1e2b3ae
JH		 127int smp_generate_rpa(struct crypto_blkcipher *tfm, u8 irk[16], bdaddr_t *rpa)
128{
129 int err;
130
131 get_random_bytes(&rpa->b[3], 3);
132
133 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
134 rpa->b[5] |= 0x40; /* Set second most significant bit */
135
136 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
137 if (err < 0)
138 return err;
139
140 BT_DBG("RPA %pMR", rpa);
141
142 return 0;
143}
144
d22ef0bc 145static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
f1560463
MH		 146 u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia,
147 u8 _rat, bdaddr_t *ra, u8 res[16])
d22ef0bc
AB		 148{
149 u8 p1[16], p2[16];
150 int err;
151
152 memset(p1, 0, 16);
153
154 /* p1 = pres || preq || _rat || _iat */
155 swap56(pres, p1);
156 swap56(preq, p1 + 7);
157 p1[14] = _rat;
158 p1[15] = _iat;
159
160 memset(p2, 0, 16);
161
162 /* p2 = padding || ia || ra */
163 baswap((bdaddr_t *) (p2 + 4), ia);
164 baswap((bdaddr_t *) (p2 + 10), ra);
165
166 /* res = r XOR p1 */
167 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
168
169 /* res = e(k, res) */
170 err = smp_e(tfm, k, res);
171 if (err) {
172 BT_ERR("Encrypt data error");
173 return err;
174 }
175
176 /* res = res XOR p2 */
177 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
178
179 /* res = e(k, res) */
180 err = smp_e(tfm, k, res);
181 if (err)
182 BT_ERR("Encrypt data error");
183
184 return err;
185}
186
f1560463
MH		 187static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
188 u8 r2[16], u8 _r[16])
d22ef0bc
AB		 189{
190 int err;
191
192 /* Just least significant octets from r1 and r2 are considered */
193 memcpy(_r, r1 + 8, 8);
194 memcpy(_r + 8, r2 + 8, 8);
195
196 err = smp_e(tfm, k, _r);
197 if (err)
198 BT_ERR("Encrypt data error");
199
200 return err;
201}
202
eb492e01 203static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
f1560463 204 u16 dlen, void *data)
eb492e01
AB		 205{
206 struct sk_buff *skb;
207 struct l2cap_hdr *lh;
208 int len;
209
210 len = L2CAP_HDR_SIZE + sizeof(code) + dlen;
211
212 if (len > conn->mtu)
213 return NULL;
214
215 skb = bt_skb_alloc(len, GFP_ATOMIC);
216 if (!skb)
217 return NULL;
218
219 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
220 lh->len = cpu_to_le16(sizeof(code) + dlen);
d8aece2a 221 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
eb492e01
AB		 222
223 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
224
225 memcpy(skb_put(skb, dlen), data, dlen);
226
227 return skb;
228}
229
230static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
231{
232 struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
233
234 BT_DBG("code 0x%2.2x", code);
235
236 if (!skb)
237 return;
238
73d80deb
LAD		 239 skb->priority = HCI_PRIO_MAX;
240 hci_send_acl(conn->hchan, skb, 0);
e2dcd113 241
6c9d42a1 242 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 243 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 244}
245
2b64d153
BG		 246static __u8 authreq_to_seclevel(__u8 authreq)
247{
248 if (authreq & SMP_AUTH_MITM)
249 return BT_SECURITY_HIGH;
250 else
251 return BT_SECURITY_MEDIUM;
252}
253
254static __u8 seclevel_to_authreq(__u8 sec_level)
255{
256 switch (sec_level) {
257 case BT_SECURITY_HIGH:
258 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
259 case BT_SECURITY_MEDIUM:
260 return SMP_AUTH_BONDING;
261 default:
262 return SMP_AUTH_NONE;
263 }
264}
265
b8e66eac 266static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 267 struct smp_cmd_pairing *req,
268 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 269{
fd349c02
JH		 270 struct smp_chan *smp = conn->smp_chan;
271 struct hci_conn *hcon = conn->hcon;
272 struct hci_dev *hdev = hcon->hdev;
273 u8 local_dist = 0, remote_dist = 0;
54790f73 274
a8b2d5c2 275 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
fd349c02
JH		 276 local_dist = SMP_DIST_ENC_KEY;
277 remote_dist = SMP_DIST_ENC_KEY;
54790f73 278 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 279 } else {
280 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 281 }
282
fd349c02
JH		 283 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
284 remote_dist |= SMP_DIST_ID_KEY;
285
863efaf2
JH		 286 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
287 local_dist |= SMP_DIST_ID_KEY;
288
54790f73
VCG		 289 if (rsp == NULL) {
290 req->io_capability = conn->hcon->io_capability;
291 req->oob_flag = SMP_OOB_NOT_PRESENT;
292 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 293 req->init_key_dist = local_dist;
294 req->resp_key_dist = remote_dist;
065a13e2 295 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 296
