projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix allowing SMP Signing info PDU
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
b28b4943
JH		 34#define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd)
35#define SMP_DISALLOW_CMD(smp, code) clear_bit(code, &smp->allow_cmd)
36
17b02e62 37#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 38
065a13e2 39#define AUTH_REQ_MASK 0x07
88d3a8ac 40#define KEY_DIST_MASK 0x07
065a13e2 41
533e35d4
JH		 42enum {
43 SMP_FLAG_TK_VALID,
44 SMP_FLAG_CFM_PENDING,
45 SMP_FLAG_MITM_AUTH,
46 SMP_FLAG_COMPLETE,
47 SMP_FLAG_INITIATOR,
48};
4bc58f51
JH		 49
50struct smp_chan {
b68fda68
JH		 51 struct l2cap_conn *conn;
52 struct delayed_work security_timer;
b28b4943 53 unsigned long allow_cmd; /* Bitmask of allowed commands */
b68fda68 54
4bc58f51
JH		 55 u8 preq[7]; /* SMP Pairing Request */
56 u8 prsp[7]; /* SMP Pairing Response */
57 u8 prnd[16]; /* SMP Pairing Random (local) */
58 u8 rrnd[16]; /* SMP Pairing Random (remote) */
59 u8 pcnf[16]; /* SMP Pairing Confirm */
60 u8 tk[16]; /* SMP Temporary Key */
61 u8 enc_key_size;
62 u8 remote_key_dist;
63 bdaddr_t id_addr;
64 u8 id_addr_type;
65 u8 irk[16];
66 struct smp_csrk *csrk;
67 struct smp_csrk *slave_csrk;
68 struct smp_ltk *ltk;
69 struct smp_ltk *slave_ltk;
70 struct smp_irk *remote_irk;
4a74d658 71 unsigned long flags;
6a7bd103
JH		 72
73 struct crypto_blkcipher *tfm_aes;
4bc58f51
JH		 74};
75
8a2936f4 76static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
d22ef0bc 77{
8a2936f4 78 size_t i;
d22ef0bc 79
8a2936f4
JH		 80 for (i = 0; i < len; i++)
81 dst[len - 1 - i] = src[i];
d22ef0bc
AB		 82}
83
84static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
85{
86 struct blkcipher_desc desc;
87 struct scatterlist sg;
943a732a 88 uint8_t tmp[16], data[16];
201a5929 89 int err;
d22ef0bc
AB		 90
91 if (tfm == NULL) {
92 BT_ERR("tfm %p", tfm);
93 return -EINVAL;
94 }
95
96 desc.tfm = tfm;
97 desc.flags = 0;
98
943a732a 99 /* The most significant octet of key corresponds to k[0] */
8a2936f4 100 swap_buf(k, tmp, 16);
943a732a
JH		 101
102 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 103 if (err) {
104 BT_ERR("cipher setkey failed: %d", err);
105 return err;
106 }
107
943a732a 108 /* Most significant octet of plaintextData corresponds to data[0] */
8a2936f4 109 swap_buf(r, data, 16);
943a732a
JH		 110
111 sg_init_one(&sg, data, 16);
d22ef0bc 112
d22ef0bc
AB		 113 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
114 if (err)
115 BT_ERR("Encrypt data error %d", err);
116
943a732a 117 /* Most significant octet of encryptedData corresponds to data[0] */
8a2936f4 118 swap_buf(data, r, 16);
943a732a 119
d22ef0bc
AB		 120 return err;
121}
122
60478054
JH		 123static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
124{
943a732a 125 u8 _res[16];
60478054
JH		 126 int err;
127
128 /* r' = padding || r */
943a732a
JH		 129 memcpy(_res, r, 3);
130 memset(_res + 3, 0, 13);
60478054 131
943a732a 132 err = smp_e(tfm, irk, _res);
60478054
JH		 133 if (err) {
134 BT_ERR("Encrypt error");
135 return err;
136 }
137
138 /* The output of the random address function ah is:
139 * ah(h, r) = e(k, r') mod 2^24
140 * The output of the security function e is then truncated to 24 bits
141 * by taking the least significant 24 bits of the output of e as the
142 * result of ah.
143 */
943a732a 144 memcpy(res, _res, 3);
60478054
JH		 145
146 return 0;
147}
148
defce9e8 149bool smp_irk_matches(struct hci_dev *hdev, u8 irk[16], bdaddr_t *bdaddr)
60478054 150{
defce9e8
JH		 151 struct l2cap_chan *chan = hdev->smp_data;
152 struct crypto_blkcipher *tfm;
60478054
JH		 153 u8 hash[3];
154 int err;
155
defce9e8
JH		 156 if (!chan || !chan->data)
157 return false;
158
159 tfm = chan->data;
160
60478054
JH		 161 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
162
163 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
164 if (err)
165 return false;
166
167 return !memcmp(bdaddr->b, hash, 3);
168}
169
defce9e8 170int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
b1e2b3ae 171{
defce9e8
JH		 172 struct l2cap_chan *chan = hdev->smp_data;
173 struct crypto_blkcipher *tfm;
b1e2b3ae
JH		 174 int err;
175
defce9e8
JH		 176 if (!chan || !chan->data)
177 return -EOPNOTSUPP;
178
179 tfm = chan->data;
180
b1e2b3ae
JH		 181 get_random_bytes(&rpa->b[3], 3);
182
183 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
184 rpa->b[5] |= 0x40; /* Set second most significant bit */
185
186 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
187 if (err < 0)
188 return err;
189
190 BT_DBG("RPA %pMR", rpa);
191
192 return 0;
193}
194
ec70f36f
JH		 195static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
196 u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat, bdaddr_t *ra,
197 u8 res[16])
d22ef0bc 198{
ec70f36f 199 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 200 u8 p1[16], p2[16];
201 int err;
202
ec70f36f
JH		 203 BT_DBG("%s", hdev->name);
204
d22ef0bc
AB		 205 memset(p1, 0, 16);
206
207 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 208 p1[0] = _iat;
209 p1[1] = _rat;
210 memcpy(p1 + 2, preq, 7);
211 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 212
213 /* p2 = padding || ia || ra */
943a732a
JH		 214 memcpy(p2, ra, 6);
215 memcpy(p2 + 6, ia, 6);
216 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 217
218 /* res = r XOR p1 */
219 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
220
221 /* res = e(k, res) */
ec70f36f 222 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 223 if (err) {
224 BT_ERR("Encrypt data error");
225 return err;
226 }
227
228 /* res = res XOR p2 */
229 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
230
231 /* res = e(k, res) */
ec70f36f 232 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 233 if (err)
234 BT_ERR("Encrypt data error");
235
236 return err;
237}
238
ec70f36f
JH		 239static int smp_s1(struct smp_chan *smp, u8 k[16], u8 r1[16], u8 r2[16],
240 u8 _r[16])
d22ef0bc 241{
ec70f36f 242 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 243 int err;
244
ec70f36f
JH		 245 BT_DBG("%s", hdev->name);
246
d22ef0bc 247 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 248 memcpy(_r, r2, 8);
249 memcpy(_r + 8, r1, 8);
d22ef0bc 250
ec70f36f 251 err = smp_e(smp->tfm_aes, k, _r);
d22ef0bc
AB		 252 if (err)
253 BT_ERR("Encrypt data error");
254
255 return err;
256}
257
5d88cc73 258static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
eb492e01 259{
5d88cc73 260 struct l2cap_chan *chan = conn->smp;
b68fda68 261 struct smp_chan *smp;
5d88cc73
JH		 262 struct kvec iv[2];
263 struct msghdr msg;
eb492e01 264
5d88cc73
JH		 265 if (!chan)
266 return;
eb492e01 267
5d88cc73 268 BT_DBG("code 0x%2.2x", code);
eb492e01 269
5d88cc73
JH		 270 iv[0].iov_base = &code;
271 iv[0].iov_len = 1;
eb492e01 272
5d88cc73
JH		 273 iv[1].iov_base = data;
274 iv[1].iov_len = len;
eb492e01 275
5d88cc73 276 memset(&msg, 0, sizeof(msg));
eb492e01 277
5d88cc73
JH		 278 msg.msg_iov = (struct iovec *) &iv;
279 msg.msg_iovlen = 2;
eb492e01 280
5d88cc73 281 l2cap_chan_send(chan, &msg, 1 + len);
e2dcd113 282
b68fda68
JH		 283 if (!chan->data)
284 return;
285
