projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Move canceling security_timer into smp_chan_destroy()
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
533e35d4
JH		 38enum {
39 SMP_FLAG_TK_VALID,
40 SMP_FLAG_CFM_PENDING,
41 SMP_FLAG_MITM_AUTH,
42 SMP_FLAG_COMPLETE,
43 SMP_FLAG_INITIATOR,
44};
4bc58f51
JH		 45
46struct smp_chan {
b68fda68
JH		 47 struct l2cap_conn *conn;
48 struct delayed_work security_timer;
49
4bc58f51
JH		 50 u8 preq[7]; /* SMP Pairing Request */
51 u8 prsp[7]; /* SMP Pairing Response */
52 u8 prnd[16]; /* SMP Pairing Random (local) */
53 u8 rrnd[16]; /* SMP Pairing Random (remote) */
54 u8 pcnf[16]; /* SMP Pairing Confirm */
55 u8 tk[16]; /* SMP Temporary Key */
56 u8 enc_key_size;
57 u8 remote_key_dist;
58 bdaddr_t id_addr;
59 u8 id_addr_type;
60 u8 irk[16];
61 struct smp_csrk *csrk;
62 struct smp_csrk *slave_csrk;
63 struct smp_ltk *ltk;
64 struct smp_ltk *slave_ltk;
65 struct smp_irk *remote_irk;
4a74d658 66 unsigned long flags;
6a7bd103
JH		 67
68 struct crypto_blkcipher *tfm_aes;
4bc58f51
JH		 69};
70
8a2936f4 71static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
d22ef0bc 72{
8a2936f4 73 size_t i;
d22ef0bc 74
8a2936f4
JH		 75 for (i = 0; i < len; i++)
76 dst[len - 1 - i] = src[i];
d22ef0bc
AB		 77}
78
79static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
80{
81 struct blkcipher_desc desc;
82 struct scatterlist sg;
943a732a 83 uint8_t tmp[16], data[16];
201a5929 84 int err;
d22ef0bc
AB		 85
86 if (tfm == NULL) {
87 BT_ERR("tfm %p", tfm);
88 return -EINVAL;
89 }
90
91 desc.tfm = tfm;
92 desc.flags = 0;
93
943a732a 94 /* The most significant octet of key corresponds to k[0] */
8a2936f4 95 swap_buf(k, tmp, 16);
943a732a
JH		 96
97 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 98 if (err) {
99 BT_ERR("cipher setkey failed: %d", err);
100 return err;
101 }
102
943a732a 103 /* Most significant octet of plaintextData corresponds to data[0] */
8a2936f4 104 swap_buf(r, data, 16);
943a732a
JH		 105
106 sg_init_one(&sg, data, 16);
d22ef0bc 107
d22ef0bc
AB		 108 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
109 if (err)
110 BT_ERR("Encrypt data error %d", err);
111
943a732a 112 /* Most significant octet of encryptedData corresponds to data[0] */
8a2936f4 113 swap_buf(data, r, 16);
943a732a 114
d22ef0bc
AB		 115 return err;
116}
117
60478054
JH		 118static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
119{
943a732a 120 u8 _res[16];
60478054
JH		 121 int err;
122
123 /* r' = padding || r */
943a732a
JH		 124 memcpy(_res, r, 3);
125 memset(_res + 3, 0, 13);
60478054 126
943a732a 127 err = smp_e(tfm, irk, _res);
60478054
JH		 128 if (err) {
129 BT_ERR("Encrypt error");
130 return err;
131 }
132
133 /* The output of the random address function ah is:
134 * ah(h, r) = e(k, r') mod 2^24
135 * The output of the security function e is then truncated to 24 bits
136 * by taking the least significant 24 bits of the output of e as the
137 * result of ah.
138 */
943a732a 139 memcpy(res, _res, 3);
60478054
JH		 140
141 return 0;
142}
143
defce9e8 144bool smp_irk_matches(struct hci_dev *hdev, u8 irk[16], bdaddr_t *bdaddr)
60478054 145{
defce9e8
JH		 146 struct l2cap_chan *chan = hdev->smp_data;
147 struct crypto_blkcipher *tfm;
60478054
JH		 148 u8 hash[3];
149 int err;
150
defce9e8
JH		 151 if (!chan || !chan->data)
152 return false;
153
154 tfm = chan->data;
155
60478054
JH		 156 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
157
158 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
159 if (err)
160 return false;
161
162 return !memcmp(bdaddr->b, hash, 3);
163}
164
defce9e8 165int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
b1e2b3ae 166{
defce9e8
JH		 167 struct l2cap_chan *chan = hdev->smp_data;
168 struct crypto_blkcipher *tfm;
b1e2b3ae
JH		 169 int err;
170
defce9e8
JH		 171 if (!chan || !chan->data)
172 return -EOPNOTSUPP;
173
174 tfm = chan->data;
175
b1e2b3ae
JH		 176 get_random_bytes(&rpa->b[3], 3);
177
178 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
179 rpa->b[5] |= 0x40; /* Set second most significant bit */
180
181 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
182 if (err < 0)
183 return err;
184
185 BT_DBG("RPA %pMR", rpa);
186
187 return 0;
188}
189
ec70f36f
JH		 190static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
191 u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat, bdaddr_t *ra,
192 u8 res[16])
d22ef0bc 193{
ec70f36f 194 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 195 u8 p1[16], p2[16];
196 int err;
197
ec70f36f
JH		 198 BT_DBG("%s", hdev->name);
199
d22ef0bc
AB		 200 memset(p1, 0, 16);
201
202 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 203 p1[0] = _iat;
204 p1[1] = _rat;
205 memcpy(p1 + 2, preq, 7);
206 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 207
208 /* p2 = padding || ia || ra */
943a732a
JH		 209 memcpy(p2, ra, 6);
210 memcpy(p2 + 6, ia, 6);
211 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 212
213 /* res = r XOR p1 */
214 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
215
216 /* res = e(k, res) */
ec70f36f 217 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 218 if (err) {
219 BT_ERR("Encrypt data error");
220 return err;
221 }
222
223 /* res = res XOR p2 */
224 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
225
226 /* res = e(k, res) */
ec70f36f 227 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 228 if (err)
229 BT_ERR("Encrypt data error");
230
231 return err;
232}
233
ec70f36f
JH		 234static int smp_s1(struct smp_chan *smp, u8 k[16], u8 r1[16], u8 r2[16],
235 u8 _r[16])
d22ef0bc 236{
ec70f36f 237 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 238 int err;
239
ec70f36f
JH		 240 BT_DBG("%s", hdev->name);
241
d22ef0bc 242 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 243 memcpy(_r, r2, 8);
244 memcpy(_r + 8, r1, 8);
d22ef0bc 245
ec70f36f 246 err = smp_e(smp->tfm_aes, k, _r);
d22ef0bc
AB		 247 if (err)
248 BT_ERR("Encrypt data error");
249
250 return err;
251}
252
5d88cc73 253static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
eb492e01 254{
5d88cc73 255 struct l2cap_chan *chan = conn->smp;
b68fda68 256 struct smp_chan *smp;
5d88cc73
JH		 257 struct kvec iv[2];
258 struct msghdr msg;
eb492e01 259
5d88cc73
JH		 260 if (!chan)
261 return;
eb492e01 262
5d88cc73 263 BT_DBG("code 0x%2.2x", code);
eb492e01 264
5d88cc73
JH		 265 iv[0].iov_base = &code;
266 iv[0].iov_len = 1;
eb492e01 267
5d88cc73
JH		 268 iv[1].iov_base = data;
269 iv[1].iov_len = len;
eb492e01 270
5d88cc73 271 memset(&msg, 0, sizeof(msg));
eb492e01 272
5d88cc73
JH		 273 msg.msg_iov = (struct iovec *) &iv;