297 smp->remote_key_dist = remote_dist;
54790f73
VCG		 298 return;
299 }
300
301 rsp->io_capability = conn->hcon->io_capability;
302 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
303 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 304 rsp->init_key_dist = req->init_key_dist & remote_dist;
305 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 306 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 307
308 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 309}
310
3158c50c
VCG		 311static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
312{
1c1def09
VCG		 313 struct smp_chan *smp = conn->smp_chan;
314
3158c50c 315 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 316 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 317 return SMP_ENC_KEY_SIZE;
318
f7aa611a 319 smp->enc_key_size = max_key_size;
3158c50c
VCG		 320
321 return 0;
322}
323
84794e11 324static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 325{
bab73cb6
JH		 326 struct hci_conn *hcon = conn->hcon;
327
84794e11 328 if (reason)
4f957a76 329 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 330 &reason);
4f957a76 331
ce39fb4e
MH		 332 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
333 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
334 HCI_ERROR_AUTH_FAILURE);
f1c09c07 335
61a0cfb0
AG		 336 cancel_delayed_work_sync(&conn->security_timer);
337
ce39fb4e 338 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 339 smp_chan_destroy(conn);
4f957a76
BG		 340}
341
2b64d153
BG		 342#define JUST_WORKS 0x00
343#define JUST_CFM 0x01
344#define REQ_PASSKEY 0x02
345#define CFM_PASSKEY 0x03
346#define REQ_OOB 0x04
347#define OVERLAP 0xFF
348
349static const u8 gen_method[5][5] = {
350 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
351 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
352 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
353 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
354 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
355};
356
357static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
358 u8 local_io, u8 remote_io)
359{
360 struct hci_conn *hcon = conn->hcon;
361 struct smp_chan *smp = conn->smp_chan;
362 u8 method;
363 u32 passkey = 0;
364 int ret = 0;
365
366 /* Initialize key for JUST WORKS */
367 memset(smp->tk, 0, sizeof(smp->tk));
368 clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
369
370 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
371
372 /* If neither side wants MITM, use JUST WORKS */
373 /* If either side has unknown io_caps, use JUST WORKS */
374 /* Otherwise, look up method from the table */
375 if (!(auth & SMP_AUTH_MITM) ||
f1560463
MH		 376 local_io > SMP_IO_KEYBOARD_DISPLAY ||
377 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2b64d153
BG		 378 method = JUST_WORKS;
379 else
b3ff53ff 380 method = gen_method[remote_io][local_io];
2b64d153
BG		 381
382 /* If not bonding, don't ask user to confirm a Zero TK */
383 if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
384 method = JUST_WORKS;
385
386 /* If Just Works, Continue with Zero TK */
387 if (method == JUST_WORKS) {
388 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
389 return 0;
390 }
391
392 /* Not Just Works/Confirm results in MITM Authentication */
393 if (method != JUST_CFM)
394 set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
395
396 /* If both devices have Keyoard-Display I/O, the master
397 * Confirms and the slave Enters the passkey.
398 */
399 if (method == OVERLAP) {
400 if (hcon->link_mode & HCI_LM_MASTER)
401 method = CFM_PASSKEY;
402 else
403 method = REQ_PASSKEY;
404 }
405
406 /* Generate random passkey. Not valid until confirmed. */
407 if (method == CFM_PASSKEY) {
408 u8 key[16];
409
410 memset(key, 0, sizeof(key));
411 get_random_bytes(&passkey, sizeof(passkey));
412 passkey %= 1000000;
413 put_unaligned_le32(passkey, key);
414 swap128(key, smp->tk);
415 BT_DBG("PassKey: %d", passkey);
416 }
417
418 hci_dev_lock(hcon->hdev);
419
420 if (method == REQ_PASSKEY)
ce39fb4e 421 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 422 hcon->type, hcon->dst_type);
2b64d153 423 else
ce39fb4e 424 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
272d90df 425 hcon->type, hcon->dst_type,
2b64d153
BG		 426 cpu_to_le32(passkey), 0);
427
428 hci_dev_unlock(hcon->hdev);
429
430 return ret;
431}
432
8aab4757
VCG		 433static void confirm_work(struct work_struct *work)
434{
435 struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
436 struct l2cap_conn *conn = smp->conn;
893ce8b1
JH		 437 struct hci_dev *hdev = conn->hcon->hdev;