286 smp = chan->data;
287
288 cancel_delayed_work_sync(&smp->security_timer);
1b0921d6 289 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
eb492e01
AB		 290}
291
2b64d153
BG		 292static __u8 authreq_to_seclevel(__u8 authreq)
293{
294 if (authreq & SMP_AUTH_MITM)
295 return BT_SECURITY_HIGH;
296 else
297 return BT_SECURITY_MEDIUM;
298}
299
300static __u8 seclevel_to_authreq(__u8 sec_level)
301{
302 switch (sec_level) {
303 case BT_SECURITY_HIGH:
304 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
305 case BT_SECURITY_MEDIUM:
306 return SMP_AUTH_BONDING;
307 default:
308 return SMP_AUTH_NONE;
309 }
310}
311
b8e66eac 312static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 313 struct smp_cmd_pairing *req,
314 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 315{
5d88cc73
JH		 316 struct l2cap_chan *chan = conn->smp;
317 struct smp_chan *smp = chan->data;
fd349c02
JH		 318 struct hci_conn *hcon = conn->hcon;
319 struct hci_dev *hdev = hcon->hdev;
320 u8 local_dist = 0, remote_dist = 0;
54790f73 321
b6ae8457 322 if (test_bit(HCI_BONDABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 323 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
324 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 325 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 326 } else {
327 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 328 }
329
fd349c02
JH		 330 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
331 remote_dist |= SMP_DIST_ID_KEY;
332
863efaf2
JH		 333 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
334 local_dist |= SMP_DIST_ID_KEY;
335
54790f73
VCG		 336 if (rsp == NULL) {
337 req->io_capability = conn->hcon->io_capability;
338 req->oob_flag = SMP_OOB_NOT_PRESENT;
339 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 340 req->init_key_dist = local_dist;
341 req->resp_key_dist = remote_dist;
065a13e2 342 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 343
344 smp->remote_key_dist = remote_dist;
54790f73
VCG		 345 return;
346 }
347
348 rsp->io_capability = conn->hcon->io_capability;
349 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
350 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 351 rsp->init_key_dist = req->init_key_dist & remote_dist;
352 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 353 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 354
355 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 356}
357
3158c50c
VCG		 358static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
359{
5d88cc73
JH		 360 struct l2cap_chan *chan = conn->smp;
361 struct smp_chan *smp = chan->data;
1c1def09 362
3158c50c 363 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 364 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 365 return SMP_ENC_KEY_SIZE;
366
f7aa611a 367 smp->enc_key_size = max_key_size;
3158c50c
VCG		 368
369 return 0;
370}
371
6f48e260
JH		 372static void smp_chan_destroy(struct l2cap_conn *conn)
373{
374 struct l2cap_chan *chan = conn->smp;
375 struct smp_chan *smp = chan->data;
376 bool complete;
377
378 BUG_ON(!smp);
379
380 cancel_delayed_work_sync(&smp->security_timer);
6f48e260 381
6f48e260
JH		 382 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
383 mgmt_smp_complete(conn->hcon, complete);
384
385 kfree(smp->csrk);
386 kfree(smp->slave_csrk);
387
388 crypto_free_blkcipher(smp->tfm_aes);
389
390 /* If pairing failed clean up any keys we might have */
391 if (!complete) {
392 if (smp->ltk) {
393 list_del(&smp->ltk->list);
394 kfree(smp->ltk);
395 }
396
397 if (smp->slave_ltk) {
398 list_del(&smp->slave_ltk->list);
399 kfree(smp->slave_ltk);
400 }
401
402 if (smp->remote_irk) {
403 list_del(&smp->remote_irk->list);
404 kfree(smp->remote_irk);
405 }
406 }
407
408 chan->data = NULL;
409 kfree(smp);
410 hci_conn_drop(conn->hcon);
411}
412
84794e11 413static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 414{
bab73cb6 415 struct hci_conn *hcon = conn->hcon;
b68fda68 416 struct l2cap_chan *chan = conn->smp;
bab73cb6 417
84794e11 418 if (reason)
4f957a76 419 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 420 &reason);
4f957a76 421
ce39fb4e 422 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
e1e930f5 423 mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE);
f1c09c07 424
fc75cc86 425 if (chan->data)
f1c09c07 426 smp_chan_destroy(conn);
4f957a76
BG		 427}
428
2b64d153
BG		 429#define JUST_WORKS 0x00
430#define JUST_CFM 0x01
431#define REQ_PASSKEY 0x02
432#define CFM_PASSKEY 0x03
433#define REQ_OOB 0x04
434#define OVERLAP 0xFF
435
436static const u8 gen_method[5][5] = {
437 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
438 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
439 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
440 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
441 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
442};
443
581370cc
JH		 444static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
445{
2bcd4003
JH		 446 /* If either side has unknown io_caps, use JUST_CFM (which gets
447 * converted later to JUST_WORKS if we're initiators.
448 */
581370cc
JH		 449 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
450 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2bcd4003 451 return JUST_CFM;
581370cc
JH		 452
453 return gen_method[remote_io][local_io];
454}
455
2b64d153
BG		 456static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
457 u8 local_io, u8 remote_io)
458{
459 struct hci_conn *hcon = conn->hcon;
5d88cc73
JH		 460 struct l2cap_chan *chan = conn->smp;
461 struct smp_chan *smp = chan->data;
2b64d153
BG		 462 u8 method;
463 u32 passkey = 0;
464 int ret = 0;
465
466 /* Initialize key for JUST WORKS */
467 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 468 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 469
470 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
471
2bcd4003
JH		 472 /* If neither side wants MITM, either "just" confirm an incoming
473 * request or use just-works for outgoing ones. The JUST_CFM
474 * will be converted to JUST_WORKS if necessary later in this
475 * function. If either side has MITM look up the method from the
476 * table.
477 */
581370cc 478 if (!(auth & SMP_AUTH_MITM))
2bcd4003 479 method = JUST_CFM;
2b64d153 480 else
581370cc 481 method = get_auth_method(smp, local_io, remote_io);
2b64d153 482
a82505c7 483 /* Don't confirm locally initiated pairing attempts */
4a74d658 484 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 485 method = JUST_WORKS;
486
02f3e254
JH		 487 /* Don't bother user space with no IO capabilities */
488 if (method == JUST_CFM && hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
489 method = JUST_WORKS;
490
2b64d153
BG		 491 /* If Just Works, Continue with Zero TK */
492 if (method == JUST_WORKS) {
4a74d658 493 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 494 return 0;
495 }
496
497 /* Not Just Works/Confirm results in MITM Authentication */
498 if (method != JUST_CFM)
4a74d658 499 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
2b64d153
BG		 500
501 /* If both devices have Keyoard-Display I/O, the master
502 * Confirms and the slave Enters the passkey.