274 msg.msg_iovlen = 2;
eb492e01 275
5d88cc73 276 l2cap_chan_send(chan, &msg, 1 + len);
e2dcd113 277
b68fda68
JH		 278 if (!chan->data)
279 return;
280
281 smp = chan->data;
282
283 cancel_delayed_work_sync(&smp->security_timer);
284 if (test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
285 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
eb492e01
AB		 286}
287
2b64d153
BG		 288static __u8 authreq_to_seclevel(__u8 authreq)
289{
290 if (authreq & SMP_AUTH_MITM)
291 return BT_SECURITY_HIGH;
292 else
293 return BT_SECURITY_MEDIUM;
294}
295
296static __u8 seclevel_to_authreq(__u8 sec_level)
297{
298 switch (sec_level) {
299 case BT_SECURITY_HIGH:
300 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
301 case BT_SECURITY_MEDIUM:
302 return SMP_AUTH_BONDING;
303 default:
304 return SMP_AUTH_NONE;
305 }
306}
307
b8e66eac 308static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 309 struct smp_cmd_pairing *req,
310 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 311{
5d88cc73
JH		 312 struct l2cap_chan *chan = conn->smp;
313 struct smp_chan *smp = chan->data;
fd349c02
JH		 314 struct hci_conn *hcon = conn->hcon;
315 struct hci_dev *hdev = hcon->hdev;
316 u8 local_dist = 0, remote_dist = 0;
54790f73 317
b6ae8457 318 if (test_bit(HCI_BONDABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 319 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
320 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 321 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 322 } else {
323 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 324 }
325
fd349c02
JH		 326 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
327 remote_dist |= SMP_DIST_ID_KEY;
328
863efaf2
JH		 329 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
330 local_dist |= SMP_DIST_ID_KEY;
331
54790f73
VCG		 332 if (rsp == NULL) {
333 req->io_capability = conn->hcon->io_capability;
334 req->oob_flag = SMP_OOB_NOT_PRESENT;
335 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 336 req->init_key_dist = local_dist;
337 req->resp_key_dist = remote_dist;
065a13e2 338 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 339
340 smp->remote_key_dist = remote_dist;
54790f73
VCG		 341 return;
342 }
343
344 rsp->io_capability = conn->hcon->io_capability;
345 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
346 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 347 rsp->init_key_dist = req->init_key_dist & remote_dist;
348 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 349 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 350
351 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 352}
353
3158c50c
VCG		 354static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
355{
5d88cc73
JH		 356 struct l2cap_chan *chan = conn->smp;
357 struct smp_chan *smp = chan->data;
1c1def09 358
3158c50c 359 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 360 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 361 return SMP_ENC_KEY_SIZE;
362
f7aa611a 363 smp->enc_key_size = max_key_size;
3158c50c
VCG		 364
365 return 0;
366}
367
84794e11 368static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 369{
bab73cb6 370 struct hci_conn *hcon = conn->hcon;
b68fda68
JH		 371 struct l2cap_chan *chan = conn->smp;
372 struct smp_chan *smp;
bab73cb6 373
84794e11 374 if (reason)
4f957a76 375 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 376 &reason);
4f957a76 377
ce39fb4e
MH		 378 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
379 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
380 HCI_ERROR_AUTH_FAILURE);
f1c09c07 381
b68fda68
JH		 382 if (!chan->data)
383 return;
384
385 smp = chan->data;
386
ce39fb4e 387 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 388 smp_chan_destroy(conn);
4f957a76
BG		 389}
390
2b64d153
BG		 391#define JUST_WORKS 0x00
392#define JUST_CFM 0x01
393#define REQ_PASSKEY 0x02
394#define CFM_PASSKEY 0x03
395#define REQ_OOB 0x04
396#define OVERLAP 0xFF
397
398static const u8 gen_method[5][5] = {
399 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
400 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
401 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
402 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
403 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
404};
405
581370cc
JH		 406static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
407{
2bcd4003
JH		 408 /* If either side has unknown io_caps, use JUST_CFM (which gets
409 * converted later to JUST_WORKS if we're initiators.
410 */
581370cc
JH		 411 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
412 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2bcd4003 413 return JUST_CFM;
581370cc
JH		 414
415 return gen_method[remote_io][local_io];
416}
417
2b64d153
BG		 418static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
419 u8 local_io, u8 remote_io)
420{
421 struct hci_conn *hcon = conn->hcon;
5d88cc73
JH		 422 struct l2cap_chan *chan = conn->smp;
423 struct smp_chan *smp = chan->data;
2b64d153
BG		 424 u8 method;
425 u32 passkey = 0;
426 int ret = 0;
427
428 /* Initialize key for JUST WORKS */
429 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 430 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 431
432 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
433
2bcd4003
JH		 434 /* If neither side wants MITM, either "just" confirm an incoming
435 * request or use just-works for outgoing ones. The JUST_CFM
436 * will be converted to JUST_WORKS if necessary later in this
437 * function. If either side has MITM look up the method from the
438 * table.
439 */
581370cc 440 if (!(auth & SMP_AUTH_MITM))
2bcd4003 441 method = JUST_CFM;
2b64d153 442 else
581370cc 443 method = get_auth_method(smp, local_io, remote_io);
2b64d153 444
a82505c7 445 /* Don't confirm locally initiated pairing attempts */
4a74d658 446 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 447 method = JUST_WORKS;
448
02f3e254
JH		 449 /* Don't bother user space with no IO capabilities */
450 if (method == JUST_CFM && hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
451 method = JUST_WORKS;
452
2b64d153
BG		 453 /* If Just Works, Continue with Zero TK */
454 if (method == JUST_WORKS) {
4a74d658 455 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 456 return 0;
457 }
458
459 /* Not Just Works/Confirm results in MITM Authentication */
460 if (method != JUST_CFM)
4a74d658 461 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
2b64d153
BG		 462
463 /* If both devices have Keyoard-Display I/O, the master
464 * Confirms and the slave Enters the passkey.