438 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 439 struct smp_cmd_pairing_confirm cp;
440 int ret;
441 u8 res[16], reason;
442
443 BT_DBG("conn %p", conn);
444
893ce8b1
JH		 445 /* Prevent mutual access to hdev->tfm_aes */
446 hci_dev_lock(hdev);
8aab4757 447
b1cd5fd9
JH		 448 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
449 conn->hcon->init_addr_type, &conn->hcon->init_addr,
450 conn->hcon->resp_addr_type, &conn->hcon->resp_addr, res);
893ce8b1
JH		 451
452 hci_dev_unlock(hdev);
453
8aab4757
VCG		 454 if (ret) {
455 reason = SMP_UNSPECIFIED;
456 goto error;
457 }
458
2b64d153
BG		 459 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
460
8aab4757
VCG		 461 swap128(res, cp.confirm_val);
462 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
463
464 return;
465
466error:
84794e11 467 smp_failure(conn, reason);
8aab4757
VCG		 468}
469
470static void random_work(struct work_struct *work)
471{
472 struct smp_chan *smp = container_of(work, struct smp_chan, random);
473 struct l2cap_conn *conn = smp->conn;
474 struct hci_conn *hcon = conn->hcon;
893ce8b1
JH		 475 struct hci_dev *hdev = hcon->hdev;
476 struct crypto_blkcipher *tfm = hdev->tfm_aes;
8aab4757
VCG		 477 u8 reason, confirm[16], res[16], key[16];
478 int ret;
479
480 if (IS_ERR_OR_NULL(tfm)) {
481 reason = SMP_UNSPECIFIED;
482 goto error;
483 }
484
485 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
486
893ce8b1
JH		 487 /* Prevent mutual access to hdev->tfm_aes */
488 hci_dev_lock(hdev);
489
b1cd5fd9
JH		 490 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
491 hcon->init_addr_type, &hcon->init_addr,
492 hcon->resp_addr_type, &hcon->resp_addr, res);
893ce8b1
JH		 493
494 hci_dev_unlock(hdev);
495
8aab4757
VCG		 496 if (ret) {
497 reason = SMP_UNSPECIFIED;
498 goto error;
499 }
500
501 swap128(res, confirm);
502
503 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
504 BT_ERR("Pairing failed (confirmation values mismatch)");
505 reason = SMP_CONFIRM_FAILED;
506 goto error;
507 }
508
509 if (hcon->out) {
fe39c7b2
MH		 510 u8 stk[16];
511 __le64 rand = 0;
512 __le16 ediv = 0;
8aab4757
VCG		 513
514 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
515 swap128(key, stk);
516
f7aa611a 517 memset(stk + smp->enc_key_size, 0,
04124681 518 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 519
51a8efd7 520 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
8aab4757
VCG		 521 reason = SMP_UNSPECIFIED;
522 goto error;
523 }
524
525 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 526 hcon->enc_key_size = smp->enc_key_size;
8aab4757 527 } else {
fe39c7b2
MH		 528 u8 stk[16], r[16];
529 __le64 rand = 0;
530 __le16 ediv = 0;
8aab4757
VCG		 531
532 swap128(smp->prnd, r);
533 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
534
535 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
536 swap128(key, stk);
537
f7aa611a 538 memset(stk + smp->enc_key_size, 0,
f1560463 539 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 540
ce39fb4e 541 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
35d70271 542 HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
04124681 543 ediv, rand);
8aab4757
VCG		 544 }
545
546 return;
547
548error:
84794e11 549 smp_failure(conn, reason);
8aab4757
VCG		 550}
551
e3098be4
JH		 552static void smp_reencrypt(struct work_struct *work)
553{
554 struct smp_chan *smp = container_of(work, struct smp_chan,
555 reencrypt.work);
556 struct l2cap_conn *conn = smp->conn;
557 struct hci_conn *hcon = conn->hcon;
558 struct smp_ltk *ltk = smp->ltk;
559
560 BT_DBG("");
561
562 hci_le_start_enc(hcon, ltk->ediv, ltk->rand, ltk->val);
563 hcon->enc_key_size = ltk->enc_size;
564}
565
8aab4757
VCG		 566static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
567{
568 struct smp_chan *smp;
569
f1560463 570 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
8aab4757
VCG		 571 if (!smp)
572 return NULL;
573
574 INIT_WORK(&smp->confirm, confirm_work);
575 INIT_WORK(&smp->random, random_work);
e3098be4 576 INIT_DELAYED_WORK(&smp->reencrypt, smp_reencrypt);
8aab4757
VCG		 577
578 smp->conn = conn;
579 conn->smp_chan = smp;
2b64d153 580 conn->hcon->smp_conn = conn;
8aab4757
VCG		 581
582 hci_conn_hold(conn->hcon);
583
584 return smp;
585}
586
587void smp_chan_destroy(struct l2cap_conn *conn)
588{
c8eb9690 589 struct smp_chan *smp = conn->smp_chan;
f4a407be 590 bool complete;
c8eb9690 591
f1c09c07 592 BUG_ON(!smp);
c8eb9690 593
e3098be4
JH		 594 cancel_delayed_work_sync(&smp->reencrypt);
595
f4a407be
JH		 596 complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