503 */
504 if (method == OVERLAP) {
40bef302 505 if (hcon->role == HCI_ROLE_MASTER)
2b64d153
BG		 506 method = CFM_PASSKEY;
507 else
508 method = REQ_PASSKEY;
509 }
510
01ad34d2 511 /* Generate random passkey. */
2b64d153 512 if (method == CFM_PASSKEY) {
943a732a 513 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 514 get_random_bytes(&passkey, sizeof(passkey));
515 passkey %= 1000000;
943a732a 516 put_unaligned_le32(passkey, smp->tk);
2b64d153 517 BT_DBG("PassKey: %d", passkey);
4a74d658 518 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 519 }
520
521 hci_dev_lock(hcon->hdev);
522
523 if (method == REQ_PASSKEY)
ce39fb4e 524 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 525 hcon->type, hcon->dst_type);
4eb65e66
JH		 526 else if (method == JUST_CFM)
527 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
528 hcon->type, hcon->dst_type,
529 passkey, 1);
2b64d153 530 else
01ad34d2 531 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 532 hcon->type, hcon->dst_type,
39adbffe 533 passkey, 0);
2b64d153
BG		 534
535 hci_dev_unlock(hcon->hdev);
536
537 return ret;
538}
539
1cc61144 540static u8 smp_confirm(struct smp_chan *smp)
8aab4757 541{
8aab4757 542 struct l2cap_conn *conn = smp->conn;
8aab4757
VCG		 543 struct smp_cmd_pairing_confirm cp;
544 int ret;
8aab4757
VCG		 545
546 BT_DBG("conn %p", conn);
547
ec70f36f 548 ret = smp_c1(smp, smp->tk, smp->prnd, smp->preq, smp->prsp,
b1cd5fd9 549 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 550 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
551 cp.confirm_val);
1cc61144
JH		 552 if (ret)
553 return SMP_UNSPECIFIED;
8aab4757 554
4a74d658 555 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 556
8aab4757
VCG		 557 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
558
b28b4943
JH		 559 if (conn->hcon->out)
560 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
561 else
562 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
563
1cc61144 564 return 0;
8aab4757
VCG		 565}
566
861580a9 567static u8 smp_random(struct smp_chan *smp)
8aab4757 568{
8aab4757
VCG		 569 struct l2cap_conn *conn = smp->conn;
570 struct hci_conn *hcon = conn->hcon;
861580a9 571 u8 confirm[16];
8aab4757
VCG		 572 int ret;
573
ec70f36f 574 if (IS_ERR_OR_NULL(smp->tfm_aes))
861580a9 575 return SMP_UNSPECIFIED;
8aab4757
VCG		 576
577 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
578
ec70f36f 579 ret = smp_c1(smp, smp->tk, smp->rrnd, smp->preq, smp->prsp,
b1cd5fd9 580 hcon->init_addr_type, &hcon->init_addr,
943a732a 581 hcon->resp_addr_type, &hcon->resp_addr, confirm);
861580a9
JH		 582 if (ret)
583 return SMP_UNSPECIFIED;
8aab4757 584
8aab4757
VCG		 585 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
586 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 587 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 588 }
589
590 if (hcon->out) {
fe39c7b2
MH		 591 u8 stk[16];
592 __le64 rand = 0;
593 __le16 ediv = 0;
8aab4757 594
ec70f36f 595 smp_s1(smp, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 596
f7aa611a 597 memset(stk + smp->enc_key_size, 0,
04124681 598 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 599
861580a9
JH		 600 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
601 return SMP_UNSPECIFIED;
8aab4757
VCG		 602
603 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 604 hcon->enc_key_size = smp->enc_key_size;
fe59a05f 605 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
8aab4757 606 } else {
fff3490f 607 u8 stk[16], auth;
fe39c7b2
MH		 608 __le64 rand = 0;
609 __le16 ediv = 0;
8aab4757 610
943a732a
JH		 611 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
612 smp->prnd);
8aab4757 613
ec70f36f 614 smp_s1(smp, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 615
f7aa611a 616 memset(stk + smp->enc_key_size, 0,
f1560463 617 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 618
fff3490f
JH		 619 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
620 auth = 1;
621 else
622 auth = 0;
623
7d5843b7
JH		 624 /* Even though there's no _SLAVE suffix this is the
625 * slave STK we're adding for later lookup (the master
626 * STK never needs to be stored).
627 */
ce39fb4e 628 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2ceba539 629 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
8aab4757
VCG		 630 }
631
861580a9 632 return 0;
8aab4757
VCG		 633}
634
44f1a7ab
JH		 635static void smp_notify_keys(struct l2cap_conn *conn)
636{
637 struct l2cap_chan *chan = conn->smp;
638 struct smp_chan *smp = chan->data;
639 struct hci_conn *hcon = conn->hcon;
640 struct hci_dev *hdev = hcon->hdev;
641 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
642 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
643 bool persistent;
644
645 if (smp->remote_irk) {
646 mgmt_new_irk(hdev, smp->remote_irk);
647 /* Now that user space can be considered to know the
648 * identity address track the connection based on it
649 * from now on.
650 */
651 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
652 hcon->dst_type = smp->remote_irk->addr_type;
f3d82d0c 653 queue_work(hdev->workqueue, &conn->id_addr_update_work);
44f1a7ab
JH		 654
655 /* When receiving an indentity resolving key for
656 * a remote device that does not use a resolvable
657 * private address, just remove the key so that
658 * it is possible to use the controller white
659 * list for scanning.
660 *
661 * Userspace will have been told to not store
662 * this key at this point. So it is safe to
663 * just remove it.
664 */
665 if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
666 list_del(&smp->remote_irk->list);
667 kfree(smp->remote_irk);
668 smp->remote_irk = NULL;
669 }
670 }
671
672 /* The LTKs and CSRKs should be persistent only if both sides
673 * had the bonding bit set in their authentication requests.
674 */
675 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
676
677 if (smp->csrk) {
678 smp->csrk->bdaddr_type = hcon->dst_type;
679 bacpy(&smp->csrk->bdaddr, &hcon->dst);
680 mgmt_new_csrk(hdev, smp->csrk, persistent);
681 }
682
683 if (smp->slave_csrk) {
684 smp->slave_csrk->bdaddr_type = hcon->dst_type;
685 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
686 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
687 }
688
689 if (smp->ltk) {
690 smp->ltk->bdaddr_type = hcon->dst_type;
691 bacpy(&smp->ltk->bdaddr, &hcon->dst);
692 mgmt_new_ltk(hdev, smp->ltk, persistent);
693 }
694
695 if (smp->slave_ltk) {
696 smp->slave_ltk->bdaddr_type = hcon->dst_type;
697 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
698 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
699 }
700}
701
b28b4943
JH		 702static void smp_allow_key_dist(struct smp_chan *smp)
703{
704 /* Allow the first expected phase 3 PDU. The rest of the PDUs
705 * will be allowed in each PDU handler to ensure we receive
706 * them in the correct order.