465 */
466 if (method == OVERLAP) {
40bef302 467 if (hcon->role == HCI_ROLE_MASTER)
2b64d153
BG		 468 method = CFM_PASSKEY;
469 else
470 method = REQ_PASSKEY;
471 }
472
01ad34d2 473 /* Generate random passkey. */
2b64d153 474 if (method == CFM_PASSKEY) {
943a732a 475 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 476 get_random_bytes(&passkey, sizeof(passkey));
477 passkey %= 1000000;
943a732a 478 put_unaligned_le32(passkey, smp->tk);
2b64d153 479 BT_DBG("PassKey: %d", passkey);
4a74d658 480 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 481 }
482
483 hci_dev_lock(hcon->hdev);
484
485 if (method == REQ_PASSKEY)
ce39fb4e 486 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 487 hcon->type, hcon->dst_type);
4eb65e66
JH		 488 else if (method == JUST_CFM)
489 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
490 hcon->type, hcon->dst_type,
491 passkey, 1);
2b64d153 492 else
01ad34d2 493 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 494 hcon->type, hcon->dst_type,
39adbffe 495 passkey, 0);
2b64d153
BG		 496
497 hci_dev_unlock(hcon->hdev);
498
499 return ret;
500}
501
1cc61144 502static u8 smp_confirm(struct smp_chan *smp)
8aab4757 503{
8aab4757 504 struct l2cap_conn *conn = smp->conn;
8aab4757
VCG		 505 struct smp_cmd_pairing_confirm cp;
506 int ret;
8aab4757
VCG		 507
508 BT_DBG("conn %p", conn);
509
ec70f36f 510 ret = smp_c1(smp, smp->tk, smp->prnd, smp->preq, smp->prsp,
b1cd5fd9 511 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 512 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
513 cp.confirm_val);
1cc61144
JH		 514 if (ret)
515 return SMP_UNSPECIFIED;
8aab4757 516
4a74d658 517 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 518
8aab4757
VCG		 519 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
520
1cc61144 521 return 0;
8aab4757
VCG		 522}
523
861580a9 524static u8 smp_random(struct smp_chan *smp)
8aab4757 525{
8aab4757
VCG		 526 struct l2cap_conn *conn = smp->conn;
527 struct hci_conn *hcon = conn->hcon;
861580a9 528 u8 confirm[16];
8aab4757
VCG		 529 int ret;
530
ec70f36f 531 if (IS_ERR_OR_NULL(smp->tfm_aes))
861580a9 532 return SMP_UNSPECIFIED;
8aab4757
VCG		 533
534 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
535
ec70f36f 536 ret = smp_c1(smp, smp->tk, smp->rrnd, smp->preq, smp->prsp,
b1cd5fd9 537 hcon->init_addr_type, &hcon->init_addr,
943a732a 538 hcon->resp_addr_type, &hcon->resp_addr, confirm);
861580a9
JH		 539 if (ret)
540 return SMP_UNSPECIFIED;
8aab4757 541
8aab4757
VCG		 542 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
543 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 544 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 545 }
546
547 if (hcon->out) {
fe39c7b2
MH		 548 u8 stk[16];
549 __le64 rand = 0;
550 __le16 ediv = 0;
8aab4757 551
ec70f36f 552 smp_s1(smp, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 553
f7aa611a 554 memset(stk + smp->enc_key_size, 0,
04124681 555 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 556
861580a9
JH		 557 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
558 return SMP_UNSPECIFIED;
8aab4757
VCG		 559
560 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 561 hcon->enc_key_size = smp->enc_key_size;
fe59a05f 562 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
8aab4757 563 } else {
fff3490f 564 u8 stk[16], auth;
fe39c7b2
MH		 565 __le64 rand = 0;
566 __le16 ediv = 0;
8aab4757 567
943a732a
JH		 568 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
569 smp->prnd);
8aab4757 570
ec70f36f 571 smp_s1(smp, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 572
f7aa611a 573 memset(stk + smp->enc_key_size, 0,
f1560463 574 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 575
fff3490f
JH		 576 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
577 auth = 1;
578 else
579 auth = 0;
580
7d5843b7
JH		 581 /* Even though there's no _SLAVE suffix this is the
582 * slave STK we're adding for later lookup (the master
583 * STK never needs to be stored).
584 */
ce39fb4e 585 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2ceba539 586 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
8aab4757
VCG		 587 }
588
861580a9 589 return 0;
8aab4757
VCG		 590}
591
44f1a7ab
JH		 592static void smp_notify_keys(struct l2cap_conn *conn)
593{
594 struct l2cap_chan *chan = conn->smp;
595 struct smp_chan *smp = chan->data;
596 struct hci_conn *hcon = conn->hcon;
597 struct hci_dev *hdev = hcon->hdev;
598 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
599 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
600 bool persistent;
601
602 if (smp->remote_irk) {
603 mgmt_new_irk(hdev, smp->remote_irk);
604 /* Now that user space can be considered to know the
605 * identity address track the connection based on it
606 * from now on.
607 */
608 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
609 hcon->dst_type = smp->remote_irk->addr_type;
610 l2cap_conn_update_id_addr(hcon);
611
612 /* When receiving an indentity resolving key for
613 * a remote device that does not use a resolvable
614 * private address, just remove the key so that
615 * it is possible to use the controller white
616 * list for scanning.
617 *
618 * Userspace will have been told to not store
619 * this key at this point. So it is safe to
620 * just remove it.
621 */
622 if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
623 list_del(&smp->remote_irk->list);
624 kfree(smp->remote_irk);
625 smp->remote_irk = NULL;
626 }
627 }
628
629 /* The LTKs and CSRKs should be persistent only if both sides
630 * had the bonding bit set in their authentication requests.
631 */
632 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
633
634 if (smp->csrk) {
635 smp->csrk->bdaddr_type = hcon->dst_type;
636 bacpy(&smp->csrk->bdaddr, &hcon->dst);
637 mgmt_new_csrk(hdev, smp->csrk, persistent);
638 }
639
640 if (smp->slave_csrk) {
641 smp->slave_csrk->bdaddr_type = hcon->dst_type;
642 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
643 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
644 }
645
646 if (smp->ltk) {
647 smp->ltk->bdaddr_type = hcon->dst_type;
648 bacpy(&smp->ltk->bdaddr, &hcon->dst);
649 mgmt_new_ltk(hdev, smp->ltk, persistent);
650 }
651
652 if (smp->slave_ltk) {
653 smp->slave_ltk->bdaddr_type = hcon->dst_type;
654 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
655 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
656 }
657}
658
659static int smp_distribute_keys(struct l2cap_conn *conn)
660{
661 struct smp_cmd_pairing *req, *rsp;
662 struct l2cap_chan *chan = conn->smp;
663 struct smp_chan *smp = chan->data;
664 struct hci_conn *hcon = conn->hcon;
665 struct hci_dev *hdev = hcon->hdev;
666 __u8 *keydist;
667
668 BT_DBG("conn %p", conn);
669
670 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
671 return 0;
672
673 rsp = (void *) &smp->prsp[1];
674
675 /* The responder sends its keys first */
676 if (hcon->out && (smp->remote_key_dist & 0x07))
677 return 0;
678
679 req = (void *) &smp->preq[1];
680
681 if (hcon->out) {
682 keydist = &rsp->init_key_dist;
683 *keydist &= req->init_key_dist;
684 } else {
685 keydist = &rsp->resp_key_dist;
686 *keydist &= req->resp_key_dist;
687 }
688
689 BT_DBG("keydist 0x%x", *keydist);
690
691 if (*keydist & SMP_DIST_ENC_KEY) {
692 struct smp_cmd_encrypt_info enc;
693 struct smp_cmd_master_ident ident;
694 struct smp_ltk *ltk;
695 u8 authenticated;
696 __le16 ediv;
697 __le64 rand;
698
699 get_random_bytes(enc.ltk, sizeof(enc.ltk));
700 get_random_bytes(&ediv, sizeof(ediv));
701 get_random_bytes(&rand, sizeof(rand));
702
703 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
704
705 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
706 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
707 SMP_LTK_SLAVE, authenticated, enc.ltk,
708 smp->enc_key_size, ediv, rand);
709 smp->slave_ltk = ltk;
710
711 ident.ediv = ediv;
712 ident.rand = rand;
713
714 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
715
716 *keydist &= ~SMP_DIST_ENC_KEY;
717 }
718
719 if (*keydist & SMP_DIST_ID_KEY) {
720 struct smp_cmd_ident_addr_info addrinfo;
721 struct smp_cmd_ident_info idinfo;
722
723 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
724
725 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
726
727 /* The hci_conn contains the local identity address
728 * after the connection has been established.