597 mgmt_smp_complete(conn->hcon, complete);
598
759331d7
JH		 599 /* If pairing failed clean up any keys we might have */
600 if (!complete) {
601 if (smp->ltk) {
602 list_del(&smp->ltk->list);
603 kfree(smp->ltk);
604 }
605
606 if (smp->slave_ltk) {
607 list_del(&smp->slave_ltk->list);
608 kfree(smp->slave_ltk);
609 }
610
611 if (smp->remote_irk) {
612 list_del(&smp->remote_irk->list);
613 kfree(smp->remote_irk);
614 }
615 }
616
c8eb9690
BG		 617 kfree(smp);
618 conn->smp_chan = NULL;
2b64d153 619 conn->hcon->smp_conn = NULL;
76a68ba0 620 hci_conn_drop(conn->hcon);
8aab4757
VCG		 621}
622
2b64d153
BG		 623int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
624{
625 struct l2cap_conn *conn = hcon->smp_conn;
626 struct smp_chan *smp;
627 u32 value;
628 u8 key[16];
629
630 BT_DBG("");
631
632 if (!conn)
633 return -ENOTCONN;
634
635 smp = conn->smp_chan;
636
637 switch (mgmt_op) {
638 case MGMT_OP_USER_PASSKEY_REPLY:
639 value = le32_to_cpu(passkey);
640 memset(key, 0, sizeof(key));
641 BT_DBG("PassKey: %d", value);
642 put_unaligned_le32(value, key);
643 swap128(key, smp->tk);
644 /* Fall Through */
645 case MGMT_OP_USER_CONFIRM_REPLY:
646 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
647 break;
648 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
649 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 650 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 651 return 0;
652 default:
84794e11 653 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 654 return -EOPNOTSUPP;
655 }
656
657 /* If it is our turn to send Pairing Confirm, do so now */
658 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
659 queue_work(hcon->hdev->workqueue, &smp->confirm);
660
661 return 0;
662}
663
da85e5e5 664static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 665{
3158c50c 666 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
8aab4757 667 struct smp_chan *smp;
3158c50c 668 u8 key_size;
2b64d153 669 u8 auth = SMP_AUTH_NONE;
8aab4757 670 int ret;
88ba43b6
AB		 671
672 BT_DBG("conn %p", conn);
673
c46b98be
JH		 674 if (skb->len < sizeof(*req))
675 return SMP_UNSPECIFIED;
676
2b64d153
BG		 677 if (conn->hcon->link_mode & HCI_LM_MASTER)
678 return SMP_CMD_NOTSUPP;
679
51a8efd7 680 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
8aab4757 681 smp = smp_chan_create(conn);
d08fd0e7
AE		 682 else
683 smp = conn->smp_chan;
8aab4757 684
d08fd0e7
AE		 685 if (!smp)
686 return SMP_UNSPECIFIED;
d26a2345 687
1c1def09
VCG		 688 smp->preq[0] = SMP_CMD_PAIRING_REQ;
689 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 690 skb_pull(skb, sizeof(*req));
88ba43b6 691
2b64d153
BG		 692 /* We didn't start the pairing, so match remote */
693 if (req->auth_req & SMP_AUTH_BONDING)
694 auth = req->auth_req;
da85e5e5 695
fdde0a26
IY		 696 conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
697
2b64d153 698 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 699
700 key_size = min(req->max_key_size, rsp.max_key_size);
701 if (check_enc_key_size(conn, key_size))
702 return SMP_ENC_KEY_SIZE;
88ba43b6 703
e84a6b13 704 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 705
1c1def09
VCG		 706 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
707 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 708
3158c50c 709 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 710
2b64d153
BG		 711 /* Request setup of TK */
712 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
713 if (ret)
714 return SMP_UNSPECIFIED;
715
da85e5e5 716 return 0;
88ba43b6
AB		 717}
718
da85e5e5 719static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 720{
3158c50c 721 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1c1def09 722 struct smp_chan *smp = conn->smp_chan;
8aab4757 723 struct hci_dev *hdev = conn->hcon->hdev;
2b64d153 724 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 725 int ret;
88ba43b6
AB		 726
727 BT_DBG("conn %p", conn);
728
c46b98be
JH		 729 if (skb->len < sizeof(*rsp))
730 return SMP_UNSPECIFIED;
731
2b64d153
BG		 732 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
733 return SMP_CMD_NOTSUPP;
734
3158c50c
VCG		 735 skb_pull(skb, sizeof(*rsp));
736
1c1def09 737 req = (void *) &smp->preq[1];
da85e5e5 738
3158c50c
VCG		 739 key_size = min(req->max_key_size, rsp->max_key_size);
740 if (check_enc_key_size(conn, key_size))
741 return SMP_ENC_KEY_SIZE;
742
e84a6b13 743 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 744
8aab4757
VCG		 745 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
746 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 747