707 */
708 if (smp->remote_key_dist & SMP_DIST_ENC_KEY)
709 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
710 else if (smp->remote_key_dist & SMP_DIST_ID_KEY)
711 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
712 else if (smp->remote_key_dist & SMP_DIST_SIGN)
713 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
714}
715
d6268e86 716static void smp_distribute_keys(struct smp_chan *smp)
44f1a7ab
JH		 717{
718 struct smp_cmd_pairing *req, *rsp;
86d1407c 719 struct l2cap_conn *conn = smp->conn;
44f1a7ab
JH		 720 struct hci_conn *hcon = conn->hcon;
721 struct hci_dev *hdev = hcon->hdev;
722 __u8 *keydist;
723
724 BT_DBG("conn %p", conn);
725
44f1a7ab
JH		 726 rsp = (void *) &smp->prsp[1];
727
728 /* The responder sends its keys first */
b28b4943
JH		 729 if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) {
730 smp_allow_key_dist(smp);
86d1407c 731 return;
b28b4943 732 }
44f1a7ab
JH		 733
734 req = (void *) &smp->preq[1];
735
736 if (hcon->out) {
737 keydist = &rsp->init_key_dist;
738 *keydist &= req->init_key_dist;
739 } else {
740 keydist = &rsp->resp_key_dist;
741 *keydist &= req->resp_key_dist;
742 }
743
744 BT_DBG("keydist 0x%x", *keydist);
745
746 if (*keydist & SMP_DIST_ENC_KEY) {
747 struct smp_cmd_encrypt_info enc;
748 struct smp_cmd_master_ident ident;
749 struct smp_ltk *ltk;
750 u8 authenticated;
751 __le16 ediv;
752 __le64 rand;
753
754 get_random_bytes(enc.ltk, sizeof(enc.ltk));
755 get_random_bytes(&ediv, sizeof(ediv));
756 get_random_bytes(&rand, sizeof(rand));
757
758 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
759
760 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
761 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
762 SMP_LTK_SLAVE, authenticated, enc.ltk,
763 smp->enc_key_size, ediv, rand);
764 smp->slave_ltk = ltk;
765
766 ident.ediv = ediv;
767 ident.rand = rand;
768
769 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
770
771 *keydist &= ~SMP_DIST_ENC_KEY;
772 }
773
774 if (*keydist & SMP_DIST_ID_KEY) {
775 struct smp_cmd_ident_addr_info addrinfo;
776 struct smp_cmd_ident_info idinfo;
777
778 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
779
780 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
781
782 /* The hci_conn contains the local identity address
783 * after the connection has been established.
784 *
785 * This is true even when the connection has been
786 * established using a resolvable random address.
787 */
788 bacpy(&addrinfo.bdaddr, &hcon->src);
789 addrinfo.addr_type = hcon->src_type;
790
791 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
792 &addrinfo);
793
794 *keydist &= ~SMP_DIST_ID_KEY;
795 }
796
797 if (*keydist & SMP_DIST_SIGN) {
798 struct smp_cmd_sign_info sign;
799 struct smp_csrk *csrk;
800
801 /* Generate a new random key */
802 get_random_bytes(sign.csrk, sizeof(sign.csrk));
803
804 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
805 if (csrk) {
806 csrk->master = 0x00;
807 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
808 }
809 smp->slave_csrk = csrk;
810
811 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
812
813 *keydist &= ~SMP_DIST_SIGN;
814 }
815
816 /* If there are still keys to be received wait for them */
b28b4943
JH		 817 if (smp->remote_key_dist & KEY_DIST_MASK) {
818 smp_allow_key_dist(smp);
86d1407c 819 return;
b28b4943 820 }
44f1a7ab 821
44f1a7ab
JH		 822 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
823 smp_notify_keys(conn);
824
825 smp_chan_destroy(conn);
44f1a7ab
JH		 826}
827
b68fda68
JH		 828static void smp_timeout(struct work_struct *work)
829{
830 struct smp_chan *smp = container_of(work, struct smp_chan,
831 security_timer.work);
832 struct l2cap_conn *conn = smp->conn;
833
834 BT_DBG("conn %p", conn);
835
1e91c29e 836 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM);
b68fda68
JH		 837}
838
8aab4757
VCG		 839static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
840{
5d88cc73 841 struct l2cap_chan *chan = conn->smp;
8aab4757
VCG		 842 struct smp_chan *smp;
843
f1560463 844 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
fc75cc86 845 if (!smp)
8aab4757
VCG		 846 return NULL;
847
6a7bd103
JH		 848 smp->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
849 if (IS_ERR(smp->tfm_aes)) {
850 BT_ERR("Unable to create ECB crypto context");
851 kfree(smp);
852 return NULL;
853 }
854
8aab4757 855 smp->conn = conn;
5d88cc73 856 chan->data = smp;
8aab4757 857
b28b4943
JH		 858 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL);
859
b68fda68
JH		 860 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
861
8aab4757
VCG		 862 hci_conn_hold(conn->hcon);
863
864 return smp;
865}
866
2b64d153
BG		 867int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
868{
b10e8017 869 struct l2cap_conn *conn = hcon->l2cap_data;
5d88cc73 870 struct l2cap_chan *chan;
2b64d153
BG		 871 struct smp_chan *smp;
872 u32 value;
fc75cc86 873 int err;
2b64d153
BG		 874
875 BT_DBG("");
876
fc75cc86 877 if (!conn)
2b64d153
BG		 878 return -ENOTCONN;
879
5d88cc73
JH		 880 chan = conn->smp;
881 if (!chan)
882 return -ENOTCONN;
883
fc75cc86
JH		 884 l2cap_chan_lock(chan);
885 if (!chan->data) {
886 err = -ENOTCONN;
887 goto unlock;
888 }
889
5d88cc73 890 smp = chan->data;
2b64d153
BG		 891
892 switch (mgmt_op) {
893 case MGMT_OP_USER_PASSKEY_REPLY:
894 value = le32_to_cpu(passkey);
943a732a 895 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 896 BT_DBG("PassKey: %d", value);
943a732a 897 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 898 /* Fall Through */
899 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 900 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 901 break;
902 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
903 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 904 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 905 err = 0;
906 goto unlock;
2b64d153 907 default:
84794e11 908 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
fc75cc86
JH		 909 err = -EOPNOTSUPP;
910 goto unlock;
2b64d153
BG		 911 }
912
fc75cc86
JH		 913 err = 0;
914
2b64d153 915 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 916 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
917 u8 rsp = smp_confirm(smp);
918 if (rsp)
919 smp_failure(conn, rsp);
920 }
2b64d153 921
fc75cc86
JH		 922unlock:
923 l2cap_chan_unlock(chan);
924 return err;
2b64d153
BG		 925}
926
da85e5e5 927static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 928{
3158c50c 929 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
fc75cc86 930 struct l2cap_chan *chan = conn->smp;
b3c6410b 931 struct hci_dev *hdev = conn->hcon->hdev;
8aab4757 932 struct smp_chan *smp;
c7262e71 933 u8 key_size, auth, sec_level;
8aab4757 934 int ret;
88ba43b6
AB		 935
936 BT_DBG("conn %p", conn);
937
c46b98be 938 if (skb->len < sizeof(*req))
38e4a915 939 return SMP_INVALID_PARAMS;
c46b98be 940
40bef302 941 if (conn->hcon->role != HCI_ROLE_SLAVE)
2b64d153
BG		 942 return SMP_CMD_NOTSUPP;
943
fc75cc86 944 if (!chan->data)
8aab4757 945 smp = smp_chan_create(conn);
fc75cc86 946 else
5d88cc73 947 smp = chan->data;
8aab4757 948
d08fd0e7
AE		 949 if (!smp)