729 *
730 * This is true even when the connection has been
731 * established using a resolvable random address.
732 */
733 bacpy(&addrinfo.bdaddr, &hcon->src);
734 addrinfo.addr_type = hcon->src_type;
735
736 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
737 &addrinfo);
738
739 *keydist &= ~SMP_DIST_ID_KEY;
740 }
741
742 if (*keydist & SMP_DIST_SIGN) {
743 struct smp_cmd_sign_info sign;
744 struct smp_csrk *csrk;
745
746 /* Generate a new random key */
747 get_random_bytes(sign.csrk, sizeof(sign.csrk));
748
749 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
750 if (csrk) {
751 csrk->master = 0x00;
752 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
753 }
754 smp->slave_csrk = csrk;
755
756 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
757
758 *keydist &= ~SMP_DIST_SIGN;
759 }
760
761 /* If there are still keys to be received wait for them */
762 if ((smp->remote_key_dist & 0x07))
763 return 0;
764
765 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
44f1a7ab
JH		 766 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
767 smp_notify_keys(conn);
768
769 smp_chan_destroy(conn);
770
771 return 0;
772}
773
b68fda68
JH		 774static void smp_timeout(struct work_struct *work)
775{
776 struct smp_chan *smp = container_of(work, struct smp_chan,
777 security_timer.work);
778 struct l2cap_conn *conn = smp->conn;
779
780 BT_DBG("conn %p", conn);
781
782 l2cap_conn_shutdown(conn, ETIMEDOUT);
783}
784
8aab4757
VCG		 785static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
786{
5d88cc73 787 struct l2cap_chan *chan = conn->smp;
8aab4757
VCG		 788 struct smp_chan *smp;
789
f1560463 790 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
616d55be
JH		 791 if (!smp) {
792 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
8aab4757 793 return NULL;
616d55be 794 }
8aab4757 795
6a7bd103
JH		 796 smp->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
797 if (IS_ERR(smp->tfm_aes)) {
798 BT_ERR("Unable to create ECB crypto context");
799 kfree(smp);
616d55be 800 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6a7bd103
JH		 801 return NULL;
802 }
803
8aab4757 804 smp->conn = conn;
5d88cc73 805 chan->data = smp;
8aab4757 806
b68fda68
JH		 807 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
808
8aab4757
VCG		 809 hci_conn_hold(conn->hcon);
810
811 return smp;
812}
813
814void smp_chan_destroy(struct l2cap_conn *conn)
815{
5d88cc73
JH		 816 struct l2cap_chan *chan = conn->smp;
817 struct smp_chan *smp = chan->data;
f4a407be 818 bool complete;
c8eb9690 819
f1c09c07 820 BUG_ON(!smp);
c8eb9690 821
109ec230
JH		 822 cancel_delayed_work_sync(&smp->security_timer);
823 /* In case the timeout freed the SMP context */
824 if (!chan->data)
825 return;
826
4a74d658 827 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
f4a407be
JH		 828 mgmt_smp_complete(conn->hcon, complete);
829
7ee4ea36
MH		 830 kfree(smp->csrk);
831 kfree(smp->slave_csrk);
832
6a7bd103
JH		 833 crypto_free_blkcipher(smp->tfm_aes);
834
759331d7
JH		 835 /* If pairing failed clean up any keys we might have */
836 if (!complete) {
837 if (smp->ltk) {
838 list_del(&smp->ltk->list);
839 kfree(smp->ltk);
840 }
841
842 if (smp->slave_ltk) {
843 list_del(&smp->slave_ltk->list);
844 kfree(smp->slave_ltk);
845 }
846
847 if (smp->remote_irk) {
848 list_del(&smp->remote_irk->list);
849 kfree(smp->remote_irk);
850 }
851 }
852
5d88cc73 853 chan->data = NULL;
c8eb9690 854 kfree(smp);
76a68ba0 855 hci_conn_drop(conn->hcon);
8aab4757
VCG		 856}
857
2b64d153
BG		 858int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
859{
b10e8017 860 struct l2cap_conn *conn = hcon->l2cap_data;
5d88cc73 861 struct l2cap_chan *chan;
2b64d153
BG		 862 struct smp_chan *smp;
863 u32 value;
2b64d153
BG		 864
865 BT_DBG("");
866
642ac774 867 if (!conn || !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
2b64d153
BG		 868 return -ENOTCONN;
869
5d88cc73
JH		 870 chan = conn->smp;
871 if (!chan)
872 return -ENOTCONN;
873
874 smp = chan->data;
2b64d153
BG		 875
876 switch (mgmt_op) {
877 case MGMT_OP_USER_PASSKEY_REPLY:
878 value = le32_to_cpu(passkey);
943a732a 879 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 880 BT_DBG("PassKey: %d", value);
943a732a 881 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 882 /* Fall Through */
883 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 884 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 885 break;
886 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
887 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 888 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 889 return 0;
890 default:
84794e11 891 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 892 return -EOPNOTSUPP;
893 }
894
895 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 896 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
897 u8 rsp = smp_confirm(smp);
898 if (rsp)
899 smp_failure(conn, rsp);
900 }
2b64d153
BG		 901
902 return 0;
903}
904
da85e5e5 905static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 906{
3158c50c 907 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
b3c6410b 908 struct hci_dev *hdev = conn->hcon->hdev;
8aab4757 909 struct smp_chan *smp;
c7262e71 910 u8 key_size, auth, sec_level;
8aab4757 911 int ret;
88ba43b6
AB		 912
913 BT_DBG("conn %p", conn);
914
c46b98be 915 if (skb->len < sizeof(*req))
38e4a915 916 return SMP_INVALID_PARAMS;
c46b98be 917
40bef302 918 if (conn->hcon->role != HCI_ROLE_SLAVE)
2b64d153
BG		 919 return SMP_CMD_NOTSUPP;
920
5d88cc73 921 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
8aab4757 922 smp = smp_chan_create(conn);
5d88cc73
JH		 923 } else {
924 struct l2cap_chan *chan = conn->smp;
925 smp = chan->data;
926 }
8aab4757 927
d08fd0e7
AE		 928 if (!smp)
929 return SMP_UNSPECIFIED;
d26a2345 930
b6ae8457 931 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
b3c6410b
JH		 932 (req->auth_req & SMP_AUTH_BONDING))
933 return SMP_PAIRING_NOTSUPP;
934
1c1def09
VCG		 935 smp->preq[0] = SMP_CMD_PAIRING_REQ;
936 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 937 skb_pull(skb, sizeof(*req));
88ba43b6 938
2b64d153 939 /* We didn't start the pairing, so match remote */