2b64d153 748 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 749 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 750 auth = SMP_AUTH_BONDING;
751
752 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
753
476585ec 754 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 755 if (ret)
756 return SMP_UNSPECIFIED;
757
758 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
759
760 /* Can't compose response until we have been confirmed */
761 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
762 return 0;
763
8aab4757 764 queue_work(hdev->workqueue, &smp->confirm);
da85e5e5
VCG		 765
766 return 0;
88ba43b6
AB		 767}
768
da85e5e5 769static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 770{
1c1def09 771 struct smp_chan *smp = conn->smp_chan;
8aab4757 772 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 773
88ba43b6
AB		 774 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
775
c46b98be
JH		 776 if (skb->len < sizeof(smp->pcnf))
777 return SMP_UNSPECIFIED;
778
1c1def09
VCG		 779 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
780 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 781
7d24ddcc
AB		 782 if (conn->hcon->out) {
783 u8 random[16];
88ba43b6 784
1c1def09 785 swap128(smp->prnd, random);
88ba43b6 786 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
f1560463 787 random);
2b64d153 788 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
8aab4757 789 queue_work(hdev->workqueue, &smp->confirm);
2b64d153
BG		 790 } else {
791 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
88ba43b6 792 }
da85e5e5
VCG		 793
794 return 0;
88ba43b6
AB		 795}
796
da85e5e5 797static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 798{
1c1def09 799 struct smp_chan *smp = conn->smp_chan;
8aab4757 800 struct hci_dev *hdev = conn->hcon->hdev;
7d24ddcc 801
8aab4757 802 BT_DBG("conn %p", conn);
3158c50c 803
c46b98be
JH		 804 if (skb->len < sizeof(smp->rrnd))
805 return SMP_UNSPECIFIED;
806
8aab4757
VCG		 807 swap128(skb->data, smp->rrnd);
808 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 809
8aab4757 810 queue_work(hdev->workqueue, &smp->random);
da85e5e5
VCG		 811
812 return 0;
88ba43b6
AB		 813}
814
4dab7864 815static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 816{
c9839a11 817 struct smp_ltk *key;
988c5997
VCG		 818 struct hci_conn *hcon = conn->hcon;
819
98a0b845
JH		 820 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
821 hcon->out);
988c5997
VCG		 822 if (!key)
823 return 0;
824
4dab7864
JH		 825 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
826 return 0;
827
51a8efd7 828 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
988c5997
VCG		 829 return 1;
830
c9839a11
VCG		 831 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
832 hcon->enc_key_size = key->enc_size;
988c5997
VCG		 833
834 return 1;
988c5997 835}
f1560463 836
da85e5e5 837static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 838{
839 struct smp_cmd_security_req *rp = (void *) skb->data;
840 struct smp_cmd_pairing cp;
f1cb9af5 841 struct hci_conn *hcon = conn->hcon;
8aab4757 842 struct smp_chan *smp;
88ba43b6
AB		 843
844 BT_DBG("conn %p", conn);
845
c46b98be
JH		 846 if (skb->len < sizeof(*rp))
847 return SMP_UNSPECIFIED;
848
86ca9eac
JH		 849 if (!(conn->hcon->link_mode & HCI_LM_MASTER))
850 return SMP_CMD_NOTSUPP;
851
2b64d153 852 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
feb45eb5 853
4dab7864 854 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 855 return 0;
856
51a8efd7 857 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 858 return 0;
f1cb9af5 859
8aab4757 860 smp = smp_chan_create(conn);
d26a2345 861
88ba43b6 862 skb_pull(skb, sizeof(*rp));
88ba43b6 863
da85e5e5 864 memset(&cp, 0, sizeof(cp));
54790f73 865 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 866
1c1def09
VCG		 867 smp->preq[0] = SMP_CMD_PAIRING_REQ;
868 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 869
88ba43b6 870 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 871
da85e5e5 872 return 0;
88ba43b6
AB		 873}
874
ad32a2f5
JH		 875bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
876{
877 if (sec_level == BT_SECURITY_LOW)
878 return true;
879
880 if (hcon->sec_level >= sec_level)
881 return true;
882
883 return false;
884}
885
cc110922 886int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 887{
cc110922 888 struct l2cap_conn *conn = hcon->l2cap_data;
1c1def09 889 struct smp_chan *smp = conn->smp_chan;
2b64d153 890 __u8 authreq;
eb492e01 891
3a0259bb
VCG		 892 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
893
757aee0f 894 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 895 return 1;