950 return SMP_UNSPECIFIED;
d26a2345 951
b6ae8457 952 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
b3c6410b
JH		 953 (req->auth_req & SMP_AUTH_BONDING))
954 return SMP_PAIRING_NOTSUPP;
955
b28b4943
JH		 956 SMP_DISALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
957
1c1def09
VCG		 958 smp->preq[0] = SMP_CMD_PAIRING_REQ;
959 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 960 skb_pull(skb, sizeof(*req));
88ba43b6 961
2b64d153 962 /* We didn't start the pairing, so match remote */
1ef35827 963 auth = req->auth_req;
da85e5e5 964
c7262e71
JH		 965 sec_level = authreq_to_seclevel(auth);
966 if (sec_level > conn->hcon->pending_sec_level)
967 conn->hcon->pending_sec_level = sec_level;
fdde0a26 968
2ed8f65c
JH		 969 /* If we need MITM check that it can be acheived */
970 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
971 u8 method;
972
973 method = get_auth_method(smp, conn->hcon->io_capability,
974 req->io_capability);
975 if (method == JUST_WORKS || method == JUST_CFM)
976 return SMP_AUTH_REQUIREMENTS;
977 }
978
2b64d153 979 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 980
981 key_size = min(req->max_key_size, rsp.max_key_size);
982 if (check_enc_key_size(conn, key_size))
983 return SMP_ENC_KEY_SIZE;
88ba43b6 984
e84a6b13 985 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 986
1c1def09
VCG		 987 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
988 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 989
3158c50c 990 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
b28b4943 991 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
da85e5e5 992
2b64d153
BG		 993 /* Request setup of TK */
994 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
995 if (ret)
996 return SMP_UNSPECIFIED;
997
da85e5e5 998 return 0;
88ba43b6
AB		 999}
1000
da85e5e5 1001static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1002{
3158c50c 1003 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
5d88cc73
JH		 1004 struct l2cap_chan *chan = conn->smp;
1005 struct smp_chan *smp = chan->data;
2b64d153 1006 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 1007 int ret;
88ba43b6
AB		 1008
1009 BT_DBG("conn %p", conn);
1010
c46b98be 1011 if (skb->len < sizeof(*rsp))
38e4a915 1012 return SMP_INVALID_PARAMS;
c46b98be 1013
40bef302 1014 if (conn->hcon->role != HCI_ROLE_MASTER)
2b64d153
BG		 1015 return SMP_CMD_NOTSUPP;
1016
b28b4943
JH		 1017 SMP_DISALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
1018
3158c50c
VCG		 1019 skb_pull(skb, sizeof(*rsp));
1020
1c1def09 1021 req = (void *) &smp->preq[1];
da85e5e5 1022
3158c50c
VCG		 1023 key_size = min(req->max_key_size, rsp->max_key_size);
1024 if (check_enc_key_size(conn, key_size))
1025 return SMP_ENC_KEY_SIZE;
1026
2ed8f65c
JH		 1027 /* If we need MITM check that it can be acheived */
1028 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1029 u8 method;
1030
1031 method = get_auth_method(smp, req->io_capability,
1032 rsp->io_capability);
1033 if (method == JUST_WORKS || method == JUST_CFM)
1034 return SMP_AUTH_REQUIREMENTS;
1035 }
1036
e84a6b13 1037 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 1038
8aab4757
VCG		 1039 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1040 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 1041
fdcc4bec
JH		 1042 /* Update remote key distribution in case the remote cleared
1043 * some bits that we had enabled in our request.
1044 */
1045 smp->remote_key_dist &= rsp->resp_key_dist;
1046
2b64d153 1047 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 1048 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 1049 auth = SMP_AUTH_BONDING;
1050
1051 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
1052
476585ec 1053 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 1054 if (ret)
1055 return SMP_UNSPECIFIED;
1056
4a74d658 1057 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 1058
1059 /* Can't compose response until we have been confirmed */
4a74d658 1060 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1061 return smp_confirm(smp);
da85e5e5
VCG		 1062
1063 return 0;
88ba43b6
AB		 1064}
1065
da85e5e5 1066static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1067{
5d88cc73
JH		 1068 struct l2cap_chan *chan = conn->smp;
1069 struct smp_chan *smp = chan->data;
7d24ddcc 1070
88ba43b6
AB		 1071 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
1072
c46b98be 1073 if (skb->len < sizeof(smp->pcnf))
38e4a915 1074 return SMP_INVALID_PARAMS;
c46b98be 1075
b28b4943
JH		 1076 SMP_DISALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1077
1c1def09
VCG		 1078 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
1079 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 1080
b28b4943 1081 if (conn->hcon->out) {
943a732a
JH		 1082 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1083 smp->prnd);
b28b4943
JH		 1084 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1085 return 0;
1086 }
1087
1088 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 1089 return smp_confirm(smp);
943a732a 1090 else
4a74d658 1091 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 1092
1093 return 0;
88ba43b6
AB		 1094}
1095
da85e5e5 1096static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 1097{
5d88cc73
JH		 1098 struct l2cap_chan *chan = conn->smp;
1099 struct smp_chan *smp = chan->data;
7d24ddcc 1100
8aab4757 1101 BT_DBG("conn %p", conn);
3158c50c 1102
c46b98be 1103 if (skb->len < sizeof(smp->rrnd))
38e4a915 1104 return SMP_INVALID_PARAMS;
c46b98be 1105
b28b4943
JH		 1106 SMP_DISALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1107
943a732a 1108 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 1109 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 1110
861580a9 1111 return smp_random(smp);
88ba43b6
AB		 1112}
1113
f81cd823 1114static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 1115{
c9839a11 1116 struct smp_ltk *key;
988c5997
VCG		 1117 struct hci_conn *hcon = conn->hcon;
1118
98a0b845 1119 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1120 hcon->role);
988c5997 1121 if (!key)
f81cd823 1122 return false;
988c5997 1123
4dab7864 1124 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
f81cd823 1125 return false;
4dab7864 1126
51a8efd7 1127 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
f81cd823 1128 return true;
988c5997 1129
c9839a11
VCG		 1130 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
1131 hcon->enc_key_size = key->enc_size;
988c5997 1132
fe59a05f
JH		 1133 /* We never store STKs for master role, so clear this flag */
1134 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1135
f81cd823 1136 return true;
988c5997 1137}
f1560463 1138
854f4727
JH		 1139bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
1140{
1141 if (sec_level == BT_SECURITY_LOW)
1142 return true;
1143
9ab65d60
JH		 1144 /* If we're encrypted with an STK always claim insufficient
1145 * security. This way we allow the connection to be re-encrypted
1146 * with an LTK, even if the LTK provides the same level of
b2d5e254
JH		 1147 * security. Only exception is if we don't have an LTK (e.g.
1148 * because of key distribution bits).