1ef35827 940 auth = req->auth_req;
da85e5e5 941
c7262e71
JH		 942 sec_level = authreq_to_seclevel(auth);
943 if (sec_level > conn->hcon->pending_sec_level)
944 conn->hcon->pending_sec_level = sec_level;
fdde0a26 945
2ed8f65c
JH		 946 /* If we need MITM check that it can be acheived */
947 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
948 u8 method;
949
950 method = get_auth_method(smp, conn->hcon->io_capability,
951 req->io_capability);
952 if (method == JUST_WORKS || method == JUST_CFM)
953 return SMP_AUTH_REQUIREMENTS;
954 }
955
2b64d153 956 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 957
958 key_size = min(req->max_key_size, rsp.max_key_size);
959 if (check_enc_key_size(conn, key_size))
960 return SMP_ENC_KEY_SIZE;
88ba43b6 961
e84a6b13 962 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 963
1c1def09
VCG		 964 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
965 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 966
3158c50c 967 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 968
2b64d153
BG		 969 /* Request setup of TK */
970 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
971 if (ret)
972 return SMP_UNSPECIFIED;
973
da85e5e5 974 return 0;
88ba43b6
AB		 975}
976
da85e5e5 977static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 978{
3158c50c 979 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
5d88cc73
JH		 980 struct l2cap_chan *chan = conn->smp;
981 struct smp_chan *smp = chan->data;
2b64d153 982 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 983 int ret;
88ba43b6
AB		 984
985 BT_DBG("conn %p", conn);
986
c46b98be 987 if (skb->len < sizeof(*rsp))
38e4a915 988 return SMP_INVALID_PARAMS;
c46b98be 989
40bef302 990 if (conn->hcon->role != HCI_ROLE_MASTER)
2b64d153
BG		 991 return SMP_CMD_NOTSUPP;
992
3158c50c
VCG		 993 skb_pull(skb, sizeof(*rsp));
994
1c1def09 995 req = (void *) &smp->preq[1];
da85e5e5 996
3158c50c
VCG		 997 key_size = min(req->max_key_size, rsp->max_key_size);
998 if (check_enc_key_size(conn, key_size))
999 return SMP_ENC_KEY_SIZE;
1000
2ed8f65c
JH		 1001 /* If we need MITM check that it can be acheived */
1002 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1003 u8 method;
1004
1005 method = get_auth_method(smp, req->io_capability,
1006 rsp->io_capability);
1007 if (method == JUST_WORKS || method == JUST_CFM)
1008 return SMP_AUTH_REQUIREMENTS;
1009 }
1010
e84a6b13 1011 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 1012
8aab4757
VCG		 1013 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1014 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 1015
fdcc4bec
JH		 1016 /* Update remote key distribution in case the remote cleared
1017 * some bits that we had enabled in our request.
1018 */
1019 smp->remote_key_dist &= rsp->resp_key_dist;
1020
2b64d153 1021 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 1022 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 1023 auth = SMP_AUTH_BONDING;
1024
1025 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
1026
476585ec 1027 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 1028 if (ret)
1029 return SMP_UNSPECIFIED;
1030
4a74d658 1031 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 1032
1033 /* Can't compose response until we have been confirmed */
4a74d658 1034 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1035 return smp_confirm(smp);
da85e5e5
VCG		 1036
1037 return 0;
88ba43b6
AB		 1038}
1039
da85e5e5 1040static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1041{
5d88cc73
JH		 1042 struct l2cap_chan *chan = conn->smp;
1043 struct smp_chan *smp = chan->data;
7d24ddcc 1044
88ba43b6
AB		 1045 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
1046
c46b98be 1047 if (skb->len < sizeof(smp->pcnf))
38e4a915 1048 return SMP_INVALID_PARAMS;
c46b98be 1049
1c1def09
VCG		 1050 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
1051 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 1052
943a732a
JH		 1053 if (conn->hcon->out)
1054 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1055 smp->prnd);
4a74d658 1056 else if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1057 return smp_confirm(smp);
943a732a 1058 else
4a74d658 1059 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 1060
1061 return 0;
88ba43b6
AB		 1062}
1063
da85e5e5 1064static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1065{
5d88cc73
JH		 1066 struct l2cap_chan *chan = conn->smp;
1067 struct smp_chan *smp = chan->data;
7d24ddcc 1068
8aab4757 1069 BT_DBG("conn %p", conn);
3158c50c 1070
c46b98be 1071 if (skb->len < sizeof(smp->rrnd))
38e4a915 1072 return SMP_INVALID_PARAMS;
c46b98be 1073
943a732a 1074 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 1075 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 1076
861580a9 1077 return smp_random(smp);
88ba43b6
AB		 1078}
1079
f81cd823 1080static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 1081{
c9839a11 1082 struct smp_ltk *key;
988c5997
VCG		 1083 struct hci_conn *hcon = conn->hcon;
1084
98a0b845 1085 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1086 hcon->role);
988c5997 1087 if (!key)
f81cd823 1088 return false;
988c5997 1089
4dab7864 1090 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
f81cd823 1091 return false;
4dab7864 1092
51a8efd7 1093 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
f81cd823 1094 return true;
988c5997 1095
c9839a11
VCG		 1096 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
1097 hcon->enc_key_size = key->enc_size;
988c5997 1098
fe59a05f
JH		 1099 /* We never store STKs for master role, so clear this flag */
1100 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1101
f81cd823 1102 return true;
988c5997 1103}
f1560463 1104
854f4727
JH		 1105bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
1106{
1107 if (sec_level == BT_SECURITY_LOW)
1108 return true;
1109
9ab65d60
JH		 1110 /* If we're encrypted with an STK always claim insufficient
1111 * security. This way we allow the connection to be re-encrypted
1112 * with an LTK, even if the LTK provides the same level of
b2d5e254
JH		 1113 * security. Only exception is if we don't have an LTK (e.g.
1114 * because of key distribution bits).