896
ad32a2f5 897 if (smp_sufficient_security(hcon, sec_level))
eb492e01 898 return 1;
f1cb9af5 899
988c5997 900 if (hcon->link_mode & HCI_LM_MASTER)
4dab7864 901 if (smp_ltk_encrypt(conn, sec_level))
02bc7455 902 goto done;
d26a2345 903
51a8efd7 904 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 905 return 0;
906
8aab4757 907 smp = smp_chan_create(conn);
2b64d153
BG		 908 if (!smp)
909 return 1;
910
911 authreq = seclevel_to_authreq(sec_level);
d26a2345 912
d26a2345
VCG		 913 if (hcon->link_mode & HCI_LM_MASTER) {
914 struct smp_cmd_pairing cp;
f01ead31 915
2b64d153 916 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 917 smp->preq[0] = SMP_CMD_PAIRING_REQ;
918 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 919
eb492e01
AB		 920 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
921 } else {
922 struct smp_cmd_security_req cp;
2b64d153 923 cp.auth_req = authreq;
eb492e01
AB		 924 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
925 }
926
02bc7455 927done:
f1cb9af5 928 hcon->pending_sec_level = sec_level;
f1cb9af5 929
eb492e01
AB		 930 return 0;
931}
932
7034b911
VCG		 933static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
934{
16b90839 935 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
1c1def09 936 struct smp_chan *smp = conn->smp_chan;
16b90839 937
c46b98be
JH		 938 BT_DBG("conn %p", conn);
939
940 if (skb->len < sizeof(*rp))
941 return SMP_UNSPECIFIED;
942
6131ddc8
JH		 943 /* Ignore this PDU if it wasn't requested */
944 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
945 return 0;
946
16b90839
VCG		 947 skb_pull(skb, sizeof(*rp));
948
1c1def09 949 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 950
7034b911
VCG		 951 return 0;
952}
953
954static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
955{
16b90839 956 struct smp_cmd_master_ident *rp = (void *) skb->data;
1c1def09 957 struct smp_chan *smp = conn->smp_chan;
c9839a11
VCG		 958 struct hci_dev *hdev = conn->hcon->hdev;
959 struct hci_conn *hcon = conn->hcon;
23d0e128 960 struct smp_ltk *ltk;
c9839a11 961 u8 authenticated;
16b90839 962
c46b98be
JH		 963 BT_DBG("conn %p", conn);
964
965 if (skb->len < sizeof(*rp))
966 return SMP_UNSPECIFIED;
967
6131ddc8
JH		 968 /* Ignore this PDU if it wasn't requested */
969 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
970 return 0;
971
9747a9f3
JH		 972 /* Mark the information as received */
973 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
974
16b90839 975 skb_pull(skb, sizeof(*rp));
7034b911 976
c9839a11 977 hci_dev_lock(hdev);
ce39fb4e 978 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
35d70271 979 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, HCI_SMP_LTK,
23d0e128
JH		 980 authenticated, smp->tk, smp->enc_key_size,
981 rp->ediv, rp->rand);
982 smp->ltk = ltk;
fd349c02 983 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 984 smp_distribute_keys(conn);
c9839a11 985 hci_dev_unlock(hdev);
7034b911
VCG		 986
987 return 0;
988}
989
fd349c02
JH		 990static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
991{
992 struct smp_cmd_ident_info *info = (void *) skb->data;
993 struct smp_chan *smp = conn->smp_chan;
994
995 BT_DBG("");
996
997 if (skb->len < sizeof(*info))
998 return SMP_UNSPECIFIED;
999
6131ddc8
JH		 1000 /* Ignore this PDU if it wasn't requested */
1001 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1002 return 0;
1003
fd349c02
JH		 1004 skb_pull(skb, sizeof(*info));
1005
1006 memcpy(smp->irk, info->irk, 16);
1007
1008 return 0;
1009}
1010
1011static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1012 struct sk_buff *skb)
1013{
1014 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
1015 struct smp_chan *smp = conn->smp_chan;
1016 struct hci_conn *hcon = conn->hcon;
1017 bdaddr_t rpa;
1018
1019 BT_DBG("");
1020
1021 if (skb->len < sizeof(*info))
1022 return SMP_UNSPECIFIED;
1023
6131ddc8
JH		 1024 /* Ignore this PDU if it wasn't requested */
1025 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1026 return 0;
1027
9747a9f3
JH		 1028 /* Mark the information as received */
1029 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1030
fd349c02
JH		 1031 skb_pull(skb, sizeof(*info));
1032
a9a58f86
JH		 1033 /* Strictly speaking the Core Specification (4.1) allows sending
1034 * an empty address which would force us to rely on just the IRK
1035 * as "identity information". However, since such
1036 * implementations are not known of and in order to not over
1037 * complicate our implementation, simply pretend that we never
1038 * received an IRK for such a device.