9ab65d60 1149 */
b2d5e254
JH		 1150 if (test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
1151 hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 1152 hcon->role))
9ab65d60
JH		 1153 return false;
1154
854f4727
JH		 1155 if (hcon->sec_level >= sec_level)
1156 return true;
1157
1158 return false;
1159}
1160
da85e5e5 1161static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 1162{
1163 struct smp_cmd_security_req *rp = (void *) skb->data;
1164 struct smp_cmd_pairing cp;
f1cb9af5 1165 struct hci_conn *hcon = conn->hcon;
8aab4757 1166 struct smp_chan *smp;
c7262e71 1167 u8 sec_level;
88ba43b6
AB		 1168
1169 BT_DBG("conn %p", conn);
1170
c46b98be 1171 if (skb->len < sizeof(*rp))
38e4a915 1172 return SMP_INVALID_PARAMS;
c46b98be 1173
40bef302 1174 if (hcon->role != HCI_ROLE_MASTER)
86ca9eac
JH		 1175 return SMP_CMD_NOTSUPP;
1176
c7262e71 1177 sec_level = authreq_to_seclevel(rp->auth_req);
854f4727
JH		 1178 if (smp_sufficient_security(hcon, sec_level))
1179 return 0;
1180
c7262e71
JH		 1181 if (sec_level > hcon->pending_sec_level)
1182 hcon->pending_sec_level = sec_level;
feb45eb5 1183
4dab7864 1184 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 1185 return 0;
1186
8aab4757 1187 smp = smp_chan_create(conn);
c29d2444
JH		 1188 if (!smp)
1189 return SMP_UNSPECIFIED;
d26a2345 1190
b6ae8457 1191 if (!test_bit(HCI_BONDABLE, &hcon->hdev->dev_flags) &&
616d55be
JH		 1192 (rp->auth_req & SMP_AUTH_BONDING))
1193 return SMP_PAIRING_NOTSUPP;
1194
88ba43b6 1195 skb_pull(skb, sizeof(*rp));
88ba43b6 1196
da85e5e5 1197 memset(&cp, 0, sizeof(cp));
54790f73 1198 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 1199
1c1def09
VCG		 1200 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1201 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1202
88ba43b6 1203 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
b28b4943 1204 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
f1cb9af5 1205
da85e5e5 1206 return 0;
88ba43b6
AB		 1207}
1208
cc110922 1209int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 1210{
cc110922 1211 struct l2cap_conn *conn = hcon->l2cap_data;
c68b7f12 1212 struct l2cap_chan *chan;
0a66cf20 1213 struct smp_chan *smp;
2b64d153 1214 __u8 authreq;
fc75cc86 1215 int ret;
eb492e01 1216
3a0259bb
VCG		 1217 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
1218
0a66cf20
JH		 1219 /* This may be NULL if there's an unexpected disconnection */
1220 if (!conn)
1221 return 1;
1222
c68b7f12
JH		 1223 chan = conn->smp;
1224
757aee0f 1225 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 1226 return 1;
1227
ad32a2f5 1228 if (smp_sufficient_security(hcon, sec_level))
eb492e01 1229 return 1;
f1cb9af5 1230
c7262e71
JH		 1231 if (sec_level > hcon->pending_sec_level)
1232 hcon->pending_sec_level = sec_level;
1233
40bef302 1234 if (hcon->role == HCI_ROLE_MASTER)
c7262e71
JH		 1235 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
1236 return 0;
d26a2345 1237
fc75cc86
JH		 1238 l2cap_chan_lock(chan);
1239
1240 /* If SMP is already in progress ignore this request */
1241 if (chan->data) {
1242 ret = 0;
1243 goto unlock;
1244 }
d26a2345 1245
8aab4757 1246 smp = smp_chan_create(conn);
fc75cc86
JH		 1247 if (!smp) {
1248 ret = 1;
1249 goto unlock;
1250 }
2b64d153
BG		 1251
1252 authreq = seclevel_to_authreq(sec_level);
d26a2345 1253
79897d20
JH		 1254 /* Require MITM if IO Capability allows or the security level
1255 * requires it.
2e233644 1256 */
79897d20 1257 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 1258 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 1259 authreq |= SMP_AUTH_MITM;
1260
40bef302 1261 if (hcon->role == HCI_ROLE_MASTER) {
d26a2345 1262 struct smp_cmd_pairing cp;
f01ead31 1263
2b64d153 1264 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 1265 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1266 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1267
eb492e01 1268 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
b28b4943 1269 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
eb492e01
AB		 1270 } else {
1271 struct smp_cmd_security_req cp;
2b64d153 1272 cp.auth_req = authreq;
eb492e01 1273 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
b28b4943 1274 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
eb492e01
AB		 1275 }
1276
4a74d658 1277 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
fc75cc86 1278 ret = 0;
edca792c 1279
fc75cc86
JH		 1280unlock:
1281 l2cap_chan_unlock(chan);
1282 return ret;
eb492e01
AB		 1283}
1284
7034b911
VCG		 1285static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
1286{
16b90839 1287 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
5d88cc73
JH		 1288 struct l2cap_chan *chan = conn->smp;
1289 struct smp_chan *smp = chan->data;
16b90839 1290
c46b98be
JH		 1291 BT_DBG("conn %p", conn);
1292
1293 if (skb->len < sizeof(*rp))
38e4a915 1294 return SMP_INVALID_PARAMS;
c46b98be 1295
b28b4943
JH		 1296 SMP_DISALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
1297 SMP_ALLOW_CMD(smp, SMP_CMD_MASTER_IDENT);
6131ddc8 1298
16b90839
VCG		 1299 skb_pull(skb, sizeof(*rp));
1300
1c1def09 1301 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 1302
7034b911
VCG		 1303 return 0;
1304}
1305
1306static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
1307{
16b90839 1308 struct smp_cmd_master_ident *rp = (void *) skb->data;
5d88cc73
JH		 1309 struct l2cap_chan *chan = conn->smp;
1310 struct smp_chan *smp = chan->data;
c9839a11
VCG		 1311 struct hci_dev *hdev = conn->hcon->hdev;
1312 struct hci_conn *hcon = conn->hcon;
23d0e128 1313 struct smp_ltk *ltk;
c9839a11 1314 u8 authenticated;
16b90839 1315
c46b98be
JH		 1316 BT_DBG("conn %p", conn);
1317
1318 if (skb->len < sizeof(*rp))
38e4a915 1319 return SMP_INVALID_PARAMS;
c46b98be 1320
9747a9f3
JH		 1321 /* Mark the information as received */
1322 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1323
b28b4943
JH		 1324 SMP_DISALLOW_CMD(smp, SMP_CMD_MASTER_IDENT);
1325 if (smp->remote_key_dist & SMP_DIST_ID_KEY)
1326 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
196332f5
JH		 1327 else if (smp->remote_key_dist & SMP_DIST_SIGN)
1328 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
b28b4943 1329
16b90839 1330 skb_pull(skb, sizeof(*rp));
7034b911 1331
c9839a11 1332 hci_dev_lock(hdev);
ce39fb4e 1333 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2ceba539 1334 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
23d0e128
JH		 1335 authenticated, smp->tk, smp->enc_key_size,
1336 rp->ediv, rp->rand);
1337 smp->ltk = ltk;
c6e81e9a 1338 if (!(smp->remote_key_dist & KEY_DIST_MASK))
d6268e86 1339 smp_distribute_keys(smp);
c9839a11 1340 hci_dev_unlock(hdev);
7034b911
VCG		 1341
1342 return 0;
1343}
1344
fd349c02
JH		 1345static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1346{
1347 struct smp_cmd_ident_info *info = (void *) skb->data;
5d88cc73
JH		 1348 struct l2cap_chan *chan = conn->smp;
1349 struct smp_chan *smp = chan->data;
fd349c02
JH		 1350
1351 BT_DBG("");
1352
1353 if (skb->len < sizeof(*info))
38e4a915 1354 return SMP_INVALID_PARAMS;
fd349c02 1355
b28b4943
JH		 1356 SMP_DISALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
1357 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
6131ddc8 1358
fd349c02
JH		 1359 skb_pull(skb, sizeof(*info));
1360
1361 memcpy(smp->irk, info->irk, 16);
1362
1363 return 0;
1364}
1365
1366static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1367 struct sk_buff *skb)
1368{
1369 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
5d88cc73
JH		 1370 struct l2cap_chan *chan = conn->smp;
1371 struct smp_chan *smp = chan->data;
fd349c02
JH		 1372 struct hci_conn *hcon = conn->hcon;
1373 bdaddr_t rpa;
1374
1375 BT_DBG("");
1376
1377 if (skb->len < sizeof(*info))
38e4a915 1378 return SMP_INVALID_PARAMS;
fd349c02 1379
9747a9f3
JH		 1380 /* Mark the information as received */
1381 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1382
b28b4943
JH		 1383 SMP_DISALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
1384 if (smp->remote_key_dist & SMP_DIST_SIGN)
1385 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1386
fd349c02
JH		 1387 skb_pull(skb, sizeof(*info));
1388
31dd624e
JH		 1389 hci_dev_lock(hcon->hdev);
1390
a9a58f86
JH		 1391 /* Strictly speaking the Core Specification (4.1) allows sending
1392 * an empty address which would force us to rely on just the IRK
1393 * as "identity information". However, since such
1394 * implementations are not known of and in order to not over
1395 * complicate our implementation, simply pretend that we never
1396 * received an IRK for such a device.