9ab65d60 1115 */
b2d5e254
JH		 1116 if (test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
1117 hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1118 hcon->role))
9ab65d60
JH		 1119 return false;
1120
854f4727
JH		 1121 if (hcon->sec_level >= sec_level)
1122 return true;
1123
1124 return false;
1125}
1126
da85e5e5 1127static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 1128{
1129 struct smp_cmd_security_req *rp = (void *) skb->data;
1130 struct smp_cmd_pairing cp;
f1cb9af5 1131 struct hci_conn *hcon = conn->hcon;
8aab4757 1132 struct smp_chan *smp;
c7262e71 1133 u8 sec_level;
88ba43b6
AB		 1134
1135 BT_DBG("conn %p", conn);
1136
c46b98be 1137 if (skb->len < sizeof(*rp))
38e4a915 1138 return SMP_INVALID_PARAMS;
c46b98be 1139
40bef302 1140 if (hcon->role != HCI_ROLE_MASTER)
86ca9eac
JH		 1141 return SMP_CMD_NOTSUPP;
1142
c7262e71 1143 sec_level = authreq_to_seclevel(rp->auth_req);
854f4727
JH		 1144 if (smp_sufficient_security(hcon, sec_level))
1145 return 0;
1146
c7262e71
JH		 1147 if (sec_level > hcon->pending_sec_level)
1148 hcon->pending_sec_level = sec_level;
feb45eb5 1149
4dab7864 1150 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 1151 return 0;
1152
51a8efd7 1153 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 1154 return 0;
f1cb9af5 1155
8aab4757 1156 smp = smp_chan_create(conn);
c29d2444
JH		 1157 if (!smp)
1158 return SMP_UNSPECIFIED;
d26a2345 1159
b6ae8457 1160 if (!test_bit(HCI_BONDABLE, &hcon->hdev->dev_flags) &&
616d55be
JH		 1161 (rp->auth_req & SMP_AUTH_BONDING))
1162 return SMP_PAIRING_NOTSUPP;
1163
88ba43b6 1164 skb_pull(skb, sizeof(*rp));
88ba43b6 1165
da85e5e5 1166 memset(&cp, 0, sizeof(cp));
54790f73 1167 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 1168
1c1def09
VCG		 1169 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1170 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1171
88ba43b6 1172 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 1173
da85e5e5 1174 return 0;
88ba43b6
AB		 1175}
1176
cc110922 1177int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 1178{
cc110922 1179 struct l2cap_conn *conn = hcon->l2cap_data;
0a66cf20 1180 struct smp_chan *smp;
2b64d153 1181 __u8 authreq;
eb492e01 1182
3a0259bb
VCG		 1183 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
1184
0a66cf20
JH		 1185 /* This may be NULL if there's an unexpected disconnection */
1186 if (!conn)
1187 return 1;
1188
757aee0f 1189 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 1190 return 1;
1191
ad32a2f5 1192 if (smp_sufficient_security(hcon, sec_level))
eb492e01 1193 return 1;
f1cb9af5 1194
c7262e71
JH		 1195 if (sec_level > hcon->pending_sec_level)
1196 hcon->pending_sec_level = sec_level;
1197
40bef302 1198 if (hcon->role == HCI_ROLE_MASTER)
c7262e71
JH		 1199 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
1200 return 0;
d26a2345 1201
51a8efd7 1202 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1203 return 0;
1204
8aab4757 1205 smp = smp_chan_create(conn);
2b64d153
BG		 1206 if (!smp)
1207 return 1;
1208
1209 authreq = seclevel_to_authreq(sec_level);
d26a2345 1210
79897d20
JH		 1211 /* Require MITM if IO Capability allows or the security level
1212 * requires it.
2e233644 1213 */
79897d20 1214 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 1215 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 1216 authreq |= SMP_AUTH_MITM;
1217
40bef302 1218 if (hcon->role == HCI_ROLE_MASTER) {
d26a2345 1219 struct smp_cmd_pairing cp;
f01ead31 1220
2b64d153 1221 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 1222 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1223 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1224
eb492e01
AB		 1225 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
1226 } else {
1227 struct smp_cmd_security_req cp;
2b64d153 1228 cp.auth_req = authreq;
eb492e01
AB		 1229 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
1230 }
1231
4a74d658 1232 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
edca792c 1233
eb492e01
AB		 1234 return 0;
1235}
1236
7034b911
VCG		 1237static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
1238{
16b90839 1239 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
5d88cc73
JH		 1240 struct l2cap_chan *chan = conn->smp;
1241 struct smp_chan *smp = chan->data;
16b90839 1242
c46b98be
JH		 1243 BT_DBG("conn %p", conn);
1244
1245 if (skb->len < sizeof(*rp))
38e4a915 1246 return SMP_INVALID_PARAMS;
c46b98be 1247
6131ddc8
JH		 1248 /* Ignore this PDU if it wasn't requested */
1249 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1250 return 0;
1251
16b90839
VCG		 1252 skb_pull(skb, sizeof(*rp));
1253
1c1def09 1254 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 1255
7034b911
VCG		 1256 return 0;
1257}
1258
1259static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
1260{
16b90839 1261 struct smp_cmd_master_ident *rp = (void *) skb->data;
5d88cc73
JH		 1262 struct l2cap_chan *chan = conn->smp;
1263 struct smp_chan *smp = chan->data;
c9839a11
VCG		 1264 struct hci_dev *hdev = conn->hcon->hdev;
1265 struct hci_conn *hcon = conn->hcon;
23d0e128 1266 struct smp_ltk *ltk;
c9839a11 1267 u8 authenticated;
16b90839 1268
c46b98be
JH		 1269 BT_DBG("conn %p", conn);
1270
1271 if (skb->len < sizeof(*rp))
38e4a915 1272 return SMP_INVALID_PARAMS;
c46b98be 1273
6131ddc8
JH		 1274 /* Ignore this PDU if it wasn't requested */
1275 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1276 return 0;
1277
9747a9f3
JH		 1278 /* Mark the information as received */
1279 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1280
16b90839 1281 skb_pull(skb, sizeof(*rp));
7034b911 1282
c9839a11 1283 hci_dev_lock(hdev);
ce39fb4e 1284 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2ceba539 1285 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
23d0e128
JH		 1286 authenticated, smp->tk, smp->enc_key_size,
1287 rp->ediv, rp->rand);
1288 smp->ltk = ltk;
fd349c02 1289 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 1290 smp_distribute_keys(conn);
c9839a11 1291 hci_dev_unlock(hdev);
7034b911
VCG		 1292
1293 return 0;
1294}
1295
fd349c02
JH		 1296static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1297{
1298 struct smp_cmd_ident_info *info = (void *) skb->data;
5d88cc73
JH		 1299 struct l2cap_chan *chan = conn->smp;
1300 struct smp_chan *smp = chan->data;
fd349c02
JH		 1301
1302 BT_DBG("");
1303
1304 if (skb->len < sizeof(*info))
38e4a915 1305 return SMP_INVALID_PARAMS;
fd349c02 1306
6131ddc8
JH		 1307 /* Ignore this PDU if it wasn't requested */
1308 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1309 return 0;
1310
fd349c02
JH		 1311 skb_pull(skb, sizeof(*info));
1312
1313 memcpy(smp->irk, info->irk, 16);
1314
1315 return 0;
1316}
1317
1318static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1319 struct sk_buff *skb)
1320{
1321 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
5d88cc73
JH		 1322 struct l2cap_chan *chan = conn->smp;
1323 struct smp_chan *smp = chan->data;
fd349c02
JH		 1324 struct hci_conn *hcon = conn->hcon;
1325 bdaddr_t rpa;
1326
1327 BT_DBG("");
1328
1329 if (skb->len < sizeof(*info))
38e4a915 1330 return SMP_INVALID_PARAMS;
fd349c02 1331
6131ddc8
JH		 1332 /* Ignore this PDU if it wasn't requested */
1333 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1334 return 0;
1335
9747a9f3
JH		 1336 /* Mark the information as received */
1337 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1338
fd349c02
JH		 1339 skb_pull(skb, sizeof(*info));
1340
31dd624e
JH		 1341 hci_dev_lock(hcon->hdev);
1342
a9a58f86
JH		 1343 /* Strictly speaking the Core Specification (4.1) allows sending
1344 * an empty address which would force us to rely on just the IRK
1345 * as "identity information". However, since such
1346 * implementations are not known of and in order to not over
1347 * complicate our implementation, simply pretend that we never
1348 * received an IRK for such a device.