1039 */
1040 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1041 BT_ERR("Ignoring IRK with no identity address");
4bd6d38e 1042 smp_distribute_keys(conn);
a9a58f86
JH		 1043 return 0;
1044 }
1045
fd349c02
JH		 1046 bacpy(&smp->id_addr, &info->bdaddr);
1047 smp->id_addr_type = info->addr_type;
1048
1049 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1050 bacpy(&rpa, &hcon->dst);
1051 else
1052 bacpy(&rpa, BDADDR_ANY);
1053
23d0e128
JH		 1054 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1055 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1056
68d6f6de
JH		 1057 /* Track the connection based on the Identity Address from now on */
1058 bacpy(&hcon->dst, &smp->id_addr);
1059 hcon->dst_type = smp->id_addr_type;
1060
387a33e3
JH		 1061 l2cap_conn_update_id_addr(hcon);
1062
4bd6d38e 1063 smp_distribute_keys(conn);
fd349c02
JH		 1064
1065 return 0;
1066}
1067
eb492e01
AB		 1068int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1069{
7b9899db 1070 struct hci_conn *hcon = conn->hcon;
92381f5c 1071 __u8 code, reason;
eb492e01
AB		 1072 int err = 0;
1073
7b9899db
MH		 1074 if (hcon->type != LE_LINK) {
1075 kfree_skb(skb);
3432711f 1076 return 0;
7b9899db
MH		 1077 }
1078
92381f5c
MH		 1079 if (skb->len < 1) {
1080 kfree_skb(skb);
1081 return -EILSEQ;
1082 }
1083
06ae3314 1084 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1085 err = -ENOTSUPP;
1086 reason = SMP_PAIRING_NOTSUPP;
1087 goto done;
1088 }
1089
92381f5c 1090 code = skb->data[0];
eb492e01
AB		 1091 skb_pull(skb, sizeof(code));
1092
8cf9fa12
JH		 1093 /*
1094 * The SMP context must be initialized for all other PDUs except
1095 * pairing and security requests. If we get any other PDU when
1096 * not initialized simply disconnect (done if this function
1097 * returns an error).
1098 */
1099 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
1100 !conn->smp_chan) {
1101 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1102 kfree_skb(skb);
1103 return -ENOTSUPP;
1104 }
1105
eb492e01
AB		 1106 switch (code) {
1107 case SMP_CMD_PAIRING_REQ:
da85e5e5 1108 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1109 break;
1110
1111 case SMP_CMD_PAIRING_FAIL:
84794e11 1112 smp_failure(conn, 0);
da85e5e5
VCG		 1113 reason = 0;
1114 err = -EPERM;
eb492e01
AB		 1115 break;
1116
1117 case SMP_CMD_PAIRING_RSP:
da85e5e5 1118 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1119 break;
1120
1121 case SMP_CMD_SECURITY_REQ:
da85e5e5 1122 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1123 break;
1124
eb492e01 1125 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1126 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1127 break;
1128
eb492e01 1129 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1130 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1131 break;
1132
eb492e01 1133 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1134 reason = smp_cmd_encrypt_info(conn, skb);
1135 break;
1136
eb492e01 1137 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1138 reason = smp_cmd_master_ident(conn, skb);
1139 break;
1140
eb492e01 1141 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1142 reason = smp_cmd_ident_info(conn, skb);
1143 break;
1144
eb492e01 1145 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1146 reason = smp_cmd_ident_addr_info(conn, skb);
1147 break;
1148
eb492e01 1149 case SMP_CMD_SIGN_INFO:
7034b911
VCG		 1150 /* Just ignored */
1151 reason = 0;
1152 break;
1153
eb492e01
AB		 1154 default:
1155 BT_DBG("Unknown command code 0x%2.2x", code);
1156
1157 reason = SMP_CMD_NOTSUPP;
eb492e01 1158 err = -EOPNOTSUPP;
3a0259bb 1159 goto done;
eb492e01
AB		 1160 }
1161
3a0259bb
VCG		 1162done:
1163 if (reason)
84794e11 1164 smp_failure(conn, reason);
3a0259bb 1165
eb492e01
AB		 1166 kfree_skb(skb);
1167 return err;
1168}
7034b911 1169
35d70271
JH		 1170static void smp_notify_keys(struct l2cap_conn *conn)
1171{
1172 struct smp_chan *smp = conn->smp_chan;
1173 struct hci_conn *hcon = conn->hcon;
1174 struct hci_dev *hdev = hcon->hdev;
1175
95fbac8a
JH		 1176 if (smp->remote_irk)
1177 mgmt_new_irk(hdev, smp->remote_irk);
1178
35d70271
JH		 1179 if (smp->ltk) {
1180 smp->ltk->bdaddr_type = hcon->dst_type;
1181 bacpy(&smp->ltk->bdaddr, &hcon->dst);
1182 mgmt_new_ltk(hdev, smp->ltk);
1183 }
1184
1185 if (smp->slave_ltk) {
1186 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1187 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
1188 mgmt_new_ltk(hdev, smp->slave_ltk);