1397 */
1398 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1399 BT_ERR("Ignoring IRK with no identity address");
31dd624e 1400 goto distribute;
a9a58f86
JH		 1401 }
1402
fd349c02
JH		 1403 bacpy(&smp->id_addr, &info->bdaddr);
1404 smp->id_addr_type = info->addr_type;
1405
1406 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1407 bacpy(&rpa, &hcon->dst);
1408 else
1409 bacpy(&rpa, BDADDR_ANY);
1410
23d0e128
JH		 1411 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1412 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1413
31dd624e 1414distribute:
c6e81e9a
JH		 1415 if (!(smp->remote_key_dist & KEY_DIST_MASK))
1416 smp_distribute_keys(smp);
fd349c02 1417
31dd624e
JH		 1418 hci_dev_unlock(hcon->hdev);
1419
fd349c02
JH		 1420 return 0;
1421}
1422
7ee4ea36
MH		 1423static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1424{
1425 struct smp_cmd_sign_info *rp = (void *) skb->data;
5d88cc73
JH		 1426 struct l2cap_chan *chan = conn->smp;
1427 struct smp_chan *smp = chan->data;
7ee4ea36
MH		 1428 struct hci_dev *hdev = conn->hcon->hdev;
1429 struct smp_csrk *csrk;
1430
1431 BT_DBG("conn %p", conn);
1432
1433 if (skb->len < sizeof(*rp))
38e4a915 1434 return SMP_INVALID_PARAMS;
7ee4ea36 1435
7ee4ea36
MH		 1436 /* Mark the information as received */
1437 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1438
b28b4943
JH		 1439 SMP_DISALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1440
7ee4ea36
MH		 1441 skb_pull(skb, sizeof(*rp));
1442
1443 hci_dev_lock(hdev);
1444 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1445 if (csrk) {
1446 csrk->master = 0x01;
1447 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1448 }
1449 smp->csrk = csrk;
d6268e86 1450 smp_distribute_keys(smp);
7ee4ea36
MH		 1451 hci_dev_unlock(hdev);
1452
1453 return 0;
1454}
1455
4befb867 1456static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
eb492e01 1457{
5d88cc73 1458 struct l2cap_conn *conn = chan->conn;
7b9899db 1459 struct hci_conn *hcon = conn->hcon;
b28b4943 1460 struct smp_chan *smp;
92381f5c 1461 __u8 code, reason;
eb492e01
AB		 1462 int err = 0;
1463
7b9899db
MH		 1464 if (hcon->type != LE_LINK) {
1465 kfree_skb(skb);
3432711f 1466 return 0;
7b9899db
MH		 1467 }
1468
8ae9b984 1469 if (skb->len < 1)
92381f5c 1470 return -EILSEQ;
92381f5c 1471
06ae3314 1472 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
2e65c9d2
AG		 1473 reason = SMP_PAIRING_NOTSUPP;
1474 goto done;
1475 }
1476
92381f5c 1477 code = skb->data[0];
eb492e01
AB		 1478 skb_pull(skb, sizeof(code));
1479
b28b4943
JH		 1480 smp = chan->data;
1481
1482 if (code > SMP_CMD_MAX)
1483 goto drop;
1484
1485 if (smp && !test_bit(code, &smp->allow_cmd))
1486 goto drop;
1487
1488 /* If we don't have a context the only allowed commands are
1489 * pairing request and security request.