1349 */
1350 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1351 BT_ERR("Ignoring IRK with no identity address");
31dd624e 1352 goto distribute;
a9a58f86
JH		 1353 }
1354
fd349c02
JH		 1355 bacpy(&smp->id_addr, &info->bdaddr);
1356 smp->id_addr_type = info->addr_type;
1357
1358 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1359 bacpy(&rpa, &hcon->dst);
1360 else
1361 bacpy(&rpa, BDADDR_ANY);
1362
23d0e128
JH		 1363 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1364 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1365
31dd624e 1366distribute:
4bd6d38e 1367 smp_distribute_keys(conn);
fd349c02 1368
31dd624e
JH		 1369 hci_dev_unlock(hcon->hdev);
1370
fd349c02
JH		 1371 return 0;
1372}
1373
7ee4ea36
MH		 1374static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1375{
1376 struct smp_cmd_sign_info *rp = (void *) skb->data;
5d88cc73
JH		 1377 struct l2cap_chan *chan = conn->smp;
1378 struct smp_chan *smp = chan->data;
7ee4ea36
MH		 1379 struct hci_dev *hdev = conn->hcon->hdev;
1380 struct smp_csrk *csrk;
1381
1382 BT_DBG("conn %p", conn);
1383
1384 if (skb->len < sizeof(*rp))
38e4a915 1385 return SMP_INVALID_PARAMS;
7ee4ea36
MH		 1386
1387 /* Ignore this PDU if it wasn't requested */
1388 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1389 return 0;
1390
1391 /* Mark the information as received */
1392 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1393
1394 skb_pull(skb, sizeof(*rp));
1395
1396 hci_dev_lock(hdev);
1397 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1398 if (csrk) {
1399 csrk->master = 0x01;
1400 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1401 }
1402 smp->csrk = csrk;
5fcb9347 1403 smp_distribute_keys(conn);
7ee4ea36
MH		 1404 hci_dev_unlock(hdev);
1405
1406 return 0;
1407}
1408
4befb867 1409static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
eb492e01 1410{
5d88cc73 1411 struct l2cap_conn *conn = chan->conn;
7b9899db 1412 struct hci_conn *hcon = conn->hcon;
92381f5c 1413 __u8 code, reason;
eb492e01
AB		 1414 int err = 0;
1415
7b9899db
MH		 1416 if (hcon->type != LE_LINK) {
1417 kfree_skb(skb);
3432711f 1418 return 0;
7b9899db
MH		 1419 }
1420
8ae9b984 1421 if (skb->len < 1)
92381f5c 1422 return -EILSEQ;
92381f5c 1423
06ae3314 1424 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
beb19e4c 1425 err = -EOPNOTSUPP;
2e65c9d2
AG		 1426 reason = SMP_PAIRING_NOTSUPP;
1427 goto done;
1428 }
1429
92381f5c 1430 code = skb->data[0];
eb492e01
AB		 1431 skb_pull(skb, sizeof(code));
1432
8cf9fa12
JH		 1433 /*
1434 * The SMP context must be initialized for all other PDUs except
1435 * pairing and security requests. If we get any other PDU when
1436 * not initialized simply disconnect (done if this function
1437 * returns an error).
1438 */
1439 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
d3368605 1440 !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
8cf9fa12 1441 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
8ae9b984
JH		 1442 reason = SMP_CMD_NOTSUPP;
1443 err = -EOPNOTSUPP;
1444 goto done;
8cf9fa12
JH		 1445 }
1446
eb492e01
AB		 1447 switch (code) {
1448 case SMP_CMD_PAIRING_REQ:
da85e5e5 1449 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1450 break;
1451
1452 case SMP_CMD_PAIRING_FAIL:
84794e11 1453 smp_failure(conn, 0);
da85e5e5
VCG		 1454 reason = 0;
1455 err = -EPERM;
eb492e01
AB		 1456 break;
1457
1458 case SMP_CMD_PAIRING_RSP:
da85e5e5 1459 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1460 break;
1461
1462 case SMP_CMD_SECURITY_REQ:
da85e5e5 1463 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1464 break;
1465
eb492e01 1466 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1467 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1468 break;
1469
eb492e01 1470 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1471 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1472 break;
1473
eb492e01 1474 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1475 reason = smp_cmd_encrypt_info(conn, skb);
1476 break;
1477
eb492e01 1478 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1479 reason = smp_cmd_master_ident(conn, skb);
1480 break;
1481
eb492e01 1482 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1483 reason = smp_cmd_ident_info(conn, skb);
1484 break;
1485
eb492e01 1486 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1487 reason = smp_cmd_ident_addr_info(conn, skb);
1488 break;
1489
eb492e01 1490 case SMP_CMD_SIGN_INFO:
7ee4ea36 1491 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1492 break;
1493
eb492e01
AB		 1494 default:
1495 BT_DBG("Unknown command code 0x%2.2x", code);
1496
1497 reason = SMP_CMD_NOTSUPP;
eb492e01 1498 err = -EOPNOTSUPP;
3a0259bb 1499 goto done;
eb492e01
AB		 1500 }
1501
3a0259bb
VCG		 1502done:
1503 if (reason)
84794e11 1504 smp_failure(conn, reason);
8ae9b984
JH		 1505 if (!err)
1506 kfree_skb(skb);
eb492e01
AB		 1507 return err;
1508}
7034b911 1509
70db83c4
JH		 1510static void smp_teardown_cb(struct l2cap_chan *chan, int err)
1511{
1512 struct l2cap_conn *conn = chan->conn;
b68fda68 1513 struct smp_chan *smp = chan->data;
70db83c4
JH		 1514
1515 BT_DBG("chan %p", chan);
1516
109ec230 1517 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