1189 }
1190}
1191
4bd6d38e 1192int smp_distribute_keys(struct l2cap_conn *conn)
7034b911
VCG		 1193{
1194 struct smp_cmd_pairing *req, *rsp;
1c1def09 1195 struct smp_chan *smp = conn->smp_chan;
524237cb
JH		 1196 struct hci_conn *hcon = conn->hcon;
1197 struct hci_dev *hdev = hcon->hdev;
38ccdc93 1198 bool ltk_encrypt;
7034b911
VCG		 1199 __u8 *keydist;
1200
4bd6d38e 1201 BT_DBG("conn %p", conn);
7034b911 1202
524237cb 1203 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1204 return 0;
1205
1c1def09 1206 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1207
1208 /* The responder sends its keys first */
efabba37 1209 if (hcon->out && (smp->remote_key_dist & 0x07))
7034b911
VCG		 1210 return 0;
1211
1c1def09 1212 req = (void *) &smp->preq[1];
7034b911 1213
524237cb 1214 if (hcon->out) {
7034b911
VCG		 1215 keydist = &rsp->init_key_dist;
1216 *keydist &= req->init_key_dist;
1217 } else {
1218 keydist = &rsp->resp_key_dist;
1219 *keydist &= req->resp_key_dist;
1220 }
1221
7034b911
VCG		 1222 BT_DBG("keydist 0x%x", *keydist);
1223
1224 if (*keydist & SMP_DIST_ENC_KEY) {
1225 struct smp_cmd_encrypt_info enc;
1226 struct smp_cmd_master_ident ident;
23d0e128 1227 struct smp_ltk *ltk;
c9839a11 1228 u8 authenticated;
7034b911 1229 __le16 ediv;
fe39c7b2 1230 __le64 rand;
7034b911
VCG		 1231
1232 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1233 get_random_bytes(&ediv, sizeof(ediv));
fe39c7b2 1234 get_random_bytes(&rand, sizeof(rand));
7034b911
VCG		 1235
1236 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1237
c9839a11 1238 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1239 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
35d70271 1240 HCI_SMP_LTK_SLAVE, authenticated, enc.ltk,
fe39c7b2 1241 smp->enc_key_size, ediv, rand);
23d0e128 1242 smp->slave_ltk = ltk;
16b90839 1243
58115373 1244 ident.ediv = ediv;
fe39c7b2 1245 ident.rand = rand;
7034b911
VCG		 1246
1247 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1248
1249 *keydist &= ~SMP_DIST_ENC_KEY;
1250 }
1251
1252 if (*keydist & SMP_DIST_ID_KEY) {
1253 struct smp_cmd_ident_addr_info addrinfo;
1254 struct smp_cmd_ident_info idinfo;
1255
863efaf2 1256 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1257
1258 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1259
82d4b359
JH		 1260 /* The hci_conn contains the local identity address
1261 * after the connection has been established.
1262 *
1263 * This is true even when the connection has been
1264 * established using a resolvable random address.
1265 */
524237cb 1266 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1267 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1268
1269 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1270 &addrinfo);
7034b911
VCG		 1271
1272 *keydist &= ~SMP_DIST_ID_KEY;
1273 }
1274
1275 if (*keydist & SMP_DIST_SIGN) {
1276 struct smp_cmd_sign_info sign;
1277
1278 /* Send a dummy key */
1279 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1280
1281 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1282
1283 *keydist &= ~SMP_DIST_SIGN;
1284 }
1285
efabba37
JH		 1286 /* If there are still keys to be received wait for them */
1287 if ((smp->remote_key_dist & 0x07))
1288 return 0;
1289
38ccdc93
JH		 1290 /* Check if we should try to re-encrypt the link with the LTK.
1291 * SMP_FLAG_LTK_ENCRYPT flag is used to track whether we've
1292 * already tried this (in which case we shouldn't try again).
1293 *
1294 * The request will trigger an encryption key refresh event
1295 * which will cause a call to auth_cfm and eventually lead to
1296 * l2cap_core.c calling this smp_distribute_keys function again
1297 * and thereby completing the process.
1298 */
1299 if (smp->ltk)
1300 ltk_encrypt = !test_and_set_bit(SMP_FLAG_LTK_ENCRYPT,
1301 &smp->smp_flags);
1302 else
1303 ltk_encrypt = false;
efabba37 1304
38ccdc93
JH		 1305 /* Re-encrypt the link with LTK if possible */
1306 if (ltk_encrypt && hcon->out) {
e3098be4
JH		 1307 queue_delayed_work(hdev->req_workqueue, &smp->reencrypt,
1308 SMP_REENCRYPT_TIMEOUT);
38ccdc93
JH		 1309 } else {
1310 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
1311 cancel_delayed_work_sync(&conn->security_timer);
1312 set_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
1313 smp_notify_keys(conn);
1314 smp_chan_destroy(conn);
1315 }
d26a2345 1316
7034b911
VCG		 1317 return 0;
1318}
Linux kernel - Deliverables
This page took 0.216218 seconds and 5 git commands to generate.