8cf9fa12 1490 */
b28b4943
JH		 1491 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ)
1492 goto drop;
8cf9fa12 1493
eb492e01
AB		 1494 switch (code) {
1495 case SMP_CMD_PAIRING_REQ:
da85e5e5 1496 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1497 break;
1498
1499 case SMP_CMD_PAIRING_FAIL:
84794e11 1500 smp_failure(conn, 0);
da85e5e5 1501 err = -EPERM;
eb492e01
AB		 1502 break;
1503
1504 case SMP_CMD_PAIRING_RSP:
da85e5e5 1505 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1506 break;
1507
1508 case SMP_CMD_SECURITY_REQ:
da85e5e5 1509 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1510 break;
1511
eb492e01 1512 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1513 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1514 break;
1515
eb492e01 1516 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1517 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1518 break;
1519
eb492e01 1520 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1521 reason = smp_cmd_encrypt_info(conn, skb);
1522 break;
1523
eb492e01 1524 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1525 reason = smp_cmd_master_ident(conn, skb);
1526 break;
1527
eb492e01 1528 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1529 reason = smp_cmd_ident_info(conn, skb);
1530 break;
1531
eb492e01 1532 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1533 reason = smp_cmd_ident_addr_info(conn, skb);
1534 break;
1535
eb492e01 1536 case SMP_CMD_SIGN_INFO:
7ee4ea36 1537 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1538 break;
1539
eb492e01
AB		 1540 default:
1541 BT_DBG("Unknown command code 0x%2.2x", code);
eb492e01 1542 reason = SMP_CMD_NOTSUPP;
3a0259bb 1543 goto done;
eb492e01
AB		 1544 }
1545
3a0259bb 1546done:
9b7b18ef
JH		 1547 if (!err) {
1548 if (reason)
1549 smp_failure(conn, reason);
8ae9b984 1550 kfree_skb(skb);
9b7b18ef
JH		 1551 }
1552
eb492e01 1553 return err;
b28b4943
JH		 1554
1555drop:
1556 BT_ERR("%s unexpected SMP command 0x%02x from %pMR", hcon->hdev->name,
1557 code, &hcon->dst);
1558 kfree_skb(skb);
1559 return 0;
eb492e01 1560}
7034b911 1561
70db83c4
JH		 1562static void smp_teardown_cb(struct l2cap_chan *chan, int err)
1563{
1564 struct l2cap_conn *conn = chan->conn;
1565
1566 BT_DBG("chan %p", chan);
1567
fc75cc86 1568 if (chan->data)
5d88cc73 1569 smp_chan_destroy(conn);
5d88cc73 1570
70db83c4
JH		 1571 conn->smp = NULL;
1572 l2cap_chan_put(chan);
1573}
1574
44f1a7ab
JH		 1575static void smp_resume_cb(struct l2cap_chan *chan)
1576{
b68fda68 1577 struct smp_chan *smp = chan->data;
44f1a7ab
JH		 1578 struct l2cap_conn *conn = chan->conn;
1579 struct hci_conn *hcon = conn->hcon;
1580
1581 BT_DBG("chan %p", chan);
1582
86d1407c
JH		 1583 if (!smp)
1584 return;
b68fda68 1585
84bc0db5
JH		 1586 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
1587 return;
1588
86d1407c
JH		 1589 cancel_delayed_work(&smp->security_timer);
1590
d6268e86 1591 smp_distribute_keys(smp);
44f1a7ab
JH		 1592}
1593
70db83c4
JH		 1594static void smp_ready_cb(struct l2cap_chan *chan)
1595{
1596 struct l2cap_conn *conn = chan->conn;
1597
1598 BT_DBG("chan %p", chan);
1599
1600 conn->smp = chan;
1601 l2cap_chan_hold(chan);
1602}
1603
4befb867
JH		 1604static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1605{
1606 int err;
1607
1608 BT_DBG("chan %p", chan);
1609
1610 err = smp_sig_channel(chan, skb);
1611 if (err) {
b68fda68 1612 struct smp_chan *smp = chan->data;
4befb867 1613
b68fda68
JH		 1614 if (smp)
1615 cancel_delayed_work_sync(&smp->security_timer);
4befb867 1616
1e91c29e 1617 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
4befb867
JH		 1618 }
1619
1620 return err;
1621}
1622
70db83c4
JH		 1623static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
1624 unsigned long hdr_len,
1625 unsigned long len, int nb)
1626{
1627 struct sk_buff *skb;
1628
1629 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
1630 if (!skb)
1631 return ERR_PTR(-ENOMEM);
1632
1633 skb->priority = HCI_PRIO_MAX;
1634 bt_cb(skb)->chan = chan;
1635
1636 return skb;
1637}
1638
1639static const struct l2cap_ops smp_chan_ops = {
1640 .name = "Security Manager",
1641 .ready = smp_ready_cb,
5d88cc73 1642 .recv = smp_recv_cb,
70db83c4
JH		 1643 .alloc_skb = smp_alloc_skb_cb,
1644 .teardown = smp_teardown_cb,
44f1a7ab 1645 .resume = smp_resume_cb,
70db83c4
JH		 1646
1647 .new_connection = l2cap_chan_no_new_connection,
70db83c4
JH		 1648 .state_change = l2cap_chan_no_state_change,
1649 .close = l2cap_chan_no_close,
1650 .defer = l2cap_chan_no_defer,
1651 .suspend = l2cap_chan_no_suspend,
70db83c4
JH		 1652 .set_shutdown = l2cap_chan_no_set_shutdown,
1653 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1654 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1655};
1656
1657static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
1658{
1659 struct l2cap_chan *chan;
1660
1661 BT_DBG("pchan %p", pchan);
1662
1663 chan = l2cap_chan_create();
1664 if (!chan)
1665 return NULL;
1666
1667 chan->chan_type = pchan->chan_type;
1668 chan->ops = &smp_chan_ops;
1669 chan->scid = pchan->scid;
1670 chan->dcid = chan->scid;
1671 chan->imtu = pchan->imtu;
1672 chan->omtu = pchan->omtu;
1673 chan->mode = pchan->mode;
1674
1675 BT_DBG("created chan %p", chan);
1676
1677 return chan;
1678}
1679
1680static const struct l2cap_ops smp_root_chan_ops = {
1681 .name = "Security Manager Root",
1682 .new_connection = smp_new_conn_cb,
1683
1684 /* None of these are implemented for the root channel */
1685 .close = l2cap_chan_no_close,
1686 .alloc_skb = l2cap_chan_no_alloc_skb,
1687 .recv = l2cap_chan_no_recv,
1688 .state_change = l2cap_chan_no_state_change,
1689 .teardown = l2cap_chan_no_teardown,
1690 .ready = l2cap_chan_no_ready,
1691 .defer = l2cap_chan_no_defer,
1692 .suspend = l2cap_chan_no_suspend,
1693 .resume = l2cap_chan_no_resume,
1694 .set_shutdown = l2cap_chan_no_set_shutdown,
1695 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1696 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1697};
1698
711eafe3
JH		 1699int smp_register(struct hci_dev *hdev)
1700{
70db83c4 1701 struct l2cap_chan *chan;
defce9e8 1702 struct crypto_blkcipher *tfm_aes;
70db83c4 1703
711eafe3
JH		 1704 BT_DBG("%s", hdev->name);
1705
defce9e8
JH		 1706 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1707 if (IS_ERR(tfm_aes)) {
1708 int err = PTR_ERR(tfm_aes);
711eafe3 1709 BT_ERR("Unable to create crypto context");
711eafe3
JH		 1710 return err;
1711 }
1712
70db83c4
JH		 1713 chan = l2cap_chan_create();
1714 if (!chan) {
defce9e8 1715 crypto_free_blkcipher(tfm_aes);
70db83c4
JH		 1716 return -ENOMEM;
1717 }
1718
defce9e8
JH		 1719 chan->data = tfm_aes;
1720
5d88cc73 1721 l2cap_add_scid(chan, L2CAP_CID_SMP);
70db83c4
JH		 1722
1723 l2cap_chan_set_defaults(chan);
1724
1725 bacpy(&chan->src, &hdev->bdaddr);
1726 chan->src_type = BDADDR_LE_PUBLIC;
1727 chan->state = BT_LISTEN;
1728 chan->mode = L2CAP_MODE_BASIC;
1729 chan->imtu = L2CAP_DEFAULT_MTU;
1730 chan->ops = &smp_root_chan_ops;
1731
1732 hdev->smp_data = chan;
1733
711eafe3
JH		 1734 return 0;
1735}
1736
1737void smp_unregister(struct hci_dev *hdev)
1738{
70db83c4 1739 struct l2cap_chan *chan = hdev->smp_data;
defce9e8 1740 struct crypto_blkcipher *tfm_aes;
70db83c4
JH		 1741
1742 if (!chan)
1743 return;
1744
1745 BT_DBG("%s chan %p", hdev->name, chan);
711eafe3 1746
defce9e8
JH		 1747 tfm_aes = chan->data;
1748 if (tfm_aes) {
1749 chan->data = NULL;
1750 crypto_free_blkcipher(tfm_aes);
711eafe3 1751 }
70db83c4
JH		 1752
1753 hdev->smp_data = NULL;
1754 l2cap_chan_put(chan);
711eafe3 1755}
Linux kernel - Deliverables
This page took 0.287145 seconds and 5 git commands to generate.