5d88cc73 1518 smp_chan_destroy(conn);
5d88cc73 1519
70db83c4
JH		 1520 conn->smp = NULL;
1521 l2cap_chan_put(chan);
1522}
1523
44f1a7ab
JH		 1524static void smp_resume_cb(struct l2cap_chan *chan)
1525{
b68fda68 1526 struct smp_chan *smp = chan->data;
44f1a7ab
JH		 1527 struct l2cap_conn *conn = chan->conn;
1528 struct hci_conn *hcon = conn->hcon;
1529
1530 BT_DBG("chan %p", chan);
1531
1532 if (test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
1533 smp_distribute_keys(conn);
b68fda68
JH		 1534
1535 if (smp)
1536 cancel_delayed_work(&smp->security_timer);
44f1a7ab
JH		 1537}
1538
70db83c4
JH		 1539static void smp_ready_cb(struct l2cap_chan *chan)
1540{
1541 struct l2cap_conn *conn = chan->conn;
1542
1543 BT_DBG("chan %p", chan);
1544
1545 conn->smp = chan;
1546 l2cap_chan_hold(chan);
1547}
1548
4befb867
JH		 1549static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1550{
1551 int err;
1552
1553 BT_DBG("chan %p", chan);
1554
1555 err = smp_sig_channel(chan, skb);
1556 if (err) {
b68fda68 1557 struct smp_chan *smp = chan->data;
4befb867 1558
b68fda68
JH		 1559 if (smp)
1560 cancel_delayed_work_sync(&smp->security_timer);
4befb867
JH		 1561
1562 l2cap_conn_shutdown(chan->conn, -err);
1563 }
1564
1565 return err;
1566}
1567
70db83c4
JH		 1568static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
1569 unsigned long hdr_len,
1570 unsigned long len, int nb)
1571{
1572 struct sk_buff *skb;
1573
1574 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
1575 if (!skb)
1576 return ERR_PTR(-ENOMEM);
1577
1578 skb->priority = HCI_PRIO_MAX;
1579 bt_cb(skb)->chan = chan;
1580
1581 return skb;
1582}
1583
1584static const struct l2cap_ops smp_chan_ops = {
1585 .name = "Security Manager",
1586 .ready = smp_ready_cb,
5d88cc73 1587 .recv = smp_recv_cb,
70db83c4
JH		 1588 .alloc_skb = smp_alloc_skb_cb,
1589 .teardown = smp_teardown_cb,
44f1a7ab 1590 .resume = smp_resume_cb,
70db83c4
JH		 1591
1592 .new_connection = l2cap_chan_no_new_connection,
70db83c4
JH		 1593 .state_change = l2cap_chan_no_state_change,
1594 .close = l2cap_chan_no_close,
1595 .defer = l2cap_chan_no_defer,
1596 .suspend = l2cap_chan_no_suspend,
70db83c4
JH		 1597 .set_shutdown = l2cap_chan_no_set_shutdown,
1598 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1599 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1600};
1601
1602static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
1603{
1604 struct l2cap_chan *chan;
1605
1606 BT_DBG("pchan %p", pchan);
1607
1608 chan = l2cap_chan_create();
1609 if (!chan)
1610 return NULL;
1611
1612 chan->chan_type = pchan->chan_type;
1613 chan->ops = &smp_chan_ops;
1614 chan->scid = pchan->scid;
1615 chan->dcid = chan->scid;
1616 chan->imtu = pchan->imtu;
1617 chan->omtu = pchan->omtu;
1618 chan->mode = pchan->mode;
1619
1620 BT_DBG("created chan %p", chan);
1621
1622 return chan;
1623}
1624
1625static const struct l2cap_ops smp_root_chan_ops = {
1626 .name = "Security Manager Root",
1627 .new_connection = smp_new_conn_cb,
1628
1629 /* None of these are implemented for the root channel */
1630 .close = l2cap_chan_no_close,
1631 .alloc_skb = l2cap_chan_no_alloc_skb,
1632 .recv = l2cap_chan_no_recv,
1633 .state_change = l2cap_chan_no_state_change,
1634 .teardown = l2cap_chan_no_teardown,
1635 .ready = l2cap_chan_no_ready,
1636 .defer = l2cap_chan_no_defer,
1637 .suspend = l2cap_chan_no_suspend,
1638 .resume = l2cap_chan_no_resume,
1639 .set_shutdown = l2cap_chan_no_set_shutdown,
1640 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1641 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1642};
1643
711eafe3
JH		 1644int smp_register(struct hci_dev *hdev)
1645{
70db83c4 1646 struct l2cap_chan *chan;
defce9e8 1647 struct crypto_blkcipher *tfm_aes;
70db83c4 1648
711eafe3
JH		 1649 BT_DBG("%s", hdev->name);
1650
defce9e8
JH		 1651 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1652 if (IS_ERR(tfm_aes)) {
1653 int err = PTR_ERR(tfm_aes);
711eafe3 1654 BT_ERR("Unable to create crypto context");
711eafe3
JH		 1655 return err;
1656 }
1657
70db83c4
JH		 1658 chan = l2cap_chan_create();
1659 if (!chan) {
defce9e8 1660 crypto_free_blkcipher(tfm_aes);
70db83c4
JH		 1661 return -ENOMEM;
1662 }
1663
defce9e8
JH		 1664 chan->data = tfm_aes;
1665
5d88cc73 1666 l2cap_add_scid(chan, L2CAP_CID_SMP);
70db83c4
JH		 1667
1668 l2cap_chan_set_defaults(chan);
1669
1670 bacpy(&chan->src, &hdev->bdaddr);
1671 chan->src_type = BDADDR_LE_PUBLIC;
1672 chan->state = BT_LISTEN;
1673 chan->mode = L2CAP_MODE_BASIC;
1674 chan->imtu = L2CAP_DEFAULT_MTU;
1675 chan->ops = &smp_root_chan_ops;
1676
1677 hdev->smp_data = chan;
1678
711eafe3
JH		 1679 return 0;
1680}
1681
1682void smp_unregister(struct hci_dev *hdev)
1683{
70db83c4 1684 struct l2cap_chan *chan = hdev->smp_data;
defce9e8 1685 struct crypto_blkcipher *tfm_aes;
70db83c4
JH		 1686
1687 if (!chan)
1688 return;
1689
1690 BT_DBG("%s chan %p", hdev->name, chan);
711eafe3 1691
defce9e8
JH		 1692 tfm_aes = chan->data;
1693 if (tfm_aes) {
1694 chan->data = NULL;
1695 crypto_free_blkcipher(tfm_aes);
711eafe3 1696 }
70db83c4
JH		 1697
1698 hdev->smp_data = NULL;
1699 l2cap_chan_put(chan);
711eafe3 1700}
Linux kernel - Deliverables
This page took 0.286731 seconds and 5 git commands to generate.